Add module 'Shell to Meterpreter Upgrade'

The intent of this module is to add additional functionality to the 'spawn_meterpreter' script by @jduck


Goals:

- Add multiplatform support for 'sessions -u'
	- Currently support Windows, Linux x86/64, Linux ARM, FreeBSD, Solaris

- Avoid writing to disk where possible while still maintaining full meterpreter feature set
- Allow upgraded sessions to be redirected to another listener/host
- Leave existing shell intact and functional

The first pass at this was in PR #3302 which just added functionality to the script.  Due to some limitations and inconsistencies it was suggested that a module would be a better fit.


NOTE:  This PR depends on landing PR #3390 'Improve reliability of have_powershell'


Methods of use:

Upgrade a single session, auto detect platform and LHOST

     sessions -u <session id>
     Example:  sessions -u 1

	
Upgrade multiple  sessions, auto detect platforms and LHOST, use distinct mutli/handler for each. The example below upgrades sessions 1,3,5,6,7,8.
    
     sessions -u <session id range>	
     Example:  sessions -u 1,3,5-8

It also operates like a standard post module that provides the ability to set LHOST and LPORT.  The option 'SESSION' indicates the target session, is required, and only accepts 1 value

     use post/multi/manage/shell_to_meterpreter


The following is a list of the current code's results.  Each includes the starting point test exploit and shell type and then indicates the resulting meterpreter and whether or not the stage was written to disk.

- Linux - Metasploitable 2

	exploit:	exploit/unix/misc/distcc_exec
	shell:		unix

	meterpreter:	meterpreter x86/linux
	Disk write:	yes, due to Bourne stager


	exploit:	exploit/multi/misc/java_rmi_server
	shell type:	java via java/shell/bind_tcp

	meterpreter:	meterpreter x86/linux
	Disk write:	yes, due to Bourne stager


- Linux - Raspbian ARM6

	exploit:	auxiliary/scanner/ssh/ssh_login
	shell type:	linux	
	meterpreter:	meterpreter python/python
	Disk write:	no		

- Linux - Ubuntu x86_64

	exploit:	auxiliary/scanner/ssh/ssh_login
	shell type:	linux	
	meterpreter:	meterpreter x86/linux
	Disk write:	yes, due to Bourne stager

- Windows Server 2008 R2 / 2012 R2

	exploit:	exploit/windows/smb/psexec
	shell type:	windows via windows/shell/reverse_tcp	
	meterpreter:	meterpreter x86/win32
	Disk write:	No, used PowerShell to inject shellcode

- Windows XP SP3

	exploit:	exploit/windows/smb/psexec
	shell type:	windows via windows/shell/reverse_tcp	
	meterpreter:	meterpreter x86/win32
	Disk write:	yes

- FreeBSD 10.0 (PC-BSD) 

	exploit:	auxiliary/scanner/ssh/ssh_login
	shell type:	bsd	

	meterpreter:	meterpreter python/python
	Disk write:	No

- Solaris 11.1 (5.11) x86

	exploit:	auxiliary/scanner/ssh/ssh_login
	shell type:	solaris	

	meterpreter:	meterpreter python/python
	Disk write:	No


Future work:

The function 'build_sessions_array' added to command_dispatcher/core.rb could be used with the sessions -k command to allow selective killing of multiple sessions.  Additionally, the function could be expanded to provide session selection based on attributes.  An example would be   'sessions -u shell:linux'
Like meatballs said, idiomatic ruby would be unless ret, assuming there is no else. Unless...else is evil. In that case stick with if, but use ! instead of not, ! is also preferred by the high ruby council, tho personally I like 'not', but ! has stronger precedence

> On Jul 12, 2014, at 9:20, timwr <notifications@github.com> wrote:
> 
> In modules/post/multi/manage/shell_to_meterpreter.rb:
> 
> > +
> > +    #
> > +    # Calculate the total size
> > +    #
> > +    total_bytes = 0
> > +    cmds.each { |cmd| total_bytes += cmd.length }
> > +
> > +    begin
> > +      #
> > +      # Run the commands one at a time
> > +      #
> > +      sent = 0
> > +      aborted = false
> > +      cmds.each { |cmd|
> > +        ret = session.shell_command_token(cmd)
> > +        if (not ret)
> pedantic but I think you can drop the brackets from all the if statements, e.g just "if not ret"
> 
> —
> Reply to this email directly or view it on GitHub.