-
Notifications
You must be signed in to change notification settings - Fork 14.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add the fuzzy-use plugin #19471
Add the fuzzy-use plugin #19471
Conversation
6ca2b93
to
ba65ecc
Compare
Could we update the docs for this 🤞 |
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
# | ||
# This method handles the fzuse command. | ||
# | ||
def cmd_fzuse(*args) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just a question; Why is it called fzuse
instead of fzfuse
👀
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm guessing the rationale is the fzf
is considered an implementation detail, and in the future fzuse
could technically be powered by anything? 🤔
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I went with fzuse
because it's fuzzy-user. fzf
is named as it is because it's fuzzy-finder.
Open3.popen3('fzf', '--select-1', '--query', query, '--pointer=->', color, '--preview', "'#{ruby}' '#{__FILE__}' '#{socket_path}' '{1}'", '--preview-label', "Module Information") do |stdin, stdout, stderr, wait_thr| | ||
framework.modules.module_types.each do |module_type| | ||
framework.modules.module_names(module_type).each do |module_name| | ||
stdin.puts "#{module_type}/#{module_name}" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not a blocker; it'd be interesting to add actions here potentially
selection = nil | ||
|
||
Dir.mktmpdir('msf-fzuse-') do |dir| | ||
socket_path = File.join(dir, "msf-fzuse.sock") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What are your thoughts on using Ruby's tmp file API and creating the file in the ~/.msf4/tmp/local
directory with a slightly different naming convention:
>> Tempfile.create(['msf-fsuse-', '.sock'], Msf::Config.local_directory) { |socket_file| puts socket_file.path }
/home/vagrant/.msf4/local/msf-fsuse-20240927-2373170-2tm1kk.sock
Which I think should allow us to drop the wrapper mktmpdir
call here too
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That doesn't work:
[6] pry(main)> Tempfile.create(['msf-fsuse-', '.sock']) { |sf| UNIXServer.new(sf) }
Errno::EADDRINUSE: Address already in use - connect(2) for /tmp/msf-fsuse-20240927-98954-b5sojv.sock
from (pry):6:in `initialize'
[7] pry(main)> Tempfile.create(['msf-fsuse-', '.sock']) { |sf| UNIXServer.new(sf.path + '.new') }
=> #<UNIXServer:/tmp/msf-fsuse-20240927-98954-of8yja.sock.new>
[8] pry(main)>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah that makes sense 👍
So I guess this would be enough to move the file into the ~/.msf4
folder
>> Dir.mktmpdir('msf-fzuse-', Msf::Config.local_directory) { |dir| socket_path = File.join(dir, "msf-fzuse.sock"); UNIXServer.new(socket_path) }
=> #<UNIXServer:/home/vagrant/.msf4/local/msf-fzuse-20240927-2373170-wkyt2n/msf-fzuse.sock>
>> Dir.mktmpdir('msf-fzuse-', Msf::Config.local_directory) { |dir| socket_path = File.join(dir, "msf-fzuse.sock"); UNIXServer.new(socket_path) }
=> #<UNIXServer:/home/vagrant/.msf4/local/msf-fzuse-20240927-2373170-n3ya92/msf-fzuse.sock>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it necessary to put it in the config directory? The file only lasts a couple of seconds while the user is picking their module and I wasn't aware there was a precedent of placing temp files in the config directory.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We've had PRs that put wordlists etc into places outside of ~/.msf4
which I think we've tried to avoid in the past, and for Metasploit Pro it's unexpected for files to appear in random places IMO instead of being self-contained. It's not a strong blocker for me 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me; merge away 📈
Works great, thanks for the addition @zeroSteiner! |
Release NotesThis adds a plugin that offers the fzuse command to offer a different UI for the selection of modules. It requires fzf to be present. |
This adds a plugin that offers the
fzuse
command to offer a different UI for the selection of modules. It requiresfzf
to be present.Verification
List the steps needed to make sure this thing works
fzf
fzuse
pluginfzuse
command to select modules