Skip to content

Allow different host port and listener port - #819

Closed
ruvolof wants to merge 1 commit into
BC-SECURITY:mainfrom
ruvolof:allow-different-host-port-and-listener-port
Closed

ruvolof wants to merge 1 commit into
BC-SECURITY:mainfrom
ruvolof:allow-different-host-port-and-listener-port

Conversation

@ruvolof

@ruvolof ruvolof commented Apr 13, 2026

Copy link
Copy Markdown

Describe your changes

This merge request addresses the possibility to have a different host port and bind port (scenario when Empire runs behind a reverse proxy).

The merge requests maintains the old behavior of forcing the bind port into the host if the host port is not specified.

Additionally, while working on this issue I had already noticed another issue with the default uris for malleable profile when missing the stager block. My solution is a bit different than the one currently in main, adding the default uri only when the stager block is not found. During my tests, the original approach ended up creating this additional uri even when the stager block was present (and then it could be randomly selected when generating the launchers).

Issue ticket number and link (if there is one)

#808

Checklist before requesting a review

  • [X ] I have performed a self-review of my code
  • If it is a core feature, I have added thorough tests.
  • [-] I have added an entry to CHANGELOG.md
  • I have updated the documentation in docs/ (if applicable)

@Cx01N
Cx01N requested a review from Hubbl3 April 19, 2026 00:55
@ruvolof
ruvolof force-pushed the allow-different-host-port-and-listener-port branch from 3b973a0 to 55ce159 Compare July 4, 2026 07:40
@ruvolof
ruvolof force-pushed the allow-different-host-port-and-listener-port branch from 55ce159 to c19250c Compare August 5, 2026 20:27
Previously the listener Host could not carry a port and the listener bind
Port was effectively forced to match it. This allows the advertised host
port and the listener bind port to differ:

- validate_listener_address no longer rejects a port given in Host; the
  host address is built from the host-supplied port when present, falling
  back to the Port option otherwise (omitting it for the 80/http and
  443/https defaults).
- The malleable listener extracts the advertised port from Host via
  get_malleable_port for launcher and stager generation, and builds the
  stager request from server + path/query.
- The malleable Stager only injects the default /init/ URI when the
  profile defines no http-stager block, instead of always.
- Listener tests updated for the new normalization behaviour.
@ruvolof
ruvolof force-pushed the allow-different-host-port-and-listener-port branch from c19250c to 3ece9c7 Compare October 11, 2026 08:13
@Cx01N

Cx01N commented Oct 12, 2026

Copy link
Copy Markdown
Member

Thanks @ruvolof! This was hand-ported onto the 7.0 listener layout (listeners moved to listeners/<name>/listener.py + .j2 templates, so it no longer applied cleanly) with you credited via Co-authored-by. It will ship here with the next release. Closing as superseded.

@Cx01N Cx01N closed this Oct 12, 2026
@ruvolof
ruvolof deleted the allow-different-host-port-and-listener-port branch October 27, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants