Module: Msf::WebServices::FrameworkExtension

Defined in:
lib/msf/core/web_services/framework_extension.rb

Overview

Extension provides a Metasploit Framework instance to a Sinatra application. The framework instance is stored with the setting name framework and is also accessible via the framework helper method. If the data service URL environment variable is set, then the framework instance will be configured to use the data service rather than the local database.

Environment Variables: MSF_WS_DATA_SERVICE_URL - The data service URL. MSF_WS_DATA_SERVICE_API_TOKEN - API token used to authenticate to the remote data service. MSF_WS_DATA_SERVICE_CERT - Certificate file matching the remote data server’s certificate.

Needed when using self-signed SSL certificates.

MSF_WS_DATA_SERVICE_SKIP_VERIFY - (Boolean) Skip validating authenticity of server’s certificate. MSF_WS_DATA_SERVICE_LOGGER - (String) The logger that framework will use. By default logs will be

placed in `~/.msf4/logs`

Defined Under Namespace

Modules: Helpers Classes: DataServiceError

Constant Summary collapse

FALSE_VALUES = 
[nil, false, 0, '0', 'f', 'false', 'off', 'no'].to_set

Class Method Summary collapse

Class Method Details

.db_connect(framework, app) ⇒ Object 



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'lib/msf/core/web_services/framework_extension.rb', line 65

def self.db_connect(framework, app)
  remote_data_service = !app.settings.data_service_url.nil? && !app.settings.data_service_url.empty?

  if remote_data_service
    options = {
      url: app.settings.data_service_url,
      api_token: app.settings.data_service_api_token,
      cert: app.settings.data_service_cert,
      skip_verify: app.settings.data_service_skip_verify
    }
    db_result = Msf::DbConnector.db_connect(framework, options)
  else
    db_result = Msf::DbConnector.db_connect_from_config(framework)
  end

  return unless db_result[:error]

  # A remote data service is only ever used because the operator named it, so a failed
  # connection is fatal. Continuing would leave the local database that Msf::DbConnector
  # requires as an Active Record prerequisite registered as the current data service,
  # silently serving and authenticating against a different backend than the one asked for.
  if remote_data_service
    raise DataServiceError, "Failed to connect to the configured data service " \
                            "#{app.settings.data_service_url}: #{db_result[:error]}"
  end

  # Without a configured data service a database is optional: module search, execution
  # and result polling are all held in memory, so a failed connection must not stop the
  # service from starting. Only the db.* RPC methods depend on it.
  elog("Web service failed to connect to the database: #{db_result[:error]}")
  warn "[!] Failed to connect to the database: #{db_result[:error]}\n" \
       '[!] Starting without database support - db.* RPC methods will be unavailable.'
end

.registered(app) ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/msf/core/web_services/framework_extension.rb', line 35

def self.registered(app)
  app.helpers FrameworkExtension::Helpers

  app.set :data_service_url, ENV.fetch('MSF_WS_DATA_SERVICE_URL', nil)
  app.set :data_service_api_token, ENV.fetch('MSF_WS_DATA_SERVICE_API_TOKEN', nil)
  app.set :data_service_cert, ENV.fetch('MSF_WS_DATA_SERVICE_CERT', nil)
  app.set :data_service_skip_verify, to_bool(ENV.fetch('MSF_WS_DATA_SERVICE_SKIP_VERIFY', false))

  @@framework = nil
  # Create simplified instance of the framework
  app.set :framework, (proc {
    @@framework ||= begin
      init_framework_opts = {
        'Logger' => ENV.fetch('MSF_WS_DATA_SERVICE_LOGGER', nil),
        # SkipDatabaseInit false is the default behavior, however for explicitness - note that framework first
        # connects to a local database as a pre-requisite to connecting to a remote service to correctly
        # configure active record
        'SkipDatabaseInit' => false
      }
      framework = Msf::Simple::Framework.create(init_framework_opts)
      Msf::WebServices::FrameworkExtension.db_connect(framework, app)

      framework
    end
  })
end