CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
require 'spec_helper'
2
require 'metasploit/framework/credential_collection'
3

4
RSpec.describe Metasploit::Framework::CredentialCollection do
5

6
  subject(:collection) do
7
    described_class.new(
8
      nil_passwords: nil_passwords,
9
      blank_passwords: blank_passwords,
10
      pass_file: pass_file,
11
      password: password,
12
      user_as_pass: user_as_pass,
13
      user_file: user_file,
14
      username: username,
15
      userpass_file: userpass_file,
16
      prepended_creds: prepended_creds,
17
      additional_privates: additional_privates,
18
      additional_publics: additional_publics,
19
      password_spray: password_spray
20
    )
21
  end
22

23
  before(:each) do
24
    # The test suite overrides File.open(...) calls; fall back to the normal behavior for any File.open calls that aren't explicitly mocked
25
    allow(File).to receive(:open).with(anything).and_call_original
26
    allow(File).to receive(:open).with(anything, anything).and_call_original
27
    allow(File).to receive(:open).with(anything, anything, anything).and_call_original
28
  end
29

30
  let(:nil_passwords) { nil }
31
  let(:blank_passwords) { nil }
32
  let(:username) { "user" }
33
  let(:password) { "pass" }
34
  let(:user_file) { nil }
35
  let(:pass_file) { nil }
36
  let(:user_as_pass) { nil }
37
  let(:userpass_file) { nil }
38
  let(:prepended_creds) { [] }
39
  let(:additional_privates) { [] }
40
  let(:additional_publics) { [] }
41
  let(:password_spray) { false }
42

43
  describe "#each" do
44
    specify do
45
      expect { |b| collection.each(&b) }.to yield_with_args(Metasploit::Framework::Credential)
46
    end
47

48
    context "when given a user_file and password" do
49
      let(:username) { nil }
50
      let(:user_file) do
51
        filename = "foo"
52
        stub_file = StringIO.new("asdf\njkl\n")
53
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
54

55
        filename
56
      end
57

58
      specify  do
59
        expect { |b| collection.each(&b) }.to yield_successive_args(
60
          Metasploit::Framework::Credential.new(public: "asdf", private: password),
61
          Metasploit::Framework::Credential.new(public: "jkl", private: password),
62
        )
63
      end
64
    end
65

66
    context "when given a pass_file and username" do
67
      let(:password) { nil }
68
      let(:pass_file) do
69
        filename = "foo"
70
        stub_file = StringIO.new("asdf\njkl\n")
71
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
72

73
        filename
74
      end
75

76
      specify  do
77
        expect { |b| collection.each(&b) }.to yield_successive_args(
78
          Metasploit::Framework::Credential.new(public: username, private: "asdf"),
79
          Metasploit::Framework::Credential.new(public: username, private: "jkl"),
80
        )
81
      end
82
    end
83

84
    context "when given a userspass_file" do
85
      let(:username) { nil }
86
      let(:password) { nil }
87
      let(:userpass_file) do
88
        filename = "foo"
89
        stub_file = StringIO.new("asdf jkl\nfoo bar\n")
90
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
91

92
        filename
93
      end
94

95
      specify  do
96
        expect { |b| collection.each(&b) }.to yield_successive_args(
97
          Metasploit::Framework::Credential.new(public: "asdf", private: "jkl"),
98
          Metasploit::Framework::Credential.new(public: "foo", private: "bar"),
99
        )
100
      end
101
    end
102

103
    context "when given a pass_file and user_file" do
104
      let(:password) { nil }
105
      let(:username) { nil }
106
      let(:user_file) do
107
        filename = "user_file"
108
        stub_file = StringIO.new("asdf\njkl\n")
109
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
110

111
        filename
112
      end
113
      let(:pass_file) do
114
        filename = "pass_file"
115
        stub_file = StringIO.new("asdf\njkl\n")
116
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
117

118
        filename
119
      end
120

121
      specify  do
122
        expect { |b| collection.each(&b) }.to yield_successive_args(
123
          Metasploit::Framework::Credential.new(public: "asdf", private: "asdf"),
124
          Metasploit::Framework::Credential.new(public: "asdf", private: "jkl"),
125
          Metasploit::Framework::Credential.new(public: "jkl", private: "asdf"),
126
          Metasploit::Framework::Credential.new(public: "jkl", private: "jkl"),
127
        )
128
      end
129
    end
130

131
    context "when given a pass_file and user_file and password spray" do
132
      let(:password) { nil }
133
      let(:username) { nil }
134
      let(:password_spray) { true }
135
      let(:pass_file) do
136
        filename = "pass_file"
137
        stub_file = StringIO.new("password1\npassword2\n")
138
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
139

140
        filename
141
      end
142
      let(:user_file) do
143
        filename = "user_file"
144
        stub_file = StringIO.new("user1\nuser2\nuser3\n")
145
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
146

147
        filename
148
      end
149

150
      specify  do
151
        expect { |b| collection.each(&b) }.to yield_successive_args(
152
          Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
153
          Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
154
          Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
155
          Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
156
          Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
157
          Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
158
        )
159
      end
160
    end
161

162
    context 'when given a username and password' do
163
      let(:password) { 'password' }
164
      let(:username) { 'root' }
165

166
      specify do
167
        expected = [
168
          Metasploit::Framework::Credential.new(public: 'root', private: 'password'),
169
        ]
170
        expect { |b| collection.each(&b) }.to yield_successive_args(*expected)
171
      end
172
    end
173

174
    context 'when given a pass_file, user_file, password spray and a default username' do
175
      let(:password) { nil }
176
      let(:username) { 'root' }
177
      let(:password_spray) { true }
178
      let(:pass_file) do
179
        filename = "pass_file"
180
        stub_file = StringIO.new("password1\npassword2\n")
181
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
182

183
        filename
184
      end
185
      let(:user_file) do
186
        filename = "user_file"
187
        stub_file = StringIO.new("user1\nuser2\nuser3\n")
188
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
189

190
        filename
191
      end
192

193
      specify do
194
        expected = [
195
          Metasploit::Framework::Credential.new(public: "root", private: "password1"),
196
          Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
197
          Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
198
          Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
199
          Metasploit::Framework::Credential.new(public: "root", private: "password2"),
200
          Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
201
          Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
202
          Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
203
        ]
204
        expect { |b| collection.each(&b) }.to yield_successive_args(*expected)
205
      end
206
    end
207

208
    context 'when given a pass_file, user_file, password spray and additional privates' do
209
      let(:password) { nil }
210
      let(:username) { 'root' }
211
      let(:password_spray) { true }
212
      let(:additional_privates) { ['foo'] }
213
      let(:pass_file) do
214
        filename = "pass_file"
215
        stub_file = StringIO.new("password1\npassword2\n")
216
        allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
217

218
        filename
219
      end
220
      let(:user_file) do
221
        filename = "user_file"
222
        stub_file = StringIO.new("user1\nuser2\nuser3\n")
223
        allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
224

225
        filename
226
      end
227

228
      specify do
229
        expected = [
230
          Metasploit::Framework::Credential.new(public: "root", private: "password1"),
231
          Metasploit::Framework::Credential.new(public: "user1", private: "password1"),
232
          Metasploit::Framework::Credential.new(public: "user2", private: "password1"),
233
          Metasploit::Framework::Credential.new(public: "user3", private: "password1"),
234
          Metasploit::Framework::Credential.new(public: "root", private: "password2"),
235
          Metasploit::Framework::Credential.new(public: "user1", private: "password2"),
236
          Metasploit::Framework::Credential.new(public: "user2", private: "password2"),
237
          Metasploit::Framework::Credential.new(public: "user3", private: "password2"),
238
          Metasploit::Framework::Credential.new(public: "root", private: "foo"),
239
          Metasploit::Framework::Credential.new(public: "user1", private: "foo"),
240
          Metasploit::Framework::Credential.new(public: "user2", private: "foo"),
241
          Metasploit::Framework::Credential.new(public: "user3", private: "foo"),
242
        ]
243
        expect { |b| collection.each(&b) }.to yield_successive_args(*expected)
244
      end
245
    end
246

247
    context 'when given a username, user_file and pass_file' do
248
      let(:password) { nil }
249
      let(:username) { 'my_username' }
250
      let(:user_file) do
251
        filename = "user_file"
252
        stub_file = StringIO.new("asdf\njkl\n")
253
        allow(File).to receive(:open).with(filename, /^r/).and_yield stub_file
254

255
        filename
256
      end
257

258
      let(:pass_file) do
259
        filename = "pass_file"
260
        stub_file = StringIO.new("asdf\njkl\n")
261
        allow(File).to receive(:open).with(filename, /^r/).and_return stub_file
262

263
        filename
264
      end
265

266
      it do
267
        expect { |b| collection.each(&b) }.to yield_successive_args(
268
                                                Metasploit::Framework::Credential.new(public: "my_username", private: "asdf"),
269
                                                Metasploit::Framework::Credential.new(public: "my_username", private: "jkl"),
270
                                                Metasploit::Framework::Credential.new(public: "asdf", private: "asdf"),
271
                                                Metasploit::Framework::Credential.new(public: "asdf", private: "jkl"),
272
                                                Metasploit::Framework::Credential.new(public: "jkl", private: "asdf"),
273
                                                Metasploit::Framework::Credential.new(public: "jkl", private: "jkl")
274
                                              )
275
      end
276
    end
277

278
    context "when :user_as_pass is true" do
279
      let(:user_as_pass) { true }
280
      specify  do
281
        expect { |b| collection.each(&b) }.to yield_successive_args(
282
          Metasploit::Framework::Credential.new(public: username, private: password),
283
          Metasploit::Framework::Credential.new(public: username, private: username),
284
        )
285
      end
286
    end
287

288
    context "when :nil_passwords is true" do
289
      let(:nil_passwords) { true }
290
      specify  do
291
        expect { |b| collection.each(&b) }.to yield_successive_args(
292
          Metasploit::Framework::Credential.new(public: username, private: nil),
293
          Metasploit::Framework::Credential.new(public: username, private: password),
294
        )
295
      end
296
    end
297

298
    context "when :blank_passwords is true" do
299
      let(:blank_passwords) { true }
300
      specify  do
301
        expect { |b| collection.each(&b) }.to yield_successive_args(
302
          Metasploit::Framework::Credential.new(public: username, private: password),
303
          Metasploit::Framework::Credential.new(public: username, private: ""),
304
        )
305
      end
306
    end
307

308
  end
309

310
  describe "#empty?" do
311
    context "when only :userpass_file is set" do
312
      let(:username) { nil }
313
      let(:password) { nil }
314
      let(:userpass_file) { "test_file" }
315
      specify do
316
        expect(collection.empty?).to eq false
317
      end
318
    end
319

320
    context "when :username is set" do
321
      context "and :password is set" do
322
        specify do
323
          expect(collection.empty?).to eq false
324
        end
325
      end
326

327
      context "and :password is not set" do
328
        let(:password) { nil }
329
        specify do
330
          expect(collection.empty?).to eq true
331
        end
332

333
        context "and :nil_passwords is true" do
334
          let(:nil_passwords) { true }
335
          specify do
336
            expect(collection.empty?).to eq false
337
          end
338
        end
339

340
        context "and :blank_passwords is true" do
341
          let(:blank_passwords) { true }
342
          specify do
343
            expect(collection.empty?).to eq false
344
          end
345
        end
346
      end
347
    end
348

349
    context "when :username is not set" do
350
      context "and :password is not set" do
351
        let(:username) { nil }
352
        let(:password) { nil }
353
        specify do
354
          expect(collection.empty?).to eq true
355
        end
356

357
        context "and :prepended_creds is not empty" do
358
          let(:prepended_creds) { [ "test" ] }
359
          specify do
360
            expect(collection.empty?).to eq false
361
          end
362
        end
363

364
        context "and :additional_privates is not empty" do
365
          let(:additional_privates) { [ "test_private" ] }
366
          specify do
367
            expect(collection.empty?).to eq true
368
          end
369
        end
370

371
        context "and :additional_publics is not empty" do
372
          let(:additional_publics) { [ "test_public" ] }
373
          specify do
374
            expect(collection.empty?).to eq true
375
          end
376
        end
377
      end
378
    end
379
  end
380

381
  describe "#prepend_cred" do
382
    specify do
383
      prep = Metasploit::Framework::Credential.new(public: "foo", private: "bar")
384
      collection.prepend_cred(prep)
385
      expect { |b| collection.each(&b) }.to yield_successive_args(
386
        prep,
387
        Metasploit::Framework::Credential.new(public: username, private: password),
388
      )
389
    end
390
  end
391

392
end
393

394