touch up visual_mining_netcharts_upload

Author: kernelsmith

modules/exploits/multi/http/visual_mining_netcharts_upload.rb

@@ -19,13 +19,15 @@ def initialize(info = {})
     super(update_info(info,
       'Name'        => 'Visual Mining NetCharts Server Remote Code Execution',
       'Description' => %q{
-        This module exploits multiple vulnerabilities on Visual Mining NetCharts. First of all, a
-        lack of  input validation in the administration console allows to upload arbitrary jsp code
-        to locations accessible later through the web service. But authentication is required to
-        access the administration console. To bypass authentication, a 'hidden' user is available
-        by default (and non editable). This user, named 'Scheduler', only will be able to log in
-        the console after some modification in the user's database. If the 'Scheduler' user isn't
-        available it's possible to provide valid credentials through the datastore options.
+        This module exploits multiple vulnerabilities in Visual Mining NetCharts.
+        First, a lack of input validation in the administration console permits
+        arbitrary jsp code upload to locations accessible later through the web
+        service. Authentication is typically required, however a 'hidden' user is
+        available by default (and non editable). This user, named 'Scheduler',
+        can only login to the console after any modification in the user
+        database (a user is added, admin password is changed etc). If the
+        'Scheduler' user isn't available valid credentials must be supplied. The
+        default Admin password is Admin.
       },
       'Author'       =>
         [
@@ -65,10 +67,10 @@ def check
     })
 
     if res && res.code == 200 && res.body && res.body.to_s.include?(SIGNATURE)
-      return Exploit::CheckCode::Detected
+      Exploit::CheckCode::Detected
+    else
+      Exploit::CheckCode::Safe
     end
-
-    Exploit::CheckCode::Safe
   end
 
   def exploit
@@ -114,25 +116,17 @@ def upload(file_name, contents)
     })
 
     if res && res.code == 200 && res.body && res.body.to_s.include?(SIGNATURE)
-      return true
+      true
+    else
+      false
     end
-
-    false
   end
 
   def username
-    if datastore['USERNAME'].blank?
-      return DEFAULT_USERNAME
-    end
-
-    datastore['USERNAME']
+    datastore['USERNAME'].blank? ? DEFAULT_USERNAME : datastore['USERNAME']
   end
 
   def password
-    if datastore['PASSWORD'].blank?
-      return DEFAULT_PASSWORD
-    end
-
-    datastore['PASSWORD']
+    datastore['PASSWORD'].blank? ? DEFAULT_PASSWORD : datastore['PASSWORD']
   end
 end