Merge pull request #2 from rapid7/master

update

.rubocop.yml

@@ -39,6 +39,11 @@ Style/MethodLength:
                   often exceed 200 lines.
   Max: 300
 
+# Basically everything in metasploit needs binary encoding, not UTF-8.
+# Disable this here and enforce it through msftidy
+Style/Encoding:
+  Enabled: false
+
 Style/NumericLiterals:
   Enabled: false
   Description: 'This often hurts readability for exploit-ish code.'
@@ -53,4 +58,22 @@ Style/StringLiterals:
 
 Style/WordArray:
   Enabled: false
-  Description: 'Metasploit prefers consistent use of []'
+  Description: 'Metasploit prefers consistent use of []'
+
+Style/RedundantBegin:
+  Exclude:
+    # this pattern is very common and somewhat unavoidable
+    # def run_host(ip)
+    #   begin
+    #     ...
+    #   rescue ...
+    #     ...
+    #   ensure
+    #     disconnect
+    #   end
+    # end
+    - 'modules/**/*'
+
+Documentation:
+  Exclude:
+    - 'modules/**/*'

.travis.yml

@@ -1,3 +1,6 @@
+env:
+  - RAKE_TASK=cucumber
+  - RAKE_TASK=spec
 language: ruby
 before_install:
   - rake --version
@@ -14,6 +17,7 @@ before_script:
   - bundle exec rake --version
   - bundle exec rake db:create
   - bundle exec rake db:migrate
+script: "bundle exec rake $RAKE_TASK"
 
 rvm:
   #- '1.8.7'

Gemfile

@@ -48,6 +48,10 @@ group :pcap do
 end
 
 group :test do
+  # cucumber extension for testing command line applications, like msfconsole
+  gem 'aruba'
+  # cucumber + automatic database cleaning with database_cleaner
+  gem 'cucumber-rails'
   gem 'shoulda-matchers'
   # code coverage for tests
   # any version newer than 0.5.4 gives an Encoding error when trying to read the source files.

Gemfile.lock

@@ -45,17 +45,41 @@ GEM
     arel (3.0.3)
     arel-helpers (2.0.1)
       activerecord (>= 3.1.0, < 5)
+    aruba (0.6.1)
+      childprocess (>= 0.3.6)
+      cucumber (>= 1.1.1)
+      rspec-expectations (>= 2.7.0)
     bcrypt (3.1.7)
     builder (3.0.4)
+    capybara (2.4.1)
+      mime-types (>= 1.16)
+      nokogiri (>= 1.3.3)
+      rack (>= 1.0.0)
+      rack-test (>= 0.5.4)
+      xpath (~> 2.0)
+    childprocess (0.5.3)
+      ffi (~> 1.0, >= 1.0.11)
     coderay (1.1.0)
+    cucumber (1.2.1)
+      builder (>= 2.1.2)
+      diff-lcs (>= 1.1.3)
+      gherkin (~> 2.11.0)
+      json (>= 1.4.6)
+    cucumber-rails (1.3.0)
+      capybara (>= 1.1.2)
+      cucumber (>= 1.1.8)
+      nokogiri (>= 1.5.0)
     diff-lcs (1.2.5)
     erubis (2.7.0)
     factory_girl (4.4.0)
       activesupport (>= 3.0.0)
     factory_girl_rails (4.4.1)
       factory_girl (~> 4.4.0)
       railties (>= 3.0.0)
+    ffi (1.9.3)
     fivemat (1.2.1)
+    gherkin (2.11.6)
+      json (>= 1.7.6)
     hike (1.2.3)
     i18n (0.6.11)
     journey (1.0.4)
@@ -80,6 +104,7 @@ GEM
       pg
     meterpreter_bins (0.0.7)
     method_source (0.8.2)
+    mime-types (2.3)
     mini_portile (0.6.0)
     msgpack (0.5.8)
     multi_json (1.0.4)
@@ -150,13 +175,17 @@ GEM
     tilt (1.4.1)
     timecop (0.7.1)
     tzinfo (0.3.40)
+    xpath (2.0.0)
+      nokogiri (~> 1.3)
     yard (0.8.7.4)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   activerecord (>= 3.0.0, < 4.0.0)
+  aruba
+  cucumber-rails
   factory_girl (>= 4.1.0)
   factory_girl_rails
   fivemat (= 1.2.1)

config/application.rb

@@ -26,30 +26,14 @@
 #
 
 require 'metasploit/framework/common_engine'
-require 'msf/base/config'
+require 'metasploit/framework/database'
 
 module Metasploit
   module Framework
     class Application < Rails::Application
       include Metasploit::Framework::CommonEngine
 
-      environment_database_yaml = ENV['MSF_DATABASE_CONFIG']
-
-      if environment_database_yaml
-        # DO NOT check if the path exists: if the environment variable is set, then the user meant to use this path
-        # and if it doesn't exist then an error should occur so the user knows the environment variable points to a
-        # non-existent file.
-        config.paths['config/database'] = environment_database_yaml
-      else
-        user_config_root = Pathname.new(Msf::Config.get_config_root)
-        user_database_yaml = user_config_root.join('database.yml')
-
-        # DO check if the path exists as in test environments there may be no config root, in which case the normal
-        # rails location, `config/database.yml`, should contain the database config.
-        if user_database_yaml.exist?
-          config.paths['config/database'] = [user_database_yaml.to_path]
-        end
-      end
+      config.paths['config/database'] = [Metasploit::Framework::Database.configurations_pathname.try(:to_path)]
     end
   end
 end

config/cucumber.yml

@@ -0,0 +1,8 @@
+<%
+rerun = File.file?('rerun.txt') ? IO.read('rerun.txt') : ""
+rerun_opts = rerun.to_s.strip.empty? ? "--format #{ENV['CUCUMBER_FORMAT'] || 'progress'} features" : "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} #{rerun}"
+std_opts = "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} --strict --tags ~@wip"
+%>
+default: <%= std_opts %> features
+wip: --tags @wip:3 --wip features
+rerun: <%= rerun_opts %> --format rerun --out rerun.txt --strict --tags ~@wip

features/msfconsole/database_yml.feature

@@ -0,0 +1,158 @@
+Feature: `msfconsole` `database.yml`
+
+  In order to connect to the database in `msfconsole`
+  As a user calling `msfconsole` from a terminal
+  I want to be able to set the path of the `database.yml` in one of 4 locations (in order of precedence):
+
+  1. An explicit argument to the `-y` flag to `msfconsole`
+  2. The MSF_DATABASE_CONFIG environment variable
+  3. The user's `~/.msf4/database.yml`
+  4. `config/database.yml` in the metasploit-framework checkout location.
+
+  Scenario: With all 4 locations, --yaml wins
+    Given a file named "command_line.yml" with:
+      """
+      test:
+        adapter: postgresql
+        database: command_line_metasploit_framework_test
+        username: command_line_metasploit_framework_test
+      """
+    And a file named "msf_database_config.yml" with:
+      """
+      test:
+        adapter: postgresql
+        database: environment_metasploit_framework_test
+        username: environment_metasploit_framework_test
+      """
+    And I set the environment variables to:
+      | variable            | value                   |
+      | MSF_DATABASE_CONFIG | msf_database_config.yml |
+    And a directory named "home"
+    And I cd to "home"
+    And a mocked home directory
+    And a directory named ".msf4"
+    And I cd to ".msf4"
+    And a file named "database.yml" with:
+      """
+      test:
+        adapter: postgresql
+        database: user_metasploit_framework_test
+        username: user_metasploit_framework_test
+      """
+    And I cd to "../.."
+    And the project "database.yml" exists with:
+      """
+      test:
+        adapter: postgresql
+        database: project_metasploit_framework_test
+        username: project_metasploit_framework_test
+      """
+    When I run `msfconsole --environment test --yaml command_line.yml` interactively
+    And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
+    And I type "exit"
+    Then the output should contain "command_line_metasploit_framework_test"
+
+  Scenario: Without --yaml, MSF_DATABASE_CONFIG wins
+    Given a file named "msf_database_config.yml" with:
+      """
+      test:
+        adapter: postgresql
+        database: environment_metasploit_framework_test
+        username: environment_metasploit_framework_test
+      """
+    And I set the environment variables to:
+      | variable            | value                   |
+      | MSF_DATABASE_CONFIG | msf_database_config.yml |
+    And a directory named "home"
+    And I cd to "home"
+    And a mocked home directory
+    And a directory named ".msf4"
+    And I cd to ".msf4"
+    And a file named "database.yml" with:
+      """
+      test:
+        adapter: postgresql
+        database: user_metasploit_framework_test
+        username: user_metasploit_framework_test
+      """
+    And I cd to "../.."
+    And the project "database.yml" exists with:
+      """
+      test:
+        adapter: postgresql
+        database: project_metasploit_framework_test
+        username: project_metasploit_framework_test
+      """
+    When I run `msfconsole --environment test` interactively
+    And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
+    And I type "exit"
+    Then the output should contain "environment_metasploit_framework_test"
+
+  Scenario: Without --yaml or MSF_DATABASE_CONFIG, ~/.msf4/database.yml wins
+    Given I unset the environment variables:
+      | variable            |
+      | MSF_DATABASE_CONFIG |
+    And a directory named "home"
+    And I cd to "home"
+    And a mocked home directory
+    And a directory named ".msf4"
+    And I cd to ".msf4"
+    And a file named "database.yml" with:
+      """
+      test:
+        adapter: postgresql
+        database: user_metasploit_framework_test
+        username: user_metasploit_framework_test
+      """
+    And I cd to "../.."
+    And the project "database.yml" exists with:
+      """
+      test:
+        adapter: postgresql
+        database: project_metasploit_framework_test
+        username: project_metasploit_framework_test
+      """
+    When I run `msfconsole --environment test` interactively
+    And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
+    And I type "exit"
+    Then the output should contain "user_metasploit_framework_test"
+
+  Scenario: Without --yaml, MSF_DATABASE_CONFIG or ~/.msf4/database.yml, project "database.yml" wins
+    Given I unset the environment variables:
+      | variable            |
+      | MSF_DATABASE_CONFIG |
+    And a directory named "home"
+    And I cd to "home"
+    And a mocked home directory
+    And I cd to "../.."
+    And the project "database.yml" exists with:
+      """
+      test:
+        adapter: postgresql
+        database: project_metasploit_framework_test
+        username: project_metasploit_framework_test
+      """
+    When I run `msfconsole --environment test` interactively
+    And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
+    And I type "exit"
+    Then the output should contain "project_metasploit_framework_test"
+
+
+  Scenario: Without --yaml, MSF_DATABASE_CONFIG, ~/.msf4/database.yml, or project "database.yml", no database connection
+    Given I unset the environment variables:
+      | variable            |
+      | MSF_DATABASE_CONFIG |
+    And a directory named "home"
+    And I cd to "home"
+    And a mocked home directory
+    And I cd to "../.."
+    And the project "database.yml" does not exist
+    When I run `msfconsole --environment test` interactively
+    And I wait for stdout to contain "Free Metasploit Pro trial: http://r-7.co/trymsp"
+    And I type "db_status"
+    And I type "exit"
+    Then the output should not contain "command_line_metasploit_framework_test"
+    And the output should not contain "environment_metasploit_framework_test"
+    And the output should not contain "user_metasploit_framework_test"
+    And the output should not contain "project_metasploit_framework_test"
+    And the output should contain "[*] postgresql selected, no connection"

features/step_definitions/env.rb

@@ -0,0 +1,20 @@
+Given /^I unset the environment variables:$/ do |table|
+  table.hashes.each do |row|
+    variable = row['variable'].to_s.upcase
+
+    # @todo add extension to Announcer
+    announcer.instance_eval do
+      if @options[:env]
+        print "$ unset #{variable}"
+      end
+    end
+
+    current_value = ENV.delete(variable)
+
+    # if original_env already has the key, then the true original was already recorded from a previous unset or set,
+    # so don't record the current value as it will cause ENV not to be restored after the Scenario.
+    unless original_env.key? variable
+      original_env[variable] = current_value
+    end
+  end
+end

features/step_definitions/project.rb

@@ -0,0 +1,14 @@
+require 'metasploit/framework/database/cucumber'
+
+Given /^the project "database.yml" does not exist$/ do
+  Metasploit::Framework::Database::Cucumber.backup_project_configurations
+end
+
+Given /^the project "database.yml" exists with:$/ do |file_content|
+  Metasploit::Framework::Database::Cucumber.backup_project_configurations
+  write_file(Metasploit::Framework::Database::Cucumber.project_configurations_path, file_content)
+end
+
+After do
+  Metasploit::Framework::Database::Cucumber.restore_project_configurations
+end

features/support/bin/stty

@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+
+case ARGV[0]
+  when 'size'
+    puts "30 134"
+  when '-a'
+    puts <<EOS
+speed 38400 baud; 30 rows; 134 columns;
+lflags: icanon isig iexten echo echoe echok echoke -echonl echoctl
+	-echoprt -altwerase -noflsh -tostop -flusho pendin -nokerninfo
+	-extproc
+iflags: -istrip icrnl -inlcr -igncr ixon -ixoff ixany imaxbel iutf8
+	-ignbrk brkint -inpck -ignpar -parmrk
+oflags: opost onlcr -oxtabs -onocr -onlret
+cflags: cread cs8 -parenb -parodd hupcl -clocal -cstopb -crtscts -dsrflow
+	-dtrflow -mdmbuf
+cchars: discard = ^O; dsusp = ^Y; eof = ^D; eol = <undef>;
+	eol2 = <undef>; erase = ^?; intr = ^C; kill = ^U; lnext = ^V;
+	min = 1; quit = ^\; reprint = ^R; start = ^Q; status = ^T;
+	stop = ^S; susp = ^Z; time = 0; werase = ^W;
+EOS
+  when '-g'
+    puts "gfmt1:cflag=4b00:iflag=6b02:lflag=200005cf:oflag=3:discard=f:dsusp=19:eof=4:eol=ff:eol2=ff:erase=7f:intr=3:kill=15:lnext=16:min=1:quit=1c:reprint=12:start=11:status=14:stop=13:susp=1a:time=0:werase=17:ispeed=38400:ospeed=38400"
+end
+
+exit 0