Metasploit-framework: Metasploit compatibility with ruby 2.5

[anthraxx]

Steps to reproduce

Right now metasploit doesn't work with ruby 2.5 specifically because of used grpc version.

Expected behavior

Metasploit should be usable with ruby 2.5. It looks likr grpc 1.9.1 is build and published on rubygems for ruby 2.5. It would be nice to get a travisci rvm bump and grpc Gemfile.lock bump.

Current behavior

Gem::RuntimeRequirementNotMetError: grpc requires Ruby version < 2.5, >= 2.0. The current ruby version is 2.5.0.
An error occurred while installing grpc (1.8.3), and Bundler cannot continue.

System stuff

Metasploit version

Get this with the version command in msfconsole (or git log -1 --pretty=oneline for a source install).

I installed Metasploit with:

• [x] Source install (ruby 2.5)

OS

Arch Linux

[sempervictus]

If you update the relevant gem in your gemfile, does it pass spec testing? This is likely a deeper rabbit hole than one gem. Ping @busterb

[vendforce]

For arch users only, that are using ruby 2.5.0

Temporary work around , put it in your bashrc file

#### HIDE MSFCONSOLE DEPRECIATION WARNING

MSFOPTFILE=$(find / -type f -iname opt.rb -not -path "/*gems/*" -exec grep -q "msf\|Msf" {} \; -exec echo {} \;)
if grep -q -o "OpenSSL::SSL::SSLContext::METHODS" \
$MSFOPTFILE; then \
sed -i 's/OpenSSL::SSL::SSLContext::METHODS/[:TLSv1_2, :TLSv1_1, :TLSv1, :SSLv3, :SSLv23, :SSLv2]/' \
$MSFOPTFILE ; fi

MSFGEMFILE=$(find / -type f -iname Gemfile.lock -not -path "/*gems/*" -exec grep -q 'grpc ([0-9].[0-9].[0-9])' {} \; -exec echo {} \;)
if grep -q -o "grpc (1.8.3)" \
$MSFGEMFILE ; then \
sed -i 's/grpc (1.8.3)/grpc (1.9.1)/' \
$MSFGEMFILE ; fi

Everytime you do msfupdate just reload your terminal and the warnings will not come up

To speed up the loading of bash prompt, change

MSFGEMFILE=$(find / -type f -iname Gemfile.lock -not -path "/*gems/*" -exec grep -q 'grpc ([0-9].[0-9].[0-9])' {} \; -exec echo {} \;)
MSFOPTFILE=$(find / -type f -iname opt.rb -not -path "/*gems/*" -exec grep -q "msf\|Msf" {} \; -exec echo {} \;)

To

MSFOPTFILE="your location of (metasploit folder)/lib/msf/core/opt.rb"
MSFGEMFILE="your location of Gemfile.lock in metasploit folder"

[sempervictus]

I'd be careful with _find /_ with TBs of data on systems, which can be compressed and deduplicated may not be taken kindly. Might wanna go with /opt/m* or something slightly more narrow.
The ruby thing on Arch is pathological, I use it all over... RVM and friends were made for this sort of thing, and its why Pro carries its own bins.

[vendforce]

Thanks for your input, yes I agree to a certain extent, I was just giving that example in case someone cloned it into some other folder than /opt

But in saying that using find and greping the extact match should'nt give any other file , than the one that is unique to metasploit same with the opt file if you can prove otherwise I will accept your responce

but yes the better approach would be delare MSFOPTFILE & MSFGEMFILE to the exact file locations for that user

Regarding rvm , I personally dont want to have to change or have muliple versions of ruby I would rather use the latest stable version after all why bother using arch if your not running the latest , so until metasploit are in line with the latest stable ruby and gems I'll just find a way around it. If other people want to use rvm or others there free to do so.I just replied to give anthraxx a work around, whether he chooses to use it or not thats up to him

But your reply and comments are appreciated thanks

[vendforce]

I'd be careful with find / with TBs of data on systems, which can be compressed and deduplicated may not be taken kindly

I've added an exclude gems folder option to the find command to make sure it will be taken kindly

[anthraxx]

btw grpc 1.10.0 still works perfectly fine, not just for me but lots of users. i don't see anything holding up a bump.

[anthraxx]

works good especially via #9762