Port and fix MongoDB scanner modules (version/login/schemadump/hashdump) - #21788
Port and fix MongoDB scanner modules (version/login/schemadump/hashdump)#21788prithvee07 wants to merge 11 commits into
Conversation
The module's check method already returns proper CheckCode values but wasn't wired into the framework's check-before-exploit flow. Prepending Msf::Exploit::Remote::AutoCheck lets users verify vulnerability status automatically before exploitation, with ForceExploit available to override. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkE73M69GgryoXCXW9sTg7
The module's check method already returns proper CheckCode values but wasn't wired into the framework's check-before-exploit flow. Prepending Msf::Exploit::Remote::AutoCheck lets users verify vault presence automatically before persistence is installed, with ForceExploit available to override. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkE73M69GgryoXCXW9sTg7
packetfu 2.0.0's StructFu#typecast infers the attribute being assigned by regex-parsing the method name out of caller[0]'s raw backtrace entry, requiring a literal backtick before the method name. Ruby 3.4 changed backtrace quoting from a backtick to a single quote (https://bugs.ruby-lang.org/issues/19392), so the match returns nil and the subsequent [1] raises NoMethodError: undefined method '[]' for nil. This breaks every PacketFu header assignment on Ruby 3.4+, including arp_sweep's ARPPacket construction. packetfu is unmaintained (last released June 2023), so patch StructFu#typecast in a small compat file required right after packetfu loads, accepting either quote character so it works on Ruby < 3.4 and >= 3.4 alike. See rapid7#21721 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkE73M69GgryoXCXW9sTg7
Fix NoMethodError in PacketFu StructFu#typecast on Ruby 3.4+
…hk6s4 Add AutoCheck to modules with existing check methods
Ports and fixes the MongoDB auxiliary modules from rapid7#21785 (h00die): mongodb_version (new), mongodb_login (updated for SCRAM-SHA-1 / MongoDB 3.0+), and the new mongodb_schemadump and mongodb_hashdump modules. Fixes applied relative to the original PR: - 'Reliability' => [UNKNOWN_RELIABILITY] double-nested the constant (UNKNOWN_RELIABILITY is itself ['unknown-reliability']), which crashed the `info` command with "no implicit conversion of Array into String" in dump_traits. Changed to 'Reliability' => UNKNOWN_RELIABILITY in all four modules. - mongodb_version.rb defined a `parse_doc` helper that was never called; get_version duplicated the same BSON-parsing logic inline. - ~250 lines of identical build_cmd_packet/parse_doc/parse_docs/ parse_scram_payload/have_auth_error? code were copy-pasted across mongodb_login.rb and mongodb_hashdump.rb (with subsets duplicated in mongodb_version.rb and mongodb_schemadump.rb too). Extracted the wire-protocol primitives into a new Msf::Exploit::Remote::Mongodb mixin (lib/msf/core/exploit/remote/mongodb.rb); each module keeps its own auth-flow/reporting logic on top of it, since those differ enough (SCRAM step counts, whether creds get reported, return value semantics) that unifying them risked changing tested behavior. - Typo: "Sccuessfully tested" -> "Successfully tested" in mongodb_schemadump.rb's description. - mongodb_hashdump.rb stores credentials with jtr_format 'mongodb-scram-sha1'/'mongodb-scram-sha256', but neither format is registered in cracker.rb's jtr_format_to_hashcat_format table or crack_databases.rb's format list, so Metasploit's own analyze modules won't select them for cracking despite the hashes being correctly formatted for external hashcat use. Documented this limitation directly in the module description rather than attempting an unverified extension of the cracking pipeline. - Missing trailing newline in 3 of 4 documentation markdown files, which fails tools/dev/msftidy_docs.rb. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkE73M69GgryoXCXW9sTg7
Port and fix MongoDB scanner modules (version/login/schemadump/hashdump)
The bare rescue in Packet#parse caught Timeout::Error along with every other StandardError, silently converting it into a generic ParseCode::Error. Rex::Proto::Http::Client#read_response relies on Timeout::Error propagating out of resp.parse so its own rescue Timeout::Error clause can return a partial response when config['partial'] is set; that path was unreachable whenever the timeout fired during parsing rather than between reads. Now Timeout::Error is re-raised explicitly before the catch-all rescue, restoring the intended timeout-vs-malformed-response distinction.
…w51ezu Fix Rex::Proto::Http::Packet#parse swallowing Timeout::Error
Cache#initialize spawns a background thread that populates @module_metadata_cache via load_cache_from_file_store without holding @Mutex. get_metadata, get_module_reference, and module_metadata all correctly call wait_for_load before touching the cache, but refresh_metadata_instance and refresh_metadata did not. When refresh_cache_from_module_files (called from vuln_attempt_registration_spec's before(:each), among other places) ran before the background load thread finished, the synchronous refresh_metadata call would iterate @module_metadata_cache while the unsynchronized background thread was still adding keys to the same Hash, raising "RuntimeError: can't add a new key into hash during iteration" at @module_metadata_cache[cache_key] = metadata_obj. Add the missing wait_for_load call to both methods, matching the existing pattern in the three read-only accessors.
…e-race Fix race condition in Msf::Modules::Metadata::Cache background load
|
Instead of submitting this from your master branch (which wouldn't be accepted), to rapid7's master, you'll want to submit a PR to h00die's fork to merge into the mongodb_schemadump branch from a unique branch of your own. This makes it so the code will be diffed correctly, and can be merged (if accepted) to the upstream PR for rapid7. You'll also want to not delete the big AI disclosure section of the PR since claude helped. It also looks like there may be some additional code that snuck in thats unrelated like the obsidian plugin and solman item. I have at least confirmed the |
|
@prithvee07 @h00die it looks like this was submitted as a PR to @h00die's branch here: prithvee07#3 and was merged. |
|
This can be closed, but I'm yet to receive a pr for my branch |
I thought prithvee07#3 was the pull request in question? Is this a different pull request? |
|
That's a PR to their own repo, not mine |
Oh; I see... that's a PR from Claude to them. Right. @prithvee07 can you swap this to a topic branch (see https://docs.metasploit.com/docs/development/get-started/creating-your-first-pr.html#creating-a-new-branch-for-your-code and https://github.com/rapid7/metasploit-framework/blob/master/CONTRIBUTING.md#code-contribution-dos--donts) |
|
@prithvee07 I want to make sure you get credit for the fixes (via commits), but @bwatters-r7 has already assigned my PR to himself to review. Please try to get this PR fixed per provided instructions and pointed to my repo to ingest so it gets brought into metasploit correctly. If I don't hear from you soon I'll add you as a contrib on the modules so you'll at least get your name in framework. If you need help, feel free to hit me up on discord or anyone in the |
|
@bwatters-r7 Can you push to metasploit |
@prithvee07 not in the current state. The best way to do this is for you to create a new branch based on h00die's branch, make the changes, and then PR those changes back to h00die's branch. When we land h00die's PR, your changes will go into Metasploit. h00die and I can work with you on how to PR to his branch, but the first thing is to make sure your environment matches https://docs.metasploit.com/docs/development/get-started/setting-up-a-metasploit-development-environment.html Let us know how we can help. I'm happy to send over detailed commands, but they will only work if your environment is set up like the documentation above. |
|
I'm closing this because @h00die moved over the code here and gave credit. |
4 participants
Thank you for contributing to Metasploit Framework!
Description
Ports and fixes the MongoDB auxiliary modules originally proposed in #21785 (h00die): mongodb_version (new), mongodb_login (updated for SCRAM-SHA-1 / MongoDB 3.0+, falling back to legacy MONGODB-CR), and the new mongodb_schemadump and mongodb_hashdump modules.
I don't have push access to that upstream PR's branch, so rather than leave the review findings unactioned, this recreates the same functionality in this fork with the issues found during review fixed:
infocommand withno implicit conversion of Array into Stringin dump_traits. Reproduced live in msfconsole before fixing to 'Reliability' => UNKNOWN_RELIABILITY.Breaking Changes
None.