Allow local_editor in cmd_edit to take arguments

Such as vim -i NONE. This may allow command injection via arguments.
However, you can already start an arbitrary program by setting
LocalEditor or escaping the editor.

msf > setg LocalEditor /bin/sh
LocalEditor => /bin/sh
msf > edit -i
[*] Launching /bin/sh -i
$
MS-2855/keylogger-mettle-extension
William Vu 2017-12-14 19:21:33 -06:00
parent 234ef5627e
commit 0a1eea9860
1 changed files with 1 additions and 1 deletions

View File

@ -92,7 +92,7 @@ module Msf
end
print_status("Launching #{editor} #{path}")
system(editor, path)
system(*editor.split, path)
# XXX: This will try to reload *any* .rb and break on modules
if args.length > 0 && path.end_with?('.rb')