4

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category.

  • What can I use as payload for reverse http / https channel on Linux target ?
  • How can I explicitly set the output proxy http of the target network to the payload (no such configuration in payload options) ?
  • Most of the time on linux / osx hosts they have Python or Java, try one of those as both have reverse_http(s) – mubix Jun 23 '15 at 14:11
  • I think the reason of not choosing reverse_http(s) is due to the large size of the payload. If reverse_http(s) can be selected with the exploit (outside BAP), OP should be able to select those payloads within BAP as well. If not, then BAP won't show those payloads since it selects from compatible payloads. – void_in Jun 23 '15 at 15:20
  • seems PAYLOAD_LINUX or PAYLOAD_GENERIC to python/reverse_http does not seem to work – Kartoch Jun 23 '15 at 16:15
1

If reverse_http(s) is not in your payload binaries then you can manually add it. You can download and add the payload from the link below. At the bottom of page there is a download link

https://funoverip.net/2012/10/metasploit-stager-reverse_https-basic-authentication-against-proxy/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.