Add a base64 ARCH_CMD encoder

[zeroSteiner]

This adds a new encoder module that leverages base64 encoding to escape bad characters in ARCH_CMD payloads for the Linux and UNIX platforms. It aims to consolidate the way in which modules have been doing it by automatically identifying the decoding binary, or allowing the user to specify it themselves.

Testing

• Use an ARCH_CMD payload module in msfconsole
• Generate the payload with one or more bad characters that will trigger the encoding
• See that the encoder works and the payload executes

[bcoles]

If we want to support OSX, --decode would be a safer fallback default flag.

[bcoles]

Apparently BusyBox base64 is the opposite: -d is supported but --decode is not.

https://boxmatrix.info/wiki/Property:base64_(bbcmd)

[jvoisin]

For busybox, busybox base64 -d can be used to tell it apart from coreutils' busybox.

[zeroSteiner]

I added a few additional platforms including OSX. Now when base64 is selected the (|) characters need to be allowed so it can automatically use either -d or --decode, otherwise it'll fail with an EncodignError. The encoder doesn't know the payload platform, so it can't be determined based on that. Informing the encoder of the payload platform could be useful, but seems out of scope for this.

I also added base64-long and base64-short as options for using -d and --decode respectively. That should cover all of the bases, so long as the user knows what they're targeting.

[jvoisin]

For busybox, busybox base64 -d can be used to tell it apart from coreutils' busybox.

[jvoisin]

Wouldn't something like this be more clear/maintainable:

base64_decoder = '(which base64 >/dev/null && base64 -d || which openssl >/dev/null && openssl enc -base64 -d)'
if (state.badchars.bytes & base64_decode.to_a.uniq.to_s.bytes).empty?
  base64_decoder = 'base64 -d'
end

[cdelafuente-r7]

Thanks @zeroSteiner ! It looks good to me. I tested every generated payloads on Linux (Debian) and Mac OS X and it works as expected. I'll go ahead and land it.

[cdelafuente-r7]

Release Notes

This adds a new encoder module that leverages base64 encoding to escape bad characters in ARCH_CMD payloads for the Linux and UNIX platforms.