{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10414","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10414/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10414/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10414/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/10414","id":346759306,"node_id":"MDU6SXNzdWUzNDY3NTkzMDY=","number":10414,"title":"Meterpreter HTTP Payloads False Positives? (or bug) One is \"encrypted\" the other is not yet both are from same handler","user":{"login":"realoriginal","id":30811388,"node_id":"MDQ6VXNlcjMwODExMzg4","avatar_url":"https://avatars0.githubusercontent.com/u/30811388?v=4","gravatar_id":"","url":"https://api.github.com/users/realoriginal","html_url":"https://github.com/realoriginal","followers_url":"https://api.github.com/users/realoriginal/followers","following_url":"https://api.github.com/users/realoriginal/following{/other_user}","gists_url":"https://api.github.com/users/realoriginal/gists{/gist_id}","starred_url":"https://api.github.com/users/realoriginal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/realoriginal/subscriptions","organizations_url":"https://api.github.com/users/realoriginal/orgs","repos_url":"https://api.github.com/users/realoriginal/repos","events_url":"https://api.github.com/users/realoriginal/events{/privacy}","received_events_url":"https://api.github.com/users/realoriginal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-08-01T20:37:55Z","updated_at":"2018-08-11T18:42:20Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I have a feeling the bug itself may be in the exploit. If so, lemme know and I'll happily PR it\r\n\r\n```\r\n\r\n  Session ID: 12\r\n        Name:\r\n        Type: meterpreter windows\r\n        Info: NT Service\\MSSQL @ -snip-\r\n      Tunnel: -snip-:443 -> -snip-:49199 (-snip-)\r\n         Via: exploit/multi/handler\r\n   Encrypted: true\r\n        UUID: 64b7aa9cc0add487/x64=2/windows=1/2018-08-01T20:02:34Z\r\n     CheckIn: 4s ago @ 2018-08-01 16:34:58 -0400\r\n  Registered: No\r\n        LURI: /PATHHOLD\r\n\r\n  Session ID: 13\r\n        Name:\r\n        Type: meterpreter windows\r\n        Info: NT AUTHORITY\\SYSTEM @ -snip-\r\n      Tunnel: -snip-:443 -> -snip-:49262 (-snip-)\r\n         Via: exploit/multi/handler\r\n   Encrypted: false\r\n        UUID: 35a06e84bc52acf5/x64=2/windows=1/2018-08-01T20:04:37Z\r\n     CheckIn: 8s ago @ 2018-08-01 16:34:54 -0400\r\n  Registered: No\r\n        LURI: /PATHHOLD\r\n```\r\n\r\n## Steps to reproduce\r\n\r\nHow'd you do it?\r\n\r\n1. Started a `multi/meterpreter/reverse_http` handler\r\n2. Used on exploit, `exploit/windows/mssql/mssql_clr_payload` to then get a session to the multi HTTP handler using `windows/x64/meterpreter/reverse_http` as payload. \r\n3. `sessions -q -v` says the new session is `Encrypted: true`\r\n4. Used an exploit I plan on PR'ing soon that has an ExitFunction set to `NONE` rather then the default `THREAD` for other exploits. (I can provide module code/exploit in a PR immediately if need be in case it MAY be related to this)\r\n5. `sessions -q -v` for the new established session claims the new session from the exploit was `Encrypted: false`\r\n\r\nI have not tried with other scenarios \r\n\r\n## Expected behavior\r\n\r\nI'm certain from previous memory that I SHOULD have an encrypted session as I got from MSSQL. Out of the ordinary. \r\n\r\n## Current behavior\r\n\r\nClaims that the session is Encrypted: false.\r\n\r\n## System stuff\r\n\r\n`Linux kali 4.12.0-kali1-amd64 #1 SMP Debian 4.12.6-1kali6 (2017-08-30) x86_64 GNU/Linux`\r\n\r\n### Metasploit version\r\n\r\nGet this with the `version` command in msfconsole (or `git log -1 --pretty=oneline` for a source install).\r\n```\r\nFramework: 4.17.3-dev\r\nConsole  : 4.17.3-dev\r\n```\r\n\r\n### I installed Metasploit with:\r\n- [x] Kali package via apt\r\n- [x] Omnibus installer (nightly)\r\n- [ ] Commercial/Community installer (from http://www.rapid7.com/products/metasploit/download.jsp)\r\n- [ ] Source install (please specify ruby version)\r\n\r\n### OS\r\n\r\nWhat OS are you running Metasploit on?\r\n\r\nKali Rolling\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/412294139","html_url":"https://github.com/rapid7/metasploit-framework/issues/10414#issuecomment-412294139","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10414","id":412294139,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMjI5NDEzOQ==","user":{"login":"realoriginal","id":30811388,"node_id":"MDQ6VXNlcjMwODExMzg4","avatar_url":"https://avatars0.githubusercontent.com/u/30811388?v=4","gravatar_id":"","url":"https://api.github.com/users/realoriginal","html_url":"https://github.com/realoriginal","followers_url":"https://api.github.com/users/realoriginal/followers","following_url":"https://api.github.com/users/realoriginal/following{/other_user}","gists_url":"https://api.github.com/users/realoriginal/gists{/gist_id}","starred_url":"https://api.github.com/users/realoriginal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/realoriginal/subscriptions","organizations_url":"https://api.github.com/users/realoriginal/orgs","repos_url":"https://api.github.com/users/realoriginal/repos","events_url":"https://api.github.com/users/realoriginal/events{/privacy}","received_events_url":"https://api.github.com/users/realoriginal/received_events","type":"User","site_admin":false},"created_at":"2018-08-11T18:42:20Z","updated_at":"2018-08-11T18:42:20Z","author_association":"CONTRIBUTOR","body":"And the test case was actually just as I put in the PR's \"example\", I could've probably shown that there as well it was unencrypted. This was different to how exploit/windows/mssql/mssql_clr_payload resulted in encrypted session (until i actually migrated ...?). Strange"}}
{"actor":{"display_login":"realoriginal"}}