metasploit-framework
metasploit-framework copied to clipboard
Meterpreter portfwd hangs when using a web browser through the tunnel
Steps to reproduce
How'd you do it?
- 3 VMs: Kali attacker box-> ProxyBox(Win10||Server w/ x64 meterpreter/reverse_https) -> Ubuntu server w/ Nextcloud (a docker solution is the quickest way to spin it up in a lab. I'm using Nextcloud 17.0.2 and Mariadb 10.5 but I don't think the versions here are too important )
- Deploy Meterpreter onto the proxybox and create a portfwd forward tunnel (portfwd add -l 800 -r <UbuntuIP> -p 80)
- On Ubuntu, run tcpdump -ni
tcp port 80 - From Kali: open Firefox and browse to http://127.0.0.1:800. Login and click around for a couple of mins until the connection hangs (have the Ubuntu machine visible with tcpdump running)
- try reloading the page from Kali OR open a new tab to browse through the tunnel again
- review tcpdump
- close the Meterpreter session and deploy a new one to reset. (flushing the rule is not enough, the fwd port stays listening)
This section should also tell us any relevant information about the environment; for example, if an exploit that used to work is failing, tell us the victim operating system and service versions.
Were you following a specific guide/tutorial or reading documentation?
I was not following a tutorial, just simply trying to set up a PoC lab for tunneling to a website. I used msfvenom to create x64 reverse_tcp and reverse_https Meterpreters and deployed them with a file share to make testing easier.
I believe I set it up correctly but open to counsel if not. Thank you in advanced for your time and consideration! :)
If yes link the guide/tutorial or documentation you were following here, otherwise you may omit this section.
Expected behavior
What should happen? Traffic moves through the tunnel without getting hung up
Current behavior
Appears that Meterpreter ceases to forward traffic through the tunnel. This mostly happens with websites that use scripting or other features that require more data. A plain html site does not seem to cause this issue to occur.
What happens instead? Tunnel gets hung up and no traffic is received
Metasploit version
msf6 > version
Framework: 6.2.36-dev
Console : 6.2.36-dev
Get this with the version
command in msfconsole (or git log -1 --pretty=oneline
for a source install).
Additional Information
Module/Datastore
The following global/module datastore, and database setup was configured before the issue occurred:
Collapse
[framework/ui/console]
ActiveModule=exploit/multi/handler
[multi/handler]
PAYLOAD=windows/x64/meterpreter/reverse_https
WORKSPACE=
VERBOSE=false
WfsDelay=2
EnableContextEncoding=false
ContextInformationFile=
DisablePayloadHandler=false
ExitOnSession=true
ListenerTimeout=0
LHOST=0.0.0.0
LPORT=8993
ReverseListenerBindPort=
ReverseAllowProxy=false
ReverseListenerComm=
ReverseListenerBindAddress=
ReverseListenerThreaded=false
StagerRetryCount=10
StagerRetryWait=5
PLATFORM=
ARCH=
loglevel=3
HandlerSSLCert=
SSLVersion=Auto
PingbackRetries=0
PingbackSleep=30
LURI=
OverrideRequestHost=false
OverrideLHOST=
OverrideLPORT=
OverrideScheme=
HttpUserAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.46
HttpServerName=Apache
HttpUnknownRequestResponse=<html><body><h1>It works!</h1></body></html>
IgnoreUnknownPayloads=false
StagerVerifySSLCert=false
PayloadUUIDSeed=
PayloadUUIDRaw=
PayloadUUIDName=
PayloadUUIDTracking=false
EnableStageEncoding=false
StageEncoder=
StageEncoderSaveRegisters=
StageEncodingFallback=true
PrependMigrate=false
PrependMigrateProc=
EXITFUNC=process
StagerURILength=
HttpHostHeader=
HttpCookie=
HttpReferer=
HttpProxyHost=
HttpProxyPort=
HttpProxyUser=
HttpProxyPass=
HttpProxyType=HTTP
AutoLoadStdapi=true
AutoVerifySessionTimeout=30
InitialAutoRunScript=
AutoRunScript=
AutoSystemInfo=true
EnableUnicodeEncoding=false
SessionRetryTotal=3600
SessionRetryWait=10
SessionExpirationTimeout=604800
SessionCommunicationTimeout=300
PayloadProcessCommandLine=
AutoUnhookProcess=false
MeterpreterDebugBuild=false
MeterpreterDebugLogging=
Database Configuration
The database contains the following information:
Collapse
Session Type: postgresql selected, no connection
History
The following commands were ran during the session and before this issue occurred:
Collapse
2000 debug
Framework Errors
The following framework errors occurred before the issue occurred:
Collapse
[01/30/2023 19:19:23] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3b60ef490> monitor_relays read - EOFError end of file reached
[01/30/2023 19:19:28] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3b60ef490> monitor_relays read - EOFError end of file reached
[01/30/2023 19:19:28] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3b60ef490> monitor_relays read - EOFError end of file reached
[01/30/2023 19:19:43] [e(0)] core: Thread Exception: StreamMonitorRemote critical=false source:
/usr/share/metasploit-framework/lib/metasploit/framework/thread_factory_provider.rb:25:in `spawn'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/socket_abstraction.rb:136:in `monitor_rsock'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/stream_abstraction.rb:30:in `initialize_abstraction'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channels/socket_abstraction.rb:56:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:73:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `new'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:36:in `open'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:124:in `create_tcp_client_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:93:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:659:in `create_tcp_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:488:in `block in cmd_portfwd'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:58:in `on_local_connection'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:437:in `accept_relay_conn'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:509:in `block in monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `each'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:184:in `block in start'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context' - Rex::TimeoutError Send timed out
[01/30/2023 19:19:43] [e(0)] core: Thread Exception: StreamMonitorRemote critical=false source:
/usr/share/metasploit-framework/lib/metasploit/framework/thread_factory_provider.rb:25:in `spawn'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/socket_abstraction.rb:136:in `monitor_rsock'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/stream_abstraction.rb:30:in `initialize_abstraction'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channels/socket_abstraction.rb:56:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:73:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `new'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:36:in `open'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:124:in `create_tcp_client_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:93:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:659:in `create_tcp_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:488:in `block in cmd_portfwd'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:58:in `on_local_connection'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:437:in `accept_relay_conn'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:509:in `block in monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `each'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:184:in `block in start'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context' - Rex::TimeoutError Send timed out
[01/30/2023 19:19:43] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3b60ef490> monitor_relays - Rex::TimeoutError Send timed out
[01/30/2023 19:20:58] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3d7db07a8> monitor_relays read - EOFError end of file reached
[01/30/2023 19:21:12] [e(0)] core: Thread Exception: StreamMonitorRemote critical=false source:
/usr/share/metasploit-framework/lib/metasploit/framework/thread_factory_provider.rb:25:in `spawn'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/socket_abstraction.rb:136:in `monitor_rsock'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/stream_abstraction.rb:30:in `initialize_abstraction'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channels/socket_abstraction.rb:56:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:73:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `new'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:36:in `open'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:124:in `create_tcp_client_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:93:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:659:in `create_tcp_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:488:in `block in cmd_portfwd'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:58:in `on_local_connection'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:437:in `accept_relay_conn'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:509:in `block in monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `each'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:184:in `block in start'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context' - Rex::TimeoutError Send timed out
[01/30/2023 19:21:13] [e(0)] core: Thread Exception: StreamMonitorRemote critical=false source:
/usr/share/metasploit-framework/lib/metasploit/framework/thread_factory_provider.rb:25:in `spawn'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/socket_abstraction.rb:136:in `monitor_rsock'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/stream_abstraction.rb:30:in `initialize_abstraction'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channels/socket_abstraction.rb:56:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:73:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `new'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:36:in `open'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:124:in `create_tcp_client_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:93:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:659:in `create_tcp_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:488:in `block in cmd_portfwd'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:58:in `on_local_connection'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:437:in `accept_relay_conn'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:509:in `block in monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `each'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:184:in `block in start'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context' - Rex::TimeoutError Send timed out
[01/30/2023 19:21:13] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3d7db07a8> monitor_relays - Rex::TimeoutError Send timed out
Web Service Errors
The following web service errors occurred before the issue occurred:
Collapse
msf-ws.log does not exist.
Framework Logs
The following framework logs were recorded before the issue occurred:
Collapse
[01/30/2023 19:20:58] [w(0)] core: monitor_rsock: the remote socket has been closed, exiting loop
[01/30/2023 19:21:12] [e(0)] core: Thread Exception: StreamMonitorRemote critical=false source:
/usr/share/metasploit-framework/lib/metasploit/framework/thread_factory_provider.rb:25:in `spawn'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/socket_abstraction.rb:136:in `monitor_rsock'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/stream_abstraction.rb:30:in `initialize_abstraction'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channels/socket_abstraction.rb:56:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:73:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `new'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:36:in `open'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:124:in `create_tcp_client_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:93:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:659:in `create_tcp_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:488:in `block in cmd_portfwd'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:58:in `on_local_connection'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:437:in `accept_relay_conn'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:509:in `block in monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `each'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:184:in `block in start'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context' - Rex::TimeoutError Send timed out
[01/30/2023 19:21:13] [e(0)] core: Thread Exception: StreamMonitorRemote critical=false source:
/usr/share/metasploit-framework/lib/metasploit/framework/thread_factory_provider.rb:25:in `spawn'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/socket_abstraction.rb:136:in `monitor_rsock'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-core-0.1.29/lib/rex/io/stream_abstraction.rb:30:in `initialize_abstraction'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channels/socket_abstraction.rb:56:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:73:in `initialize'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `new'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:124:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb:36:in `open'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:124:in `create_tcp_client_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb:93:in `create'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:659:in `create_tcp_channel'
/usr/share/metasploit-framework/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb:488:in `block in cmd_portfwd'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:58:in `on_local_connection'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:437:in `accept_relay_conn'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:509:in `block in monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `each'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:505:in `monitor_relays'
/usr/share/metasploit-framework/lib/rex/services/local_relay.rb:184:in `block in start'
/usr/share/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/usr/share/metasploit-framework/lib/msf/core/thread_manager.rb:105:in `block in spawn'
/usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context' - Rex::TimeoutError Send timed out
[01/30/2023 19:21:13] [e(0)] rex: Error in #<Rex::Services::LocalRelay:0x00007fb3d7db07a8> monitor_relays - Rex::TimeoutError Send timed out
[01/30/2023 19:21:13] [w(0)] core: monitor_rsock: the remote socket has been closed, exiting loop
[01/30/2023 19:22:16] [d(0)] core: HistoryManager.pop_context name: :meterpreter
Web Service Logs
The following web service logs were recorded before the issue occurred:
Collapse
msf-ws.log does not exist.
Version/Install
The versions and install method of your Metasploit setup:
Collapse
Framework: 6.2.36-dev
Ruby: ruby 3.1.2p20 (2022-04-12 revision 4491bb740a) [x86_64-linux-gnu]
OpenSSL: OpenSSL 3.0.7 1 Nov 2022
Install Root: /usr/share/metasploit-framework
Session Type: postgresql selected, no connection
Install Method: Other - Please specify