{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9482","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9482/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9482/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9482/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/9482","id":293496980,"number":9482,"title":"Linux Meterpreter / mettle `cmd_exec` gives empty output on old Linuxes (Debian 5 / CentOS 5)","user":{"login":"bcoles","id":434827,"avatar_url":"https://avatars2.githubusercontent.com/u/434827?v=4","gravatar_id":"","url":"https://api.github.com/users/bcoles","html_url":"https://github.com/bcoles","followers_url":"https://api.github.com/users/bcoles/followers","following_url":"https://api.github.com/users/bcoles/following{/other_user}","gists_url":"https://api.github.com/users/bcoles/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoles/subscriptions","organizations_url":"https://api.github.com/users/bcoles/orgs","repos_url":"https://api.github.com/users/bcoles/repos","events_url":"https://api.github.com/users/bcoles/events{/privacy}","received_events_url":"https://api.github.com/users/bcoles/received_events","type":"User","site_admin":false},"labels":[{"id":124421898,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21","default":true},{"id":103443960,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-02-01T11:33:55Z","updated_at":"2018-02-03T10:00:46Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"`cmd_exec` on Linux Meterpreter sessions intermittently (more often than not) returns an empty string on old Linuxes (Debian 5 / CentOS 5). This issue does not exist on more recent, yet still ancient, Linuxes such as Fedora 13 and Ubuntu 10.04.\r\n\r\n## Affected\r\n\r\n* CentOS 5.0\r\n* CentOS 5.4\r\n* CentOS 5.5\r\n* CentOS 5.6\r\n* Debian 5.0.4\r\n\r\n## Not Affected\r\n\r\n* CentOS 5.11\r\n* Fedora 13\r\n* Ubuntu 10.04\r\n\r\n## Steps to reproduce\r\n\r\nThe following local exploit module demonstrates this issue:\r\n\r\n```ruby\r\n##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Local\r\n  Rank = ExcellentRanking\r\n\r\n  include Msf::Post::File\r\n  include Msf::Exploit::EXE\r\n  include Msf::Exploit::FileDropper\r\n\r\n  def initialize(info = {})\r\n    super(update_info(info,\r\n      'Name'           => 'Test',\r\n      'Description'    => %q{\r\n        Test\r\n      },\r\n      'License'        => MSF_LICENSE,\r\n      'Author'         =>\r\n        [\r\n          'test'\r\n        ],\r\n      'DisclosureDate' => 'test',\r\n      'Platform'       => [ 'linux' ],\r\n      'Arch'           => [ ARCH_X86, ARCH_X64 ],\r\n      'SessionTypes'   => [ 'shell', 'meterpreter' ],\r\n      'Targets'        => [[ 'Auto', {} ]],\r\n      'References'     =>\r\n        [\r\n          [ ]\r\n        ]\r\n    ))\r\n  end\r\n\r\n  def exploit\r\n    10.times do\r\n      puts cmd_exec 'echo test'\r\n    end\r\n\r\n    puts cmd_exec 'echo we made it to the end'\r\n  end\r\nend\r\n```\r\n\r\n\r\n## Current behavior\r\n\r\nIntermittent lies\r\n\r\n\r\n## Expected behavior\r\n\r\nNo lies\r\n\r\n\r\n## Example Output\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > sessions\r\n\r\nActive sessions\r\n===============\r\n\r\n  Id  Name          Type                   Information                                                  Connection\r\n  --  ----          ----                   -----------                                                  ----------\r\n  1   debian 5.0.4  meterpreter x86/linux  uid=1000, gid=1000, euid=1000, egid=1000 @ 172.16.191.151    172.16.191.244:1337 -> 172.16.191.151:49447 (172.16.191.151)\r\n  2   centos 5.0    meterpreter x86/linux  uid=500, gid=500, euid=500, egid=500 @ 172.16.191.159        172.16.191.244:1337 -> 172.16.191.159:53458 (172.16.191.159)\r\n  4   centos 5.5    meterpreter x64/linux  uid=500, gid=500, euid=500, egid=500 @ livecd.localdomain    172.16.191.244:1337 -> 172.16.191.144:44739 (172.16.191.144)\r\n  5   centos 5.4    meterpreter x64/linux  uid=500, gid=500, euid=500, egid=500 @ livecd.localdomain    172.16.191.244:1337 -> 172.16.191.147:44223 (172.16.191.147)\r\n  6   ubuntu 10.04  meterpreter x64/linux  uid=1000, gid=1000, euid=1000, egid=1000 @ 172.16.191.149    172.16.191.244:1337 -> 172.16.191.149:48460 (172.16.191.149)\r\n  7   fedora 13     meterpreter x86/linux  uid=500, gid=500, euid=500, egid=500 @ fedora13.localdomain  172.16.191.244:1337 -> 172.16.191.138:43789 (172.16.191.138)\r\n```\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > set session 1\r\nsession => 1\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\n```\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > set session 2\r\nsession => 2\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\ntest\r\ntest\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\ntest\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\n```\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > set session 4\r\nsession => 4\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\ntest\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\ntest\r\ntest\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\n\r\ntest\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\ntest\r\ntest\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\ntest\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\n```\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > set session 5\r\nsession => 5\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\ntest\r\ntest\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\ntest\r\ntest\r\n\r\n\r\n[*] Exploit completed, but no session was created.\r\n```\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > set session 6\r\nsession => 6\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\nwe made it to the end\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\nwe made it to the end\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\nwe made it to the end\r\n[*] Exploit completed, but no session was created.\r\n```\r\n\r\n```\r\nmsf5 exploit(linux/local/test) > set session 7\r\nsession => 7\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\nwe made it to the end\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\nwe made it to the end\r\n[*] Exploit completed, but no session was created.\r\nmsf5 exploit(linux/local/test) > run\r\n\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\ntest\r\nwe made it to the end\r\n[*] Exploit completed, but no session was created.\r\n```\r\n\r\nNote that more modern, yet still ancient, Linuxes such as Fedora 13 and Ubuntu 10.04 are not affected.\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/362795017","html_url":"https://github.com/rapid7/metasploit-framework/issues/9482#issuecomment-362795017","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9482","id":362795017,"user":{"login":"busterb","id":4108654,"avatar_url":"https://avatars3.githubusercontent.com/u/4108654?v=4","gravatar_id":"","url":"https://api.github.com/users/busterb","html_url":"https://github.com/busterb","followers_url":"https://api.github.com/users/busterb/followers","following_url":"https://api.github.com/users/busterb/following{/other_user}","gists_url":"https://api.github.com/users/busterb/gists{/gist_id}","starred_url":"https://api.github.com/users/busterb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/busterb/subscriptions","organizations_url":"https://api.github.com/users/busterb/orgs","repos_url":"https://api.github.com/users/busterb/repos","events_url":"https://api.github.com/users/busterb/events{/privacy}","received_events_url":"https://api.github.com/users/busterb/received_events","type":"User","site_admin":false},"created_at":"2018-02-03T10:00:46Z","updated_at":"2018-02-03T10:00:46Z","author_association":"CONTRIBUTOR","body":"PR to address this is available now on the mettle repository now. Let me know if you need any help trying it out."}}
{"actor":{"display_login":"busterb"}}