CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
require 'metasploit/framework/login_scanner/http'
2
require 'json'
3

4
module Metasploit
5
  module Framework
6
    module LoginScanner
7

8
      # Octopus Deploy login scanner
9
      class OctopusDeploy < HTTP
10

11
        # Inherit LIKELY_PORTS,LIKELY_SERVICE_NAMES, and REALM_KEY from HTTP
12
        CAN_GET_SESSION = true
13
        DEFAULT_PORT    = 80
14
        PRIVATE_TYPES   = [ :password ]
15

16
        # (see Base#set_sane_defaults)
17
        def set_sane_defaults
18
          uri = '/api/users/login' if uri.nil?
19
          method = 'POST' if method.nil?
20

21
          super
22
        end
23

24
        def attempt_login(credential)
25
          result_opts = {
26
            credential: credential,
27
            host: host,
28
            port: port,
29
            protocol: 'tcp'
30
          }
31
          if ssl
32
            result_opts[:service_name] = 'https'
33
          else
34
            result_opts[:service_name] = 'http'
35
          end
36
          begin
37
            json_post_data = JSON.pretty_generate({ Username: credential.public, Password: credential.private })
38
            res = send_request({
39
              'method' => 'POST',
40
              'uri' => uri,
41
              'ctype' => 'application/json',
42
              'data' => json_post_data
43
            })
44

45
            body = JSON.parse(res.body)
46
            if res && res.code == 200 && body.key?('IsActive') && body['IsActive']
47
              result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: res.body)
48
            else
49
              result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: res)
50
            end
51
          rescue ::JSON::ParserError
52
            result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: res.body)
53
          rescue ::EOFError, Errno::ETIMEDOUT, Rex::ConnectionError, ::Timeout::Error
54
            result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT)
55
          end
56
          Result.new(result_opts)
57
        end
58
      end
59
    end
60
  end
61
end
62

63