12/19/2015 A couple findings that will demonstrate an ability to identify and DoS (setup fake malformed meterpreter stages between listener and attacker) meterpreter https (and possibly http) listeners. TL;DR summary: 1. By issuing GET requests to certain files dished out by the handler/listener and checking their contents for a “core_patch_url” string, fingerprinting of Reverse Handlers is possible. 2. By issuing malformed or prematurely terminated GET requests to files dished out by the handler/listener, the listener can be tricked into opening a Meterpreter session and forced into a state where it stops accepting sessions. (Handler DoS) First, the port you set the listeners up on are accessible via a URL, by design:
There exist a number of files, which can be requested via the listener URL, which, depending on the file being requested, can cause the handler to behave in a number of unexpected ways. The contents (and types) of files we can “GET” can be used to confirm the existence of a listener running on a machine, or launch a DoS attack against the listener by issuing “fake” Meterpreter stage sessions via a specific URL request to the handler. For instance, launch a handler with a meterpreter reverse https payload:
Once that’s running, request a “chpwd.htm” file from the listener:
We can see in the output of the contents of the “chpwd.htm” file, the string “core_patch_url” followed by a randomly generated string. The “core_patch_url” will be our fingerprint. On the listener side, the log we see (when requesting chpwd.htm) is:
Alternatively, we can request a file “blank.php”. This file appears to actually be the stager generated by the listener:
The downloaded “blank.php” file i’m guessing is the stager DLL generated by the handler, but for reasons unknown, is being given a .php extension. On the listener side, the log we see (when requesting blank.php) is:
Requesting the “blank.php” file appears to trigger a python stage and actually opens up a meterpreter session. (Although invalid and is soon terminated):
The meterpreter output from above confirms we can initialize “fake” malformed sessions (or prematurely terminated sessions). Essentially DoS’ing the handler, causing a timeout condition between any “true” payloads and the handler/listener. Aside from the “chpwd.htm” core_patch_url file and the “blank.php” binary file, we can find the following, are also accessible:
PoC's: Meterpreter Listener DoS script: meterpreter_dos.py Meterpreter Listener Detector script: meterpreter_fingerprint.py Mitigation: By default, the listeners
are configured to allow connections from any “payload” UUID.
Setting “IgnoreUnknownPayloads true” in your resource script
for the listener, or on the msfconsole command line should mitigate this,
however, the payload and listener will need to be configured in “Paranoid
Mode”. OR, a quick iptables allow inbound from shell IP to listener port:
|
