kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
BSD 3-Clause "New" or "Revised" License
10.54k stars 1.91k forks source link

Cannot create certificate from behind reverse proxy #787

Closed ghost closed 1 year ago

ghost commented 2 years ago

Hello,

I have two docker containers: Nginx and Evilginx2. Nginx proxies all subdomains to evilginx2, and as well as the acme challenges:

server {
    listen 80;

        server_name *.${NGINX_HOST};  

    location / {
        proxy_pass https://evilginx:80;
    }

        location /.well-known/acme-challenge/ {
            proxy_pass https://evilginx:80;
        }
}

Evilginx is unable to handle this:

[14:46:33] [war] failed to load certificate files for phishlet '<PHISHLET>', domain '<DOMAIN>': open /app/config/crt/<DOMAIN>/<PHISHLET>.crt: no such file or directory
[14:46:33] [inf] requesting SSL/TLS certificates from LetsEncrypt...
[14:49:08] [!!!] acme: Error -> One or more domains had a problem:
...
 Invalid response from http://<DOMAIN>/.well-known/acme-challenge/<Challange String>: 504

It seems evilginx2 is not handling the proxy properly, resulting in gateway timeouts. I've looked at the source code of the go challenge, and tested this with a simple go module that does an acme-challenge - and cannot find a solution. I can't find anything in your application's code that would make this not work.

Adding in Host headers (proxy_set_header Host $host;) results in a 502 bad gateway error, which Is why I think this is a bug on the evilginx2 side.

[war] failed to load certificate files for phishlet '<PHISHLET>', domain '<DOMAIN>': open /app/config/crt/<DOMAIN>/<PHISHLET>.crt: no such file or directory
[15:07:58] [inf] requesting SSL/TLS certificates from LetsEncrypt...
[15:08:11] [!!!] acme: Error -> One or more domains had a problem:
[<DOMAIN>] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: <IP>: Invalid response from http://<DOMAIN>/.well-known/acme-challenge/<Challange String>: 502, url:
[<DOMAIN>] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: <IP>: Invalid response from http://<DOMAIN>/.well-known/acme-challenge/<Challange String>: 502, url: