librex 0.0.13 → 0.0.15

data/lib/rex/proto/http/client.rb.ut.rb

@@ -1,95 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
-
-require 'test/unit'
-require 'rex/proto/http'
-
-class Rex::Proto::Http::Client::UnitTest < Test::Unit::TestCase
-
-	Klass = Rex::Proto::Http::Client
-
-	def test_parse
-		c = Klass.new('www.metasploit.com')
-
-		# Set request factory parameters
-		c.set_config(
-			'vhost'      => 'www.metasploit.com',
-			'agent'      => 'Metasploit Framework/3.3',
-			'version'    => '1.1',
-			'cookie'     => 'NoCookie=NotACookie'
-		)
-
-		# Set client parameters
-		c.set_config(
-			'read_max_data' => 1024 * 1024
-		)
-
-		#
-		# Request the main web page
-		#
-		r = c.request_raw(
-			'method' => 'GET',
-			'uri'    => '/'
-		)
-
-		resp = c.send_recv(r)
-
-		assert_equal(200, resp.code)
-		assert_equal('OK', resp.message)
-		assert_equal('1.1', resp.proto)
-
-		#
-		# Request a file that does not exist
-		#
-		r = c.request_raw(
-			'method' => 'GET',
-			'uri'    => '/NoFileHere.404'
-		)
-
-		resp = c.send_recv(r)
-
-		assert_equal(404, resp.code)
-		assert_equal('Not Found', resp.message)
-		assert_equal('1.1', resp.proto)
-
-
-		#
-		# Send a POST request that results in a 302
-		#
-		c = Klass.new('beta.microsoft.com')
-		c.set_config('vhost' => 'beta.microsoft.com')
-
-		r = c.request_cgi(
-			'method' => 'POST',
-			'uri'    => '/',
-			'vars_post'  => { 'var' => 'val' },
-			'ctype' => 'application/x-www-form-urlencoded'
-		)
-
-		resp = c.send_recv(r)
-
-		#assert_equal(200, resp.code)
-		#assert_equal('OK', resp.message)
-		assert_equal(301, resp.code)
-		assert_equal('Moved Permanently', resp.message)
-		assert_equal('1.1', resp.proto)
-	end
-
-	def test_ssl
-		c = Klass.new('www.metasploit.com', 443, {}, true)
-		c.set_config('vhost' => 'www.metasploit.com')
-		r = c.request_raw(
-			'method' => 'GET',
-			'uri'    => '/'
-		)
-		resp = c.send_recv(r)
-
-		assert_equal(200, resp.code)
-		assert_equal('OK', resp.message)
-		assert_equal('1.0', resp.proto)
-		c.close
-	end
-
-end
-

data/lib/rex/proto/http/handler.rb

@@ -1,46 +0,0 @@
-module Rex
-module Proto
-module Http
-
-###
-#
-# This class acts as the base class for all handlers.
-#
-###
-class Handler
-
-	require 'rex/proto/http/handler/erb'
-	require 'rex/proto/http/handler/proc'
-
-	#
-	# Initializes the handler instance as being associated with the supplied
-	# server.
-	#
-	def initialize(server)
-		self.server = server
-	end
-
-	#
-	# By default, handlers do not require a relative resource.
-	#
-	def self.relative_resource_required?
-		false
-	end
-
-	#
-	# Calls the class method.
-	#
-	def relative_resource_required?
-		self.class.relative_resource_required?
-	end
-
-protected
-
-	attr_accessor :server # :nodoc:
-
-end
-
-
-end
-end
-end

data/lib/rex/proto/http/handler/erb.rb

@@ -1,128 +0,0 @@
-require 'erb'
-include ERB::Util
-
-module Rex
-module Proto
-module Http
-
-###
-#
-# This class implements a handler for ERB (.rhtml) template files.  This is
-# based off the webrick handler.
-#
-###
-class Handler::Erb < Handler
-
-	#
-	# ERB handlers required a relative resource so that the full path name can
-	# be computed.
-	#
-	def self.relative_resource_required?
-		true
-	end
-
-	#
-	# Initializes the ERB handler
-	#
-	def initialize(server, root_path, opts = {})
-		super(server)
-
-		self.root_path = root_path
-		self.opts = opts
-
-		self.opts['MimeType'] = "text/html" unless self.opts['MimeType']
-	end
-
-	#
-	# Called when a request arrives.
-	#
-	def on_request(cli, req)
-		resource = req.relative_resource
-
-		# Make sure directory traversals aren't happening
-		if (resource =~ /\.\./)
-			wlog("Erb::on_request: Dangerous request performed: #{resource}",
-				LogSource)
-			return
-		# If the request is for the root directory, use the document index file.
-		elsif (resource == '/')
-			resource << opts['DocumentIndex'] || 'index.rhtml'
-		end
-
-		begin
-			resp = Response.new
-
-			# Calculate the actual file path on disk.
-			file_path = root_path + resource
-		
-			# Serialize the contents of the file
-			data = ''
-			
-			File.open(file_path, 'rb') { |f|
-				data = f.read
-			}
-
-			# Set the content-type to text/html by default.  We do this before
-			# evaluation so that the script can change it.
-			resp['Content-Type'] = server ? server.mime_type(resource) : 'text/html'
-
-			# If the requested file is a ruby html file, evaluate it.
-			if (File.extname(file_path) == ".rhtml")
-				# Evaluate the data and set the output as the response body.
-				resp.body = evaluate(ERB.new(data), cli, req, resp)
-			# Otherwise, just set the body to the data that was read.
-			else
-				resp.body = data
-			end
-		rescue Errno::ENOENT
-			server.send_e404(cli, req)
-		rescue
-			elog("Erb::on_request: #{$!}\n#{$@.join("\n")}", LogSource)
-
-			resp.code    = 500
-			resp.message = "Internal Server Error"
-			resp.body =
-				"<html><head>" +
-				"<title>Internal Server Error</title>" +
-				"</head><body> " +
-				"<h1>Internal Server Error</h1>" +
-				"The server encountered an error:<br/><br/> <b>" + html_escape($!) + "</b><br/><br/>" +
-				"Stack trace:<br/><br/>" +
-				$@.map { |e| html_escape(e.to_s) }.join("<br/>") + 
-				"</body></html>"
-		end
-
-		# Send the response to the 
-		if (cli and resp)
-			cli.send_response(resp)
-		end
-
-		resp
-	end
-
-	#
-	# Evaulates the ERB context in a specific binding context.
-	#
-	def evaluate(erb, cli, request, response)
-		# If the thing that created this handler wanted us to use a callback
-		# instead of the default behavior, then let's do that.
-		if (opts['ErbCallback'])
-			opts['ErbCallback'].call(erb, cli, request, response)
-		else
-			Module.new.module_eval {
-				query_string = request.qstring
-				meta_vars = request.meta_vars
-				erb.result(binding)
-			}
-		end
-	end
-
-protected
-
-	attr_accessor :root_path, :opts # :nodoc:
-
-end
-
-end
-end
-end

data/lib/rex/proto/http/handler/erb.rb.ut.rb

@@ -1,21 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', '..'))
-
-require 'test/unit'
-require 'rex/proto/http'
-
-class Rex::Proto::Http::Handler::Erb::UnitTest < Test::Unit::TestCase
-
-	Klass = Rex::Proto::Http::Handler::Erb
-	Request = Rex::Proto::Http::Request
-
-	def test_erb
-		k = Klass.new(nil, File.dirname(__FILE__))
-		r = k.on_request(nil, Request::Get.new("/erb.rb.ut.rb.rhtml"))
-
-		assert_not_nil(r)
-		assert_equal("foo 4\n", r.body)
-	end
-
-end

data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml

@@ -1 +0,0 @@
-foo <%= 2 + 2 %>

data/lib/rex/proto/http/handler/proc.rb

@@ -1,60 +0,0 @@
-require 'erb'
-
-module Rex
-module Proto
-module Http
-
-###
-#
-# This class is used to wrapper the calling of a procedure when a request
-# arrives.
-#
-###
-class Handler::Proc < Handler
-
-	#
-	# Initializes the proc handler with the supplied procedure
-	#
-	def initialize(server, procedure, virt_dir = false)
-		super(server)
-
-		self.procedure = procedure
-		self.virt_dir  = virt_dir || false
-	end
-
-	#
-	# Returns true if the procedure is representing a virtual directory.
-	#
-	def relative_resource_required?
-		virt_dir	
-	end
-
-	#
-	# Called when a request arrives.
-	#
-	def on_request(cli, req)
-		begin
-			procedure.call(cli, req)
-		rescue Errno::EPIPE
-			elog("Proc::on_request: Client closed connection prematurely", LogSource)
-		rescue
-			elog("Proc::on_request: #{$!}\n\n#{$@.join("\n")}", LogSource)
-			if self.server and self.server.context
-				exploit = self.server.context['MsfExploit']
-				if exploit
-					exploit.print_error("Exception handling request: #{$!}")
-				end
-			end
-		end
-	end
-
-protected
-
-	attr_accessor :procedure # :nodoc:
-	attr_accessor :virt_dir  # :nodoc:
-
-end
-
-end
-end
-end

data/lib/rex/proto/http/handler/proc.rb.ut.rb

@@ -1,24 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', '..'))
-
-require 'test/unit'
-require 'rex/proto/http'
-
-class Rex::Proto::Http::Handler::Proc::UnitTest < Test::Unit::TestCase
-
-	Klass = Rex::Proto::Http::Handler::Proc
-	Request = Rex::Proto::Http::Request
-
-	def test_proc
-		cool = 0
-		k = Klass.new(nil, Proc.new { |cli, req|
-			cool = 1
-		})
-			
-		r = k.on_request(nil, Request::Get.new("/erb.rb.ut.rb.rhtml"))
-
-		assert_equal(1, cool)
-	end
-
-end

data/lib/rex/proto/http/header.rb

@@ -1,161 +0,0 @@
-require 'rex/proto/http'
-
-module Rex
-module Proto
-module Http
-
-###
-#
-# Represents the logical HTTP header portion of an HTTP packet (request or
-# response).
-#
-###
-class Packet::Header < Hash
-
-	#
-	# Initializes an HTTP packet header class that inherits from a Hash base
-	# class.
-	#
-	def initialize
-		self.dcase_hash = {}
-
-		reset
-	end
-
-	#
-	# Parses a header from a string.
-	#
-	# XXX - Putting : in a header value breaks this badly
-	def from_s(header)
-		reset
-
-		# ghettoooooo!
-		# If we don't have any newlines..., put one there.
-		if (header.size > 0 && header !~ /\r\n/)
-			header << "\r\n"
-		end
-
-		# put the non-standard line terminations back to normal
-		# gah.  not having look behinds suck,
-		header.gsub!(/([^\r])\n/,'\1' + "\r\n")
-
-		# undo folding, kinda ugly but works for now.
-		header.gsub!(/:\s*\r\n\s+/smi,': ')
-
-		# Extract the command string
-		self.cmd_string = header.slice!(/.+\r\n/)
-
-		# Extract each header value pair
-		header.split(/\r\n/m).each { |str|
-			if (md = str.match(/^(.+?): (.+?)$/))
-				if (self[md[1]])
-					self[md[1]] << ", " + md[2]
-				else
-					self[md[1]] = md[2]
-				end
-			end
-		}
-	end
-
-	#
-	# More advanced [] that does downcase comparison.
-	#
-	def [](key)
-		begin
-			rv = self.fetch(key)
-		rescue IndexError
-			rv = nil
-		end
-		if (rv == nil)
-			begin
-				rv = self.dcase_hash[key.downcase]
-			rescue IndexError
-				rv = nil
-			end
-		end
-
-		return rv
-	end
-
-	#
-	# More advanced []= that does downcase storage.
-	#
-	def []=(key, value)
-		stored = false
-
-		self.each_key { |k|
-			if (k.downcase == key.downcase)
-				self.store(k, value)
-				stored = true
-			end
-		}
-
-		self.store(key, value) if (stored == false)
-		self.dcase_hash[key.downcase] = value
-	end
-
-	#
-	# Converts the header to a string.
-	#
-	def to_s(prefix = '')
-		str = prefix
-
-		if self.junk_headers
-			while str.length < 4096
-				if self.fold
-					str << "X-#{Rex::Text.rand_text_alphanumeric(rand(30) + 5)}:\r\n\t#{Rex::Text.rand_text_alphanumeric(rand(1024) + 1)}\r\n"
-				else
-					str << "X-#{Rex::Text.rand_text_alphanumeric(rand(30) + 5)}: #{Rex::Text.rand_text_alphanumeric(rand(1024) + 1)}\r\n"
-				end
-			end
-		end
-
-		each_pair { |var, val|
-			if self.fold
-				str << "#{var}:\r\n\t#{val}\r\n"
-			else
-				str << "#{var}: #{val}\r\n"
-			end
-		}
-
-		str << "\r\n"
-
-		return str
-	end
-
-	#
-	# Brings in from an array like yo.
-	#
-	def from_a(ary)
-		ary.each { |e|
-			self[e[0]] = e[1]
-		}
-	end
-
-	#
-	# Flushes all header pairs.
-	#
-	def reset
-		self.cmd_string = ''
-		self.clear
-		self.dcase_hash.clear
-	end
-
-	#
-	# The raw command string associated with the header which will vary between
-	# requests and responses.
-	#
-	attr_accessor :junk_headers
-	attr_accessor :cmd_string
-	attr_accessor :fold
-
-protected
-
-	attr_accessor :dcase_hash # :nodoc:
-
-end
-
-end
-end
-end
-