Land rapid7#7433, Add IP Addresses to HTTP PUT/DELETE scanner output

Author: wwebb-r7

modules/auxiliary/scanner/http/http_put.rb

@@ -54,7 +54,7 @@ def initialize
   # Send a normal HTTP request and see if we successfully uploaded or deleted a file.
   # If successful, return true, otherwise false.
   #
-  def file_exists(path, data)
+  def file_exists(path, data, ip)
     begin
       res = send_request_cgi(
         {
@@ -65,7 +65,7 @@ def file_exists(path, data)
         }, 20
       ).to_s
     rescue ::Exception => e
-      print_error("Error: #{e.to_s}")
+      print_error("#{ip}: Error: #{e.to_s}")
       return nil
     end
 
@@ -75,7 +75,7 @@ def file_exists(path, data)
   #
   # Do a PUT request to the server.  Function returns the HTTP response.
   #
-  def do_put(path, data)
+  def do_put(path, data, ip)
     begin
       res = send_request_cgi(
         {
@@ -86,7 +86,7 @@ def do_put(path, data)
         }, 20
       )
     rescue ::Exception => e
-      print_error("Error: #{e.to_s}")
+      print_error("#{ip}: Error: #{e.to_s}")
       return nil
     end
 
@@ -96,7 +96,7 @@ def do_put(path, data)
   #
   # Do a DELETE request. Function returns the HTTP response.
   #
-  def do_delete(path)
+  def do_delete(path, ip)
     begin
       res = send_request_cgi(
         {
@@ -106,7 +106,7 @@ def do_delete(path)
         }, 20
       )
     rescue ::Exception => e
-      print_error("Error: #{e.to_s}")
+      print_error("#{ip}: Error: #{e.to_s}")
       return nil
     end
 
@@ -135,11 +135,11 @@ def run_host(ip)
       end
 
       # Upload file
-      res = do_put(path, data)
-      vprint_status("Reply: #{res.code.to_s}") if not res.nil?
+      res = do_put(path, data, ip)
+      vprint_status("#{ip}: Reply: #{res.code.to_s}") if not res.nil?
 
       # Check file
-      if not res.nil? and file_exists(path, data)
+      if not res.nil? and file_exists(path, data, ip)
         turl = "#{(ssl ? 'https' : 'http')}://#{ip}:#{rport}#{path}"
         print_good("File uploaded: #{turl}")
         report_vuln(
@@ -152,26 +152,26 @@ def run_host(ip)
           :exploited_at => Time.now.utc
         )
       else
-        print_error("File doesn't seem to exist. The upload probably failed.")
+        print_error("#{ip}: File doesn't seem to exist. The upload probably failed.")
       end
 
     when 'DELETE'
       # Check file before deleting
       if path !~ /(.+\.\w+)$/
         print_error("You must supply a filename")
         return
-      elsif not file_exists(path, data)
+      elsif not file_exists(path, data, ip)
         print_error("File is already gone. Will not continue DELETE")
         return
       end
 
       # Delete our file
-      res = do_delete(path)
-      vprint_status("Reply: #{res.code.to_s}") if not res.nil?
+      res = do_delete(path, ip)
+      vprint_status("#{ip}: Reply: #{res.code.to_s}") if not res.nil?
 
       # Check if DELETE was successful
-      if res.nil? or file_exists(path, data)
-        print_error("DELETE failed. File is still there.")
+      if res.nil? or file_exists(path, data, ip)
+        print_error("#{ip}: DELETE failed. File is still there.")
       else
         turl = "#{(ssl ? 'https' : 'http')}://#{ip}:#{rport}#{path}"
         print_good("File deleted: #{turl}")