{"action":"opened","issue":{"url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/239","repository_url":"https://api.github.com/repos/PowerShellEmpire/Empire","labels_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/239/labels{/name}","comments_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/239/comments","events_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/239/events","html_url":"https://github.com/PowerShellEmpire/Empire/issues/239","id":158558311,"number":239,"title":"Empire agent breaking backend by sending multiple cookies (NGINX proxy in use)","user":{"login":"0x3a","id":7872766,"avatar_url":"https://avatars.githubusercontent.com/u/7872766?v=3","gravatar_id":"","url":"https://api.github.com/users/0x3a","html_url":"https://github.com/0x3a","followers_url":"https://api.github.com/users/0x3a/followers","following_url":"https://api.github.com/users/0x3a/following{/other_user}","gists_url":"https://api.github.com/users/0x3a/gists{/gist_id}","starred_url":"https://api.github.com/users/0x3a/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0x3a/subscriptions","organizations_url":"https://api.github.com/users/0x3a/orgs","repos_url":"https://api.github.com/users/0x3a/repos","events_url":"https://api.github.com/users/0x3a/events{/privacy}","received_events_url":"https://api.github.com/users/0x3a/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-05T14:59:43Z","updated_at":"2016-06-05T14:59:43Z","closed_at":null,"body":"## Empire Version\r\n[Version]: 1.5.0\r\n\r\n## OS Information (Linux flavor, Python version)\r\nRunning Empire on the latest Kali (Linux kali 4.3.0-kali1-amd64 #1 SMP Debian 4.3.3-7kali2 (2016-01-27) x86_64 GNU/Linux)\r\nPython 2.7.11\r\nTarget OS - Microsoft Windows 10 Version 10.0.10586\r\n\r\n## Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.\r\nI've been working on a setup where I log into a remote VPS using reverse tunneling with SSH (ssh -R 8080:localhost:8080 <remote host>) and the VPS has NGINX to upstream requests to localhost:8080. This forwarding requests works fine, I can test this with my browser as well as a stager connecting for the first time.\r\n\r\nAs soon as a launcher has downloaded the stager it decrypts it properly but when this connects the first time it works, second time empire actually breaks:\r\n\r\n> ----------------------------------------\r\n> Exception happened during processing of request from ('127.0.0.1', 36940)\r\n> Traceback (most recent call last):\r\n>   File \"/usr/lib/python2.7/SocketServer.py\", line 295, in _handle_request_noblock\r\n>     self.process_request(request, client_address)\r\n>   File \"/usr/lib/python2.7/SocketServer.py\", line 321, in process_request\r\n>     self.finish_request(request, client_address)\r\n>   File \"/usr/lib/python2.7/SocketServer.py\", line 334, in finish_request\r\n>     self.RequestHandlerClass(request, client_address, self)\r\n>   File \"/usr/lib/python2.7/SocketServer.py\", line 655, in __init__\r\n>     self.handle()\r\n>   File \"/usr/lib/python2.7/BaseHTTPServer.py\", line 340, in handle\r\n>     self.handle_one_request()\r\n>   File \"/usr/lib/python2.7/BaseHTTPServer.py\", line 328, in handle_one_request\r\n>     method()\r\n>   File \"/root/Documents/Empire/lib/common/http.py\", line 80, in do_GET\r\n>     name, sessionID = part.split(\"=\")\r\n> ValueError: too many values to unpack\r\n> ----------------------------------------\r\n\r\nLooking at a capture I can see what is happening:\r\n\r\n> GET /index.asp HTTP/1.1\r\n> Cookie: SESSIONID=F2CC4EMAC2W1KSYF,SESSIONID=GT3PMXT1WPUNMYNF\r\n\r\nSomehow the client checks in with two IDs. I originally thought this was caused by NGINX itself (I'm still unsure) so I disabled any *Set-Cookie* headers but the agent should send this header itself, it isn't set through any Set-Cookie from the empire backend. Current configuration for NGINX is:\r\n\r\n>server {\r\n>        listen 80;\r\n>\r\n>        location /admin/get.php {\r\n>                proxy_pass https://localhost:8080;\r\n>        }\r\n>}\r\n\r\n## Screenshot of error, embedded text output, or Pastebin link to the error\r\n\r\nMentioned above in the description.\r\n\r\n## Any additional information\r\n"}}
{"actor":{"display_login":"0x3a"}}