|
| 1 | +# -*- coding: binary -*- |
| 2 | + |
| 3 | +require 'rex/version' |
| 4 | + |
| 5 | +# |
| 6 | +# Provides version compatibility checks between exploit targets and payloads. |
| 7 | +# |
| 8 | +module Msf::Module::VersionCompatibility |
| 9 | + # Check version compatibility between a payload and the current exploit target. |
| 10 | + # |
| 11 | + # @param payload_instance [Msf::Payload] An payload module instance. |
| 12 | + # @return [Array<String>] An array of warning strings. Empty if there were no warnings and payload is compatible. |
| 13 | + def version_compatibility_warnings(payload_instance) |
| 14 | + warnings = [] |
| 15 | + |
| 16 | + target_versions = current_target_runtime_versions |
| 17 | + return warnings unless target_versions.is_a?(Hash) && !target_versions.empty? |
| 18 | + |
| 19 | + payload_mins = payload_minimum_versions(payload_instance) |
| 20 | + return warnings unless payload_mins.is_a?(Hash) && !payload_mins.empty? |
| 21 | + |
| 22 | + payload_mins.each do |runtime, min_version| |
| 23 | + next unless target_versions.key?(runtime) |
| 24 | + |
| 25 | + target_ver = to_version(target_versions[runtime]) |
| 26 | + required_ver = to_version(min_version) |
| 27 | + |
| 28 | + if target_ver < required_ver |
| 29 | + required_name = human_readable_version_string(runtime, required_ver) |
| 30 | + target_name = human_readable_version_string(runtime, target_ver) |
| 31 | + warnings << "Payload requires #{runtime} >= #{required_name}, but the minimum potentially provided by the target is #{target_name}" |
| 32 | + end |
| 33 | + end |
| 34 | + |
| 35 | + warnings |
| 36 | + end |
| 37 | + |
| 38 | + private |
| 39 | + |
| 40 | + # Normalize a value to Rex::Version |
| 41 | + # |
| 42 | + # @param value [String, Rex::Version] The version to normalize. |
| 43 | + # @return [Rex::Version] |
| 44 | + def to_version(value) |
| 45 | + value.is_a?(Rex::Version) ? value : Rex::Version.new(value.to_s) |
| 46 | + end |
| 47 | + |
| 48 | + # Look up a human-readable name for a version number. |
| 49 | + # Falls back to the raw version string if no mapping is found. |
| 50 | + # |
| 51 | + # @param runtime [String] The runtime key (e.g., 'Windows', 'Python'). |
| 52 | + # @param version [Rex::Version] The version to look up. |
| 53 | + # @return [String] A human-readable string like "Windows XP Service Pack 2 (5.1.2600.2)" |
| 54 | + def human_readable_version_string(runtime, version) |
| 55 | + case runtime |
| 56 | + when 'Windows' |
| 57 | + name = windows_version_name(version) |
| 58 | + return "#{name} (#{version})" if name |
| 59 | + end |
| 60 | + |
| 61 | + version.to_s |
| 62 | + end |
| 63 | + |
| 64 | + # Look up a Windows version's human-readable name from the WindowsVersion mappings. |
| 65 | + # |
| 66 | + # @param version [Rex::Version] The version to look up. |
| 67 | + # @return [String, nil] The friendly name, or nil if not found. |
| 68 | + def windows_version_name(version) |
| 69 | + [ |
| 70 | + { klass: Msf::WindowsVersion::WorkstationSpecificVersions, mapping: Msf::WindowsVersion::WorkstationNameMapping }, |
| 71 | + { klass: Msf::WindowsVersion::ServerSpecificVersions, mapping: Msf::WindowsVersion::ServerNameMapping } |
| 72 | + ].each do |h| |
| 73 | + h[:klass].constants.each do |const| |
| 74 | + return h[:mapping][const] if h[:klass].const_get(const) == version |
| 75 | + end |
| 76 | + end |
| 77 | + |
| 78 | + nil |
| 79 | + end |
| 80 | + |
| 81 | + # Retrieve RuntimeVersions from the currently selected target. |
| 82 | + # If the current target does not declare RuntimeVersions but other targets do, |
| 83 | + # returns the lowest (most conservative) version across all targets that declare them. |
| 84 | + # This handles the "Automatic" target case where the exploit may end up running |
| 85 | + # against the lowest-versioned target at runtime. |
| 86 | + # |
| 87 | + # @return [Hash, nil] The RuntimeVersions hash from the active target, or nil. |
| 88 | + def current_target_runtime_versions |
| 89 | + return nil unless respond_to?(:target) && target |
| 90 | + |
| 91 | + # If the selected target explicitly declares RuntimeVersions, use those directly |
| 92 | + target_versions = target.opts['RuntimeVersions'] |
| 93 | + if target_versions.is_a?(Hash) && !target_versions.empty? |
| 94 | + return target_versions |
| 95 | + end |
| 96 | + |
| 97 | + # Only compute the lowest common denominator for targets that are explicitly |
| 98 | + # automatic (i.e., have no RuntimeVersions and are flagged as auto or named "Automatic"). |
| 99 | + # This avoids incorrectly triggering the fallback for non-auto targets that simply |
| 100 | + # haven't been annotated with RuntimeVersions yet. |
| 101 | + is_auto_target = target.opts['auto'] || target.name =~ /Automatic/i |
| 102 | + return nil unless is_auto_target |
| 103 | + |
| 104 | + # For automatic targets, compute the lowest version across all other targets |
| 105 | + # that declare RuntimeVersions. This represents the worst-case scenario at runtime. |
| 106 | + return nil unless respond_to?(:targets) && targets.is_a?(Array) |
| 107 | + |
| 108 | + lowest_versions = {} |
| 109 | + targets.each do |t| |
| 110 | + rt = t.opts['RuntimeVersions'] |
| 111 | + next unless rt.is_a?(Hash) |
| 112 | + |
| 113 | + rt.each do |runtime, version| |
| 114 | + ver = to_version(version) |
| 115 | + if lowest_versions[runtime].nil? || ver < lowest_versions[runtime] |
| 116 | + lowest_versions[runtime] = ver |
| 117 | + end |
| 118 | + end |
| 119 | + end |
| 120 | + |
| 121 | + lowest_versions.empty? ? nil : lowest_versions |
| 122 | + end |
| 123 | + |
| 124 | + # Retrieve MinimumVersions from a payload instance. |
| 125 | + # |
| 126 | + # @param payload_instance [Msf::Payload] The payload to inspect. |
| 127 | + # @return [Hash, nil] The MinimumVersions hash with OS names as the keys, or nil. |
| 128 | + def payload_minimum_versions(payload_instance) |
| 129 | + payload_instance.instance_variable_get(:@module_info)&.dig('MinimumVersions') |
| 130 | + end |
| 131 | +end |
0 commit comments