rapid7/metasploit-framework — pull request #3571 by Ceenix (2014-07-25 13:52:16+00:00)
Title: Add Wordpress XML-RPC Login Scanner

This module attempts to authenticate against a Wordpress-site (via
XMLRPC) using username and password combinations indicated by the
USER_FILE, PASS_FILE, and USERPASS_FILE options.

The module, checks for XMLRPC response using `demo.sayHello` function
and sweeps users with `wp.getUsers` function.
Please note that if `demo.sayHello` request fails, module will abort the operation.

Module tested with the latest wordpress version (3.9.1)

#### Usage:
+ Install Wordpress (>3.5)
+ Set Options in the module
+ Set RHOSTS
+ Set USERFILE
+ Set PASSFILE
+ Run the module

### Here is an example usage:
![screenshot](https://cloud.githubusercontent.com/assets/8256314/3702517/5f2713c6-1400-11e4-8582-426af1193073.png)

### Example Verbose Output:
If the `VERBOSE` option set `TRUE`, the module will print raw XML output.

![screenshot_verbose](https://cloud.githubusercontent.com/assets/8256314/3702607/2cb4c982-1401-11e4-8715-fa0512fb3e16.png)

If `ADMIN` account is obtained, more detailed XML output will be returned:
![screenshot_admin_verbose](https://cloud.githubusercontent.com/assets/8256314/3702766/d1a1728c-1402-11e4-8105-e8b8f6e728a4.png)

### Example Creds Output:
![screenshot_cred](https://cloud.githubusercontent.com/assets/8256314/3702622/5e0e3766-1401-11e4-9de5-4cc078e693dc.png)