dstruct 0.0.1

data/lib/rex/parser/group_policy_preferences.rb

@@ -0,0 +1,185 @@
+# -*- coding: binary -*-
+#
+
+module Rex
+module Parser
+
+# This is a parser for the Windows Group Policy Preferences file
+# format. It's used by modules/post/windows/gather/credentials/gpp.rb
+# and uses REXML (as opposed to Nokogiri) for its XML parsing.
+# See: http://msdn.microsoft.com/en-gb/library/cc232587.aspx
+class GPP
+  require 'rex'
+  require 'rexml/document'
+
+  def self.parse(data)
+    if data.nil?
+      return []
+    end
+
+    xml = REXML::Document.new(data).root
+    results = []
+
+    unless xml and xml.elements and xml.elements.to_a("//Properties")
+      return []
+    end
+
+    xml.elements.to_a("//Properties").each do |node|
+      epassword = node.attributes['cpassword']
+      next if epassword.to_s.empty?
+      password = self.decrypt(epassword)
+
+      user = node.attributes['runAs'] if node.attributes['runAs']
+      user = node.attributes['accountName'] if node.attributes['accountName']
+      user = node.attributes['username'] if node.attributes['username']
+      user = node.attributes['userName'] if node.attributes['userName']
+      user = node.attributes['newName'] unless node.attributes['newName'].nil? || node.attributes['newName'].empty?
+      changed = node.parent.attributes['changed']
+
+      # Printers and Shares
+      path = node.attributes['path']
+
+      # Datasources
+      dsn = node.attributes['dsn']
+      driver = node.attributes['driver']
+
+      # Tasks
+      app_name = node.attributes['appName']
+
+      # Services
+      service = node.attributes['serviceName']
+
+      # Groups
+      expires = node.attributes['expires']
+      never_expires = node.attributes['neverExpires']
+      disabled = node.attributes['acctDisabled']
+
+      result = {
+        :USER => user,
+        :PASS => password,
+        :CHANGED => changed
+      }
+
+      result.merge!({ :EXPIRES => expires }) unless expires.nil? || expires.empty?
+      result.merge!({ :NEVER_EXPIRES => never_expires.to_i }) unless never_expires.nil? || never_expires.empty?
+      result.merge!({ :DISABLED => disabled.to_i }) unless disabled.nil? || disabled.empty?
+      result.merge!({ :PATH => path }) unless path.nil? || path.empty?
+      result.merge!({ :DATASOURCE => dsn }) unless dsn.nil? || dsn.empty?
+      result.merge!({ :DRIVER => driver }) unless driver.nil? || driver.empty?
+      result.merge!({ :TASK => app_name }) unless app_name.nil? || app_name.empty?
+      result.merge!({ :SERVICE => service }) unless service.nil? || service.empty?
+
+      attributes = []
+      node.elements.each('//Attributes//Attribute') do |dsn_attribute|
+        attributes << {
+          :A_NAME => dsn_attribute.attributes['name'],
+          :A_VALUE => dsn_attribute.attributes['value']
+        }
+      end
+
+      result.merge!({ :ATTRIBUTES => attributes }) unless attributes.empty?
+
+      results << result
+    end
+
+    results
+  end
+
+  def self.create_tables(results, filetype, domain=nil, dc=nil)
+    tables = []
+    results.each do |result|
+      table = Rex::Ui::Text::Table.new(
+        'Header'     => 'Group Policy Credential Info',
+        'Indent'     => 1,
+        'SortIndex'  => -1,
+        'Columns'    =>
+        [
+          'Name',
+          'Value',
+        ]
+      )
+
+      table << ["TYPE", filetype]
+      table << ["USERNAME", result[:USER]]
+      table << ["PASSWORD", result[:PASS]]
+      table << ["DOMAIN CONTROLLER", dc] unless dc.nil? || dc.empty?
+      table << ["DOMAIN", domain] unless domain.nil? || domain.empty?
+      table << ["CHANGED", result[:CHANGED]]
+      table << ["EXPIRES", result[:EXPIRES]] unless result[:EXPIRES].nil? || result[:EXPIRES].empty?
+      table << ["NEVER_EXPIRES?", result[:NEVER_EXPIRES]] unless result[:NEVER_EXPIRES].nil?
+      table << ["DISABLED", result[:DISABLED]] unless result[:DISABLED].nil?
+      table << ["PATH", result[:PATH]] unless result[:PATH].nil? || result[:PATH].empty?
+      table << ["DATASOURCE", result[:DSN]] unless result[:DSN].nil? || result[:DSN].empty?
+      table << ["DRIVER", result[:DRIVER]] unless result[:DRIVER].nil? || result[:DRIVER].empty?
+      table << ["TASK", result[:TASK]] unless result[:TASK].nil? || result[:TASK].empty?
+      table << ["SERVICE", result[:SERVICE]] unless result[:SERVICE].nil? || result[:SERVICE].empty?
+
+      unless result[:ATTRIBUTES].nil? || result[:ATTRIBUTES].empty?
+        result[:ATTRIBUTES].each do |dsn_attribute|
+          table << ["ATTRIBUTE", "#{dsn_attribute[:A_NAME]} - #{dsn_attribute[:A_VALUE]}"]
+        end
+      end
+
+      tables << table
+    end
+
+    tables
+  end
+
+  # Decrypts passwords using Microsoft's published key:
+  # http://msdn.microsoft.com/en-us/library/cc422924.aspx
+  def self.decrypt(encrypted_data)
+    password = ""
+    return password unless encrypted_data
+
+    password = ""
+    retries = 0
+    original_data = encrypted_data.dup
+
+    begin
+      mod = encrypted_data.length % 4
+
+      # PowerSploit code strips the last character, unsure why...
+      case mod
+      when 1
+        encrypted_data = encrypted_data[0..-2]
+      when 2, 3
+        padding = '=' * (4 - mod)
+        encrypted_data = "#{encrypted_data}#{padding}"
+      end
+
+      # Strict base64 decoding used here
+      decoded = encrypted_data.unpack('m0').first
+    rescue ::ArgumentError => e
+      # Appears to be some junk UTF-8 Padding appended at times in
+      # Win2k8 (not in Win2k8R2)
+      # Lets try stripping junk and see if we can decrypt
+      if retries < 8
+        retries += 1
+        original_data = original_data[0..-2]
+        encrypted_data = original_data
+        retry
+      else
+        return password
+      end
+    end
+
+    key = "\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b"
+    aes = OpenSSL::Cipher::Cipher.new("AES-256-CBC")
+    begin
+      aes.decrypt
+      aes.key = key
+      plaintext = aes.update(decoded)
+      plaintext << aes.final
+      password = plaintext.unpack('v*').pack('C*') # UNICODE conversion
+    rescue OpenSSL::Cipher::CipherError => e
+      puts "Unable to decode: \"#{encrypted_data}\" Exception: #{e}"
+    end
+
+    password
+  end
+
+end
+end
+end
+

data/lib/rex/parser/ini.rb

@@ -0,0 +1,186 @@
+# -*- coding: binary -*-
+module Rex
+module Parser
+
+###
+#
+# This class parses the contents of an INI file.
+#
+###
+class Ini < Hash
+
+  ##
+  #
+  # Factories
+  #
+  ##
+
+  #
+  # Creates a new class instance and reads in the contents of the supplied
+  # file path.
+  #
+  def self.from_file(path)
+    ini = Ini.new(path)
+    ini.from_file
+    return ini
+  end
+
+  #
+  # Creates a new class instance from the supplied string.
+  #
+  def self.from_s(str)
+    ini = Ini.new
+    ini.from_s(str)
+    return ini
+  end
+
+  #
+  # Initializes an ini instance and tries to read in the groups from the
+  # file if it exists.
+  #
+  def initialize(path = nil)
+    self.path = path
+
+    # Try to synchronize ourself with the file if we
+    # have one
+    begin
+      self.from_file if (self.path)
+    rescue
+    end
+  end
+
+  #
+  # Enumerates the groups hash keys.
+  #
+  def each_group(&block)
+    self.keys.each { |k|
+      yield
+    }
+  end
+
+  #
+  # Adds a group of the supplied name if it doesn't already exist.
+  #
+  def add_group(name = 'global', reset = true)
+    self[name] = {} if (reset == true)
+    self[name] = {} if (!self[name])
+
+    return self[name]
+  end
+
+  #
+  # Checks to see if name is a valid group.
+  #
+  def group?(name)
+    return (self[name] != nil)
+  end
+
+  ##
+  #
+  # Serializers
+  #
+  ##
+
+  #
+  # Reads in the groups from the supplied file path or the instance's file
+  # path.
+  #
+  def from_file(fpath = nil)
+    fpath = path if (!fpath)
+
+    read_groups(fpath)
+  end
+
+  #
+  # Reads in the groups from the supplied string.
+  #
+  def from_s(str)
+    read_groups_string(str.split("\n"))
+  end
+
+  #
+  # Writes the group settings to a file.
+  #
+  def to_file(tpath = nil)
+    tpath = path if (!tpath)
+
+    f = File.new(tpath, "w")
+    f.write(to_s)
+    f.close
+  end
+
+  #
+  # Converts the groups to a string.
+  #
+  def to_s
+    str = ''
+    keys.sort.each { |k|
+      str << "[#{k}]\n"
+
+      self[k].each_pair { |var, val|
+        str << "#{var}=#{val}\n"
+      }
+
+      str << "\n";
+    }
+
+    return str
+  end
+
+  attr_reader :path
+
+protected
+
+  #
+  # Reads in the groups and their attributes from the supplied file
+  # path or from the instance's file path if one was set.
+  #
+  def read_groups(fpath) # :nodoc:
+    if (!fpath)
+      raise ArgumentError, "No file path specified.",
+        caller
+    end
+
+    # Read in the contents of the file
+    lines = ::IO.readlines(fpath)
+
+    # Now read the contents from the supplied string
+    read_groups_string(lines)
+  end
+
+  #
+  # Reads groups from the supplied string
+  #
+  def read_groups_string(str) # :nodoc:
+    # Reset the groups hash
+    self.clear
+
+    # The active group
+    active_group = nil
+
+    # Walk each line initializing the groups
+    str.each { |line|
+      next if (line.match(/^;/))
+
+      # Eliminate cr/lf
+      line.gsub!(/(\n|\r)/, '')
+
+      # Is it a group [bob]?
+      if (md = line.match(/^\[(.+?)\]/))
+        active_group = md[1]
+        self[md[1]]  = {}
+      # Is it a VAR=VAL?
+      elsif (md = line.match(/^(.+?)=(.*)$/))
+        if (active_group)
+          self[active_group][md[1]] = md[2]
+        end
+      end
+    }
+  end
+
+  attr_writer :path # :nodoc:
+
+end
+
+end
+end

data/lib/rex/parser/ip360_aspl_xml.rb

@@ -0,0 +1,103 @@
+# -*- coding: binary -*-
+require 'rexml/document'
+require 'rex/ui'
+
+module Rex
+module Parser
+
+
+class IP360ASPLXMLStreamParser
+
+  @vulnid = nil
+  @appid = nil
+  @location = nil
+
+  attr_accessor :on_found_aspl
+
+  def initialize(&block)
+    reset_state
+    on_found_aspl = block if block
+  end
+
+  def reset_state
+    @aspl = {'vulns' => {'name' => { }, 'cve' => { }, 'bid' => { } },
+      'oses' => {'name' => { } } }
+    @state = :generic_state
+  end
+
+  def tag_start(name, attributes)
+    case name
+    when "vulns"
+      @location = "vulns"
+    when "vuln"
+      @vulnid = attributes['id'].strip
+    when "name"
+      @state = :is_name
+    when "advisories"
+      @c = ""
+      @cfirst = 1
+      @b = ""
+      @bfirst = 1
+      @x = Hash.new
+    when "publisher"
+      @state = :is_pub
+    when "id"
+      @state = :is_refid
+    when "operatingSystems"
+      @location = "os"
+    when "operatingSystem"
+      @osid = attributes['id'].strip
+    end
+  end
+
+  def text(str)
+    case @state
+    when :is_name
+      @aspl['vulns']['name'][@vulnid] = str if @location == "vulns"
+      @aspl['oses'][@osid] = str if @location == "os"
+    when :is_pub
+      @x['pub'] = str
+    when :is_refid
+      @x['refid'] = str
+    end
+  end
+
+  def tag_end(name)
+    case name
+    when "ontology"
+      on_found_aspl.call(@aspl) if on_found_aspl
+      reset_state
+    when "advisory"
+      if (@x['pub'] =~ /CVE/)
+        if (@cfirst == 0)
+          @c += ","
+        end
+        @c += @x['refid']
+        @cfirst = 0
+      elsif (@x['pub'] =~ /BugTraq/)
+        if (@bfirst == 0)
+          @b += ","
+        end
+        @b += @x['refid']
+        @bfirst = 0
+      end
+    when "advisories"
+      @aspl['vulns']['cve'][@vulnid] = @c
+      @aspl['vulns']['bid'][@vulnid] = @b
+      @c = ""
+      @b = ""
+    end
+    @state = :generic_state
+  end
+
+  # We don't need these methods, but they're necessary to keep REXML happy
+  #
+  def xmldecl(version, encoding, standalone); end
+  def cdata; end
+  def comment(str); end
+  def instruction(name, instruction); end
+  def attlist; end
+end
+
+end
+end