Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stop error rendering in multi/meterpreter handler #11966

Merged
merged 1 commit into from Jun 14, 2019

Conversation

Projects
None yet
3 participants
@OJ
Copy link
Contributor

commented Jun 11, 2019

The reverse_http/s listeners result in awful errors when multi/meterpreter is set as the payload. Anyone that hits the endpoint with an invalid or missing UUID will spam the MSF console with exceptions. They look like this:

[-] [2019.06.11-13:14:34] https://0.0.0.0:443 handling request from <REDACTED>; (UUID: pytq9o79) Exception handling request: Invalid platform: '#<Msf::Module::PlatformLi
st:0x000055cd8b6ffa00>'

This patch avoids this issue in cases where the UUID isn't specific. We avoid setting it as a default, which doesn't make sense anyway. This patch results in the standard response being returned as it would with an unknown URI or UUID.

Verification

  • Start msfconsole
  • use multi/handler
  • set payload multi/meterpreter/reverse_http
  • Set configuration parameters, spin up a listener. Then create an HTTP payload that points to this listener.
  • Hit the endpoint with a browser and make sure that the "It works" message appears, make sure that the exception doesn't appear in the console.
  • Fire the payload make sure that the session works correctly.
  • This should fix the issue for HTTP and HTTPS payloads.
Stop error rendering in multi/meterpreter
The reverse_http/s listeners result in awful errors when
multi/meterpreter is set as the payload. Anyone that hits the endpoint
with an invalid or missing UUID will spam the MSF console with
exceptions.

This patch avoids this issue in cases where the UUID isn't specific. We
avoid setting it as a default, which doesn't make sense anyway.

@OJ OJ added the enhancement label Jun 11, 2019

@bwatters-r7 bwatters-r7 self-assigned this Jun 11, 2019

@bwatters-r7 bwatters-r7 merged commit 5621d20 into rapid7:master Jun 14, 2019

3 checks passed

Metasploit Automation - Sanity Test Execution Successfully completed all tests.
Details
Metasploit Automation - Test Execution Successfully completed all tests.
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

bwatters-r7 added a commit that referenced this pull request Jun 14, 2019

Land #11966, Stop error rendering in multi/meterpreter handler
Merge branch 'land-11966' into upstream-master
@bwatters-r7

This comment has been minimized.

Copy link
Contributor

commented Jun 14, 2019

Release notes

This changes the behavior of our HTTP payload callback listener to treat any callback without the URI or UUID the same as if it did not have a known UUID, that is, it pretends to be a default web server and pleads ignorance.

@jmartin-r7 jmartin-r7 added the msf5 label Jun 16, 2019

@jmartin-r7

This comment has been minimized.

Copy link
Contributor

commented Jun 16, 2019

Marked as msf5 as this consumes new database stored UUIDs not available on 4.x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.