Metasploit: send_request_cgi returns nil for HTTPS connections

Question

I am currently trying to write an auxiliary module for Metasploit. The module basically tries multiple default credentials to get access to the router's management page. The authentication is done via web, i.e. HTTP POST.

Currently, the module works as expected for plain HTTP connections, i.e. unsecured connections, however every connection attempt via HTTPS (port 443), returns nil. Below is the function used within the Metasploit class to retrieve the login page:

def get_login_page(ip)
 begin
  response = send_request_cgi(
    'uri'   =>  '/',
    'method' =>  'GET'
  )

  # Some models of ZyXEL ZyWALL return a 200 OK response
  # and use javascript to redirect to the rpAuth.html page.
  if response && response.body =~ /changeURL\('rpAuth.html'\)/
    vprint_status "#{ip}- Redirecting to rpAuth.html page..."
    response = send_request_cgi(
      'uri'   =>  '/rpAuth.html',
      'method' =>  'GET'
    )
  end

 rescue ::Rex::ConnectionError
   vprint_error "#{ip} - Failed to connect to Web management console."
 end
 return response
end

When trying to connect via HTTPS, the first send_request_cgi call returns nil. No exception are caught or thrown. I have tried with 3 different hosts to make sure the issue was not with a specific endpoint. All my 3 attempts failed to return a response. At every attempt, I set the RPORT option to 443;

RHOSTS  0.0.0.0 yes       The target address range or CIDR identifier
RPORT   443     yes       The target port

Note that I have replaced the real IP with 0.0.0.0. Using a web browser, I can actually connect to the router via HTTPS with no issue (other than having to add an exception since the certificate is untrusted) and am presented the login page. With Wireshark, I tried to look at the generated traffic. I can clearly see that nothing is sent by the router. I notice the 3-way handshake being completed and the HTTP GET request being made:

GET / HTTP/1.1
Host: 0.0.0.0
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

There are 3-4 ACK after and then a FIN/PUSH sent by the server.

Based on this page on Metasploit's GitHub, I was under the impression that connections to HTTPS websites were handled by the underlying framework. I have not seen any articles/tutorial/source that leads me to believe otherwise. The doc about the send_request_cgi does not specify any specific requirement to establish a HTTPS connection. Other posts did not had the exact same issue I'm having. At this point I suspect either the OS, the framework or me forgetting to enable something. Other modules I have looked at either only targets HTTP websites - which I doubt - or do not have any special handling for HTTPS connections.

Any help determining the cause would be greatly appreciated.

Version of Metasploit: Framework: 4.9.3-2014060501 Console : 4.9.3-2014060501.15168

Version of OS: SMP Debian 3.14.5-1kali1 (2014-06-07)

Answer 1

As per this post on SecurityStreet, the solution was to set SSL to true in the DefaultOptions in the initialize function:

def initialize
  super(
    ...
    'DefaultOptions' =>
      {
        ...
        'SSL' => true
      }
   )
   ...
end

Connections to routers using HTTPS worked afterwards.