Change from PEM to DER for crypt TLV negotiation #13400
Conversation
|
Code looks fine here. @OJ would you mind targeting this PR to the 6.x branch instead of master? |
|
Whoops! Sorry. Thought I'd done that already. Fixed! |
This first bit of code aims to add a "map" to the packet functionality that is able to translate to and from "method strings" to "command ids". IDs are sent across the wire, and they're now integers. This removes the need for the strings to be present in things like native meterp, and hence makes things a little less obvious on the wire, and way less obvious on disk/in the payload. Given that we need this functionality in other Meterpreters to support the removal of strings, some code has been added that can generate source files for Python, C# and C. This code might move, but for now it's at least in a spot where it's used the most.
This thing doesn't exist any more, so no need to have code referencing it.
Not sure why, but this is causing issues. Gross.
This was not originally ported to an int when it should have been.
Just to reduce the more obvious thing going across the wire (ie. no more "BEGIN PUBLIC KEY"). We now see binary blobs.
|
Not sure why this still looks so messy! |
|
Alright the mettle, Windows and PHP implementations are all done. Once the Java and Python changes are made, I can bump the gems and get this PR landed. |
|
Great, thank you. I'll make sure the java stuff is lined up first thing this morning. |
|
Alright, changes are now in for the Windows, Java, PHP and Python Meterpreters (metasploit-payloads v2.0.5) and Mettle (metasploit_payloads-mettle v1.0.1). All are still negotiating TLV encryption, and pass tests using the I'll have this landed shortly with a bump in the respective gems and updates to the payload sizes. |
|
Something is off with this, I merged it in commit efbff6f however the GitHub web UI is not showing it as merged. I'm going to have to close this out manually. I suspect it's related to it also looking messy despite it merging cleanly. Thanks for all your work on this @OJ! |
Release NotesUpdated transmission of the RSA key used to negotiate TLV encryption for Meterpreter to use the binary DER format instead of the text-based PEM format. This makes the key smaller, easier to process, and removes the static "BEGIN PUBLIC KEY" string. |
|
Thank you!
…On Sat, 20 Jun 2020, 02:34 Spencer McIntyre, ***@***.***> wrote:
Release Notes
This changes the RSA key that is used to negotiate TLV encryption for
Meterpreter to being transmitted in the binary DER format instead of the
text-based PEM format. This makes the key smaller, easier to process and
removes the static "BEGIN PUBLIC KEY" string.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#13400 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAHBYEP5LIEBA5T3LJLE2DRXOHSPANCNFSM4M2BVPDA>
.
|
Description
This started as "let's remove the
BEGIN PUBLIC KEYstuff from the plaintext crypt TLV negoation" and ended up as that, plus "let's just refactor some areas of the API that do stupid stuff.In short:
_raw()API functions in Windows Meterp so that the length parameter is required as well.Validation
sessions -x).sessions -x).sessions -x).screenshotstill works in Windows.railgunstill works in Windows.Next up we'll be adding support for encryption in Java, Android and Python, with a goal of enforcing it when all those payloads have support.