librex 0.0.20 → 0.0.21

data/lib/rex/parser/ini.rb.ut.rb

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+
+require 'test/unit'
+require 'rex/parser/ini'
+
+class Rex::Parser::Ini::UnitTest < Test::Unit::TestCase
+
+	Klass   = Rex::Parser::Ini
+	TestIni = <<END
+[group1]
+cat=dog
+bird=frog
+
+[group2]
+salad=cake
+END
+
+	def test_parse
+		ini = Klass.from_s(TestIni)
+
+		assert_equal('dog', ini['group1']['cat'])
+		assert_equal('frog', ini['group1']['bird'])
+		assert_equal('cake', ini['group2']['salad'])
+		assert_equal(TestIni + "\n", ini.to_s)
+	end
+	
+end

data/lib/rex/parser/ip360_aspl_xml.rb

@@ -0,0 +1,102 @@
+require 'rexml/document'
+require 'rex/ui'
+
+module Rex
+module Parser
+
+
+class IP360ASPLXMLStreamParser
+	
+	@vulnid = nil
+	@appid = nil
+	@location = nil
+
+	attr_accessor :on_found_aspl
+
+	def initialize(&block)
+		reset_state
+		on_found_aspl = block if block
+	end
+
+	def reset_state
+		@aspl = {'vulns' => {'name' => { }, 'cve' => { }, 'bid' => { } },
+			'oses' => {'name' => { } } }
+		@state = :generic_state
+	end
+
+	def tag_start(name, attributes)
+		case name
+		when "vulns"
+			@location = "vulns"
+		when "vuln"
+			@vulnid = attributes['id'].strip
+		when "name"
+			@state = :is_name
+		when "advisories"
+			@c = ""
+			@cfirst = 1
+			@b = ""
+			@bfirst = 1
+			@x = Hash.new
+		when "publisher"
+			@state = :is_pub
+		when "id"
+			@state = :is_refid
+		when "operatingSystems"
+			@location = "os"
+		when "operatingSystem"
+			@osid = attributes['id'].strip
+		end
+	end
+	
+	def text(str)
+		case @state
+		when :is_name
+			@aspl['vulns']['name'][@vulnid] = str if @location == "vulns"
+			@aspl['oses'][@osid] = str if @location == "os"
+		when :is_pub
+			@x['pub'] = str
+		when :is_refid
+			@x['refid'] = str
+		end
+	end
+
+	def tag_end(name)
+		case name
+		when "ontology"
+			on_found_aspl.call(@aspl) if on_found_aspl
+			reset_state
+		when "advisory"
+			if (@x['pub'] =~ /CVE/)
+				if (@cfirst == 0)
+					@c += ","
+				end
+				@c += @x['refid']
+				@cfirst = 0
+			elsif (@x['pub'] =~ /BugTraq/)
+				if (@bfirst == 0)
+					@b += ","
+				end
+				@b += @x['refid']
+				@bfirst = 0
+			end
+		when "advisories"
+			@aspl['vulns']['cve'][@vulnid] = @c
+			@aspl['vulns']['bid'][@vulnid] = @b
+			@c = ""
+			@b = ""
+		end
+		@state = :generic_state
+	end
+
+	# We don't need these methods, but they're necessary to keep REXML happy
+	#
+	def xmldecl(version, encoding, standalone); end
+	def cdata; end
+	def comment(str); end
+	def instruction(name, instruction); end
+	def attlist; end
+end
+
+end
+end

data/lib/rex/parser/ip360_xml.rb

@@ -0,0 +1,97 @@
+require 'rexml/document'
+require 'rex/ui'
+
+module Rex
+module Parser
+
+
+class IP360XMLStreamParser
+
+	attr_accessor :on_found_host
+
+	def initialize(&block)
+		reset_state
+		on_found_host = block if block
+	end
+
+	def reset_state
+		@host = {'hname' => nil, 'hid' => nil, 'addr' => nil, 'mac' => nil, 'os' => nil,
+			'vulns' => ['vuln' => {'vulnid' => nil, 'port' => nil, 'proto' => nil} ],
+			'apps' => ['app' => {'appid' => nil, 'svcid' => nil, 'port' => nil, 'proto' => nil } ],
+		}
+		@state = :generic_state
+	end
+
+	def tag_start(name, attributes)
+		case name
+		when "host"
+			@host['hid'] = attributes['persistent_id']
+		when "ip"
+			@state = :is_ip
+		when "dnsName"
+			@state = :is_fqdn
+		when "macAddress"
+			@state = :is_mac
+		when "os"
+			@host['os'] = attributes['id']	
+		when "vulnerability"
+			@x = Hash.new	
+			@x['vulnid'] = attributes['id']
+		when "port"
+			@state = :is_port
+		when "protocol"
+			@state = :is_proto
+		when "application"
+			@y = Hash.new
+			@y['appid'] = attributes['application_id']
+			@y['svcid'] = attributes['svcid']
+			@y['port'] = attributes['port']
+			@y['proto'] = attributes['protocol']
+			@host['apps'].push @y
+		end
+	end
+	
+	def text(str)
+		case @state
+		when :is_fqdn
+			@host['hname'] = str
+		when :is_ip
+			@host['addr'] = str
+		when :is_mac
+			@host['mac'] = str
+		when :is_port
+			@x['port'] = str
+		when :is_proto
+			@x['proto'] = str
+		end
+	end
+
+	def tag_end(name)
+		case name
+		when "host"
+			on_found_host.call(@host) if on_found_host
+			reset_state
+		when "vulnerability"
+			@host['vulns'].push @x
+		end
+		@state = :generic_state
+	end
+
+	def cdata(d)
+		#do nothing
+	end
+
+	# We don't need these methods, but they're necessary to keep REXML happy
+	#
+	def xmldecl(version, encoding, standalone) # :nodoc:
+	end
+	def comment(str) # :nodoc:
+	end
+	def instruction(name, instruction) # :nodoc:
+	end
+	def attlist # :nodoc:
+	end
+end
+
+end
+end

data/lib/rex/parser/nessus_xml.rb

@@ -0,0 +1,118 @@
+require 'rexml/document'
+require 'rex/ui'
+
+module Rex
+module Parser
+
+
+class NessusXMLStreamParser
+
+	attr_accessor :on_found_host
+
+	def initialize(&block)
+		reset_state
+		on_found_host = block if block
+	end
+
+	def reset_state
+		@host = {'hname' => nil, 'addr' => nil, 'mac' => nil, 'os' => nil, 'ports' => [
+			'port' => {'port' => nil, 'svc_name'  => nil, 'proto' => nil, 'severity' => nil,
+			'nasl' => nil, 'description' => nil, 'cve' => [], 'bid' => [], 'xref' => [], 'msf' => nil } ] }
+		@state = :generic_state
+	end
+
+	def tag_start(name, attributes)
+		case name
+		when "tag"
+			if attributes['name'] == "mac-address"
+				@state = :is_mac
+			end
+			if attributes['name'] == "host-fqdn"
+				@state = :is_fqdn
+			end
+			if attributes['name'] == "ip-addr"
+				@state = :is_ip
+			end
+			if attributes['name'] == "host-ip"
+				@state = :is_ip
+			end
+			if attributes['name'] == "operating-system"
+				@state = :is_os
+			end
+		when "ReportHost"
+			@host['hname'] = attributes['name']
+		when "ReportItem"
+			@cve = Array.new
+			@bid = Array.new
+			@xref = Array.new
+			@x = Hash.new
+			@x['nasl'] = attributes['pluginID']
+			@x['port'] = attributes['port']
+			@x['proto'] = attributes['protocol']
+			@x['svc_name'] = attributes['svc_name']
+			@x['severity'] = attributes['severity']
+		when "description"
+			@state = :is_desc
+		when "cve"
+			@state = :is_cve
+		when "bid"
+			@state = :is_bid
+		when "xref"
+			@state = :is_xref
+		when "solution"
+			@state = :is_solution
+		when "metasploit_name"
+			@state = :msf
+		end
+	end
+	
+	def text(str)
+		case @state
+		when :is_fqdn
+			@host['hname'] = str
+		when :is_ip
+			@host['addr'] = str
+		when :is_os
+			@host['os'] = str
+		when :is_mac
+			@host['mac'] = str
+		when :is_desc
+			@x['description'] = str
+		when :is_cve
+			@cve.push str
+		when :is_bid
+			@bid.push str
+		when :is_xref
+			@xref.push str
+		when :msf
+			#p str
+			@x['msf'] = str
+		end
+	end
+
+	def tag_end(name)
+		case name
+		when "ReportHost"
+			on_found_host.call(@host) if on_found_host
+			reset_state
+		when "ReportItem"
+			@x['cve'] = @cve
+			@x['bid'] = @bid
+			@x['xref'] = @xref
+			@host['ports'].push @x
+		end
+		@state = :generic_state
+	end
+
+	# We don't need these methods, but they're necessary to keep REXML happy
+	#
+	def xmldecl(version, encoding, standalone); end
+	def cdata; end
+	def comment(str); end
+	def instruction(name, instruction); end
+	def attlist; end
+end
+
+end
+end
+

data/lib/rex/parser/netsparker_xml.rb

@@ -0,0 +1,94 @@
+module Rex
+module Parser
+
+
+class NetSparkerXMLStreamParser
+
+	attr_accessor :on_found_vuln
+
+	def initialize(on_found_vuln = nil)
+		self.on_found_vuln = on_found_vuln if on_found_vuln
+		reset_state		
+	end
+
+	def reset_state
+		@state = :generic_state
+		@vuln  = {'info' => []}
+		@attr  = {}
+	end
+
+	def tag_start(name, attributes)
+		@state = "in_#{name.downcase}".intern
+		@attr  = attributes
+		
+		case name
+		when "vulnerability"
+			@vuln['confirmed'] = attributes['confirmed']
+		end
+	end
+
+	def text(str)
+		case @state
+		when :in_url
+			@vuln['url'] ||= ""
+			@vuln['url']  += str
+		when :in_type
+			@vuln['type'] ||= ""		
+			@vuln['type']  += str
+		when :in_severity
+			@vuln['severity'] ||= ""
+			@vuln['severity']  += str
+		when :in_vulnerableparametertype
+			@vuln["vparam_type"] ||= ""
+			@vuln["vparam_type"]  += str
+		when :in_vulnerableparameter
+			@vuln["vparam_name"] ||= ""			
+			@vuln["vparam_name"]  += str		
+		when :in_vulnerableparametervalue
+			@vuln["vparam_value"] ||= ""		
+			@vuln["vparam_value"]  += str				
+		when :in_rawrequest
+			@vuln["request"] ||= ""			
+			@vuln["request"]  += str
+		when :in_rawresponse
+			@vuln["response"] ||= ""
+			@vuln["response"]  += str
+		when :in_info
+			# <info name="Identified Internal Path(s)">C:\AppServ\www\test-apps\dokeos\main\inc\banner.inc.php</info>
+			if not str.to_s.strip.empty?
+				@vuln['info'] << [@attr['name'] || "Information", str]
+			end
+		when :in_netsparker
+		when :in_target
+		when :in_scantime
+		when :generic_state
+		when :in_vulnerability
+		when :in_extrainformation
+		else 
+			# $stderr.puts "unknown state: #{@state}"
+		end
+	end
+
+	def tag_end(name)
+		case name
+		when "vulnerability"
+			@vuln.keys.each do |k|
+				@vuln[k] = @vuln[k].strip if @vuln[k].kind_of?(::String)
+			end
+			on_found_vuln.call(@vuln) if on_found_vuln
+			reset_state
+		end
+	end
+
+	# We don't need these methods, but they're necessary to keep REXML happy
+	def xmldecl(version, encoding, standalone); end
+	def cdata; end
+	def comment(str); end
+	def instruction(name, instruction); end
+	def attlist; end
+end
+end
+end
+
+__END__
+

data/lib/rex/parser/nexpose_xml.rb

@@ -0,0 +1,136 @@
+module Rex
+module Parser
+
+# XXX doesn't tie services to vulns
+class NexposeXMLStreamParser
+
+	attr_accessor :callback
+
+	def initialize(callback = nil)
+		reset_state
+		self.callback = callback if callback
+	end
+
+	def reset_state
+		@state = :generic_state
+		@host = { "status" => nil, "endpoints" => [], "names" => [], "vulns" => {} }
+		@vuln = { "refs" => [] }
+	end
+
+	def tag_start(name, attributes)
+		case name
+		when "node"
+			@host["hardware-address"] = attributes["hardware-address"]
+			@host["addr"] = attributes["address"]
+			@host["status"] = attributes["status"]
+		when "os"
+			# Take only the highest certainty
+			if not @host["os_certainty"] or (@host["os_certainty"].to_f < attributes["certainty"].to_f)
+				@host["os_vendor"]    = attributes["vendor"]
+				@host["os_family"]    = attributes["family"]
+				@host["os_product"]   = attributes["product"]
+				@host["arch"]         = attributes["arch"]
+				@host["os_certainty"] = attributes["certainty"]
+			end
+		when "name"
+			#@host["names"].push attributes["name"]
+			@state = :in_name
+		when "endpoint"
+			# This is a port in NeXpose parlance
+			@host["endpoints"].push(attributes)
+		when "service"
+			@state = :in_service
+			# Store any service info with the associated port.  There shouldn't
+			# be any collisions on attribute names here, so just merge them.
+			@host["endpoints"].last.merge!(attributes)
+		when "fingerprint"
+			if @state == :in_service
+				@host["endpoints"].last.merge!(attributes)
+			end
+		when "test"
+			if attributes["status"] == "vulnerable-exploited" or attributes["status"] == "vulnerable-version"
+				@host["vulns"][attributes["id"]] = attributes.dup
+			end
+		when "vulnerability"
+			@vuln.merge! attributes
+		when "reference"
+			@state = :in_reference
+			@vuln["refs"].push attributes
+		end
+	end
+
+	def text(str)
+		case @state
+		when :in_name
+			@host["names"].push str
+		when :in_reference
+			@vuln["refs"].last["value"] = str
+		end
+	end
+
+	def tag_end(name)
+		case name
+		when "node"
+			callback.call(:host, @host) if callback
+			reset_state
+		when "vulnerability"
+			callback.call(:vuln, @vuln) if callback
+			reset_state
+		when "service","reference"
+			@state = :generic_state
+		end
+	end
+
+	# We don't need these methods, but they're necessary to keep REXML happy
+	def xmldecl(version, encoding, standalone) # :nodoc:
+	end
+	def cdata # :nodoc:
+	end
+	def comment(str) # :nodoc:
+	end
+	def instruction(name, instruction) # :nodoc:
+	end
+	def attlist # :nodoc:
+	end
+end
+end
+end
+
+__END__
+
+<node address="10.1.1.10" status="alive" hardware-address="0007371F3BE8">
+<names>
+<name>NETBIOSNAME</name>
+<name>hostname.example.com</name>
+</names>
+<fingerprints>
+<os  certainty="1.00" device-class="Domain controller" vendor="Microsoft" family="Windows" product="Windows Server 2003, Standard Edition" version="SP2" arch="x86"/>
+<os  certainty="0.85" device-class="General" vendor="Microsoft" family="Windows" product="Windows Server 2003"/>
+<os  certainty="0.70" vendor="Microsoft" family="Windows" product="Windows Server 2003"/>
+</fingerprints>
+<software>
+<fingerprint  certainty="1.00" vendor="Acronis" product="Acronis&#160;True&#160;Image&#160;Echo&#160;Server" version="9.5.8163"/>
+<fingerprint  certainty="1.00" vendor="Acronis" product="Acronis&#160;Universal&#160;Restore for Acronis&#160;True&#160;Image&#160;Echo&#160;Server" version="9.5.8076"/>
+<fingerprint  certainty="1.00" software-class="Internet Client" vendor="Microsoft" family="Internet Explorer" product="Internet Explorer" version="7.0.5730.11"/>
+<fingerprint  certainty="1.00" software-class="Database Client" vendor="Microsoft" family="MDAC" product="MDAC" version="2.8"/>
+<fingerprint  certainty="1.00" software-class="Media Client" vendor="Microsoft" family="Windows Media Player" product="Windows Media Player" version="10.0.0.3997"/>
+<fingerprint  certainty="1.00" vendor="MySolutions NORDIC" product="NSClient++ (Win32)" version="0.3.4.0"/>
+<fingerprint  certainty="1.00" vendor="Symantec Corporation" product="LiveUpdate 3.1 (Symantec Corporation)" version="3.1.0.99"/>
+<fingerprint  certainty="1.00" vendor="Symantec Corporation" product="Symantec AntiVirus" version="10.1.5000.5"/>
+</software>
+<tests>
+<test status="not-vulnerable" id="backdoor-ckb.cfaae1e6">
+
+<endpoint protocol="tcp" port="139" status="open">
+<services>
+<service name="CIFS">
+<fingerprints>
+<fingerprint  certainty="1.00" product="Windows Server 2003 R2 5.2"/>
+</fingerprints>
+<tests>
+</tests>
+</service>
+</services>
+</endpoint>
+</node>
+