-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix session verification by checking TLV negotiation #14789
Fix session verification by checking TLV negotiation #14789
Conversation
Testing the first part of this shows this is now fixed: Before:
Took about 2-3 minutes to die. After:
Takes about 34-35 seconds to die and also prints out the message that the session is invalid. |
Can also verify the reverse HTTP session works as expected:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changes look good, and with the verification this looks good to land!
Release NotesFixed a bug where Meterpreter sessions were incorrectly being validated due to the fact that TLV encryption for the session would take place before session verification. The fix now considers Meterpreter sessions valid if they successfully negotiate TLV encryption. This fix also removes the |
The
AutoVerifySession
feature that we have does not appear to work since 6.x added full TLV encryption. This is due to the fact that the TLV negotiation takes place before session verification. The session verification itself just issues a TLV to fetch the remote machine ID to ensure that the session is responsive. If the TLV negotiation times out, aRex::TimeoutError
is raised and the session is closed. In this case the timeout takes the default value of 300 seconds and closes the session without any error message describing why.The solution to address this proposed within this PR is to require successful TLV encryption negotiation in order for a session to be considered valid. Since v6 all Meterpreters support TLV encryption and since v5 Meterpreter sessions are incompatible anyway, we should never have a session established by a Meterpreter instance regardless of the implementation and platform that does not support TLV encryption. Metasploit should (and does) fail closed when TLV encryption can not be established, so there's no point in trying to issue the command to obtain the machine ID if it fails.
This also removes the
AutoVerifySession
datastore option (which previously defaulted totrue
) and instead always performs the verification, because again all valid Meterpreter instances should negotiate TLV encryption.Verification
List the steps needed to make sure this thing works
msfconsole
handler -p python/meterpreter/reverse_tcp -P 4444 -H 192.168.159.128
nc localhost 4444
and just let it situse payload/python/meterpreter/reverse_http
,to_handler
Output After This Patch
In this case an invalid session is opened by making an HTTP GET request to the URL. After 30 seconds (instead of 5 minutes) the session is identified as invalid and closed.
Output Before This Patch
Here you see that the session is opened and then it does with no explanation. There was a period of a few minutes that elapsed between the session being opened and the message stating that it died.
In this example, the user immediately interacts with the session and attempts to load the stdapi extension. Because the session is unresponsive, Metasploit incorrectly identifies that the Meterpreter doesn't support the load command.