Fix atutor_filemanager_traversal.rb credentials checks and clean up code

[ErikWynter]

About

This change fixes a bug in the atutor_filemanager_traversal.rb module at /modules/exploits/linux/http/ and cleans up the code. Currently, the module will not run if no credentials are provided, even though these are not required. The reason is the erroneous use of empty? in the exploit method (line 302): if (not datastore['USERNAME'].empty? and not datastore['PASSWORD'].empty?). This bug is also present in the check method (line 82), causing check to fail in the same scenario as well. This change also incorporates automatic code improvements made by running RuboCop against the module, and cleans up the exec_code method.

Scenarios

1. Running the existing module without credentials

msf5 exploit(linux/http/atutor_filemanager_traversal) > show options

Module options (exploit/linux/http/atutor_filemanager_traversal):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    no        The password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     192.168.1.12     yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /ATutor/         yes       The path of Atutor
   USERNAME                    no        The username to authenticate as
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.128     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(linux/http/atutor_filemanager_traversal) > run

[*] Started reverse TCP handler on 192.168.1.128:4444 
[-] 192.168.1.12:80 - Exploit failed: NoMethodError undefined method `empty?' for nil:NilClass
[*] Exploit completed, but no session was created.
msf5 exploit(linux/http/atutor_filemanager_traversal) > 

2. Running the upgraded module without credentials

msf5 exploit(linux/http/atutor_filemanager_traversal) > run

[*] Started reverse TCP handler on 192.168.1.128:4444 
[*] 192.168.1.12:80 - Account details are not set, bypassing authentication...
[*] 192.168.1.12:80 - Triggering type juggle attack...

3. Running check on the existing module without credentials

msf5 exploit(linux/http/atutor_filemanager_traversal) > check

[-] 192.168.1.12:80 - Exploit failed: NoMethodError undefined method `empty?' for nil:NilClass
[-] 192.168.1.12:80 - Check failed: The state could not be determined.

4. Running check on the upgraded module without credentials

msf5 exploit(linux/http/atutor_filemanager_traversal) > check
[*] 192.168.1.12:80 - Cannot reliably check exploitability. Check requires credentials. The target may still be vulnerable. If so, it may be possible to bypass authentication.

[ErikWynter]

Notes

• The upgraded module has not been tested against ATutor 2.2.1, but only against a newer version of ATutor (2.2.4), which is not vulnerable. However, the suggested changes are just a simple bug fix and some code improvements suggested by RuboCop, so the functionality of the module should only be impacted positively.
• RuboCop still complaints about a few issues that it didn't automatically change. I have not to fixed these because I am not exactly sure how they would impact functionality and don't have a vulnerable system for testing.
• There is a ton of room left for improvement here.

[space-r7]

Changes lgtm!

[space-r7]

Release Notes

The exploit/linux/http/atutor_filemanager_traversal exploit previously would not run if credentials were not provided even though credentials were not required. Now the exploit will run without credentials.