Meterpreter session architectures not tracked in MSF properly
@OJ is already working on this.
Since Feb 18, 2020.
Assessment
This issue has not been assessed yet.
Description
Once a Meterpreter session has been established back to MSF, it's possible to migrate from one process to another, as we know.
Unfortunately there's a small issue where during or after migration, no steps are taken to make sure that the new architecture of the session is tracked. Ideally, we should update the UUID of the session to match the new architecture, but we don't.
This doesn't prove to be an issue while using an established session that has been migrated from one arch to another, but it does cause issues when that session is put to sleep/split and then returns to MSF.
When MSF gets the session coming back, it believes it to be the same as the original architecture, even if it's no longer then case thanks to migrating. I'm not sure yet if this is just down to the fact that we don't update the UUID when migrating, or whether our handlers are not correctly checking the UUID in stageless connections once they've come back in. I think we should be doing both.
Steps to reproduce
- Set up a
reverse_*handler of some kind (I used toreverse_https) that's x86 and hasExitOnSessionset tofalse. Kick it off withrun -j. - Create a matching payload/binary.
- Execute the payload/binary on an x64 system, get a session.
- Check to make sure
sysinfosaysMeterpreter : x86/win32. - Run
uuidto see the current UUID details - Migrate the session to an x64 process.
- Run
sysinfoagain and notice it changes toMeterpreter : x64/win64. - Run
uuidand notice that the architecture returned is stillx86=1/windows=1as it was before. - Put the session to sleep for 1 second using
sleep 1. - Wait for the session to come back, and interact with it.
- Run
sysinfoagain and notice that we now haveMeterpreter : x86/win32again. - Run
uuidand we still have the same details.
At this point we have mixed architecture things going on, which can result in bad things happening. If the user loads an extension at this point, they will see crashing happening as x86 binaries are thrown at x64 sessions.
Suggested approach
I think we should:
- Make sure we update the UUID when migrating so that the arch matches.
- Validate the UUID when stageless sessions are received, and/or immediately after staged sessions have finished loading their first stage.
If in doubt, we should always ask Meterp instead of trying to keep track of it at the MSF side.
Ping @hdm and @busterb since we chatted on IRC about it.
Thanks!
- Dominant language
- Ruby
- Stars
- 39k
- Forks
- 15k
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 32
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rapid7/metasploit-framework
-
suggestion-docs
Difficulty 1/5 Under an hour Newbie friendliness 88/100
rapid7/metasploit-framework#21669 · 2 comments · 1 reaction ·
-
suggestion-docs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
rapid7/metasploit-framework#21503 · 2 comments ·
-
suggestion-docs
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
rapid7/metasploit-framework#20663 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
rapid7/metasploit-framework#21919 ·
-
suggestion-module
rapid7/metasploit-framework#21907 · 1 comment · 1 assignee ·
All issues in rapid7/metasploit-framework
Similar issues
-
バグ
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
voxpupuli/puppet-epel#186 · 1 comment ·
-
external_created_at is no longer used for the message timestamp since the new message UI (v4.4.0) OpenBug Frontend
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
TheOdinProject/curriculum#31402 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100