intrigue-ident 0.2 → 0.9.9

data/lib/simple_socket.rb

@@ -0,0 +1,41 @@
+require 'socketry'
+
+module Intrigue
+  module Ident
+    module SimpleSocket
+
+      # Connect to a given IP address and port.
+      # @param ip [String]
+      # @param port [Integer]
+      # @return [TCPSocket, false]
+      def connect_tcp(ip, port, timeout)
+        begin
+          Socketry::TCP::Socket.connect(ip.strip, port, local_addr: nil, local_port: nil, timeout: timeout)
+        rescue Socketry::Resolver::Error
+          puts "Error connecting! Unable to resolve."
+          return nil
+        rescue Socketry::TimeoutError
+          puts "Error connecting! Timeout!"
+          return nil
+        end
+      end
+
+      # Connect to a given IP address and port.
+      # @param ip [String]
+      # @param port [Integer]
+      # @return [UDPSocket, false]
+      def connect_udp(ip, port)
+        begin 
+          Socketry::UDP::Socket.connect(ip.strip, port)
+        rescue Socketry::Resolver::Error
+          puts "Error connecting! Unable to resolve."
+          return nil
+        rescue Socketry::TimeoutError
+          puts "Error connecting! Timeout."
+          return nil
+        end
+      end
+
+    end 
+  end
+end

data/lib/smtp/check_factory.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Smtp
+class CheckFactory
+
+    #
+    # Register a new handler
+    #
+    def self.register(klass)
+      @checks = [] unless @checks
+      @checks << klass if klass
+    end
+
+    #
+    # Provide the full list of checks
+    #
+    def self.checks
+      @checks
+    end
+
+end
+end
+end
+end

data/lib/smtp/content.rb

@@ -0,0 +1,13 @@
+module Intrigue
+  module Ident
+    module Smtp
+      module Content
+
+      def _banner(content)
+        content["details"]["banner"]
+      end
+
+    end
+  end
+end
+end

data/lib/smtp/matchers.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Smtp
+module Matchers
+
+  require_relative 'smtp'
+  include Intrigue::Ident::Smtp
+  
+  require_relative 'content'
+  include Intrigue::Ident::Smtp::Content
+  
+  # gives us the recog smtp matchers 
+  include Intrigue::Ident::RecogWrapper::Smtp
+
+  def match_smtp_response_hash(check,response_hash)
+  
+    if check[:type] == "fingerprint"
+      if check[:match_type] == :content_banner
+        match = _construct_match_response(check,response_hash) if _banner(response_hash) =~ check[:match_content]
+      end
+    end
+
+  end
+
+end
+end
+end
+end

data/lib/smtp/smtp.rb

@@ -0,0 +1,53 @@
+module Intrigue
+  module Ident
+    module Smtp
+
+      include Intrigue::Ident::SimpleSocket
+
+      def generate_smtp_request_and_check(ip, port=25, debug=false)
+
+        # do the request (store as string and funky format bc of usage in core.. and  json conversions)
+        banner_string = grab_banner_smtp(ip,port)
+        details = {
+          "details" => {
+            "banner" => banner_string
+          }
+        }
+  
+        results = []
+  
+        # generate the checks 
+        checks = Intrigue::Ident::Smtp::CheckFactory.checks.map{ |x| x.new.generate_checks }.compact.flatten
+  
+        # and run them against our result
+        checks.each do |check|
+          results << match_smtp_response_hash(check,details)
+        end
+
+        recog_results = recog_match_smtp_banner(banner_string)
+  
+      { "fingerprints" => (results + recog_results).uniq.compact, "banner" => banner_string, "content" => [] }
+      end
+
+      private
+
+      def grab_banner_smtp(ip, port, timeout=60)
+          
+        if socket = connect_tcp(ip, port, timeout)
+          #socket.writepartial("HELO friend.local\r\n\r\n")
+          begin 
+            out = socket.readpartial(2048, timeout: timeout)
+          rescue Socketry::TimeoutError
+            puts "Error while reading! Timeout."
+            out = nil
+          end
+        else 
+          out = nil
+        end
+        
+      out
+      end
+
+    end
+  end
+end

data/lib/snmp/check_factory.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Snmp
+class CheckFactory
+
+    #
+    # Register a new handler
+    #
+    def self.register(klass)
+      @checks = [] unless @checks
+      @checks << klass if klass
+    end
+
+    #
+    # Provide the full list of checks
+    #
+    def self.checks
+      @checks
+    end
+
+end
+end
+end
+end

data/lib/snmp/content.rb

@@ -0,0 +1,13 @@
+module Intrigue
+  module Ident
+    module Snmp
+      module Content
+
+      def _banner(content)
+        content["details"]["banner"]
+      end
+
+    end
+  end
+end
+end

data/lib/snmp/matchers.rb

@@ -0,0 +1,25 @@
+module Intrigue
+module Ident
+module Snmp
+module Matchers
+
+  require_relative 'snmp'
+  include Intrigue::Ident::Snmp
+  
+  require_relative 'content'
+  include Intrigue::Ident::Snmp::Content
+
+  def match_snmp_response_hash(check,response_hash)
+    
+    if check[:type] == "fingerprint"
+      if check[:match_type] == :content_banner
+        match = _construct_match_response(check,response_hash) if _banner(response_hash) =~ check[:match_content]
+      end
+    end
+
+  end
+
+end
+end
+end
+end

data/lib/snmp/snmp.rb

@@ -0,0 +1,55 @@
+require 'snmp'
+
+module Intrigue
+  module Ident
+    module Snmp
+
+      include Intrigue::Ident::SimpleSocket
+
+      def generate_snmp_request_and_check(ip, port=161, debug=false)
+        
+        # do the request (store as string and funky format bc of usage in core.. and  json conversions)
+        banner_string = grab_banner_smtp(ip,port)
+        details = {
+          "details" => {
+            "banner" => banner_string
+          }
+        }
+
+        results = []
+
+        # generate the checks 
+        checks = Intrigue::Ident::Snmp::CheckFactory.checks.map{ |x| x.new.generate_checks }.compact.flatten
+
+        # and run them against our result
+        checks.each do |check|
+          results << match_snmp_response_hash(check,details)
+        end
+
+      { "fingerprints" => results.uniq.compact, "banner" => banner_string, "content" => [] }
+      end
+
+      private
+
+      def grab_banner_snmp(ip, port=161, community="public", timeout=60)
+          
+        snmp_args = { :host => ip, :port => port, :community => community, :timeout => timeout }
+        out = ""
+        begin 
+          SNMP::Manager.open(snmp_args) do |manager|
+              response = manager.get(["sysDescr.0", "sysName.0"])
+              response.each_varbind do |vb|
+                out << "#{vb.value.to_s}"
+              end
+          end
+        rescue Socketry::TimeoutError
+          puts "Error connecting! Timeout!"
+          return nil
+        end
+
+      out.length > 0 ? out : nil
+      end
+
+    end
+  end
+end

data/lib/ssh/check_factory.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Ssh
+class CheckFactory
+
+    #
+    # Register a new handler
+    #
+    def self.register(klass)
+      @checks = [] unless @checks
+      @checks << klass if klass
+    end
+
+    #
+    # Provide the full list of checks
+    #
+    def self.checks
+      @checks
+    end
+
+end
+end
+end
+end

data/lib/ssh/content.rb

@@ -0,0 +1,13 @@
+module Intrigue
+  module Ident
+    module Ssh
+      module Content
+
+      def _banner(content)
+        content["details"]["banner"]
+      end
+
+    end
+  end
+end
+end

data/lib/ssh/matchers.rb

@@ -0,0 +1,26 @@
+module Intrigue
+module Ident
+module Ssh
+module Matchers
+
+  require_relative 'ssh'
+  include Intrigue::Ident::Ssh
+  
+  require_relative 'content'
+  include Intrigue::Ident::Ssh::Content
+
+  def match_ssh_response_hash(check,response_hash)
+    
+    if check[:type] == "fingerprint"
+      if check[:match_type] == :content_banner
+        puts "Banner: #{_banner(response_hash)}"
+        match = _construct_match_response(check,response_hash) if (_banner(response_hash) =~ check[:match_content])
+      end
+    end
+
+  end
+
+end
+end
+end
+end

data/lib/ssh/ssh.rb

@@ -0,0 +1,52 @@
+module Intrigue
+  module Ident
+    module Ssh
+
+      include Intrigue::Ident::SimpleSocket
+
+      def generate_ssh_request_and_check(ip, port=22, debug=false)
+
+        # do the request (store as string and funky format bc of usage in core.. and  json conversions)
+        banner_string = grab_banner_ssh(ip,port)
+        details = {
+          "details" => {
+            "banner" => banner_string
+          }
+        }
+  
+        results = []
+  
+        # generate the checks 
+        checks = Intrigue::Ident::Ssh::CheckFactory.checks.map{ |x| x.new.generate_checks }.compact.flatten
+  
+        # and run them against our result
+        checks.each do |check|
+          results << match_ssh_response_hash(check,details)
+        end
+  
+      { "fingerprints" => results.uniq.compact, "banner" => banner_string, "content" => [] }
+      end
+
+      private
+
+      def grab_banner_ssh(ip, port, timeout=30)
+          
+        if socket = connect_tcp(ip, port, timeout)
+          #socket.writepartial("HELO friend.local\r\n\r\n")
+          begin 
+            out = socket.readpartial(2048, timeout: timeout)
+          rescue Socketry::TimeoutError
+            puts "Error while reading! Timeout."
+            out = nil
+          end
+        else 
+          out = nil
+        end
+        
+      out
+      end
+
+
+    end
+  end
+end

data/lib/telnet/check_factory.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Telnet
+class CheckFactory
+
+    #
+    # Register a new handler
+    #
+    def self.register(klass)
+      @checks = [] unless @checks
+      @checks << klass if klass
+    end
+
+    #
+    # Provide the full list of checks
+    #
+    def self.checks
+      @checks
+    end
+
+end
+end
+end
+end

data/lib/telnet/content.rb

@@ -0,0 +1,13 @@
+module Intrigue
+  module Ident
+    module Telnet
+      module Content
+
+      def _banner(content)
+        content["details"]["banner"]
+      end
+
+    end
+  end
+end
+end