Skip to content

Commit bcdea05

Browse files
author
Pedro Ribeiro
committed
Merge pull request #1 from rapid7/master
Update from original
2 parents 0c9daff + b3e8987 commit bcdea05

File tree

97 files changed

+2820
-1300
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

97 files changed

+2820
-1300
lines changed

‎Gemfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ group :db do
77
# Needed for Msf::DbManager
88
gem 'activerecord', '>= 3.0.0', '< 4.0.0'
99
# Metasploit::Credential database models
10-
gem 'metasploit-credential', '>= 0.8.6', '< 0.9'
10+
gem 'metasploit-credential', '>= 0.9.0'
1111
# Database models shared between framework and Pro.
1212
gem 'metasploit_data_models', '~> 0.19'
1313
# Needed for module caching in Mdm::ModuleDetails

‎Gemfile.lock

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ PATH
77
bcrypt
88
json
99
metasploit-model (~> 0.26.1)
10-
meterpreter_bins (= 0.0.6)
10+
meterpreter_bins (= 0.0.7)
1111
msgpack
1212
nokogiri
1313
packetfu (= 1.1.9)
@@ -62,7 +62,7 @@ GEM
6262
json (1.8.1)
6363
metasploit-concern (0.1.1)
6464
activesupport (~> 3.0, >= 3.0.0)
65-
metasploit-credential (0.8.6)
65+
metasploit-credential (0.9.0)
6666
metasploit-concern (~> 0.1.0)
6767
metasploit-model (~> 0.26.1)
6868
metasploit_data_models (~> 0.19.4)
@@ -78,7 +78,7 @@ GEM
7878
metasploit-concern (~> 0.1.0)
7979
metasploit-model (~> 0.26.1)
8080
pg
81-
meterpreter_bins (0.0.6)
81+
meterpreter_bins (0.0.7)
8282
method_source (0.8.2)
8383
mini_portile (0.6.0)
8484
msgpack (0.5.8)
@@ -160,7 +160,7 @@ DEPENDENCIES
160160
factory_girl (>= 4.1.0)
161161
factory_girl_rails
162162
fivemat (= 1.2.1)
163-
metasploit-credential (>= 0.8.6, < 0.9)
163+
metasploit-credential (>= 0.9.0)
164164
metasploit-framework!
165165
metasploit_data_models (~> 0.19)
166166
network_interface (~> 0.0.1)

‎lib/metasploit/framework/credential.rb

+14
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,20 @@ def to_credential
9191
self
9292
end
9393

94+
# This method takes all of the attributes of the {Credential} and spits
95+
# them out in a hash compatible with the create_credential calls.
96+
#
97+
# @return [Hash] a hash compatible with #create_credential
98+
def to_h
99+
{
100+
private_data: private,
101+
private_type: private_type,
102+
username: public,
103+
realm_key: realm_key,
104+
realm_value: realm
105+
}
106+
end
107+
94108
private
95109

96110
def at_realm

‎lib/metasploit/framework/credential_collection.rb

+18-8
Original file line numberDiff line numberDiff line change
@@ -86,18 +86,18 @@ def each
8686

8787
if username.present?
8888
if password.present?
89-
yield Metasploit::Framework::Credential.new(public: username, private: password, realm: realm)
89+
yield Metasploit::Framework::Credential.new(public: username, private: password, realm: realm, private_type: private_type(password))
9090
end
9191
if user_as_pass
92-
yield Metasploit::Framework::Credential.new(public: username, private: username, realm: realm)
92+
yield Metasploit::Framework::Credential.new(public: username, private: username, realm: realm, private_type: :password)
9393
end
9494
if blank_passwords
95-
yield Metasploit::Framework::Credential.new(public: username, private: "", realm: realm)
95+
yield Metasploit::Framework::Credential.new(public: username, private: "", realm: realm, private_type: :password)
9696
end
9797
if pass_fd
9898
pass_fd.each_line do |pass_from_file|
9999
pass_from_file.chomp!
100-
yield Metasploit::Framework::Credential.new(public: username, private: pass_from_file, realm: realm)
100+
yield Metasploit::Framework::Credential.new(public: username, private: pass_from_file, realm: realm, private_type: private_type(pass_from_file))
101101
end
102102
pass_fd.seek(0)
103103
end
@@ -108,18 +108,18 @@ def each
108108
user_fd.each_line do |user_from_file|
109109
user_from_file.chomp!
110110
if password
111-
yield Metasploit::Framework::Credential.new(public: user_from_file, private: password, realm: realm)
111+
yield Metasploit::Framework::Credential.new(public: user_from_file, private: password, realm: realm, private_type: private_type(password) )
112112
end
113113
if user_as_pass
114-
yield Metasploit::Framework::Credential.new(public: user_from_file, private: user_from_file, realm: realm)
114+
yield Metasploit::Framework::Credential.new(public: user_from_file, private: user_from_file, realm: realm, private_type: :password)
115115
end
116116
if blank_passwords
117-
yield Metasploit::Framework::Credential.new(public: user_from_file, private: "", realm: realm)
117+
yield Metasploit::Framework::Credential.new(public: user_from_file, private: "", realm: realm, private_type: :password)
118118
end
119119
if pass_fd
120120
pass_fd.each_line do |pass_from_file|
121121
pass_from_file.chomp!
122-
yield Metasploit::Framework::Credential.new(public: user_from_file, private: pass_from_file, realm: realm)
122+
yield Metasploit::Framework::Credential.new(public: user_from_file, private: pass_from_file, realm: realm, private_type: private_type(pass_from_file))
123123
end
124124
pass_fd.seek(0)
125125
end
@@ -145,4 +145,14 @@ def each
145145
pass_fd.close if pass_fd && !pass_fd.closed?
146146
end
147147

148+
private
149+
150+
def private_type(private)
151+
if private =~ /[0-9a-f]{32}:[0-9a-f]{32}/
152+
:ntlm_hash
153+
else
154+
:password
155+
end
156+
end
157+
148158
end

‎lib/metasploit/framework/login_scanner/afp.rb

+6-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,12 @@ def attempt_login(credential)
3535
status = (success == true) ? Metasploit::Model::Login::Status::SUCCESSFUL : Metasploit::Model::Login::Status::INCORRECT
3636
end
3737

38-
Result.new(credential: credential, status: status)
38+
result = Result.new(credential: credential, status: status)
39+
result.host = host
40+
result.port = port
41+
result.protocol = 'tcp'
42+
result.service_name = 'afp'
43+
result
3944
end
4045

4146
def set_sane_defaults

‎lib/metasploit/framework/login_scanner/axis2.rb

+10-1
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,17 @@ def attempt_login(credential)
2121
)
2222

2323
result_opts = {
24-
credential: credential
24+
credential: credential,
25+
host: host,
26+
port: port,
27+
protocol: 'tcp'
2528
}
29+
if ssl
30+
result_opts[:service_name] = 'https'
31+
else
32+
result_opts[:service_name] = 'http'
33+
end
34+
2635
begin
2736
http_client.connect
2837
body = "userName=#{Rex::Text.uri_encode(credential.public)}&password=#{Rex::Text.uri_encode(credential.private)}&submit=+Login+"

‎lib/metasploit/framework/login_scanner/db2.rb

+6-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,12 @@ def attempt_login(credential)
4646
})
4747
end
4848

49-
::Metasploit::Framework::LoginScanner::Result.new(result_options)
49+
result = ::Metasploit::Framework::LoginScanner::Result.new(result_options)
50+
result.host = host
51+
result.port = port
52+
result.protocol = 'tcp'
53+
result.service_name = 'db2'
54+
result
5055
end
5156

5257
private

‎lib/metasploit/framework/login_scanner/ftp.rb

+6-2
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,12 @@ def attempt_login(credential)
5353
result_options[:status] = Metasploit::Model::Login::Status::INCORRECT
5454
end
5555

56-
::Metasploit::Framework::LoginScanner::Result.new(result_options)
57-
56+
result = ::Metasploit::Framework::LoginScanner::Result.new(result_options)
57+
result.host = host
58+
result.port = port
59+
result.protocol = 'tcp'
60+
result.service_name = 'ftp'
61+
result
5862
end
5963

6064
private

‎lib/metasploit/framework/login_scanner/http.rb

+10-1
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,18 @@ def attempt_login(credential)
4646
result_opts = {
4747
credential: credential,
4848
status: Metasploit::Model::Login::Status::INCORRECT,
49-
proof: nil
49+
proof: nil,
50+
host: host,
51+
port: port,
52+
protocol: 'tcp'
5053
}
5154

55+
if ssl
56+
result_opts[:service_name] = 'https'
57+
else
58+
result_opts[:service_name] = 'http'
59+
end
60+
5261
http_client = Rex::Proto::Http::Client.new(
5362
host, port, {}, ssl, ssl_version,
5463
nil, credential.public, credential.private

‎lib/metasploit/framework/login_scanner/mssql.rb

+5-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,11 @@ class MSSQL
3434

3535
def attempt_login(credential)
3636
result_options = {
37-
credential: credential
37+
credential: credential,
38+
host: host,
39+
port: port,
40+
protocol: 'tcp',
41+
service_name: 'mssql'
3842
}
3943

4044
begin

‎lib/metasploit/framework/login_scanner/mysql.rb

+5-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,11 @@ class MySQL
2323

2424
def attempt_login(credential)
2525
result_options = {
26-
credential: credential
26+
credential: credential,
27+
host: host,
28+
port: port,
29+
protocol: 'tcp',
30+
service_name: 'mysql'
2731
}
2832

2933
# manage our behind the scenes socket. Close any existing one and open a new one

‎lib/metasploit/framework/login_scanner/pop3.rb

+5-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,11 @@ class POP3
2626
def attempt_login(credential)
2727
result_options = {
2828
credential: credential,
29-
status: Metasploit::Model::Login::Status::INCORRECT
29+
status: Metasploit::Model::Login::Status::INCORRECT,
30+
host: host,
31+
port: port,
32+
protocol: 'tcp',
33+
service_name: 'pop3'
3034
}
3135

3236
disconnect if self.sock

‎lib/metasploit/framework/login_scanner/postgres.rb

+5-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,11 @@ class Postgres
2323
# @return [Metasploit::Framework::LoginScanner::Result] The LoginScanner Result object
2424
def attempt_login(credential)
2525
result_options = {
26-
credential: credential
26+
credential: credential,
27+
host: host,
28+
port: port,
29+
protocol: 'tcp',
30+
service_name: 'postgres'
2731
}
2832

2933
db_name = credential.realm || 'template1'

‎lib/metasploit/framework/login_scanner/result.rb

+49-22
Original file line numberDiff line numberDiff line change
@@ -8,43 +8,70 @@ module LoginScanner
88
class Result
99
include ActiveModel::Validations
1010

11-
# @!attribute [r] access_level
11+
# @!attribute access_level
1212
# @return [String] the access level gained
13-
attr_reader :access_level
14-
# @!attribute [r] credential
13+
attr_accessor :access_level
14+
# @!attribute credential
1515
# @return [Credential] the Credential object the result is for
16-
attr_reader :credential
17-
# @!attribute [r] proof
18-
# @return [String,nil] the proof that the lgoin was successful
19-
attr_reader :proof
20-
# @!attribute [r] status
16+
attr_accessor :credential
17+
# @!attribute host
18+
# @return [String] the addess of the target host for this result
19+
attr_accessor :host
20+
# @!attribute port
21+
# @return [Fixnum] the port number of the service for this result
22+
attr_accessor :port
23+
# @!attribute proof
24+
# @return [String,nil] the proof that the login was successful
25+
attr_accessor :proof
26+
# @!attribute protocol
27+
# @return [String] the transport protocol used for this result (tcp/udp)
28+
attr_accessor :protocol
29+
# @!attribute service_name
30+
# @return [String] the name to give the service for this result
31+
attr_accessor :service_name
32+
# @!attribute status
2133
# @return [String] the status of the attempt. Should be a member of `Metasploit::Model::Login::Status::ALL`
22-
attr_reader :status
34+
attr_accessor :status
2335

2436
validates :status,
2537
inclusion: {
2638
in: Metasploit::Model::Login::Status::ALL
2739
}
2840

29-
# @param [Hash] opts The options hash for the initializer
30-
# @option opts [String] :private The private credential component
31-
# @option opts [String] :proof The proof that the login was successful
32-
# @option opts [String] :public The public credential component
33-
# @option opts [String] :realm The realm credential component
34-
# @option opts [String] :status The status code returned
35-
def initialize(opts= {})
36-
@access_level = opts.fetch(:access_level, nil)
37-
@credential = opts.fetch(:credential)
38-
@proof = opts.fetch(:proof, nil)
39-
@status = opts.fetch(:status)
41+
# @param attributes [Hash{Symbol => String,nil}]
42+
def initialize(attributes={})
43+
attributes.each do |attribute, value|
44+
public_send("#{attribute}=", value)
45+
end
46+
end
47+
48+
def inspect
49+
"#<#{self.class} #{credential.public}:#{credential.private}@#{credential.realm} #{status} >"
4050
end
4151

4252
def success?
4353
status == Metasploit::Model::Login::Status::SUCCESSFUL
4454
end
4555

46-
def inspect
47-
"#<#{self.class} #{credential.public}:#{credential.private}@#{credential.realm} #{status} >"
56+
# This method takes all the data inside the Result object
57+
# and spits out a hash compatible with #create_credential
58+
# and #create_credential_login.
59+
#
60+
# @return [Hash] the hash to use with #create_credential and #create_credential_login
61+
def to_h
62+
result_hash = credential.to_h
63+
result_hash.merge!(
64+
access_level: access_level,
65+
address: host,
66+
last_attempted_at: DateTime.now,
67+
origin_type: :service,
68+
port: port,
69+
proof: proof,
70+
protocol: protocol,
71+
service_name: service_name,
72+
status: status
73+
)
74+
result_hash.delete_if { |k,v| v.nil? }
4875
end
4976

5077
end

‎lib/metasploit/framework/login_scanner/smb.rb

+6-1
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,12 @@ def attempt_login(credential)
212212
access_level ||= AccessLevels::GUEST
213213
end
214214

215-
Result.new(credential: credential, status: status, proof: proof, access_level: access_level)
215+
result = Result.new(credential: credential, status: status, proof: proof, access_level: access_level)
216+
result.host = host
217+
result.port = port
218+
result.protocol = 'tcp'
219+
result.service_name = 'smb'
220+
result
216221
end
217222

218223
def connect

‎lib/metasploit/framework/login_scanner/snmp.rb

+5-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@ class SNMP
2222
# @return [Metasploit::Framework::LoginScanner::Result] The LoginScanner Result object
2323
def attempt_login(credential)
2424
result_options = {
25-
credential: credential
25+
credential: credential,
26+
host: host,
27+
port: port,
28+
protocol: 'udp',
29+
service_name: 'snmp'
2630
}
2731

2832
[:SNMPv1, :SNMPv2c].each do |version|

‎lib/metasploit/framework/login_scanner/ssh.rb

+6-1
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,12 @@ def attempt_login(credential)
9393
end
9494
end
9595

96-
::Metasploit::Framework::LoginScanner::Result.new(result_options)
96+
result = ::Metasploit::Framework::LoginScanner::Result.new(result_options)
97+
result.host = host
98+
result.port = port
99+
result.protocol = 'tcp'
100+
result.service_name = 'ssh'
101+
result
97102
end
98103

99104
private

0 commit comments

Comments
 (0)