EmpireProject / Empire

Empire is a PowerShell and Python post-exploitation agent.
http://www.powershellempire.com/
BSD 3-Clause "New" or "Revised" License
7.36k stars 2.8k forks source link

Custom DefaultProfile with domain fronting is malforming headers. #1339

Open fela15 opened 5 years ago

fela15 commented 5 years ago

Empire Version

2.5

OS Information (Linux flavor, Python version)

4.4.0-142-generic #168-Ubuntu SMP Wed Jan x86_64 x86_64 x86_64 GNU/Linux

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

When I set a Host header, used for domain fronting, the first request made to the empire server works just fine, but the 2 and 3 dont. The Host header I wrote on the DefaultProfile is being written in a malformed way.

First req:

GET /login/process.php HTTP/1.1 Cookie: XXXXX=XXXXXX Host: MYDOMAIN

Then this happens:

POST /news.php HTTP/1.1 MYDOMAIN: , User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0;rv:11.0) like Gecko Host: .com Content-Length: 462