Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds mixin to support resolving IPs across different session types #18500

Closed
wants to merge 2 commits into from

Conversation

cgranleese-r7
Copy link
Contributor

@cgranleese-r7 cgranleese-r7 commented Nov 1, 2023

This PR builds on a previous PR, specifically this comment thread.

This new mixin allows for DNS resolution for modules with multiple session types. E.g. modules/post/windows/gather/enum_computers.rb supports multiple sessions:

'SessionTypes' => %w[meterpreter powershell shell]

However the resolution across these session requires different logic. Meterpreter will now make use of the new Meterpreter API changes that will NEED to be landed before this PR can land.

metasploit-payloads PR - rapid7/metasploit-payloads#681
metasploit-framework PR - #18499

The mixin will check if we have a Meterpreter session with access to the net library and use the new Meterpreter API if so, otherwise fallback to nslookup if not.

Note

A rescue was added to the enum_computers module to allow for instances when the DNS isn't able to be resolved via the meterpreter API. This is due to inconsistent resolving methods in the runtime languages.

With no errors

image

With every entry returning an error

image

Mixed results

image

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • use post/windows/gather/enum_computers.rb
  • Target a machine with multiple computers available
  • Get a Meterpreter session
  • Verify the module now list all expected computers as part of that domain
    Example:
List of identified Hosts.
=========================

 Domain  Hostname  IPs
 ------  --------  ---
 VB      DC1       192.168.175.201, 192.168.175.200, 192.168.175.135

@cgranleese-r7 cgranleese-r7 added enhancement rn-enhancement release notes enhancement blocked Blocked by one or more additional tasks labels Nov 1, 2023
@adfoster-r7
Copy link
Contributor

We'll need to make sure this works with ipv6

@adfoster-r7 adfoster-r7 added the attic Older submissions that we still want to work on again label Nov 15, 2024
@adfoster-r7
Copy link
Contributor

Will attic for now until we can pick this up again in the new year when we've got the other priorities out for this year 👍

Copy link

Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it attic and closed it for now.

What does this generally mean? It could be one or more of several things:

  • It doesn't look like there has been any activity on this pull request in a while
  • We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now.
  • Sometimes the implementation isn't quite right and a different approach is necessary.

We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!

@github-actions github-actions bot closed this Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
attic Older submissions that we still want to work on again blocked Blocked by one or more additional tasks enhancement rn-enhancement release notes enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants