Class: Metasploit::Framework::LoginScanner::WordpressRPC

Inherits:
HTTP
  • Object
show all
Defined in:
lib/metasploit/framework/login_scanner/wordpress_rpc.rb

Overview

Wordpress XML RPC login scanner

Constant Summary

Constants inherited from HTTP

HTTP::AUTHORIZATION_HEADER, HTTP::DEFAULT_HTTP_NOT_AUTHED_CODES, HTTP::DEFAULT_HTTP_SUCCESS_CODES, HTTP::DEFAULT_PORT, HTTP::DEFAULT_REALM, HTTP::DEFAULT_SSL_PORT, HTTP::LIKELY_PORTS, HTTP::LIKELY_SERVICE_NAMES, HTTP::PRIVATE_TYPES, HTTP::REALM_KEY

Instance Attribute Summary

Attributes inherited from HTTP

#digest_auth_iis, #evade_header_folding, #evade_method_random_case, #evade_method_random_invalid, #evade_method_random_valid, #evade_pad_fake_headers, #evade_pad_fake_headers_count, #evade_pad_get_params, #evade_pad_get_params_count, #evade_pad_method_uri_count, #evade_pad_method_uri_type, #evade_pad_post_params, #evade_pad_post_params_count, #evade_pad_uri_version_count, #evade_pad_uri_version_type, #evade_shuffle_get_params, #evade_shuffle_post_params, #evade_uri_dir_fake_relative, #evade_uri_dir_self_reference, #evade_uri_encode_mode, #evade_uri_fake_end, #evade_uri_fake_params_start, #evade_uri_full_url, #evade_uri_use_backslashes, #evade_version_random_invalid, #evade_version_random_valid, #http_password, #http_success_codes, #http_username, #keep_connection_alive, #kerberos_authenticator_factory, #method, #ntlm_domain, #ntlm_send_lm, #ntlm_send_ntlm, #ntlm_send_spn, #ntlm_use_lm_key, #ntlm_use_ntlmv2, #ntlm_use_ntlmv2_session, #uri, #user_agent, #vhost

Instance Method Summary collapse

Methods inherited from HTTP

#authentication_required?, #build_http_service_opts, #build_service_opts, #db, #send_request, #service_as_result

Methods included from Msf::Auxiliary::Report

#active_db?, #create_cracked_credential, #create_credential, #create_credential_and_login, #create_credential_login, #db, #db_warning_given?, #get_client, #get_host, #inside_workspace_boundary?, #invalidate_login, #mytask, #myworkspace, #myworkspace_id, #report_auth_info, #report_client, #report_exploit, #report_host, #report_loot, #report_note, #report_service, #report_vuln, #report_web_form, #report_web_page, #report_web_site, #report_web_vuln, #store_cred, #store_local, #store_loot

Methods included from Require

optionally, optionally_active_record_railtie, optionally_include_metasploit_credential_creation, #optionally_include_metasploit_credential_creation, optionally_require_metasploit_db_gem_engines

Instance Method Details

#attempt_login(credential) ⇒ Object 



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 33

def (credential)
  result_opts = {
      credential: credential,
      **service_as_result(service_opts)
  }

  begin

    response = send_request(
      {
        'uri' => uri,
        'method' => method,
        'data' => generate_xml_request(credential.public,credential.private)
      }
    )

    if response && response.code == 200 && response.body =~ /<value><int>401<\/int><\/value>/ || response.body =~ /<name>user_id<\/name>/
      result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: response)
    elsif response.body =~ /<value><int>-32601<\/int><\/value>/
      result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT)
    else
      result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: response)
    end
  rescue ::EOFError, Rex::ConnectionError, ::Timeout::Error => e
    result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: e)
  end

  Result.new(result_opts)

end

#check_setup ⇒ false, String

Checks if the target is a WordPress XML-RPC endpoint

Returns:

  • (false) —

    if the target looks like a WordPress XML-RPC endpoint

  • (String) —

    a human-readable error message if it doesn't



14
15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 14

def check_setup
  res = send_request({
    'method' => 'GET',
    'uri'    => uri
  })

  return 'Unable to connect to the WordPress XML-RPC endpoint' unless res
  return 'Unable to locate WordPress XML-RPC endpoint (Is WordPress installed and is XML-RPC enabled?)' unless res.code == 200 && res.body.include?('XML-RPC server accepts POST requests only')

  report_service(service_opts)

  false
end

#generate_xml_request(user, pass) ⇒ String

This method generates the XML data for the RPC login request

Parameters:

  • user (String) —

    the username to authenticate with

  • pass (String) —

    the password to authenticate with

Returns:

  • (String) —

    the generated XML body for the request



68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 68

def generate_xml_request(user, pass)
  xml = "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>"
  xml << '<methodCall>'
  xml << '<methodName>wp.getUsers</methodName>'
  xml << '<params><param><value>1</value></param>'
  xml << "<param><value>#{user}</value></param>"
  xml << "<param><value>#{pass}</value></param>"
  xml << '</params>'
  xml << '</methodCall>'
  xml
end

#service_opts ⇒ Object 



28
29
30
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 28

def service_opts
  build_service_opts('wordpress')
end

#set_sane_defaults ⇒ Object 



81
82
83
84
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 81

def set_sane_defaults
  @method = "POST".freeze
  super
end