[WebSocket] Error: Must be GET request

[Auzgame]

First Steps

1. Confirm that your issue has not been posted previously by searching here: https://github.com/beefproject/beef/issues
2. Confirm that the wiki does not contain the answers you seek: https://github.com/beefproject/beef/wiki
3. Check the FAQ: https://github.com/beefproject/beef/wiki/FAQ
4. BeEF Version: v0.5.4.0
5. Ruby Version: 2.7
6. Browser Details (e.g. Chrome v81.0): Chrome latest
7. Operating System (e.g. OSX Catalina): Linux Debian

Configuration

1. Have you made any changes to your BeEF configuration? Yes - Modified how beEF handles cookies
2. Have you enabled or disabled any BeEF extensions? No

Steps to Reproduce

1. Install/Setup everything
2. Use public host settings under beef.http.public
3. start the server
4. Connect client
5. Hook browser
6. Try and run a command

Debugging Message

Nonce Incorrect
Nonce Incorrect

I keep getting this debug message when I try and use a command. I was wondering if you could help and also tell me how the commands in ruby work. (e.g how they flow in code)
Also should mention I was debugging and found out that events under extensions/events/handler.rb return the following error

#<Thread:0x0000000003daac20 /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:45 run> terminated with exception (report_on_exception is true):
Traceback (most recent call last):
    11: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:46:in `block (2 levels) in <class:DynamicReconstruction>'
    10: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `check_packets'
     9: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `each'
     8: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:74:in `block in check_packets'
     7: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `execute'
     6: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `new'
     5: from /home/runner/beef/extensions/events/handler.rb:17:in `initialize'
     4: from /home/runner/beef/extensions/events/handler.rb:42:in `setup'
     3: from /home/runner/beef/extensions/events/handler.rb:42:in `each'
     2: from /home/runner/beef/extensions/events/handler.rb:43:in `block in setup'
     1: from /home/runner/beef/extensions/events/handler.rb:49:in `parse'
/home/runner/beef/extensions/events/handler.rb:49:in `[]': no implicit conversion of String into Integer (TypeError)
#<Thread:0x0000000003ba24a0 /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:45 run> terminated with exception (report_on_exception is true):
Traceback (most recent call last):
    11: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:46:in `block (2 levels) in <class:DynamicReconstruction>'
    10: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `check_packets'
     9: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `each'
     8: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:74:in `block in check_packets'
     7: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `execute'
     6: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `new'
     5: from /home/runner/beef/extensions/events/handler.rb:17:in `initialize'
     4: from /home/runner/beef/extensions/events/handler.rb:42:in `setup'
     3: from /home/runner/beef/extensions/events/handler.rb:42:in `each'
     2: from /home/runner/beef/extensions/events/handler.rb:43:in `block in setup'
     1: from /home/runner/beef/extensions/events/handler.rb:49:in `parse'
/home/runner/beef/extensions/events/handler.rb:49:in `[]': no implicit conversion of String into Integer (TypeError)
#<Thread:0x0000000003b29aa0 /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:45 run> terminated with exception (report_on_exception is true):
Traceback (most recent call last):
    11: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:46:in `block (2 levels) in <class:DynamicReconstruction>'
    10: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `check_packets'
     9: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `each'
     8: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:74:in `block in check_packets'
     7: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `execute'
     6: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `new'
     5: from /home/runner/beef/extensions/events/handler.rb:17:in `initialize'
     4: from /home/runner/beef/extensions/events/handler.rb:42:in `setup'
     3: from /home/runner/beef/extensions/events/handler.rb:42:in `each'
     2: from /home/runner/beef/extensions/events/handler.rb:43:in `block in setup'
     1: from /home/runner/beef/extensions/events/handler.rb:49:in `parse'
/home/runner/beef/extensions/events/handler.rb:49:in `[]': no implicit conversion of String into Integer (TypeError)

[bcoles]

Have you made any changes to your BeEF configuration? Yes - Modified how beEF handles cookies

The issue is most likely due to your changes to the code base.

[Auzgame]

Have you made any changes to your BeEF configuration? Yes - Modified how beEF handles cookies

The issue is most likely due to your changes to the code base.

The changes I made to the cookies just made it so you don't need to login with a username/password.

[bcoles]

Have you made any changes to your BeEF configuration? Yes - Modified how beEF handles cookies

The issue is most likely due to your changes to the code base.

The changes I made to the cookies just made it so you don't need to login with a username/password.

Presumably your changes do not set the user logged in, thus never creating a session with an associated @nonce.

# grep -rni "nonce incorrect" .
./extensions/admin_ui/controllers/modules/modules.rb:281:              print_error 'nonce incorrect'
./extensions/admin_ui/controllers/modules/modules.rb:338:              print_error 'nonce incorrect'
./extensions/admin_ui/controllers/modules/modules.rb:389:              print_error 'nonce incorrect'
./extensions/admin_ui/controllers/modules/modules.rb:423:              print_error 'nonce incorrect'

beef/extensions/admin_ui/classes/session.rb

Lines 22 to 29 in bcd0865

	#
	# set the session logged in
	#
	def set_logged_in(ip)
	@id = BeEF::Core::Crypto.secure_token
	@nonce = BeEF::Core::Crypto.secure_token
	@ip = ip
	end

[Auzgame]

Have you made any changes to your BeEF configuration? Yes - Modified how beEF handles cookies

The issue is most likely due to your changes to the code base.

The changes I made to the cookies just made it so you don't need to login with a username/password.

Presumably your changes do not set the user logged in, thus never creating a session with an associated @nonce.

# grep -rni "nonce incorrect" .
./extensions/admin_ui/controllers/modules/modules.rb:281:              print_error 'nonce incorrect'
./extensions/admin_ui/controllers/modules/modules.rb:338:              print_error 'nonce incorrect'
./extensions/admin_ui/controllers/modules/modules.rb:389:              print_error 'nonce incorrect'
./extensions/admin_ui/controllers/modules/modules.rb:423:              print_error 'nonce incorrect'

beef/extensions/admin_ui/classes/session.rb

Lines 22 to 29 in bcd0865

	#
	# set the session logged in
	#
	def set_logged_in(ip)
	@id = BeEF::Core::Crypto.secure_token
	@nonce = BeEF::Core::Crypto.secure_token
	@ip = ip
	end

Ok quick update. I reverted the changes back to default and did more debugging and it looks like in the session.rb @ip and @id are returning nil.

[Auzgame]

Think I found the issue. In the session.rb, the @ip and request.ip don't match, which is causing the log out.

return false unless @ip.to_s.eql? request.ip

Could you explain what these to variables are and how I can fix the issue

[bcoles]

What are you trying to do?

Also, exposing BeEF to the Internet without requiring a username and password is not a smart move.

[Auzgame]

What are you trying to do?

Also, exposing BeEF to the Internet without requiring a username and password is not a smart move.

Nevermind just found out that I needed to enable allow_reverse_proxy to fix the @ip != request.ip

[Auzgame]

More errors appeared upon fixing that inside the extensions/events/handler.rb regarding def parse(event)

#<Thread:0x0000000003e54478 /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:45 run> terminated with exception (report_on_exception is true):
Traceback (most recent call last):
    11: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:46:in `block (2 levels) in <class:DynamicReconstruction>'
    10: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `check_packets'
     9: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:53:in `each'
     8: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:74:in `block in check_packets'
     7: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `execute'
     6: from /home/runner/beef/core/main/network_stack/handlers/dynamicreconstruction.rb:100:in `new'
     5: from /home/runner/beef/extensions/events/handler.rb:17:in `initialize'
     4: from /home/runner/beef/extensions/events/handler.rb:42:in `setup'
     3: from /home/runner/beef/extensions/events/handler.rb:42:in `each'
     2: from /home/runner/beef/extensions/events/handler.rb:43:in `block in setup'
     1: from /home/runner/beef/extensions/events/handler.rb:49:in `parse'
/home/runner/beef/extensions/events/handler.rb:49:in `[]': no implicit conversion of String into Integer (TypeError)

[bcoles]

git pull

[Auzgame]

Thanks for the patch. Fixed most of my issues. I'll come back if i need more help!

[Auzgame]

Hey man I was doing more testing and got pretty far. I'm at the issue where I'm getting the following error on repeat:

[ 0:55:41][!] [WebSocket] Error: Must be GET request
[ 0:55:41][!] [WebSocket] Error: Not an upgrade request

This occurs after I send a command to a client. The command will get executed by the client but the client can't send back any info. So things like overwriting the html body work, like the rick roll, but everything else is broken.