infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix to the username normalisation routine to deal with creds that 

have no username (i.e. VNC)
unstable
David Maloney 2011-11-15 08:52:18 -08:00
parent 8d47883af0
commit 6306f8888a
1 changed files with 23 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
lib/msf/core/db.rb
View File

@ -973,25 +973,37 @@ class DBManager
ret = {} ret = {}
#Check to see if the creds already exist. We look also for a downcased username with the
#same password because we can fairly safely assume they are not in fact two seperate creds.
#this allows us to hedge against duplication of creds in the DB.
if duplicate_ok
# If duplicate usernames are okay, find by both user and password (allows # If duplicate usernames are okay, find by both user and password (allows
# for actual duplicates to get modified updated_at, sources, etc) # for actual duplicates to get modified updated_at, sources, etc)
if duplicate_ok if token[0].nil? or token[0].empty?
cred = service.creds.find_by_user_and_ptype_and_pass(token[0] || "", ptype, token[1] || "") cred = service.creds.find_or_initalize_by_user_and_ptype_and_pass(token[0] || "", ptype, token[1] || "")
unless cred else
dcu = token[0].downcase cred = service.creds.find_by_user_and_ptype_and_pass(token[0] || "", ptype, token[1] || "")
cred = service.creds.find_by_user_and_ptype_and_pass( dcu || "", ptype, token[1] || "")
unless cred unless cred
cred = service.creds.find_or_initalize_by_user_and_ptype_and_pass(token[0] || "", ptype, token[1] || "") dcu = token[0].downcase
cred = service.creds.find_by_user_and_ptype_and_pass( dcu || "", ptype, token[1] || "")
unless cred
cred = service.creds.find_or_initalize_by_user_and_ptype_and_pass(token[0] || "", ptype, token[1] || "")
end
end end
end end
else else
# Create the cred by username only (so we can change passwords) # Create the cred by username only (so we can change passwords)
cred = service.creds.find_by_user_and_ptype(token[0] || "", ptype) if token[0].nil? or token[0].empty?
unless cred cred = service.creds.find_or_initialize_by_user_and_ptype(token[0] || "", ptype)
dcu = token[0].downcase else
cred = service.creds.find_by_user_and_ptype_and_pass( dcu || "", ptype, token[1] || "") cred = service.creds.find_by_user_and_ptype(token[0] || "", ptype)
unless cred unless cred
cred = service.creds.find_or_initialize_by_user_and_ptype(token[0] || "", ptype) dcu = token[0].downcase
cred = service.creds.find_by_user_and_ptype_and_pass( dcu || "", ptype, token[1] || "")
unless cred
cred = service.creds.find_or_initialize_by_user_and_ptype(token[0] || "", ptype)
end
end end
end end
end end