Msf::Post::File: readable? / exists? / read_file methods crash sessions with EOFError on Solaris

Open
#20,103 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
operating-systems, ruby

Research direction

Reproduce the failure with a Solaris 10u2 solaris/x86/shell_reverse_tcp session and modules/post/solaris/gather/enum_packages.rb. Trace the calls through lib/msf/core/post/file.rb, lib/msf/core/post/solaris/system.rb, and the command-shell session files named in the stack trace. Done means readable?, exists?, and read_file no longer terminate the Solaris session with EOFError and the module completes.

Written by the indexing model from the issue text.

Description

bug confirmed
  1. Get a solaris/x86/shell_reverse_tcp session on Solaris (tested on Solaris 10u2)
  2. Run a module which reads a file, or create a module which uses readable? / exists? / read_file
msf6 post(solaris/gather/enum_packages) > run
[*] 192.168.200.166 - Command shell session 3 closed.
[-] Post failed: EOFError EOFError
[-] Call stack:
[-]   /var/lib/gems/3.3.0/gems/rex-core-0.1.33/lib/rex/io/stream.rb:224:in `get_once'
[-]   /root/Desktop/metasploit-framework/lib/msf/base/sessions/command_shell.rb:668:in `shell_read'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:64:in `block (2 levels) in shell_read_until_token'
[-]   <internal:kernel>:187:in `loop'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:63:in `block in shell_read_until_token'
[-]   /var/lib/gems/3.3.0/gems/timeout-0.4.3/lib/timeout.rb:185:in `block in timeout'
[-]   /var/lib/gems/3.3.0/gems/timeout-0.4.3/lib/timeout.rb:38:in `handle_timeout'
[-]   /var/lib/gems/3.3.0/gems/timeout-0.4.3/lib/timeout.rb:194:in `timeout'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:60:in `shell_read_until_token'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:158:in `shell_command_token_base'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb:130:in `shell_command_token_unix'
[-]   /root/Desktop/metasploit-framework/lib/msf/base/sessions/unix_escaping.rb:4:in `shell_command_token'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/post/common.rb:197:in `cmd_exec'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/post/file.rb:313:in `exist?'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/post/file.rb:279:in `readable?'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/post/file.rb:488:in `read_file'
[-]   /root/Desktop/metasploit-framework/lib/msf/core/post/solaris/system.rb:17:in `get_sysinfo'
[-]   /root/Desktop/metasploit-framework/modules/post/solaris/gather/enum_packages.rb:32:in `run'
[*] Post module execution completed
Dominant language
Ruby
Stars
39k
Forks
15k
Avg merge
5d 6h
Merged PRs (30d)
32

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rapid7/metasploit-framework

All issues in rapid7/metasploit-framework

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.