Skip to content

Commit

Permalink
Lower ranking because they cannot auto-target
Browse files Browse the repository at this point in the history
In order to be qualified as ExcellentRanking, auto-target is a must,
or the module has to default to a payload that's universal for
multiple platforms.  Otherwise you're wasting time in Pro.
  • Loading branch information
sinn3r committed Jan 24, 2013
1 parent 8e09247 commit 0c0f4a3
Show file tree
Hide file tree
Showing 4 changed files with 4 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
Rank = GoodRanking

HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

Expand Down
2 changes: 1 addition & 1 deletion modules/exploits/multi/http/jenkins_script_console.rb
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
Rank = GoodRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStagerVBS
Expand Down
2 changes: 1 addition & 1 deletion modules/exploits/multi/http/splunk_upload_app_exec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
Rank = GoodRanking

include Msf::Exploit::Remote::HttpClient

Expand Down
2 changes: 1 addition & 1 deletion modules/exploits/multi/http/struts_code_exec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
Rank = GoodRanking

include Msf::Exploit::CmdStagerTFTP
include Msf::Exploit::Remote::HttpClient
Expand Down

4 comments on commit 0c0f4a3

@schierlm
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

someone might want to update https://github.com/rapid7/metasploit-framework/wiki/Exploit-Ranking to reflect this new requirement then.

@sinn3r
Copy link
Contributor Author

@sinn3r sinn3r commented on 0c0f4a3 Jan 25, 2013 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@schierlm
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently the current wording is at least ambiguous.

How I'm interpreting the list on the wiki page:

if (is DoS || requires manual configuration)
    return MANUAL_RANKING;
else if (! memory corruption)
    return EXCELLENT_RANKING;
else if (has auto target)
    return GREAT_RANKING;
else if (has "sensible" default target)
    return GOOD_RANKING;
else if (generally reliable)
    return NORMAL_RANKING;
else if (nearly impossible to exploit)
    return LOW_RANKING;
else
    return AVERAGE_RANKING;

In other words, it reads for me as if only the two outer ranks (MANUAL and EXCELLENT) are eligible for non-memory-corruptions and all the other categories are for memory corruptions only to differentiate the reliability (while MANUAL is of course also eligible for memory corruptions). Which somehow makes sense because usually a mischosen target for a memory corruption results in at least a restart of the service, while a mischosen target for a non-memory-corruption in worst case results in no shell or a not working one (which is negligible risk).

Perhaps the right way would be to differentiate between the "automatism" of the exploit (if I run it unconfigured, will it get me shells) and the "risk" (if I run it unconfigured, will it get me into trouble?) by providing two different rank scales?

@todb-r7
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FIrst off, a lot of people mistake the Rankings as statements of module quality, which they're not -- but that's not obvious unless you read a particular wiki page.

In this case, it looks like you're fishing for an is_automatable? boolean? We went down that path with Browser Autopwn, which ended up being outside of this ranking system, too.

Sounds like it might be time to reimagine the ranking system, because if you're getting confused, I can't imagine newbies are going to guess correctly.

Please sign in to comment.