From 117c2b9298173de83ee5ca1c12e8fab780e12aa6 Mon Sep 17 00:00:00 2001
From: "redwaysecurity.com" <heyder@redwaysecurity.com>
Date: Fri, 19 Jul 2024 12:33:13 +0200
Subject: [PATCH 1/5] feat: Allow explicit SSL configuration in start_service
 method

The start_service method now allows users to specify their SSL preferences directly through the opts parameter. If the ssl option is not provided in opts, it will default to the value in datastore['SSL'].

This change enhances the flexibility and usability of the start_service method, preventing unintended behavior when users need to control the SSL setting explicitly.

Closes #19329
---
 lib/msf/core/exploit/remote/http_server.rb            | 11 ++++++++---
 .../auxiliary/gather/magento_xxe_cve_2024_34102.rb    |  9 +++------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/lib/msf/core/exploit/remote/http_server.rb b/lib/msf/core/exploit/remote/http_server.rb
index 5b771c2b1d37..a62ee6c8cdfc 100644
--- a/lib/msf/core/exploit/remote/http_server.rb
+++ b/lib/msf/core/exploit/remote/http_server.rb
@@ -116,14 +116,17 @@ def check_dependencies
   # completely on the datastore. (See dlink_upnp_exec_noauth)
   def start_service(opts = {})
 
+    # Keep compatibility with modules that don't pass the ssl option to the start server but rely on the datastore instead.
+    opts['ssl'] = opts['ssl'].nil? ? datastore['SSL'] : opts['ssl']
+
     check_dependencies
 
     # Start a new HTTP server service.
     self.service = Rex::ServiceManager.start(
       Rex::Proto::Http::Server,
       (opts['ServerPort'] || bindport).to_i,
-      opts['ServerHost'] || bindhost,
-      datastore['SSL'], # XXX: Should be in opts, need to test this
+      opts['ServerHost']  || bindhost,
+      opts['ssl'],
       {
         'Msf'        => framework,
         'MsfExploit' => self,
@@ -149,7 +152,9 @@ def start_service(opts = {})
       'Path' => opts['Path'] || resource_uri
     }.update(opts['Uri'] || {})
 
-    proto = (datastore["SSL"] ? "https" : "http")
+    proto = (opts['ssl'] ? "https" : "http")
+
+    puts proto
 
     # SSLCompression may or may not actually be available. For example, on
     # Ubuntu, it's disabled by default, unless the correct environment
diff --git a/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb b/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
index c9480526fe33..f30a057404c4 100644
--- a/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
+++ b/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
@@ -154,19 +154,16 @@ def run
       fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful')
     end
 
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
           on_request_uri(cli, req)
         end,
         'Path' => '/'
-      }
+      },
+      'ssl' => false
     })
-    datastore['SSL'] = true if ssl_restore
+
     xxe_request
   rescue Timeout::Error => e
     fail_with(Failure::TimeoutExpired, e.message)

From dc282f5cc44f49859b89a23100711cd7fc63ed52 Mon Sep 17 00:00:00 2001
From: "redwaysecurity.com" <heyder@redwaysecurity.com>
Date: Fri, 19 Jul 2024 12:38:50 +0200
Subject: [PATCH 2/5] Cleanup

---
 lib/msf/core/exploit/remote/http_server.rb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/msf/core/exploit/remote/http_server.rb b/lib/msf/core/exploit/remote/http_server.rb
index a62ee6c8cdfc..8db884c0a5c7 100644
--- a/lib/msf/core/exploit/remote/http_server.rb
+++ b/lib/msf/core/exploit/remote/http_server.rb
@@ -154,8 +154,6 @@ def start_service(opts = {})
 
     proto = (opts['ssl'] ? "https" : "http")
 
-    puts proto
-
     # SSLCompression may or may not actually be available. For example, on
     # Ubuntu, it's disabled by default, unless the correct environment
     # variable is set. See https://github.com/rapid7/metasploit-framework/pull/2666

From 10e4668e689fd71e1b179c70738cd5cab5bc8bbd Mon Sep 17 00:00:00 2001
From: Heyder Andrade <heyder@users.noreply.github.com>
Date: Thu, 25 Jul 2024 19:05:48 +0200
Subject: [PATCH 3/5] Update lib/msf/core/exploit/remote/http_server.rb

Co-authored-by: Simon Janusz <85949464+sjanusz-r7@users.noreply.github.com>
---
 lib/msf/core/exploit/remote/http_server.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/http_server.rb b/lib/msf/core/exploit/remote/http_server.rb
index 8db884c0a5c7..50ea6ac3664a 100644
--- a/lib/msf/core/exploit/remote/http_server.rb
+++ b/lib/msf/core/exploit/remote/http_server.rb
@@ -125,7 +125,7 @@ def start_service(opts = {})
     self.service = Rex::ServiceManager.start(
       Rex::Proto::Http::Server,
       (opts['ServerPort'] || bindport).to_i,
-      opts['ServerHost']  || bindhost,
+      opts['ServerHost'] || bindhost,
       opts['ssl'],
       {
         'Msf'        => framework,

From a812617feef38164aca964ed34bbd52dfd9d03d7 Mon Sep 17 00:00:00 2001
From: "redwaysecurity.com" <heyder@redwaysecurity.com>
Date: Fri, 26 Jul 2024 17:30:25 +0200
Subject: [PATCH 4/5] Removed "ssl_restore = true"

---
 .../linux/http/dlink_diagnostic_exec_noauth.rb  | 10 +++-------
 .../exploits/linux/http/dlink_dir615_up_exec.rb | 10 +++-------
 .../exploits/linux/http/dlink_hnap_login_bof.rb | 10 +++-------
 .../linux/http/linksys_e1500_apply_exec.rb      | 10 +++-------
 .../linux/http/linksys_wrt54gl_apply_exec.rb    | 10 +++-------
 .../linux/http/netgear_dgn1000b_setup_exec.rb   | 10 +++-------
 .../linux/http/netgear_dgn2200b_pppoe_exec.rb   | 10 +++-------
 modules/exploits/linux/http/vestacp_exec.rb     | 15 ++++-----------
 .../exploits/linux/smtp/exim4_dovecot_exec.rb   | 11 +++--------
 .../multi/http/bassmaster_js_injection.rb       | 12 ++++--------
 .../multi/http/mutiny_subnetmask_exec.rb        | 10 +++-------
 .../http/rails_dynamic_render_code_exec.rb      | 12 ++++--------
 .../multi/http/struts_default_action_mapper.rb  | 17 ++---------------
 ...icro_threat_discovery_admin_sys_time_cmdi.rb | 11 +++--------
 .../exploits/multi/misc/ibm_tm1_unauth_rce.rb   | 11 +++--------
 .../multi/sap/sap_mgmt_con_osexec_payload.rb    | 10 +++-------
 .../manageengine_adaudit_plus_cve_2022_28219.rb |  9 ++-------
 17 files changed, 52 insertions(+), 136 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb b/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
index 09c6eb47aa79..dcf9edfa5bad 100644
--- a/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
+++ b/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
@@ -122,11 +122,6 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
@@ -144,9 +139,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/linux/http/dlink_dir615_up_exec.rb b/modules/exploits/linux/http/dlink_dir615_up_exec.rb
index d1e6db63151f..a9c210a5d7fb 100644
--- a/modules/exploits/linux/http/dlink_dir615_up_exec.rb
+++ b/modules/exploits/linux/http/dlink_dir615_up_exec.rb
@@ -155,11 +155,6 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
         srv_host = Rex::Socket.source_address(rhost)
@@ -174,9 +169,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+      })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/linux/http/dlink_hnap_login_bof.rb b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
index 81eed0fb1a4c..8cfb46603375 100644
--- a/modules/exploits/linux/http/dlink_hnap_login_bof.rb
+++ b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
@@ -253,12 +253,6 @@ def exploit
       @elf_sent = false
       resource_uri = '/' + downfile
 
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
-
       if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
         srv_host = Rex::Socket.source_address(rhost)
       else
@@ -272,7 +266,9 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+      })
 
       datastore['SSL'] = true if ssl_restore
       print_status("#{peer} - Asking the device to download and execute #{service_url}")
diff --git a/modules/exploits/linux/http/linksys_e1500_apply_exec.rb b/modules/exploits/linux/http/linksys_e1500_apply_exec.rb
index b06d83c4edf6..09b00c6c7c01 100644
--- a/modules/exploits/linux/http/linksys_e1500_apply_exec.rb
+++ b/modules/exploits/linux/http/linksys_e1500_apply_exec.rb
@@ -151,11 +151,6 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
@@ -172,9 +167,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb b/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
index 321ac0b77b41..23dd62260c82 100644
--- a/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
+++ b/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
@@ -304,11 +304,6 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
@@ -325,9 +320,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb b/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
index f5c8f91650fb..8148b41eacc6 100644
--- a/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
+++ b/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
@@ -155,11 +155,6 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
@@ -176,9 +171,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb b/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
index fb25a57294a6..c7b3c4887da5 100644
--- a/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
+++ b/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
@@ -270,11 +270,6 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
@@ -291,9 +286,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/linux/http/vestacp_exec.rb b/modules/exploits/linux/http/vestacp_exec.rb
index 64b89b65defc..7bf8b3430cb5 100644
--- a/modules/exploits/linux/http/vestacp_exec.rb
+++ b/modules/exploits/linux/http/vestacp_exec.rb
@@ -252,28 +252,21 @@ def on_request_uri(cli, _request)
   end
 
   def start_http_server
-    #
-    # HttpClient and HttpServer use same SSL variable :(
-    # We don't need SSL for payload delivery so we
-    # will disable it temporarily.
-    #
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
+    
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
           on_request_uri(cli, req)
         end,
         'Path' => resource_uri
-      }
+      },
+      'ssl' => false # do not use SSL
     })
     print_status("Second payload download URI is #{get_uri}")
     # We need to use instance variables since get_uri keeps using
     # the SSL setting from the datastore.
     # Once the URI is retrieved, we will restore the SSL settings within the datastore.
     @second_stage_url = get_uri
-    datastore['SSL'] = true if ssl_restore
+
   end
 end
diff --git a/modules/exploits/linux/smtp/exim4_dovecot_exec.rb b/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
index caa972d00e0b..44481fc1baf9 100644
--- a/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
+++ b/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
@@ -112,12 +112,6 @@ def exploit
         fail_with(Failure::Unknown, 'The Web Server needs to live on SRVPORT=80')
       end
 
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
-
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
       if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
@@ -134,9 +128,10 @@ def exploit
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
 
diff --git a/modules/exploits/multi/http/bassmaster_js_injection.rb b/modules/exploits/multi/http/bassmaster_js_injection.rb
index 2153fee64508..5deadf9eb630 100644
--- a/modules/exploits/multi/http/bassmaster_js_injection.rb
+++ b/modules/exploits/multi/http/bassmaster_js_injection.rb
@@ -141,12 +141,6 @@ def start_http_server
       srv_host = datastore['SRVHOST']
     end
 
-    # do not use SSL for the attacking web server
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
-
     @service_url = "http:\\x2f\\x2f#{srv_host}:#{datastore['SRVPORT']}#{resource_uri}"
     service_url_payload = srv_host + resource_uri
     print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")
@@ -155,8 +149,10 @@ def start_http_server
         on_request_uri(cli, req)
       },
       'Path' => resource_uri
-    }})
-    datastore['SSL'] = true if ssl_restore
+    },
+    'ssl' => false # do not use SSL
+    })
+
     connect
   end
 
diff --git a/modules/exploits/multi/http/mutiny_subnetmask_exec.rb b/modules/exploits/multi/http/mutiny_subnetmask_exec.rb
index 9b7d651cbed5..1d8af0537625 100644
--- a/modules/exploits/multi/http/mutiny_subnetmask_exec.rb
+++ b/modules/exploits/multi/http/mutiny_subnetmask_exec.rb
@@ -113,11 +113,6 @@ def on_new_session(session)
   def start_web_service
     print_status("Setting up the Web Service...")
 
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
-
     resource_uri = '/' + @elfname + '.elf'
     service_url = "http://#{lookup_lhost}:#{datastore['SRVPORT']}#{resource_uri}"
 
@@ -127,8 +122,9 @@ def start_web_service
         on_request_uri(cli, req)
       },
       'Path' => resource_uri
-    }})
-    datastore['SSL'] = true if ssl_restore
+    },
+    'ssl' => false # do not use SSL
+    })
 
     return service_url
   end
diff --git a/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb b/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
index 18ab694ccfc6..7f17ccc32cb3 100644
--- a/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
+++ b/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
@@ -162,12 +162,6 @@ def start_http_server
       srv_host = datastore['SRVHOST']
     end
 
-    # do not use SSL for the attacking web server
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
-
     @service_url = "http://#{srv_host}:#{datastore['SRVPORT']}#{resource_uri}"
     service_url_payload = srv_host + resource_uri
     print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")
@@ -176,8 +170,10 @@ def start_http_server
         on_request_uri(cli, req)
       },
       'Path' => resource_uri
-    }})
-    datastore['SSL'] = true if ssl_restore
+    },
+    'ssl' => false # do not use SSL
+    })
+
     connect
   end
 
diff --git a/modules/exploits/multi/http/struts_default_action_mapper.rb b/modules/exploits/multi/http/struts_default_action_mapper.rb
index e799bd30b6c1..a7cb2ffd4a51 100644
--- a/modules/exploits/multi/http/struts_default_action_mapper.rb
+++ b/modules/exploits/multi/http/struts_default_action_mapper.rb
@@ -115,14 +115,6 @@ def on_new_session(session)
   end
 
   def start_http_service
-    # do not use SSL for this part
-    # XXX: See https://github.com/rapid7/metasploit-framework/issues/3853
-    # It must be possible to do this without directly editing the
-    # datastore.
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
 
     if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
       srv_host = Rex::Socket.source_address(rhost)
@@ -138,15 +130,10 @@ def start_http_service
           on_request_uri(cli, req)
         },
         'Path' => '/'
-      }
+      },
+      'ssl' => false # do not use SSL
     })
 
-    # Restore SSL preference
-    # XXX: See https://github.com/rapid7/metasploit-framework/issues/3853
-    # It must be possible to do this without directly editing the
-    # datastore.
-    datastore['SSL'] = true if ssl_restore
-
     return service_url
   end
 
diff --git a/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb b/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
index f3c8f243871a..0f1d432da5f6 100644
--- a/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
+++ b/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
@@ -151,12 +151,6 @@ def start_http_server
     downfile = rand_text_alpha(8+rand(8))
     resource_uri = '/' + downfile
 
-    # do not use SSL for the attacking web server
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
-
     if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
       srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)
     else
@@ -172,9 +166,10 @@ def start_http_server
         on_request_uri(cli, req)
       },
       'Path' => resource_uri
-    }})
+    },
+    'ssl' => false # do not use SSL
+    })
 
-    datastore['SSL'] = true if ssl_restore
     connect
   end
 
diff --git a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
index efe0e11421d6..a56108f4f55a 100644
--- a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
+++ b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
@@ -528,12 +528,6 @@ def exploit
       @pl = generate_payload_exe
     end
 
-    # do not use SSL for the CAM server!
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
-
     print_status('Starting up the fake CAM server...')
     start_service(
       {
@@ -542,10 +536,11 @@ def exploit
             on_request_uri(cli, req)
           end,
           'Path' => '/'
-        }
+        },
+        'ssl' => false # do not use SSL
       }
     )
-    datastore['SSL'] = true if ssl_restore
+
 
     # Step 4: send the server config update packet, and ignore what it sends back
     print_status('Changing authentication method to 4 (CAM auth)')
diff --git a/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb b/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
index 77b9c4ec6bad..ea0634787de2 100644
--- a/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
+++ b/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
@@ -215,11 +215,6 @@ def exploit_linux
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      #do not use SSL
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
 
       #we use SRVHOST as download IP for the coming wget command.
       #SRVHOST needs a real IP address of our download host
@@ -236,9 +231,10 @@ def exploit_linux
           on_request_uri(cli, req)
         },
         'Path' => resource_uri
-      }})
+      },
+      'ssl' => false # do not use SSL
+    })
 
-      datastore['SSL'] = true if ssl_restore
     end
 
     #
diff --git a/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb b/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
index b30ff0e8935c..30832cc5234a 100644
--- a/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
+++ b/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
@@ -417,11 +417,6 @@ def upload_payload(payload, queue)
   end
 
   def serve_http_file(path, respond_with = '')
-    # do not use SSL for the attacking web server
-    if datastore['SSL']
-      ssl_restore = true
-      datastore['SSL'] = false
-    end
 
     start_service({
       'Uri' => {
@@ -429,10 +424,10 @@ def serve_http_file(path, respond_with = '')
           send_response(cli, respond_with)
         end,
         'Path' => path
-      }
+      },
+      'ssl' => false # do not use SSL
     })
 
-    datastore['SSL'] = true if ssl_restore
   end
 
   def create_json_request(xml_payload)

From 434593dcb463a8e3987176b6346a862ca4e0e368 Mon Sep 17 00:00:00 2001
From: Jack Heysel <jack_heysel@rapid7.com>
Date: Thu, 5 Sep 2024 08:49:32 -0700
Subject: [PATCH 5/5] Suggestion and rubocop fixes

---
 modules/exploits/linux/http/dlink_hnap_login_bof.rb           | 1 -
 modules/exploits/linux/http/vestacp_exec.rb                   | 2 --
 modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb             | 1 -
 .../windows/http/manageengine_adaudit_plus_cve_2022_28219.rb  | 4 +---
 4 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_hnap_login_bof.rb b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
index 8cfb46603375..ec6881f134e0 100644
--- a/modules/exploits/linux/http/dlink_hnap_login_bof.rb
+++ b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
@@ -270,7 +270,6 @@ def exploit
       'ssl' => false # do not use SSL
       })
 
-      datastore['SSL'] = true if ssl_restore
       print_status("#{peer} - Asking the device to download and execute #{service_url}")
 
       filename = rand_text_alpha_lower(rand(8) + 2)
diff --git a/modules/exploits/linux/http/vestacp_exec.rb b/modules/exploits/linux/http/vestacp_exec.rb
index 7bf8b3430cb5..b65e2bbd73ff 100644
--- a/modules/exploits/linux/http/vestacp_exec.rb
+++ b/modules/exploits/linux/http/vestacp_exec.rb
@@ -252,7 +252,6 @@ def on_request_uri(cli, _request)
   end
 
   def start_http_server
-    
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
@@ -267,6 +266,5 @@ def start_http_server
     # the SSL setting from the datastore.
     # Once the URI is retrieved, we will restore the SSL settings within the datastore.
     @second_stage_url = get_uri
-
   end
 end
diff --git a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
index a56108f4f55a..bb200c4d4448 100644
--- a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
+++ b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
@@ -541,7 +541,6 @@ def exploit
       }
     )
 
-
     # Step 4: send the server config update packet, and ignore what it sends back
     print_status('Changing authentication method to 4 (CAM auth)')
     upd_cent = update_auth(4)
diff --git a/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb b/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
index 30832cc5234a..f36da810c058 100644
--- a/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
+++ b/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
@@ -78,7 +78,7 @@ def initialize(info = {})
   end
 
   def srv_host
-    if ((datastore['SRVHOST'] == '0.0.0.0') || (datastore['SRVHOST'] == '::'))
+    if (datastore['SRVHOST'] == '0.0.0.0') || (datastore['SRVHOST'] == '::')
       return datastore['URIHOST'] || Rex::Socket.source_address(rhost)
     end
 
@@ -417,7 +417,6 @@ def upload_payload(payload, queue)
   end
 
   def serve_http_file(path, respond_with = '')
-
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, _req|
@@ -427,7 +426,6 @@ def serve_http_file(path, respond_with = '')
       },
       'ssl' => false # do not use SSL
     })
-
   end
 
   def create_json_request(xml_payload)