Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
require 'spec_helper'
2
require 'metasploit/framework/credential_collection'
3

4
RSpec.describe Metasploit::Framework::CredentialCollection do
5

6
  subject(:collection) do
7
    described_class.new(
8
      nil_passwords: nil_passwords,
9
      blank_passwords: blank_passwords,
10
      pass_file: pass_file,
11
      password: password,
12
      user_as_pass: user_as_pass,
13
      user_file: user_file,
14
      username: username,
15
      userpass_file: userpass_file,
16
      prepended_creds: prepended_creds,
17
      additional_privates: additional_privates,
18
      additional_publics: additional_publics,
19
      password_spray: password_spray
20
    )
21
  end
22

23
  before(:each) do
24
    # The test suite overrides File.open(...) calls; fall back to the normal behavior for any File.open calls that aren't explicitly mocked
25
    allow(File).to receive(:open).with(anything).and_call_original
26
    allow(File).to receive(:open).with(anything, anything).and_call_original
27
    allow(File).to receive(:open).with(anything, anything, anything).and_call_original
28
  end
29

30
  let(:nil_passwords) { nil }
31
  let(:blank_passwords) { nil }
32
  let(:username) { "user" }
33
  let(:password) { "pass" }
34
  let(:user_file) { nil }
35
  let(:pass_file) { nil }
36
  let(:user_as_pass) { nil }
37
  let(:userpass_file) { nil }
38
  let(:prepended_creds) { [] }
39
  let(:additional_privates) { [] }
40
  let(:additional_publics) { [] }
41
  let(:password_spray) { false }
42

43
  describe "#each" do
44
    specify do
45
      expect { |b| collection.each(&b) }.to yield_with_args(Metasploit::Framework::Credential)
46
    end
47

48
    context "when given a user_file and password" do
49
      let(:username) { nil }
50
      let(:user_file) do
51
        filename = "foo"
52
        stub_file = StringIO.new("asdf\njkl\n")
53
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
54

55
        filename
56
      end
57

58
      specify  do
59
        expect { |b| collection.each(&b) }.to yield_successive_args(
60
          Metasploit::Framework::Credential.new(public: "asdf", private: password),
61
          Metasploit::Framework::Credential.new(public: "jkl", private: password),
62
        )
63
      end
64
    end
65

66
    context "when given a pass_file and username" do
67
      let(:password) { nil }
68
      let(:pass_file) do
69
        filename = "foo"
70
        stub_file = StringIO.new("asdf\njkl\n")
71
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
72

73
        filename
74
      end
75

76
      specify  do
77
        expect { |b| collection.each(&b) }.to yield_successive_args(
78
          Metasploit::Framework::Credential.new(public: username, private: "asdf"),
79
          Metasploit::Framework::Credential.new(public: username, private: "jkl"),
80
        )
81
      end
82
    end
83

84
    context "when given a userspass_file" do
85
      let(:username) { nil }
86
      let(:password) { nil }
87
      let(:userpass_file) do
88
        filename = "foo"
89
        stub_file = StringIO.new("asdf jkl\nfoo bar\n")
90
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
91

92
        filename
93
      end
94

95
      specify  do
96
        expect { |b| collection.each(&b) }.to yield_successive_args(
97
          Metasploit::Framework::Credential.new(public: "asdf", private: "jkl"),
98
          Metasploit::Framework::Credential.new(public: "foo", private: "bar"),
99
        )
100
      end
101
    end
102

103
    context "when given a pass_file and user_file" do
104
      let(:password) { nil }
105
      let(:username) { nil }
106
      let(:user_file) do
107
        filename = "user_file"
108
        stub_file = StringIO.new("asdf\njkl\n")
109
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
110

111
        filename
112
      end
113
      let(:pass_file) do
114
        filename = "pass_file"
115
        stub_file = StringIO.new("asdf\njkl\n")
116
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
117

118
        filename
119
      end
120

121
      specify  do
122
        expect { |b| collection.each(&b) }.to yield_successive_args(
123
          Metasploit::Framework::Credential.new(public: "asdf", private: "asdf"),
124
          Metasploit::Framework::Credential.new(public: "asdf", private: "jkl"),
125
          Metasploit::Framework::Credential.new(public: "jkl", private: "asdf"),
126
          Metasploit::Framework::Credential.new(public: "jkl", private: "jkl"),
127
        )
128
      end
129
    end
130

131
    context "when given a pass_file and user_file and password spray" do
132
      let(:password) { nil }
133
      let(:username) { nil }
134
      let(:password_spray) { true }
135
      let(:pass_file) do
136
        filename = "pass_file"
137
        stub_file = StringIO.new("password1\npassword2\n")
138
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
139

140
        filename
141
      end
142
      let(:user_file) do
143
        filename = "user_file"
144
        stub_file = StringIO.new("user1\nuser2\nuser3\n")
145
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
146

147
        filename
148
      end
149

150
      specify  do
151
        expect { |b| collection.each(&b) }.to yield_successive_args(
152
          Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
153
          Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
154
          Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
155
          Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
156
          Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
157
          Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
158
        )
159
      end
160

161
      context 'when :user_as_pass is true' do
162
        let(:user_as_pass) { true }
163

164
        specify  do
165
          expect { |b| collection.each(&b) }.to yield_successive_args(
166
            Metasploit::Framework::Credential.new(public: "user1", private: "user1"),
167
            Metasploit::Framework::Credential.new(public: "user2", private: "user2"),
168
            Metasploit::Framework::Credential.new(public: "user3", private: "user3"),
169
            Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
170
            Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
171
            Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
172
            Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
173
            Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
174
            Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
175
          )
176
        end
177
      end
178
    end
179

180
    context 'when given a username and password' do
181
      let(:password) { 'password' }
182
      let(:username) { 'root' }
183

184
      specify do
185
        expected = [
186
          Metasploit::Framework::Credential.new(public: 'root', private: 'password'),
187
        ]
188
        expect { |b| collection.each(&b) }.to yield_successive_args(*expected)
189
      end
190
    end
191

192
    context 'when given a pass_file, user_file, password spray and a default username' do
193
      let(:password) { nil }
194
      let(:username) { 'root' }
195
      let(:password_spray) { true }
196
      let(:pass_file) do
197
        filename = "pass_file"
198
        stub_file = StringIO.new("password1\npassword2\n")
199
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
200

201
        filename
202
      end
203
      let(:user_file) do
204
        filename = "user_file"
205
        stub_file = StringIO.new("user1\nuser2\nuser3\n")
206
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
207

208
        filename
209
      end
210

211
      specify do
212
        expected = [
213
          Metasploit::Framework::Credential.new(public: "root", private: "password1"),
214
          Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
215
          Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
216
          Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
217
          Metasploit::Framework::Credential.new(public: "root", private: "password2"),
218
          Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
219
          Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
220
          Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
221
        ]
222
        expect { |b| collection.each(&b) }.to yield_successive_args(*expected)
223
      end
224
    end
225

226
    context 'when given a pass_file, user_file, password spray and additional privates' do
227
      let(:password) { nil }
228
      let(:username) { 'root' }
229
      let(:password_spray) { true }
230
      let(:additional_privates) { ['foo'] }
231
      let(:pass_file) do
232
        filename = "pass_file"
233
        stub_file = StringIO.new("password1\npassword2\n")
234
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
235

236
        filename
237
      end
238
      let(:user_file) do
239
        filename = "user_file"
240
        stub_file = StringIO.new("user1\nuser2\nuser3\n")
241
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
242

243
        filename
244
      end
245

246
      specify do
247
        expected = [
248
          Metasploit::Framework::Credential.new(public: "root", private: "password1"),
249
          Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
250
          Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
251
          Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
252
          Metasploit::Framework::Credential.new(public: "root", private: "password2"),
253
          Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
254
          Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
255
          Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
256
          Metasploit::Framework::Credential.new(public: "root", private: "foo"),
257
          Metasploit::Framework::Credential.new(public: "user1", private: "foo"),
258
          Metasploit::Framework::Credential.new(public: "user2", private: "foo"),
259
          Metasploit::Framework::Credential.new(public: "user3", private: "foo"),
260
        ]
261
        expect { |b| collection.each(&b) }.to yield_successive_args(*expected)
262
      end
263
    end
264

265
    context 'when given a username, user_file and pass_file' do
266
      let(:password) { nil }
267
      let(:username) { 'my_username' }
268
      let(:user_file) do
269
        filename = "user_file"
270
        stub_file = StringIO.new("asdf\njkl\n")
271
        allow(File).to receive(:open).with(filename, /^r/).and_yield stub_file
272

273
        filename
274
      end
275

276
      let(:pass_file) do
277
        filename = "pass_file"
278
        stub_file = StringIO.new("asdf\njkl\n")
279
        allow(File).to receive(:open).with(filename, /^r/).and_return stub_file
280

281
        filename
282
      end
283

284
      it do
285
        expect { |b| collection.each(&b) }.to yield_successive_args(
286
                                                Metasploit::Framework::Credential.new(public: "my_username", private: "asdf"),
287
                                                Metasploit::Framework::Credential.new(public: "my_username", private: "jkl"),
288
                                                Metasploit::Framework::Credential.new(public: "asdf", private: "asdf"),
289
                                                Metasploit::Framework::Credential.new(public: "asdf", private: "jkl"),
290
                                                Metasploit::Framework::Credential.new(public: "jkl", private: "asdf"),
291
                                                Metasploit::Framework::Credential.new(public: "jkl", private: "jkl")
292
                                              )
293
      end
294
    end
295

296
    context "when :user_as_pass is true" do
297
      let(:user_as_pass) { true }
298
      specify  do
299
        expect { |b| collection.each(&b) }.to yield_successive_args(
300
          Metasploit::Framework::Credential.new(public: username, private: password),
301
          Metasploit::Framework::Credential.new(public: username, private: username),
302
        )
303
      end
304
    end
305

306
    context "when :nil_passwords is true" do
307
      let(:nil_passwords) { true }
308
      specify  do
309
        expect { |b| collection.each(&b) }.to yield_successive_args(
310
          Metasploit::Framework::Credential.new(public: username, private: nil),
311
          Metasploit::Framework::Credential.new(public: username, private: password),
312
        )
313
      end
314
    end
315

316
    context "when :blank_passwords is true" do
317
      let(:blank_passwords) { true }
318
      specify  do
319
        expect { |b| collection.each(&b) }.to yield_successive_args(
320
          Metasploit::Framework::Credential.new(public: username, private: password),
321
          Metasploit::Framework::Credential.new(public: username, private: ""),
322
        )
323
      end
324
    end
325

326
  end
327

328
  describe "#empty?" do
329
    context "when only :userpass_file is set" do
330
      let(:username) { nil }
331
      let(:password) { nil }
332
      let(:userpass_file) { "test_file" }
333
      specify do
334
        expect(collection.empty?).to eq false
335
      end
336
    end
337

338
    context "when :username is set" do
339
      context "and :password is set" do
340
        specify do
341
          expect(collection.empty?).to eq false
342
        end
343
      end
344

345
      context "and :password is not set" do
346
        let(:password) { nil }
347
        specify do
348
          expect(collection.empty?).to eq true
349
        end
350

351
        context "and :nil_passwords is true" do
352
          let(:nil_passwords) { true }
353
          specify do
354
            expect(collection.empty?).to eq false
355
          end
356
        end
357

358
        context "and :blank_passwords is true" do
359
          let(:blank_passwords) { true }
360
          specify do
361
            expect(collection.empty?).to eq false
362
          end
363
        end
364
      end
365
    end
366

367
    context "when :username is not set" do
368
      context "and :password is not set" do
369
        let(:username) { nil }
370
        let(:password) { nil }
371
        specify do
372
          expect(collection.empty?).to eq true
373
        end
374

375
        context "and :prepended_creds is not empty" do
376
          let(:prepended_creds) { [ "test" ] }
377
          specify do
378
            expect(collection.empty?).to eq false
379
          end
380
        end
381

382
        context "and :additional_privates is not empty" do
383
          let(:additional_privates) { [ "test_private" ] }
384
          specify do
385
            expect(collection.empty?).to eq true
386
          end
387
        end
388

389
        context "and :additional_publics is not empty" do
390
          let(:additional_publics) { [ "test_public" ] }
391
          specify do
392
            expect(collection.empty?).to eq true
393
          end
394
        end
395
      end
396
    end
397
  end
398

399
  describe "#prepend_cred" do
400
    specify do
401
      prep = Metasploit::Framework::Credential.new(public: "foo", private: "bar")
402
      collection.prepend_cred(prep)
403
      expect { |b| collection.each(&b) }.to yield_successive_args(
404
        prep,
405
        Metasploit::Framework::Credential.new(public: username, private: password),
406
      )
407
    end
408
  end
409

410
end
411

412