Fix #9513, Add private_type to be able to store password for Tomcat

[wchen-r7]

Description

This PR fixes a credential reporting issue with auxiliary/scanner/http/tomcat_mgr_login.

If there is no :private_type, the create_credential method in Metasploit::Credential::Creation will quietly skip the password, which makes it look like a bug when the user is trying to view
the password from the creds command.

Fix #9513

Verification

• Set up a Tomcat instance (make sure you have Java installed): apache-tomcat-9.0.1.zip
• Save a new username/password in data/wordlists/tomcat_mgr_default_userpass.txt. Make sure the new user/pass is the last on the list.
• Start msfconsole
• Do: use auxiliary/scanner/http/tomcat_mgr_login
• Do: set rhosts [ip]
• Do: run
• Do: creds
• Make sure you can see your new user/pass, also the private_type on the list.

[zeroSteiner]

Works as intended. The details in the issue report were alot of help in trying to reproduce the problem before verifying this addressed it.

Example with the patch:

metasploit-framework (S:0 J:0) auxiliary(scanner/http/tomcat_mgr_login) > set RHOSTS 192.168.254.121
RHOSTS => 192.168.254.121
metasploit-framework (S:0 J:0) auxiliary(scanner/http/tomcat_mgr_login) > run

[-] [2018.02.13-19:22:46] 192.168.254.121:8080 - LOGIN FAILED: admin:admin (Incorrect)
[-] [2018.02.13-19:22:46] 192.168.254.121:8080 - LOGIN FAILED: admin:manager (Incorrect)
[-] [2018.02.13-19:22:46] 192.168.254.121:8080 - LOGIN FAILED: admin:role1 (Incorrect)
...
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: both:vagrant (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: j2deployer:j2deployer (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: ovwebusr:OvW*busr1 (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: cxsdk:kdsxc (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: root:owaspbwa (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: ADMIN:ADMIN (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: xampp:xampp (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: tomcat:s3cret (Incorrect)
[-] [2018.02.13-19:22:48] 192.168.254.121:8080 - LOGIN FAILED: QCC:QLogic66 (Incorrect)
[-] [2018.02.13-19:22:49] 192.168.254.121:8080 - LOGIN FAILED: admin:vagrant (Incorrect)
[+] [2018.02.13-19:22:49] 192.168.254.121:8080 - Login Successful: msftest:msftest123!
[*] [2018.02.13-19:22:49] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
metasploit-framework (S:0 J:0) auxiliary(scanner/http/tomcat_mgr_login) > creds 
Credentials
===========

host             origin           service          public   private      realm  private_type
----             ------           -------          ------   -------      -----  ------------
192.168.254.121  192.168.254.121  8080/tcp (http)  msftest  msftest123!         Password

metasploit-framework (S:0 J:0) auxiliary(scanner/http/tomcat_mgr_login) > 

I'll get this landed momentarily.

[zeroSteiner]

Release Notes

This fix resolves a bug in the auxiliary/scanner/http/tomcat_mgr_login module that was causing a recovered credential pair to not be stored in the database under certain conditions. The module now ensures that the private_type is set to password, causing the information to be stored correctly.