librex 0.0.20 → 0.0.21

data/lib/rex/proto/drda.rb

@@ -0,0 +1,5 @@
+require 'rex/proto/drda/constants'
+require 'rex/proto/drda/packet'
+require 'rex/proto/drda/utils'
+
+

data/lib/rex/proto/drda.rb.ts.rb

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+
+require 'rex/test'
+
+module Rex
+	class Test
+		$_REX_TEST_DRDA_HOST = "192.168.145.138"
+		$_REX_TEST_DRDA_USER = "db2inst1"
+		$_REX_TEST_DRDA_PASS = "db2pw"
+	end
+end
+
+require 'rex/proto/drda/constants.rb.ut.rb'
+require 'rex/proto/drda/packet.rb.ut.rb'
+require 'rex/proto/drda/utils.rb.ut.rb'
+
+

data/lib/rex/proto/drda/constants.rb

@@ -0,0 +1,49 @@
+require 'rex/proto/drda'
+
+module Rex
+module Proto
+module DRDA
+class Constants
+
+require 'rex/text'
+
+# DRDA Code Points
+
+EXCSAT     = 0x1041 # Exchange Server Attributes
+EXTNAM     = 0x115e # External Name
+MGRLVLLS   = 0x1404 # Manager-Level List
+SRVCLSNM   = 0x1147 # Server Class Name
+SRVNAM     = 0x116d # Server Name
+SRVRLSLV   = 0x115a # Server Product Release Level
+ACCSEC     = 0x106d # Access Security
+SECMEC     = 0x11a2 # Security Mechanism
+RDBNAM     = 0x2110 # Relational Database Name
+SECTKN     = 0x11dc # Security Token
+EXCSATRD   = 0x1443 # Server Attributes Reply Data
+ACCSECRD   = 0x14ac # Access Security Reply Data
+SRVDGN     = 0x1153 # Server Diagnostic Information
+RDBNFNRM   = 0x2211 # Relational Database Not Found
+SECCHK     = 0x106e # Security Check
+USERID     = 0x11a0 # Remote User ID
+PASSWORD   = 0x11a1 # Remote Password
+RDBACCCL   = 0x210f # RDB Access Manager Class
+PRDID      = 0x112e # Product-Specific Identifier
+PRDDTA     = 0x2104 # Product-Specific Data
+TYPEDEFNAM = 0x002f # Data Type Definition Name
+TTPEDEFOVR = 0x0035 # TYPEDEF Overrides
+CRRTKN     = 0x2135 # Correlation Token
+TRGDFTRT   = 0x213b # Target Default Value Return
+SQLCARD    = 0x2408 # SQL Communications Area Reply Data
+SECCHKRM   = 0x1219 # Security Check Response Message
+SRVCOD     = 0x1149 # Severity Code
+SECCHKCD   = 0x11a4 # Security Check Code
+ACCRDBRM   = 0x2201 # Access to RDB Completed
+
+def self.const_values
+	self.constants.map {|x| self.const_get x}
+end
+
+end
+end
+end
+end

data/lib/rex/proto/drda/constants.rb.ut.rb

@@ -0,0 +1,23 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/test'
+require 'rex/proto/drda/constants'
+
+class Rex::Proto::DRDA::Constants::UnitTest < Test::Unit::TestCase
+	
+	Konst = Rex::Proto::DRDA::Constants
+
+	def test_defines
+		assert_equal(Konst::EXCSAT, 0x1041)
+		assert_equal(Konst::MGRLVLLS, 0x1404)
+		assert_equal(Konst::SECCHKCD, 0x11a4)
+	end
+
+	def test_const_values
+		assert_kind_of(Array, Konst.const_values)
+		assert Konst.const_values.include? Konst::EXCSAT
+	end
+	
+end

data/lib/rex/proto/drda/packet.rb

@@ -0,0 +1,252 @@
+require 'rex/proto/drda'
+
+module Rex
+module Proto
+module DRDA
+
+class Error < StandardError; end
+class RespError < Error; end
+
+# See:
+# http://publib.boulder.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=/com.ibm.db29.doc.drda/db2z_excsat.htm 
+class MGRLVLLS_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:codepoint] = Constants::MGRLVLLS
+		self[:payload] = "\x14\x03\x00\x0a\x24\x07\x00\x0a" +
+			"\x14\x74\x00\x05\x24\x0f\x00\x08" + 
+			"\x14\x40\x00\x09\x1c\x08\x04\xb8"
+		self[:length] = self[:payload].to_s.size+4
+	end
+	def to_s
+		self.to_a.pack("nna*")
+	end
+end
+
+# Currently, only takes a MGRLVLLS param. Extend the struct 
+# when more parameters are defined.
+class EXCSAT_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
+	 :codepoint, :mgrlvlls) 
+
+	def initialize(args={})
+		self[:magic] = 0xd0
+		self[:format] = 0x41
+		self[:correlid] = 1
+		self[:codepoint] = Constants::EXCSAT
+		self[:mgrlvlls] = args[:mgrlvlls] || MGRLVLLS_PARAM.new.to_s
+		self[:length] = (10 + self[:mgrlvlls].to_s.size)
+		self[:length2] = self[:length]-6 
+	end
+
+	def to_s
+		packstr = "nCCnnn"
+		packstr += "a*"  # Pack smarter as more params are added.
+		self.to_a.pack(packstr)
+	end
+end
+
+# See http://publib.boulder.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=/com.ibm.db29.doc.drda/db2z_accsec.htm
+# for all sorts of info about SECMEC.
+class SECMEC_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:length] = 6
+		self[:codepoint] = Constants::SECMEC
+		self[:payload] = 3 # Plaintext username and password.
+	end
+	def to_s
+		self.to_a.pack("nnn")
+	end
+end
+
+# Relational Database name parameter. 
+class RDBNAM_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:length] = 22 # Since the database name is padded out.
+		self[:codepoint] = Constants::RDBNAM
+		self[:payload] = encode(args[:payload].to_s)
+	end
+
+	def encode(str)
+		Rex::Text.to_ebcdic([str].pack("A18"))
+	end
+
+	def payload=(str)
+		self[:payload] = encode(str.to_s)
+	end
+
+	def to_s
+		self.to_a.pack("nna18")
+	end
+
+end
+
+# The ACCSEC DDM is responsible for picking the security mechanism (SECMEC)
+# which, in our case, will always be plain text username and password. It
+# also sets the relational database name (RDBNAM), if specified. You need
+# one to login, but not to probe.
+class ACCSEC_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
+	 :codepoint, :secmec, :rdbnam)
+	def initialize(args={})
+		self[:magic] = 0xd0
+		self[:format] = args[:format] || 0x01
+		self[:correlid] = 2
+		self[:codepoint] = Constants::ACCSEC
+		self[:secmec] = SECMEC_PARAM.new.to_s
+		if args[:dbname] # Include a database name if we're given one.
+			self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+		end
+		self[:length] =  10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size
+		self[:length2] = self[:length]-6 
+	end
+	def dbname=(str)
+		self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+	end
+	def to_s
+		packstr = "nCCnnna6"
+		packstr += "a22" if self[:rdbnam]
+		self.to_a.pack(packstr)
+	end
+end
+
+class DDM_PARAM < Struct.new(:length, :codepoint, :payload)
+
+	def read(str="")
+		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+		raise DRDA::RespError, "DDM_PARAM is too short" if str.size < 4
+		(self[:length], self[:codepoint]) =
+			str.unpack("nn")
+		raise DRDA::RespError, "DDM_PARAM Length is too short" if self[:length] < 4
+		rest = str[4,self[:length]-4] # If it's negative or whatever, it'll end up as "".
+		self[:payload] = rest.to_s[0,self[:length]-4]
+		return self
+	end
+
+	def to_s
+		self.to_a.pack("nna*")
+	end
+
+end
+
+class BASIC_DDM < Struct.new(:length, :magic, :format, :correlid,
+	:length2, :codepoint, :payload)
+	def initialize
+		self[:payload] = []
+	end
+
+	def read(str="")
+		self[:payload].clear
+		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+		raise DRDA::RespError, "Response is too short." if str.size < 10
+		(self[:length],self[:magic],self[:format],
+		 self[:correlid],self[:length2],self[:codepoint]) =
+		 str.unpack("nCCnnn")
+		sanity_check
+		rest = str[10,self[:length2]-4]
+		i = 0
+		while (i < rest.size)
+			if self[:codepoint] == Constants::SQLCARD # These aren't DDM's. 
+				this_param = rest[i,self[:length]-10]
+			else
+				this_param = DDM_PARAM.new.read(rest[i,rest.size])
+			end
+			self[:payload] << this_param
+			i += this_param.to_s.size
+		end
+		return self
+	end
+
+	# Just a quick test. 
+	def sanity_check
+		if self[:length] < 10
+			raise DRDA::RespError, "DDM Length is too short."
+		elsif self[:length2] < 4
+			raise DRDA::RespError, "DDM Length2 is too short."
+		elsif self[:length]-6 != self[:length2]
+			raise DRDA::RespError, "Codepoint: 0x#{self[:codepoint].to_s(16)} DDM Length2 (0x#{self[:length2].to_s(16)}) isn't six less than Length (0x#{self[:length].to_s(16)})"
+		end
+	end
+
+	def to_s
+		self.to_a.pack("nCCnnn") + self[:payload].map {|x| x.to_s}.join
+	end
+
+end
+
+class SERVER_PACKET < Array
+
+	def read(str="")
+		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+		self.clear
+		i = 0
+		while(i < str.size)
+			this_ddm = BASIC_DDM.new.read(str[i,str.size])
+			self << this_ddm
+			i += this_ddm.to_s.size
+		end
+		return self
+	end
+
+	def to_s; self.join; end
+	def sz; self.to_s.size; end
+
+end
+
+class PASSWORD_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:codepoint] = Constants::PASSWORD
+		self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
+		self[:length] = self[:payload].size + 4
+	end
+	def encode(str)
+		Rex::Text.to_ebcdic(str)
+	end
+	def to_s
+		self.to_a.pack("nna*")
+	end
+end
+
+class USERID_PARAM < Struct.new(:length, :codepoint, :payload)
+	def initialize(args={})
+		self[:codepoint] = Constants::USERID
+		self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
+		self[:length] = self[:payload].size + 4
+	end
+	def encode(str)
+		Rex::Text.to_ebcdic(str)
+	end
+	def to_s
+		self.to_a.pack("nna*")
+	end
+end
+
+class SECCHK_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
+	:codepoint, :secmec, :rdbnam, :password, :userid)
+	def initialize(args={}) # Takes :dbname, :dbpass, :dbuser
+		self[:magic] = 0xd0
+		self[:format] = 0x01
+		self[:correlid] = 2
+		self[:codepoint] = Constants::SECCHK
+		self[:secmec] = SECMEC_PARAM.new.to_s
+		if args[:dbname] # Include a database name if we're given one.
+			self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+		end
+		self[:password] = PASSWORD_PARAM.new(:payload => args[:dbpass]).to_s
+		self[:userid] = USERID_PARAM.new(:payload => args[:dbuser]).to_s
+		self[:length] = ( 10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size +
+					 self[:password].to_s.size + self[:userid].to_s.size )
+		self[:length2] = self[:length]-6 
+	end
+	def dbname=(str)
+		self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+	end
+	def to_s
+		packstr = "nCCnnna6"
+		packstr += "a22" if self[:rdbnam]
+		packstr += "a*a*" # username and password
+		self.to_a.pack(packstr)
+	end
+end
+
+end
+end
+end
+

data/lib/rex/proto/drda/packet.rb.ut.rb

@@ -0,0 +1,109 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/test'
+require 'rex/proto/drda/packet'
+
+class Rex::Proto::DRDA::UnitTest < Test::Unit::TestCase
+	
+	Klass = Rex::Proto::DRDA
+	Konst = Rex::Proto::DRDA::Constants
+
+	# Test a sample param
+	def test_mgrlvlls_param
+		p = Klass::MGRLVLLS_PARAM.new
+		assert_kind_of(Struct, p)
+		assert_equal(Konst::MGRLVLLS, p.codepoint)
+	end
+
+	# Test a sample ddm
+	def test_secchk_ddm
+		d = Klass::SECCHK_DDM.new
+		assert_kind_of Struct, d
+		assert_equal Konst::SECCHK, d.codepoint
+	end
+
+	# All parameter names should have a corresponding codepoint, 
+	# except "DDM_PARAM" (a generic parameter).
+	def test_all_param_codepoints
+		params = Klass.constants.map {|x| x if x =~ /PARAM$/}.compact
+		assert_operator params.size, :>=, 6 # Allow for more later.
+		params.each do |p|
+			cp = p.split(/_PARAM/).first
+			next if cp == "DDM"
+			assert Konst.const_defined? cp
+			assert_kind_of Numeric, Konst.const_get(cp)
+		end
+	end
+
+	# Similarly, so should DDM Structs.
+	def test_all_ddm_codepoints
+		ddms = Klass.constants.map {|x| x if x =~ /DDM$/}.compact
+		assert_operator ddms.size, :>=, 4 # Allow for more later.
+		ddms.each do |p|
+			cp = p.split(/_DDM/).first
+			next if cp == "BASIC"
+			assert_kind_of Numeric, Konst.const_get(cp)
+		end
+	end
+
+	# Ensure that all params have the same struct.
+	def test_param_struct
+		params = Klass.constants.map {|x| x if x =~ /PARAM$/}.compact
+		params.each do |p|
+			obj = Klass.const_get(p).new
+			assert_equal 3, obj.size
+			assert_respond_to obj, :codepoint
+			assert_respond_to obj, :length
+			assert_respond_to obj, :payload
+		end
+	end
+
+	# Make some similiar assertions about DDMs, though specific DDMs
+	# will have particular elements after the codepoint, usually more
+	# than one.
+	def test_ddm_struct
+		ddms = Klass.constants.map {|x| x if x =~ /DDM$/}.compact
+		ddms.each do |d|
+			obj = Klass.const_get(d).new
+			assert_operator obj.size, :>=, 7 
+			assert_respond_to obj, :length
+			assert_respond_to obj, :magic
+			assert_respond_to obj, :format
+			assert_respond_to obj, :correlid
+			assert_respond_to obj, :length2
+			assert_respond_to obj, :codepoint
+		end
+	end
+
+	# The server packet is special since it's an Array of BASIC_DDM's,
+	# and doesn't have a particular, fixed struct. (It would be nice
+	# to build those up on the fly, but we're not really interested in
+	# validating most server responses right now.
+	def test_server_packet_structure
+		s = Klass::SERVER_PACKET.new
+		assert_kind_of Array, s
+		assert_respond_to s, :to_s
+		assert_respond_to s, :sz
+		assert_respond_to s, :read
+	end
+
+	# Exercise the SERVER_PACKET#read function with a sample packet.
+	def test_server_packet_read
+		pkt = "0015d0420001000f1219000611490000000511a4000050d0520002004a2201000611490000000c112ee2d8d3f0f8f0f2f4000d002fd8e3c4e2d8d3e7f8f6000a00350006119c033300062103022e00172135c3f0c1f8f6c1f0f14bc5c6f1f2070402195612008cd0030002008624080000000000303030303053514c303830323400ffffffff0200000000000000030000000000000000000000202020202020202020202000124d59444232444220202020202020202020200000003331ff383139ff4d59555345522020ff4d594442324442ff514442322f4c494e5558ff353538ff353538ff30ff31323038ff30ffff".scan(/../).map {|x| x.to_i(16).chr}.join
+		s = Klass::SERVER_PACKET.new
+		assert_equal 0, s.size
+		s.read(pkt)
+		assert_equal 3, s.size
+		assert_equal Konst::SECCHKRM, s[0].codepoint
+		assert_equal Konst::ACCRDBRM, s[1].codepoint
+		assert_equal Konst::SQLCARD, s[2].codepoint
+		assert_equal 0xd0, s[0].magic 
+		assert_equal 0x52, s[1].format
+		assert_equal 134, s[2].length2
+		assert_equal 21+80+140, s.sz
+	end
+
+end
+