metasploit-framework icon indicating copy to clipboard operation
metasploit-framework copied to clipboard

Msf::Post::File.file_remote_digest[md5|sha1]: Cleanup and perform hashing remotely

Open bcoles opened this issue 2 years ago • 0 comments

This PR modifies the remote file hashing methods to perform hashing remotely.

It also offers an option for users to specify a hashing utility with the :util option. No utility is selected by default to maintain the existing behaviour (stupidly downloading the file then hashing it locally).

Tested on Windows 7 SP1 (x64) with PowerShell, shell and Meterpreter sessions.

Tested with:

puts 'md5:' + file_remote_digestmd5("C:\\doesnotexist").inspect
puts 'md5:' + file_remote_digestmd5("C:\\windows\\win.ini").to_s
puts 'md5:' + file_remote_digestmd5("C:\\windows\\win.ini", util: 'certutil').to_s

puts 'sha1:' + file_remote_digestsha1("C:\\doesnotexist").inspect
puts 'sha1:' + file_remote_digestsha1("C:\\windows\\win.ini").to_s
puts 'sha1:' + file_remote_digestsha1("C:\\windows\\win.ini", util: 'certutil').to_s

Also lazily tested [sha1|md5]sum utilities with a shell session on Linux.

    puts 'md5:' + file_remote_digestmd5("/etc/passwd", util: 'md5sum').to_s
    puts 'md5:' + file_remote_digestmd5("/tmp/doesnotexist").inspect
    puts 'sha1:' + file_remote_digestsha1("/tmp/doesnotexist").inspect
    puts 'sha1:' + file_remote_digestsha1("/etc/passwd", util: 'sha1sum').to_s

This also indirectly fixes a bug. The read_file method can return operating system error message rather than the file contents; ie:

"The system cannot find the file specified.\r\n"

By adding support for PowerShell and Meterpreter sessions, the read_file branch is not called for sessions of these types.

This is an issue with the read_file method and is outside the scope of this PR. Ideally, read_file should return nil (or an empty string) if the file read fails.

I did fix this a while ago (fixed in #11342; previous discussion in #9854) for shell sessions (by first checking if the file is readable?), but only for non-Windows systems.

bcoles avatar Aug 06 '22 09:08 bcoles