Module: Msf::Exploit::Remote::HTTP::Gitlab::Form::AccessTokens

Included in:
AccessTokens
Defined in:
lib/msf/core/exploit/remote/http/gitlab/form/access_tokens.rb

Overview

Create a Gitlab Access Token via form

Instance Method Summary collapse

Instance Method Details

#gitlab_create_personal_access_token ⇒ String?

Create Gitlab access access token

Returns:

  • (String, nil) —

    Gitlab personal access token if created, nil otherwise

Raises:



8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/msf/core/exploit/remote/http/gitlab/form/access_tokens.rb', line 8

def gitlab_create_personal_access_token
  res = send_request_cgi({
    'method' => 'POST',
    'uri' => normalize_uri(target_uri.path, '/-/profile/personal_access_tokens'),
    'keep_cookies' => true,
    'vars_post' => {
      'personal_access_token[name]' => Rex::Text.rand_text_alphanumeric(8),
      'personal_access_token[expires_at]' => '',
      'personal_access_token[scopes][]' => 'api',
      'commit' => 'Create personal access token'
    },
    'headers' => {
      'X-CSRF-Token' => gitlab_helper_extract_csrf_token(path: '/-/profile/personal_access_tokens', regex: /name="csrf-token" content="(.*)"/)
    }
  })

  raise Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError.new message: 'Request timed out' unless res

  raise Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError, "Failed to create access token. Unexpected HTTP #{res.code} response." unless res.code == 200

  token = JSON.parse(res.body)['new_token']

  return token if token

  nil
end