warn when lhost set to 127.0.0.1 #8041

bermannoah · 2017-03-01T22:19:17Z

See issue #7188. This pull request adds an alert if you set LHOST to a loopback address (e.g. 127.0.01). Please let me know if there is any additional behavior desired or if I ought to change the warning message. I set the alert to a print_warning as requested.

Verification

The steps needed to make sure this thing works:

Console Output

msf > exploit 
[ ! ] You are attempting to listen on a loopback address by setting LHOST to 127.0.0.1, did you mean to set ReverseListenerBindAddress instead?

[ * ] Started reverse TCP handler on 127.0.0.1:4444
[ * ] Starting the payload handler...

busterb · 2017-03-02T06:29:02Z

thanks @bermannoah . I think we may want to move this validation somewhere else. It seems odd to have this in the middle of the command dispatcher, since you can set LHOST from various places.

wvu · 2017-03-02T06:47:17Z

lib/msf/ui/console/command_dispatcher/core.rb

+    ip = args[1]
+
+    if (name.upcase == "LHOST" && ip == "127.0.0.1")
+      print_error("You may experience errors with this choice of address for LHOST.")


Wherever we decide to put this check, if print_warning is available, please use that instead. Thanks.

@wvu-r7: made the change -- thanks!

bermannoah · 2017-03-02T16:24:22Z

@busterb: is there any place in particular you'd recommend moving it? I tried to find a more widely available place to put it and this seemed the most... succinct?

busterb · 2017-03-03T19:49:14Z

hi @bermannoah , I would suggest instead putting the warning inside of lib/msf/core/handler/reverse.rb inside of setup_handler right after it successfully sets up a listening socket, so it warns when it actually starts listening, rather than assignment from the UI. That will also allow it to warn from other contexts as well.

That also puts the warning where the actual networking code lives. You could also check for 127.0.0.0/8 or ::1 instead of just the single IPv4 loopback address.

rwhitcroft · 2017-03-03T23:43:56Z

Might need to go in reverse_http.rb as well to handle http(s) stuff, among others. Is there a higher base class I'm not seeing?

busterb · 2017-03-04T00:55:12Z

I think you're right @rwhitcroft.

busterb · 2017-03-07T08:04:22Z

I think adding the test here is appropriate so you catch all of the loopback IPs: https://github.com/rapid7/metasploit-framework/pull/8063/files#r104604972

I also think I see the root cause for session instability in the original bug report. If you're port forwarding over a tunnel, you probably want to set ReverseListenerBindAddress to 127.0.0.1, but leave LHOST (which gets embedded into your payload) as an externally routable IP. Otherwise, your staged payload will likely be connecting to the wrong address, unless you're a developer testing payloads.

So, the message might say 'You are attempting to listen on a loopback address by setting LHOST to #{address}, did you mean to set ReverseListenerBindAddress instead?' .

itsmeroy2012 · 2017-03-07T16:28:37Z

I have a solution to this but I don't know how to pull @bermannoah 's fork as a remote, and send him a pull request on his topic branch.

bermannoah · 2017-03-07T16:34:35Z

@itsmeroy2012 you can pull down my repo and push to the lhost-setting-warning branch or just do the work on your own repo and make a separate PR. I had a couple IRL things come up this weekend and haven't finished fixing my own patch. :)

itsmeroy2012 · 2017-03-07T16:39:42Z

I have done the work on my repo. @busterb told me to make suggestions on here rather than hijacking with an alternate PR and I'm new to github so I'm unable to pull down your repo and push to the 'lhost-setting-warning' branch. Could you guide me through it?

bermannoah · 2017-03-07T16:46:14Z

@itsmeroy2012 yup! Here's a high level overview, let me know if it doesn't match your system setup. Basically:

1 - git clone git@github.com:bermannoah/metasploit-framework.git if you're using SSH with github (here's a guide) otherwise, git clone https://github.com/bermannoah/metasploit-framework.git. You might need to do it in a different directory than your version of the repo.

2 - cd into the repo directory

3 - just in case, run git fetch to make sure you have all branches.

4 - git checkout lhost-setting-warning && git pull origin lhost-setting-warning (just in case)

5 - you'll need to go into the core.rb file and remove or alter my old solution to this issue

6 - make the changes you have in mind. make sure they work etc etc

7 - do all the usual git add . and git commit -S -m "commit text here" stuff. then run git push origin lhost-setting-warning and it should push to this PR.

Let me know if that works for you or if you run into any troubles!

itsmeroy2012 · 2017-03-07T17:15:06Z

When I run 'git checkout lhost-setting-warning && git pull origin lhost-setting-warning ' there is a fatal error. Will this be a problem later?

itsmeroy2012 · 2017-03-07T17:21:46Z

And then there is this. I think I don't have the rights to write into the repository.

bermannoah · 2017-03-07T17:48:38Z

@itsmeroy2012 oh shoot, I'm sorry. It looks like your branch is up to date so you won't need to run git pull. For the future though it looks like you're leaving out origin -- it should be git pull origin branchname. When it comes to the second command: it looks like you don't have a GPG key setup for your commits. The contributor guide for metasploit recommends it -- here's a guide to generating a key and here's a guide to connecting it to github.

Let me know if you have any more questions! Good luck! :)

…esses.

itsmeroy2012 · 2017-03-07T18:36:50Z

Everything ran successfully until this error popped out while executing the command "git push origin lhost-setting-warning"

remote: Permission to bermannoah/metasploit-framework.git denied to itsmeroy2012.
fatal: unable to access 'https://github.com/bermannoah/metasploit-framework.git/': The requested URL returned error: 403

bermannoah · 2017-03-07T18:38:55Z

@itsmeroy2012 i'll add you as a contributor, one sec

itsmeroy2012 · 2017-03-07T18:40:03Z

root@kali:~/bermannoah/metasploit-framework# git remote -v
origin https://github.com/bermannoah/metasploit-framework.git (fetch)
origin https://github.com/bermannoah/metasploit-framework.git (push)

bermannoah · 2017-03-07T18:40:32Z

@itsmeroy2012 awesome -- added you as a contributor to my repo. try again?

itsmeroy2012 · 2017-03-07T18:43:27Z

Do I need to repeat the steps again? Because the same error pops out , the one I mentioned above.

bermannoah · 2017-03-07T18:44:19Z

@itsmeroy2012 did you accept the contributor invite?

itsmeroy2012 · 2017-03-07T18:48:30Z

Thanks a lot for your precious time. I think it is done.

wvu · 2017-03-15T10:33:27Z

lib/msf/core/handler/reverse.rb

@@ -55,6 +55,17 @@ def bind_port
        (port > 0) ? port : datastore['LPORT'].to_i
      end

+      # Checking if LHOST is a loopback address
+      def is_loopback_address(address)


This method needs to be named is_loopback_address?. Fixing myself.

And for the record, this code is @busterb's: #8063 (comment).

wvu · 2017-03-15T10:34:14Z

lib/msf/core/handler/reverse.rb

@@ -82,12 +93,16 @@ def setup_handler
                'MsfPayload' => self,
                'MsfExploit' => assoc_exploit
              })
+
+            if is_loopback_address(ip)
+              print_warning ("You are attempting to listen on a loopback address by setting LHOST to #{ip}, did you mean to set ReverseListenerBindAddress instead?")


Extraneous whitespace and comma splice. Fixing.

wvu · 2017-03-15T10:40:42Z

msf exploit(handler) > set lhost 192.168.33.1
lhost => 192.168.33.1
msf exploit(handler) > set reverselistenerbindaddress 127.0.0.1
reverselistenerbindaddress => 127.0.0.1
msf exploit(handler) > run

[!] You are attempting to listen on a loopback address by setting LHOST to 127.0.0.1, did you mean to set ReverseListenerBindAddress instead?
[*] Started reverse TCP handler on 127.0.0.1:4444 
[*] Starting the payload handler...

This does not work.

busterb · 2017-03-15T16:11:35Z

Yeah, that's exactly the opposite of what this was intended to alert on.

itsmeroy2012 · 2017-03-15T19:25:43Z

When we give the command: -

'set reverselistenerbindaddress 127.0.0.1' , the 'ip' variable in the file lib/msf/core/handler/reverse.rb changes in the following code:-

if is_loopback_address(ip)
print_warning ("You are attempting to listen on a loopback address by setting LHOST to #{ip}, did you mean to set ReverseListenerBindAddress instead?")
end

Why is this happening and does the same variable stores both the lhost and the reverselistenerbindaddress?
@wvu-r7 @busterb

wvu · 2017-03-15T19:44:55Z

@itsmeroy2012: It's looping through each bind address. Look at the code just above that.

itsmeroy2012 · 2017-03-16T06:00:59Z

You're talking about this part right? @wvu-r7

bind_addresses.each do |ip|
begin ...
....

wvu · 2017-03-16T06:58:35Z

@itsmeroy2012: Correct.

itsmeroy2012 · 2017-03-16T16:22:56Z

What's the complexity of this issue now? Is it still under 'newbie-friendly' ? @wvu-r7

itsmeroy2012 · 2017-03-16T17:52:50Z

This seems to solve the problem specified above. But there's one flaw, the user has to specify a value for LPORT else the callback_host stores the value '172.16.176.36' for some reason. Should I push the change? @wvu-r7

bind_addresses.each do |ip|
begin
self.listener_sock = Rex::Socket::TcpServer.create(
'LocalHost' => ip,
'LocalPort' => local_port,
'Comm' => comm,
'Context' =>
{
'Msf' => framework,
'MsfPayload' => self,
'MsfExploit' => assoc_exploit
})

        callback_host = datastore['LHOST']
        if is_loopback_address(callback_host)
          print_warning ("You are attempting to listen on a loopback address by setting LHOST to #{ip}, did you mean to set ReverseListenerBindAddress instead?")
        end

wvu · 2017-03-16T18:34:08Z

Please see af3cd18 for edification.

itsmeroy2012 · 2017-03-16T18:34:45Z

What was the fix?? @wvu-r7

wvu · 2017-03-16T18:36:28Z

Read the commit!!

pbarry-r7 · 2017-03-21T21:35:00Z

Release Notes

A warning now displays when the use of loopback addresses may be unintentional and lead to undesired/unexpected behavior.

Alex942 · 2017-11-01T16:32:53Z

hey, i am stuck with this problem.. someone help me in solving this problem.......plzzzz

wvu · 2017-11-01T17:03:49Z

@Alex942: What problem? Don't comment on old tickets for support. Go to IRC.

Alex942 · 2017-11-02T10:08:44Z

@wvu-r7 my metasploit showing error when i am setting my lhost to 127.0.0.1......i am unable to fix this

wvu · 2017-11-02T18:33:56Z

Not an error. It works fine, just not suggested.

Alex942 · 2017-11-03T11:27:31Z

@wvu-r7 can you please explain me step by step how to fix it..........

rwhitcroft · 2017-11-03T14:48:50Z

@Alex942 You're not listening. This is not an error, so there's nothing to fix. You are telling Metasploit you want to listen on the local address (127.0.0.1) which means no clients will be able to connect to you. Metasploit thinks that's weird, so it shows you this warning.

Please stop posting in this thread. Also, some suggested reading for you: https://en.wikipedia.org/wiki/Localhost

Alex942 · 2017-11-04T05:16:27Z

@rwhitcroft i just want my metasploit to start a meterpreter session when i choose 127.0.0.1 as local host. That all.............i know you all are pro of this area and you know many times more than me thats why i am asking...............

wvu · 2017-11-04T05:57:35Z

@Alex942: You have provided close to zero details about your problem. How can we help? This isn't even the right place still. Please ask on IRC. I don't want to lock this thread.

If you want to catch a shell on localhost, your payload needs to connect back to that address. Basically, LHOST should match between handler and payload. This is all the help I can provide without further information. Thanks.

wvu · 2017-11-04T06:03:04Z

Here ya go: https://metasploit.help.rapid7.com/docs/joining-the-metasploit-irc-channel.

bermannoah added 2 commits March 1, 2017 14:53

warn when lhost set to 127.0.0.1

d9f5b75

modify warning wording

f91328b

bermannoah mentioned this pull request Mar 1, 2017

Feature Request: add warning when selecting 127.0.0.1 for LHOST #7188

Closed

wvu reviewed Mar 2, 2017

View reviewed changes

change print_error to print_warning

23474df

busterb added enhancement payload labels Mar 3, 2017

cbrnrd mentioned this pull request Mar 7, 2017

Issue #7188 resolved #8063

Closed

11 tasks

busterb mentioned this pull request Mar 7, 2017

Issue #7188 resolved along with checking for all loopback addresses. #8066

Closed

11 tasks

Issue rapid7#7188 resolved along with checking for all loopback addr…

27c2795

…esses.

wvu reviewed Mar 15, 2017

View reviewed changes

wvu added a commit to wvu/metasploit-framework that referenced this pull request Mar 16, 2017

Fix rapid7#8041 so it works

af3cd18

wvu added a commit to wvu/metasploit-framework that referenced this pull request Mar 16, 2017

Land rapid7#8041, loopback warning for LHOST

bb3c7ca

wvu added a commit to wvu/metasploit-framework that referenced this pull request Mar 16, 2017

Land rapid7#8041, loopback warning for LHOST

bad1fc9

wvu merged commit ad929b6 into rapid7:master Mar 16, 2017

bermannoah deleted the lhost-setting-warning branch March 17, 2017 00:53

tdoan-r7 added the rn-enhancement release notes enhancement label Mar 22, 2017

rapid7 locked and limited conversation to collaborators Nov 4, 2017

warn when lhost set to 127.0.0.1 #8041

warn when lhost set to 127.0.0.1 #8041

Conversation

bermannoah commented Mar 1, 2017 • edited

Verification

Console Output

busterb commented Mar 2, 2017

wvu Mar 2, 2017

Choose a reason for hiding this comment

bermannoah Mar 2, 2017

Choose a reason for hiding this comment

bermannoah commented Mar 2, 2017

busterb commented Mar 3, 2017 • edited

rwhitcroft commented Mar 3, 2017 • edited

busterb commented Mar 4, 2017

busterb commented Mar 7, 2017 • edited

itsmeroy2012 commented Mar 7, 2017

bermannoah commented Mar 7, 2017

itsmeroy2012 commented Mar 7, 2017

bermannoah commented Mar 7, 2017

itsmeroy2012 commented Mar 7, 2017

itsmeroy2012 commented Mar 7, 2017

bermannoah commented Mar 7, 2017

itsmeroy2012 commented Mar 7, 2017

bermannoah commented Mar 7, 2017 • edited

itsmeroy2012 commented Mar 7, 2017

bermannoah commented Mar 7, 2017

itsmeroy2012 commented Mar 7, 2017

bermannoah commented Mar 7, 2017

itsmeroy2012 commented Mar 7, 2017

wvu Mar 15, 2017

Choose a reason for hiding this comment

wvu Mar 16, 2017

Choose a reason for hiding this comment

wvu Mar 15, 2017

Choose a reason for hiding this comment

wvu commented Mar 15, 2017

busterb commented Mar 15, 2017

itsmeroy2012 commented Mar 15, 2017 • edited

wvu commented Mar 15, 2017

itsmeroy2012 commented Mar 16, 2017

wvu commented Mar 16, 2017

itsmeroy2012 commented Mar 16, 2017

itsmeroy2012 commented Mar 16, 2017

wvu commented Mar 16, 2017

itsmeroy2012 commented Mar 16, 2017

wvu commented Mar 16, 2017

pbarry-r7 commented Mar 21, 2017 • edited by tdoan-r7

Release Notes

Alex942 commented Nov 1, 2017

wvu commented Nov 1, 2017

Alex942 commented Nov 2, 2017

wvu commented Nov 2, 2017

Alex942 commented Nov 3, 2017

rwhitcroft commented Nov 3, 2017 • edited

Alex942 commented Nov 4, 2017

wvu commented Nov 4, 2017

wvu commented Nov 4, 2017

bermannoah commented Mar 1, 2017 •

edited

busterb commented Mar 3, 2017 •

edited

rwhitcroft commented Mar 3, 2017 •

edited

busterb commented Mar 7, 2017 •

edited

bermannoah commented Mar 7, 2017 •

edited

itsmeroy2012 commented Mar 15, 2017 •

edited

pbarry-r7 commented Mar 21, 2017 •

edited by tdoan-r7

rwhitcroft commented Nov 3, 2017 •

edited