{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/27786448","id":27786448,"diff_hunk":"@@ -66,9 +66,12 @@ def initialize_passive_dispatcher\n     self.waiters    = []\n     self.alive      = true\n \n+    # Ensure that there is only one leading and trailing slash on the URI\n+    resource_uri = \"/\" + self.conn_id.to_s.gsub(/(^\\/|\\/$)/, '') + \"/\"","path":"lib/rex/post/meterpreter/packet_dispatcher.rb","position":5,"original_position":5,"commit_id":"3c59519811bb33cecc26d58a015c137921b96da8","original_commit_id":"3c59519811bb33cecc26d58a015c137921b96da8","user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"body":"Given that it's possible for Base64 encoded stuff to include slashes, and they _could_ appear at the end, should we do something to protect against this? eg.:\r\n``` ruby\r\n2.1.5 :002 > puts Base64.encode64(\"subjects?\")\r\nc3ViamVjdHM/\r\n```\r\nI realise it's a pretty slim chance, but should we care?","created_at":"2015-04-06T06:29:57Z","updated_at":"2015-04-06T06:29:57Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/5072#discussion_r27786448","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/27786448"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5072#discussion_r27786448"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072","id":32637920,"html_url":"https://github.com/rapid7/metasploit-framework/pull/5072","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5072.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5072.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5072","number":5072,"state":"open","locked":false,"title":"Support and embed payload UUIDs","user":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"body":"This changeset adds support for embedding UUIDs into payloads and displaying the connected UUID in the ```sessions -l -v``` output. This PR handles most of the stagers and payloads that work over HTTP & HTTPS. This work is backwards-compatible with older stagers (64-bit reverse_http for example).\r\n\r\nIn addition, this PR adds two new datastore options for stagers and payloads using the HTTP/HTTPS transports:\r\n* ```PayloadUUIDSeed```: A human-readable string that is hashed and used to calculate a Payload UID\r\n* ```PayloadUUIDRaw```: An 8-byte raw Payload UID specified as a 16-byte hex string\r\n\r\nA UUID is made up of 4 distinct fields:\r\n * ```puid```: The Payload UID is a possibly-random 8-byte prefix identifying a specific generated payload. This is randomly generated or derived from ```PayloadUUIDSeed``` or ```PayloadUUIDRaw```\r\n * ```arch```: The Architecture ID corresponds to a table of constants that map to every architecture known within Metasploit. This isn't perfect due to weirdness within Metasploit (X64 isn't exactly X86_64)\r\n * ```platform```: The Platform ID corresponds to a table of constants that map to every platformknown within Metasploit. If the payload supports multiple platforms, the first one in the PlatformList will be stored in the UUID.\r\n * ```timestamp```: The Timestamp is a Unix time value (UTC) of when the payload was generated. Values prior to 2015-01-01 or too far into the future are treated as invalid and ignored.\r\n\r\nThese four values are then obfuscated using two random bytes via XOR. These two random bytes result in a fairly random 16-byte UUID value. For HTTP/HTTPS transports, these 16 bytes are further encoded as a 22-byte Base64URL string. \r\n\r\nGenerated stagers and payloads now automatically embed a UUID if there is enough room. In the case of HTTP/HTTPS transports, the first 22 bytes of the URL (excluding non-Base64URL bytes) are treated as the UUID. If the UUID looks \"invalid\" (bad arch, platform, timestamp), only the Payload UID will be extracted, preserving backwards compatibility with existing payloads.\r\n\r\nStagers using HTTP/HTTPS transports will reuse the UUID during the switch from \"init\" to \"connection\" URLs, preserving the UUID between Metasploit instances and the staging process. The currently associated UUID can be seed with the ```-v``` flag to the ```sessions -l``` command.\r\n\r\nThere is still quite a bit of work left to do before UUIDs become practical, but this PR creates the initial path, and opens the door to smaller future PRs to add support to specific stagers and payloads. The end goal would be to enable universal handlers that can detect the architecture and platform on the fly and make it easy to track exactly what payload connected back to a shared listener.\r\n\r\n\r\n","created_at":"2015-04-04T18:56:31Z","updated_at":"2015-04-06T06:29:57Z","closed_at":null,"merged_at":null,"merge_commit_sha":"16e2a8f07eb3951aff5c5d476e06ad2dedbecc3d","assignee":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5072/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/3c59519811bb33cecc26d58a015c137921b96da8","head":{"label":"hmoore-r7:feature/registered-payload-uuids","ref":"feature/registered-payload-uuids","sha":"3c59519811bb33cecc26d58a015c137921b96da8","user":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"repo":{"id":9303582,"name":"metasploit-framework","full_name":"hmoore-r7/metasploit-framework","owner":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/hmoore-r7/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/hmoore-r7/metasploit-framework","forks_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/hmoore-r7/metasploit-framework/releases{/id}","created_at":"2013-04-08T18:25:37Z","updated_at":"2015-04-06T03:08:17Z","pushed_at":"2015-04-06T04:26:15Z","git_url":"git://github.com/hmoore-r7/metasploit-framework.git","ssh_url":"git@github.com:hmoore-r7/metasploit-framework.git","clone_url":"https://github.com/hmoore-r7/metasploit-framework.git","svn_url":"https://github.com/hmoore-r7/metasploit-framework","homepage":"http://www.metasploit.com/","size":314509,"stargazers_count":1,"watchers_count":1,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"57395deb1d8bfe2965ac1df79e275114568d726f","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-04-06T06:19:43Z","pushed_at":"2015-04-06T05:44:02Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1052861,"stargazers_count":3559,"watchers_count":3559,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2950,"mirror_url":null,"open_issues_count":192,"forks":2950,"open_issues":192,"watchers":3559,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5072"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5072"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5072/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5072/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/3c59519811bb33cecc26d58a015c137921b96da8"}}}}