Fix Gitlab login scanner ignoring user and pass (#18831)

[Takahiro-Yoko]

fixes #18831
(and rubocop formatting and add doc)

Before

HttpUsername, USERNAME, HttpPassword and PASSWORD options exist.
HttpUsername and HttpPassword are used.
USERNAME and PASSWORD are not used.

After

Remove HttpUsername and HttpPassword.
Use USERNAME and PASSWORD instead.

Verification

1. Install GitLab and start it
2. Start msfconsole
3. Do: use auxiliary/scanner/http/gitlab_login
4. Do: set rhosts
5. Do: set usernames and passwords via the username and password options, or pass a list via user_file and pass_file options
6. Do: run

Result

[jheysel-r7]

Thanks for the fix, the documentation file and for running rubocop @Takahiro-Yoko! Everything looks great 👍

Before

HttpUsername and HttpPassword are used:

msf6 auxiliary(scanner/http/gitlab_login) > set HttpUsername msfuser
HttpUsername => msfuser
msf6 auxiliary(scanner/http/gitlab_login) > set HttpPassword notpassword
HttpPassword => notpassword
msf6 auxiliary(scanner/http/gitlab_login) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf6 auxiliary(scanner/http/gitlab_login) > set rport 1680
rport => 1680
msf6 auxiliary(scanner/http/gitlab_login) > run

[*] 127.0.0.1:1680 - GitLab v7 login page
[!] No active DB -- Credential data will not be saved!
[+] 127.0.0.1:1680 - Login Successful: msfuser:notpassword
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

After

username and password are used

msf6 auxiliary(scanner/http/gitlab_login) > set username msfuser
username => msfuser
msf6 auxiliary(scanner/http/gitlab_login) > set password notpassword
password => notpassword
msf6 auxiliary(scanner/http/gitlab_login) > run

[*] 127.0.0.1:1680 - GitLab v7 login page
[!] No active DB -- Credential data will not be saved!
[+] 127.0.0.1:1680 - Login Successful: msfuser:notpassword
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

user_file and pass_file work as expected:

msf6 auxiliary(scanner/http/gitlab_login) > unset password
Unsetting password...
msf6 auxiliary(scanner/http/gitlab_login) > unset username
Unsetting username...
msf6 auxiliary(scanner/http/gitlab_login) > set user_file ~/tmp/users.txt
user_file => ~/tmp/users.txt
msf6 auxiliary(scanner/http/gitlab_login) > set pass_file ~/tmp/passwords.txt
pass_file => ~/tmp/passwords.txt
msf6 auxiliary(scanner/http/gitlab_login) > run

[-] Msf::OptionValidateError One or more options failed to validate: USER_FILE, PASS_FILE.
msf6 auxiliary(scanner/http/gitlab_login) > run

[*] 127.0.0.1:1680 - GitLab v7 login page
[!] No active DB -- Credential data will not be saved!
[-] 127.0.0.1:1680 - LOGIN FAILED: user:password (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: user:mydogsname (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: user:test123 (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: user:derp (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: user:notpassword (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: derp:password (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: derp:mydogsname (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: derp:test123 (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: derp:derp (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: derp:notpassword (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: bichael:password (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: bichael:mydogsname (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: bichael:test123 (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: bichael:derp (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: bichael:notpassword (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: mrtest:password (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: mrtest:mydogsname (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: mrtest:test123 (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: mrtest:derp (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: mrtest:notpassword (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: msfuser:password (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: msfuser:mydogsname (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: msfuser:test123 (Incorrect)
[-] 127.0.0.1:1680 - LOGIN FAILED: msfuser:derp (Incorrect)
[+] 127.0.0.1:1680 - Login Successful: msfuser:notpassword
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[jheysel-r7]

Release Notes

This fixes the gitlab_login scanner so that it uses the proper datastore options Username and Password which are the standard for login scanners. Before this fix the scanner was using HttpUsername and HttpPassword and ignoring the datastore options Username and Password