Skip to content

Fixes deprecation message logic when no data object present - #20561

Merged
adfoster-r7 merged 2 commits into
rapid7:masterfrom
cgranleese-r7:fixes-report-note-warning-when-no-data-key
Sep 24, 2025
Merged

Fixes deprecation message logic when no data object present#20561
adfoster-r7 merged 2 commits into
rapid7:masterfrom
cgranleese-r7:fixes-report-note-warning-when-no-data-key

Conversation

@cgranleese-r7

Copy link
Copy Markdown
Contributor

Fixes #20558.

With the previous implementation I added #19939 if no data object was present in the report_note method it would incorrectly return the deprecation message. Now a nil check has been added, so if data is not present it will not return the depreciation message.

Testing

Can be any target or module that make use of report_note. Below I will add what I used:

### Target

❯ docker run --platform linux/amd64 \
… ❯   -e "ACCEPT_EULA=Y" \
… ❯   -e "MSSQL_SA_PASSWORD=MyMSSQLServerPassword__<>" \
… ❯   -p 1433:1433 \
… ❯   mcr.microsoft.com/mssql/server:2022-latest

Module

admin/mssql/mssql_enum

Within the chosen module, comment out the data object from the report_note call:

    report_note(
      host: mssql_client.peerhost,
      proto: 'TCP',
      port: mssql_client.peerport,
      type: 'MSSQL_ENUM',
      # data: { version: sqlversion }
    )

Before

msf auxiliary(admin/mssql/mssql_enum) > run session=-1
[*] Running MS SQL Server Enumeration...
[*] Using existing session 1
[*] Version:
[*]	Microsoft SQL Server 2022 (RTM-CU18) (KB5050771) - 16.0.4185.3 (X64)
[*]		Feb 28 2025 18:24:49
[*]		Copyright (C) 2022 Microsoft Corporation
[*]		Developer Edition (64-bit) on Linux (Ubuntu 22.04.5 LTS) <X64>
[-] [DEPRECATION] Using report_note with a non-hash data value is deprecated, please raise a Github issue with this output.
[-] Call stack:
[-]   /Users/cgranleese/.rvm/gems/ruby-3.3.8@metasploit-framework/gems/activerecord-7.2.2.1/lib/active_record/connection_adapters/abstract/connection_pool.rb:415:in `with_connection'
[-]   /Users/cgranleese/code/metasploit-framework/lib/msf/core/db_manager/note.rb:81:in `report_note'
[-]   /Users/cgranleese/code/metasploit-framework/lib/metasploit/framework/data_service/proxy/note_data_proxy.rb:40:in `block in report_note'
[-]   /Users/cgranleese/code/metasploit-framework/lib/metasploit/framework/data_service/proxy/core.rb:164:in `data_service_operation'
[-]   /Users/cgranleese/code/metasploit-framework/lib/metasploit/framework/data_service/proxy/note_data_proxy.rb:38:in `report_note'
[-]   /Users/cgranleese/code/metasploit-framework/lib/msf/core/auxiliary/report.rb:185:in `report_note'
[-]   /Users/cgranleese/code/metasploit-framework/modules/auxiliary/admin/mssql/mssql_enum.rb:54:in `run'
[-]   /Users/cgranleese/code/metasploit-framework/lib/msf/base/simple/auxiliary.rb:180:in `job_run_proc'
[-]   /Users/cgranleese/code/metasploit-framework/lib/msf/base/simple/auxiliary.rb:87:in `run_simple'
[-]   /Users/cgranleese/code/metasploit-framework/lib/msf/base/simple/auxiliary.rb:98:in `run_simple'
[-]   /Users/cgranleese/code/metasploit-framework/lib/msf/ui/console/command_dispatcher/auxiliary.rb:66:in `cmd_run'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:582:in `run_command'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:531:in `block in run_single'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:525:in `each'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:525:in `run_single'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/shell.rb:165:in `block in run'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/shell.rb:309:in `block in with_history_manager_context'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/shell/history_manager.rb:35:in `with_context'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/shell.rb:306:in `with_history_manager_context'
[-]   /Users/cgranleese/code/metasploit-framework/lib/rex/ui/text/shell.rb:133:in `run'
[-]   /Users/cgranleese/code/metasploit-framework/lib/metasploit/framework/command/console.rb:54:in `start'
[-]   /Users/cgranleese/code/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
[-]   ./msfconsole:23:in `<main>'
[*] Configuration Parameters:
[*] 	C2 Audit Mode is Not Enabled
...
[*] Default Server Instance SQL Server Service is running under the privilege of:
[*] 	xp_regread might be disabled in this system
[*] Auxiliary module execution completed

After

msf auxiliary(admin/mssql/mssql_enum) > run session=-1
[*] Running MS SQL Server Enumeration...
[*] Using existing session 1
[*] Version:
[*]	Microsoft SQL Server 2022 (RTM-CU18) (KB5050771) - 16.0.4185.3 (X64)
[*]		Feb 28 2025 18:24:49
[*]		Copyright (C) 2022 Microsoft Corporation
[*]		Developer Edition (64-bit) on Linux (Ubuntu 22.04.5 LTS) <X64>[*] Configuration Parameters:
[*] 	C2 Audit Mode is Not Enabled
...
[*] Default Server Instance SQL Server Service is running under the privilege of:
[*] 	xp_regread might be disabled in this system
[*] Auxiliary module execution completed

Verification

  • Follow testing steps again and confirm before and after
  • Code change is sane
  • CI goes green

@cgranleese-r7 cgranleese-r7 added the rn-fix release notes fix label Sep 23, 2025
Comment thread lib/msf/core/db_manager/note.rb Outdated
Co-authored-by: cgranleese-r7 <69522014+cgranleese-r7@users.noreply.github.com>
@adfoster-r7
adfoster-r7 merged commit 40c32a2 into rapid7:master Sep 24, 2025
47 checks passed
@cgranleese-r7
cgranleese-r7 deleted the fixes-report-note-warning-when-no-data-key branch September 24, 2025 13:29
@cgranleese-r7

cgranleese-r7 commented Sep 24, 2025

Copy link
Copy Markdown
Contributor Author

Release Notes

Fixes a crash when running modules that reported notes with no data present, such as the admin/mssql/mssql_enum and scanner/http/wordpress_scanner modules

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

rn-fix release notes fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[DEPRECATION] Using report_note with a non-hash data value is deprecated, please raise a Github issue with this output.

2 participants