Msf::Post::File: readable? / exists? / read_file methods crash sessions with EOFError on Solaris
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- operating-systems, ruby
- Domain
- backend, operating-systems
Research direction
Reproduce the failure with a Solaris 10u2 solaris/x86/shell_reverse_tcp session and modules/post/solaris/gather/enum_packages.rb. Trace the calls through lib/msf/core/post/file.rb, lib/msf/core/post/solaris/system.rb, and the command-shell session files named in the stack trace. Done means readable?, exists?, and read_file no longer terminate the Solaris session with EOFError and the module completes.
Written by the indexing model from the issue text.
Description
- Get a
solaris/x86/shell_reverse_tcpsession on Solaris (tested on Solaris 10u2) - Run a module which reads a file, or create a module which uses
readable?/exists?/read_file
msf6 post(solaris/gather/enum_packages) > run
[*] 192.168.200.166 - Command shell session 3 closed.
[-] Post failed: EOFError EOFError
[-] Call stack:
[-] /var/lib/gems/3.3.0/gems/rex-core-0.1.33/lib/rex/io/stream.rb:224:in `get_once'
[-] /root/Desktop/metasploit-framework/lib/msf/base/sessions/command_shell.rb:668:in `shell_read'
[-] /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:64:in `block (2 levels) in shell_read_until_token'
[-] <internal:kernel>:187:in `loop'
[-] /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:63:in `block in shell_read_until_token'
[-] /var/lib/gems/3.3.0/gems/timeout-0.4.3/lib/timeout.rb:185:in `block in timeout'
[-] /var/lib/gems/3.3.0/gems/timeout-0.4.3/lib/timeout.rb:38:in `handle_timeout'
[-] /var/lib/gems/3.3.0/gems/timeout-0.4.3/lib/timeout.rb:194:in `timeout'
[-] /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:60:in `shell_read_until_token'
[-] /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:158:in `shell_command_token_base'
[-] /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:130:in `shell_command_token_unix'
[-] /root/Desktop/metasploit-framework/lib/msf/base/sessions/unix_escaping.rb:4:in `shell_command_token'
[-] /root/Desktop/metasploit-framework/lib/msf/core/post/common.rb:197:in `cmd_exec'
[-] /root/Desktop/metasploit-framework/lib/msf/core/post/file.rb:313:in `exist?'
[-] /root/Desktop/metasploit-framework/lib/msf/core/post/file.rb:279:in `readable?'
[-] /root/Desktop/metasploit-framework/lib/msf/core/post/file.rb:488:in `read_file'
[-] /root/Desktop/metasploit-framework/lib/msf/core/post/solaris/system.rb:17:in `get_sysinfo'
[-] /root/Desktop/metasploit-framework/modules/post/solaris/gather/enum_packages.rb:32:in `run'
[*] Post module execution completed
- Dominant language
- Ruby
- Stars
- 39k
- Forks
- 15k
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 32
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rapid7/metasploit-framework
-
suggestion-docs
Difficulty 1/5 Under an hour Newbie friendliness 88/100
rapid7/metasploit-framework#21669 · 2 comments · 1 reaction ·
-
suggestion-docs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
rapid7/metasploit-framework#21503 · 2 comments ·
-
suggestion-docs
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
rapid7/metasploit-framework#20663 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
rapid7/metasploit-framework#21919 ·
-
suggestion-module
rapid7/metasploit-framework#21907 · 1 comment · 1 assignee ·
All issues in rapid7/metasploit-framework
Similar issues
-
バグ
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
voxpupuli/puppet-epel#186 · 1 comment ·
-
external_created_at is no longer used for the message timestamp since the new message UI (v4.4.0) OpenBug Frontend
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
TheOdinProject/curriculum#31402 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100