{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5360","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5360/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5360/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5360/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/5360","id":77346444,"number":5360,"title":"#5357 breaks meterpreter sessions","user":{"login":"sempervictus","id":1331084,"avatar_url":"https://avatars.githubusercontent.com/u/1331084?v=3","gravatar_id":"","url":"https://api.github.com/users/sempervictus","html_url":"https://github.com/sempervictus","followers_url":"https://api.github.com/users/sempervictus/followers","following_url":"https://api.github.com/users/sempervictus/following{/other_user}","gists_url":"https://api.github.com/users/sempervictus/gists{/gist_id}","starred_url":"https://api.github.com/users/sempervictus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sempervictus/subscriptions","organizations_url":"https://api.github.com/users/sempervictus/orgs","repos_url":"https://api.github.com/users/sempervictus/repos","events_url":"https://api.github.com/users/sempervictus/events{/privacy}","received_events_url":"https://api.github.com/users/sempervictus/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-17T16:43:00Z","updated_at":"2015-05-17T16:53:39Z","closed_at":null,"body":"The UUID configuration being applied by the session_block method in lib/rex/payloads/meterpreter/config.rb attempts to assign opts[:uuid].to_raw to the uuid variable in session_data. This breaks meterpreter sessions (at least here, OJ's seems to work), which die in \"sending stage.\" Stage0 on the remote side executes, downloads a broken stage1, and happily kills itself (no lingering PIDs on the client at least).\r\n\r\nThe following diff allows payloads to work again, and shows what's going on with the UUID var (obviously dont merge this debug code please):\r\n```\r\ndiff --git i/lib/rex/payloads/meterpreter/config.rb w/lib/rex/payloads/meterpreter/config.rb\r\nindex a06a19e..728c0b7 100644\r\n--- i/lib/rex/payloads/meterpreter/config.rb\r\n+++ w/lib/rex/payloads/meterpreter/config.rb\r\n@@ -47,7 +47,8 @@ private\r\n   end\r\n \r\n   def session_block(opts)\r\n-    uuid = opts[:uuid].to_raw\r\n+    $stdout.write(\"UUID is #{opts[:uuid]}\\nRAW is #{opts[:uuid].to_raw} @ #{opts[:uuid].to_raw.length} bytes\\n\")\r\n+    uuid = to_str(opts[:uuid].to_raw,64) #opts[:uuid].to_raw\r\n     exit_func = Msf::Payload::Windows.exit_types[opts[:exitfunk]]\r\n \r\n     session_data = [\r\n```\r\nSample output of what its producing:\r\n```\r\n[*] [2015.05.17-12:39:38] Powershell command length: 2473\r\n[*] [2015.05.17-12:39:38] 10.1.1.20:445 - Executing the payload...\r\n[*] [2015.05.17-12:39:38] 10.1.1.20:445 - Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:10.1.1.20[\\svcctl] ...\r\n[*] [2015.05.17-12:39:39] 10.1.1.20:445 - Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:10.1.1.20[\\svcctl] ...\r\n[*] [2015.05.17-12:39:39] 10.1.1.20:445 - Obtaining a service manager handle...\r\n[*] [2015.05.17-12:39:39] 10.1.1.20:445 - Creating the service...\r\n[+] [2015.05.17-12:39:39] 10.1.1.20:445 - Successfully created the service\r\n[*] [2015.05.17-12:39:39] 10.1.1.20:445 - Starting the service...\r\n[+] [2015.05.17-12:39:40] 10.1.1.20:445 - Service start timed out, OK if running a command or non-service executable...\r\n[*] [2015.05.17-12:39:40] 10.1.1.20:445 - Removing the service...\r\n[+] [2015.05.17-12:39:40] 10.1.1.20:445 - Successfully removed the sevice\r\n[*] [2015.05.17-12:39:40] 10.1.1.20:445 - Closing service handle...\r\nUUID is 91a2e3c28654fa63/x86=1/windows=1/2015-05-17T16:39:41Z\r\nRAW is ���T�c�֩��� @ 16 bytes\r\n[*] [2015.05.17-12:39:41] Sending stage (884386 bytes) to 10.1.1.20\r\n(2015-05-17)12:39 (S:0 J:4)msf  exploit(psexec_psh) > [*] Meterpreter session 1 opened (10.1.1.10:31158 -> 10.1.1.20:51207) at 2015-05-17 12:39:44 -0400\r\n\r\n```\r\n\r\nThe raw uuid _does_ appear to be 16bytes, but somewhere down the line it seems to keel.\r\n@OJ: thoughts?\r\n\r\nThis is using meterpter #162 and msf #5357 "},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/102822675","html_url":"https://github.com/rapid7/metasploit-framework/issues/5360#issuecomment-102822675","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5360","id":102822675,"user":{"login":"sempervictus","id":1331084,"avatar_url":"https://avatars.githubusercontent.com/u/1331084?v=3","gravatar_id":"","url":"https://api.github.com/users/sempervictus","html_url":"https://github.com/sempervictus","followers_url":"https://api.github.com/users/sempervictus/followers","following_url":"https://api.github.com/users/sempervictus/following{/other_user}","gists_url":"https://api.github.com/users/sempervictus/gists{/gist_id}","starred_url":"https://api.github.com/users/sempervictus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sempervictus/subscriptions","organizations_url":"https://api.github.com/users/sempervictus/orgs","repos_url":"https://api.github.com/users/sempervictus/repos","events_url":"https://api.github.com/users/sempervictus/events{/privacy}","received_events_url":"https://api.github.com/users/sempervictus/received_events","type":"User","site_admin":false},"created_at":"2015-05-17T16:53:39Z","updated_at":"2015-05-17T16:53:39Z","body":"I may have a reason as to why this is happening: the raw uuid creates line breaks in the packed session_data.\r\n\r\nUsing the .to_raw approach:\r\n```\r\nUUID is 22777bea9721901e/x86=1/windows=1/2015-05-17T16:50:10Z\r\nRAW is \"w{��!�\u001E\r\n�\r\n �_��Y @ 16 bytes\r\nFinal data: ���V�:\t\"w{��!�\u001E\r\n�\r\n �_��Y\r\n```\r\nand then the to_str approach:\r\n```\r\nUUID is 07628cb7a43749d9/x86=1/windows=1/2015-05-17T16:51:04Z\r\nRAW is b���7I�������!\u0003 @ 16 bytes\r\nFinal data: ���V�:\tb���7I�������!\u0003\r\n```\r\n\r\nThe diff to reproduce this:\r\n```\r\ndiff --git i/lib/rex/payloads/meterpreter/config.rb w/lib/rex/payloads/meterpreter/config.rb\r\nindex a06a19e..8102679 100644\r\n--- i/lib/rex/payloads/meterpreter/config.rb\r\n+++ w/lib/rex/payloads/meterpreter/config.rb\r\n@@ -47,7 +47,9 @@ private\r\n   end\r\n \r\n   def session_block(opts)\r\n-    uuid = opts[:uuid].to_raw\r\n+    $stdout.write(\"UUID is #{opts[:uuid]}\\nRAW is #{opts[:uuid].to_raw} @ #{opts[:uuid].to_raw.length} bytes\\n\")\r\n+    uuid = to_str(opts[:uuid].to_raw,64) \r\n+    #uuid = opts[:uuid].to_raw\r\n     exit_func = Msf::Payload::Windows.exit_types[opts[:exitfunk]]\r\n \r\n     session_data = [\r\n@@ -57,7 +59,9 @@ private\r\n       uuid                # the UUID\r\n     ]\r\n \r\n-    session_data.pack(\"VVVA*\")\r\n+    res = session_data.pack(\"VVVA*\")\r\n+    $stdout.puts(\"Final data: #{res}\\n\")\r\n+    res\r\n   end\r\n```"}}