rapid7/metasploit-framework — pull request #3401 by TomSellers (2014-05-29 11:46:39+00:00)
Title: Add module 'Shell to Meterpreter Upgrade'

The intent of this module is to add additional functionality to the 'spawn_meterpreter' script by @jduck

Goals:

- Add multiplatform support for 'sessions -u'
- Currently support Windows, Linux x86/64, Linux ARM, FreeBSD, Solaris

- Avoid writing to disk where possible while still maintaining full meterpreter feature set
- Allow upgraded sessions to be redirected to another listener/host
- Leave existing shell intact and functional

The first pass at this was in PR #3302 which just added functionality to the script. Due to some limitations and inconsistencies it was suggested that a module would be a better fit.

NOTE: This PR depends on landing PR #3390 'Improve reliability of have_powershell'

Methods of use:

Upgrade a single session, auto detect platform and LHOST

sessions -u
Example: sessions -u 1

Upgrade multiple sessions, auto detect platforms and LHOST, use distinct mutli/handler for each. The example below upgrades sessions 1,3,5,6,7,8.

sessions -u
Example: sessions -u 1,3,5-8

It also operates like a standard post module that provides the ability to set LHOST and LPORT. The option 'SESSION' indicates the target session, is required, and only accepts 1 value

use post/multi/manage/shell_to_meterpreter

The following is a list of the current code's results. Each includes the starting point test exploit and shell type and then indicates the resulting meterpreter and whether or not the stage was written to disk.

- Linux - Metasploitable 2

exploit:	exploit/unix/misc/distcc_exec
shell:	unix

meterpreter:	meterpreter x86/linux
Disk write:	yes, due to Bourne stager

exploit:	exploit/multi/misc/java_rmi_server
shell type:	java via java/shell/bind_tcp

meterpreter:	meterpreter x86/linux
Disk write:	yes, due to Bourne stager

- Linux - Raspbian ARM6

exploit:	auxiliary/scanner/ssh/ssh_login
shell type:	linux
meterpreter:	meterpreter python/python
Disk write:	no

- Linux - Ubuntu x86_64

exploit:	auxiliary/scanner/ssh/ssh_login
shell type:	linux
meterpreter:	meterpreter x86/linux
Disk write:	yes, due to Bourne stager

- Windows Server 2008 R2 / 2012 R2

exploit:	exploit/windows/smb/psexec
shell type:	windows via windows/shell/reverse_tcp
meterpreter:	meterpreter x86/win32
Disk write:	No, used PowerShell to inject shellcode

- Windows XP SP3

exploit:	exploit/windows/smb/psexec
shell type:	windows via windows/shell/reverse_tcp
meterpreter:	meterpreter x86/win32
Disk write:	yes

- FreeBSD 10.0 (PC-BSD)

exploit:	auxiliary/scanner/ssh/ssh_login
shell type:	bsd

meterpreter:	meterpreter python/python
Disk write:	No

- Solaris 11.1 (5.11) x86

exploit:	auxiliary/scanner/ssh/ssh_login
shell type:	solaris

meterpreter:	meterpreter python/python
Disk write:	No

Future work:

The function 'build_sessions_array' added to command_dispatcher/core.rb could be used with the sessions -k command to allow selective killing of multiple sessions. Additionally, the function could be expanded to provide session selection based on attributes. An example would be 'sessions -u shell:linux'