Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support Mdm::Module::Ref object when linking vulns #12738

Merged
merged 2 commits into from
Dec 17, 2019

Conversation

jmartin-tech
Copy link
Contributor

@jmartin-tech jmartin-tech commented Dec 17, 2019

In some legacy cases a database cache can result in a session reporting vulns with support for an Mdm::Module::Ref object. Due to serialization processes in these cases the string representation of name from the object needs to be passed to find_or_create_ref.

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • Load a database module set
irb
modules.refresh_cache_from_module_files
sleep(5)
db.update_all_module_details
exit
  • use exploit/windows/smb/ms08_067_netapi to generate a session
  • Verify the refs table contains valid reference names not numbers

@jmartin-tech
Copy link
Contributor Author

Testing shows this needed to account for empty refs that look to have caused imports to silently drop vulns with no references.

@bcook-r7
Copy link
Contributor

bcook-r7 commented Dec 17, 2019

I really like this, it makes it easier to read as well.

@bcook-r7 bcook-r7 self-assigned this Dec 17, 2019
busterb added a commit that referenced this pull request Dec 17, 2019
@busterb busterb merged commit 31ed5d5 into rapid7:master Dec 17, 2019
@bcook-r7
Copy link
Contributor

I didn't use the exact same exploit module, but got the same side-effect. Thanks!

@jmartin-tech jmartin-tech deleted the support-ref-object branch December 17, 2019 20:37
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants