Skip to content

Commit 64aeccc

Browse files
Mathiou04Mathiou04
committed
CredentialCollection: adding various tests that currently fails to demonstrate multiple bugs in the each method
1 parent 03dc231 commit 64aeccc

File tree

1 file changed

+263
-0
lines changed

1 file changed

+263
-0
lines changed

‎spec/lib/metasploit/framework/credential_collection_spec.rb

+263
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@
9898
Metasploit::Framework::Credential.new(public: "foo", private: "bar"),
9999
)
100100
end
101+
102+
# REMOVE BEFORE COMMIT: question for the userpass file: do we want to make options work with it or not?
101103
end
102104

103105
context "when given a pass_file and user_file" do
@@ -311,6 +313,20 @@
311313
Metasploit::Framework::Credential.new(public: username, private: password),
312314
)
313315
end
316+
317+
context "when using password spraying" do
318+
let(:password_spray) { true }
319+
320+
# REMOVE BEFORE COMMIT: yields nothings, fails because of bug in method
321+
context "without password" do
322+
let(:password) { nil }
323+
specify do
324+
expect { |b| collection.each(&b) }.to yield_successive_args(
325+
Metasploit::Framework::Credential.new(public: username, private: nil),
326+
)
327+
end
328+
end
329+
end
314330
end
315331

316332
context "when :blank_passwords is true" do
@@ -323,6 +339,253 @@
323339
end
324340
end
325341

342+
context "when given additional_publics" do
343+
let(:username) { nil }
344+
let(:password) { nil }
345+
let(:additional_publics) { [ "test_public" ] }
346+
347+
context "when :user_as_pass is true" do
348+
let(:user_as_pass) { true }
349+
350+
# REMOVE BEFORE COMMIT currently failing
351+
specify do
352+
expect { |b| collection.each(&b) }.to yield_successive_args(
353+
Metasploit::Framework::Credential.new(public: "test_public", private: "test_public"),
354+
)
355+
end
356+
357+
358+
context "when using password spraying" do
359+
let(:password_spray) { true }
360+
361+
# REMOVE BEFORE COMMIT currently failing
362+
specify do
363+
expect { |b| collection.each(&b) }.to yield_successive_args(
364+
Metasploit::Framework::Credential.new(public: "test_public", private: "test_public"),
365+
)
366+
end
367+
end
368+
end
369+
370+
context "when :nil_passwords is true" do
371+
let(:nil_passwords) { true }
372+
373+
# REMOVE BEFORE COMMIT: this option is ignored currently for additional_publics
374+
specify do
375+
expect { |b| collection.each(&b) }.to yield_successive_args(
376+
Metasploit::Framework::Credential.new(public: "test_public", private: nil),
377+
)
378+
end
379+
end
380+
381+
context "when using password spraying" do
382+
let(:password_spray) { true }
383+
384+
context "when :blank_passwords and :nil_password are true" do
385+
let(:blank_passwords) { true }
386+
let(:nil_passwords) { true }
387+
388+
context "with 2 additional_publics" do
389+
let(:additional_publics) { [ "test_public1", "test_public2" ] }
390+
391+
# REMOVE BEFORE COMMIT: fails because no pwd spraying
392+
specify do
393+
expect { |b| collection.each(&b) }.to yield_successive_args(
394+
Metasploit::Framework::Credential.new(public: "test_public1", private: ""),
395+
Metasploit::Framework::Credential.new(public: "test_public2", private: ""),
396+
Metasploit::Framework::Credential.new(public: "test_public1", private: nil),
397+
Metasploit::Framework::Credential.new(public: "test_public2", private: nil),
398+
)
399+
end
400+
end
401+
end
402+
403+
context "when given a user file" do
404+
let(:user_file) do
405+
filename = "user_file"
406+
stub_file = StringIO.new("asdf\njkl\n")
407+
allow(File).to receive(:open).with(filename, /^r/).and_return stub_file
408+
409+
filename
410+
end
411+
412+
# REMOVE BEFORE COMMIT: this also yields the usernames as passwords for the additional_public
413+
context "when given a password" do
414+
let(:password) { "password" }
415+
416+
specify do
417+
expect { |b| collection.each(&b) }.to yield_successive_args(
418+
Metasploit::Framework::Credential.new(public: "adsf", private: "password"),
419+
Metasploit::Framework::Credential.new(public: "jkl", private: "password"),
420+
Metasploit::Framework::Credential.new(public: "test_public", private: "password"),
421+
)
422+
end
423+
end
424+
end
425+
end
426+
end
427+
428+
context "when using password spraying" do
429+
let(:password_spray) { true }
430+
let(:username) { nil }
431+
let(:password) { nil }
432+
433+
context "when :blank_passwords is true" do
434+
let(:blank_passwords) { true }
435+
436+
context "with password (but no username)" do
437+
let(:password) { "pass" }
438+
439+
# REMOVE BEFORE COMMIT: this yields empty creds (no username, no pass)
440+
specify do
441+
expect { |b| collection.each(&b) }.to yield_successive_args()
442+
end
443+
end
444+
445+
# REMOVE BEFORE COMMIT: yields nothings, fails because of bug in method
446+
context "with username (but no password)" do
447+
let(:username) { "user" }
448+
449+
specify do
450+
expect { |b| collection.each(&b) }.to yield_successive_args(
451+
Metasploit::Framework::Credential.new(public: username, private: ''),
452+
)
453+
end
454+
end
455+
end
456+
457+
context "when given a user_file" do
458+
let(:user_file) do
459+
filename = "foo"
460+
stub_file = StringIO.new("asdf\njkl\n")
461+
allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
462+
463+
filename
464+
end
465+
466+
# REMOVE BEFORE COMMIT: yields nothing, same for blank passwords option
467+
specify do
468+
expect { |b| collection.each(&b) }.to yield_successive_args(
469+
Metasploit::Framework::Credential.new(public: "asdf", private: nil),
470+
Metasploit::Framework::Credential.new(public: "jkl", private: nil),
471+
)
472+
end
473+
end
474+
475+
context "when :nil_passwords is true" do
476+
let(:nil_passwords) { true }
477+
478+
specify do
479+
expect { |b| collection.each(&b) }.to yield_successive_args(
480+
Metasploit::Framework::Credential.new(public: "asdf", private: nil),
481+
Metasploit::Framework::Credential.new(public: "jkl", private: nil),
482+
Metasploit::Framework::Credential.new(public: "asdf", private: password),
483+
Metasploit::Framework::Credential.new(public: "jkl", private: password),
484+
)
485+
end
486+
end
487+
end
488+
489+
context "when every possible option is used" do
490+
let(:nil_passwords) { true }
491+
let(:blank_passwords) { true }
492+
let(:username) { "user" }
493+
let(:password) { "pass" }
494+
let(:user_file) do
495+
filename = "user_file"
496+
stub_file = StringIO.new("userfile")
497+
allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
498+
499+
filename
500+
end
501+
let(:pass_file) do
502+
filename = "pass_file"
503+
stub_file = StringIO.new("passfile\n")
504+
allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
505+
506+
filename
507+
end
508+
let(:user_as_pass) { false }
509+
let(:userpass_file) do
510+
filename = "userpass_file"
511+
stub_file = StringIO.new("userpass_user userpass_pass\n")
512+
allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
513+
514+
filename
515+
end
516+
let(:prepended_creds) { ['test_prepend'] }
517+
let(:additional_privates) { ['test_private'] }
518+
let(:additional_publics) { ['test_public'] }
519+
520+
# REMOVE BEFORE COMMIT: fails because of the useraspass error, then fails because of the nil value for addiitonal publics and should be ok then
521+
specify do
522+
expect { |b| collection.each(&b) }.to yield_successive_args(
523+
"test_prepend",
524+
Metasploit::Framework::Credential.new(public: "user", private: nil),
525+
Metasploit::Framework::Credential.new(public: "user", private: "pass"),
526+
Metasploit::Framework::Credential.new(public: "user", private: "user"),
527+
Metasploit::Framework::Credential.new(public: "user", private: ""),
528+
Metasploit::Framework::Credential.new(public: "user", private: "passfile"),
529+
Metasploit::Framework::Credential.new(public: "user", private: "test_private"),
530+
Metasploit::Framework::Credential.new(public: "userfile", private: nil),
531+
Metasploit::Framework::Credential.new(public: "userfile", private: "pass"),
532+
Metasploit::Framework::Credential.new(public: "userfile", private: "userfile"),
533+
Metasploit::Framework::Credential.new(public: "userfile", private: ""),
534+
Metasploit::Framework::Credential.new(public: "userfile", private: "passfile"),
535+
Metasploit::Framework::Credential.new(public: "userfile", private: "test_private"),
536+
Metasploit::Framework::Credential.new(public: "userpass_user", private: "userpass_pass"),
537+
Metasploit::Framework::Credential.new(public: "test_public", private: nil), # missing this case
538+
Metasploit::Framework::Credential.new(public: "test_public", private: "pass"),
539+
Metasploit::Framework::Credential.new(public: "test_public", private: "test_public"),
540+
Metasploit::Framework::Credential.new(public: "test_public", private: ""),
541+
Metasploit::Framework::Credential.new(public: "test_public", private: "passfile"),
542+
Metasploit::Framework::Credential.new(public: "test_public", private: "test_private")
543+
)
544+
end
545+
546+
context "when using password spraying" do
547+
let(:password_spray) { true }
548+
let(:user_file) do
549+
filename = "user_file"
550+
stub_file = StringIO.new("userfile")
551+
allow(File).to receive(:open).with(filename,/^r/).and_return stub_file
552+
553+
filename
554+
end
555+
let(:pass_file) do
556+
filename = "pass_file"
557+
stub_file = StringIO.new("passfile\n")
558+
allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file
559+
560+
filename
561+
end
562+
563+
specify do
564+
expect { |b| collection.each(&b) }.to yield_successive_args(
565+
"test_prepend",
566+
Metasploit::Framework::Credential.new(public: "user", private: nil),
567+
Metasploit::Framework::Credential.new(public: "userfile", private: nil),
568+
Metasploit::Framework::Credential.new(public: "test_public", private: nil),
569+
Metasploit::Framework::Credential.new(public: "user", private: "pass"),
570+
Metasploit::Framework::Credential.new(public: "userfile", private: "pass"),
571+
Metasploit::Framework::Credential.new(public: "test_public", private: "pass"),
572+
Metasploit::Framework::Credential.new(public: "user", private: "user"),
573+
Metasploit::Framework::Credential.new(public: "userfile", private: "userfile"),
574+
Metasploit::Framework::Credential.new(public: "test_public", private: "test_public"),
575+
Metasploit::Framework::Credential.new(public: "user", private: ""),
576+
Metasploit::Framework::Credential.new(public: "userfile", private: ""),
577+
Metasploit::Framework::Credential.new(public: "test_public", private: ""),
578+
Metasploit::Framework::Credential.new(public: "user", private: "passfile"),
579+
Metasploit::Framework::Credential.new(public: "userfile", private: "passfile"),
580+
Metasploit::Framework::Credential.new(public: "test_public", private: "passfile"),
581+
Metasploit::Framework::Credential.new(public: "userpass_user", private: "userpass_pass"),
582+
Metasploit::Framework::Credential.new(public: "user", private: "test_private"),
583+
Metasploit::Framework::Credential.new(public: "userfile", private: "test_private"),
584+
Metasploit::Framework::Credential.new(public: "test_public", private: "test_private"),
585+
)
586+
end
587+
end
588+
end
326589
end
327590

328591
describe "#empty?" do

0 commit comments

Comments
 (0)