Module Msf::Handler::PassiveX
In: lib/msf/core/handler/passivex.rb

This handler implements the PassiveX reverse HTTP tunneling interface.

Methods

cleanup_handler   deref_handler   find_session_channel   flush_session_channels   general_handler_type   handler_type   new   new_session_channel   on_request   on_session   setup_handler   start_handler   stop_handler   wfs_delay  

Included Modules

Msf::Handler

Classes and Modules

Module Msf::Handler::PassiveX::PxSession
Class Msf::Handler::PassiveX::PxRef
Class Msf::Handler::PassiveX::PxSessionChannel

Public Class methods

general_handler_type()

Returns the connection-described general handler type, in this case ‘tunnel’.

handler_type()

Returns the string representation of the handler type, in this case ‘reverse_http’.

new(info = {})

Initializes the PassiveX HTTP tunneling handler.

Public Instance methods

cleanup_handler()

Simply calls stop handler to ensure that things ar ecool.

deref_handler()

Decrement the references to the handler that was used by this exploit. If it reaches zero, stop it.

on_session(session)

Called when a new session is created on behalf of this handler. In this case, we extend the session so that we can track references to the handler since we need to keep the HTTP tunnel up while the session is alive.

setup_handler()

Create an HTTP listener that will be connected to and communicated with by the payload that is injected, and possibly used for tunneling purposes.

start_handler()

Basically does nothing. The service is already started and listening during set up.

stop_handler()

Stops the service and deinitializes it.

wfs_delay()

PassiveX payloads have a wait-for-session delay of 30 seconds minimum because it can take a bit of time for the OCX to get registered.

Protected Instance methods

find_session_channel(sid)

Finds a session based on the supplied sid

flush_session_channels()

Flushes all existing session_channels and cleans up any resources associated with them.

new_session_channel(sid)

Creates a new session with the supplied sid.

on_request(cli, req)

Processes the HTTP request from the PassiveX client. In this case, when a request is made to "/", an HTML body is sent that has an embedded object tag. This causes the passivex.dll to be downloaded and registered (since registration and downloading have been enabled prior to this point). After that, the OCX may create a tunnel or download a second stage if instructed by the server.

[Validate]