Arch Linux

greengold

Member

Registered: 2010-01-30

Posts: 199

Metasploit DB connect

Hi all, back again...

Now I'm trying to get Metasploit working with database Surprisingly problem is with Ruby's adapter gems which shoul provide me connection to postgresql database.

So, I have installed rubby 1.9.3,  ruby-pg, postgresql-libs and I tried metasploit, metasploit-svn even metasploit from git.

Basically, I have followed this post.
I tried many gem combinatios, like this thread suggests.

now I have this gems installed:

$ gem list

*** LOCAL GEMS ***

activemodel (3.2.12)
activerecord (3.2.12)
activesupport (3.2.12)
arel (3.0.2)
bigdecimal (1.1.0)
builder (3.0.4)
i18n (0.6.1)
io-console (0.3)
json (1.5.4)
minitest (2.5.1)
msgpack (0.5.3, 0.4.7)
multi_json (1.6.1)
nokogiri (1.5.6)
pg (0.14.1)
rake (0.9.2.2)
rdoc (3.9.5)
ruby-pg (0.8.0)
sqlite3 (1.3.7)
tzinfo (0.3.35)
wirble (0.1.3)

but there's nothing but:

[-] Failed to connect to the database: Please install the postgresql adapter: `gem install activerecord-postgresql-adapter` (cannot load such file -- pg)

Please can you help me out, or provide me version that will just work?
This is pretty urgent.

Thanks for suggestions!

greengold

Member

Registered: 2010-01-30

Posts: 199

Re: Metasploit DB connect

ok, after installing metasploit .run package from official site problem is gone.

innocenceisdeath

Member

Registered: 2013-02-16

Posts: 3

Re: Metasploit DB connect

Well now metasploit isn't being managed by pacman, which isn't great.

The problem is with the pg gem.

In my opinion the best solution to make sure you have all the correct gems installed and working is the following:

Install metasploit-svn from the AUR: https://aur.archlinux.org/packages/metasploit-svn/
Install ruby-bundler from the AUR: https://aur.archlinux.org/packages/ruby-bundler/

$ cd /usr/src/metasploit
$ bundle config build.pg --with-pg-config=/usr/bin/pg_config
$ bundle install

This will install all the required gems for metasploit, and correctly configure pg, which was the cause of the issue you were having.
Make sure you have your gem executables in your path, this can be done temporarily with:

$ export PATH=$PATH:$(ruby -rubygems -e "puts Gem.user_dir")/bin

Hopefully it will now work.

greengold

Member

Registered: 2010-01-30

Posts: 199

Re: Metasploit DB connect

thank for your afford, innocenceisdeath!
but, sadly, this is not working for me...
too bad, there should be at least one 100% working version, or this gems should be bundled within PKGBUILD, because in this way metasploit is not much useful.

teekay

Member

Registered: 2011-10-26

Posts: 271

Re: Metasploit DB connect

The user who installed the gems and runs metasploit needs to be the same user.

You could also install the gems system-wide using "gem --no-user-install install ..." or by editing /etc/gemrc.

greengold

Member

Registered: 2010-01-30

Posts: 199

Re: Metasploit DB connect

guys, Im connected to database now, but Im getting this error from metasploit:

msf  auxiliary(apache_mod_isapi) > run

[-] Auxiliary failed: NoMethodError undefined method `o_i' for 80:Fixnum
[-] Call stack:
[-]   /opt/metasploit/apps/pro/msf3/modules/auxiliary/dos/http/apache_mod_isapi.rb:64:in `run'
[*] Auxiliary module execution completed
msf  auxiliary(apache_mod_isapi) >

Really, I have no idea what is this about and I dont know ruby. I tryed to install pg gem as a sudo, as a user and as innocenceisdeath is recommending too. Still the same...
also installing gems as system wide produces this:

$ gem --no-user-install install pg
ERROR:  Invalid option: --no-user-install.  See 'gem --help'.

I need to demonstrate some exploit for my diploma thesis but really metasploit is not working as expected at all.

Can you reccomend something?
Thank you!

Last edited by greengold (2013-03-04 18:22:41)

teekay

Member

Registered: 2011-10-26

Posts: 271

Re: Metasploit DB connect

My fault, --no-user-install is an option of gem install, of course

gem install --no-user-install ...

greengold

Member

Registered: 2010-01-30

Posts: 199

Re: Metasploit DB connect

I dont think that this may be caused by wrong user privileges... Main reason of that is I can connect do postgreSql dbs which rely on pg intf. I even can conect to it when I uninstall pg gem
really this is going over my top...

innocenceisdeath

Member

Registered: 2013-02-16

Posts: 3

Re: Metasploit DB connect

Take some time to actually read the error and try to comprehend the problem.

Really, I have no idea what is this about and I dont know ruby. I tryed to install pg gem as a sudo, as a user and as innocenceisdeath is recommending too. Still the same...
also installing gems as system wide produces this:

$ gem --no-user-install install pg
ERROR:  Invalid option: --no-user-install.  See 'gem --help'.

I need to demonstrate some exploit for my diploma thesis but really metasploit is not working as expected at all.

Can you reccomend something?
Thank you!

Metasploit is working fine, you've just had trouble installing it manually.

Why are you still messing around with ruby gems? You said you already got them working and the error doesn't indicate any dependency issues. You, don't need to install them system-wide as long as they are installed for whichever user is running Metasploit.

msf  auxiliary(apache_mod_isapi) > run

[-] Auxiliary failed: NoMethodError undefined method `o_i' for 80:Fixnum
[-] Call stack:
[-]   /opt/metasploit/apps/pro/msf3/modules/auxiliary/dos/http/apache_mod_isapi.rb:64:in `run'
[*] Auxiliary module execution completed
msf  auxiliary(apache_mod_isapi) >

It tells you right there the code is trying to call a method that doesn't exist. The issue isn't in your configuration, there is a bug in that module. I have submitted a bug report, but if you can't wait you can apply this patch to the module in question.

--- apache_mod_isapi.rb 2013-03-13 12:20:04.097819792 +0000
+++ apache_mod_isapi_fixed.rb   2013-03-13 12:20:32.194507241 +0000
@@ -61,7 +61,7 @@
        def run
 
                serverIP = datastore['RHOST']
-               if (datastore['RPORT'].o_i != 80)
+               if (datastore['RPORT'].to_i != 80)
                        serverIP += ":" + datastore['RPORT'].to_s
                end
                isapiURI = datastore['ISAPI']

The file that needs to be patched is /opt/metasploit/apps/pro/msf3/modules/auxiliary/dos/http/apache_mod_isapi.rb
Judging by the path you're still not actually running the SVN version.

greengold

Member

Registered: 2010-01-30

Posts: 199

Re: Metasploit DB connect

thanks!
I was messing with gems because, I tought, something is missing, or I have bad version of some gem if it cant find function.
I had tried svn version also, but I revert to official one. Now I can't exactly remember why, but Im sure there were problems.
I ended up with vmware with BackTrack running. but thanks for afford anyway.