Going the extra mile – customizing the Metasploit exploit

For the Metasploit module we used in the previous section, exploit/multi/http/wp_crop_rce, we need to have the username and password set for the module to work. But what if there's a reCAPTCHA in place at the time of authentication? The module will surely fail because there's no workaround for the module to get the session cookie:

1. Let's modify the module so that it works with the COOKIE datastore as well:

We can see the updated module options in the following screenshot:

2. Let's define a function for the COOKIE datastore:

3. We also need to validate the cookie based on the response code. So, let's define a validate_cookie() function; this will validate the cookie with a 200 HTTP response code:

4. Now, in the exploit() function, let's include a fail-safe fail_with() method to ensure...