You should check which res isn't nil before accessing res.body, since send_request_cgi can return nil in case of timeout. More info here: https://github.com/rapid7/metasploit-framework/wiki/How-to-Send-an-HTTP-Request-Using-HTTPClient