infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land #5990, reverse_hop_http fix

bug/bundler_fix
William Vu 2015-09-26 13:42:46 -05:00
parent 866636b59c 30102d4526
commit f4b4b21bfc
No known key found for this signature in database
GPG Key ID: 68BD00CE25866743
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
data/php/hop.php
View File

@ -33,7 +33,7 @@ if($url === "/control"){
if(array_key_exists('HTTP_X_INIT', $_SERVER)){
$f = fopen($tempdir."/init", "w"); //only one init file
}else{
$prefix = "down_" . bin2hex($_SERVER['HTTP_X_URLFRAG']);
$prefix = "down_" . sha1($_SERVER['HTTP_X_URLFRAG']);
$f = fopen(tempnam($tempdir,$prefix), "w");
}
fwrite($f, $postdata);
@ -45,9 +45,9 @@ if($url === "/control"){
//get data
$postdata = file_get_contents("php://input");
//See if we should send anything down
if($postdata === 'RECV'){
findSendDelete($tempdir, "down_" . bin2hex($url));
$fname = $tempdir . "/up_recv_" . bin2hex($url); //Only keep one RECV poll
if($postdata === "RECV\x00"){
findSendDelete($tempdir, "down_" . sha1($url));
$fname = $tempdir . "/up_recv_" . sha1($url); //Only keep one RECV poll
}else{
$fname = tempnam($tempdir, "up_"); //actual data gets its own filename
}

8
lib/msf/core/handler/reverse_hop_http.rb
View File

@ -54,6 +54,13 @@ module ReverseHopHttp
"tunnel"
end
#
# Returns the socket type. (hop)
#
def type?
return 'hop'
end
#
# Sets up a handler. Doesn't do much since it's all in start_handler.
#
@ -249,6 +256,7 @@ module ReverseHopHttp
# generate a new connect
sum = uri_checksum_lookup(:connect)
conn_id = generate_uri_uuid(sum, uuid)
conn_id = conn_id[1..-1] if conn_id.start_with? '/'
url = full_uri + conn_id + "/\x00"
print_status("Preparing stage for next session #{conn_id}")