Class: Metasploit::Framework::CredentialCollection

Inherits:
PrivateCredentialCollection show all
Defined in:
lib/metasploit/framework/credential_collection.rb

Instance Attribute Summary collapse

Attributes inherited from PrivateCredentialCollection

#additional_privates, #blank_passwords, #filter, #nil_passwords, #pass_file, #password, #prepended_creds, #realm

Instance Method Summary collapse

Methods inherited from PrivateCredentialCollection

#add_private, #each_unfiltered, #filtered?, #prepend_cred, #private_type

Constructor Details

#initialize(opts = {}) ⇒ CredentialCollection

Returns a new instance of CredentialCollection.

Parameters:

  • opts (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (opts):



240
241
242
243
 
# File 'lib/metasploit/framework/credential_collection.rb', line 240

def initialize(opts = {})
  super
  self.additional_publics  ||= []
end

Instance Attribute Details

#additional_publics ⇒ Array<String>

Additional public values that should be tried

Returns:

  • (Array<String>) 


187
188
189
 
# File 'lib/metasploit/framework/credential_collection.rb', line 187

def additional_publics
  @additional_publics
end

#anonymous_login ⇒ Boolean

Whether to attempt an anonymous login (blank user/pass)

Returns:

  • (Boolean) 


213
214
215
 
# File 'lib/metasploit/framework/credential_collection.rb', line 213

def 
  @anonymous_login
end

#ignore_private ⇒ Boolean

Whether to ignore private (password). This is usually set when Kerberos or Schannel authentication is requested and the credentials are retrieved from cache or from a file. This attribute should be true in these scenarios, otherwise validation will fail since the password is not provided.

Returns:

  • (Boolean) 


222
223
224
 
# File 'lib/metasploit/framework/credential_collection.rb', line 222

def ignore_private
  @ignore_private
end

#ignore_public ⇒ Boolean

Whether to ignore public (username). This is usually set when Schannel authentication is requested and the credentials are retrieved from a file (certificate). This attribute should be true in this case, otherwise validation will fail since the password is not provided.

Returns:

  • (Boolean) 


230
231
232
 
# File 'lib/metasploit/framework/credential_collection.rb', line 230

def ignore_public
  @ignore_public
end

#password_spray ⇒ Boolean

Whether password spray is enabled. When true, each password is tried against each username first. Otherwise the default bruteforce logic will attempt all passwords against the first user, before continuing to the next user

Returns:

  • (Boolean) 


181
182
183
 
# File 'lib/metasploit/framework/credential_collection.rb', line 181

def password_spray
  @password_spray
end

#user_as_pass ⇒ Boolean

Whether each username should be tried as a password for that user

Returns:

  • (Boolean) 


192
193
194
 
# File 'lib/metasploit/framework/credential_collection.rb', line 192

def user_as_pass
  @user_as_pass
end

#user_file ⇒ String

Path to a file containing usernames, one per line

Returns:

  • (String) 


197
198
199
 
# File 'lib/metasploit/framework/credential_collection.rb', line 197

def user_file
  @user_file
end

#username ⇒ String

The username that should be tried

Returns:

  • (String) 


202
203
204
 
# File 'lib/metasploit/framework/credential_collection.rb', line 202

def username
  @username
end

#userpass_file ⇒ String

Path to a file containing usernames and passwords separated by a space, one pair per line

Returns:

  • (String) 


208
209
210
 
# File 'lib/metasploit/framework/credential_collection.rb', line 208

def userpass_file
  @userpass_file
end

Instance Method Details

#add_public(public_str = '') ⇒ void

This method returns an undefined value.

Adds a string as an additional public credential to be combined in the collection.

Parameters:

  • public_str (String) (defaults to: '') —

    The string to use as a public credential



250
251
252
 
# File 'lib/metasploit/framework/credential_collection.rb', line 250

def add_public(public_str='')
  additional_publics << public_str
end

#each_filtered {|credential| ... } ⇒ void Also known as: each

This method returns an undefined value.

Combines all the provided credential sources into a stream of Metasploit::Framework::Credential objects, yielding them one at a time

Yield Parameters:



259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
 
# File 'lib/metasploit/framework/credential_collection.rb', line 259

def each_filtered
  if ignore_private
    if ignore_public
      yield Metasploit::Framework::Credential.new(public: nil, private: nil, realm: realm)
    else
      yield Metasploit::Framework::Credential.new(public: username, private: nil, realm: realm)
    end
  elsif password_spray
    each_unfiltered_password_first do |credential|
      next unless self.filter.nil? || self.filter.call(credential)

      yield credential
    end
  else
    each_unfiltered_username_first do |credential|
      next unless self.filter.nil? || self.filter.call(credential)

      yield credential
    end
  end
end

#each_unfiltered_password_first {|credential| ... } ⇒ void

This method returns an undefined value.

When password spraying is enabled, do first passwords then usernames

i.e.
 username1:password1
 username2:password1
 username3:password1

…

username1:password2
username2:password2
username3:password2

…

Yield Parameters:



295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
 
# File 'lib/metasploit/framework/credential_collection.rb', line 295

def each_unfiltered_password_first
  if user_file.present?
    user_fd = File.open(user_file, 'r:binary')
  end

  prepended_creds.each { |c| yield c }

  if 
    yield Metasploit::Framework::Credential.new(public: '', private: '', realm: realm, private_type: :password)
  end

  if user_as_pass
    if user_fd
      user_fd.each_line do |user_from_file|
        user_from_file.chomp!
        yield Metasploit::Framework::Credential.new(public: user_from_file, private: user_from_file, realm: realm, private_type: private_type(password))
      end
      user_fd.seek(0)
    end
  end

  if password.present?
    if nil_passwords
      yield Metasploit::Framework::Credential.new(public: username, private: nil, realm: realm, private_type: :password)
    end
    if username.present?
      yield Metasploit::Framework::Credential.new(public: username, private: password, realm: realm, private_type: private_type(password))
    end
    if user_as_pass
      yield Metasploit::Framework::Credential.new(public: username, private: username, realm: realm, private_type: :password)
    end
    if blank_passwords
      yield Metasploit::Framework::Credential.new(public: username, private: "", realm: realm, private_type: :password)
    end
    if user_fd
      user_fd.each_line do |user_from_file|
        user_from_file.chomp!
        yield Metasploit::Framework::Credential.new(public: user_from_file, private: password, realm: realm, private_type: private_type(password))
      end
      user_fd.seek(0)
    end
  end

  if pass_file.present?
    File.open(pass_file, 'r:binary') do |pass_fd|
      pass_fd.each_line do |pass_from_file|
        pass_from_file.chomp!
        if username.present?
          yield Metasploit::Framework::Credential.new(public: username, private: pass_from_file, realm: realm, private_type: :password)
        end
        next unless user_fd

        user_fd.each_line do |user_from_file|
          user_from_file.chomp!
          yield Metasploit::Framework::Credential.new(public: user_from_file, private: pass_from_file, realm: realm, private_type: private_type(pass_from_file))
        end
        user_fd.seek(0)
      end
    end
  end

  if userpass_file.present?
    File.open(userpass_file, 'r:binary') do |userpass_fd|
      userpass_fd.each_line do |line|
        user, pass = line.split(" ", 2)
        if pass.blank?
          pass = ''
        else
          pass.chomp!
        end
        yield Metasploit::Framework::Credential.new(public: user, private: pass, realm: realm)
      end
    end
  end

  additional_privates.each do |add_private|
    if username.present?
      yield Metasploit::Framework::Credential.new(public: username, private: add_private, realm: realm, private_type: private_type(add_private))
    end
    user_fd.each_line do |user_from_file|
      user_from_file.chomp!
      yield Metasploit::Framework::Credential.new(public: user_from_file, private: add_private, realm: realm, private_type: private_type(add_private))
    end
    user_fd.seek(0)
  end

  additional_publics.each do |add_public|
    if password.present?
      yield Metasploit::Framework::Credential.new(public: add_public, private: password, realm: realm, private_type: private_type(password) )
    end
    if user_as_pass
      yield Metasploit::Framework::Credential.new(public: add_public, private: user_from_file, realm: realm, private_type: :password)
    end
    if blank_passwords
      yield Metasploit::Framework::Credential.new(public: add_public, private: "", realm: realm, private_type: :password)
    end
    if nil_passwords
      yield Metasploit::Framework::Credential.new(public: add_public, private: nil, realm: realm, private_type: :password)
    end
    if user_fd
      user_fd.each_line do |user_from_file|
        user_from_file.chomp!
        yield Metasploit::Framework::Credential.new(public: add_public, private: user_from_file, realm: realm, private_type: private_type(user_from_file))
      end
      user_fd.seek(0)
    end
    additional_privates.each do |add_private|
      yield Metasploit::Framework::Credential.new(public: add_public, private: add_private, realm: realm, private_type: private_type(add_private))
    end
  end
ensure
  user_fd.close if user_fd && !user_fd.closed?
end

#each_unfiltered_username_first {|credential| ... } ⇒ void

This method returns an undefined value.

When password spraying is not enabled, do first usernames then passwords

i.e.
 username1:password1
 username1:password2
 username1:password3

…

username2:password1
username2:password2
username2:password3

Yield Parameters:



420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
 
# File 'lib/metasploit/framework/credential_collection.rb', line 420

def each_unfiltered_username_first
  if pass_file.present?
    pass_fd = File.open(pass_file, 'r:binary')
  end

  prepended_creds.each { |c| yield c }

  if 
    yield Metasploit::Framework::Credential.new(public: '', private: '', realm: realm, private_type: :password)
  end

  if username.present?
    if nil_passwords
      yield Metasploit::Framework::Credential.new(public: username, private: nil, realm: realm, private_type: :password)
    end
    if password.present?
      yield Metasploit::Framework::Credential.new(public: username, private: password, realm: realm, private_type: private_type(password))
    end
    if user_as_pass
      yield Metasploit::Framework::Credential.new(public: username, private: username, realm: realm, private_type: :password)
    end
    if blank_passwords
      yield Metasploit::Framework::Credential.new(public: username, private: "", realm: realm, private_type: :password)
    end
    if pass_fd
      pass_fd.each_line do |pass_from_file|
        pass_from_file.chomp!
        yield Metasploit::Framework::Credential.new(public: username, private: pass_from_file, realm: realm, private_type: private_type(pass_from_file))
      end
      pass_fd.seek(0)
    end
    additional_privates.each do |add_private|
      yield Metasploit::Framework::Credential.new(public: username, private: add_private, realm: realm, private_type: private_type(add_private))
    end
  end

  if user_file.present?
    File.open(user_file, 'r:binary') do |user_fd|
      user_fd.each_line do |user_from_file|
        user_from_file.chomp!
        if nil_passwords
          yield Metasploit::Framework::Credential.new(public: user_from_file, private: nil, realm: realm, private_type: :password)
        end
        if password.present?
          yield Metasploit::Framework::Credential.new(public: user_from_file, private: password, realm: realm, private_type: private_type(password) )
        end
        if user_as_pass
          yield Metasploit::Framework::Credential.new(public: user_from_file, private: user_from_file, realm: realm, private_type: :password)
        end
        if blank_passwords
          yield Metasploit::Framework::Credential.new(public: user_from_file, private: "", realm: realm, private_type: :password)
        end
        if pass_fd
          pass_fd.each_line do |pass_from_file|
            pass_from_file.chomp!
            yield Metasploit::Framework::Credential.new(public: user_from_file, private: pass_from_file, realm: realm, private_type: private_type(pass_from_file))
          end
          pass_fd.seek(0)
        end
        additional_privates.each do |add_private|
          yield Metasploit::Framework::Credential.new(public: user_from_file, private: add_private, realm: realm, private_type: private_type(add_private))
        end
      end
    end
  end

  if userpass_file.present?
    File.open(userpass_file, 'r:binary') do |userpass_fd|
      userpass_fd.each_line do |line|
        user, pass = line.split(" ", 2)
        if pass.blank?
          pass = ''
        else
          pass.chomp!
        end
        yield Metasploit::Framework::Credential.new(public: user, private: pass, realm: realm)
      end
    end
  end

  additional_publics.each do |add_public|
    if password.present?
      yield Metasploit::Framework::Credential.new(public: add_public, private: password, realm: realm, private_type: private_type(password) )
    end
    if user_as_pass
      yield Metasploit::Framework::Credential.new(public: add_public, private: user_from_file, realm: realm, private_type: :password)
    end
    if blank_passwords
      yield Metasploit::Framework::Credential.new(public: add_public, private: "", realm: realm, private_type: :password)
    end
    if pass_fd
      pass_fd.each_line do |pass_from_file|
        pass_from_file.chomp!
        yield Metasploit::Framework::Credential.new(public: add_public, private: pass_from_file, realm: realm, private_type: private_type(pass_from_file))
      end
      pass_fd.seek(0)
    end
    additional_privates.each do |add_private|
      yield Metasploit::Framework::Credential.new(public: add_public, private: add_private, realm: realm, private_type: private_type(add_private))
    end
  end
ensure
  pass_fd.close if pass_fd && !pass_fd.closed?
end

#empty? ⇒ Boolean

Returns true when #each will have no results to iterate

Returns:

  • (Boolean) 


528
529
530
 
# File 'lib/metasploit/framework/credential_collection.rb', line 528

def empty?
  prepended_creds.empty? && !has_users? && ! || (has_users? && !has_privates?)
end

#has_privates? ⇒ Boolean

Returns true when there are any private values set

Returns:

  • (Boolean) 


542
543
544
 
# File 'lib/metasploit/framework/credential_collection.rb', line 542

def has_privates?
  super || userpass_file.present? || user_as_pass || !!ignore_private
end

#has_users? ⇒ Boolean

Returns true when there are any user values set

Returns:

  • (Boolean) 


535
536
537
 
# File 'lib/metasploit/framework/credential_collection.rb', line 535

def has_users?
  username.present? || user_file.present? || userpass_file.present? || !additional_publics.empty? || !!ignore_public
end