Metasploit-framework: Failed to load homemade module

Created on 23 Jan 2020 · 12Comments · Source: rapid7/metasploit-framework

Steps to reproduce

Hello, I am new to metasploit module development, I am making a module to test for SSRF on web servers, I wrote the base of the of the module and loaded put metasploit. After loading up metasploit it said
"[-] WARNING! The following modules could not be loaded!
[-] /usr/share/metasploit-framework/modules/auxiliary/scanner/ssrf/ssrf_scanner.rb"
then i decided to check the framework.log file and it says

"[01/23/2020 05:59:06] [e(0)] core: /usr/share/metasploit-framework/modules/auxiliary/scanner/ssrf/ssrf_scanner.rb failed to load due to the following error: SyntaxError /usr/share/metasploit-framework/modules/auxiliary/scanner/ssrf/ssrf_scanner.rb:40: syntax error, unexpected end-of-input, expecting keyword_end Call stack: /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:51:in module_eval' /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:51:inmodule_eval_with_lexical_scope' /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:140:in block in load_module' /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:559:innamespace_module_transaction' /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:178:in load_module' /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:246:inblock in load_modules' /usr/share/metasploit-framework/lib/msf/core/modules/loader/directory.rb:49:in block (2 levels) in each_module_reference_name' /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/rex-core-0.1.13/lib/rex/file.rb:133:inblock in find' /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/rex-core-0.1.13/lib/rex/file.rb:132:in catch' /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/rex-core-0.1.13/lib/rex/file.rb:132:infind' /usr/share/metasploit-framework/lib/msf/core/modules/loader/directory.rb:40:in block in each_module_reference_name' /usr/share/metasploit-framework/lib/msf/core/modules/loader/directory.rb:30:inforeach' /usr/share/metasploit-framework/lib/msf/core/modules/loader/directory.rb:30:in each_module_reference_name' /usr/share/metasploit-framework/lib/msf/core/modules/loader/base.rb:245:inload_modules' /usr/share/metasploit-framework/lib/msf/core/module_manager/loading.rb:135:in block in load_modules' /usr/share/metasploit-framework/lib/msf/core/module_manager/loading.rb:133:ineach' /usr/share/metasploit-framework/lib/msf/core/module_manager/loading.rb:133:in load_modules' /usr/share/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:41:inblock in add_module_path' /usr/share/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:40:in each' /usr/share/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:40:inadd_module_path' /usr/share/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:50:in block in init_module_paths' /usr/share/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:49:ineach' /usr/share/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:49:in init_module_paths' /usr/share/metasploit-framework/lib/msf/ui/console/driver.rb:161:ininitialize' /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:62:in new' /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:62:indriver' /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in start' /usr/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:instart' /usr/bin/msfconsole:49:in `

INFO

I am running kali linux 2019.4, and i installed metasploit via APT
My metasploit version is metasploit v5.0.66-dev

Any help would be amazing. Thank you!

question

Source

THEpWn3R-o

Most helpful comment

Thank you both so much! I finally got the module to run! I am sorry for me being a noob at this, i am still learning ruby and how to make modules for metasploit. Once again thank you!!
Screenshot from 2020-01-23 21-48-17

THEpWn3R-o on 24 Jan 2020

🎉2 ❤1

All 12 comments

You have a syntax error in /usr/share/metasploit-framework/modules/auxiliary/scanner/ssrf/ssrf_scanner.rb around line 40. The interpreter is expecting end, but didn't find it. Perhaps the syntax on a preceding line was not properly terminated, or perhaps you simply need to add end somewhere.

bcoles on 23 Jan 2020

I added a end to one of the if statements I forgot to add, but it resulted in this response when i went to reload the modules

[*] Reloading modules from all module paths...
[-] Error while running command reload_all: wrong number of arguments (given 3, expected 1..2)

Call stack:
/usr/share/metasploit-framework/modules/auxiliary/scanner/ssrf/ssrf_scanner.rb:23:in []' /usr/share/metasploit-framework/modules/auxiliary/scanner/ssrf/ssrf_scanner.rb:23:ininitialize'
/usr/share/metasploit-framework/lib/msf/core/module_set.rb:54:in new' /usr/share/metasploit-framework/lib/msf/core/module_set.rb:54:increate'
/usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:61:in block (3 levels) in refresh_metadata' /usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:57:ineach'
/usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:57:in block (2 levels) in refresh_metadata' /usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:54:ineach'
/usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:54:in block in refresh_metadata' /usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:51:insynchronize'
/usr/share/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:51:in refresh_metadata' /usr/share/metasploit-framework/lib/msf/core/module_manager/cache.rb:124:inrefresh_cache_from_module_files'
/usr/share/metasploit-framework/lib/msf/core/module_manager/reloading.rb:51:in reload_modules' /usr/share/metasploit-framework/lib/msf/ui/console/command_dispatcher/modules.rb:859:incmd_reload_all'
/usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:523:in run_command' /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:474:inblock in run_single'
/usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:in each' /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:468:inrun_single'
/usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:158:in run' /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:48:instart'
/usr/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in start' /usr/bin/msfconsole:49:in

THEpWn3R-o on 23 Jan 2020

Okay, so i shutdown metasploit and started it back up and it says the module has loaded but it doesn't show up while i am searching for modules. But i tried to just enter it directly and it returns

msf5 > use auxiliary/scanner/ssrf/ssrf_scanner
[-] Error while running command use: wrong number of arguments (given 3, expected 1..2)

THEpWn3R-o on 23 Jan 2020

You are calling functionality that takes 1-2 arguments with 3 arguments instead.

wvu-r7 on 24 Jan 2020

I fixed what i thought it could be, but it is still throwing the error, here is the script

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
    include Msf::Auxiliary::Nmap

    def initialize(info = {})
    super(update_info(info,
      'Name'           => 'SSRF scanner',
      'Description'    => %q{
        This module will try to determine if a server is vulnerable to SSRF
      },
      'Author'         => [ 'thepwn3r' ],
      'License'        => MSF_LICENSE
    ))
    register_options(
        [
          OptString.new('TARGETURL', [true, 'The URL to test', 'www.example.com']),
          OptInt.new('RPORT', [false, 'Port webserver is running on', 80]),
          OptBool.new('ForceRun'[false, 'force the scanner to run even if nmap doesnt see a webserver', false]),
        ])
    end

  def nmap_check
    print_status("running check with nmap")

    nmap_run("-p#{datastore['RPORT']} -Pn #{datastore['TARGETURL']}")

    if nmap_host().include? '80/tcp open  http'
        puts 'Looks like a webserver is detected, procceding'
    else 
        puts 'No webserver detected, to continue turn ForceRun to true'
    end
  end

end

{ I know it bad & bare, but I'm still learning and testing so please me patient with me. Thank you. }

THEpWn3R-o on 24 Jan 2020

nmap_run takes no args:

https://github.com/rapid7/metasploit-framework/blob/a60b44c0edcb3e45efdd90f6e2392e2600909083/lib/msf/core/auxiliary/nmap.rb#L90

nmap_host doesn't exist, but nmap_hosts does, and it takes a block:

https://github.com/rapid7/metasploit-framework/blob/a60b44c0edcb3e45efdd90f6e2392e2600909083/lib/msf/core/auxiliary/nmap.rb#L239

wvu-r7 on 24 Jan 2020

okay so i did some reading up, i just want to know if i have the syntax right. would it be
def namp_hosts(&80/tcp open http) ? Or would it still have the .include? method

THEpWn3R-o on 24 Jan 2020

wvu@kharak:/rapid7/metasploit-framework:master$ git grep nmap_hosts
lib/msf/core/auxiliary/nmap.rb:# the data yielded from nmap_hosts(). See auxiliary/scanner/oracle/oracle_login
lib/msf/core/auxiliary/nmap.rb:def nmap_hosts(&block)
modules/auxiliary/scanner/oracle/oracle_login.rb:      nmap_hosts {|type,data| process_nokogiri_callback(type,data)}
modules/auxiliary/scanner/oracle/oracle_login.rb:      nmap_hosts {|host| process_host(host)}
wvu@kharak:/rapid7/metasploit-framework:master$

Take a look at the last one.

Also, there are better ways to detect a web server than shelling out to Nmap to check if a port is open. Check out HttpClient.

wvu-r7 on 24 Jan 2020

Your code is missing a comma:

< OptBool.new('ForceRun'[false, 'force the scanner to run even if nmap doesnt see a webserver', false]),
---
> OptBool.new('ForceRun', [false, 'force the scanner to run even if nmap doesnt see a webserver', false]),

bcoles on 24 Jan 2020

THEpWn3R-o on 24 Jan 2020

🎉2 ❤1

Congrats! Keep on keeping on.

wvu-r7 on 24 Jan 2020

:+1:

THEpWn3R-o on 24 Jan 2020

Was this page helpful?

0 / 5 - 0 ratings