Metasploit-framework: incompatibility with ruby 2.4 (various problems)

Created on 11 Jan 2017  路  31Comments  路  Source: rapid7/metasploit-framework

Steps to reproduce

Running metasploit with ruby 2.4 fails because of incompatibilities in the locked dependencies.

Expected behavior

Metasploit should also work with ruby 2.4.

Current behavior

There are multiple problems when trying to use with ruby 2.4.
The first one is the json gem, that ca be temporarily worked around by using the 1.8 branch via git, an issue is already open here: https://github.com/flori/json/issues/308
However that uncovers more problems like incompatibility with activesupport 4.2.7.1:

/opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:121: warning: constant ::Fixnum is deprecated
/opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:121: warning: constant ::Bignum is deprecated
/opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:124:in `block (2 levels) in <class:Numeric>': stack level too deep (SystemStackError)
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
    from /opt/metasploit/vendor/bundle/ruby/2.4.0/gems/activesupport-4.2.7.1/lib/active_support/core_ext/numeric/conversions.rb:131:in `block (2 levels) in <class:Numeric>'
     ... 4680 levels...
    from /opt/metasploit/lib/metasploit/framework/command/base.rb:69:in `parsed_options'
    from /opt/metasploit/lib/metasploit/framework/command/base.rb:47:in `require_environment!'
    from /opt/metasploit/lib/metasploit/framework/command/base.rb:81:in `start'
    from /opt/metasploit/msfconsole:48:in `<main>'

System stuff

Metasploit version

Latest release 4.13.13 from github.

I installed Metasploit with:

Source install (ruby 2.4) using bundler to run with exact gems from Gemfile.lock

OS

Latest ArchLinux using ruby 2.4 (note that, as on some other distros too, there is only ruby 2.4 with no legacy version).

picture anthraxx
👍4 😕1

Most helpful comment

well, because I'm the package maintainer and package metasploit for Arch Linux so its installable easily from the package manager.... and has to use the system ruby for that.

picture anthraxx on 12 Jan 2017
👍3

All 31 comments

Why aren't you using RVM or rbenv? We're not on 2.4 yet.

wvu-r7 picture wvu-r7 on 12 Jan 2017

well, because I'm the package maintainer and package metasploit for Arch Linux so its installable easily from the package manager.... and has to use the system ruby for that.

anthraxx picture anthraxx on 12 Jan 2017
👍3

If I'm not mistaken, rails doesn't support 2.4 until rails 5, so none of the active* deps will work without a bunch of upgrade work. It will have to happen eventually, but we probably won't be able to prioritize it for a while yet.

In the mean time, you can work around this by using a compatible ruby through rvm or rbenv

egypt picture egypt on 12 Jan 2017

Well I can't as mentioned, that would basically mean it won't work from the package manager on Arch Linux until its resolved :cry:

anthraxx picture anthraxx on 12 Jan 2017

Ahh, you're the package maintainer for Metasploit. On Arch. I'm sorry. :(

wvu-r7 picture wvu-r7 on 12 Jan 2017
😄1

@anthraxx Ah, I hadn't seen your earlier response. That's unfortunate. Is it possible to add a ruby 2.3 package for backwards compatibility?

egypt picture egypt on 12 Jan 2017

@anthraxx feel free to pitch in with the upgrade to Rails 5 if you would like to move Metasploit to Ruby 2.4 right now.

In the mean time, it looks like the Rails community is backporting 2.4 support, but it will take time. It doesn't happen for free.

busterb picture busterb on 12 Jan 2017

How about AUR, @anthraxx? It's been a while since I've run Arch, but I did find this: https://aur.archlinux.org/packages/ruby2.3/.

wvu-r7 picture wvu-r7 on 12 Jan 2017

fyi: I also got gem install errors on other ruby based projects when trying to build nokogiri because of the removed FixNum and BigInteger. So this can maybe also cause problems if it's not fixed yet.

FireFart picture FireFart on 12 Jan 2017

@wvu-r7 well i can make it work locally with AUR, but thats custom user content and does not help for our official binary repos... so locally i can of cause also use rvm or rbenv :laughing:
I will see if i can temporarily move ruby2.3 into the binary repos, but for us that's really ugly and the last resort. Thanks all for your feedbacks, appreciated.
AFAIK rails and other stuff are indeed backporting 2.4 support so lets see step by step how we can progress on this by bumping dependencies as it goes.

anthraxx picture anthraxx on 12 Jan 2017

json released version 1.8.5 with ruby-2.4 support. Please bump the version in Gemgile.lock.

anatol picture anatol on 12 Jan 2017

the json bump will happen automatically in about 27 hours.

bcook-r7 picture bcook-r7 on 12 Jan 2017

glad you guys are working on this.. my distro install broke. Cant wait to get changes from upstream thanks <3

r3k2 picture r3k2 on 13 Jan 2017

I ran into the same issue. Just upgraded my Arch to the latest build with Ruby 2.4 getting the activesupport Gem to fail with latest metasploit-framework (bleeding edge). Any workaround (that doesn't invole installing some older Ruby packages via AUR)?

Any suggestion is appraciated!

wneessen picture wneessen on 16 Jan 2017

@wneessen you can give a test with this PR https://patch-diff.githubusercontent.com/raw/rapid7/metasploit-framework/pull/7819.patch but it may still contain problems... be an early tester and report issues back to the PR :smiley_cat:

anthraxx picture anthraxx on 16 Jan 2017

@anthraxx When the issue with ruby 2.4 gonna be fixed?

Auxilus picture Auxilus on 9 Feb 2017

@anthraxx how do I use that .Patch file?

Auxilus picture Auxilus on 9 Feb 2017

We are entirely dependent on code outside of our control being updated first. See #7819 for a list of upstream projects to pester^H^H^H^H^H^persuade into merging Ruby 2.4 support.

busterb picture busterb on 9 Feb 2017

If you're getting antsy, grab https://raw.githubusercontent.com/bcook-r7/metasploit-framework/c5d435fbf5d943d90d500d4459f92f78f11d1c4c/Gemfile and replace your current Gemfile with it. Then run 'bundle update.

busterb picture busterb on 9 Feb 2017

Alternately, use rvm to install Ruby 2.3.3 for now. It supports just about every distribution under the sun.

busterb picture busterb on 9 Feb 2017

How do I do that?
Please walk me through...
I'd appreciate if give me path of command
So that I can execute them one by one ...

Auxilus picture Auxilus on 9 Feb 2017

And how do I do that all in an app called termux?
Do I have to clone entire repository for that ?
Or is there a way around ?

Auxilus picture Auxilus on 9 Feb 2017

Well, this isn't really a support channel, and I think you're going to have rouble if you're not really even sure how to use a terminal emulator. Maybe hop on #metasploit

busterb picture busterb on 9 Feb 2017

Hop on #metasploit, we'll help you out.

busterb picture busterb on 9 Feb 2017

Thanks

Auxilus picture Auxilus on 9 Feb 2017

No, he means you should hop on the #metasploit IRC channel

wneessen picture wneessen on 9 Feb 2017

Btw. @anthraxx. The patch didn't work for me. But as I needed a working installation quickly, I was able to "downgrade" to 2.3 using RVM

wneessen picture wneessen on 9 Feb 2017

Any news on this?

r3k2 picture r3k2 on 20 Feb 2017

need learn metasploit on termux
im just have termux
i dont have pc/notbook/ or computer device
please help me build metasploit on termux

nethunter007 picture nethunter007 on 8 Apr 2017

well, ruby 2.4 support landed last week. For termux, you need to work with the developer of that distribution to build metasploit packages, since we need more than just ruby 2.4. See https://github.com/termux/termux-packages

busterb picture busterb on 8 Apr 2017

Well I've been using metasploit on termux for more than 2 months ... You have to compile it from source...Gem installation will fail for nokogiri and network-interface which you can fix by checking respective issues on https://github.com/termux/termux-packages/issues

Auxilus picture Auxilus on 9 Apr 2017
Was this page helpful?
0 / 5 - 0 ratings

Related issues

wvu-r7 picture wvu-r7  路  3Comments
handsomebeast picture handsomebeast  路  3Comments
wvu-r7 picture wvu-r7  路  3Comments
ejholmes picture ejholmes  路  3Comments
Acidical picture Acidical  路  3Comments