[Mac] Tab Auto Complete Crashes Metasploit

[ghost]

OS: OSX 10.10
Ruby: ruby 1.9.3-p550
Metasploit: metasploit v4.10.1-dev [core:4.10.1.pre.dev api:1.0.0]

Description:
Tab autocomplete on any file name at the end of the directory path crashes msfconsole / meterpreter / whatever is being used at the time.

Example:
Let's say I want to set a PASS_FILE to be the value of '/Users/peleus/Bench/unix_passwords.txt'
The following occurs at each point of the file entry.

'set PASS_FILE /User[tab]' -> OK
'set PASS_FILE /Users/[tab]' -> OK
'set PASS_FILE /Users/peleus/Ben[tab]' -> OK
'set PASS_FILE /Users/peleus/Bench/u[tab]' -> Crash
'set PASS_FILE /Users/peleus/Bench/unix_passwords.txt[tab]' -> Crash

This occurs not only with modules (auxiliary / exploit's etc) but also within open meterpreter sessions (say designating a file to upload).

**Error Log (Note: File does exist) :**
set PASS_FILE /Users/peleus/Bench/u/Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:8438:in `lstat': No such file or directory - /usr/local/share/metasploit-framework/set PASS_FILE /Users/peleus/Bench/unix_passwords.txt (Errno::ENOENT)
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:8438:in `append_to_match'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:6812:in `rl_complete_internal'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:6851:in `rl_complete'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4322:in `_rl_dispatch_subseq'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4311:in `_rl_dispatch'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4727:in `readline_internal_charloop'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4801:in `readline_internal'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4823:in `readline'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/readline.rb:45:in `readline'
    from /usr/local/share/metasploit-framework/lib/rex/ui/text/input/readline.rb:86:in `pgets'
    from /usr/local/share/metasploit-framework/lib/rex/ui/text/shell.rb:184:in `run'
    from /usr/local/share/metasploit-framework/lib/metasploit/framework/command/console.rb:30:in `start'
    from /usr/local/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
    from /usr/local/share/metasploit-framework/msfconsole:48:in `<top (required)>'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/msfconsole:23:in `load'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/msfconsole:23:in `<main>'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/ruby_executable_hooks:15:in `eval'
    from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/ruby_executable_hooks:15:in `<main>'

[jagar]

I have also experienced the same issue. This also occurs when using the db_import functionality. My stacktrace displays the same line numbers and files as posted above.

OS: Ubuntu 14.04.1 LTS
Ruby: ruby 1.9.3p484
Metasploit: metasploit v4.10.1-dev [core:4.10.1.pre.dev api:1.0.0]

I was able to reliably reproduce this issue. It appears that tab completing directory names works just fine, but when the tab completion will result in a unique file name, it crashes.

PoC:

msf> ls
[*] exec: ls

testdir
test.xml
test.xml2
msf> ls testdir

[*] exec: ls testdir

test.xml
test.xml2
msf> db_import /tmp/test<TAB>
test.xml   test.xml2  testdir
msf> db_import /tmp/testdir/test.xml<TAB>
test.xml   test.xml2
msf> db_import /tmp/test.<TAB>
test.xml   test.xml2
msf> db_import /tmp/test.xml2<TAB>    // Crashes msfconsole with same stacktrace

[kernelsmith]

Workaround is to start msfconsole with the -L switch. Ruby readline has problems

-Josh

On Nov 20, 2014, at 04:13, PeleusGitHub notifications@github.com wrote:

OS: OSX 10.10
Ruby: ruby 1.9.3-p550
Metasploit: metasploit v4.10.1-dev [core:4.10.1.pre.dev api:1.0.0]

Description:
Tab autocomplete on any file name at the end of the directory path crashes msfconsole / meterpreter / whatever is being used at the time.

Example:
Let's say I want to set a PASS_FILE to be the value of '/Users/peleus/Bench/unix_passwords.txt'
The following occurs at each point of the file entry.

'set PASS_FILE /User' -> OK
'set PASS_FILE /Users/' -> OK
'set PASS_FILE /Users/peleus/Ben' -> OK
'set PASS_FILE /Users/peleus/Bench/u' -> Crash
'set PASS_FILE /Users/peleus/Bench/unix_passwords.txt' -> Crash

This occurs not only with modules (auxiliary / exploit's etc) but also within open meterpreter sessions (say designating a file to upload).

Error Log (Note: File does exist) :
set PASS_FILE /Users/peleus/Bench/u/Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:8438:in lstat': No such file or directory - /usr/local/share/metasploit-framework/set PASS_FILE /Users/peleus/Bench/unix_passwords.txt (Errno::ENOENT)
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:8438:inappend_to_match'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:6812:in rl_complete_internal'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:6851:inrl_complete'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4322:in _rl_dispatch_subseq'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4311:in_rl_dispatch'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4727:in readline_internal_charloop'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4801:inreadline_internal'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/rbreadline.rb:4823:in readline'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@global/gems/rb-readline-0.5.1/lib/readline.rb:45:inreadline'
from /usr/local/share/metasploit-framework/lib/rex/ui/text/input/readline.rb:86:in pgets'
from /usr/local/share/metasploit-framework/lib/rex/ui/text/shell.rb:184:inrun'
from /usr/local/share/metasploit-framework/lib/metasploit/framework/command/console.rb:30:in start'
from /usr/local/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:instart'
from /usr/local/share/metasploit-framework/msfconsole:48:in <top (required)>'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/msfconsole:23:inload'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/msfconsole:23:in

'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/ruby_executable_hooks:15:ineval'
from /Users/peleus/.rvm/gems/ruby-1.9.3-p550@metasploit-framework/bin/ruby_executable_hooks:15:in `'

—
Reply to this email directly or view it on GitHub.

[hdm]

Looks like this is actually a bug in the upstream rb-readline library: https://github.com/luislavena/rb-readline

[hdm]

This is a duplicate of #4128. Closing this ticket and tracking there.

[OJ]

FWIW: @PeleusGitHub this was a great bug report. 👍

[todb-r7]

The short story, @PeleusGitHub , is to use Metasploit as ./msfconsole -L until we figure out what's going on with ConnorAtherton/rb-readline#111 . Also, yes, great bug report, wonderful repro steps.

[hdm]

This is now patched in upstream rb-readline.

[hdm]

For Metasploit to get this patch, rb-readline needs to release a new gem.

[tikums]

I can reproduce this on Kali Linux 1.1.0 (3.18.0-kali1-686-pae).

Ruby: ruby 1.9.3p194 (2012-04-20 revision 35410) [i486-linux]
Metasploit Framework Version: 4.11.0-2015013101

Description:
While performing 'db_import', tab autocomplete on any file name at the end of the directory path crashes msfconsole.

Example/PoC:
While trying to import XML results of an external nmap scan

msf > db_import /tmp/test.xml2<TAB>    // Crashes msfconsole with stacktrace:
/opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:8438:in `lstat': No such file or directory - /root/db_import /root/winxp (Errno::ENOENT)
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:8438:in `append_to_match'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:6812:in `rl_complete_internal'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:6851:in `rl_complete'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:4322:in `_rl_dispatch_subseq'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:4311:in `_rl_dispatch'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:4727:in `readline_internal_charloop'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:4801:in `readline_internal'
    from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rb-readline-0.5.2/lib/rbreadline.rb:4823:in `readline'
    from /usr/share/metasploit-framework/lib/rex/ui/text/input/readline.rb:132:in `readline_with_output'
    from /usr/share/metasploit-framework/lib/rex/ui/text/input/readline.rb:86:in `pgets'
    from /usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:184:in `run'
    from /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:38:in `start'
    from /usr/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
    from /opt/metasploit/apps/pro/msf3/msfconsole:48:in `<main>'
root@kali:~#

[hdm]

This is patched in master. Is your Kali up to date? That looks like a January update version.

[tikums]

Thanks, @hmoore-r7

I've updated to master and confirm that I can no longer reproduce it.