From a3756ca99322335b2da58d05575b685c1110ff6f Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 3 Jan 2024 13:54:26 -0500 Subject: [PATCH 1/2] Update the module name regex The module name regex only includes a subset of modules types that Metasploit supports. This notably prevents modules which create handlers such as payloads and evasion modules from storing information in the database. --- app/models/metasploit/credential/origin/service.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/models/metasploit/credential/origin/service.rb b/app/models/metasploit/credential/origin/service.rb index 86a0d71b..3c12add5 100644 --- a/app/models/metasploit/credential/origin/service.rb +++ b/app/models/metasploit/credential/origin/service.rb @@ -9,9 +9,9 @@ class Metasploit::Credential::Origin::Service < ApplicationRecord # # Regular expression that matches any `Mdm::Module::Detail#fullname` for {#module_full_name} where - # `Mdm::Module::Detail#mtype` is `'auxiliary'` or `'exploit'` and the remainder is a valid + # `Mdm::Module::Detail#mtype` is the module type, e.g. `'auxiliary'` or `'exploit'`, and the remainder is a valid # `Mdm::Module::Detail#refname` (it does not contain a `'\'` and is lower case alphanumeric). - MODULE_FULL_NAME_REGEXP = /\A(?auxiliary|exploit|post)\/(?[\-0-9A-Z_a-z]+(?:\/[\-0-9A-Z_a-z]+)*)\Z/ + MODULE_FULL_NAME_REGEXP = /\A(?auxiliary|evasion|exploit|payload|post)\/(?[\-0-9A-Z_a-z]+(?:\/[\-0-9A-Z_a-z]+)*)\Z/ # # Associations From ae1bcbebc0f0aa7fd98b9af2ed6273c1b53235da Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 4 Jan 2024 11:30:26 -0500 Subject: [PATCH 2/2] Update the specs for the new regex --- .../metasploit/credential/origin/service_spec.rb | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/spec/models/metasploit/credential/origin/service_spec.rb b/spec/models/metasploit/credential/origin/service_spec.rb index 604651f4..19b07595 100644 --- a/spec/models/metasploit/credential/origin/service_spec.rb +++ b/spec/models/metasploit/credential/origin/service_spec.rb @@ -82,6 +82,16 @@ end end + context 'with evasion' do + let(:module_type) do + 'evasion' + end + + it 'allows value' do + expect(service_origin).to allow_value(module_full_name).for(:module_full_name) + end + end + context 'with exploit' do let(:module_type) do 'exploit' @@ -108,7 +118,7 @@ end it 'allows value' do - expect(service_origin).not_to allow_value(module_full_name).for(:module_full_name) + expect(service_origin).to allow_value(module_full_name).for(:module_full_name) end end