BasicAuth datastore cleanup
cleanup all the old BasicAuth datastore optionsbug/bundler_fix
parent
8b1febb4cf
commit
4c1e630bf3
|
@ -26,7 +26,7 @@ class Metasploit3 < Msf::Auxiliary
|
|||
'Name' => 'Cisco Device HTTP Device Manager Access',
|
||||
'Description' => %q{
|
||||
This module gathers data from a Cisco device (router or switch) with the device manager
|
||||
web interface exposed. The BasicAuthUser and BasicAuthPass options can be used to specify
|
||||
web interface exposed. The USERNAME and PASSWORD options can be used to specify
|
||||
authentication.
|
||||
},
|
||||
'Author' => [ 'hdm' ],
|
||||
|
@ -61,7 +61,7 @@ class Metasploit3 < Msf::Auxiliary
|
|||
print_good("#{rhost}:#{rport} Successfully authenticated to this device")
|
||||
|
||||
# Report a vulnerability only if no password was specified
|
||||
if datastore['BasicAuthPass'].to_s.length == 0
|
||||
if datastore['PASSWORD'].to_s.length == 0
|
||||
|
||||
report_vuln(
|
||||
{
|
||||
|
|
|
@ -72,8 +72,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('BasicAuthUser', [true, 'The HTTP username to specify for basic authentication', 'piranha']),
|
||||
OptString.new('BasicAuthPass', [true, 'The HTTP password to specify for basic authentication', 'q']),
|
||||
OptString.new('USERNAME', [true, 'The HTTP username to specify for basic authentication', 'piranha']),
|
||||
OptString.new('PASSWORD', [true, 'The HTTP password to specify for basic authentication', 'q']),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
@ -96,7 +96,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if res.code == 401
|
||||
print_error("401 Authorization Required! Our BasicAuthUser and BasicAuthPass credentials not accepted!")
|
||||
print_error("401 Authorization Required! Our credentials were not accepted!")
|
||||
elsif (res.code == 200 and res.body =~ /The passwords you supplied match/)
|
||||
print_status("Command successfully executed (according to the server).")
|
||||
end
|
||||
|
|
|
@ -227,9 +227,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
authmsg = res.headers['WWW-Authenticate']
|
||||
end
|
||||
print_error("The remote server responded expecting authentication")
|
||||
if datastore['BasicAuthUser'] and datastore['BasicAuthPass']
|
||||
print_error("BasicAuthUser \"%s\" failed to authenticate" % datastore['BasicAuthUser'])
|
||||
elsif authmsg
|
||||
if authmsg
|
||||
print_error("WWW-Authenticate: %s" % authmsg)
|
||||
end
|
||||
cleanup_instructions(rpath, name) # display cleanup info
|
||||
|
|
|
@ -96,9 +96,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
|
||||
def exploit
|
||||
datastore['BasicAuthUser'] = datastore['USERNAME']
|
||||
datastore['BasicAuthPass'] = datastore['PASSWORD']
|
||||
|
||||
jsp_name = datastore['JSP'] || rand_text_alpha(8+rand(8))
|
||||
app_base = datastore['APPBASE'] || rand_text_alpha(8+rand(8))
|
||||
|
||||
|
|
|
@ -123,9 +123,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
|
||||
def exploit
|
||||
datastore['BasicAuthUser'] = datastore['USERNAME']
|
||||
datastore['BasicAuthPass'] = datastore['PASSWORD']
|
||||
|
||||
jsp_name = datastore['JSP'] || rand_text_alpha(8+rand(8))
|
||||
app_base = datastore['APPBASE'] || rand_text_alpha(8+rand(8))
|
||||
|
||||
|
|
|
@ -112,9 +112,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
def check
|
||||
datastore['BasicAuthUser'] = datastore['USERNAME']
|
||||
datastore['BasicAuthPass'] = datastore['PASSWORD']
|
||||
|
||||
res = query_serverinfo
|
||||
disconnect
|
||||
return CheckCode::Unknown if res.nil?
|
||||
|
@ -127,8 +124,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
:host => rhost,
|
||||
:port => rport,
|
||||
:sname => (ssl ? "https" : "http"),
|
||||
:user => datastore['BasicAuthUser'],
|
||||
:pass => datastore['BasicAuthPass'],
|
||||
:user => datastore['USERNAME'],
|
||||
:pass => datastore['PASSWORD'],
|
||||
:proof => "WEBAPP=\"Tomcat Manager App\", VHOST=#{vhost}, PATH=#{datastore['PATH']}",
|
||||
:active => true
|
||||
)
|
||||
|
@ -164,9 +161,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
|
||||
def exploit
|
||||
datastore['BasicAuthUser'] = datastore['USERNAME']
|
||||
datastore['BasicAuthPass'] = datastore['PASSWORD']
|
||||
|
||||
mytarget = target
|
||||
if (target.name =~ /Automatic/)
|
||||
mytarget = auto_target
|
||||
|
@ -221,8 +215,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
:host => rhost,
|
||||
:port => rport,
|
||||
:sname => (ssl ? "https" : "http"),
|
||||
:user => datastore['BasicAuthUser'],
|
||||
:pass => datastore['BasicAuthPass'],
|
||||
:user => datastore['USERNAME'],
|
||||
:pass => datastore['PASSWORD'],
|
||||
:proof => "WEBAPP=\"Tomcat Manager App\", VHOST=#{vhost}, PATH=#{datastore['PATH']}",
|
||||
:active => true
|
||||
)
|
||||
|
|
|
@ -67,9 +67,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
def go(command)
|
||||
datastore['BasicAuthUser'] = datastore['USERNAME']
|
||||
datastore['BasicAuthPass'] = datastore['PASSWORD']
|
||||
|
||||
xml = <<-EOS
|
||||
<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
|
|
|
@ -72,8 +72,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('BasicAuthUser', [true, 'The HTTP username to specify for basic authentication', 'anonymous']),
|
||||
OptString.new('BasicAuthPass', [true, 'The HTTP password to specify for basic authentication', 'mozilla@example.com']),
|
||||
OptString.new('USERNAME', [true, 'The HTTP username to specify for basic authentication', 'anonymous']),
|
||||
OptString.new('PASSWORD', [true, 'The HTTP password to specify for basic authentication', 'mozilla@example.com']),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
|
Loading…
Reference in New Issue