mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-11-12 11:52:01 +01:00
Allow local_editor in cmd_edit to take arguments
Such as vim -i NONE. This may allow command injection via arguments. However, you can already start an arbitrary program by setting LocalEditor or escaping the editor. msf > setg LocalEditor /bin/sh LocalEditor => /bin/sh msf > edit -i [*] Launching /bin/sh -i $
This commit is contained in:
parent
234ef5627e
commit
0a1eea9860
@ -92,7 +92,7 @@ module Msf
|
||||
end
|
||||
|
||||
print_status("Launching #{editor} #{path}")
|
||||
system(editor, path)
|
||||
system(*editor.split, path)
|
||||
|
||||
# XXX: This will try to reload *any* .rb and break on modules
|
||||
if args.length > 0 && path.end_with?('.rb')
|
||||
|
Loading…
Reference in New Issue
Block a user