dstruct 0.0.1

data/lib/rex/random_identifier_generator.rb

@@ -0,0 +1,177 @@
+# -*- coding: binary -*-
+
+# A quick way to produce unique random strings that follow the rules of
+# identifiers, i.e., begin with a letter and contain only alphanumeric
+# characters and underscore.
+#
+# The advantage of using this class over, say, {Rex::Text.rand_text_alpha}
+# each time you need a new identifier is that it ensures you don't have
+# collisions.
+#
+# @example
+#   vars = Rex::RandomIdentifierGenerator.new
+#   asp_code = <<-END_CODE
+#     Sub #{vars[:func]}()
+#       Dim #{vars[:fso]}
+#       Set #{vars[:fso]} = CreateObject("Scripting.FileSystemObject")
+#       ...
+#     End Sub
+#     #{vars[:func]}
+#   END_CODE
+#
+class Rex::RandomIdentifierGenerator
+
+  # Raised when a RandomIdentifierGenerator cannot create any more
+  # identifiers without collisions.
+  class ExhaustedSpaceError < StandardError; end
+
+  # Default options
+  DefaultOpts = {
+    # Arbitrary
+    :max_length => 12,
+    :min_length => 3,
+    # This should be pretty universal for identifier rules
+    :char_set => Rex::Text::AlphaNumeric+"_",
+    :first_char_set => Rex::Text::LowerAlpha
+  }
+
+  # @param opts [Hash] Options, see {DefaultOpts} for default values
+  # @option opts :max_length [Fixnum]
+  # @option opts :min_length [Fixnum]
+  # @option opts :char_set [String]
+  def initialize(opts={})
+    # Holds all identifiers.
+    @value_by_name = {}
+    # Inverse of value_by_name so we can ensure uniqueness without
+    # having to search through the whole list of values
+    @name_by_value = {}
+
+    @opts = DefaultOpts.merge(opts)
+    if @opts[:min_length] < 1 || @opts[:max_length] < 1 || @opts[:max_length] < @opts[:min_length]
+      raise ArgumentError, "Invalid length options"
+    end
+
+    # This is really just the maximum number of shortest names. This
+    # will still be a pretty big number most of the time, so don't
+    # bother calculating the real one, which will potentially be
+    # expensive, since we're talking about a 36-digit decimal number to
+    # represent the total possibilities for the range of 10- to
+    # 20-character identifiers.
+    #
+    # 26 because the first char is lowercase alpha, (min_length - 1) and
+    # not just min_length because it includes that first alpha char.
+    @max_permutations = 26 * (@opts[:char_set].length ** (@opts[:min_length]-1))
+    # The real number of permutations could be calculated thusly:
+    #((@opts[:min_length]-1) .. (@opts[:max_length]-1)).reduce(0) { |a, e|
+    #	a + (26 * @opts[:char_set].length ** e)
+    #}
+  end
+
+  # Returns the @value_by_name hash
+  #
+  # @return [Hash]
+  def to_h
+    return @value_by_name
+  end
+
+  # Return a unique random identifier for +name+, generating a new one
+  # if necessary.
+  #
+  # @param name [Symbol] A descriptive, intention-revealing name for an
+  #   identifier. This is what you would normally call the variable if
+  #   you weren't generating it.
+  # @return [String]
+  def get(name)
+    return @value_by_name[name] if @value_by_name[name]
+
+    @value_by_name[name] = generate
+    @name_by_value[@value_by_name[name]] = name
+
+    @value_by_name[name]
+  end
+  alias [] get
+  alias init_var get
+
+  # Add a new identifier. Its name will be checked for uniqueness among
+  # previously-generated names.
+  #
+  # @note This should be called *before* any calls to {#get} to avoid
+  #   potential collisions. If you do hit a collision, this method will
+  #   raise.
+  #
+  # @param name (see #get)
+  # @param value [String] The identifier that will be returned by
+  #   subsequent calls to {#get} with the sane +name+.
+  # @raise RuntimeError if +value+ already exists
+  # @return [void]
+  def store(name, value)
+
+    case @name_by_value[value]
+    when name
+      # we already have this value and it is associated with this name
+      # nothing to do here
+    when nil
+      # don't have this value yet, so go ahead and just insert
+      @value_by_name[name] = value
+      @name_by_value[value] = name
+    else
+      # then the caller is trying to insert a duplicate
+      raise RuntimeError, "Value is not unique!"
+    end
+
+    self
+  end
+
+  # Create a random string that satisfies most languages' requirements
+  # for identifiers. In particular, with a default configuration, the
+  # first character will always be lowercase alpha (unless modified by a
+  # block), and the whole thing will contain only a-zA-Z0-9_ characters.
+  #
+  # If called with a block, the block will be given the identifier before
+  # uniqueness checks. The block's return value will be the new
+  # identifier. Note that the block may be called multiple times if it
+  # returns a non-unique value.
+  #
+  # @note Calling this method with a block that returns only values that
+  #   this generator already contains will result in an infinite loop.
+  #
+  # @example
+  #   rig = Rex::RandomIdentifierGenerator.new
+  #   const = rig.generate { |val| val.capitalize }
+  #   rig.insert(:SOME_CONSTANT, const)
+  #   ruby_code = <<-EOC
+  #     #{rig[:SOME_CONSTANT]} = %q^generated ruby constant^
+  #     def #{rig[:my_method]}; ...; end
+  #   EOC
+  #
+  # @param len [Fixnum] Avoid setting this unless a specific size is
+  #   necessary. Default is random within range of min .. max
+  # @return [String] A string that matches <tt>[a-z][a-zA-Z0-9_]*</tt>
+  # @yield [String] The identifier before uniqueness checks. This allows
+  #   you to modify the value and still avoid collisions.
+  def generate(len=nil)
+    raise ArgumentError, "len must be positive integer" if len && len < 1
+    raise ExhaustedSpaceError if @value_by_name.length >= @max_permutations
+
+    # pick a random length within the limits
+    len ||= rand(@opts[:min_length] .. (@opts[:max_length]))
+
+    ident = ""
+
+    # XXX: Infinite loop if block returns only values we've already
+    # generated.
+    loop do
+      ident  = Rex::Text.rand_base(1, "", @opts[:first_char_set])
+      ident << Rex::Text.rand_base(len-1, "", @opts[:char_set])
+      if block_given?
+        ident = yield ident
+      end
+      # Try to make another one if it collides with a previously
+      # generated one.
+      break unless @name_by_value.key?(ident)
+    end
+
+    ident
+  end
+
+end

data/lib/rex/registry.rb

@@ -0,0 +1,14 @@
+# -*- coding: binary -*-
+require 'rex/registry/hive'
+require 'rex/registry/regf'
+require 'rex/registry/nodekey'
+require 'rex/registry/lfkey'
+require 'rex/registry/valuekey'
+require 'rex/registry/valuelist'
+
+module Rex
+module Registry
+
+  attr_accessor :alias
+end
+end

data/lib/rex/registry/hive.rb

@@ -0,0 +1,132 @@
+# -*- coding: binary -*-
+require_relative "regf"
+require_relative "nodekey"
+
+module Rex
+module Registry
+
+class Hive
+  attr_accessor :root_key, :hive_regf, :hive_name
+
+  def initialize(hivepath)
+
+    hive_blob = open(hivepath, "rb") { |io| io.read }
+
+    @hive_regf = RegfBlock.new(hive_blob)
+    return nil if !@hive_regf.root_key_offset
+
+    @root_key = NodeKey.new(hive_blob, 0x1000 + @hive_regf.root_key_offset)
+    return nil if !@root_key.lf_record
+
+    keys = []
+    root_key.lf_record.children.each do |key|
+      keys << key.name
+    end
+
+    if keys.include? "LastKnownGoodRecovery"
+      @hive_name = "SYSTEM"
+    elsif keys.include? "Microsoft"
+      @hive_name = "SOFTWARE"
+    elsif keys.include? "Environment"
+      @hive_name = "NTUSER.DAT"
+    elsif keys.include? "SAM"
+      @hive_name = "SAM"
+    elsif keys.include? "Policy"
+      @hive_name = "SECURITY"
+    else
+      @hive_name = "UNKNOWN"
+    end
+
+  end
+
+  def relative_query(path)
+
+    if path == "" || path == "\\"
+      return @root_key
+    end
+
+    current_child = nil
+    paths = path.split("\\")
+
+    return if !@root_key.lf_record
+
+    @root_key.lf_record.children.each do |child|
+      next if child.name.downcase != paths[1].downcase
+
+      current_child = child
+
+      if paths.length == 2
+        current_child.full_path = path
+        return current_child
+      end
+
+      2.upto(paths.length) do |i|
+
+        if i == paths.length
+          current_child.full_path = path
+          return current_child
+        else
+          if current_child.lf_record && current_child.lf_record.children
+            current_child.lf_record.children.each do |c|
+              next if c.name.downcase != paths[i].downcase
+
+              current_child = c
+
+              break
+            end
+          end
+        end
+      end
+    end
+
+    return if !current_child
+
+    current_child.full_path = path
+    return current_child
+    end
+
+    def value_query(path)
+      if path == "" || path == "\\"
+      return nil
+    end
+
+    paths = path.split("\\")
+
+    return if !@root_key.lf_record
+
+    @root_key.lf_record.children.each do |root_child|
+      next if root_child.name.downcase != paths[1].downcase
+
+      current_child = root_child
+
+      if paths.length == 2
+        return nil
+      end
+
+      2.upto(paths.length - 1) do |i|
+        next if !current_child.lf_record
+
+        current_child.lf_record.children.each do |c|
+          next if c.name != paths[i]
+          current_child = c
+
+          break
+        end
+      end
+
+      if !current_child.value_list || current_child.value_list.values.length == 0
+        return nil
+      end
+
+      current_child.value_list.values.each do |value|
+        next if value.name.downcase != paths[paths.length - 1].downcase
+
+        value.full_path = path
+        return value
+      end
+    end
+  end
+end
+
+end
+end

data/lib/rex/registry/lfkey.rb

@@ -0,0 +1,51 @@
+# -*- coding: binary -*-
+require_relative "nodekey"
+
+module Rex
+module Registry
+
+class LFBlock
+
+  attr_accessor :number_of_keys, :hash_records, :children
+
+  def initialize(hive_blob, offset)
+    offset = offset + 4
+    lf_header = hive_blob[offset, 2]
+
+    if lf_header !~ /lf/ && lf_header !~ /lh/
+      return
+    end
+
+    @number_of_keys = hive_blob[offset + 0x02, 2].unpack('C').first
+
+    @hash_records = []
+    @children = []
+
+    hash_offset = offset + 0x04
+
+    1.upto(@number_of_keys) do |h|
+
+      hash = LFHashRecord.new(hive_blob, hash_offset)
+
+      @hash_records << hash
+
+      hash_offset = hash_offset + 0x08
+
+      @children << NodeKey.new(hive_blob, hash.nodekey_offset + 0x1000)
+    end
+  end
+end
+
+class LFHashRecord
+
+  attr_accessor :nodekey_offset, :nodekey_name_verification
+
+  def initialize(hive_blob, offset)
+    @nodekey_offset = hive_blob[offset, 4].unpack('V').first
+    @nodekey_name_verification = hive_blob[offset+0x04, 4].to_s
+  end
+
+end
+
+end
+end

data/lib/rex/registry/nodekey.rb

@@ -0,0 +1,54 @@
+# -*- coding: binary -*-
+require_relative "lfkey"
+require_relative "valuelist"
+
+module Rex
+module Registry
+
+class NodeKey
+
+  attr_accessor :timestamp, :parent_offset, :subkeys_count, :lf_record_offset
+  attr_accessor :value_count, :value_list_offset, :security_key_offset
+  attr_accessor :class_name_offset, :name_length, :class_name_length, :full_path
+  attr_accessor :name, :lf_record, :value_list, :class_name_data, :readable_timestamp
+
+  def initialize(hive, offset)
+
+    offset = offset + 0x04
+
+    nk_header = hive[offset, 2]
+    nk_type = hive[offset+0x02, 2]
+
+    if nk_header !~ /nk/
+      return
+    end
+
+    @timestamp = hive[offset+0x04, 8].unpack('Q').first
+    @parent_offset = hive[offset+0x10, 4].unpack('V').first
+    @subkeys_count = hive[offset+0x14, 4].unpack('V').first
+    @lf_record_offset = hive[offset+0x1c, 4].unpack('V').first
+    @value_count = hive[offset+0x24, 4].unpack('V').first
+    @value_list_offset = hive[offset+0x28, 4].unpack('V').first
+    @security_key_offset = hive[offset+0x2c, 4].unpack('V').first
+    @class_name_offset = hive[offset+0x30, 4].unpack('V').first
+    @name_length = hive[offset+0x48, 2].unpack('C').first
+    @class_name_length = hive[offset+0x4a, 2].unpack('C').first
+    @name = hive[offset+0x4c, @name_length].to_s
+
+    windows_time = @timestamp
+    unix_time = windows_time/10000000-11644473600
+    ruby_time = Time.at(unix_time)
+
+    @readable_timestamp = ruby_time
+
+    @lf_record = LFBlock.new(hive, @lf_record_offset + 0x1000) if @lf_record_offset != -1
+    @value_list = ValueList.new(hive, @value_list_offset + 0x1000, @value_count) if @value_list_offset != -1
+
+    @class_name_data = hive[@class_name_offset + 0x04 + 0x1000, @class_name_length]
+
+  end
+
+end
+
+end
+end

data/lib/rex/registry/regf.rb

@@ -0,0 +1,25 @@
+# -*- coding: binary -*-
+module Rex
+module Registry
+
+class RegfBlock
+
+  attr_accessor :timestamp, :root_key_offset
+
+  def initialize(hive)
+
+    regf_header = hive[0x00, 4]
+
+    if regf_header !~ /regf/
+      puts "Not a registry hive"
+      return
+    end
+
+    @timestamp = hive[0x0C, 8].unpack('q').first
+    @root_key_offset = 0x20
+
+  end
+end
+
+end
+end