librex 0.0.1

data/lib/rex/proto/drda/constants.rb.ut.rb

@@ -0,0 +1,23 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/test'
+require 'rex/proto/drda/constants'
+
+class Rex::Proto::DRDA::Constants::UnitTest < Test::Unit::TestCase
+	
+	Konst = Rex::Proto::DRDA::Constants
+
+	def test_defines
+		assert_equal(Konst::EXCSAT, 0x1041)
+		assert_equal(Konst::MGRLVLLS, 0x1404)
+		assert_equal(Konst::SECCHKCD, 0x11a4)
+	end
+
+	def test_const_values
+		assert_kind_of(Array, Konst.const_values)
+		assert Konst.const_values.include? Konst::EXCSAT
+	end
+	
+end

data/lib/rex/proto/drda/packet.rb

@@ -0,0 +1,252 @@
+require 'rex/proto/drda'
+
+module Rex
+module Proto
+module DRDA
+
+class Error < StandardError; end
+class RespError < Error; end
+
+# See:
+# http://publib.boulder.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=/com.ibm.db29.doc.drda/db2z_excsat.htm 
+class MGRLVLLS_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:codepoint] = Constants::MGRLVLLS
+		self[:payload] = "\x14\x03\x00\x0a\x24\x07\x00\x0a" +
+			"\x14\x74\x00\x05\x24\x0f\x00\x08" + 
+			"\x14\x40\x00\x09\x1c\x08\x04\xb8"
+		self[:length] = self[:payload].to_s.size+4
+	end
+	def to_s
+		self.to_a.pack("nna*")
+	end
+end
+
+# Currently, only takes a MGRLVLLS param. Extend the struct 
+# when more parameters are defined.
+class EXCSAT_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
+	 :codepoint, :mgrlvlls) 
+
+	def initialize(args={})
+		self[:magic] = 0xd0
+		self[:format] = 0x41
+		self[:correlid] = 1
+		self[:codepoint] = Constants::EXCSAT
+		self[:mgrlvlls] = args[:mgrlvlls] || MGRLVLLS_PARAM.new.to_s
+		self[:length] = (10 + self[:mgrlvlls].to_s.size)
+		self[:length2] = self[:length]-6 
+	end
+
+	def to_s
+		packstr = "nCCnnn"
+		packstr += "a*"  # Pack smarter as more params are added.
+		self.to_a.pack(packstr)
+	end
+end
+
+# See http://publib.boulder.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=/com.ibm.db29.doc.drda/db2z_accsec.htm
+# for all sorts of info about SECMEC.
+class SECMEC_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:length] = 6
+		self[:codepoint] = Constants::SECMEC
+		self[:payload] = 3 # Plaintext username and password.
+	end
+	def to_s
+		self.to_a.pack("nnn")
+	end
+end
+
+# Relational Database name parameter. 
+class RDBNAM_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:length] = 22 # Since the database name is padded out.
+		self[:codepoint] = Constants::RDBNAM
+		self[:payload] = encode(args[:payload].to_s)
+	end
+
+	def encode(str)
+		Rex::Text.to_ebcdic([str].pack("A18"))
+	end
+
+	def payload=(str)
+		self[:payload] = encode(str.to_s)
+	end
+
+	def to_s
+		self.to_a.pack("nna18")
+	end
+
+end
+
+# The ACCSEC DDM is responsible for picking the security mechanism (SECMEC)
+# which, in our case, will always be plain text username and password. It
+# also sets the relational database name (RDBNAM), if specified. You need
+# one to login, but not to probe.
+class ACCSEC_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
+	 :codepoint, :secmec, :rdbnam)
+	def initialize(args={})
+		self[:magic] = 0xd0
+		self[:format] = args[:format] || 0x01
+		self[:correlid] = 2
+		self[:codepoint] = Constants::ACCSEC
+		self[:secmec] = SECMEC_PARAM.new.to_s
+		if args[:dbname] # Include a database name if we're given one.
+			self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+		end
+		self[:length] =  10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size
+		self[:length2] = self[:length]-6 
+	end
+	def dbname=(str)
+		self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+	end
+	def to_s
+		packstr = "nCCnnna6"
+		packstr += "a22" if self[:rdbnam]
+		self.to_a.pack(packstr)
+	end
+end
+
+class DDM_PARAM < Struct.new(:length, :codepoint, :payload)
+
+	def read(str="")
+		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+		raise DRDA::RespError, "DDM_PARAM is too short" if str.size < 4
+		(self[:length], self[:codepoint]) =
+			str.unpack("nn")
+		raise DRDA::RespError, "DDM_PARAM Length is too short" if self[:length] < 4
+		rest = str[4,self[:length]-4] # If it's negative or whatever, it'll end up as "".
+		self[:payload] = rest.to_s[0,self[:length]-4]
+		return self
+	end
+
+	def to_s
+		self.to_a.pack("nna*")
+	end
+
+end
+
+class BASIC_DDM < Struct.new(:length, :magic, :format, :correlid,
+	:length2, :codepoint, :payload)
+	def initialize
+		self[:payload] = []
+	end
+
+	def read(str="")
+		self[:payload].clear
+		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+		raise DRDA::RespError, "Response is too short." if str.size < 10
+		(self[:length],self[:magic],self[:format],
+		 self[:correlid],self[:length2],self[:codepoint]) =
+		 str.unpack("nCCnnn")
+		sanity_check
+		rest = str[10,self[:length2]-4]
+		i = 0
+		while (i < rest.size)
+			if self[:codepoint] == Constants::SQLCARD # These aren't DDM's. 
+				this_param = rest[i,self[:length]-10]
+			else
+				this_param = DDM_PARAM.new.read(rest[i,rest.size])
+			end
+			self[:payload] << this_param
+			i += this_param.to_s.size
+		end
+		return self
+	end
+
+	# Just a quick test. 
+	def sanity_check
+		if self[:length] < 10
+			raise DRDA::RespError, "DDM Length is too short."
+		elsif self[:length2] < 4
+			raise DRDA::RespError, "DDM Length2 is too short."
+		elsif self[:length]-6 != self[:length2]
+			raise DRDA::RespError, "Codepoint: 0x#{self[:codepoint].to_s(16)} DDM Length2 (0x#{self[:length2].to_s(16)}) isn't six less than Length (0x#{self[:length].to_s(16)})"
+		end
+	end
+
+	def to_s
+		self.to_a.pack("nCCnnn") + self[:payload].map {|x| x.to_s}.join
+	end
+
+end
+
+class SERVER_PACKET < Array
+
+	def read(str="")
+		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+		self.clear
+		i = 0
+		while(i < str.size)
+			this_ddm = BASIC_DDM.new.read(str[i,str.size])
+			self << this_ddm
+			i += this_ddm.to_s.size
+		end
+		return self
+	end
+
+	def to_s; self.join; end
+	def sz; self.to_s.size; end
+
+end
+
+class PASSWORD_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:codepoint] = Constants::PASSWORD
+		self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
+		self[:length] = self[:payload].size + 4
+	end
+	def encode(str)
+		Rex::Text.to_ebcdic(str)
+	end
+	def to_s
+		self.to_a.pack("nna*")
+	end
+end
+
+class USERID_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:codepoint] = Constants::USERID
+		self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
+		self[:length] = self[:payload].size + 4
+	end
+	def encode(str)
+		Rex::Text.to_ebcdic(str)
+	end
+	def to_s
+		self.to_a.pack("nna*")
+	end
+end
+
+class SECCHK_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
+	:codepoint, :secmec, :rdbnam, :password, :userid)
+	def initialize(args={}) # Takes :dbname, :dbpass, :dbuser
+		self[:magic] = 0xd0
+		self[:format] = 0x01
+		self[:correlid] = 2
+		self[:codepoint] = Constants::SECCHK
+		self[:secmec] = SECMEC_PARAM.new.to_s
+		if args[:dbname] # Include a database name if we're given one.
+			self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+		end
+		self[:password] = PASSWORD_PARAM.new(:payload => args[:dbpass]).to_s
+		self[:userid] = USERID_PARAM.new(:payload => args[:dbuser]).to_s
+		self[:length] = ( 10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size +
+					 self[:password].to_s.size + self[:userid].to_s.size )
+		self[:length2] = self[:length]-6 
+	end
+	def dbname=(str)
+		self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+	end
+	def to_s
+		packstr = "nCCnnna6"
+		packstr += "a22" if self[:rdbnam]
+		packstr += "a*a*" # username and password
+		self.to_a.pack(packstr)
+	end
+end
+
+end
+end
+end
+

data/lib/rex/proto/drda/packet.rb.ut.rb

@@ -0,0 +1,109 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/test'
+require 'rex/proto/drda/packet'
+
+class Rex::Proto::DRDA::UnitTest < Test::Unit::TestCase
+	
+	Klass = Rex::Proto::DRDA
+	Konst = Rex::Proto::DRDA::Constants
+
+	# Test a sample param
+	def test_mgrlvlls_param
+		p = Klass::MGRLVLLS_PARAM.new
+		assert_kind_of(Struct, p)
+		assert_equal(Konst::MGRLVLLS, p.codepoint)
+	end
+
+	# Test a sample ddm
+	def test_secchk_ddm
+		d = Klass::SECCHK_DDM.new
+		assert_kind_of Struct, d
+		assert_equal Konst::SECCHK, d.codepoint
+	end
+
+	# All parameter names should have a corresponding codepoint, 
+	# except "DDM_PARAM" (a generic parameter).
+	def test_all_param_codepoints
+		params = Klass.constants.map {|x| x if x =~ /PARAM$/}.compact
+		assert_operator params.size, :>=, 6 # Allow for more later.
+		params.each do |p|
+			cp = p.split(/_PARAM/).first
+			next if cp == "DDM"
+			assert Konst.const_defined? cp
+			assert_kind_of Numeric, Konst.const_get(cp)
+		end
+	end
+
+	# Similarly, so should DDM Structs.
+	def test_all_ddm_codepoints
+		ddms = Klass.constants.map {|x| x if x =~ /DDM$/}.compact
+		assert_operator ddms.size, :>=, 4 # Allow for more later.
+		ddms.each do |p|
+			cp = p.split(/_DDM/).first
+			next if cp == "BASIC"
+			assert_kind_of Numeric, Konst.const_get(cp)
+		end
+	end
+
+	# Ensure that all params have the same struct.
+	def test_param_struct
+		params = Klass.constants.map {|x| x if x =~ /PARAM$/}.compact
+		params.each do |p|
+			obj = Klass.const_get(p).new
+			assert_equal 3, obj.size
+			assert_respond_to obj, :codepoint
+			assert_respond_to obj, :length
+			assert_respond_to obj, :payload
+		end
+	end
+
+	# Make some similiar assertions about DDMs, though specific DDMs
+	# will have particular elements after the codepoint, usually more
+	# than one.
+	def test_ddm_struct
+		ddms = Klass.constants.map {|x| x if x =~ /DDM$/}.compact
+		ddms.each do |d|
+			obj = Klass.const_get(d).new
+			assert_operator obj.size, :>=, 7 
+			assert_respond_to obj, :length
+			assert_respond_to obj, :magic
+			assert_respond_to obj, :format
+			assert_respond_to obj, :correlid
+			assert_respond_to obj, :length2
+			assert_respond_to obj, :codepoint
+		end
+	end
+
+	# The server packet is special since it's an Array of BASIC_DDM's,
+	# and doesn't have a particular, fixed struct. (It would be nice
+	# to build those up on the fly, but we're not really interested in
+	# validating most server responses right now.
+	def test_server_packet_structure
+		s = Klass::SERVER_PACKET.new
+		assert_kind_of Array, s
+		assert_respond_to s, :to_s
+		assert_respond_to s, :sz
+		assert_respond_to s, :read
+	end
+
+	# Exercise the SERVER_PACKET#read function with a sample packet.
+	def test_server_packet_read
+		pkt = "0015d0420001000f1219000611490000000511a4000050d0520002004a2201000611490000000c112ee2d8d3f0f8f0f2f4000d002fd8e3c4e2d8d3e7f8f6000a00350006119c033300062103022e00172135c3f0c1f8f6c1f0f14bc5c6f1f2070402195612008cd0030002008624080000000000303030303053514c303830323400ffffffff0200000000000000030000000000000000000000202020202020202020202000124d59444232444220202020202020202020200000003331ff383139ff4d59555345522020ff4d594442324442ff514442322f4c494e5558ff353538ff353538ff30ff31323038ff30ffff".scan(/../).map {|x| x.to_i(16).chr}.join
+		s = Klass::SERVER_PACKET.new
+		assert_equal 0, s.size
+		s.read(pkt)
+		assert_equal 3, s.size
+		assert_equal Konst::SECCHKRM, s[0].codepoint
+		assert_equal Konst::ACCRDBRM, s[1].codepoint
+		assert_equal Konst::SQLCARD, s[2].codepoint
+		assert_equal 0xd0, s[0].magic 
+		assert_equal 0x52, s[1].format
+		assert_equal 134, s[2].length2
+		assert_equal 21+80+140, s.sz
+	end
+
+end
+

data/lib/rex/proto/drda/utils.rb

@@ -0,0 +1,123 @@
+require 'rex/proto/drda'
+
+module Rex
+module Proto
+module DRDA
+class Utils
+
+	# Creates a packet with EXCSAT_DDM and an ACCSEC_DDM. This will elicit
+	# a reponse from the target server.
+	def self.client_probe(dbname=nil)
+		pkt = [
+			EXCSAT_DDM.new,
+			ACCSEC_DDM.new(:dbname => dbname)
+		]
+		pkt.map {|x| x.to_s}.join
+	end
+
+	# Creates a packet with EXCSAT_DDM and an SECCHK_DDM.
+	# In order to ever succeed, you do need a successful probe first.
+	def self.client_auth(args={})
+		dbname = args[:dbname]
+		dbuser = args[:dbuser]
+		dbpass = args[:dbpass]
+		pkt = [
+			ACCSEC_DDM.new(:format => 0x41),
+			SECCHK_DDM.new(:dbname => dbname, :dbuser => dbuser, :dbpass => dbpass)
+		]
+		pkt.map {|x| x.to_s}.join
+	end
+
+	def self.server_packet_info(obj)
+		info_hash = {}
+		return info_hash unless obj.kind_of? Rex::Proto::DRDA::SERVER_PACKET
+		obj.each do |ddm|
+			case ddm.codepoint
+			when Constants::EXCSATRD
+				info_hash.merge!(_info_excsatrd(ddm))
+			when Constants::ACCSECRD
+				info_hash.merge!(_info_accsecrd(ddm))
+			when Constants::RDBNFNRM
+				info_hash.merge!(_info_rdbnfnrm(ddm))
+			when Constants::SECCHKRM
+				info_hash.merge!(_info_secchkrm(ddm))
+			else
+				next
+			end 
+		end
+		return info_hash
+	end
+
+	def self._info_excsatrd(ddm)
+		info_hash = {:excsatrd => true}
+		ddm.payload.each do |param|
+			case param.codepoint
+			when Constants::SRVNAM
+				info_hash[:instance_name] = Rex::Text.from_ebcdic(param.payload)
+			when Constants::SRVCLSNM
+				info_hash[:platform] = Rex::Text.from_ebcdic(param.payload)
+			when Constants::SRVRLSLV
+				info_hash[:version] = Rex::Text.from_ebcdic(param.payload)
+			else
+				next
+			end
+		end
+	 return info_hash	
+	end
+
+	def self._info_accsecrd(ddm)
+		info_hash = {:accsecrd => true}
+		ddm.payload.each do |param|
+			case param.codepoint
+			when Constants::SECMEC
+				info_hash[:plaintext_auth] = true if param.payload =~ /\x00\x03/
+			when Constants::SECCHKCD
+				info_hash[:security_check_code] = param.payload.unpack("C").first
+				# A little spurious? This is always nonzero when there's no SECCHKRM DDM.
+				info_hash[:db_login_success] = false unless info_hash[:security_check_code].zero? 
+			else
+				next
+			end
+		end
+		return info_hash
+	end
+
+	def self._info_rdbnfnrm(ddm)
+		info_hash = {:rdbnfnrm => true}
+		info_hash[:database_found] = false
+		ddm.payload.each do |param|
+			case param.codepoint
+			when Constants::RDBNAM
+				info_hash[:db_name] = Rex::Text.from_ebcdic(param.payload).unpack("A*").first
+			when Constants::SRVDGN
+				info_hash[:error_message] = Rex::Text.from_ebcdic(param.payload)
+			else
+				next
+			end
+		end
+		return info_hash
+	end
+
+	def self._info_secchkrm(ddm)
+		info_hash = {:secchkrm => true}
+		ddm.payload.each do |param|
+			case param.codepoint
+			when Constants::SRVCOD
+				info_hash[:severity_code] = param.payload.unpack("n").first
+			when Constants::SECCHKCD
+				info_hash[:security_check_code] = param.payload.unpack("C").first
+			else
+				next
+			end
+		end
+		if info_hash[:serverity].to_i.zero? and info_hash[:security_check_code].to_i.zero?
+			info_hash[:db_login_success] = true
+		end
+		return info_hash
+	end
+
+end
+
+end
+end
+end