dstruct 0.0.1

data/lib/rex/parser/nokogiri_doc_mixin.rb

@@ -0,0 +1,233 @@
+# -*- coding: binary -*-
+module Rex
+  module Parser
+
+    # Determines if Nokogiri is available and if it's a minimum
+    # acceptable version.
+    def self.load_nokogiri
+      @nokogiri_loaded = false
+      begin
+        require 'nokogiri'
+        major,minor = Nokogiri::VERSION.split(".")[0,2]
+        if major.to_i >= 1
+          if minor.to_i >= 4
+            @nokogiri_loaded = true
+          end
+        end
+      rescue LoadError => e
+        @nokogiri_loaded = false
+        @nokogiri_error  = e
+      end
+      @nokogiri_loaded
+    end
+
+    def self.nokogiri_loaded
+      !!@nokogiri_loaded
+    end
+
+    # Useful during development, shouldn't be used in normal operation.
+    def self.reload(fname)
+      $stdout.puts "Reloading #{fname}..."
+      load __FILE__
+      load File.join(File.expand_path(File.dirname(__FILE__)),fname)
+    end
+
+  end
+end
+
+module Rex
+module Parser
+
+    load_nokogiri && module NokogiriDocMixin
+
+    # Set up the getters and instance variables for the document
+    eval("attr_reader :args, :db, :state, :block, :report_data")
+
+    def initialize(args,db,&block)
+      @args = args
+      @db = db
+      @state = {}
+      @state[:current_tag] = {}
+      @block = block if block
+      @report_data = {:wspace => args[:wspace]}
+      @nx_console_id = args[:nx_console_id]
+      super()
+    end
+
+    # Turn XML attribute pairs in to more workable hashes (there
+    # are better Enumerable tricks in Ruby 1.9, but ignoring for now)
+    def attr_hash(attrs)
+      h = {}
+      attrs.each {|k,v| h[k] = v}
+      h
+    end
+
+    def valid_ip(addr)
+      valid = false
+      valid = ::Rex::Socket::RangeWalker.new(addr).valid? rescue false
+      !!valid
+    end
+
+    def normalize_ref(ref_type, ref_value)
+      return if ref_type.nil? || ref_type.empty? || ref_value.nil? || ref_value.empty?
+      ref_value = ref_value.strip
+      ref_type = ref_type.strip.upcase
+
+      ret = case ref_type
+        when "CVE"
+          ref_value.gsub("CAN", "CVE")
+        when "MS"
+          if ref_value =~ /^MS[0-9]/
+            "MSB-#{ref_value}"
+          else
+            "MSB-MS#{ref_value}"
+          end
+        when "URL", "BID"
+          "#{ref_type}-#{ref_value}"
+        when "APPLE"
+          ref_value
+        when "XF"
+          if ref_value =~ /\((\d+)\)$/
+            "#{ref_type}-#{$1}"
+          else
+            "#{ref_type}-#{ref_value}"
+          end
+        else # Handle others?
+          "#{ref_type}-#{ref_value}"
+        end
+      return ret
+    end
+
+    def normalize_references(orig_refs)
+      return [] unless orig_refs
+      refs = []
+      orig_refs.each do |ref_hash|
+
+        ref_hash_sym = Hash[ref_hash.map {|k, v| [k.to_sym, v] }]
+        ref_type = ref_hash_sym[:source].to_s.strip.upcase
+        ref_value = ref_hash_sym[:value].to_s.strip
+        refs << normalize_ref(ref_type, ref_value)
+      end
+      return refs.compact.uniq
+    end
+
+    def in_tag(tagname)
+      @state[:current_tag].keys.include? tagname
+    end
+
+    # If there's an address, it's not on the blacklist,
+    # it has ports, and the port list isn't
+    # empty... it's okay.
+    def host_is_okay
+      return false unless @report_data[:host]
+      return false unless valid_ip(@report_data[:host])
+      return false unless @report_data[:state] == Msf::HostState::Alive
+      if @args[:blacklist]
+        return false if @args[:blacklist].include?(@report_data[:host])
+      end
+      return false unless @report_data[:ports]
+      return false if @report_data[:ports].empty?
+      return true
+    end
+
+    # XXX: Document classes ought to define this
+    def determine_port_state(v)
+      return v
+    end
+
+    # Circumvent the unknown attribute logging by the various reporters. They
+    # seem to be there just for debugging anyway.
+    def db_report(table, data)
+      raise "Data should be a hash" unless data.kind_of? Hash
+      nonempty_data = data.reject {|k,v| v.nil?}
+      valid_attrs = db_valid_attributes(table)
+      raise "Unknown table `#{table}'" if valid_attrs.empty?
+      case table
+      when :note, :web_site, :web_page, :web_form, :web_vuln
+        just_the_facts = nonempty_data
+      else
+        just_the_facts = nonempty_data.select {|k,v| valid_attrs.include? k.to_s.to_sym}
+      end
+      return nil if just_the_facts.empty?
+      just_the_facts[:task] = @args[:task]
+      db.send("report_#{table}", just_the_facts)
+    end
+
+    # XXX: It would be better to either have a single registry of acceptable
+    # keys if we're going to alert on bad ones, or to be more forgiving if
+    # the caller is this thing. There is basically no way to tell if
+    # report_host()'s tastes are going to change with this scheme.
+    def db_valid_attributes(table)
+      case table.to_s.to_sym
+      when :host
+        ::Mdm::Host.new.attribute_names.map {|x| x.to_sym} |
+          [:host, :workspace]
+      when :service
+        ::Mdm::Service.new.attribute_names.map {|x| x.to_sym} |
+          [:host, :host_name, :mac, :workspace]
+      when :vuln
+        ::Mdm::Vuln.new.attribute_names.map {|x| x.to_sym} |
+          [:host, :refs, :workspace, :port, :proto, :details, :exploited_at]
+      when :vuln_details
+        ::Mdm::VulnDetails.new.attribute_names.map {|x| x.to_sym} | [ :key ]
+      when :host_details
+        ::Mdm::HostDetails.new.attribute_names.map {|x| x.to_sym} | [ :key ]
+      when :note, :web_site, :web_page, :web_form, :web_vuln
+        # These guys don't complain
+        [:anything]
+      else
+        []
+      end
+    end
+
+    # Nokogiri 1.4.4 (and presumably beyond) generates attrs as pairs,
+    # like [["value1","foo"],["value2","bar"]] (but not hashes for some
+    # reason). 1.4.3.1 (and presumably 1.4.3.x and prior) generates attrs
+    # as a flat array of strings. We want array_pairs.
+    def normalize_attrs(attrs)
+      attr_pairs = []
+      case attrs.first
+      when Array, NilClass
+        attr_pairs = attrs
+      when String
+        attrs.each_index {|i|
+          next if i % 2 == 0
+          attr_pairs << [attrs[i-1],attrs[i]]
+        }
+      else # Wow, yet another format! It's either from the distant past or distant future.
+        raise ::Msf::DBImportError.new("Unknown format for XML attributes. Please check your Nokogiri version.")
+      end
+      return attr_pairs
+    end
+
+    # This breaks xml-encoded characters, so need to append.
+    # It's on the end_element tag name to turn the appending
+    # off and clear out the data.
+    def characters(text)
+      return unless @state[:has_text]
+      @text ||= ""
+      @text << text
+    end
+
+    # Effectively the same as characters()
+    def cdata_block(text)
+      return unless @state[:has_text]
+      @text ||= ""
+      @text << text
+    end
+
+    def end_document
+      block = @block
+      return unless @report_type_ok
+      unless @state[:current_tag].empty?
+        missing_ends = @state[:current_tag].keys.map {|x| "'#{x}'"}.join(", ")
+        msg = "Warning, the provided file is incomplete, and there may be missing\n"
+        msg << "data. The following tags were not closed: #{missing_ends}."
+        db.emit(:warning,msg,&block) if block
+      end
+    end
+
+  end
+
+end
+end

data/lib/rex/parser/openvas_nokogiri.rb

@@ -0,0 +1,172 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+module Parser
+
+  # If Nokogiri is available, define OpenVAS document class.
+  load_nokogiri && class OpenVASDocument < Nokogiri::XML::SAX::Document
+
+  include NokogiriDocMixin
+
+  # ourselves with the @state variable, turning things on when we
+  # get here (and turning things off when we exit in end_element()).
+  def start_element(name=nil,attrs=[])
+    attrs = normalize_attrs(attrs)
+    block = @block
+    @state[:current_tag][name] = true
+    case name
+    when "host"
+      @state[:has_text] = true
+    end
+  end
+
+  # When we exit a tag, this is triggered.
+  def end_element(name=nil)
+    block = @block
+    case name
+    when "name"
+      return if not in_tag("result")
+      @state[:has_text] = true
+      @state[:vuln_name] = @text.strip if @text
+      @text = nil
+    when "description"
+      @state[:has_text] = true
+      @state[:vuln_desc] = @text.strip if @text
+      @text = nil
+    when "bid"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+      @state[:has_text] = true
+      @state[:bid] = @text.strip if @text
+      @text = nil
+    when "cve"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+      @state[:has_text] = true
+      @state[:cves] = @text.strip if @text
+      @text = nil
+    when "risk_factor"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+
+      #we do this to clean out the buffer so to speak
+      #if we don't set text to nil now, the text will show up later
+      @state[:has_text] = true
+      @text = nil
+    when "cvss_base"
+      return if not in_tag("result")
+      return if not in_tag("nvt")
+      @state[:has_text] = true
+      @text = nil
+    when "subnet"
+      @state[:has_text] = true
+      @text = nil
+    when "result"
+      return if not in_tag("results")
+      record_vuln
+    when "threat"
+      return if not in_tag("ports")
+      return if not in_tag("port")
+      @state[:has_text] = true
+
+      if not @text.index('(')
+        @state[:name] = nil
+        @state[:port] = nil
+        @state[:proto] = nil
+        @text = nil
+        return
+      end
+
+      @state[:name] = @text.split(' ')[0] if @text
+      @state[:port] = @text.split('(')[1].split('/')[0] if @text
+      @state[:proto] = @text.split('(')[1].split('/')[1].split(')')[0] if @text
+
+      @text = nil
+    when "host"
+      if in_tag('result')
+        @state[:has_text] = true
+        @state[:host] = @text.strip if @text
+        @text = nil
+      elsif in_tag('ports')
+        return if not in_tag('port')
+        @state[:has_text] = true
+        @state[:host] = @text.strip if @text
+        @text = nil
+      end
+    when "port"
+      if in_tag('result')
+        @state[:has_text] = true
+        if not @text.index('(')
+          @state[:proto] = nil
+          @state[:port] = nil
+          @text = nil
+          return
+        end
+        @state[:proto] = @text.split('(')[0].strip if @text
+        @state[:port] = @text.split('(')[1].split('/')[0].gsub(/\)/, '') if @text
+        @text = nil
+      elsif in_tag('ports')
+        record_service
+      end
+    when "name"
+      return if not in_tag("result")
+      @state[:has_text] = true
+      @text = nil
+    end
+    @state[:current_tag].delete name
+  end
+
+  def record_vuln
+    if (@state[:cves] and @state[:cves] == "NOCVE")  and (@state[:bid] and @state[:bid] == "NOBID")
+      return
+    end
+
+    if @state[:cves] and @state[:cves] != "NOCVE" and !@state[:cves].empty?
+      @state[:cves].split(',').each do |cve|
+        vuln_info = {}
+        vuln_info[:host] = @state[:host]
+        vuln_info[:refs] = normalize_references([{ :source => "CVE", :value => cve}])
+        vuln_info[:name] = @state[:vuln_name]
+        vuln_info[:info] = @state[:vuln_desc]
+        vuln_info[:port] = @state[:port]
+        vuln_info[:proto] = @state[:proto]
+
+        db_report(:vuln, vuln_info)
+      end
+    end
+    if @state[:bid] and @state[:bid] != "NOBID" and !@state[:bid].empty?
+      @state[:bid].split(',').each do |bid|
+        vuln_info = {}
+        vuln_info[:host] = @state[:host]
+        vuln_info[:refs] = normalize_references([{ :source => "BID", :value => bid}])
+        vuln_info[:name] = @state[:vuln_name]
+        vuln_info[:info] = @state[:vuln_desc]
+        vuln_info[:port] = @state[:port]
+        vuln_info[:proto] = @state[:proto]
+
+        db_report(:vuln, vuln_info)
+      end
+    end
+  end
+
+  def record_service
+    return if not @state[:name]
+
+    service_info = {}
+    service_info[:host] = @state[:host]
+    service_info[:name] = @state[:name]
+    service_info[:port] = @state[:port]
+    service_info[:proto] = @state[:proto]
+
+    db_report(:service, service_info)
+
+    host_info = {}
+    host_info[:host] = @state[:host]
+
+    db_report(:host, host_info)
+  end
+end
+end
+end
+

data/lib/rex/parser/outpost24_nokogiri.rb

@@ -0,0 +1,240 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+module Parser
+
+load_nokogiri && class Outpost24Document < Nokogiri::XML::SAX::Document
+
+  include NokogiriDocMixin
+
+  def start_element(name, attrs)
+    @state[:current_tag][name] = true
+    case name
+    when "description", "information"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      record_text
+    when "detail"
+      return unless in_tag("detaillist")
+      record_vuln
+    when "detaillist"
+      record_vulns
+    when "host"
+      return unless in_tag("hostlist")
+      record_host
+    when "hostlist"
+      record_hosts
+    when "id"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      return unless in_tag("cve")
+      record_text
+    when "name"
+      return unless in_tag("hostlist") || in_tag("detaillist")
+      return unless in_tag("host") || in_tag("detail")
+      record_text
+    when "platform"
+      return unless in_tag("hostlist")
+      return unless in_tag("host")
+      record_text
+    when "portinfo"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      record_service
+    when "portlist"
+      record_services
+    when "portnumber", "protocol", "service"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      return unless in_tag("portinfo")
+      record_text
+    when "report", "ip"
+      record_text
+    end
+  end
+
+  def end_element(name)
+    case name
+    when "description", "information"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      collect_vuln_data(name)
+    when "detail"
+      return unless in_tag("detaillist")
+      collect_vuln
+    when "detaillist"
+      report_vulns
+    when "host"
+      return unless in_tag("hostlist")
+      collect_host
+    when "hostlist"
+      report_hosts
+    when "id"
+      return unless in_tag("detaillist")
+      return unless in_tag("detail")
+      return unless in_tag("cve")
+      collect_vuln_data(name)
+    when "ip"
+      collect_ip
+    when "name"
+      if in_tag("hostlist") && in_tag("host")
+        collect_host_data(name)
+      elsif in_tag("detaillist") && in_tag("detail")
+        collect_vuln_data(name)
+      end
+    when "platform"
+      return unless in_tag("hostlist")
+      return unless in_tag("host")
+      collect_host_data(name)
+    when "portinfo"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      collect_service
+    when "portlist"
+      report_services
+    when "portnumber", "protocol", "service"
+      return unless in_tag("portlist")
+      return unless in_tag("portlist-host")
+      return unless in_tag("portinfo")
+      collect_service_data(name)
+    when "report"
+      collect_product
+    end
+    @state[:current_tag].delete(name)
+  end
+
+  def record_hosts
+    @report_data[:hosts] = []
+  end
+
+  def record_services
+    @report_data[:services] = []
+  end
+
+  def record_vulns
+    @report_data[:vulns] = []
+  end
+
+  def record_host
+    @host = {}
+  end
+
+  def record_service
+    @service = {}
+  end
+
+  def record_vuln
+    @vuln = {}
+    @refs = []
+  end
+
+  def record_text
+    @state[:has_text] = true
+  end
+
+  def collect_host
+    @host[:host] = @state[:host]
+    @host[:name] = @state[:hname]
+    @host[:os_name] = @state[:os_name]
+    @host[:info] = @state[:pinfo]
+    @report_data[:hosts] << @host
+  end
+
+  def collect_service
+    @service[:host] = @state[:host]
+    @service[:port] = @state[:port]
+    @service[:proto] = @state[:proto]
+    @service[:name] = @state[:sname]
+    @service[:info] = @state[:pinfo]
+    @report_data[:services] << @service
+  end
+
+  def collect_vuln
+    @vuln[:host] = @state[:host]
+    @vuln[:name] = @state[:vname]
+    @vuln[:info] = @state[:vinfo]
+    @vuln[:refs] = @refs
+    @report_data[:vulns] << @vuln
+  end
+
+  def collect_product
+    @state[:has_text] = false
+    @state[:pinfo] = @text.strip if @text
+    @text = nil
+  end
+
+  def collect_ip
+    @state[:has_text] = false
+    @state[:host] = @text.strip if @text
+    @text = nil
+  end
+
+  def collect_host_data(name)
+    @state[:has_text] = false
+    if name == "name"
+      @state[:hname] = @text.strip if @text
+    elsif name == "platform"
+      if @text
+        @state[:os_name] = @text.strip
+      else
+        @state[:os_name] = Msf::OperatingSystems::UNKNOWN
+      end
+    end
+    @text = nil
+  end
+
+  def collect_service_data(name)
+    @state[:has_text] = false
+    if name == "portnumber"
+      @state[:port] = @text.strip if @text
+    elsif name == "protocol"
+      @state[:proto] = @text.strip.downcase if @text
+    elsif name == "service"
+      @state[:sname] = @text.strip if @text
+    end
+    @text = nil
+  end
+
+  def collect_vuln_data(name)
+    @state[:has_text] = false
+    if name == "name"
+      @state[:vname] = @text.strip if @text
+    elsif name == "description"
+      @state[:vinfo] = @text.strip if @text
+    elsif name == "information"
+      @state[:vinfo] << " #{@text.strip if @text}"
+    elsif name == "id"
+      @state[:ref] = @text.strip if @text
+      @refs << normalize_ref("CVE", @state[:ref])
+    end
+    @text = nil
+  end
+
+  def report_hosts
+    block = @block
+    @report_data[:hosts].each do |h|
+      db.emit(:address, h[:host], &block) if block
+      db_report(:host, h)
+    end
+  end
+
+  def report_services
+    block = @block
+    @report_data[:services].each do |s|
+      db.emit(:service, "#{s[:host]}:#{s[:port]}/#{s[:proto]}", &block) if block
+      db_report(:service, s)
+    end
+  end
+
+  def report_vulns
+    block = @block
+    @report_data[:vulns].each do |v|
+      db.emit(:vuln, ["#{v[:name]} (#{v[:host]})", 1], &block) if block
+      db_report(:vuln, v)
+    end
+  end
+
+end
+end
+end