Class: Metasploit::Framework::LoginScanner::WordpressRPC
- Defined in:
- lib/metasploit/framework/login_scanner/wordpress_rpc.rb
Overview
Wordpress XML RPC login scanner
Constant Summary
Constants inherited from HTTP
HTTP::DEFAULT_HTTP_SUCCESS_CODES, HTTP::DEFAULT_PORT, HTTP::DEFAULT_REALM, HTTP::DEFAULT_SSL_PORT, HTTP::LIKELY_PORTS, HTTP::LIKELY_SERVICE_NAMES, HTTP::PRIVATE_TYPES, HTTP::REALM_KEY
Instance Attribute Summary
Attributes inherited from HTTP
#digest_auth_iis, #evade_header_folding, #evade_method_random_case, #evade_method_random_invalid, #evade_method_random_valid, #evade_pad_fake_headers, #evade_pad_fake_headers_count, #evade_pad_get_params, #evade_pad_get_params_count, #evade_pad_method_uri_count, #evade_pad_method_uri_type, #evade_pad_post_params, #evade_pad_post_params_count, #evade_pad_uri_version_count, #evade_pad_uri_version_type, #evade_shuffle_get_params, #evade_shuffle_post_params, #evade_uri_dir_fake_relative, #evade_uri_dir_self_reference, #evade_uri_encode_mode, #evade_uri_fake_end, #evade_uri_fake_params_start, #evade_uri_full_url, #evade_uri_use_backslashes, #evade_version_random_invalid, #evade_version_random_valid, #http_password, #http_success_codes, #http_username, #keep_connection_alive, #kerberos_authenticator_factory, #method, #ntlm_domain, #ntlm_send_lm, #ntlm_send_ntlm, #ntlm_send_spn, #ntlm_use_lm_key, #ntlm_use_ntlmv2, #ntlm_use_ntlmv2_session, #uri, #user_agent, #vhost
Instance Method Summary collapse
- #attempt_login(credential) ⇒ Object
-
#generate_xml_request(user, pass) ⇒ String
This method generates the XML data for the RPC login request.
- #set_sane_defaults ⇒ Object
Methods inherited from HTTP
Instance Method Details
#attempt_login(credential) ⇒ Object
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 11 def attempt_login(credential) result_opts = { credential: credential, host: host, port: port, protocol: 'tcp' } if ssl result_opts[:service_name] = 'https' else result_opts[:service_name] = 'http' end begin response = send_request( { 'uri' => uri, 'method' => method, 'data' => generate_xml_request(credential.public,credential.private) } ) if response && response.code == 200 && response.body =~ /<value><int>401<\/int><\/value>/ || response.body =~ /<name>user_id<\/name>/ result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: response) elsif response.body =~ /<value><int>-32601<\/int><\/value>/ result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT) else result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: response) end rescue ::EOFError, Rex::ConnectionError, ::Timeout::Error => e result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: e) end Result.new(result_opts) end |
#generate_xml_request(user, pass) ⇒ String
This method generates the XML data for the RPC login request
53 54 55 56 57 58 59 60 61 62 63 |
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 53 def generate_xml_request(user, pass) xml = "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>" xml << '<methodCall>' xml << '<methodName>wp.getUsers</methodName>' xml << '<params><param><value>1</value></param>' xml << "<param><value>#{user}</value></param>" xml << "<param><value>#{pass}</value></param>" xml << '</params>' xml << '</methodCall>' xml end |
#set_sane_defaults ⇒ Object
66 67 68 69 |
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 66 def set_sane_defaults @method = "POST".freeze super end |