Skip to content

add file: support for RHOSTS option on exploit modules #11497

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 28, 2019

Conversation

busterb
Copy link
Contributor

@busterb busterb commented Feb 28, 2019

This implements file: support for the RHOSTS option on exploit modules. Through a minor oddity with how the OptAddressRange option works, looking at 'RHOSTS' directly from the module returns the string literal rather than the normalized form. This PR instantiates an OptAddressRange if RHOSTS is specified for the purpose of normalizing file: back into the correct value.

Verification

  • Start msfconsole
  • use exploit/windows/smb/ms08_067_netapi or any remote exploit
  • set RHOSTS single-ip
  • Verify a single host is exploited
  • set RHOSTS ip-range
  • Verify multiple hosts are exploited
  • set RHOSTS file:rhosts.txt
  • Verify the contents of rhosts.txt is exploited
  • use exploit/windows/fileformat/dvdx_plf_bof or any non-remote exploit
  • ** Verify** the exploit works as expected

@busterb busterb requested a review from Green-m February 28, 2019 12:04
@busterb busterb added the bug label Feb 28, 2019
@wvu wvu self-assigned this Feb 28, 2019
Copy link
Contributor

@wvu wvu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, will test and land after lunch.

@wvu
Copy link
Contributor

wvu commented Feb 28, 2019

Release Notes

This fixes a validation bug in setting RHOSTS via file: in an exploit.

@wvu wvu merged commit 0c253ab into rapid7:master Feb 28, 2019
wvu added a commit that referenced this pull request Feb 28, 2019
@Green-m
Copy link
Contributor

Green-m commented Mar 1, 2019

This patch works well, thank you @busterb.

And there is one more thing, not related to this PR, just for discussing.
This line of code aims at validating the option of exploit module, but it not supported for RHOSTS, to avoid bugs referenced in #11493 and this PR, we have to preprocess the option before entering the exploit_simple method.

exploit.options.validate(exploit.datastore)

What I want to say is, shall we plan to streamline the exploit/auxiliay procedure to make code more elegant and consistent? Even for better parallelised mentioned in #11318? At the beginning of the framework design, it did not consider for multiple threads and hosts during exploit.

@wvu
Copy link
Contributor

wvu commented Mar 1, 2019

That is a great idea, @Green-m.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants