Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

YAML warnings are very unnecessary, they can only do harm #13250

Merged
merged 1 commit into from
Apr 15, 2020

Conversation

busterb
Copy link
Member

@busterb busterb commented Apr 14, 2020

Since MSF5 we've said 'WARNING' with print_error about an issue a lot of users don't really care about (whether there's a database.yaml). While they lose some functionality, it anecodtally doesn't seem to make a whole lot of difference in anyone's behavior, but does cause noise in the issue queue when folks don't understand, especially with Windows installations. Let's conserve a few bits of entropy in the universe and switch these warning messages to be logged as warnings (which are quiet by default).

Verification

  • Start msfconsole without a database YAML file
  • Enjoy the silence

image

Since MSF5 we've said 'WARNING' with print_error about an issue a lot of
users don't really care about (whether there's a database.yaml). While
they lose some functionality, it anecodtally doesn't seem to make a
whole lot of difference in anyone's behavior. Save a few bits and switch
these warning messages to be logged as warnings (which are quiet by
default).
@adfoster-r7
Copy link
Contributor

adfoster-r7 commented Apr 14, 2020

This seems good to me, I was playing around with an alternative approach that lets users know that they aren't connected to a database - but also tries to educate them as to what that means.

Maybe something similar to:

       =[ metasploit v5.0.85-dev-530e4cc20d               ]
+ -- --=[ 1998 exploits - 1090 auxiliary - 341 post       ]
+ -- --=[ 560 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 7 evasion                                       ]
+ -- --=[ Session type: Temporary                         ]

[-] You are currently running a temporary Metasploit session. All results will be
lost when the session ends. This is fine for most users. Learn more about
persisting your session within a database here - http://r-7.co/MSF-DB

And in the other alternative paths being:

Session type: Persisted (Local Postgres)
Session type: Persisted (Remote Postgres)

That approach required an additional wiki page to highlight how to start/stop your database, what it means, what benefits you get from using a database, etc.

But I think this PR is a good first step into reducing the confusion for new users!

Question: Will this impact anyone's existing flows by no longer being notified when their database isn't connected? i.e. Is this important information for pen testers etc? It would be annoying to go through an entire pen test to realize nothing's been saved as you'd normally expect

@adfoster-r7 adfoster-r7 reopened this Apr 14, 2020
@bwatters-r7 bwatters-r7 self-assigned this Apr 15, 2020
@bwatters-r7
Copy link
Contributor

The "Lost in Space" Robot is disappointed...

[ruby-2.6.5@metasploit-framework](land-13250) tmoose@ubuntu:~/rapid7/metasploit-framework$ ./msfconsole
[-] No local database connected. Please connect to a local database before connecting to a remote data service.
                                                  

  Metasploit Park, System Security Interface
  Version 4.0.5, Alpha E
  Ready...
  > access security
  access: PERMISSION DENIED.
  > access security grid
  access: PERMISSION DENIED.
  > access main security grid
  access: PERMISSION DENIED....and...
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!


       =[ metasploit v5.0.85-dev-8e701e4                  ]
+ -- --=[ 1999 exploits - 1092 auxiliary - 342 post       ]
+ -- --=[ 564 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 7 evasion                                       ]

Metasploit tip: Use help <command> to learn more about any command

@bwatters-r7 bwatters-r7 merged commit 00de145 into rapid7:master Apr 15, 2020
@bwatters-r7 bwatters-r7 added the rn-no-release-notes no release notes label Apr 15, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants