Class: Metasploit::Framework::LoginScanner::WordpressRPC

Inherits:
HTTP
  • Object
show all
Defined in:
lib/metasploit/framework/login_scanner/wordpress_rpc.rb

Overview

Wordpress XML RPC login scanner

Constant Summary

Constants inherited from HTTP

HTTP::AUTHORIZATION_HEADER, HTTP::DEFAULT_HTTP_NOT_AUTHED_CODES, HTTP::DEFAULT_HTTP_SUCCESS_CODES, HTTP::DEFAULT_PORT, HTTP::DEFAULT_REALM, HTTP::DEFAULT_SSL_PORT, HTTP::LIKELY_PORTS, HTTP::LIKELY_SERVICE_NAMES, HTTP::PRIVATE_TYPES, HTTP::REALM_KEY

Instance Attribute Summary

Attributes inherited from HTTP

#digest_auth_iis, #evade_header_folding, #evade_method_random_case, #evade_method_random_invalid, #evade_method_random_valid, #evade_pad_fake_headers, #evade_pad_fake_headers_count, #evade_pad_get_params, #evade_pad_get_params_count, #evade_pad_method_uri_count, #evade_pad_method_uri_type, #evade_pad_post_params, #evade_pad_post_params_count, #evade_pad_uri_version_count, #evade_pad_uri_version_type, #evade_shuffle_get_params, #evade_shuffle_post_params, #evade_uri_dir_fake_relative, #evade_uri_dir_self_reference, #evade_uri_encode_mode, #evade_uri_fake_end, #evade_uri_fake_params_start, #evade_uri_full_url, #evade_uri_use_backslashes, #evade_version_random_invalid, #evade_version_random_valid, #http_password, #http_success_codes, #http_username, #keep_connection_alive, #kerberos_authenticator_factory, #method, #ntlm_domain, #ntlm_send_lm, #ntlm_send_ntlm, #ntlm_send_spn, #ntlm_use_lm_key, #ntlm_use_ntlmv2, #ntlm_use_ntlmv2_session, #uri, #user_agent, #vhost

Instance Method Summary collapse

Methods inherited from HTTP

#authentication_required?, #check_setup, #send_request

Instance Method Details

#attempt_login(credential) ⇒ Object

[View source]

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 11

def (credential)
  result_opts = {
      credential: credential,
      host: host,
      port: port,
      protocol: 'tcp'
  }
  if ssl
    result_opts[:service_name] = 'https'
  else
    result_opts[:service_name] = 'http'
  end

  begin

    response = send_request(
      {
        'uri' => uri,
        'method' => method,
        'data' => generate_xml_request(credential.public,credential.private)
      }
    )

    if response && response.code == 200 && response.body =~ /<value><int>401<\/int><\/value>/ || response.body =~ /<name>user_id<\/name>/
      result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: response)
    elsif response.body =~ /<value><int>-32601<\/int><\/value>/
      result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT)
    else
      result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: response)
    end
  rescue ::EOFError, Rex::ConnectionError, ::Timeout::Error => e
    result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: e)
  end

  Result.new(result_opts)

end

#generate_xml_request(user, pass) ⇒ String

This method generates the XML data for the RPC login request

Parameters:

  • user (String) —

    the username to authenticate with

  • pass (String) —

    the password to authenticate with

Returns:

  • (String) —

    the generated XML body for the request

[View source]

53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 53

def generate_xml_request(user, pass)
  xml = "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>"
  xml << '<methodCall>'
  xml << '<methodName>wp.getUsers</methodName>'
  xml << '<params><param><value>1</value></param>'
  xml << "<param><value>#{user}</value></param>"
  xml << "<param><value>#{pass}</value></param>"
  xml << '</params>'
  xml << '</methodCall>'
  xml
end

#set_sane_defaults ⇒ Object

[View source]

66
67
68
69
 
# File 'lib/metasploit/framework/login_scanner/wordpress_rpc.rb', line 66

def set_sane_defaults
  @method = "POST".freeze
  super
end