rapid7/metasploit-framework — pull request #173 by corelanc0d3r (2012-02-11 23:45:03+00:00)
Title: Added 2 new payloads

Payload 1 : download_exec_https.rb
This payload allows you to download a binary (don't think it needs to have .exe extension) from a webserver. (You need to host the binary and the webserver yourself).
The payload will download the file over HTTPS, using the IE proxy settings, drops the file on the target system (you can choose the filename) and runs it.

Payload 2 : dns_query_exec.rb
This payload allows you to read & execute shellcode from the reply for a KEY DNS record.
In order to make this work, you need the following things

1. Register a public DNS zone & make sure you can create KEY records. Alternative, register a DNS zone, make the NS record point to your public IP & host your own DNS server
2. Create the shellcode you want to execute. Write the shellcode to a file and base64 encode it.
3. Create a KEY DNS record and paste in the base64 encoded shellcode as key
4. Generate the dns_query_exec payload, using the FQDN of the newly created KEY record and use that in your exploit

Upon execution of the dns_query_exec payload, a DNS query will be performed. The corporate DNS server, or online DNS servers should be more than happy to get the KEY for you so you can read it & execute it.
Or, in other words, how to retrieve bigger payload from a remote system without connecting to it ?