librex 0.0.20 → 0.0.21

data/lib/rex/proto/smb/utils.rb.ut.rb

@@ -0,0 +1,20 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/test'
+require 'rex/proto/smb/utils'
+
+class Rex::Proto::SMB::Utils::UnitTest < Test::Unit::TestCase
+	
+	Klass = Rex::Proto::SMB::Utils
+
+	def test_nbname
+	
+		nbdecoded = 'METASPLOITROCKS!'
+		nbencoded = 'ENEFFEEBFDFAEMEPEJFEFCEPEDELFDCB'
+		
+		assert_equal(Klass.nbname_encode(nbdecoded),  nbencoded )
+		assert_equal(Klass.nbname_decode(nbencoded),  nbdecoded )
+	end
+end

data/lib/rex/proto/sunrpc.rb

@@ -0,0 +1 @@
+require 'rex/proto/sunrpc/client'

data/lib/rex/proto/sunrpc/client.rb

@@ -0,0 +1,195 @@
+require 'rex/socket'
+require 'rex/encoder/xdr'
+
+module Rex
+module Proto
+module SunRPC
+
+class RPCTimeout < ::Interrupt
+   def initialize(msg = 'Operation timed out.')
+      @msg = msg
+   end
+
+	def to_s
+		@msg
+	end
+end
+
+# XXX: CPORT!
+class Client
+	AUTH_NULL = 0
+	AUTH_UNIX = 1
+
+	PMAP_PROG = 100000
+	PMAP_VERS = 2
+	PMAP_GETPORT = 3
+
+	CALL = 0
+
+	attr_accessor :rhost, :rport, :proto, :program, :version
+	attr_accessor :pport, :call_sock, :timeout, :context
+
+	attr_accessor :should_fragment
+
+	def initialize(opts)
+		self.rhost   = opts[:rhost]
+		self.rport   = opts[:rport]
+		self.program = opts[:program]
+		self.version = opts[:version]
+		self.timeout = opts[:timeout] || 20
+		self.context = opts[:context] || {}
+		self.proto   = opts[:proto]
+
+		if self.proto.downcase !~ /^(tcp|udp)$/
+			raise ::Rex::ArgumentError, 'Protocol is not "tcp" or "udp"'
+		end
+
+		@pport = nil
+
+		@auth_type = AUTH_NULL
+		@auth_data = ''
+
+		@call_sock = nil
+	end
+
+# XXX: Add optional parameter to have proto be something else
+	def create()
+		proto_num = 0
+		if @proto.eql?('tcp')
+			proto_num = 6
+		elsif @proto.eql?('udp')
+			proto_num = 17
+		end
+
+		buf =
+			Rex::Encoder::XDR.encode(CALL, 2, PMAP_PROG, PMAP_VERS, PMAP_GETPORT,
+				@auth_type, [@auth_data, 400], AUTH_NULL, '',
+				@program, @version, proto_num, 0)
+
+		sock = make_rpc(@proto, @rhost, @rport)
+		send_rpc(sock, buf)
+		ret = recv_rpc(sock)
+		close_rpc(sock)
+
+		return ret
+	end
+
+	def call(procedure, buffer, maxwait = self.timeout)
+		buf =
+			Rex::Encoder::XDR.encode(CALL, 2, @program, @version, procedure,
+				@auth_type, [@auth_data, 400], AUTH_NULL, '')+
+			buffer
+
+		if ! @call_sock
+			@call_sock = make_rpc(@proto, @rhost, @pport)
+		end
+
+		send_rpc(@call_sock, buf)
+		recv_rpc(@call_sock, maxwait)
+	end
+
+	def destroy
+		close_rpc(@call_sock) if @call_sock
+		@call_sock = nil
+	end
+
+	def authnull_create
+		@auth_type = AUTH_NULL
+		@auth_data = ''
+	end
+
+	def authunix_create(host, uid, gid, groupz)
+		raise ::Rex::ArgumentError, 'Hostname length is too long' if host.length > 255
+# 10?
+		raise ::Rex::ArgumentError, 'Too many groups' if groupz.length > 10
+
+		@auth_type = AUTH_UNIX
+		@auth_data =
+			Rex::Encoder::XDR.encode(0, host, uid, gid, groupz) # XXX: TIME! GROUPZ?!
+	end
+
+# XXX: Dirty, integrate some sort of request system into create/call?
+	def portmap_req(host, port, rpc_vers, procedure, buffer)
+		buf = Rex::Encoder::XDR.encode(CALL, 2, PMAP_PROG, rpc_vers, procedure,
+			AUTH_NULL, '', AUTH_NULL, '') + buffer
+
+		sock = make_rpc('tcp', host, port)
+		send_rpc(sock, buf)
+		ret = recv_rpc(sock)
+		close_rpc(sock)
+
+		return ret
+	end
+
+	private
+	def make_rpc(proto, host, port)
+		Rex::Socket.create(
+			'PeerHost'	=> host,
+			'PeerPort'	=> port,
+			'Proto'		=> proto,
+			'Timeout'   => self.timeout,
+			'Context'   => self.context
+		)
+	end
+
+	def build_tcp(buf)
+		if !self.should_fragment
+			return Rex::Encoder::XDR.encode(0x80000000 | buf.length) + buf
+		end
+
+		str = buf.dup
+
+		fragmented = ''
+
+		while (str.size > 0)
+			frag = str.slice!(0, rand(3) + 1)
+			len = frag.size
+			if str.size == 0
+				len |= 0x80000000
+			end
+
+			fragmented += Rex::Encoder::XDR.encode(len) + frag
+		end
+
+		return fragmented
+	end
+
+	def send_rpc(sock, buf)
+		buf = gen_xid() + buf
+		if sock.type?.eql?('tcp')
+			buf = build_tcp(buf)
+		end
+		sock.put(buf)
+	end
+
+	def recv_rpc(sock, maxwait=self.timeout)
+
+		buf = nil
+		begin
+			Timeout.timeout(maxwait) { buf = sock.get }
+		rescue ::Timeout
+		end
+
+		return nil if not buf
+
+		buf.slice!(0..3)
+		if sock.type?.eql?('tcp')
+			buf.slice!(0..3)
+		end
+		return buf if buf.length > 1
+		return nil
+	end
+
+	def close_rpc(sock)
+		sock.close
+	end
+
+	def gen_xid
+		return Rex::Encoder::XDR.encode(rand(0xffffffff) + 1)
+	end
+end
+
+end
+end
+end
+

data/lib/rex/proto/tftp.rb

@@ -0,0 +1,12 @@
+# $Id: tftp.rb 9962 2010-08-06 17:21:22Z jduck $
+#
+# TFTP Server implementation according to:
+#
+# RFC1350, RFC2347, RFC2348, RFC2349
+#
+# written by jduck <jduck [at] metasploit.com>
+# thx to scriptjunkie for pointing out option extensions
+#
+
+require 'rex/proto/tftp/constants'
+require 'rex/proto/tftp/server'

data/lib/rex/proto/tftp/constants.rb

@@ -0,0 +1,39 @@
+# $Id: constants.rb 9962 2010-08-06 17:21:22Z jduck $
+require 'rex/proto/tftp'
+
+module Rex
+module Proto
+module TFTP
+
+OPCODES = %w{ Unknown RRQ WRQ DATA ACK ERROR }
+OpRead = 1
+OpWrite = 2
+OpData = 3
+OpAck = 4
+OpError = 5
+OpOptAck = 6
+
+ERRCODES = [
+	"Undefined",
+	"File not found",
+	"Access violation",
+	"Disk full or allocation exceeded",
+	"Illegal TFTP operation",
+	"Unknown transfer ID",
+	"File already exists",
+	"No such user",
+	"Failed option negotiation"
+]
+
+ErrFileNotFound = 1
+ErrAccessViolation = 2
+ErrDiskFull = 3
+ErrIllegalOperation = 4
+ErrUnknownTransferId = 5
+ErrFileExists = 6
+ErrNoSuchUser = 7
+ErrFailedOptNegotiation = 8
+
+end
+end
+end

data/lib/rex/proto/tftp/server.rb

@@ -0,0 +1,497 @@
+# $Id: server.rb 11636 2011-01-25 02:24:37Z hdm $
+require 'rex/socket'
+require 'rex/proto/tftp'
+
+module Rex
+module Proto
+module TFTP
+
+#
+# Little util function
+#
+def self.get_string(data)
+	idx = data.index("\x00")
+	return nil if not idx
+	ret = data.slice!(0, idx)
+	# Slice off the nul byte.
+	data.slice!(0,1)
+	ret
+end
+
+
+##
+#
+# TFTP Server class
+#
+##
+class Server
+
+	def initialize(port = 69, listen_host = '0.0.0.0', context = {})
+		self.listen_host = listen_host
+		self.listen_port = port
+		self.context = context
+		self.sock = nil
+		@shutting_down = false
+		@output_dir = nil
+		@tftproot = nil
+
+		self.files = []
+		self.uploaded = []
+		self.transfers = []
+	end
+
+
+	#
+	# Start the TFTP server
+	#
+	def start
+		self.sock = Rex::Socket::Udp.create(
+			'LocalHost' => listen_host,
+			'LocalPort' => listen_port,
+			'Context'   => context
+			)
+
+		self.thread = Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
+			monitor_socket
+		}
+	end
+
+
+	#
+	# Stop the TFTP server
+	#
+	def stop
+		@shutting_down = true
+
+		# Wait a maximum of 30 seconds for all transfers to finish.
+		start = ::Time.now
+		while (self.transfers.length > 0)
+			::IO.select(nil, nil, nil, 0.5)
+			dur = ::Time.now - start
+			break if (dur > 30)
+		end
+
+		self.files.clear
+		self.thread.kill
+		self.sock.close rescue nil # might be closed already
+	end
+
+
+	#
+	# Register a filename and content for a client to request
+	#
+	def register_file(fn, content, once = false)
+		self.files << {
+			:name => fn,
+			:data => content,
+			:once => once
+		}
+	end
+
+
+	#
+	# Register an entire directory to serve files from
+	#
+	def set_tftproot(rootdir)
+		@tftproot = rootdir if ::File.directory?(rootdir)
+	end
+
+
+	#
+	# Register a directory to write uploaded files to
+	#
+	def set_output_dir(outdir)
+		@output_dir = outdir if ::File.directory?(outdir)
+	end
+
+
+	#
+	# Send an error packet w/the specified code and string
+	#
+	def send_error(from, num)
+		if (num < 1 or num >= ERRCODES.length)
+			# ignore..
+			return
+		end
+		pkt = [OpError, num].pack('nn')
+		pkt << ERRCODES[num]
+		pkt << "\x00"
+		send_packet(from, pkt)
+	end
+
+
+	#
+	# Send a single packet to the specified host
+	#
+	def send_packet(from, pkt)
+		self.sock.sendto(pkt, from[0], from[1])
+	end
+
+
+	#
+	# Find the hash entry for a file that may be offered
+	#
+	def find_file(fname)
+		# Files served via register_file() take precedence.
+		self.files.each do |f|
+			if (fname == f[:name])
+				return f
+			end
+		end
+
+		# Now, if we have a tftproot, see if it can serve from it
+		if @tftproot
+			return find_file_in_root(fname)
+		end
+
+		nil
+	end
+
+
+	#
+	# Find the file in the specified tftp root and add a temporary
+	# entry to the files hash.
+	#
+	def find_file_in_root(fname)
+		fn = ::File.expand_path(::File.join(@tftproot, fname))
+
+		# Don't allow directory traversal
+		return nil if fn.index(@tftproot) != 0
+
+		return nil if not ::File.file?(fn) or not ::File.readable?(fn)
+
+		# Read the file contents, and register it as being served once
+		data = data = ::File.open(fn, "rb") { |fd| fd.read(fd.stat.size) }
+		register_file(fname, data, true)
+
+		# Return the last file in the array
+		return self.files[-1]
+	end
+
+
+	attr_accessor :listen_host, :listen_port, :context
+	attr_accessor :sock, :files, :transfers, :uploaded
+	attr_accessor :thread
+	
+	attr_accessor :incoming_file_hook
+
+protected
+
+	def find_transfer(type, from, block)
+		self.transfers.each do |tr|
+			if (tr[:type] == type and tr[:from] == from and tr[:block] == block)
+				return tr
+			end
+		end
+		nil
+	end
+
+	def save_output(tr)
+		self.uploaded << tr[:file]
+		
+		return incoming_file_hook.call(tr) if incoming_file_hook
+		
+		if @output_dir
+			fn = tr[:file][:name].split(File::SEPARATOR)[-1]
+			if fn
+				fn = ::File.join(@output_dir, Rex::FileUtils.clean_path(fn))
+				::File.open(fn, "wb") { |fd|
+					fd.write(tr[:file][:data])
+				}
+			end
+		end
+	end
+
+
+	def check_retransmission(tr)
+		elapsed = ::Time.now - tr[:last_sent]
+		if (elapsed >= tr[:timeout])
+			# max retries reached?
+			if (tr[:retries] < 3)
+				#if (tr[:type] == OpRead)
+				#	puts "[-] ack timed out, resending block"
+				#else
+				#	puts "[-] block timed out, resending ack"
+				#end
+				tr[:last_sent] = nil
+				tr[:retries] += 1
+			else
+				#puts "[-] maximum tries reached, terminating transfer"
+				self.transfers.delete(tr)
+			end
+		end
+	end
+
+
+	#
+	# See if there is anything to do.. If so, dispatch it.
+	#
+	def monitor_socket
+		while true
+			rds = [@sock]
+			wds = []
+			self.transfers.each do |tr|
+				if (not tr[:last_sent])
+					wds << @sock
+					break
+				end
+			end
+			eds = [@sock]
+
+			r,w,e = ::IO.select(rds,wds,eds,1)
+
+			if (r != nil and r[0] == self.sock)
+				buf,host,port = self.sock.recvfrom(65535)
+				# Lame compatabilitiy :-/
+				from = [host, port]
+				dispatch_request(from, buf)
+			end
+
+			#
+			# Check to see if transfers need maintenance
+			#
+			self.transfers.each do |tr|
+				# We handle RRQ and WRQ separately
+				#
+				if (tr[:type] == OpRead)
+					# Are we awaiting an ack?
+					if (tr[:last_sent])
+						check_retransmission(tr)
+					elsif (w != nil and w[0] == self.sock)
+						# No ack waiting, send next block..
+						chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
+						if (chunk and chunk.length >= 0)
+							pkt = [OpData, tr[:block]].pack('nn')
+							pkt << chunk
+
+							send_packet(tr[:from], pkt)
+							tr[:last_sent] = ::Time.now
+
+							# If the file is a one-serve, mark it as started
+							tr[:file][:started] = true if (tr[:file][:once])
+						else
+							# No more chunks.. transfer is most likely done.
+							# However, we can only delete it once the last chunk has been
+							# acked.
+						end
+					end
+				else
+					# Are we awaiting data?
+					if (tr[:last_sent])
+						check_retransmission(tr)
+					elsif (w != nil and w[0] == self.sock)
+						# Not waiting for data, send an ack..
+						#puts "[*] sending ack for block %d" % [tr[:block]]
+						pkt = [OpAck, tr[:block]].pack('nn')
+
+						send_packet(tr[:from], pkt)
+						tr[:last_sent] = ::Time.now
+
+						# If we had a 0-511 byte chunk, we're done.
+						if (tr[:last_size] and tr[:last_size] < tr[:blksize])
+							#puts "[*] Transfer complete, saving output"
+							save_output(tr)
+							self.transfers.delete(tr)
+						end
+					end
+				end
+			end
+		end
+	end
+
+
+	def next_block(tr)
+		tr[:block] += 1
+		tr[:last_sent] = nil
+		tr[:retries] = 0
+	end
+
+
+	#
+	# Dispatch a packet that we received
+	#
+	def dispatch_request(from, buf)
+
+		op = buf.unpack('n')[0]
+		buf.slice!(0,2)
+
+		#XXX: todo - create call backs for status
+		#start = "[*] TFTP - %s:%u - %s" % [from[0], from[1], OPCODES[op]]
+
+		case op
+		when OpRead
+			# Process RRQ packets
+			fn = TFTP::get_string(buf)
+			mode = TFTP::get_string(buf).downcase
+
+			#puts "%s %s %s" % [start, fn, mode]
+
+			if (not @shutting_down) and (file = self.find_file(fn))
+				if (file[:once] and file[:started])
+					send_error(from, ErrFileNotFound)
+				else
+					transfer = {
+						:type => OpRead,
+						:from => from,
+						:file => file,
+						:block => 1,
+						:blksize => 512,
+						:offset => 0,
+						:timeout => 3,
+						:last_sent => nil,
+						:retries => 0
+					}
+
+					process_options(from, buf, transfer)
+
+					self.transfers << transfer
+				end
+			else
+				#puts "[-] file not found!"
+				send_error(from, ErrFileNotFound)
+			end
+
+		when OpWrite
+			# Process WRQ packets
+			fn = TFTP::get_string(buf)
+			mode = TFTP::get_string(buf).downcase
+
+			#puts "%s %s %s" % [start, fn, mode]
+
+			if not @shutting_down
+				transfer = {
+					:type => OpWrite,
+					:from => from,
+					:file => { :name => fn, :data => '' },
+					:block => 0, # WRQ starts at 0
+					:blksize => 512,
+					:timeout => 3,
+					:last_sent => nil,
+					:retries => 0
+				}
+
+				process_options(from, buf, transfer)
+
+				self.transfers << transfer
+			else
+				send_error(from, ErrIllegalOperation)
+			end
+
+		when OpAck
+			# Process ACK packets
+			block = buf.unpack('n')[0]
+
+			#puts "%s %d" % [start, block]
+
+			tr = find_transfer(OpRead, from, block)
+			if not tr
+				# NOTE: some clients, such as pxelinux, send an ack for block 0.
+				# To deal with this, we simply ignore it as we start with block 1.
+				return if block == 0
+
+				# If we didn't find it, send an error.
+				send_error(from, ErrUnknownTransferId)
+			else
+				# acked! send the next block
+				tr[:offset] += tr[:blksize]
+				next_block(tr)
+
+				# If the transfer is finished, delete it
+				if (tr[:offset] > tr[:file][:data].length)
+					#puts "[*] Transfer complete"
+					self.transfers.delete(tr)
+
+					# if the file is a one-serve, delete it from the files array
+					if tr[:file][:once]
+						#puts "[*] Removed one-serve file: #{tr[:file][:name]}"
+						self.files.delete(tr[:file])
+					end
+				end
+			end
+
+		when OpData
+			# Process Data packets
+			block = buf.unpack('n')[0]
+			data = buf.slice(2, buf.length)
+
+			#puts "%s %d %d bytes" % [start, block, data.length]
+
+			tr = find_transfer(OpWrite, from, (block-1))
+			if not tr
+				# If we didn't find it, send an error.
+				send_error(from, ErrUnknownTransferId)
+			else
+				tr[:file][:data] << data
+				tr[:last_size] = data.length
+				next_block(tr)
+
+				# Similar to RRQ transfers, we cannot detect that the
+				# transfer finished here. We must do so after transmitting
+				# the final ACK.
+			end
+
+		else
+			# Other packets are unsupported
+			#puts start
+			send_error(from, ErrAccessViolation)
+
+		end
+	end
+
+	def process_options(from, buf, tr)
+		found = 0
+		to_ack = []
+		while buf.length >= 4
+			opt = TFTP::get_string(buf)
+			break if not opt
+			val = TFTP::get_string(buf)
+			break if not val
+
+			found += 1
+
+			# Is it one we support?
+			opt.downcase!
+
+			case opt
+			when "blksize"
+				val = val.to_i
+				if val > 0
+					tr[:blksize] = val
+					to_ack << [ opt, val.to_s ]
+				end
+
+			when "timeout"
+				val = val.to_i
+				if val >= 1 and val <= 255
+					tr[:timeout] = val
+					to_ack << [ opt, val.to_s ]
+				end
+
+			when "tsize"
+				if tr[:type] == OpRead
+					len = tr[:file][:data].length
+				else
+					val = val.to_i
+					len = val
+				end
+				to_ack << [ opt, len.to_s ]
+
+			end
+		end
+
+		return if to_ack.length < 1
+
+		# if we have anything to ack, do it
+		data = [OpOptAck].pack('n')
+		to_ack.each { |el|
+			data << el[0] << "\x00" << el[1] << "\x00"
+		}
+
+		send_packet(from, data)
+	end
+
+end
+
+end
+end
+end