add compat check to msftidy

[h00die]

As per discussion here implements a rudimentary check on meterpreter compatibilities.

Also includes a check for attack.mitre.org URLs and suggests using the ATT&CK type instead.

Of note, this will not check if any included libraries

Verification

• tools/dev/msftidy.rb modules/ | grep "Missing Module Compat"
• tools/dev/msftidy.rb modules/ | grep "ATT&CK"

[h00die]

$ tools/dev/msftidy.rb modules/ | grep "ATT&CK"
modules/post/windows/manage/install_python.rb - [WARNING] Please use 'ATT&CK' for 'https://attack.mitre.org/techniques/T1064/'

[h00die]

$ tools/dev/msftidy.rb modules/ | grep "Missing Module Compat"
modules/exploits/linux/http/froxlor_log_path_rce.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/linux/http/raspberrymatic_unauth_rce_cve_2024_24578.rb - [INFO] Missing Module Compat for stdapi_sys_process_execute but uses .sys.process.execute
modules/exploits/linux/http/zyxel_parse_config_rce.rb - [INFO] Missing Module Compat for stdapi_sys_process_execute but uses .sys.process.execute
modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb - [INFO] Missing Module Compat for stdapi_sys_process_execute but uses .sys.process.execute
modules/exploits/linux/local/saltstack_salt_minion_deployer.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/multi/http/qdpm_upload_exec.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/multi/http/webpagetest_upload_exec.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.rb - [INFO] Missing Module Compat for stdapi_sys_process_execute but uses .sys.process.execute
modules/exploits/windows/http/avaya_ccr_imageupload_exec.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/windows/http/cyclope_ess_sqli.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/windows/http/solarwinds_storage_manager_sql.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/windows/http/umbraco_upload_aspx.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/windows/http/umbraco_upload_aspx.rb - [INFO] Missing Module Compat for stdapi_fs_search but uses .fs.file.search
modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb - [INFO] Missing Module Compat for stdapi_fs_search but uses .fs.file.search
modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb - [INFO] Missing Module Compat for stdapi_sys_config_getuid but uses .sys.config.getuid
modules/exploits/windows/local/cve_2022_26904_superprofile.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/local/cve_2022_26904_superprofile.rb - [INFO] Missing Module Compat for stdapi_sys_process_kill but uses .sys.process.kill
modules/exploits/windows/local/cve_2024_30085_cloud_files.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/local/cve_2024_30085_cloud_files.rb - [INFO] Missing Module Compat for stdapi_sys_process_execute but uses .sys.process.execute
modules/exploits/windows/local/cve_2024_30088_authz_basep.rb - [INFO] Missing Module Compat for stdapi_sys_process_thread_create but uses .thread.create
modules/exploits/windows/local/cve_2024_35250_ks_driver.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/local/cve_2024_35250_ks_driver.rb - [INFO] Missing Module Compat for stdapi_sys_process_execute but uses .sys.process.execute
modules/exploits/windows/mysql/scrutinizer_upload_exec.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/exploits/windows/persistence/accessibility_features_debugger.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/persistence/assistive_technology.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/persistence/service.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/persistence/startup_folder.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/persistence/task_scheduler.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/exploits/windows/persistence/time_provider.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/payloads/singles/cmd/windows/reverse_powershell.rb - [INFO] Missing Module Compat for core_channel_open but uses .net.socket
modules/post/windows/gather/credentials/moba_xterm.rb - [INFO] Missing Module Compat for stdapi_sys_process_memory_allocate but uses .memory.allocate
modules/post/windows/gather/credentials/moba_xterm.rb - [INFO] Missing Module Compat for stdapi_sys_process_memory_write but uses .memory.write
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_fs_delete_file but uses .fs.file.rm
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_fs_stat but uses .fs.file.stat
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_railgun_api but uses .railgun.kernel32
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_railgun_memread but uses .railgun.memread
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_sys_config_getuid but uses .sys.config.getuid
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_sys_config_sysinfo but uses .sys.config.sysinfo
modules/post/windows/gather/enum_browsers.rb - [INFO] Missing Module Compat for stdapi_sys_process_kill but uses .sys.process.kill
modules/post/windows/gather/enum_chrome.rb - [INFO] Missing Module Compat for stdapi_railgun_memread but uses .railgun.memread
modules/post/windows/gather/memory_dump.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/post/windows/manage/inject_host.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv
modules/post/windows/manage/remove_host.rb - [INFO] Missing Module Compat for stdapi_sys_config_getenv but uses .sys.config.getenv

[h00die]

ping @dledda-r7 since we had talked about this

[h00die]

Also, is there a definitive list of items? I just grabbed some out of modules I found, but there must be a better way to generate this.

[dledda-r7]

Also, is there a definitive list of items? I just grabbed some out of modules I found, but there must be a better way to generate this.

About the list, I could be wrong but i think there is auto-generated from lib/rex/post/meterpreter/extensions/<extension>/command_ids.rb where the command id are stated as

COMMAND_ID_STDAPI_RAILGUN_API = EXTENSION_ID_STDAPI + 28

so the it becomes stdapi_railgun_api.

[dledda-r7]

I have no idea if there is a way to make this "smarter", the problem is that there you are not catching mixins etc... not sure how doable it is