-
Notifications
You must be signed in to change notification settings - Fork 14.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adds mixin to support resolving IPs across different session types #18500
Conversation
We'll need to make sure this works with ipv6 |
Will attic for now until we can pick this up again in the new year when we've got the other priorities out for this year 👍 |
Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it What does this generally mean? It could be one or more of several things:
We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this! |
result[:ips] | ||
else | ||
ips = [] | ||
data = cmd_exec("nslookup #{host}") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We'll want to handle the scenario of nslookup
not being present; we can likely fall back to checking other binaries for unix environents, i.e.
$ host google.com
google.com has address 172.253.122.139
... etc ...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could we add automated tests for this: https://github.com/rapid7/metasploit-framework/tree/157763b2afa7ac990bc5a4e9a1bd1cfc25cdd58c/test/modules/post/test
So we can see if this functionality works across the board for our sessions
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's add it to the recent test infra you wired up too, i.e. non-meterpreter shells: https://github.com/rapid7/metasploit-framework/pull/19413/files#diff-dfa8c541f020ceb4c845b17cffcac5b7e331498e527254f0b60b1bb4ba1c39b8
This PR builds on a previous PR, specifically this comment thread.
This new mixin allows for DNS resolution for modules with multiple session types. E.g.
modules/post/windows/gather/enum_computers.rb
supports multiple sessions:However the resolution across these session requires different logic. Meterpreter will now make use of the new Meterpreter API changes that will NEED to be landed before this PR can land.
metasploit-payloads PR - rapid7/metasploit-payloads#681
metasploit-framework PR - #18499
The mixin will check if we have a Meterpreter session with access to the
net
library and use the new Meterpreter API if so, otherwise fallback tonslookup
if not.Note
A rescue was added to the
enum_computers
module to allow for instances when the DNS isn't able to be resolved via the meterpreter API. This is due to inconsistent resolving methods in the runtime languages.With no errors
With every entry returning an error
Mixed results
Verification
List the steps needed to make sure this thing works
msfconsole
use post/windows/gather/enum_computers.rb
Example: