librex 0.0.1

data/lib/rex/proto/http/request.rb

@@ -0,0 +1,356 @@
+require 'uri'
+require 'rex/proto/http'
+
+module Rex
+module Proto
+module Http
+
+###
+#
+# HTTP request class.
+#
+###
+class Request < Packet
+
+	PostRequests = ['POST', 'SEARCH']
+
+	##
+	#
+	# Some individual request types.
+	#
+	##
+	
+	#
+	# HTTP GET request class wrapper.
+	#
+	class Get < Request
+		def initialize(uri = '/', proto = DefaultProtocol)
+			super('GET', uri, proto)
+		end
+	end
+
+	#
+	# HTTP POST request class wrapper.
+	#
+	class Post < Request
+		def initialize(uri = '/', proto = DefaultProtocol)
+			super('POST', uri, proto)
+		end
+	end
+
+	#
+	# HTTP PUT request class wrapper.
+	#
+	class Put < Request
+		def initialize(uri = '/', proto = DefaultProtocol)
+			super('PUT', uri, proto)
+		end
+	end
+
+	#
+	# Initializes an instance of an HTTP request with the supplied method, URI,
+	# and protocol.
+	#
+	def initialize(method = 'GET', uri = '/', proto = DefaultProtocol)
+		super()
+
+		self.method    = method
+		self.raw_uri   = uri
+		self.uri_parts = {}
+		self.proto     = proto || DefaultProtocol
+		self.chunk_min_size = 1
+		self.chunk_max_size = 10
+		self.uri_encode_mode = 'hex-normal'
+
+		update_uri_parts
+	end
+
+	#
+	# Updates the command parts for this specific packet type.
+	#
+	def update_cmd_parts(str)
+		if (md = str.match(/^(.+?)\s+(.+?)\s+HTTP\/(.+?)\r?\n?$/))
+			self.method  = md[1]
+			self.raw_uri = URI.decode(md[2])
+			self.proto   = md[3]
+
+			update_uri_parts
+		else
+			raise RuntimeError, "Invalid request command string", caller
+		end
+	end
+
+	#
+	# Split the URI into the resource being requested and its query string.
+	#
+	def update_uri_parts
+		# If it has a query string, get the parts.
+		if ((self.raw_uri) and (md = self.raw_uri.match(/(.+?)\?(.*)$/)))
+			self.uri_parts['QueryString'] = parse_cgi_qstring(md[2])
+			self.uri_parts['Resource']    = md[1]
+		# Otherwise, just assume that the URI is equal to the resource being
+		# requested.
+		else
+			self.uri_parts['QueryString'] = {}
+			self.uri_parts['Resource']    = self.raw_uri
+		end
+
+		self.normalize!(resource)
+		# Set the relative resource to the actual resource.
+		self.relative_resource = resource
+	end
+
+	# normalize out multiple slashes, directory traversal, and self referrential directories
+	def normalize!(str)
+		i = 0 
+		while (str.gsub!(/(\/\.\/|\/\w+\/\.\.\/|\/\/)/,'/')); i += 1; end
+		i
+	end
+
+	# Puts a URI back together based on the URI parts
+	def uri
+		str = self.uri_parts['Resource'].dup || '/'
+		
+		# /././././
+		if self.junk_self_referring_directories
+			str.gsub!(/\//) {
+				'/.' * (rand(3) + 1) + '/'
+			}
+		end
+
+		# /%3faaa=bbbbb
+		# which could possibly decode to "/?aaa=bbbbb", which if the IDS normalizes first, then splits the URI on ?, then it can be bypassed
+		if self.junk_param_start
+			str.sub!(/\//, '/%3f' + Rex::Text.rand_text_alpha(rand(5) + 1) + '=' + Rex::Text.rand_text_alpha(rand(10) + 1) + '/../')
+		end
+
+		# /RAND/../RAND../
+		if self.junk_directories 
+			str.gsub!(/\//) {
+				dirs = ''
+				(rand(5)+5).times {
+					dirs << '/' + Rex::Text.rand_text_alpha(rand(5) + 1) + '/..'
+				}
+				dirs + '/'
+			}
+		end
+
+		# ////
+		#
+		# NOTE: this must be done after all other odd directory junk, since they would cancel this out, except junk_end_of_uri, since that a specific slash in a specific place
+		if self.junk_slashes
+			str.gsub!(/\//) {
+				'/' * (rand(3) + 2)
+			}
+			str.sub!(/^[\/]+/, '/') # only one beginning slash!
+		end
+		
+		# /%20HTTP/1.0%0d%0a/../../
+		# which decodes to "/ HTTP/1.0\r\n"
+		if self.junk_end_of_uri
+			str.sub!(/^\//, '/%20HTTP/1.0%0d%0a/../../')
+		end
+
+		Rex::Text.uri_encode(str, self.uri_encode_mode)
+
+		if !PostRequests.include?(self.method)
+			if param_string.size > 0
+				str << '?' + param_string
+			end
+		end
+		str	
+	end
+
+	def param_string
+		params=[]
+		self.uri_parts['QueryString'].each_pair { |param, value|
+			# inject a random number of params in between each param
+			if self.junk_params
+				rand(10)+5.times {
+					params.push(Rex::Text.rand_text_alpha(rand(16) + 5) + '=' + Rex::Text.rand_text_alpha(rand(10) + 1))
+				}
+			end
+			if value.kind_of?(Array)
+				value.each { |subvalue|
+    				params.push(Rex::Text.uri_encode(param, self.uri_encode_mode) + '=' + Rex::Text.uri_encode(subvalue, self.uri_encode_mode))
+				}
+			else
+    			if !value.nil?
+    				params.push(Rex::Text.uri_encode(param, self.uri_encode_mode) + '=' + Rex::Text.uri_encode(value, self.uri_encode_mode))
+    			else 
+    				params.push(Rex::Text.uri_encode(param, self.uri_encode_mode))
+    			end
+			end
+		}
+
+		# inject some junk params at the end of the param list, just to be sure :P
+		if self.junk_params
+			rand(10)+5.times {
+				params.push(Rex::Text.rand_text_alpha(rand(32) + 5) + '=' + Rex::Text.rand_text_alpha(rand(64) + 5))
+			}
+		end
+		params.join('&')
+	end
+
+	# Updates the underlying URI structure
+	def uri=(str)
+		self.raw_uri = str
+		update_uri_parts
+	end
+ 
+	# Returns a request packet
+	def to_s
+		str = ''
+		if self.junk_pipeline
+			host = ''
+			if self.headers['Host']
+				host = "Host: #{self.headers['Host']}\r\n"
+			end
+			str << "GET / HTTP/1.1\r\n#{host}Connection: Keep-Alive\r\n\r\n" * self.junk_pipeline
+			self.headers['Connection'] = 'Closed'
+		end
+		str + super
+	end
+
+	def body
+		str = super || ''
+		if str.length > 0
+			return str
+		end
+		
+		if PostRequests.include?(self.method)
+			return param_string
+		end
+		''
+	end
+
+	#
+	# Returns the command string derived from the three values.
+	#
+	def cmd_string
+		proto_str = (self.proto =~ /^\d/) ? "HTTP/#{self.proto}" : self.proto
+
+		"#{self.method} #{self.uri} #{proto_str}\r\n"
+	end
+
+	#
+	# Returns the resource that is being requested.
+	#
+	def resource
+		self.uri_parts['Resource']
+	end
+
+	#
+	# Changes the resource URI.  This is used when making a request relative to
+	# a given mount point.
+	#
+	def resource=(rsrc)
+		self.uri_parts['Resource'] = rsrc
+	end
+
+	#
+	# If there were CGI parameters in the URI, this will hold a hash of each
+	# variable to value.  If there is more than one value for a given variable,
+	# an array of each value is returned.
+	#
+	def qstring
+		self.uri_parts['QueryString']
+	end
+
+	#
+	# Returns a hash of variables that contain information about the request,
+	# such as the remote host information.
+	#
+	# TODO
+	#
+	def meta_vars
+	end
+
+	#
+	# The method being used for the request (e.g. GET).
+	#
+	attr_accessor :method
+	#
+	# The raw URI being requested, before any mucking gets to it
+	#
+	attr_accessor :raw_uri
+
+	#
+	# The split up parts of the URI.
+	#
+	attr_accessor :uri_parts
+	#
+	# The protocol to be sent with the request.
+	#
+	attr_accessor :proto
+
+	#
+	# The resource path relative to the root of a server mount point.
+	#
+	attr_accessor :relative_resource
+
+	# add junk directories
+	attr_accessor :junk_directories
+	
+	# add junk slashes 
+	attr_accessor :junk_slashes
+   
+	# add junk self referring directories (aka  /././././)
+	attr_accessor :junk_self_referring_directories
+
+	# add junk params
+	attr_accessor :junk_params
+	
+	# add junk pipeline requests
+	attr_accessor :junk_pipeline
+
+	# add junk start of params
+	attr_accessor :junk_param_start
+	
+	# add junk end of URI
+	attr_accessor :junk_end_of_uri
+	
+	# encoding uri 
+	attr_accessor :uri_encode_mode
+		
+
+protected
+
+	#
+	# Parses a CGI query string into the var/val combinations.
+	#
+	def parse_cgi_qstring(str)
+		qstring = {}
+
+		# Delimit on each variable
+		str.split(/[;&]/).each { |vv|
+			var = vv
+			val = ''
+			
+			if (md = vv.match(/(.+?)=(.*)/))
+				var = md[1]
+				val = md[2]
+			end
+
+			# Add the item to the hash with logic to convert values to an array
+			# if so desired.
+			if (qstring.include?(var))
+				if (qstring[var].kind_of?(Array))
+					qstring[var] << val
+				else
+					curr = self.qstring[var]
+					qstring[var] = [ curr, val ]
+				end
+			else
+				qstring[var] = val
+			end
+		}
+
+		return qstring
+	end
+
+end
+
+end
+end
+end

data/lib/rex/proto/http/request.rb.ut.rb

@@ -0,0 +1,214 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'test/unit'
+require 'rex/proto/http'
+
+class Rex::Proto::Http::Request::UnitTest < Test::Unit::TestCase
+
+	Klass = Rex::Proto::Http::Request
+
+	def test_to_s
+		h = Klass.new
+
+		h.headers['Foo']     = 'Fishing'
+		h.headers['Chicken'] = 47
+		h.auto_cl = true
+
+		assert_equal(
+			"GET / HTTP/1.1\r\n" +
+			"Foo: Fishing\r\n" +
+			"Content-Length: 0\r\n" +
+			"Chicken: 47\r\n\r\n", h.to_s)
+	end
+
+	def test_from_s
+		h = Klass.new
+
+		h.from_s(
+			"POST /foo HTTP/1.0\r\n" +
+			"Lucifer: Beast\r\n" +
+			"HoHo: Satan\r\n" +
+			"Eat: Babies\r\n" +
+			"\r\n")
+
+		assert_equal('POST', h.method, 'method')
+		assert_equal('/foo', h.uri, 'uri')
+		assert_equal('1.0', h.proto, 'proto')
+		assert_equal('Babies', h['Eat'], 'header')
+
+		assert_equal("POST /foo HTTP/1.0\r\n", h.cmd_string, 'cmd_string')
+
+		h.method = 'GET'
+		assert_equal("GET /foo HTTP/1.0\r\n", h.cmd_string, 'set method')
+
+		h.uri = '/bar'
+		assert_equal("GET /bar HTTP/1.0\r\n", h.cmd_string, 'set uri')
+
+		h.proto = '1.2'
+		assert_equal("GET /bar HTTP/1.2\r\n", h.cmd_string, 'set proto')
+	end
+
+	def junk_request
+		h = Klass.new
+		h.from_s("GET /foo/bar.html HTTP/1.0\r\n" + "Foo: Bar\r\n\r\n")
+		return h
+	end
+
+	def test_junk_slashes
+		srand(0)
+
+		h = junk_request
+		assert_equal('GET', h.method, 'method')
+		assert_equal('1.0', h.proto, 'proto')
+		assert_equal('Bar', h['Foo'], 'header')
+		assert_equal('/foo/bar.html', h.uri, 'uri')
+
+		h = junk_request
+		h.junk_directories = 1
+		assert_equal('/D/../DnJT/../kXG/../Y/../BmnXu/../foo/lZ/../J/../zQzFP/../S/../Yxzd/../bar.html', h.uri, 'junk directories')
+
+		h = junk_request
+		h.junk_slashes = 1
+		assert_equal('/foo//bar.html', h.uri, 'junk slashes')
+
+		h = junk_request
+		h.junk_self_referring_directories = 1
+		assert_equal('/././foo/././bar.html', h.uri, 'junk referring directories')
+
+		h = junk_request
+		h.junk_param_start = 1
+		assert_equal('/%3fgf=XjLyc/../foo/bar.html', h.uri, 'junk start of params')
+		
+		h = junk_request
+		h.junk_end_of_uri = 1
+		assert_equal('/%20HTTP/1.0%0d%0a/../../foo/bar.html', h.uri, 'junk end of URI')
+	end
+
+	def test_params
+		srand(0)
+
+		h = junk_request
+		assert_equal('/foo/bar.html', h.uri, 'uri')
+
+		h.uri_parts['QueryString']['B'] = 'a'
+		assert_equal('/foo/bar.html?B=a', h.uri, 'uri with param')
+		
+		h.uri_parts['QueryString']['B'] = ['a','b']
+		assert_equal('/foo/bar.html?B=a&B=b', h.uri, 'uri with a param with multiple values')
+		
+		h.uri_parts['QueryString']['B'] = '='
+		assert_equal('/foo/bar.html?B=%3d', h.uri, 'uri with a param that requires escaping')
+	
+		assert_equal(
+    		"GET /foo/bar.html?B=%3d HTTP/1.0\r\n" +
+    		"Foo: Bar\r\n" +
+    		"Content-Length: 0\r\n" +
+			"\r\n", h.to_s, 'GET to_s'
+		)
+		
+		h.method = 'POST'
+		assert_equal(
+    		"POST /foo/bar.html HTTP/1.0\r\n" +
+    		"Foo: Bar\r\n" +
+    		"Content-Length: 5\r\n" +
+			"\r\n" +
+			'B=%3d',
+			h.to_s, 'POST to_s'
+		)
+
+		h.body = 'FOO'
+		assert_equal(
+    		"POST /foo/bar.html HTTP/1.0\r\n" +
+    		"Foo: Bar\r\n" +
+    		"Content-Length: 3\r\n" +
+			"\r\n" +
+			'FOO',
+			h.to_s, 'POST to_s, with hardcoded body'
+		)
+
+	end
+
+	def test_junk_params
+		srand(0)
+		h = junk_request
+		
+		h.junk_params = 1
+		h.uri_parts['QueryString']['a'] = 'b'
+		h.uri_parts['QueryString']['c'] = 'd'
+
+		assert_equal("GET /foo/bar.html?eZUhlXbdhzzW=HpxJATk&UwDqBU=EQwvK&oebrfUGJbvjTMSxKih=MkBx&nYkjF=DiohcEa&tzJFh=eIUHDVbs&a=b&UHTfAFbreJT=VlcIruAo&mZKziXgT=z&hsytpEdbRjC=tPkpE&yNetXi=JaaW&PiazmuQvoAKLNHeGt=ePpmrS&c=d&BpCycOlbkfdyudyhMgpQCIzKwabBAFYiP=ulrTYGUG&zGCccmlFtJkNVfRjtzIZVtlWQZulBFGMa=OIHtFvqDKybZDOS&ERFeYDFokx=YhShOxHruwhRdMugizXZuyrpuAMJSEHDwMltwtSzxHaxudDKUqBUQqycaXwC&JCspZkaEpKM=hlnghajZyYSUecISZYnqcYSDsTtAKDGbjGTiyymUrAktp&hMPhXMF=BKGGmmLyVyyzCMdJzIFrBrPMvMVSZNecspVGkwoaeFP HTTP/1.0\r\nFoo: Bar\r\nContent-Length: 0\r\n\r\n", h.to_s, 'junk params (GET)')
+
+		h.method = 'POST'
+		assert_equal("POST /foo/bar.html HTTP/1.0\r\nFoo: Bar\r\nContent-Length: 591\r\n\r\nxfgwQgKMdA=WTFkTkFc&axTMmHQdAXPKDDQwJ=lwRJs&PmOhEQkHXbuHWieQbvv=LXO&eaiRjHtwlENl=rIgR&kBdFQmoWeT=UqKDW&a=b&dpoRzoqedheulYQ=ndBX&AXlvaZZGYPlpR=w&uFTvWtLLhHawHvgk=XVC&KFmmkBkFFmjYx=yJExY&CTDNLNkRaGviVUqRlZV=kEviLihu&c=d&LhZhftGZYtmzQXaDaudCF=HPOjnHzmzdxLDNYEzWdmLOSZsDlHdOLJLQnBScAVYJISLczRPDqYVcVOvBMLZn&atiBQBQhhsmoINqT=gXEfWAlfPTPzMtKpQGVeDQABygrSSWPPcHbYYMNSOOUHsrbsPXLNdfu&EcBxxXQpawCvRUmAGsWPKio=VigqsjpnbwKERDleXdmeLCdHzJXAwRozVeaPwRKRDnJ&DHQiEakGgRlbzOWfIdcfiRcvQIsHMgUrLd=AUtcNlvnyEuMlwEpkQSleujwAxJyhwxMGzkjmkeyTmsjO&zRDdbDhzbkVnqKdxdYyQAkiNBCCTMenVNx=zMxABkKqgcCcBNTvRkHGJPSdqSCdRjT",h.to_s, 'junk params (POST)')
+
+		h.method = 'SEARCH'
+		assert_equal("SEARCH /foo/bar.html HTTP/1.0\r\nFoo: Bar\r\nContent-Length: 522\r\n\r\nMjtCUDRsmqKl=vbEzWljeH&YvPKTNnlnSHYg=ovkqQaoQ&geUXPsTibtiRXbNwXeF=nhxicBEVIy&jwjZFB=HBBH&kNsybgrTitkQwq=rDITuAUgir&a=b&YCHsLzcfBQ=SOV&vFhqCboTPHsdjhwxQYFz=RtgW&mJFMqQ=EZ&tRdGcKFkkUyyWKreOzw=BoHFPpgXO&dzZEAaU=YREgxR&c=d&kfeJswjgOXgcrh=usIlCRPDVwydlWSHxaEtZazvTOSgbkmUsDSNzxfhSMvbniHetQBYQtb&yYwMEwzuoO=KbOmNEWPdOqZLfbWurUCZAfuGSWuZNMlTfcTooZvdcqKURAnmiBwWt&xWncBVCgyGmjkXzSmZuPxbVBJzRLADk=TvFUEpQQFgWDIcpKmcfsLibxH&mFJYMohOtPEW=CHtIFnPPpZWZZTdJLjanSIBjyxuKKYfrbNOFXqnxlmLrYRVeSZdlxoxqf&LOgBBkZMIyMY=DKHcOIujjRXMtHvuneTqtyBr", h.to_s, 'junk params (SEARCH)')
+	end
+
+	def test_junk_pipelining
+		srand(0)
+
+		h = Klass.new
+		h.from_s("GET /foo HTTP/1.0\r\n" + "Foo: Bar\r\n\r\n")
+		h.junk_pipeline = 1
+		assert_equal("GET / HTTP/1.1\r\nConnection: Keep-Alive\r\n\r\nGET /foo HTTP/1.0\r\nFoo: Bar\r\nContent-Length: 0\r\nConnection: Closed\r\n\r\n", h.to_s, 'pipeline')
+	end
+
+	def test_junk_all
+        srand(0)
+
+        h = junk_request
+        h.junk_slashes = 1
+        h.junk_directories = 1
+        h.junk_self_referring_directories = 1
+		h.junk_end_of_uri = 1
+		h.junk_param_start = 1
+
+        seen = {}
+		expect = [
+			{"//"=>145, "/./"=>35, "param"=>1, "http"=>1, "/w/../"=>3},
+			{"//"=>149, "/./"=>35, "param"=>1, "http"=>1, "/w/../"=>3},
+			{"//"=>130, "/./"=>30, "param"=>1, "http"=>1, "/w/../"=>2},
+			{"//"=>165, "/./"=>40, "param"=>1, "http"=>1, "/w/../"=>4},
+			{"//"=>145, "/./"=>35, "param"=>1, "http"=>1, "/w/../"=>3},
+		]
+		i = 0
+        5.times {
+            str = h.uri.dup
+            assert_not_equal('/foo/bar.html', str, 'all the junk')
+            assert_nil(seen[str], 'all the junk, not a dup rand')
+            seen[str] = 1
+
+			seen = { '/./' => 0, '//' => 0, '/w/../' => 0, 'http' => 0, 'param' => 0}
+			matched = 1
+			while matched == 1
+				# p str
+				if str.sub!(/\/%20HTTP\/1.0%0d%0a\/\.\.\/\.\.\//, '/')
+					seen['http'] += 1;
+				elsif str.sub!(/\/%3f\w+=\w+\/\.\.\//i, '/')
+					seen['param'] += 1;
+				elsif str.sub!(/\/\w+\/\.\.\//, '/')
+					seen['/./'] += 1;
+				elsif str.sub!(/\/\//, '/')
+					seen['//'] += 1;
+				elsif str.sub!(/\/.\//, '/')
+					seen['/w/../'] += 1;
+				else
+					matched = 0
+				end
+			end
+
+			assert_equal('/foo/bar.html', str, 'normalized')
+			assert_equal(expect[i], seen, 'expected counts')
+			i += 1
+        }
+    end
+
+	def test_normalize
+		h = junk_request
+		h.uri = '/foo/..////./././asdf/././//../bar.html'
+		assert_equal('/bar.html', h.uri, 'normalize on set')
+	end
+end