Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds pattern to catch other arch and platform values #19125

Merged

Conversation

zgoldman-r7
Copy link
Contributor

We noticed that thte mssql platform/arch detection would return the full @@version query result for both arch and platform, and have a very noisy result:
Screenshot 2024-04-19 at 2 28 01 PM
To test this, I'm not sure how to actually return a string that doesn't match the existing patterns, but just create a session (mssql_login createsession=true), and list them sessions and make sure the arch/platform looks right. You can also pry in to the method and change the string, or just make sure the tests actually look good & add/suggest more if it's not covered.

@adfoster-r7
Copy link
Contributor

Looks like the PR needs a rebase on master

@zgoldman-r7 zgoldman-r7 force-pushed the mssql-arch-detection-default-matching branch from 528ad85 to b11a712 Compare April 23, 2024 19:25
lib/rex/proto/mssql/client.rb Outdated Show resolved Hide resolved
lib/rex/proto/mssql/client.rb Outdated Show resolved Hide resolved
@zgoldman-r7 zgoldman-r7 force-pushed the mssql-arch-detection-default-matching branch from b11a712 to 434d9c2 Compare May 1, 2024 23:58
@@ -116,9 +116,20 @@ def detect_platform_and_arch
result = {}

server_vars = query('select @@version')[:rows][0][0]
if server_vars.match?(/\b\d+\.\d+\.\d+\.\d+\s\(([^)]*)\)/)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can use capture groups similar to:

query_result = query('select version()').rows.join.match(/on (?<architecture>\w+)-\w+-(?<platform>\w+)/)

Or you can pluck out the values directly

server_vars = query('select @@version')[:rows][0][0]
architecture = server_vars[/\b\d+\.\d+\.\d+\.\d+\s\(([^)]*)\)/, 1]

But named capture groups seems legit

@zgoldman-r7 zgoldman-r7 force-pushed the mssql-arch-detection-default-matching branch from 434d9c2 to fa6ce27 Compare May 2, 2024 19:39
@zgoldman-r7 zgoldman-r7 force-pushed the mssql-arch-detection-default-matching branch from fa6ce27 to 6547fdb Compare May 3, 2024 12:05
@adfoster-r7 adfoster-r7 merged commit a9960a5 into rapid7:master May 3, 2024
37 checks passed
@adfoster-r7
Copy link
Contributor

Release Notes

Updates mssql platform/arch fingerprinting to be more resilient

@cgranleese-r7 cgranleese-r7 added enhancement rn-enhancement release notes enhancement labels May 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement rn-enhancement release notes enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants