Land rapid7#2718, @wchen-r7's deletion of @peer on HttpClient modules

Author: jvazquez-r7

modules/auxiliary/admin/http/axigen_file_access.rb

@@ -51,13 +51,11 @@ def initialize(info = {})
   end
 
   def run
-    @peer = "#{rhost}:#{rport}"
-
-    print_status("#{@peer} - Trying to login")
+    print_status("#{peer} - Trying to login")
     if login
-      print_good("#{@peer} - Login successful")
+      print_good("#{peer} - Login successful")
     else
-      print_error("#{@peer} - Login failed, review USERNAME and PASSWORD options")
+      print_error("#{peer} - Login failed, review USERNAME and PASSWORD options")
       return
     end
 
@@ -69,7 +67,7 @@ def run
       @traversal.gsub!(/\//, "\\")
       file.gsub!(/\//, "\\")
     else # unix
-      print_error("#{@peer} - *nix platform detected, vulnerability is only known to work on Windows")
+      print_error("#{peer} - *nix platform detected, vulnerability is only known to work on Windows")
       return
     end
 
@@ -83,7 +81,7 @@ def run
 
   def read_file(file)
 
-    print_status("#{@peer} - Retrieving file contents...")
+    print_status("#{peer} - Retrieving file contents...")
 
     res = send_request_cgi(
     {
@@ -98,14 +96,14 @@ def read_file(file)
 
     if res and res.code == 200 and res.headers['Content-Type'] and res.body.length > 0
       store_path = store_loot("axigen.webadmin.data", "application/octet-stream", rhost, res.body, file)
-      print_good("#{@peer} - File successfully retrieved and saved on #{store_path}")
+      print_good("#{peer} - File successfully retrieved and saved on #{store_path}")
     else
-      print_error("#{@peer} - Failed to retrieve file")
+      print_error("#{peer} - Failed to retrieve file")
     end
   end
 
   def delete_file(file)
-    print_status("#{@peer} - Deleting file #{file}")
+    print_status("#{peer} - Deleting file #{file}")
 
     res = send_request_cgi(
     {
@@ -121,14 +119,14 @@ def delete_file(file)
     })
 
     if res and res.code == 200 and res.body =~ /View Log Files/
-      print_good("#{@peer} - File #{file} deleted")
+      print_good("#{peer} - File #{file} deleted")
     else
-      print_error("#{@peer} - Error deleting file #{file}")
+      print_error("#{peer} - Error deleting file #{file}")
     end
   end
 
   def get_platform
-    print_status("#{@peer} - Retrieving platform")
+    print_status("#{peer} - Retrieving platform")
 
     res = send_request_cgi(
       {
@@ -142,15 +140,15 @@ def get_platform
 
     if res and res.code == 200
       if res.body =~ /Windows/
-        print_good("#{@peer} - Windows platform found")
+        print_good("#{peer} - Windows platform found")
         return 'windows'
       elsif res.body =~ /Linux/
-        print_good("#{@peer} - Linux platform found")
+        print_good("#{peer} - Linux platform found")
         return 'unix'
       end
     end
 
-    print_warning("#{@peer} - Platform not found, assuming UNIX flavor")
+    print_warning("#{peer} - Platform not found, assuming UNIX flavor")
     return 'unix'
   end
 

modules/auxiliary/admin/http/iis_auth_bypass.rb

@@ -76,19 +76,17 @@ def try_auth
   end
 
   def run
-    @peer = "#{rhost}:#{rport}"
-
     if not has_auth
-      print_error("#{@peer} - No basic authentication enabled")
+      print_error("#{peer} - No basic authentication enabled")
       return
     end
 
     bypass_string = try_auth
 
     if bypass_string.empty?
-      print_error("#{@peer} - The bypass attempt did not work")
+      print_error("#{peer} - The bypass attempt did not work")
     else
-      print_good("#{@peer} - You can bypass auth by doing: #{bypass_string}")
+      print_good("#{peer} - You can bypass auth by doing: #{bypass_string}")
     end
   end
 

modules/auxiliary/admin/http/intersil_pass_reset.rb

@@ -52,23 +52,22 @@ def check
       })
 
       if (res and (m = res.headers['Server'].match(/Boa\/(.*)/)))
-        print_status("#{@peer} - Boa Version Detected: #{m[1]}")
+        print_status("#{peer} - Boa Version Detected: #{m[1]}")
         return Exploit::CheckCode::Safe if (m[1][0].ord-48>0) # boa server wrong version
         return Exploit::CheckCode::Safe if (m[1][3].ord-48>4)
         return Exploit::CheckCode::Vulnerable
       else
-        print_status("#{@peer} - Not a Boa Server!")
+        print_status("#{peer} - Not a Boa Server!")
         return Exploit::CheckCode::Safe # not a boa server
       end
 
     rescue Rex::ConnectionRefused
-      print_error("#{@peer} - Connection refused by server.")
+      print_error("#{peer} - Connection refused by server.")
       return Exploit::CheckCode::Safe
     end
   end
 
   def run
-    @peer = "#{rhost}:#{rport}"
     return if check != Exploit::CheckCode::Vulnerable
 
     uri = normalize_uri(target_uri.path)
@@ -81,32 +80,32 @@ def run
     })
 
     if res.nil?
-      print_error("#{@peer} - The server may be down")
+      print_error("#{peer} - The server may be down")
       return
     elsif res and res.code != 401
-      print_status("#{@peer} - #{uri} does not have basic authentication enabled")
+      print_status("#{peer} - #{uri} does not have basic authentication enabled")
       return
     end
 
-    print_status("#{@peer} - Server still operational. Checking to see if password has been overwritten")
+    print_status("#{peer} - Server still operational. Checking to see if password has been overwritten")
     res = send_request_cgi({
       'uri'   => uri,
       'method'=> 'GET',
       'authorization' => basic_auth('admin', datastore['PASSWORD'])
     })
 
     if not res
-      print_error("#{@peer} - Server timedout, will not continue")
+      print_error("#{peer} - Server timedout, will not continue")
       return
     end
 
     case res.code
     when 200
-      print_good("#{@peer} - Password reset successful with admin:#{datastore['PASSWORD']}")
+      print_good("#{peer} - Password reset successful with admin:#{datastore['PASSWORD']}")
     when 401
-      print_error("#{@peer} - Access forbidden. The password reset attempt did not work")
+      print_error("#{peer} - Access forbidden. The password reset attempt did not work")
     else
-      print_status("#{@peer} - Unexpected response: Code #{res.code} encountered")
+      print_status("#{peer} - Unexpected response: Code #{res.code} encountered")
     end
 
   end

modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb

@@ -51,13 +51,11 @@ def initialize(info = {})
   end
 
   def run
-    @peer = "#{rhost}:#{rport}"
-
-    print_status("#{@peer} - Trying to login")
+    print_status("#{peer} - Trying to login")
     if login
-      print_good("#{@peer} - Login successful")
+      print_good("#{peer} - Login successful")
     else
-      print_error("#{@peer} - Login failed, review USERNAME and PASSWORD options")
+      print_error("#{peer} - Login failed, review USERNAME and PASSWORD options")
       return
     end
 
@@ -71,7 +69,7 @@ def run
 
   def read_file(file)
 
-    print_status("#{@peer} - Copying file to Web location...")
+    print_status("#{peer} - Copying file to Web location...")
 
     dst_path = "/usr/jakarta/tomcat/webapps/ROOT/m/"
     res = send_request_cgi(
@@ -88,12 +86,12 @@ def read_file(file)
     })
 
     if res and res.code == 200 and res.body =~ /\{"success":true\}/
-      print_good("#{@peer} - File #{file} copied to #{dst_path} successfully")
+      print_good("#{peer} - File #{file} copied to #{dst_path} successfully")
     else
-      print_error("#{@peer} - Failed to copy #{file} to #{dst_path}")
+      print_error("#{peer} - Failed to copy #{file} to #{dst_path}")
     end
 
-    print_status("#{@peer} - Retrieving file contents...")
+    print_status("#{peer} - Retrieving file contents...")
 
     res = send_request_cgi(
       {
@@ -103,17 +101,17 @@ def read_file(file)
 
     if res and res.code == 200
       store_path = store_loot("mutiny.frontend.data", "application/octet-stream", rhost, res.body, file)
-      print_good("#{@peer} - File successfully retrieved and saved on #{store_path}")
+      print_good("#{peer} - File successfully retrieved and saved on #{store_path}")
     else
-      print_error("#{@peer} - Failed to retrieve file")
+      print_error("#{peer} - Failed to retrieve file")
     end
 
     # Cleanup
     delete_file("#{dst_path}#{::File.basename(file)}")
   end
 
   def delete_file(file)
-    print_status("#{@peer} - Deleting file #{file}")
+    print_status("#{peer} - Deleting file #{file}")
 
     res = send_request_cgi(
     {
@@ -127,9 +125,9 @@ def delete_file(file)
     })
 
     if res and res.code == 200 and res.body =~ /\{"success":true\}/
-      print_good("#{@peer} - File #{file} deleted")
+      print_good("#{peer} - File #{file} deleted")
     else
-      print_error("#{@peer} - Error deleting file #{file}")
+      print_error("#{peer} - Error deleting file #{file}")
     end
   end
 

modules/auxiliary/admin/http/sophos_wpa_traversal.rb

@@ -72,7 +72,7 @@ def read_file(file)
     travs << file
     travs << "%00"
 
-    print_status("#{@peer} - Retrieving file contents...")
+    print_status("#{peer} - Retrieving file contents...")
 
     res = send_request_cgi(
       {
@@ -95,19 +95,17 @@ def read_file(file)
   end
 
   def run
-    @peer = "#{rhost}:#{rport}"
-
-    print_status("#{@peer} - Checking if it's a Sophos Web Protect Appliance with the vulnerable component...")
+    print_status("#{peer} - Checking if it's a Sophos Web Protect Appliance with the vulnerable component...")
     if is_proficy?
-      print_good("#{@peer} - Check successful")
+      print_good("#{peer} - Check successful")
     else
-      print_error("#{@peer} - Sophos Web Protect Appliance vulnerable component not found")
+      print_error("#{peer} - Sophos Web Protect Appliance vulnerable component not found")
       return
     end
 
     contents = read_file(datastore['FILEPATH'])
     if contents.nil?
-      print_error("#{@peer} - File not downloaded")
+      print_error("#{peer} - File not downloaded")
       return
     end
 
@@ -119,7 +117,7 @@ def run
         contents,
         file_name
     )
-    print_good("#{rhost}:#{rport} - File saved in: #{path}")
+    print_good("#{peer} - File saved in: #{path}")
 
   end
 

modules/auxiliary/scanner/http/dolibarr_login.rb

@@ -62,11 +62,11 @@ def do_login(user, pass)
     #
     sid, token = get_sid_token
     if sid.nil? or token.nil?
-      print_error("#{@peer} - Unable to obtain session ID or token, cannot continue")
+      print_error("#{peer} - Unable to obtain session ID or token, cannot continue")
       return :abort
     else
-      vprint_status("#{@peer} - Using sessiond ID: #{sid}")
-      vprint_status("#{@peer} - Using token: #{token}")
+      vprint_status("#{peer} - Using sessiond ID: #{sid}")
+      vprint_status("#{peer} - Using token: #{token}")
     end
 
     begin
@@ -86,18 +86,18 @@ def do_login(user, pass)
         }
       })
     rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
-      vprint_error("#{@peer} - Service failed to respond")
+      vprint_error("#{peer} - Service failed to respond")
       return :abort
     end
 
     if res.nil?
-      print_error("#{@peer} - Connection timed out")
+      print_error("#{peer} - Connection timed out")
       return :abort
     end
 
     location = res.headers['Location']
     if res and res.headers and (location = res.headers['Location']) and location =~ /admin\//
-      print_good("#{@peer} - Successful login: \"#{user}:#{pass}\"")
+      print_good("#{peer} - Successful login: \"#{user}:#{pass}\"")
       report_auth_info({
         :host        => rhost,
         :port        => rport,
@@ -109,18 +109,17 @@ def do_login(user, pass)
       })
       return :next_user
     else
-      vprint_error("#{@peer} - Bad login: \"#{user}:#{pass}\"")
+      vprint_error("#{peer} - Bad login: \"#{user}:#{pass}\"")
       return
     end
   end
 
   def run
     @uri = target_uri.path
     @uri.path << "/" if @uri.path[-1, 1] != "/"
-    @peer = "#{rhost}:#{rport}"
 
     each_user_pass { |user, pass|
-      vprint_status("#{@peer} - Trying \"#{user}:#{pass}\"")
+      vprint_status("#{peer} - Trying \"#{user}:#{pass}\"")
       do_login(user, pass)
     }
   end