Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create kernel_rex_version to guard against Rex::Version crashes on local modules #19855

Open
jheysel-r7 opened this issue Feb 3, 2025 · 0 comments
Labels
suggestion-feature New feature suggestions

Comments

@jheysel-r7
Copy link
Contributor

Summary

PR: #19813 brought up an issue where in some scenarios local modules were sending kernel version strings to Rex::Version.new which were causing crashes.

The PR above resolves the issue by handling errors that occurred when running modules designed for Ubuntu instances on Amazon Linux instances. Amazon Linux has a unique kernel version string, which causes compatibility problems.

We would like to move this functionality into post/linux/kernel as a function (potentially named kernel_rex_version ) so the normalization is centralized and each individual module doesn't have to account for these differences in kernel version strings.

Basic example

The testing done in #19813 should be referenced as it illustrates the issue:

Before the fix the amazon linux version string causes and error:

msf6 exploit(linux/local/vmwgfx_fd_priv_esc) > check
[-] Exploit failed: ArgumentError Malformed version number string 4.14.355-275.572.amzn2.x86_64
[-] MANUAL replacement of trojaned  is required.
[-] Check failed: The state could not be determined.

After the fix the individual module rescues and handles the error:

msf6 exploit(linux/local/vmwgfx_fd_priv_esc) > check
[-] MANUAL replacement of trojaned  is required.
[*] The target is not exploitable. Error determining or processing kernel release (4.14.355-275.572.amzn2.x86_64) into known format: Malformed version number string 4.14.355-275.572.amzn2.x86_64
@jheysel-r7 jheysel-r7 added the suggestion-feature New feature suggestions label Feb 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
suggestion-feature New feature suggestions
Projects
None yet
Development

No branches or pull requests

1 participant