Avoid hardcoded relative paths #578

iamleot · 2019-04-06T10:31:54Z

Status

READY

Description

Describe what is changed by your Pull Request. If this PR is related to the open issue (bug/feature/new module) please attach issue number.

Verification

Provide steps to test or reproduce the PR.

Install routersploit, e.g. via pkgsrc wip/routersploit
Start ./rsf.py
use scanners/autopwn
set target 192.168.1.1
run

...then watch threads ~suddendly terminating without invoking any module:

[...]
[*] Running module...
-
[*] Starting vulnerablity check...
[*] thread-0 thread is starting...
[*] thread-1 thread is starting...
[...]
[*] thread-0 thread is terminated.
[*] thread-1 thread is terminated.
[...]
-
[*] Elapsed time: 0.0001952648162841797 seconds
-
[*] Starting default credentials check...
[*] thread-0 thread is starting...
[*] thread-1 thread is starting...
[...]
[*] thread-0 thread is terminated.
[*] thread-1 thread is terminated.
[...]
-
[*] Elapsed time: 0.00017380714416503906 seconds
[...]

At least ktruss-ing it reveals that several open("routersploit/...")
fails due ENOENT. If the $PWD is ${PYSITELIB} (e.g.
/usr/pkg/lib/python3.7/site-packages/, where routersploit/...
installed hierarcy is present) and then directly invoking routersploit
in the python interpreter via:

>>> from routersploit.interpreter import RoutersploitInterpreter
>>> rsf = RoutersploitInterpreter()
>>> rsf.start()

routersploit works!

Proposed commits should avoid uses of hardcoded relative paths and
fixes this problem.

Checklist

Write module/feature

iamleot · 2019-04-06T10:45:31Z

Copypasting relevant lines of the failed tests:

+make lint tests
python3 -m flake8 --exclude=.git,rsf.py --ignore=E501,F405,F403,W504 .
./routersploit/core/bluetooth/btle/btle_device.py:33:12: F632 use ==/!= to compare str, bytes, and int literals
./routersploit/core/exploit/shell.py:41:16: F632 use ==/!= to compare str, bytes, and int literals
./routersploit/core/exploit/utils.py:216:54: E252 missing whitespace around parameter equals
./routersploit/core/exploit/utils.py:216:55: E252 missing whitespace around parameter equals
./routersploit/modules/exploits/routers/ipfire/ipfire_oinkcode_rce.py:78:12: F632 use ==/!= to compare str, bytes, and int literals
make: *** [lint] Error 1
The command "./.travis/run.sh" exited with 2.

...I am blameful for ./routersploit/core/exploit/utils.py:216 whitespace policy ones! (I will fix them ASAP!)

- Introduce a RESOURCES_DIR similar to other *_DIR - Add a resources_directory parameter to lookup_vendor() to avoid possible hardcoded directory and - if not provided - pick up the default RESOURCES_DIR.

(Otherwise ssh_keys are tried to picked up in in ${PWD} (and mostly likely failing))

Commit id 9380c04 (probably accidentally) removed EXPLOITS_DIR use leading to loading routersploit/modules/exploits relative to the current directory instead of the installed ones in MODULES_DIR.

iamleot · 2019-04-07T18:30:12Z

...relevant part of failed tests:

+make lint tests
python3 -m flake8 --exclude=.git,rsf.py --ignore=E501,F405,F403,W504 .
./routersploit/core/bluetooth/btle/btle_device.py:33:12: F632 use ==/!= to compare str, bytes, and int literals
./routersploit/core/exploit/shell.py:41:16: F632 use ==/!= to compare str, bytes, and int literals
./routersploit/modules/exploits/routers/ipfire/ipfire_oinkcode_rce.py:78:12: F632 use ==/!= to compare str, bytes, and int literals

(None of them were touched by this pull request though.)

lucyoa · 2019-04-07T20:14:01Z

These errors have been fixed with #580, please just trigger build again

iamleot · 2019-04-07T20:17:33Z

Hello Marcin, Marcin Bury writes:

These errors have been fixed with #580

Thanks!

iamleot · 2019-04-08T12:38:26Z

I'm not happy about commit 4278012 and hopefully I'll refactor it ASAP (next few minutes!).

iamleot · 2019-04-08T12:47:13Z

I think that also routersploit/core/exploit/payloads.py needs to be adjusted similarly (and, at least according a grep it should be the last affected hard-coded use).

iamleot · 2019-04-08T12:58:34Z

Unfortunately I have not tested the routersploit/core/exploit/payloads.py (becouse I was not able to trigger it). I will keep an eye on the test results but a review for that is appreciated! Thanks!

iamleot · 2019-04-09T13:00:29Z

All hardcoded relative paths should be addressed now (and tests seems to pass!).

routersploit/core/exploit/payloads.py

routersploit/core/exploit/shell.py

@lucyoa

Spotted by @lucyoa, thanks!

@lucyoa

payloads should be listed/selected as `<architecture>/<payload>', not `payloads.<architecture>.<payload>'. Thanks to @lucyoa!

lucyoa · 2019-04-11T17:53:32Z

Awesome, thanks!

iamleot · 2019-04-11T17:56:45Z

Thank you!

iamleot added 3 commits April 6, 2019 12:46

Introduce a RESOURCE_DIR to avoid relative hardcoded paths

4217985

- Introduce a RESOURCES_DIR similar to other *_DIR - Add a resources_directory parameter to lookup_vendor() to avoid possible hardcoded directory and - if not provided - pick up the default RESOURCES_DIR.

Avoid possible hardcoded relative paths and use RESOURCE_DIR instead

a675b40

(Otherwise ssh_keys are tried to picked up in in ${PWD} (and mostly likely failing))

Avoid hardcoded relative paths and use MODULES_DIR instead

788ec9b

Commit id 9380c04 (probably accidentally) removed EXPLOITS_DIR use leading to loading routersploit/modules/exploits relative to the current directory instead of the installed ones in MODULES_DIR.

iamleot added 2 commits April 8, 2019 14:50

Avoid hardcoded relative paths and use utils.index_modules() instead

74ebaf8

Avoid hardcoded relative paths and use utils.index_modules() instead

17149ad

iamleot added 3 commits April 8, 2019 15:00

G/C no longer used import/functions

4f83762

G/C no longer used module import

68e0170

Reintroduce encode and fix a copypasto

b3cb985

lucyoa requested changes Apr 11, 2019

View reviewed changes

routersploit/core/exploit/payloads.py Outdated Show resolved Hide resolved

routersploit/core/exploit/shell.py Outdated Show resolved Hide resolved

iamleot added 2 commits April 11, 2019 18:56

Add missing `.'

b5f0ec6

Spotted by @lucyoa, thanks!

Fix a regression on the semantic/name of payloads

bc7086f

payloads should be listed/selected as `<architecture>/<payload>', not `payloads.<architecture>.<payload>'. Thanks to @lucyoa!

lucyoa approved these changes Apr 11, 2019

View reviewed changes

lucyoa merged commit c7ad64f into threat9:master Apr 11, 2019

lucyoa added the enhancement label Apr 15, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Avoid hardcoded relative paths #578

Avoid hardcoded relative paths #578

iamleot commented Apr 6, 2019

iamleot commented Apr 6, 2019

iamleot commented Apr 7, 2019

lucyoa commented Apr 7, 2019 •

edited

iamleot commented Apr 7, 2019 via email

iamleot commented Apr 8, 2019

iamleot commented Apr 8, 2019

iamleot commented Apr 8, 2019

iamleot commented Apr 9, 2019

lucyoa commented Apr 11, 2019

iamleot commented Apr 11, 2019

Avoid hardcoded relative paths #578

Avoid hardcoded relative paths #578

Conversation

iamleot commented Apr 6, 2019

Status

Description

Verification

Checklist

iamleot commented Apr 6, 2019

iamleot commented Apr 7, 2019

lucyoa commented Apr 7, 2019 • edited

iamleot commented Apr 7, 2019 via email

iamleot commented Apr 8, 2019

iamleot commented Apr 8, 2019

iamleot commented Apr 8, 2019

iamleot commented Apr 9, 2019

lucyoa commented Apr 11, 2019

iamleot commented Apr 11, 2019

lucyoa commented Apr 7, 2019 •

edited