Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix external module crash for att open proxy scanner #17792

Conversation

adfoster-r7
Copy link
Contributor

Fix external module crash for when running the auxiliary/scanner/wproxy/att_open_proxy module

Verification

Before

The att_open_proxy module iterated over an RHOST string, instead of an array of RHOST ips

msf6 auxiliary(scanner/wproxy/att_open_proxy) > run 127.0.0.1

[-] .:49152 - Error connecting: encoding with 'idna' codec failed (UnicodeError: label empty or too long)
[-] .:49152 - Error connecting: encoding with 'idna' codec failed (UnicodeError: label empty or too long)
[-] 1:49152 - Error connecting: [Errno 65] No route to host
[-] 7:49152 - Error connecting: [Errno 65] No route to host
[-] 2:49152 - Error connecting: [Errno 65] No route to host
[-] .:49152 - Error connecting: encoding with 'idna' codec failed (UnicodeError: label empty or too long)
[-] 1:49152 - Error connecting: [Errno 65] No route to host
[-] [:49152 - Error connecting: [Errno 8] nodename nor servname provided, or not known
[-] ":49152 - Error connecting: [Errno 8] nodename nor servname provided, or not known
[-] ]:49152 - Error connecting: [Errno 8] nodename nor servname provided, or not known
[-] 0:49152 - Error connecting: [Errno 61] Connect call failed ('0.0.0.0', 49152)
[-] 0:49152 - Error connecting: [Errno 61] Connect call failed ('0.0.0.0', 49152)
[-] ":49152 - Error connecting: [Errno 8] nodename nor servname provided, or not known
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

After

Verifying the at&t open proxy scanner now works:

# Create a fake listener in a tab
print -n "\x2a\xce..." | ncat -lnvp 49152 

# Run the module - no longer crashes, and you can see the ncat client has connected
msf6 auxiliary(scanner/wproxy/att_open_proxy) > run

[+] 127.0.0.1:49152 - Matches
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Also verifying get user spns still works - which was originally updated to work in #17490

msf6 auxiliary(gather/get_user_spns) > run rhost=192.168.123.13 domain=adf3.local user=Administrator PASS=p4$$w0rd4

[*] Running for 192.168.123.13...
[+] ServicePrincipalName                    Name            MemberOf  PasswordLastSet             LastLogon                   Delegation    
[+] --------------------------------------  --------------  --------  --------------------------  --------------------------  -------------
[+] fake_msql/dc3.adf3.local:1433           fake_mysql                2022-02-10 10:57:13.356981  <never>                     unconstrained 
[+] fake_msql/dc3.adf3.local                fake_mysql                2022-02-10 10:57:13.356981  <never>                     unconstrained 
[+] adf3.local/kerberoastable_service       kerberoastable            2022-06-27 20:03:33.970786  2022-06-30 14:49:29.019696                
[+] adf3.local/kerberoastable_service:1337  kerberoastable            2022-06-27 20:03:33.970786  2022-06-30 14:49:29.019696                
[+] $krb5tgs$23$*fake_mysql$ADF3.LOCAL$adf3.local/fake_mysql*$8ecdb0028c2afe5fe22....

@@ -5,11 +5,6 @@ module Msf::Module::External

def execute_module(path, method: :run, args: datastore, fail_on_exit: true)
mod = Msf::Modules::External.new(path, framework: framework)
if args.is_a?(Msf::DataStore) || args.is_a?(Msf::DataStoreWithFallbacks)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I originally added this in #17490 - but I believe this PR is a cleaner solution

The real issue is the external python modules use a datastore that doesn't have the same semantics as the Ruby version; i.e. i.e. RHOST/RHOSTS aliasing support, plus case insensitive lookups

@@ -27,6 +27,7 @@ class MetasploitModule < Msf::Auxiliary

def run_batch(ips)
datastore.delete('RHOSTS')
datastore.remove_option('RHOSTS') if self.datastore.is_a?(Msf::DataStoreWithFallbacks)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Required because the original datastore had a delete method that also removed data options (Which had other bugs associated with it)

https://github.com/rapid7/metasploit-framework/pull/16940/files#diff-09925245579a8207d4933e78a8e76c5168fe2a1134f0b02a13f9ff344e2c8dc4

@adfoster-r7 adfoster-r7 marked this pull request as draft March 20, 2023 16:50
@adfoster-r7 adfoster-r7 marked this pull request as ready for review March 20, 2023 17:05
@gwillcox-r7 gwillcox-r7 self-assigned this Mar 20, 2023
@gwillcox-r7 gwillcox-r7 added library bug external modules PRs dealing with modules run as their own process labels Mar 20, 2023
@gwillcox-r7 gwillcox-r7 removed their assignment Mar 20, 2023
@dwelch-r7 dwelch-r7 merged commit 158fae2 into rapid7:master Mar 21, 2023
@dwelch-r7 dwelch-r7 added the rn-fix release notes fix label Mar 21, 2023
@dwelch-r7
Copy link
Contributor

Release Notes

Fix external module crash for when running the auxiliary/scanner/wproxy/att_open_proxy module

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug external modules PRs dealing with modules run as their own process library rn-fix release notes fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants