rapid7/metasploit-framework — pull request #4312 by wchen-r7 (2014-12-04 18:49:27+00:00)
Title: Fix #4304 - Blank password being tried when USER_AS_PASS is true

Fix #4304

## Root Cause ##

This is kind of a design conflict between the BLANK_PASSWORDS option vs the SMB_PASS option.

If we allow BLANK_PASSWORDS, it implies we allow the user to decide whether there should be an empty string as the SMB password or not. But if we always set the default value of SMB_PASS to an empty string,
we're actually not respecting the BLANK_PASSWORDS option. In other words, as long as the BLANK_PASSWORDS option exists, it is important to know SMB_PASS may be nil, not always a string.

Not respecting BLANK_PASSWORDS when false can result in account lockouts during a pentest.

## Verification ##

- [ ] Set up a Windows box
- [ ] Start msfconsole
- [ ] ```use auxiliary/scanner/smb/smb_login```
- [ ] ```set rhosts [IP]```
- [ ] ```set user_as_pass true```
- [ ] ```set smbuser [username]```
- [ ] Make sure blank_password is false
- [ ] ```run```
- [ ] You should not see an empty password being used (basically there should be only one login attempt)