rapid7/metasploit-framework — pull request #2292 by jvazquez-r7 (2013-08-27 16:41:46+00:00)
Title: Fix the way to get a session over a telnet connection (dlink_command_php_exec_noauth)

While working with @m-1-k-3 on #2188 we've figured out which the last modules trying to get a session through the telnet service were wrong because of two things:

Even when there isn't authentication a telnet negotiation is required, which mainly is to read from the socket until the prompt is received, in order to flush it.

The correct way to create a session from an exploit isn't to use Msf::Auxiliary::CommandShell::start_session, but to use the cmd/unix/interact payload (find type) and allow the handler to start the session over the telnet connection, so callbacks like "on_new_session" are available once the session is created.

This is the third (and last) pull request trying to fix the incorrect modules:

modules/exploits/linux/http/dlink_dir300_exec_telnet.rb (#2225)
modules/exploits/linux/http/dlink_upnp_exec_noauth.rb (#2248)
modules/exploits/linux/http/dlink_command_php_exec_noauth.rb (this pull request tries to fix this one)

Any feedback about the new way of proceeding in order to get a session from a telnet connection is welcome. If there is something wrong please let me know!

On the other hand, a simulation environment can be build with Ubuntu and busybox, but if you need the real data (screenshots and pcap's) for verification of the changes working against a real device, please contact me directly.

See also #2225 and #2248