Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the fuzzy-use plugin #19471

Merged
merged 11 commits into from
Oct 1, 2024
Merged

Add the fuzzy-use plugin #19471

merged 11 commits into from
Oct 1, 2024

Conversation

zeroSteiner
Copy link
Contributor

@zeroSteiner zeroSteiner commented Sep 18, 2024

This adds a plugin that offers the fzuse command to offer a different UI for the selection of modules. It requires fzf to be present.

Verification

List the steps needed to make sure this thing works

  • Install fzf
  • Load the fzuse plugin
  • Run the fzuse command to select modules

asciicast

plugins/fzuse.rb Outdated Show resolved Hide resolved
@adfoster-r7
Copy link
Contributor

Could we update the docs for this 🤞

https://docs.metasploit.com/docs/using-metasploit/intermediate/how-to-use-plugins.html#available-plugins

Copy link

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

@smcintyre-r7 smcintyre-r7 added rn-enhancement release notes enhancement plugin and removed needs-docs labels Sep 27, 2024
#
# This method handles the fzuse command.
#
def cmd_fzuse(*args)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a question; Why is it called fzuse instead of fzfuse 👀

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm guessing the rationale is the fzf is considered an implementation detail, and in the future fzuse could technically be powered by anything? 🤔

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I went with fzuse because it's fuzzy-user. fzf is named as it is because it's fuzzy-finder.

Open3.popen3('fzf', '--select-1', '--query', query, '--pointer=->', color, '--preview', "'#{ruby}' '#{__FILE__}' '#{socket_path}' '{1}'", '--preview-label', "Module Information") do |stdin, stdout, stderr, wait_thr|
framework.modules.module_types.each do |module_type|
framework.modules.module_names(module_type).each do |module_name|
stdin.puts "#{module_type}/#{module_name}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a blocker; it'd be interesting to add actions here potentially

selection = nil

Dir.mktmpdir('msf-fzuse-') do |dir|
socket_path = File.join(dir, "msf-fzuse.sock")
Copy link
Contributor

@adfoster-r7 adfoster-r7 Sep 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What are your thoughts on using Ruby's tmp file API and creating the file in the ~/.msf4/tmp/local directory with a slightly different naming convention:

>> Tempfile.create(['msf-fsuse-', '.sock'], Msf::Config.local_directory) { |socket_file| puts socket_file.path }
/home/vagrant/.msf4/local/msf-fsuse-20240927-2373170-2tm1kk.sock

Which I think should allow us to drop the wrapper mktmpdir call here too

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That doesn't work:

[6] pry(main)> Tempfile.create(['msf-fsuse-', '.sock']) { |sf| UNIXServer.new(sf) }
Errno::EADDRINUSE: Address already in use - connect(2) for /tmp/msf-fsuse-20240927-98954-b5sojv.sock
from (pry):6:in `initialize'
[7] pry(main)> Tempfile.create(['msf-fsuse-', '.sock']) { |sf| UNIXServer.new(sf.path + '.new') }
=> #<UNIXServer:/tmp/msf-fsuse-20240927-98954-of8yja.sock.new>
[8] pry(main)> 

Copy link
Contributor

@adfoster-r7 adfoster-r7 Sep 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah that makes sense 👍

So I guess this would be enough to move the file into the ~/.msf4 folder

>> Dir.mktmpdir('msf-fzuse-', Msf::Config.local_directory) { |dir| socket_path = File.join(dir, "msf-fzuse.sock"); UNIXServer.new(socket_path) }
=> #<UNIXServer:/home/vagrant/.msf4/local/msf-fzuse-20240927-2373170-wkyt2n/msf-fzuse.sock>
>> Dir.mktmpdir('msf-fzuse-', Msf::Config.local_directory) { |dir| socket_path = File.join(dir, "msf-fzuse.sock"); UNIXServer.new(socket_path) }
=> #<UNIXServer:/home/vagrant/.msf4/local/msf-fzuse-20240927-2373170-n3ya92/msf-fzuse.sock>

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it necessary to put it in the config directory? The file only lasts a couple of seconds while the user is picking their module and I wasn't aware there was a precedent of placing temp files in the config directory.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've had PRs that put wordlists etc into places outside of ~/.msf4 which I think we've tried to avoid in the past, and for Metasploit Pro it's unexpected for files to appear in random places IMO instead of being self-contained. It's not a strong blocker for me 👍

Copy link
Contributor

@adfoster-r7 adfoster-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me; merge away 📈

@jheysel-r7
Copy link
Contributor

Works great, thanks for the addition @zeroSteiner!

Screenshot 2024-10-01 at 11 25 34 AM

@jheysel-r7 jheysel-r7 merged commit c7d1e34 into rapid7:master Oct 1, 2024
36 checks passed
@jheysel-r7
Copy link
Contributor

Release Notes

This adds a plugin that offers the fzuse command to offer a different UI for the selection of modules. It requires fzf to be present.

@jheysel-r7 jheysel-r7 self-assigned this Oct 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
plugin rn-enhancement release notes enhancement
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

4 participants