rapid7/metasploit-framework — pull request #4321 by wchen-r7 (2014-12-05 08:21:08+00:00)
Title: Fix #4246 - Access payload_exe information correctly

Fix #4246

## Root Cause ##

This fixes an undef method 'payload_exe' error. We broke this when all modules started using Msf::Exploit::CmdStager as the only source to get a command stager payload. The problem with that is "payload_exe" is an accessor in CmdStagerTFTP, not in CmdStager, so when the module wants to access that, we trigger the undef method error.

To be exact, this is the actual commit that broke it: 7ced5927d8807e385c0375a25ef71aef404d3036

## Verification ##

I don't have a Windows 2000 box anymore so I had to fix this bug without a test box. But by looking at the source and the commit history, I'm pretty sure this is the right fix.

Choose a way to verify:

**Method 1**

This is basically how I verified it as "working":

- [ ] Add a ```print_debug(@exe_payload.inspect)``` at line 200.
- [ ] Start msfconsole
- [ ] ```use exploit/windows/iis/ms01_026_dbldecode```
- [ ] ```set WINDIR C:\\Windows```
- [ ] ```set rhost [IP]``` (Something with IIS)
- [ ] ```run```
- [ ] The print_debug should print a random exe name. That would be the payload name.

**Method 2**

If you actually have a vulnerable IIS box for this, then you should choose this way:

- [ ] Start msfconsole
- [ ] ```use exploit/windows/iis/ms01_026_dbldecode```
- [ ] ```set WINDIR C:\\Windows```
- [ ] ```set rhost [IP]``` (Something with IIS)
- [ ] ```run```
- [ ] You should get a shell