{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/issues/64","labels_url":"https://api.github.com/repos/rapid7/metasploit-payloads/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-payloads/issues/64/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-payloads/issues/64/events","html_url":"https://github.com/rapid7/metasploit-payloads/pull/64","id":127065699,"number":64,"title":"TLV traffic obfuscation with 4-non-null-byte XOR","user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/android","name":"android","color":"207de5"},{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/java","name":"java","color":"5319e7"},{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/php","name":"php","color":"fbca04"},{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/posix","name":"posix","color":"d4c5f9"},{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/python","name":"python","color":"c7def8"},{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/labels/windows","name":"windows","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2016-01-17T00:31:29Z","updated_at":"2016-01-19T22:28:50Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/pulls/64","html_url":"https://github.com/rapid7/metasploit-payloads/pull/64","diff_url":"https://github.com/rapid7/metasploit-payloads/pull/64.diff","patch_url":"https://github.com/rapid7/metasploit-payloads/pull/64.patch"},"body":"This PR began as a small thought experiment after noticing just how much of Meterpeter's traffic was being analysed by various tools. AV solutions such as SONAR are getting better at picking up Meterpeter command strings that are going across the wire. SNORT rules are able to track the `RECV` in HTTP/S comms. Various other custom tools also look for the well-known command strings.\r\n\r\nIn short, there's lots of \"signature\" style detection of Meterpeter going on because of the content of the TLV packets. This PR aims to make that whole thing go away. It's based in part on various conversations with people, with sample implementations that are transport specific, and other ideas that have been rolling around in my head.\r\n\r\nThis PR requires changes on the MSF side as well. That PR can be found here: https://github.com/rapid7/metasploit-framework/pull/6480\r\n\r\n## Design\r\n\r\nThese changes result in modification of the TLV communications such that for every packet (both sent and received):\r\n\r\n* A 4-byte XOR key is generated. Each byte of this key is non-NULL.\r\n* The TLV payload is encoded using this generated XOR, including the header.\r\n* The XOR key is sent first, then the rest of the packet is sent after.\r\n* When receiving, the 4 byte XOR key is read, then the next 8 bytes of the header. When decoded, the size of the packet is determined and the rest of the packet is read.\r\n* When the entire packet has been read, the whole thing is then decoded.\r\n* Once decoded, things carry on as they did before.\r\n\r\nThe aim here is to have a packet that looks different every time it's sent, even if the content of the packet is the same. Signature-based detections will have to level up.\r\n\r\n## Status\r\n\r\nThis code isn't 100% complete. I've been dragging my feet a little getting the last bits done, but I wanted to get this PR going so that we could discuss it, and perhaps I could get some help from other people to finish it up.\r\n\r\n### Stuff that works\r\n\r\n* Windows x64 and x86 TCP, HTTP and HTTPS.\r\n* Python TCP, HTTP and HTTPS\r\n* PHP TCP\r\n\r\n### Stuff that doesn't work (yet)\r\n\r\n* POSIX x86 TCP -- haven't yet ported the code over from the Windows side, this is my next task. However, this is less of an issue, as AV/IDS tends not to impact POSIX. Still needs to be done though given MSF changes require it.\r\n* Java TCP, HTTP and HTTPS - I've done a bunch of work, but it's not yet functional. It's close though. Needs a bit of help and testing.\r\n* Android TCP, HTTP and HTTPS - same as Java.\r\n\r\n## Other stuff\r\n\r\nDidier Stevens put together a snort rule that were able to detect Meterpreter sesions, and it was based on looking for `POST` requests with the `RECV` body. This PR also removes that, and instead we use `GET` requests without a body. This makes more sense HTTP wise as well.\r\n\r\n## Testing\r\n\r\nIn my testing, I used HTTP for the most part because traffic analysis with wireshark is easy. All ya have to do is:\r\n\r\n* Build and deploy a payload that works based on the above list (use HTTP to see traffic).\r\n* Make sure you have the MSF PR running with the appropriate listener.\r\n* Fire up wireshark.\r\n* Run the payload.\r\n* Watch the traffic in wireshark.\r\n\r\nThe packet contents should be completely unreadable and unrecognisable for each packet. Packets should never reuse the same key. You should no longer see the `RECV` calls at all.\r\n\r\n## Help!\r\n\r\nAs I said, it's not finished yet. I'd appreciate any help from people who feel like getting stuck in to get this over the line."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-payloads/issues/comments/173008584","html_url":"https://github.com/rapid7/metasploit-payloads/pull/64#issuecomment-173008584","issue_url":"https://api.github.com/repos/rapid7/metasploit-payloads/issues/64","id":173008584,"user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"created_at":"2016-01-19T22:28:50Z","updated_at":"2016-01-19T22:28:50Z","body":"Awesome, thanks @sempervictus ! Yup, I'm open to that idea for sure. I'd like to get this PR in as is first and then add this extra feature after the fact though. You cool with that?"}}