AuthBrute

Msf::Auxiliary::AuthBrute standardizes login attempts using username and password dictionaries. Its implementation is lib/msf/core/auxiliary/auth_brute.rb. Combine it with SSH, SMB, or HTTP login scanners.

include

include Msf::Auxiliary::AuthBrute
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report

Main options added

Option	Meaning
USERNAME / PASSWORD	One credential pair
USER_FILE / PASS_FILE	Dictionaries
USERPASS_FILE	user pass format
USER_AS_PASS	Also try the username as the password
BLANK_PASSWORDS	Try a blank password
STOP_ON_SUCCESS	Stop on a host after success
BRUTEFORCE_SPEED	Speed from 0 to 5
DB_ALL_CREDS / DB_ALL_USERS / DB_ALL_PASS	Add candidates from the database
PASSWORD_SPRAY	Rotate through users with a fixed password (advanced)

Basic structure

def run_host(ip)
  cred_collection = build_credential_collection(
    username: datastore['USERNAME'],
    password: datastore['PASSWORD']
  )

  scanner = Metasploit::Framework::LoginScanner::SSH.new(
    configure_login_scanner(
      host: ip,
      port: rport,
      cred_details: cred_collection,
      stop_on_success: datastore['STOP_ON_SUCCESS'],
      framework: framework,
      framework_module: self
    )
  )

  scanner.scan! do |result|
    credential_data = result.to_h
    credential_data.merge!(
      module_fullname: fullname,
      workspace_id: myworkspace_id
    )
    if result.success?
      create_credential_and_login(credential_data)
      print_good("#{ip}:#{rport} - Success: #{result.credential}")
    else
      invalidate_login(credential_data)
      vprint_error("#{ip}:#{rport} - Failed: #{result.credential}")
    end
  end
end

A larger, real example: modules/auxiliary/scanner/ssh/ssh_login.rb

Patterns

Pattern	Setting
Check one known credential	USERNAME + PASSWORD, with empty dictionaries
Fixed user, password dictionary	USERNAME + PASS_FILE
Both dictionaries	USER_FILE + PASS_FILE
Password spraying	PASSWORD_SPRAY true with many users
Reuse credentials in the database	DB_ALL_CREDS true (requires the database)

Cautions

• Watch for lockouts and attempt rates even in HTB or other test environments.
• Setting DB_ALL_* without a database connection produces a warning and is ignored.
• If you also want a session after success, check options such as CreateSession or the CommandShell mixin separately; availability depends on the module.