Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds support for resolving multiple host ips #18499

Conversation

cgranleese-r7
Copy link
Contributor

This PR is in conjunction with a PR in metasploit-payloads.

This PR updates the resolve_host and resolve_hosts to now support resolving multiple host IPs.

The changes support backwards compatibility for old Meterpreter sessions by checking for TLV types off TLV_TYPE_IP that follows the existing logic, as well as the new TLV_TYPE_RESOLVE_HOST_ENTRY TLV.

Verification

Needs to be tested in tandem with the metasploit-payloads PR.

resolve_host

  • Start msfconsole
  • use php/meterpreter/reverse_tcp
  • Get a Meterpreter session
  • Run the following command irb -e "framework.sessions.values.last.net.resolve.resolve_host 'rapid7.com'"
  • Add a breakpoint and verify you get multiple IPs being resolved
  • Verify you see the following outputs
{:hostname=>"rapid7.com", :ip=>"108.156.39.19", :ips=>["108.156.39.19", "108.156.39.105", "108.156.39.48", "108.156.39.8"]}

resolve_hosts

  • Start msfconsole
  • use php/meterpreter/reverse_tcp
  • Get a Meterpreter session
  • Run the following command irb -e "framework.sessions.values.last.net.resolve.resolve_hosts ['rapid7.com', 'google.com']"
  • Add a breakpoint and verify you get multiple IPs being resolved
  • Verify you see the following output:
[{:hostname=>"rapid7.com", :ip=>"108.156.39.19", :ips=>["108.156.39.19", "108.156.39.105", "108.156.39.48", "108.156.39.8"]}, {:hostname=>"google.com", :ip=>"216.58.201.110", :ips=>["216.58.201.110"]}]

@cgranleese-r7 cgranleese-r7 added enhancement rn-enhancement release notes enhancement labels Nov 1, 2023
@cgranleese-r7 cgranleese-r7 added blocked Blocked by one or more additional tasks and removed blocked Blocked by one or more additional tasks labels Nov 2, 2023
@adfoster-r7
Copy link
Contributor

It'd be good to update the test notes to verify that an ipv6 target works as expected

@adfoster-r7
Copy link
Contributor

Will attic for now until we can pick this up again in the new year when we've got the other priorities out for this year 👍

Copy link

Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it attic and closed it for now.

What does this generally mean? It could be one or more of several things:

  • It doesn't look like there has been any activity on this pull request in a while
  • We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now.
  • Sometimes the implementation isn't quite right and a different approach is necessary.

We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!

@github-actions github-actions bot closed this Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
attic Older submissions that we still want to work on again enhancement rn-enhancement release notes enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants