Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detecting Wrong Linux Proxy Via Env. Variables. #1893

Open
JBalanza opened this issue Feb 17, 2025 · 0 comments
Open

Detecting Wrong Linux Proxy Via Env. Variables. #1893

JBalanza opened this issue Feb 17, 2025 · 0 comments

Comments

@JBalanza
Copy link

Describe the bug
When using a Linux beacon in an Environment where proxy is used, beacon gets the proxy from the HTTP_PROXY env var even tho the HTTPS_PROXY var is set and the C2 callback is made to a HTTPS website.

From implant/sliver/proxy/doc.go it details how the proxy is detected. Several environment variables like HTTPS_PROXY, HTTP_PROXY, FTP_PROXY, or ALL_PROXY are detected. The beacon is getting the HTTP_PROXY as first match if present, and ignoring the rest. Resulting into a wrong proxy setting since the C2 backend is HTTPS.

Steps to Reproduce

  1. Generate a regular linux beacon with a target url that uses HTTPS. Debug version is optional but recommended.
  2. In the victim machine, set different proxies for HTTP and HTTPS using HTTP_PROXY and HTTPS_PROXY variables respectively.
  3. Execute the beacon. Note how the HTTP proxy is picked insted of the HTTPS.

Desktop (please complete the following information):

  • OS: RHEL 8
  • Version Sliver: Latest (v1.5.42)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant