Issues in Rex::Proto::HTTP #3865
Description
This issue was RM8785, originally filed by @firefart
It seems like Rex::Proto::HTTP has some issues. This bug appeared when testing the http_header module.
Example:
firefart@LinuxMint ~/Coding/metasploit-framework $ ./msfcli auxiliary/scanner/http/http_header RHOSTS=accounts.google.com RPORT=443 SSL=true VERBOSE=true E
[*] Initializing modules...
RHOSTS => accounts.google.com
RPORT => 443
SSL => true
VERBOSE => true
[*] 173.194.70.84:443: requesting / via HEAD
[-] 173.194.70.84:443: connection timed out
[*] Scanned 1 of 2 hosts (050% complete)
[*] 2a00:1450:4001:c02::54:443: requesting / via HEAD
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed
CURL Output:
root@firefart:~# curl -skI -X HEAD https://accounts.google.com
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
Strict-Transport-Security: max-age=10893354; includeSubDomains
X-Frame-Options: DENY
Location: https://accounts.google.com/ManageAccount
Content-Length: 223
Date: Sun, 06 Apr 2014 06:52:52 GMT
Expires: Sun, 06 Apr 2014 06:52:52 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 443:quic
As you can see, MSF gets a Timeout, CURL gets the output.
I traced the error down to lib/rex/proto/http/client.rb#read_response and lib/rex/proto/http/packet.rb#parse
The buffer is filled correctly with the response but on parsing, self.state never leaves the state ParseState::ProcessingBody and so a Timeout is triggered after the default timeout because it is trapped in an endless loop.
There are many ways to fix this issue for example:
lib/rex/proto/http/packet.rb:
change
if (self.body_bytes_left == 0 and not self.transfer_chunked)to
if (self.body_bytes_left <= 0 and not self.transfer_chunked)But I think this bugfix can cause many side effects so I add it as a bug so a framework pro can have a look at it