Skip to content

Commit f189033

Browse files
author
Tod Beardsley
committed
OWA bruteforce shouldnt edit datastore (@wchen-r7)
This module was written in an era where the defaults for bruteforcing included a lot of lock-inducing behavior, thus, it was quite serious about setting datastore options directly. Also, there was apparently a bug in USER_AS_PASS that this module attempted to avoid by setting the datastore directly, rather than fixing the bug directly. As far as I know, this bug has been long since resolved.
1 parent dc7ec45 commit f189033

File tree

1 file changed

+0
-19
lines changed

1 file changed

+0
-19
lines changed

modules/auxiliary/scanner/http/owa_login.rb

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -93,26 +93,7 @@ def initialize
9393
deregister_options('BLANK_PASSWORDS', 'RHOSTS','PASSWORD','USERNAME')
9494
end
9595

96-
def cleanup
97-
# Restore the original settings
98-
datastore['BLANK_PASSWORDS'] = @blank_passwords_setting
99-
datastore['USER_AS_PASS'] = @user_as_pass_setting
100-
end
101-
10296
def run
103-
# Store the original setting
104-
@blank_passwords_setting = datastore['BLANK_PASSWORDS']
105-
106-
# OWA doesn't support blank passwords or usernames!
107-
datastore['BLANK_PASSWORDS'] = false
108-
109-
# If there's a pre-defined username/password, we need to turn off USER_AS_PASS
110-
# so that the module won't just try username:username, and then exit.
111-
@user_as_pass_setting = datastore['USER_AS_PASS']
112-
if not datastore['USERNAME'].nil? and not datastore['PASSWORD'].nil?
113-
print_status("Disabling 'USER_AS_PASS' because you've specified an username/password")
114-
datastore['USER_AS_PASS'] = false
115-
end
11697

11798
vhost = datastore['VHOST'] || datastore['RHOST']
11899

0 commit comments

Comments
 (0)