Escape braces after all in cmd/brace encoder

[wvu]

Previously escaped only commas.

Test: echo -n "echo hello, {world}" | ./msfvenom -a cmd --platform unix -e cmd/brace -b " "

Updates #10516.

[wvu]

This is terrible.

[gwillcox-r7]

But it works 👍

[wvu]

so many backslashes i don't even know what's real anymore

[sempervictus]

I wonder how many hits this PR will generate on searches by owners of reclassified firearms...

I think that expression might bear an explanatory comment, or SomeGPT will have a lot of 'splainin to do 😉

[gwillcox-r7]

Before:

  │  ~/g/metasploit-framework │   master ?1  echo -n "echo hello, {world}" | ./msfvenom -a cmd --platform unix -e cmd/brace -b " "
Attempting to read payload from STDIN...
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of cmd/brace
cmd/brace succeeded with size 22 (iteration=0)
cmd/brace chosen with final size 22
Payload size: 22 bytes
{echo,hello\,,{world}}

[gwillcox-r7]

Updated version showing that braces are now properly encoded as well:

  │  ~/g/metasploit-framework │   land-pr18032:pr/18032 ?1  echo -n "echo hello, {world}" | ./msfvenom -a cmd --platform unix -e cmd/brace -b " "  ✔ │ 3.0.5  │ 11:17:03 AM  
Attempting to read payload from STDIN...
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of cmd/brace
cmd/brace succeeded with size 24 (iteration=0)
cmd/brace chosen with final size 24
Payload size: 24 bytes
{echo,hello\,,\{world\}}

[gwillcox-r7]

Release Notes

A bug has been fixed in the cmd/brace encoder whereby it did not appropriately escape braces.