Skip to content

Commit 99c9d5a

Browse files
egyptegypt
committed
Land rapid7#3683, cucumber tests for msfconsole
2 parents 495e1c1 + 77f0a2d commit 99c9d5a

File tree

16 files changed

+266
-7
lines changed

16 files changed

+266
-7
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ Gemfile.local.lock
1313
.DS_Store
1414
# database config for testing
1515
config/database.yml
16+
# target config file for testing
17+
features/support/targets.yml
1618
# simplecov coverage data
1719
coverage
1820
doc/
@@ -50,6 +52,8 @@ tags
5052

5153
# Rails log directory
5254
/log
55+
# Rails tmp directory
56+
/tmp
5357

5458
# ignore release/debug folders for exploits
5559
external/source/exploits/**/Debug

‎.travis.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
env:
22
- RAKE_TASK=cucumber
3+
- RAKE_TASK=cucumber:boot
34
- RAKE_TASK=spec
5+
46
language: ruby
57
before_install:
68
- rake --version

‎Gemfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ group :development, :test do
3838
gem 'rspec', '>= 2.12', '< 3.0.0'
3939
# Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the
4040
# environment is development
41-
gem 'rspec-rails' , '>= 2.12', '< 3.0.0'
41+
gem 'rspec-rails' , '>= 2.12', '< 3.0.0'
4242
end
4343

4444
group :pcap do

‎Gemfile.lock

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ PATH
2121
GEM
2222
remote: https://rubygems.org/
2323
specs:
24+
actionmailer (3.2.19)
25+
actionpack (= 3.2.19)
26+
mail (~> 2.5.4)
2427
actionpack (3.2.19)
2528
activemodel (= 3.2.19)
2629
activesupport (= 3.2.19)
@@ -39,6 +42,9 @@ GEM
3942
activesupport (= 3.2.19)
4043
arel (~> 3.0.2)
4144
tzinfo (~> 0.3.29)
45+
activeresource (3.2.19)
46+
activemodel (= 3.2.19)
47+
activesupport (= 3.2.19)
4248
activesupport (3.2.19)
4349
i18n (~> 0.6, >= 0.6.4)
4450
multi_json (~> 1.0)
@@ -65,10 +71,11 @@ GEM
6571
diff-lcs (>= 1.1.3)
6672
gherkin (~> 2.11.0)
6773
json (>= 1.4.6)
68-
cucumber-rails (1.3.0)
74+
cucumber-rails (1.4.0)
6975
capybara (>= 1.1.2)
70-
cucumber (>= 1.1.8)
76+
cucumber (>= 1.2.0)
7177
nokogiri (>= 1.5.0)
78+
rails (>= 3.0.0)
7279
diff-lcs (1.2.5)
7380
erubis (2.7.0)
7481
factory_girl (4.4.0)
@@ -84,6 +91,9 @@ GEM
8491
i18n (0.6.11)
8592
journey (1.0.4)
8693
json (1.8.1)
94+
mail (2.5.4)
95+
mime-types (~> 1.16)
96+
treetop (~> 1.4.8)
8797
metasploit-concern (0.1.1)
8898
activesupport (~> 3.0, >= 3.0.0)
8999
metasploit-credential (0.9.0)
@@ -104,16 +114,17 @@ GEM
104114
pg
105115
meterpreter_bins (0.0.7)
106116
method_source (0.8.2)
107-
mime-types (2.3)
117+
mime-types (1.25.1)
108118
mini_portile (0.6.0)
109119
msgpack (0.5.8)
110-
multi_json (1.0.4)
120+
multi_json (1.0.3)
111121
network_interface (0.0.1)
112122
nokogiri (1.6.3.1)
113123
mini_portile (= 0.6.0)
114124
packetfu (1.1.9)
115125
pcaprub (0.11.3)
116126
pg (0.17.1)
127+
polyglot (0.3.5)
117128
pry (0.10.0)
118129
coderay (~> 1.1.0)
119130
method_source (~> 0.8.1)
@@ -125,6 +136,14 @@ GEM
125136
rack
126137
rack-test (0.6.2)
127138
rack (>= 1.0)
139+
rails (3.2.19)
140+
actionmailer (= 3.2.19)
141+
actionpack (= 3.2.19)
142+
activerecord (= 3.2.19)
143+
activeresource (= 3.2.19)
144+
activesupport (= 3.2.19)
145+
bundler (~> 1.0)
146+
railties (= 3.2.19)
128147
railties (3.2.19)
129148
actionpack (= 3.2.19)
130149
activesupport (= 3.2.19)
@@ -174,7 +193,10 @@ GEM
174193
thor (0.19.1)
175194
tilt (1.4.1)
176195
timecop (0.7.1)
177-
tzinfo (0.3.40)
196+
treetop (1.4.15)
197+
polyglot
198+
polyglot (>= 0.3.1)
199+
tzinfo (0.3.41)
178200
xpath (2.0.0)
179201
nokogiri (~> 1.3)
180202
yard (0.8.7.4)

‎Rakefile

100644100755
File mode changed.

‎config/cucumber.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22
rerun = File.file?('rerun.txt') ? IO.read('rerun.txt') : ""
33
rerun_opts = rerun.to_s.strip.empty? ? "--format #{ENV['CUCUMBER_FORMAT'] || 'progress'} features" : "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} #{rerun}"
44
std_opts = "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} --strict --tags ~@wip"
5+
ignored_tags = "--tags ~@boot --tags ~@targets"
56
%>
6-
default: <%= std_opts %> features
7+
default: <%= std_opts %> <%= ignored_tags %> features
8+
boot: <%= std_opts %> --tags @boot features
79
wip: --tags @wip:3 --wip features
810
rerun: <%= rerun_opts %> --format rerun --out rerun.txt --strict --tags ~@wip

‎features/commands/help.feature

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
Feature: Help command
2+
3+
Background:
4+
Given I run `msfconsole` interactively
5+
And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
6+
7+
Scenario: The 'help' command's output
8+
When I type "help"
9+
And I type "exit"
10+
Then the output should contain:
11+
"""
12+
Core Commands
13+
=============
14+
15+
Command Description
16+
------- -----------
17+
? Help menu
18+
back Move back from the current context
19+
banner Display an awesome metasploit banner
20+
cd Change the current working directory
21+
color Toggle color
22+
connect Communicate with a host
23+
edit Edit the current module with $VISUAL or $EDITOR
24+
exit Exit the console
25+
go_pro Launch Metasploit web GUI
26+
grep Grep the output of another command
27+
help Help menu
28+
info Displays information about one or more module
29+
irb Drop into irb scripting mode
30+
jobs Displays and manages jobs
31+
kill Kill a job
32+
load Load a framework plugin
33+
loadpath Searches for and loads modules from a path
34+
makerc Save commands entered since start to a file
35+
popm Pops the latest module off the stack and makes it active
36+
previous Sets the previously loaded module as the current module
37+
pushm Pushes the active or list of modules onto the module stack
38+
quit Exit the console
39+
reload_all Reloads all modules from all defined module paths
40+
resource Run the commands stored in a file
41+
route Route traffic through a session
42+
save Saves the active datastores
43+
search Searches module names and descriptions
44+
sessions Dump session listings and display information about sessions
45+
set Sets a variable to a value
46+
setg Sets a global variable to a value
47+
show Displays modules of a given type, or all modules
48+
sleep Do nothing for the specified number of seconds
49+
spool Write console output into a file as well the screen
50+
threads View and manipulate background threads
51+
unload Unload a framework plugin
52+
unset Unsets one or more variables
53+
unsetg Unsets one or more global variables
54+
use Selects a module by name
55+
version Show the framework and console library version numbers
56+
57+
58+
Database Backend Commands
59+
=========================
60+
61+
Command Description
62+
------- -----------
63+
creds List all credentials in the database
64+
db_connect Connect to an existing database
65+
db_disconnect Disconnect from the current database instance
66+
db_export Export a file containing the contents of the database
67+
db_import Import a scan result file (filetype will be auto-detected)
68+
db_nmap Executes nmap and records the output automatically
69+
db_rebuild_cache Rebuilds the database-stored module cache
70+
db_status Show the current database status
71+
hosts List all hosts in the database
72+
loot List all loot in the database
73+
notes List all notes in the database
74+
services List all services in the database
75+
vulns List all vulnerabilities in the database
76+
workspace Switch between database workspaces
77+
"""
78+

‎features/modules/exploit/smb/ms08_067_netapi.feature

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
Feature: MS08-067 netapi
2+
3+
Background:
4+
Given I run `msfconsole` interactively
5+
And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
6+
7+
Scenario: The MS08-067 Module should have the following options
8+
When I type "use exploit/windows/smb/ms08_067_netapi"
9+
And I type "show options"
10+
And I type "exit"
11+
Then the output should contain the following:
12+
| Module options (exploit/windows/smb/ms08_067_netapi) |
13+
| Name Current Setting Required Description |
14+
| ---- --------------- -------- ----------- |
15+
| RHOST yes The target address |
16+
| RPORT 445 yes Set the SMB service port |
17+
| RPORT 445 yes Set the SMB service port |
18+
19+
Scenario: The MS08-067 Module should have the following advanced options
20+
When I type "use exploit/windows/smb/ms08_067_netapi"
21+
And I type "show advanced"
22+
And I type "exit"
23+
Then the output should contain the following:
24+
| Name : CHOST |
25+
| Description : The local client address |
26+
| Name : CPORT |
27+
| Description : The local client port |
28+
| Name : ConnectTimeout |
29+
| Description : Maximum number of seconds to establish a TCP connection |
30+
| Name : ContextInformationFile |
31+
| Description : The information file that contains context information |
32+
| Name : DCERPC::ReadTimeout |
33+
| Description : The number of seconds to wait for DCERPC responses |
34+
| Name : DisablePayloadHandler |
35+
| Description : Disable the handler code for the selected payload |
36+
| Name : EnableContextEncoding |
37+
| Description : Use transient context when encoding payloads |
38+
| Name : NTLM::SendLM |
39+
| Description : Always send the LANMAN response (except when NTLMv2_session is |
40+
| specified) |
41+
| Name : NTLM::SendNTLM |
42+
| Description : Activate the 'Negotiate NTLM key' flag, indicating the use of |
43+
| NTLM responses |
44+
| Name : NTLM::SendSPN |
45+
| Current Setting: true |
46+
| Description : Send an avp of type SPN in the ntlmv2 client Blob, this allow |
47+
| authentification on windows Seven/2008r2 when SPN is required |
48+
| Name : NTLM::UseLMKey |
49+
| Description : Activate the 'Negotiate Lan Manager Key' flag, using the LM key |
50+
| when the LM response is sent |
51+
| Name : NTLM::UseNTLM2_session |
52+
| Description : Activate the 'Negotiate NTLM2 key' flag, forcing the use of a |
53+
| NTLMv2_session |
54+
| Name : NTLM::UseNTLMv2 |
55+
| Description : Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key |
56+
| is true |
57+
# | Name : Proxies |
58+
# | Description : Use a proxy chain |
59+
| Name : SMB::ChunkSize |
60+
| Current Setting: 500 |
61+
| Description : The chunk size for SMB segments, bigger values will increase |
62+
| speed but break NT 4.0 and SMB signing |
63+
| Name : SMB::Native_LM |
64+
| Description : The Native LM to send during authentication |
65+
| Name : SMB::Native_OS |
66+
| Description : The Native OS to send during authentication |
67+
| Name : SMB::VerifySignature |
68+
| Description : Enforces client-side verification of server response signatures |
69+
| Name : SMBDirect |
70+
| Description : The target port is a raw SMB service (not NetBIOS) |
71+
| Name : SMBDomain |
72+
| Description : The Windows domain to use for authentication |
73+
| Name : SMBName |
74+
| Description : The NetBIOS hostname (required for port 139 connections) |
75+
| Name : SMBPass |
76+
| Description : The password for the specified username |
77+
| Name : SMBUser |
78+
| Description : The username to authenticate as |
79+
| Name : SSL |
80+
| Description : Negotiate SSL for outgoing connections |
81+
| Name : SSLCipher |
82+
| Description : String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH" |
83+
| Name : SSLVerifyMode |
84+
| Description : SSL verification method (accepted: CLIENT_ONCE, |
85+
| FAIL_IF_NO_PEER_CERT, NONE, PEER) |
86+
| Name : SSLVersion |
87+
| Description : Specify the version of SSL that should be used (accepted: SSL2, |
88+
| SSL3, TLS1) |
89+
| Name : VERBOSE |
90+
| Description : Enable detailed status messages |
91+
| Name : WORKSPACE |
92+
| Description : Specify the workspace for this module |
93+
| Name : WfsDelay |
94+
| Description : Additional delay when waiting for a session |
95+
96+
@targets
97+
Scenario: Show RHOST/etc variable expansion from a config file
98+
When I type "use exploit/windows/smb/ms08_067_netapi"
99+
When RHOST is WINDOWS
100+
And I type "set PAYLOAD windows/meterpreter/bind_tcp"
101+
And I type "show options"
102+
And I type "run"
103+
And I type "exit"
104+
And I type "exit"
105+
Then the output should match /spider-wxp/

‎features/msfconsole/database_yml.feature

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
@boot
12
Feature: `msfconsole` `database.yml`
23

34
In order to connect to the database in `msfconsole`
@@ -156,3 +157,11 @@ Feature: `msfconsole` `database.yml`
156157
And the output should not contain "user_metasploit_framework_test"
157158
And the output should not contain "project_metasploit_framework_test"
158159
And the output should contain "[*] postgresql selected, no connection"
160+
161+
Scenario: Starting `msfconsole` with a valid database.yml
162+
Given I run `msfconsole` interactively
163+
And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
164+
When I type "db_status"
165+
And I type "exit"
166+
Then the output should contain "[*] postgresql connected to metasploit_framework_test"
167+

‎features/step_definitions/console_output.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Then /^the output should contain the following:$/ do |table|
2+
table.raw.flatten.each do |expected|
3+
assert_partial_output(expected, all_output)
4+
end
5+
end

0 commit comments

Comments
 (0)