Latest changes from defcon russia for dns transport by max3raza · Pull Request #23 · sempervictus/metasploit-framework

max3raza · 2017-09-19T09:38:15Z

Removing debug messages like puts("something...")
Removed duplicated "transport_config_reverse_dns" definition
Changed default string for SERVER_ID
Timeout setup for transport as for other transports
Latest changes from defcon russia

sempervictus

Getting this merged and run-tested this week, please pardon the delay - somewhat swamped.

sempervictus · 2017-11-02T03:12:38Z

lib/msf/core/handler/reverse_dns.rb

+
+            while (stime + ctimeout > Time.now.to_i)
+              begin
+                client = Rex::Socket::Tcp.create(


Might as well use UDP here if we're instantiating a socket for every call. If i can get native DNS to work, this wont be an issue, but session-channels may be an appropriate mechanism for this proxy semantic.

sempervictus · 2017-11-02T04:39:52Z

lib/msf/core/opt.rb

+    
+    # @return [OptAddress]
+    def self.DOMAIN(default=nil, required=true, desc="Domain name")
+      Msf::OptString.new(__method__.to_s, [ required, desc, default ])


Clever hackery, not sure if this is the best way to implement since every module load would instantiate these opts for every domain name. Also not sure about using a name such as "default" for anything. Still though, clever :)

sempervictus · 2017-11-02T04:40:40Z

lib/msf/core/opt.rb

+
+    # @return [OptEnum]
+    def self.REQ_TYPE(default=nil, required=true, desc="Domain name")
+      Msf::OptEnum.new(__method__.to_s, [ required, desc, 'DNSKEY', ['IPv6', 'DNSKEY']])


sempervictus · 2017-11-02T04:42:15Z

lib/msf/core/payload/windows/reverse_http.rb

-  def stage_over_connection?
-    false
-  end
+  #def stage_over_connection?


Why the change to an HTTP payload?

sempervictus

Round 2 of review. Merge testing ongoing presently.

sempervictus · 2017-11-15T07:21:05Z

lib/msf/core/handler/reverse_dns.rb

-        OptAddress.new('RHOST', [true, 'HANDLER BIND IP', '']),
+        OptString.new('SERVER_ID', [true, 'SERVER ID', 'toor']),
+        OptEnum.new('REQ_TYPE', [ true, 'Type of DNS tunnel', 'DNSKEY', ['IPv6', 'DNSKEY']]),
+        OptAddress.new('RHOST', [true, 'DNX PROXY IP', '']),


"DNS proxy IP" - though i suggest "DNS Server IP" since i'm working toward a native handler as well

sempervictus · 2017-11-15T07:21:58Z

lib/msf/core/handler/reverse_dns.rb

      client = nil

-      print_status("Started bind handler")
+      print_status("Started bind-DNS handler")


DNS-proxy handler?

sempervictus · 2017-11-15T07:22:15Z

lib/msf/core/handler/reverse_dns.rb


    # Start a new handling thread
-    self.listener_threads << framework.threads.spawn("BindTcpHandlerListener-#{lport}", false) {
+    self.listener_threads << framework.threads.spawn("BindTcpHandlerListener-#{lport}", false) { 


DnsProxyHandler?

sempervictus · 2017-11-15T07:23:22Z

lib/msf/core/handler/reverse_dns.rb

+          #If last connection has a valid session or died        
+          if (framework.sessions.length > 0)
+
+            framework.sessions.each_sorted do |k|


I'm a bit confused on the logic here - you end up with "session" being the last session in the sorted list, so why not just sessions.sort.last?

sempervictus · 2017-11-15T07:23:58Z

lib/msf/core/handler/reverse_dns.rb

+              opts = {
+                :datastore    => datastore,
+                :expiration   => datastore['SessionExpirationTimeout'].to_i,
+                :comm_timeout => 60*60*24,


Suggest pulling this from the datastore - tunable.

sempervictus · 2017-11-15T07:25:55Z

lib/msf/core/handler/reverse_dns.rb

+              # Start a new thread and pass the client connection
+              # as the input and output pipe.  Client's are expected
+              # to implement the Stream interface.
+              conn_threads << framework.threads.spawn("BindDnsHandlerSession", false, client) { |client_copy|


client_copy is a bit of a misnomer here - its the original object being passed into the thread. Example:

2.4.2 :001 > a = []; Thread.new(a) {|b| b << 1} => #<Thread:0x00000033659320b8@(irb):1 run> 2.4.2 :002 > a => [1]

If you dont want the original object, client.clone/dup/etc does the trick

sempervictus · 2017-11-15T07:27:28Z

lib/msf/core/handler/reverse_dns.rb

+                  #SEND SERVER_ID
+                  client_copy.put([server_id.length].pack("C") + server_id)
+                  conn = client_copy
+                  #First connect,  stage is needed? (or it not the first session and stage alredy there..


I'm thinking there's a more graceful way to do this (and i dont just mean replacing strings with symbols)... will get back to this once i have a rational plan :).

max3raza and others added 15 commits September 19, 2017 09:07

small cleanup after merge

496f8e8

debug messahes cleanup

dbdbb43

Returning timeouts (almost)

3546afd

Fixed x86 payload

eb87006

x64

ba78469

Convention fix

521c99b

x64 shellcode done

34a6441

Convention fix

ac63770

Workaround for merge: thread pawn fix

ee1d1b0

Workaround testes with bind... same behavior

b1d4126

handler improvements

3cf5475

Handler for reverse_dns done... almost 8)

b66c2fe

New options and DNSKEY tunnel

8ed1d8b

Shellcodes almost done

671a925

Bad offset in x64

fc9ff11

max3raza changed the title ~~small cleanup after merge and deleting debug messages~~ Latest changes from defcon russia for dns transport Oct 31, 2017

sempervictus reviewed Nov 2, 2017

View reviewed changes

sempervictus reviewed Nov 15, 2017

View reviewed changes

Conversation

max3raza commented Sep 19, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sempervictus left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sempervictus left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

max3raza commented Sep 19, 2017 •

edited

Loading