Adds SSL support to the postgres_login module #20517
Draft
+115
−22
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cgranleese-r7
force-pushed
the
adds-postgres-ssl-support
branch
2 times, most recently
from
09e9629 to
63cccde
Compare
adfoster-r7
reviewed
Sep 4, 2025
adfoster-r7
reviewed
Sep 4, 2025
adfoster-r7
reviewed
Sep 4, 2025
| if response == 'S' | ||
| ssl_context = OpenSSL::SSL::SSLContext.new | ||
| ssl_socket = OpenSSL::SSL::SSLSocket.new(@conn, ssl_context) | ||
| ssl_socket.sync_close = true |
There was a problem hiding this comment.
Is there any context on why this is needed? 👀
There was a problem hiding this comment.
https://ruby-doc.org/stdlib-2.6.1//libdoc/openssl/rdoc/OpenSSL/SSL/SSLSocket.html
sync_close[RW]
Whether to close the underlying socket as well, when the SSL/TLS connection is shut down. This defaults to false.
I assumed this was required to sync that the Rex socket would be closed together.
adfoster-r7
reviewed
Sep 4, 2025
adfoster-r7
reviewed
Sep 4, 2025
cgranleese-r7
force-pushed
the
adds-postgres-ssl-support
branch
from
63cccde to
e603880
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds SSL support to the
postgres_loginmodule. This was spotted as part of a separate issue, then I couldn't think of a reason why the module shouldn't have SSL support to be more in line with our other login scanners.Verification
List the steps needed to make sure this thing works
msfconsoleuse scanner/postgres/postgres_loginssl=trueis set that we seeChange Cipher Specas part of our Wireshark packets when filtering by that string