metasploit-framework icon indicating copy to clipboard operation
metasploit-framework copied to clipboard

Update the Post::Linux::Compile mixin with some enhancements

Open red0xff opened this issue 3 years ago • 2 comments

This adds some enhancements to the Msf::Post::Linux::Compile mixin.

  • Adds optionally-exposed options, CC (the compiler to use, can be gcc, clang, g++, go etc.), and MAKE (the build system to use, can be make, gmake, cmake etc.). live_compile? checks if either of the two is defined.
  • Adds upload_and_make, for uploading a source code tree, and building on the target.
  • Updated upload_and_compile, it doesn't assume that the source code is a C program (it can now work for compiling code in a more generalized manner).

I am opening the discussion here, I am not sure if it's a good idea to leave it to the module writer to pass the command line arguments to make / CC, and to the user to select which compiler to use, or to check for. upload_and_make is a good addition in my opinion, I am also not sure if the way I pass data to a block is desirable, it allows performing things like strip_comments (which is something I think modules should implement). if a block is given, it receives the path to each file, and its content, and should return the content to upload.

I did not update all the modules that use upload_and_compile.

red0xff avatar Aug 01 '22 21:08 red0xff

Are you thinking about using some of these changes in https://github.com/rapid7/metasploit-framework/pull/16794? Mainly asking if I should hold off on landing the exploit if you are.

bwatters-r7 avatar Aug 02 '22 17:08 bwatters-r7

Are you thinking about using some of these changes in #16794? Mainly asking if I should hold off on landing the exploit if you are.

You can go ahead and land that module, I'll update it afterwards if this goes forward.

I'm not sure if the changes this PR comes with are all desirable, it's no longer specific to C exploits, and I added more (optional) arguments to try and handle as many usecases as possible.

red0xff avatar Aug 02 '22 17:08 red0xff

I'm going to attic this because it's been a draft for over a month. If we'd like to pick it back up just let me know and I'd be happy to reopen it. Thanks!

smcintyre-r7 avatar Sep 12 '22 16:09 smcintyre-r7

Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it attic and closed it for now.

What does this generally mean? It could be one or more of several things:

  • It doesn't look like there has been any activity on this pull request in a while
  • We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now.
  • Sometimes the implementation isn't quite right and a different approach is necessary.

We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!

github-actions[bot] avatar Sep 12 '22 16:09 github-actions[bot]