Land #7432, Fix erroneous cred reporting in SonicWALL exploit

rapid7 · Oct 13, 2016 · 2014b2d · 2014b2d
2 parents a2a1d6c + e78d3d6
commit 2014b2d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/exploits/multi/http/sonicwall_scrutinizer_methoddetail_sqli.rb b/modules/exploits/multi/http/sonicwall_scrutinizer_methoddetail_sqli.rb
@@ -180,10 +180,10 @@ def do_login
       fail_with(Failure::NoAccess, "Username '#{datastore['USERNAME']}' is incorrect.")
     elsif res['loginfailed']
       fail_with(Failure::NoAccess, "Password '#{datastore['PASSWORD']}' is incorrect.")
+    elsif res['sessionid']
+      report_cred(datastore['USERNAME'], datastore['PASSWORD'])
     end
 
-    report_cred(datastore['USERNAME'], datastore['PASSWORD'])
-
     res
   end