metasploit-framework
metasploit-framework copied to clipboard
Update the Post::Linux::Compile mixin with some enhancements
This adds some enhancements to the Msf::Post::Linux::Compile mixin.
- Adds optionally-exposed options,
CC(the compiler to use, can be gcc, clang, g++, go etc.), andMAKE(the build system to use, can be make, gmake, cmake etc.).live_compile?checks if either of the two is defined. - Adds
upload_and_make, for uploading a source code tree, and building on the target. - Updated
upload_and_compile, it doesn't assume that the source code is a C program (it can now work for compiling code in a more generalized manner).
I am opening the discussion here, I am not sure if it's a good idea to leave it to the module writer to pass the command line arguments to make / CC, and to the user to select which compiler to use, or to check for. upload_and_make is a good addition in my opinion, I am also not sure if the way I pass data to a block is desirable, it allows performing things like strip_comments (which is something I think modules should implement). if a block is given, it receives the path to each file, and its content, and should return the content to upload.
I did not update all the modules that use upload_and_compile.
Are you thinking about using some of these changes in https://github.com/rapid7/metasploit-framework/pull/16794? Mainly asking if I should hold off on landing the exploit if you are.
Are you thinking about using some of these changes in #16794? Mainly asking if I should hold off on landing the exploit if you are.
You can go ahead and land that module, I'll update it afterwards if this goes forward.
I'm not sure if the changes this PR comes with are all desirable, it's no longer specific to C exploits, and I added more (optional) arguments to try and handle as many usecases as possible.
I'm going to attic this because it's been a draft for over a month. If we'd like to pick it back up just let me know and I'd be happy to reopen it. Thanks!
Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it attic and closed it for now.
What does this generally mean? It could be one or more of several things:
- It doesn't look like there has been any activity on this pull request in a while
- We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now.
- Sometimes the implementation isn't quite right and a different approach is necessary.
We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!