Allow local_editor in cmd_edit to take arguments
Such as vim -i NONE. This may allow command injection via arguments. However, you can already start an arbitrary program by setting LocalEditor or escaping the editor. msf > setg LocalEditor /bin/sh LocalEditor => /bin/sh msf > edit -i [*] Launching /bin/sh -i $MS-2855/keylogger-mettle-extension
parent
234ef5627e
commit
0a1eea9860
|
@ -92,7 +92,7 @@ module Msf
|
|||
end
|
||||
|
||||
print_status("Launching #{editor} #{path}")
|
||||
system(editor, path)
|
||||
system(*editor.split, path)
|
||||
|
||||
# XXX: This will try to reload *any* .rb and break on modules
|
||||
if args.length > 0 && path.end_with?('.rb')
|
||||
|
|
Loading…
Reference in New Issue