rapid7/metasploit-framework — pull request #842 by bcoles (2012-09-30 08:42:33+00:00)
Title: Add QNX QCOMM command execution module

Add QNX QCOMM command execution exploit module.

* Unauthenticated
* Remote root
* Tested on:
* QNX Neutrino 6.5 SP1

`GoodRanking` because sometimes Metasploit doesn't catch the interactive shell. Sending the raw payload with netcat works 100% reliably. The shell is returned, as per the `Payload sent successfully` condition. I have no idea why this fails in Metasploit.

This module uses `cmd_interactive` as the usual bash reverse shell tricks don't work on QNX and there's no python/perl/ruby/php/netcat/etc. There are a few alternatives however they're all terrible:

* Use the `upload` feature (as opposed to `run`) to upload netcat.
* Write a binary to file and execute it.
* Add a user, then connect again with telnet.
* Hard-code the payload as `cmd/unix/generic`.

![QNX QCOMM command execution exploit](http://whatweb.net/qnx-exploit.png)