rapid7/metasploit-framework — pull request #3955 by wchen-r7 (2014-10-06 20:54:44+00:00)
Title: Fix #3808 - NoMethodError undefined method `map' for wordpress_login_enum

This fixes #3808.

## Root Cause

The problem is due to ```load_password_vars``` not being used correctly by wordpress_login_enum. The module tries to make sure the PASS_FILE datastore option is loaded, so it does this:

```
load_password_vars(datastore['PASS_FILE'])
```

And PASS_FILE is a string, and that's supposed to be an array, which is the reason why it's causing the backtrace. However, it doesn't really need to pass PASS_FILE like that. Because when you call ```load_password_vars```, the method already does it for you:

```ruby
def load_password_vars(credentials = nil)
passwords = extract_words(datastore['PASS_FILE'])
...
```

### Verification Steps

- [ ] Download Wordpress: https://wordpress.org/download/
- [ ] Install Wordpress, and make sure you can login.
- [ ] Open up a terminal, create a PASS_FILE like the following:

```
echo pass1 > /tmp/pass.txt
echo pass2 >> /tmp/pass.txt
echo pass3 >> /tmp/pass.txt
```

- [ ] Load msfconsole
- [ ] Set RHOSTS to your Wordpress box
- [ ] Set PASS_FILE to /tmp/pass.txt
- [ ] Run
- [ ] You should not see the ```NoMethodError undefined method `map'``` error again.

An example of the output you should see should look like this:

```
msf auxiliary(wordpress_login_enum) > run

[*] /wordpress/ - WordPress Version 3.5 detected
[*] /wordpress/ - WordPress User-Enumeration - Running User Enumeration
[+] /wordpress/ - Found user 'admin' with id 1
[*] /wordpress/ - Usernames stored in: /Users/wchen/.msf4/loot/20141006155424_default_192.168.1.102_wordpress.users_776483.txt
[*] /wordpress/ - WordPress User-Validation - Running User Validation
[*] /wordpress/ - WordPress User-Validation - Checking Username:''
[-] /wordpress/ - WordPress User-Validation - Invalid Username: ''
[*] /wordpress/ - WordPress Brute Force - Running Bruteforce
[*] /wordpress/ - Brute-forcing previously found accounts...
[*] /wordpress/ - WordPress Brute Force - Trying username:'admin' with password:''
[-] /wordpress/ - WordPress Brute Force - Failed to login as 'admin'
[*] /wordpress/ - WordPress Brute Force - Trying username:'admin' with password:'pass1'
[-] /wordpress/ - WordPress Brute Force - Failed to login as 'admin'
[*] /wordpress/ - WordPress Brute Force - Trying username:'admin' with password:'pass2'
[-] /wordpress/ - WordPress Brute Force - Failed to login as 'admin'
[*] /wordpress/ - WordPress Brute Force - Trying username:'admin' with password:'pass3'
[-] /wordpress/ - WordPress Brute Force - Failed to login as 'admin'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```