Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add easier way to delete host tags #16833

Merged
merged 2 commits into from
Aug 2, 2022

Conversation

gwillcox-r7
Copy link
Contributor

Currently the only way to delete a host tag is to do this odd syntax:

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts

Hosts
=====

address  mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------  ---  ----  -------  ---------  -----  -------  ----  --------

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -a 127.0.0.1
[*] Time: 2022-07-28 19:54:27 UTC Host: host=127.0.0.1
msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -c address,tags

Hosts
=====

address    tags
-------    ----
127.0.0.1

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -t test 127.0.0.1
msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
127.0.0.1

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -c address,tags

Hosts
=====

address    tags
-------    ----
127.0.0.1  test

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -d -t test 127.0.0.1
[-] Invalid host parameter, -t.
[-] Invalid host parameter, test.
msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts 

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
127.0.0.1

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -d 127.0.0.1 -t test
msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts -c address,tags

Hosts
=====

address    tags
-------    ----
127.0.0.1

msf6 payload(windows/x64/meterpreter/reverse_tcp) > 

Note that the documentation for the hosts command makes it so that it seems like the -d and -t options are the own options and should not be combined as the -d option should just delete the host itself:

msf6 payload(windows/x64/meterpreter/reverse_tcp) > hosts --help
Usage: hosts [ options ] [addr1 addr2 ...]


OPTIONS:

    -a, --add <host>                       Add the hosts instead of searching
    -c, --columns <columns>                Only show the given columns (see list below)
    -C, --columns-until-restart <columns>  Only show the given columns until the next restart (see list below)
    -d, --delete <hosts>                   Delete the hosts instead of searching
    -h, --help                             Show this help information
    -i, --info <info>                      Change the info of a host
    -m, --comment <comment>                Change the comment of a host
    -n, --name <name>                      Change the name of a host
    -O, --order <column id>                Order rows by specified column number
    -o, --output <filename>                Send output to a file in csv format
    -R, --rhosts                           Set RHOSTS from the results of the search
    -S, --search <filter>                  Search string to filter by
    -t, --tag <tag>                        Add or specify a tag to a range of hosts
    -u, --up                               Only show hosts which are up

Available columns: address, arch, comm, comments, created_at, cred_count, detected_arch, exploit_attempt_count, host_detail_count, info, mac, name, note_count, os_family, os_flavor, os_lang, os_name, os_sp, purpose, scope, service_count, state, updated_at, virtual_host, vuln_count, tags

msf6 payload(windows/x64/meterpreter/reverse_tcp) > 

However in the code it seems like we have this odd switch whereby if you specify the -d and -t options and also specify the parameters to them correctly, _defying the documentation, only then is it possible to delete the host tags. Considering this is completely against good practice and basically falls into the realm of undocumented behavior, I decided to fix this.

The new option -T will act like -t however it will delete the tag instead of adding it. It performs the same operations that were being done before but exposes it via a proper option with associated documentation.

Spec files have not yet been added but will be soon.

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • hosts -a 127.0.0.1
  • hosts -t test 127.0.0.1
  • hosts -c address,tags 127.0.0.1
  • Verify that you see the "test" tag.
  • hosts -T test 127.0.0.1
  • hosts
  • Verify that the "test" tag was removed from 127.0.0.1
  • hosts --help
  • Verify that the "-T" option is appropriately documented.

@jheysel-r7 jheysel-r7 self-assigned this Aug 2, 2022
@jheysel-r7 jheysel-r7 merged commit 4f5c711 into rapid7:master Aug 2, 2022
@jheysel-r7
Copy link
Contributor

Thanks for the fix Grant! LGTM 👍
Confirmed existing functionality is as it was described in the PR

msf6 > hosts -c address,tags

Hosts
=====

address         tags
-------         ----
127.0.0.1       test

msf6 > hosts -d -t test 127.0.0.1
[-] Invalid host parameter, -t.
[-] Invalid host parameter, test.
msf6 > hosts

Hosts
=====

address         mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------         ---  ----  -------  ---------  -----  -------  ----  --------
127.0.0.1

msf6 > hosts -d 127.0.0.1 -t test
msf6 > hosts -c address,tags

Hosts
=====

address         tags
-------         ----
127.0.0.1

Confirmed the changes fix the issue:

msf6 > hosts -c address,tags 127.0.0.1

Hosts
=====

address    tags
-------    ----
127.0.0.1  test

msf6 > hosts -T test 127.0.0.1
msf6 > hosts

Hosts
=====

address         mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------         ---  ----  -------  ---------  -----  -------  ----  --------
127.0.0.1

@jheysel-r7
Copy link
Contributor

Release Notes

This PR adds an option to the host command to make it easier to delete host tags

@jheysel-r7 jheysel-r7 added the rn-enhancement release notes enhancement label Aug 2, 2022
@gwillcox-r7 gwillcox-r7 deleted the add-delete-host-tag branch August 2, 2022 22:34
jheysel-r7 added a commit that referenced this pull request Aug 11, 2022
The srt_webdrive_priv script is effectively replaced by
exploit/windows/local/service_permissions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

None yet

2 participants