Fix BeyondTrust PRA/RS exploit failing on older instances

[Chocapikk]

The get_site_info_via_mech_list method only queries /get_mech_list?version=3 which returns JSON on newer BeyondTrust instances. On older instances (e.g. 22.x), this endpoint returns HTTP 500, causing the company name lookup to fail and the exploit to abort with "Invalid company or app name".

This PR adds a fallback to /get_mech_list?version=2, which returns semicolon-separated key=value pairs (e.g. company=example;product=ingredi) and works on all tested versions.

Also removes the "Thank you for using BeyondTrust" string check in the check method's BRDF validation. Privileged Remote Access (PRA) instances do not contain this string in their BRDF data, causing check to incorrectly return Unknown for PRA targets.

Verification

• Start msfconsole
• use exploits/linux/http/beyondtrust_pra_rs_unauth_rce
• set RHOSTS <target> (an older BeyondTrust RS instance, e.g. version 22.x)
• set RPORT 443
• set SSL true
• set VERBOSE true
• check
• Verify check returns Appears with detected version (previously failed with Unknown on 22.x instances because version=3 returned HTTP 500)
• Verify verbose output shows Got site info via the /get_mech_list?version=2 endpoint. confirming the v2 fallback was used
• Verify check also works on newer instances (version=3 JSON path still tried first)

Tested on

• BeyondTrust Remote Support 22.x: check returns Appears with detected version (previously failed, v3 returns HTTP 500, v2 fallback succeeds)

[bwatters-r7]

I only have access to 24.1.2, but I can confirm no regressions.

[bwatters-r7]

Release Notes

Improves the check method in the beyondtrust_pra_rs_unauth_rrce to properly detect older versions that are also vulnerable but report the version in a different way.