rapid7/metasploit-framework — pull request #2225 by jvazquez-r7 (2013-08-14 17:08:47+00:00)
Title: Fix dlink_dir300_exec_telnet 

While working with @m-1-k-3 on #2188 we've figured out which the last modules trying to get a session through the telnet service were wrong because of two things:

* Even when there isn't authentication a telnet negotiation is required, which mainly is to read from the socket until the prompt is received, in order to flush it.

* The correct way to create a session from an exploit isn't to use Msf::Auxiliary::CommandShell::start_session, but to use the cmd/unix/interact payload (find type) and allow the handler to start the session over the telnet connection, so callbacks like "on_new_session" are available once the session is created.

This is the first pull request trying to fix the incorrect modules:

modules/exploits/linux/http/dlink_dir300_exec_telnet.rb (this module tries to fix this one)
modules/exploits/linux/http/dlink_upnp_exec_noauth.rb
modules/exploits/linux/http/dlink_command_php_exec_noauth.rb

Any feedback about the new way of proceeding in order to get a session from a telnet connection is welcome. If there is something wrong please let me know!

On the other hand, a simulation environment can be build with Ubuntu and busybox, but if you need the real data (screenshots and pcap's) for verification of the changes working against a real device, please contact me directly.