Update dns resolution for socks proxies #19683
Draft
+199
−47
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
adfoster-r7
force-pushed
the
update-dns-resolution-for-socks-proxies
branch
3 times, most recently
from
bb3d05c to
2c78d21
Compare
adfoster-r7
commented
Dec 2, 2024
lib/msf/core/opt_proxies.rb
Outdated
There was a problem hiding this comment.
Will extract out to a separate PR; I noticed it's possible to assign invalid values to the proxies datastore option. This should tighten things up, but the UX still isn't great IMO
smcintyre-r7
reviewed
Dec 2, 2024
lib/msf/core/rhosts_walker.rb
Outdated
| # @return [Boolean] True if DNS resolution should be performed the RHOST values, false otherwise | ||
| def perform_dns_resolution?(datastore) | ||
| # If a socks proxy has been configured, don't perform DNS resolution - so that it instead happens via the proxy | ||
| !(datastore['PROXIES'].to_s.include?(Rex::Socket::Proxies::ProxyType::SOCKS4) || datastore['PROXIES'].to_s.include?(Rex::Socket::Proxies::ProxyType::SOCKS5)) |
There was a problem hiding this comment.
It's probably time we differentiate between SOCKS4 and SOCKS4A since 4 doesn't support hostnames while 4A and 5 do and that's what we're doing here.
There was a problem hiding this comment.
Let's do HTTP and socks5; and we can circle back to implementing socks4a if that comes up (as we explicitly resolve locally in rex-socket with the current implementation), similarly with the SAPNI support
adfoster-r7
force-pushed
the
update-dns-resolution-for-socks-proxies
branch
3 times, most recently
from
a7c53a7 to
0a41f51
Compare
adfoster-r7
force-pushed
the
update-dns-resolution-for-socks-proxies
branch
from
0a41f51 to
452a386
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Improves #19641
Requires rapid7/rex-socket#69
Update dns resolution for socks proxies. Now local DNS resolution will be skipped on the host machine and deferred to any configured socks proxies, i.e. with
setg proxies socks5:127.0.0.1:1080Verification
Ensure CI passes