From ef7434b59b7aabd3cca08c90ea3d535bfdbd6435 Mon Sep 17 00:00:00 2001
From: SecureAB <SecureAB@users.noreply.github.com>
Date: Fri, 16 Jun 2017 16:54:38 +0200
Subject: [PATCH] added new authentitcity_token scheme

---
 lib/metasploit/framework/login_scanner/gitlab.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/metasploit/framework/login_scanner/gitlab.rb b/lib/metasploit/framework/login_scanner/gitlab.rb
index 648151d13a..d895591d25 100644
--- a/lib/metasploit/framework/login_scanner/gitlab.rb
+++ b/lib/metasploit/framework/login_scanner/gitlab.rb
@@ -61,6 +61,10 @@ module Metasploit
             local_session_cookie = res.get_cookies.scan(/(_gitlab_session=[A-Za-z0-9%-]+)/).flatten[0]
             auth_token = res.body.scan(/<input name="authenticity_token" type="hidden" value="(.*?)"/).flatten[0]
 
+            # New versions of GitLab use an alternative scheme
+            # Try it, if the old one was not successfull
+            auth_token = res.body.scan(/<input type="hidden" name="authenticity_token" value="(.*?)"/).flatten[0] unless auth_token
+
             fail RuntimeError, 'Unable to get Session Cookie' unless local_session_cookie
             fail RuntimeError, 'Unable to get Authentication Token' unless auth_token