Skip to content

Commit bbb41c3

Browse files
author
Brent Cook
committed
fix backward meterpreter packet timeout logic
The current logic times out every packet almost immediately, making it possible for almost any non-trivial meterpreter session to receive duplicate packets. This causes problems especially with any interactions that involve passing resource handles or pointers back and forth between MSF and meterpreter, since meterpreter can be told to operate on freed pointers, double-closes, etc. This probably fixes tons of heisenbugs, including rapid7#3798. To reproduce this, I enabled all debug messages in meterpreter to slow it down, then ran this RC script with a reverse TCP meterpreter, after linking in the test modules: (cd modules/post ln -s ../../test/modules/post/test) die.rc: use exploit/multi/handler set payload windows/meterpreter/reverse_tcp set lhost 192.168.43.1 exploit -j sleep 5 use post/test/services set SESSION 1 run
1 parent 6613745 commit bbb41c3

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/rex/post/meterpreter/packet_dispatcher.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -356,7 +356,7 @@ def monitor_socket
356356
begin
357357
if ! dispatch_inbound_packet(pkt)
358358
# Only requeue packets newer than the timeout
359-
if (::Time.now.to_i - pkt.created_at.to_i < PacketTimeout)
359+
if (::Time.now.to_i - pkt.created_at.to_i > PacketTimeout)
360360
incomplete << pkt
361361
end
362362
end

0 commit comments

Comments
 (0)