Linux post libs comments and specs #19682
Conversation
There was a problem hiding this comment.
Thank you @h00die for adding documentation and specs. I just added a couple of comments.
lib/msf/core/post/linux/packages.rb
Outdated
| return Rex::Version.new(package_version) | ||
| elsif ['redhat', 'fedora'].include?(info[:distro]) | ||
| package_version = cmd_exec("rpm -q #{package}") | ||
| return nil if package_version.include?('is not installed') |
There was a problem hiding this comment.
I haven't tested it, but I'm wondering if rpm returns a message in English on a non-English installation.
This also applies to the system commands called in this method.
There was a problem hiding this comment.
Good thinking, I'm not sure
There was a problem hiding this comment.
From my initial testing, it seems like the message changes based on the language. One way could be to use rpm -V [package name] or rpm -qa | grep [package name]. However, I think these solutions would require to run first check for presence and then fetching the version.
|
Appreciate, I'm going to get specs working for all the linux post libs before putting this up for official review. Good question about language though |
|
While this is in draft, it's going to be a little bit of a headache, lots of stuff going on. prob not worth reviewing till its out of draft tbh |
|
Ready for review, 5 tests are failing for more or less the same thing. @smcintyre-r7 was trying to help me with this, but I'll need more help getting |
|
|
There was a problem hiding this comment.
Hi @h00die , did you check output of the commands for different language variants of distributions? If we can use English phrases as checks for presence of package.
I was able to verify Ubuntu (German), Fedora (German), Gentoo (German). I picked German because it seemed less likely to have character/word overlap with English. |
There was a problem hiding this comment.
Awesome @h00die , I don't have any additional questions/comments. If you're not planning to add any other changes, I can merge it.
|
i'm happy with it at this point! |
Co-authored-by: Julien Voisin <[email protected]>
msutovsky-r7
added
rn-enhancement
Release NotesThis update is landed in commit |
This PR does a few things for linux post libs:
packagesmodule which can be used to check what version of a package is installed. Ubuntu needrestart LPE (CVE-2024-48990) #19676 (comment)