Command that can be used to generate information useful when debugging user errors by agalway-r7 · Pull Request #13430 · rapid7/metasploit-framework

agalway-r7 · 2020-05-11T09:23:42Z

Adds the debug command, that can be used to generate information useful when debugging errors.

Context

The purpose of this command is to generate a detailed error report that can be attached to Github issues. The debug output is split into five sections:

Datastore
The variables currently in use in the given environment. This section can be copied and pasted into your ~/.msf4/config file to recreate the environment that caused the error.

[framework/database]
default_db=local-https-data-service

[framework/database/local-https-data-service]
url=https://localhost:5443
cert=/Users/agalway/.msf4/msf-ws-cert.pem
skip_verify=true
api_token=fbe48c1ee49f493b0eb9bd08567e1e6d2cb1ee6b790734a2a9efa0bdf03621393b197a267e4ea841

[framework/ui/console]
ActiveModule=exploit/windows/misc/crosschex_device_bof

[windows/misc/crosschex_device_bof]
WORKSPACE=
VERBOSE=false
WfsDelay=0
EnableContextEncoding=false
ContextInformationFile=
DisablePayloadHandler=false
CPORT=5050
CHOST=0.0.0.0
TIMEOUT=1
PAYLOAD=windows/meterpreter/reverse_https
LHOST=192.168.1.2

History

The last 50 commands run by a user

547    debug -e
548    reload_lib -a
549    debug -e
550    debug
551    use crosshcex
552    use crosschex
553    run
...etc...

Errors

The last 10 errors logged to framework.log. The stack traces for any error are also retrieved and do not count towards the error total.

[06/17/2020 15:42:13] [e(0)] error: Dependencies for windows/x64/encrypted_reverse_tcp: [Metasploit::Framework::Compiler::Mingw::X64]
[06/17/2020 15:42:13] [e(0)] error: Unable to load module /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/auxiliary/gather/office365userenum.py, unknown module type
[06/17/2020 15:43:02] [e(0)] error: [-] Error while running command debug: uninitialized constant Msf::Ui::Console::CommandDispatcher::Core::Debugtext/shell
Call stack:
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/ui/console/command_dispatcher/core.rb:318:in `cmd_debug'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:523:in `run_command'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:474:in `block in run_single'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in `each'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in `run_single'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/shell.rb:158:in `run'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in `start'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
./msfconsole:22:in `<main>'

Logs

The last 50 lines of framework.log. This can repeat info retrieved with the error command

/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb:1094: Invalid return in class/module body
        return Msf::Exploit::CheckCode::Unk...
        ^~~~~~
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb:1150: syntax error, unexpected end, expecting end-of-input
  end
  ^~~
[06/23/2020 11:07:48] [e(0)] core: /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb failed to load - Errno::ENOENT No such file or directory
[06/23/2020 11:08:09] [e(0)] core: /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb failed to load - SyntaxError /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb:1089: Invalid return in class/module body
      return Msf::Exploit::CheckCode::Unk...
      ^~~~~~
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb:1094: Invalid return in class/module body
        return Msf::Exploit::CheckCode::Unk...
        ^~~~~~
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb:1150: syntax error, unexpected end, expecting end-of-input
  end
  ^~~
Call stack:
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/modules/loader/base.rb:51:in `module_eval'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/modules/loader/base.rb:51:in `module_eval_with_lexical_scope'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/modules/loader/base.rb:140:in `block in load_module'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/modules/loader/base.rb:549:in `namespace_module_transaction'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/modules/loader/base.rb:178:in `load_module'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/module_manager/cache.rb:91:in `block in load_cached_module'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/module_manager/cache.rb:86:in `each'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/module_manager/cache.rb:86:in `load_cached_module'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/module_set.rb:45:in `create'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/core/module_manager.rb:90:in `create'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/msf/ui/console/command_dispatcher/modules.rb:707:in `cmd_use'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:523:in `run_command'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:474:in `block in run_single'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in `each'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in `run_single'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/rex/ui/text/shell.rb:158:in `run'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in `start'
/Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
./msfconsole:23:in `<main>'
[06/23/2020 11:08:09] [e(0)] core: /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/exploits/windows/smb/ms08_067_netapi.rb failed to load - Errno::ENOENT No such file or directory
Call stack:
none
[06/23/2020 12:03:25] [i(0)] core: Default data service found. Attempting to connect...
[06/23/2020 12:03:25] [d(0)] core: Updated user based module store
[06/23/2020 12:03:29] [e(0)] core: Dependency for windows/encrypted_shell_reverse_tcp is not supported
[06/23/2020 12:03:29] [e(0)] core: Dependency for windows/x64/encrypted_shell_reverse_tcp is not supported
[06/23/2020 12:03:29] [e(0)] core: Dependency for windows/encrypted_reverse_tcp is not supported
[06/23/2020 12:03:29] [e(0)] core: Dependency for windows/x64/encrypted_reverse_tcp is not supported
[06/23/2020 12:03:30] [e(0)] core: Unable to load module /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework/modules/auxiliary/gather/office365userenum.py, unknown module type
[06/23/2020 12:06:03] [e(0)] core: Dependency for windows/encrypted_shell_reverse_tcp is not supported
[06/23/2020 12:06:03] [e(0)] core: Dependency for windows/x64/encrypted_shell_reverse_tcp is not supported
[06/23/2020 12:06:03] [e(0)] core: Dependency for windows/encrypted_reverse_tcp is not supported
[06/23/2020 12:06:03] [e(0)] core: Dependency for windows/x64/encrypted_reverse_tcp is not supported

Versions

The Framework version, Ruby version, Install Root, DB Connection Session Type (if any), DB Connection Name (if any), and the framework Installation method.

Framework: 5.0.95-dev-ae74d0d3a5
Ruby: ruby 2.6.6p146 (2020-03-31 revision 67876) [x86_64-darwin19]
Install Root: /Users/Shared/Relocated_Items/Security/rapid7/metasploit-framework
Session Type: Connected to remote_data_service: (https://localhost:5443). Connection type: http. Connection name: #<Metasploit::Framework::DataService::RemoteHTTPDataService:0x00007fb4369773f8>.
Install Method: Git Clone

These sections are then wrapped in Markdown, which can be copied and pasted into an Issue for easy readability:

wvu · 2020-05-11T16:41:27Z

Hey, can you retitle this and add some labels? Thanks!

adfoster-r7 · 2020-05-14T11:44:34Z

        register_log_source(src, f)
      }
+
+      register_log_source('error', error_f)


I think this will lead to good questions for module hacking 👀

acammack-r7

This should save us a lot of time! Some notes about logging and strings.

adfoster-r7 · 2020-06-08T08:33:35Z

+        output = Debug.preamble + output
+        print_line output


❔ Is this the same? 🤔

Suggested change

output = Debug.preamble + output

print_line output

print_line Debug.all(framework, driver)

No not necessarily, if you run debug with no args then you'll get the result of Debug.all. If there are args to the debug command then the user is either looking for help (-h) or is looking to display only some parts of the debug command (Eg debug -e -l for logs & errors).

A user could pass all the flags (debug -d -H -e -l -v ) and get the same result as debug with no args, save potentially a different order of information. This is the only instance where the above lines are the same.

adfoster-r7 · 2020-06-24T14:05:36Z

+
+      end
+
+      def self.errors


Now that we've got errors appearing as expected in the framework log, what are your thoughts on this section? Is this section now redundant if the log section now has all of the same information? 🤔

No I don't think so, the log command is relatively dumb and just returns the last X lines of the log file. Errors will scan the log file for the last Y number of errors and extract them in their complete from, stack traces and all. That's useful functionality, and at the very least acts as a tl;dr for logs

adfoster-r7 · 2020-06-24T14:37:28Z

+        logs_str = concat_str_array_from_last_idx(log_lines, LOG_LINE_TOTAL)
+
+        build_section('Logs',
+                      'The following logs were recorded before the issue occurred:',


nab: It might be easier to debug this log file if there was additional information on when the shell was opened, to help cross-correlate things better

As in putting messages on the log file to say "Hey, a new shell was opened here" and some identifying info?

Sorry, the time at which msfconsole was opened. We probably don't care about stale logs.

The comment was in a similar vein to https://github.com/rapid7/metasploit-framework/pull/13430/files#r444918893 - were we probably don't care about 10 errors ago 🐛

This is kind of what I was going for with the optional arguments, as it would let people choose how long the log line total and error total are. However, you're also right that there's no real reason people would care about details spanning multiple console sessions, and manually guess working that with optional log line numbers would be a pain.

Would say this is more of a seperate PR to improve logging, then debug can build on said improvements

Changes implemented

adfoster-r7 · 2020-06-29T22:52:32Z

Release Notes

A debug command was added that can be used directly in Metasploit console to output the current module, datastore, logs and software versions. This command will be useful to help improve the quality of bug reports raised on Github and when helping Metasploit users debug their issues.

agalway-r7 marked this pull request as draft May 11, 2020 09:23

agalway-r7 changed the title ~~WIP~~ Command that can be used to generate information useful when debugging user errors May 11, 2020

agalway-r7 assigned agalway-r7 and unassigned agalway-r7 May 11, 2020

agalway-r7 added enhancement feature labels May 11, 2020

adfoster-r7 changed the title ~~Command that can be used to generate information useful when debugging user errors~~ WIP: Command that can be used to generate information useful when debugging user errors May 12, 2020

agalway-r7 force-pushed the report-issue branch from 43d20ff to 5fc6048 Compare May 13, 2020 14:49

adfoster-r7 reviewed May 14, 2020

View reviewed changes