Add proxy authentication support to the Python Meterpreter

[zeroSteiner]

This adds support to the Python Meterpreter for using HTTP Proxies that require authentication by honoring the HttpProxyUser and HttpProxyPass options (at least one of the two must be set to a non-empty string). This also deregisters the HttpProxyType option because HTTP is the only one that is supported.

I also updated the meterpreter stage description to note that it's compatible with versions 2.5-2.7 and 3.1+ to imply that it does in fact work with Python 3.7, 3.8 etc.

This addresses rapid7/metasploit-payloads#386 and requires the changes in rapid7/metasploit-payloads#427.

Verification

I used proxy.py as my proxy for testing and I highly recommend for the following reasons:

• Installation was a simple command, just had to run pip install proxy.py
• It runs in the foreground with logging by default making it easy to see that it's being used
• It supports authentication with the optional --basic-auth flag

• Install proxy.py using pip install proxy.py
• Run proxy.py on all interfaces with a username of "user" and a password of "pass" proxy --hostname 0.0.0.0 --basic-auth user:pass
• Start msfconsole
• use payload/python/meterpreter/reverse_https
• Set the LHOST and LPORT options per usual
• Set the HttpProxyHost and HttpProxyPort options to whatever system is running your proxy instance
• Set the HttpProxyUser and HttpProxyPass options to "user" and "pass" respectively
• Start the handler with to_handler
• Generate and run the stage
• Get a functioning session and see that the proxy is being used

[agalway-r7]

Release Notes

Adds proxy support to the python meterpreter and removes the HttpProxyType flag as it's no longer needed.

[adfoster-r7]

Was this meant to also impact python/meterpreter_reverse_http? 👀

That payload seems to include this base mixin:

metasploit-framework/modules/payloads/singles/python/meterpreter_reverse_http.rb

Line 13 in 773c6be

include Msf::Payload::Python::ReverseHttp

but it also re-registers the same options again later:

metasploit-framework/modules/payloads/singles/python/meterpreter_reverse_http.rb

Lines 28 to 31 in 773c6be

	register_advanced_options(
	Msf::Opt::http_header_options +
	Msf::Opt::http_proxy_options
	)

Which makes the option appear again:

msf6 payload(python/meterpreter_reverse_http) > advanced
   ... etc ...
   HttpProxyType                HTTP                                                         yes       The type of HTTP proxy (Accepted: HTTP, SOCKS)

[adfoster-r7]

Bit of a drive-by-comment, I'll likely look at this with fresh eyes tomorrow and see what I've missed 😄