msfconsole ignores EICAR canary until long after its useful

[bcoles]

A bunch of users have reported issues with a missing .dex file causing Metasploit msfconsole to fail to start. Instead msfconsole dies with a long backtrace.

Here's one example issue I can be bothered to track down (there are many):

• Metasploit on Windows - Ruby error #13134 (comment)

This issue is due to anti-virus eating the .dex file. In theory, corruption of Metasploit files by anti-virus was meant to have been detected by the is_eicar_corrupted? canary.

metasploit-framework/lib/msf/util/exe.rb

Lines 2179 to 2196 in 025950e

	def self.is_eicar_corrupted?
	path = ::File.expand_path(::File.join(
	::File.dirname(__FILE__),"..", "..", "..", "data", "eicar.com")
	)
	return true unless ::File.exist?(path)
	ret = false
	if ::File.exist?(path)
	begin
	data = ::File.read(path)
	unless Digest::SHA1.hexdigest(data) == "3395856ce81f2b7382dee72602f798b642f14140"
	ret = true
	end
	rescue ::Exception
	ret = true
	end
	end
	ret
	end

(Also, this is_eicar_corrupted? method is poorly written. It checks if the file exists twice.)

The problem is that this method is called here:

metasploit-framework/lib/msf/core/framework.rb

Line 42 in 025950e

EICARCorrupted = ::Msf::Util::EXE.is_eicar_corrupted?

But the canary warning is ignored. This proves to be fatal.

A few lines later module_manager is loaded. The crash due to missing .dex file occurs somewhere in here while iterating through module paths.

metasploit-framework/lib/msf/core/framework.rb

Line 58 in 025950e

require 'msf/core/module_manager'

Some time latter, cmd_banner gets called to display the banner, version and help tips. Only then does msfconsole bother to check if the canary is happy.

metasploit-framework/lib/msf/ui/console/command_dispatcher/core.rb

Lines 258 to 265 in 025950e

	if ::Msf::Framework::EICARCorrupted
	avdwarn = []
	avdwarn << "Warning: This copy of the Metasploit Framework has been corrupted by an installed anti-virus program."
	avdwarn << " We recommend that you disable your anti-virus or exclude your Metasploit installation path,"
	avdwarn << " then restore the removed files from quarantine or reinstall the framework. For more info: "
	avdwarn << " https://community.rapid7.com/docs/DOC-1273"
	avdwarn << ""
	end

This sequence of events needs to be reworked.

[dwelch-r7]

I believe the main problem here has been unintentionally fixed by landing the zeitwerk PR #14202
But I'm still going to address the rest of the issues here