opened
Meatballs1
username_0
I was attempting to use meterpreter/reverse_https to use the default IE proxy settings and connect back to a host. 

This worked fine for the initial connection. However when the meterpreter stage takes over it is unable. It is attempting to perform a direct connection to the host ignoring the proxy which gets blocked by the firewall.

I assume this is something to do with @username_2's changes to WinHTTP (which wont pick up the proxy settings like WinINET). I'm not into the blame game but I'm going to ping @username_3 and @bturner-r7's as they have also been involved with reverse_http(s) changes and proxy settings. 

I reverted back to 1b3dfe66352dd3b32da58 and things started working again. 

Note that unless your test target is actually firewalled correctly it can be difficult to spot this behaviour. E.g. the proxy will show a CONNECT, you get a session, then it falls back to a direct connection but you dont notice...
Meterpreter Fails to Detect Default Proxy Settings
issue
created
Meatballs1
username_0
n.b. in this scenario SYSTEM default proxy settings are not available:

`netsh winhttp show proxy` -> Direct Access
comment
created
Meatballs1
username_0
To create a windows host firewall to block 443 to your msfconsole:

`netsh advfirewall firewall add rule name="Block MSF 443" dir=out action=block protocol=TCP remoteport=443 remoteip=192.168.0.77`
comment
created
Meatballs1
username_0
MSDN docs re user proxy settings:

https://msdn.microsoft.com/en-us/library/windows/desktop/aa384075%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396#setting_the_proxy_configuration_on_a_session

The call to `WinHttpGetIEProxyConfigForCurrentUser` only appears in the stdapi get_proxy_config call. So unless it is manually receiving the proxy settings from Registry or elsewhere it wont use them :(
comment
created
bcook-r7
username_1
I'm working on harmonizing the WinHttpOpen flags between the reverse_http stager and meterpreter.
comment
created
Meatballs1
username_0
title is probably more accurate now
comment
created
OJ
username_2
Pfff.. yeah like this has anything to do with me! \*whistles\* ...

I'll take a look at it today :) Thanks @username_0.
comment
created
OJ
username_2
OK so it turns out that using the WinInet settings in WinHTTP is a little bit of a pain. More details [here on MSDN](https://msdn.microsoft.com/en-us/library/windows/desktop/aa384075(v=vs.85).aspx#setting_the_proxy_configuration_on_a_session). It's going to make the stager a little bigger, but for now I'll get it working in Metsrv first, then at least we can pair up a `reverse_http/s` stager with a version of `metsrv` and we'll get proxy functionality back to something usable.

Including in the `reverse_winhttp/s` stager will come later.
comment
created
Meatballs1
username_0
TBH I don't expect reverse_winhttp stagers to pick up the proxy settings, which is why I would stick with reverse_https for all kinds of phishing/social engineering attempts.
comment
created
OJ
username_2
Ok cool. I've almost got meterpreter using the proxy stuff via WinHTTP. I'd
appreciate the help with some testing when fixed if that's OK.
comment
created
Meatballs1
username_0
Sure I have an environment where it currently fails ready to roll :D
comment
created
hmoore-r7
username_3
It looks like passing WINHTTP_ACCESS_TYPE_DEFAULT_PROXY to WinHttpOpen may be enough for both the user and service cases.
comment
created
OJ
username_2
That's what we do now both in meterpreter and the stagers, neither of which
works :(
comment
created
hmoore-r7
username_3
Ah, lame, I guess we need to add  WinHttpGetIEProxyConfigForCurrentUser() instead
comment
created
OJ
username_2
Yes. And the result of that requires a few other changes too. If wpad is
used it's not so bad, but if its a custom proxy that requires auth I can't
yet see how to get it to use the creds automatically.
comment
created
Meatballs1
username_0
Most of the time the auth will be NTLM and should be automatic based on user token?
comment
created
OJ
username_2
True, but not so for basic auth.
comment
created
busterb
username_4
While there is still a ticket for adding stager support that needs more review, the Windows meterpreter bits are now in place. Thanks everyone.
comment
closed
bcook-r7
username_1
issue