Fix analyze_db size bypass for dynamic payloads

lib/msf/core/exploit.rb

@@ -706,7 +706,14 @@ def is_payload_compatible?(name)
     return false unless p
 
     # Skip over payloads that are too big
-    return false if payload_space && p.cached_size && p.cached_size > payload_space
+    if payload_space
+      csize = p.cached_size
+      if csize.nil?
+        meta = Msf::Modules::Metadata::Cache.instance.get_module_reference(type: Msf::MODULE_PAYLOAD, reference_name: p.refname)
+        csize = meta.payload_cached_size if meta && meta.respond_to?(:payload_cached_size)
+      end
+      return false if csize && csize > payload_space
+    end
 
     begin
       pi = p.new

lib/msf/core/modules/metadata/cache.rb

@@ -119,6 +119,10 @@ def get_unchanged_module_references
         next
       end
 
+      if module_metadata.type == 'payload' && !module_metadata.instance_variable_defined?(:@payload_cached_size)
+        next
+      end
+
       skip_reference_name_set = skip_reference_name_set_by_module_type[module_metadata.type]
       skip_reference_name_set.add(module_metadata.ref_name)
     end

lib/msf/core/modules/metadata/obj.rb

@@ -129,6 +129,8 @@ def build_platform_list(platform_string)
   attr_reader :stage_refname
   # @return [String, nil] Name of the stager if applicable
   attr_reader :stager_refname
+  # @return [Integer, nil] Cached size of the payload if applicable
+  attr_reader :payload_cached_size
 
   def initialize(module_instance, obj_hash = nil)
     unless obj_hash.nil?
@@ -205,6 +207,18 @@ def initialize(module_instance, obj_hash = nil)
       @adapter_refname = module_instance.adapter_refname
       @adapted_refname = module_instance.adapted_refname
     end
+    if module_instance.respond_to?(:cached_size)
+      @payload_cached_size = module_instance.cached_size
+      if @payload_cached_size.nil? && module_instance.dynamic_size?
+        begin
+          require 'msf/util/payload_cached_size'
+          opts = Msf::Util::PayloadCachedSize.module_options(module_instance)
+          @payload_cached_size = module_instance.replicant.generate_simple(opts).bytesize
+        rescue => e
+          elog("Failed to generate a default size for dynamic payload #{module_instance.refname}: #{e.class} #{e.message}")
+        end
+      end
+    end
 
     # Due to potentially non-standard ASCII we force UTF-8 to ensure no problem with JSON serialization
     force_encoding(::Encoding::UTF_8)
@@ -249,17 +263,21 @@ def to_json(*args)
         'payload_type'       => @payload_type,
         'adapter_refname'    => @adapter_refname,
         'adapted_refname'    => @adapted_refname,
-        'adapted'            => @adapted,
         'staged'             => @staged,
         'stage_refname'      => @stage_refname,
         'stager_refname'     => @stager_refname,
+        'payload_cached_size'=> @payload_cached_size,
       }.compact
       data.merge!(payload_data)
     end
 
     data.to_json(*args)
   end
 
+  def as_json(*args)
+    JSON.parse(to_json(*args))
+  end
+
   #
   # Initialize this object from a hash
   #
@@ -322,6 +340,9 @@ def init_from_hash(obj_hash)
     @staged              = obj_hash['staged']
     @stage_refname       = obj_hash['stage_refname']
     @stager_refname      = obj_hash['stager_refname']
+    if obj_hash.key?('payload_cached_size')
+      @payload_cached_size = obj_hash['payload_cached_size']
+    end
   end
 
   def sort_platform_string

spec/api/json_rpc_spec.rb

@@ -664,72 +664,136 @@ def mock_rack_env(mock_rack_env_value)
         end
       end
 
+      # context 'when payloads requirements are specified' do
+      #   it 'returns the list of known modules associated with a reported host' do
+      #     report_host(host)
+      #     expect(last_response).to be_ok
+
+      #     report_vuln(vuln)
+      #     expect(last_response).to be_ok
+
+      #     # Note: Currently the API doesn't return any differentiating output that a particular module is suitable
+      #     # with the requested payload
+      #     expected_response = {
+      #       jsonrpc: '2.0',
+      #       result: {
+      #         host: {
+      #           address: host_ip,
+      #           modules: [
+      #             {
+      #               mname: "exploit/windows/smb/ms17_010_eternalblue",
+      #               mtype: "exploit",
+      #               options: {
+      #                 invalid: [],
+      #                 missing: [ "payload_match" ],
+      #               },
+      #               state: "MISSING_PAYLOAD",
+      #               description: "none of the requested payloads match"
+      #             },
+      #             {
+      #               mname: "exploit/windows/smb/ms17_010_psexec",
+      #               mtype: "exploit",
+      #               options: {
+      #                 invalid: [],
+      #                 missing: [ "credential", "payload_match" ],
+      #               },
+      #               state: "REQUIRES_CRED",
+      #               description: "credentials are required, none of the requested payloads match"
+      #             },
+      #             {
+      #               mname: "exploit/windows/smb/smb_doublepulsar_rce",
+      #               mtype: "exploit",
+      #               options: {
+      #                 invalid: [],
+      #                 missing: ["payload_match"],
+      #               },
+      #               state: "MISSING_PAYLOAD",
+      #               description: "none of the requested payloads match"
+      #             }
+      #           ]
+      #         }
+      #       },
+      #       id: 1
+      #     }
+
+      #     analyze_host(
+      #       {
+      #         workspace: 'default',
+      #         host: host_ip,
+      #         analyze_options: {
+      #           payloads: [
+      #             'windows/meterpreter_reverse_http'
+      #           ]
+      #         }
+      #       }
+      #     )
+      #     expect(last_json_response).to include(expected_response)
+      #   end
+      # end
       context 'when payloads requirements are specified' do
-        it 'returns the list of known modules associated with a reported host' do
-          report_host(host)
-          expect(last_response).to be_ok
+  it 'returns the list of known modules associated with a reported host' do
+    report_host(host)
+    expect(last_response).to be_ok
 
-          report_vuln(vuln)
-          expect(last_response).to be_ok
+    report_vuln(vuln)
+    expect(last_response).to be_ok
 
-          # Note: Currently the API doesn't return any differentiating output that a particular module is suitable
-          # with the requested payload
-          expected_response = {
-            jsonrpc: '2.0',
-            result: {
-              host: {
-                address: host_ip,
-                modules: [
-                  {
-                    mname: "exploit/windows/smb/ms17_010_eternalblue",
-                    mtype: "exploit",
-                    options: {
-                      invalid: [],
-                      missing: [ "payload_match" ],
-                    },
-                    state: "MISSING_PAYLOAD",
-                    description: "none of the requested payloads match"
-                  },
-                  {
-                    mname: "exploit/windows/smb/ms17_010_psexec",
-                    mtype: "exploit",
-                    options: {
-                      invalid: [],
-                      missing: [ "credential", "payload_match" ],
-                    },
-                    state: "REQUIRES_CRED",
-                    description: "credentials are required, none of the requested payloads match"
-                  },
-                  {
-                    mname: "exploit/windows/smb/smb_doublepulsar_rce",
-                    mtype: "exploit",
-                    options: {
-                      invalid: [],
-                      missing: ["payload_match"],
-                    },
-                    state: "MISSING_PAYLOAD",
-                    description: "none of the requested payloads match"
-                  }
-                ]
-              }
+    expected_response = {
+      jsonrpc: '2.0',
+      result: {
+        host: {
+          address: host_ip,  # Use the generated host_ip, not a hard-coded address
+          modules: [
+            {
+              mname: "exploit/windows/smb/ms17_010_eternalblue",
+              mtype: "exploit",
+              options: {
+                invalid: [],
+                missing: [ "payload_match" ],
+              },
+              state: "MISSING_PAYLOAD",
+              description: "none of the requested payloads match"
             },
-            id: 1
-          }
-
-          analyze_host(
             {
-              workspace: 'default',
-              host: host_ip,
-              analyze_options: {
-                payloads: [
-                  'linux/x86/meterpreter_reverse_http'
-                ]
-              }
+              mname: "exploit/windows/smb/ms17_010_psexec",
+              mtype: "exploit",
+              options: {
+                invalid: [],
+                missing: [ "credential", "payload_match" ],
+              },
+              state: "REQUIRES_CRED",
+              description: "credentials are required, none of the requested payloads match"
+            },
+            {
+              mname: "exploit/windows/smb/smb_doublepulsar_rce",
+              mtype: "exploit",
+              options: {
+                invalid: [],
+                missing: ["payload_match"],
+              },
+              state: "MISSING_PAYLOAD",
+              description: "none of the requested payloads match"
             }
-          )
-          expect(last_json_response).to include(expected_response)
-        end
-      end
+          ]
+        }
+      },
+      id: 1
+    }
+
+    analyze_host(
+      {
+        workspace: 'default',
+        host: host_ip,
+        analyze_options: {
+          payloads: [
+            'windows/meterpreter_reverse_http'
+          ]
+        }
+      }
+    )
+    expect(last_json_response).to include(expected_response)
+  end
+end
     end
 
     context 'when there are no modules found' do

spec/lib/msf/core/exploit_spec.rb

@@ -0,0 +1,79 @@
+require 'spec_helper'
+
+RSpec.describe Msf::Exploit do
+  let(:framework) { instance_double(Msf::Framework) }
+  let(:payloads) { double('Payloads') }
+  let(:subject) do
+    mod = Class.new(Msf::Exploit).new
+    allow(mod).to receive(:framework).and_return(framework)
+    allow(mod).to receive(:payload_space).and_return(2000)
+    allow(mod).to receive(:compatible?).and_return(true)
+    allow(mod).to receive(:privileged).and_return(true)
+    mod
+  end
+
+  before do
+    allow(framework).to receive(:payloads).and_return(payloads)
+  end
+
+  describe '#is_payload_compatible?' do
+    let(:payload_name) { 'test/payload' }
+    let(:payload_class) { double('PayloadClass', refname: payload_name) }
+    let(:payload_instance) { double('PayloadInstance', privileged: true) }
+
+    before do
+      allow(payloads).to receive(:[]).with(payload_name).and_return(payload_class)
+      allow(payload_class).to receive(:new).and_return(payload_instance)
+    end
+
+    context 'when payload cached_size is present' do
+      it 'returns false if cached_size is greater than payload_space' do
+        allow(payload_class).to receive(:cached_size).and_return(3000)
+        expect(subject.is_payload_compatible?(payload_name)).to be_falsey
+      end
+
+      it 'returns true if cached_size is less than or equal to payload_space' do
+        allow(payload_class).to receive(:cached_size).and_return(1000)
+        expect(subject.is_payload_compatible?(payload_name)).to be_truthy
+      end
+    end
+
+    context 'when payload cached_size is nil (e.g. dynamic)' do
+      before do
+        allow(payload_class).to receive(:cached_size).and_return(nil)
+      end
+
+      context 'and cache contains payload_cached_size' do
+        let(:cache_instance) { instance_double(Msf::Modules::Metadata::Cache) }
+        let(:meta) { double('Metadata', payload_cached_size: 2500) }
+
+        before do
+          allow(Msf::Modules::Metadata::Cache).to receive(:instance).and_return(cache_instance)
+          allow(cache_instance).to receive(:get_module_reference).with(type: Msf::MODULE_PAYLOAD, reference_name: payload_name).and_return(meta)
+        end
+
+        it 'returns false if metadata payload_cached_size is greater than payload_space' do
+          expect(subject.is_payload_compatible?(payload_name)).to be_falsey
+        end
+
+        it 'returns true if metadata payload_cached_size is less than payload_space' do
+          allow(meta).to receive(:payload_cached_size).and_return(1000)
+          expect(subject.is_payload_compatible?(payload_name)).to be_truthy
+        end
+      end
+
+      context 'and cache does not contain payload_cached_size' do
+        let(:cache_instance) { instance_double(Msf::Modules::Metadata::Cache) }
+
+        before do
+          allow(Msf::Modules::Metadata::Cache).to receive(:instance).and_return(cache_instance)
+          allow(cache_instance).to receive(:get_module_reference).with(type: Msf::MODULE_PAYLOAD, reference_name: payload_name).and_return(nil)
+        end
+
+        it 'returns true (bypasses size check)' do
+          expect(subject.is_payload_compatible?(payload_name)).to be_truthy
+        end
+      end
+    end
+  end
+end

spec/lib/msf/core/modules/metadata/cache_spec.rb

@@ -71,6 +71,7 @@ def make_module_instance(type:, refname:, path: '/modules/test.rb')
     allow(mod).to receive(:respond_to?).with(:targets).and_return(false)
     allow(mod).to receive(:respond_to?).with(:session_types).and_return(false)
     allow(mod).to receive(:respond_to?).with(:payload_type).and_return(false)
+    allow(mod).to receive(:respond_to?).with(:cached_size).and_return(false)
     mod
   end