Fix payloads not being encoded in exploits when BadChars contains whitespace

[wvu]

msfvenom is not affected by this regression due to its separate pre-flight checks.

wvu@kharak:~/rapid7/metasploit-framework:master$ ./msfvenom -p cmd/unix/generic -b " " CMD="uname -a"
[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
Found 5 compatible encoders
Attempting to encode payload with 1 iterations of cmd/echo
cmd/echo succeeded with size 61 (iteration=0)
cmd/echo chosen with final size 61
Payload size: 61 bytes
/bin/echo${IFS}-ne${IFS}'\x75\x6e\x61\x6d\x65\x20\x2d\x61'|sh
wvu@kharak:~/rapid7/metasploit-framework:master$

Verification

See #13415. Test with whitespace.

Testing

msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > git diff
[*] exec: git diff

diff --git a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
index ba475e14d9..5a1fa69989 100644
--- a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
+++ b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
@@ -76,8 +76,8 @@ class MetasploitModule < Msf::Exploit::Remote
               'Arch'      => [ARCH_CMD],
               'Payload'   =>
               {
-                # only one bad char in Linux, baby! (that we know of...)
-                'BadChars'  => "\x27",
+                # lol
+                'BadChars'  => "\x20",
               }
             }
           ],
@@ -390,6 +390,8 @@ class MetasploitModule < Msf::Exploit::Remote
   end

   def exploit
+    return p payload.encoded
+
     # first let's check if SRVHOST is valid
     if datastore['SRVHOST'] == "0.0.0.0"
       fail_with(Failure::Unknown, "Please enter a valid IP address for SRVHOST")
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) >

master

msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > rerun
[*] Reloading module...

[+] uname -a
"uname -a"
[*] Exploit completed, but no session was created.
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) >

Patch

msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > rerun
[*] Reloading module...

[+] uname -a
"/bin/echo${IFS}-ne${IFS}'\\x75\\x6e\\x61\\x6d\\x65\\x20\\x2d\\x61'|sh"
[*] Exploit completed, but no session was created.
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) >

Fixes #13415. Needed in #14000.

[acammack-r7]

Not sure how I blanked out about whitespace-only badchar sets. LGTM 👍

[pbarry-r7]

Code LGTM, tests well:

Original:

msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > set target 3
target => 3
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > set cmd uname -a
cmd => uname -a
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > run
"uname -a"

New+improved:

msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > set target 3
target => 3
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > set cmd uname -a
cmd => uname -a
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > run
"/bin/echo${IFS}-ne${IFS}'\\x75\\x6e\\x61\\x6d\\x65\\x20\\x2d\\x61'|sh"

[wvu]

Just to prove that encoding is still smart:

msf6 exploit(multi/misc/ibm_tm1_unauth_rce) > rerun
[*] Reloading module...

[+] id
"id"
[*] Exploit completed, but no session was created.
msf6 exploit(multi/misc/ibm_tm1_unauth_rce) >

It won't encode unconditionally, so #13415 still holds.

[wvu]

Release Notes

Fixed a regression in payload encoding where whitespace bad characters were not being encoded away.