Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes WMAP plugin loading failures #19006

Merged
merged 1 commit into from Mar 26, 2024

Conversation

cgranleese-r7
Copy link
Contributor

@cgranleese-r7 cgranleese-r7 commented Mar 25, 2024

Note

Fixes #18984

This PR fixes an issue where WMAP plugin module loading was causing failures. Some of this functionality was lost in this PR. The functionality that was lost was the ability to filter out any modules that weren't created.

The removal of these lines meant we were no longer filtering out any modules that weren't created:

-    # If there is no module associated with this class, then try to demand load it.
-    if klass.nil? or klass == Msf::SymbolicModule
-      framework.modules.load_cached_module(module_type, reference_name, cache_type: cache_type)
-      klass = fetch(reference_name, nil)
-    end

So we have no reintroduced that code without the symbolic modules logic.

Expected output:

msf6 exploit(unix/webapp/wp_admin_shell_upload) > wmap_run -t
[*] Testing target:
[*] 	Site: 192.168.175.135 (192.168.175.135)
[*] 	Port: 80 SSL: false
============================================================
[*] Testing started. 2024-03-25 09:47:19 +0000
[*] Loading wmap modules...
/Users/cgranleese/code/metasploit-framework/modules/auxiliary/scanner/http/rdp_web_login.py:104: warning: One-line pattern matching is experimental, and the behavior may change in future versions of Ruby!
/Users/cgranleese/code/metasploit-framework/modules/auxiliary/scanner/http/rdp_web_login.py:124: warning: One-line pattern matching is experimental, and the behavior may change in future versions of Ruby!
/Users/cgranleese/code/metasploit-framework/modules/auxiliary/scanner/http/rdp_web_login.py:125: warning: One-line pattern matching is experimental, and the behavior may change in future versions of Ruby!
/Users/cgranleese/code/metasploit-framework/modules/auxiliary/scanner/http/rdp_web_login.py:198: warning: One-line pattern matching is experimental, and the behavior may change in future versions of Ruby!
/Users/cgranleese/code/metasploit-framework/modules/auxiliary/scanner/http/rdp_web_login.py:214: warning: One-line pattern matching is experimental, and the behavior may change in future versions of Ruby!
[*] 39 wmap enabled modules loaded.
[*]
=[ SSL testing ]=
============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
============================================================
[*] Module auxiliary/scanner/http/http_version
[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/scanner/http/drupal_views_user_enum
[*] Module auxiliary/scanner/http/frontpage_login
[*] Module auxiliary/scanner/http/host_header_injection
[*] Module auxiliary/scanner/http/options
[*] Module auxiliary/scanner/http/robots_txt
[*] Module auxiliary/scanner/http/scraper
[*] Module auxiliary/scanner/http/svn_scanner
[*] Module auxiliary/scanner/http/trace
[*] Module auxiliary/scanner/http/vhost_scanner
[*] Module auxiliary/scanner/http/webdav_internal_ip
[*] Module auxiliary/scanner/http/webdav_scanner
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/scanner/http/webdav_website_content
[*] Module auxiliary/admin/http/tomcat_utf8_traversal
[*]
=[ File/Dir testing ]=
============================================================
[*] Module auxiliary/scanner/http/verb_auth_bypass
[*] Module auxiliary/scanner/http/brute_dirs
[*] Module auxiliary/scanner/http/copy_of_file
[*] Module auxiliary/scanner/http/dir_listing
[*] Module auxiliary/scanner/http/dir_scanner
[*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/file_same_name_dir
[*] Module auxiliary/scanner/http/files_dir
[*] Module auxiliary/scanner/http/http_put
[*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/prev_dir_same_name_file
[*] Module auxiliary/scanner/http/replace_ext
[*] Module auxiliary/scanner/http/soap_xml
[*] Module auxiliary/scanner/http/trace_axd
[*] Module auxiliary/scanner/http/backup_file
[*]
=[ Unique Query testing ]=
============================================================
[*] Module auxiliary/admin/vmware/vcenter_forge_saml_token
[*] Module auxiliary/scanner/http/blind_sql_query
[*] Module auxiliary/scanner/http/error_sql_injection
[*] Module auxiliary/scanner/http/http_traversal
[*] Module auxiliary/scanner/http/rails_mass_assignment
[*] Module exploit/multi/http/lcms_php_exec
[*]
=[ Query testing ]=
============================================================
[*]
=[ General testing ]=
============================================================
[*] Done.

Verification

  • Start msfconsole
  • Run load wmap
  • Run wmap_modules -r
  • Verify the errors mentioned in the linked issue no longer appear

@cgranleese-r7 cgranleese-r7 added the rn-fix release notes fix label Mar 25, 2024
@adfoster-r7 adfoster-r7 merged commit 5a77f76 into rapid7:master Mar 26, 2024
49 checks passed
@cgranleese-r7 cgranleese-r7 deleted the fix-wmap-loading-failures branch March 26, 2024 11:30
@cgranleese-r7
Copy link
Contributor Author

Release Notes

This PR fixes an issue where WMAP plugin module loading was causing failures.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rn-fix release notes fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

wmap module loading fails.
3 participants