librex 0.0.20 → 0.0.21

data/lib/rex/socket/ssl_tcp.rb

@@ -0,0 +1,184 @@
+require 'rex/socket'
+
+###
+#
+# This class provides methods for interacting with an SSL TCP client
+# connection.
+#
+###
+module Rex::Socket::SslTcp
+
+begin
+	@@loaded_openssl = false
+	
+	begin
+		require 'openssl'
+		@@loaded_openssl = true
+	rescue ::Exception
+	end
+	
+
+	include Rex::Socket::Tcp
+
+	##
+	#
+	# Factory
+	#
+	##
+
+	#
+	# Creates an SSL TCP instance.
+	#
+	def self.create(hash = {})
+		raise RuntimeError, "No OpenSSL support" if not @@loaded_openssl
+		hash['SSL'] = true
+		self.create_param(Rex::Socket::Parameters.from_hash(hash))
+	end
+
+	#
+	# Set the SSL flag to true and call the base class's create_param routine.
+	#
+	def self.create_param(param)
+		param.ssl   = true
+		Rex::Socket::Tcp.create_param(param)
+	end
+
+	##
+	#
+	# Class initialization
+	#
+	##
+
+	#
+	# Initializes the SSL socket.
+	#
+	def initsock(params = nil)
+		super
+
+
+		version = :SSLv3
+		if(params)
+			case params.ssl_version
+			when 'SSL2'
+				version = :SSLv2
+			when 'TLS1'
+				version = :TLSv1
+			end
+		end
+		
+		# Build the SSL connection
+		self.sslctx  = OpenSSL::SSL::SSLContext.new(version)
+		
+		# Configure the SSL context
+		# TODO: Allow the user to specify the verify mode and callback
+		# Valid modes:
+		#  VERIFY_CLIENT_ONCE
+		#  VERIFY_FAIL_IF_NO_PEER_CERT 
+		#  VERIFY_NONE
+		#  VERIFY_PEER
+		self.sslctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
+		self.sslctx.options = OpenSSL::SSL::OP_ALL
+		
+		# Set the verification callback
+		self.sslctx.verify_callback = Proc.new do |valid, store|
+			self.peer_verified = valid
+			true
+		end
+		
+		# Tie the context to a socket
+		self.sslsock = OpenSSL::SSL::SSLSocket.new(self, self.sslctx)
+		
+		# XXX - enabling this causes infinite recursion, so disable for now
+		# self.sslsock.sync_close = true
+
+		# Force a negotiation timeout
+		begin
+		Timeout.timeout(params.timeout) do 	
+			# Negotiate the connection
+			self.sslsock.connect
+		end
+
+		rescue ::Timeout::Error
+			raise Rex::ConnectionTimeout.new(params.peerhost, params.peerport)
+		end
+	end
+
+	##
+	#
+	# Stream mixin implementations
+	#
+	##
+
+	#
+	# Writes data over the SSL socket.
+	#
+	def write(buf, opts = {})
+		return sslsock.write(buf)
+	end
+
+	#
+	# Reads data from the SSL socket.
+	#
+	def read(length = nil, opts = {})
+		length = 16384 unless length
+
+		begin
+			return sslsock.sysread(length)
+		rescue EOFError, ::Errno::EPIPE
+			raise EOFError
+		end
+	end
+
+	#
+	# Closes the SSL socket.
+	#
+	def close
+		sslsock.close
+		super
+	end
+
+	# 
+	# Ignore shutdown requests
+	#
+	def shutdown(how=0)
+		# Calling shutdown() on an SSL socket can lead to bad things
+		# Cause of http://metasploit.com/dev/trac/ticket/102
+	end
+	
+	#
+	# Access to peer cert
+	#
+	def peer_cert
+		sslsock.peer_cert if sslsock
+	end
+	
+	#
+	# Access to peer cert chain
+	#
+	def peer_cert_chain
+		sslsock.peer_cert_chain if sslsock
+	end
+	
+	#
+	# Access to the current cipher
+	#
+	def cipher
+		sslsock.cipher if sslsock
+	end
+
+
+
+	attr_reader :peer_verified # :nodoc:
+	attr_accessor :sslsock, :sslctx # :nodoc:
+protected
+
+	attr_writer :peer_verified # :nodoc:
+
+rescue LoadError
+end
+
+	def type?
+		return 'tcp-ssl'
+	end
+
+end

data/lib/rex/socket/ssl_tcp.rb.ut.rb

@@ -0,0 +1,39 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+
+require 'test/unit'
+require 'rex/socket/ssl_tcp'
+
+class Rex::Socket::SslTcp::UnitTest < Test::Unit::TestCase
+
+	def test_ssltcp
+
+		# Create an SslTcp instance
+		t = nil
+		assert_nothing_raised {
+			t = Rex::Socket::SslTcp.create(
+				'PeerHost' => 'www.google.com',
+				'PeerPort' => 443)
+		}
+		assert_kind_of(Rex::Socket::SslTcp, t, "valid ssl tcp")
+
+		# Send a HEAD request and make sure we get some kind of response
+		head_request = "HEAD / HTTP/1.0\r\n\r\n"
+
+		assert_equal(19, t.put(head_request), "sending head request")
+
+		head_response = ""
+
+		assert_nothing_raised {
+			head_response = t.get(nil) || ""
+		}
+
+		assert_match(/^HTTP\/1./, head_response, "valid head response")
+
+		assert_nothing_raised {
+			t.close
+		}
+	end
+
+end

data/lib/rex/socket/ssl_tcp_server.rb

@@ -0,0 +1,122 @@
+require 'rex/socket'
+require 'rex/socket/tcp_server'
+require 'rex/io/stream_server'
+
+###
+#
+# This class provides methods for interacting with an SSL wrapped TCP server.  It
+# implements the StreamServer IO interface.
+#
+###
+module Rex::Socket::SslTcpServer
+
+	@@loaded_openssl = false
+
+	begin
+		require 'openssl'
+		@@loaded_openssl = true
+	rescue ::Exception
+	end
+
+
+	include Rex::Socket::TcpServer
+
+	##
+	#
+	# Factory
+	#
+	##
+
+	def self.create(hash = {})
+		hash['Proto']  = 'tcp'
+		hash['Server'] = true
+		hash['SSL']    = true
+		self.create_param(Rex::Socket::Parameters.from_hash(hash))
+	end
+
+	#
+	# Wrapper around the base class' creation method that automatically sets
+	# the parameter's protocol to TCP and sets the server flag to true.
+	#
+	def self.create_param(param)
+		param.proto  = 'tcp'
+		param.server = true
+		param.ssl    = true
+		Rex::Socket.create_param(param)
+	end
+
+	def initsock(params = nil)
+		raise RuntimeError, "No OpenSSL support" if not @@loaded_openssl
+		self.sslctx  = makessl()
+		super
+	end
+
+	def accept(opts = {})
+		sock = super()
+		return if not sock
+
+		begin
+			ssl = OpenSSL::SSL::SSLSocket.new(sock, self.sslctx)
+			ssl.accept
+			sock.extend(Rex::Socket::SslTcp)
+			sock.sslsock = ssl
+			sock.sslctx  = self.sslctx
+			return sock
+
+		rescue ::OpenSSL::SSL::SSLError
+			sock.close
+			nil
+		end
+	end
+
+
+	def makessl
+		key = OpenSSL::PKey::RSA.new(1024){ }
+
+		cert = OpenSSL::X509::Certificate.new
+		cert.version = 2
+		cert.serial = rand(0xFFFFFFFF)
+		# name = OpenSSL::X509::Name.new([["C","JP"],["O","TEST"],["CN","localhost"]])
+		subject = OpenSSL::X509::Name.new([
+				["C","US"],
+				['ST', Rex::Text.rand_state()],
+				["L", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["O", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["CN", Rex::Text.rand_hostname],
+			])
+		issuer = OpenSSL::X509::Name.new([
+				["C","US"],
+				['ST', Rex::Text.rand_state()],
+				["L", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["O", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["CN", Rex::Text.rand_hostname],
+			])
+
+		cert.subject = subject
+		cert.issuer = issuer
+		cert.not_before = Time.now - (3600 * 365)
+		cert.not_after = Time.now + (3600 * 365)
+		cert.public_key = key.public_key
+		ef = OpenSSL::X509::ExtensionFactory.new(nil,cert)
+		cert.extensions = [
+			ef.create_extension("basicConstraints","CA:FALSE"),
+			ef.create_extension("subjectKeyIdentifier","hash"),
+			ef.create_extension("extendedKeyUsage","serverAuth"),
+			ef.create_extension("keyUsage","keyEncipherment,dataEncipherment,digitalSignature")
+		]
+		ef.issuer_certificate = cert
+		cert.add_extension ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
+		cert.sign(key, OpenSSL::Digest::SHA1.new)
+
+		ctx = OpenSSL::SSL::SSLContext.new()
+		ctx.key = key
+		ctx.cert = cert
+
+		ctx.session_id_context = Rex::Text.rand_text(16)
+
+		return ctx
+	end
+
+	attr_accessor :sslctx
+end
+

data/lib/rex/socket/ssl_tcp_server.rb.ut.rb

@@ -0,0 +1,61 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+
+require 'test/unit'
+require 'rex/socket/ssl_tcp_server'
+require 'rex/socket/ssl_tcp'
+require 'rex/text'
+
+class Rex::Socket::SslTcpServer::UnitTest < Test::Unit::TestCase
+
+	# XXX.  The client data is sent & decrypted just fine.  The server data is not.  the client thread just spins.  BAH.
+	#
+	# As of 2011-03-04, works fine on 1.8.6-p399, 1.8.7-p330, 1.9.1-p378
+	#
+	def test_tcp_server
+		#return;
+
+		serv_port = 65433
+		c = nil
+
+		threads = []
+
+		# Server thread
+		threads << Thread.new() {
+			serv = Rex::Socket.create_tcp_server('LocalPort' => serv_port, 'SSL' => true)
+			assert_kind_of(Rex::Socket::SslTcpServer, serv, "type => ssl")
+			assert_kind_of(Rex::Socket::TcpServer, serv, "type => tcp")
+			assert_kind_of(Rex::IO::StreamServer, serv, "type => stream")
+			s = serv.accept
+			assert_equal("client_data\n", s.get_once(), "s: get_once")
+			assert_equal(3, s.write("Yo\n"), "s: put Yo")
+			# Make sure methods are Strings for 1.9 compat (which returns
+			# symbols)
+			meths = s.methods.map {|m| m.to_s}
+			assert(meths.include?("<<"), "Has <<")
+			assert(meths.include?(">>"), "Has >>")
+			assert(meths.include?("has_read_data?"), "Has has_read_data?")
+			serv.close
+		}
+
+		# Client thread
+		threads << Thread.new() {
+			sleep(2)
+			assert_nothing_raised {
+				c = Rex::Socket::SslTcp.create(
+				'PeerHost' => '127.0.0.1',
+				'PeerPort' => serv_port
+				)
+			}
+			assert_kind_of(Rex::Socket::Tcp, c, "TCP")
+			assert_kind_of(Rex::Socket::SslTcp, c, "SSL")
+			assert_equal(12, c.write("client_data\n"), "c: write")
+			assert_equal("Yo\n", c.get_once(), "c: get_once")
+			c.close if (c)
+		}
+
+		threads.each { |aThread|  aThread.join }
+	end
+
+end

data/lib/rex/socket/subnet_walker.rb

@@ -0,0 +1,75 @@
+require 'rex/socket'
+
+module Rex
+module Socket
+
+###
+#
+# This class provides an interface to enumerating a subnet with a supplied
+# netmask.
+#
+###
+class SubnetWalker
+
+	#
+	# Initializes a subnet walker instance using the supplied subnet
+	# information.
+	#
+	def initialize(subnet, netmask)
+		self.subnet  = Socket.resolv_to_dotted(subnet)
+		self.netmask = Socket.resolv_to_dotted(netmask)
+
+		reset
+	end
+
+	#
+	# Resets the subnet walker back to its original state.
+	#
+	def reset
+		self.curr_ip     = self.subnet.split('.')
+		self.num_ips     = (1 << (32 - Socket.net2bitmask(self.netmask).to_i))
+		self.curr_ip_idx = 0
+	end
+
+	#
+	# Returns the next IP address.
+	#
+	def next_ip
+		if (curr_ip_idx >= num_ips)
+			return nil
+		end
+
+		if (curr_ip_idx > 0)
+			self.curr_ip[3] = (curr_ip[3].to_i + 1) % 256
+			self.curr_ip[2] = (curr_ip[2].to_i + 1) % 256 if (curr_ip[3] == 0)
+			self.curr_ip[1] = (curr_ip[1].to_i + 1) % 256 if (curr_ip[2] == 0)
+			self.curr_ip[0] = (curr_ip[0].to_i + 1) % 256 if (curr_ip[1] == 0)
+		end
+
+		self.curr_ip_idx += 1
+	
+		self.curr_ip.join('.')
+	end
+
+	#
+	# The subnet that is being enumerated.
+	#
+	attr_reader :subnet
+	#
+	# The netmask of the subnet.
+	#
+	attr_reader :netmask
+	#
+	# The total number of IPs within the subnet.
+	#
+	attr_reader :num_ips
+
+protected
+
+	attr_writer   :subnet, :netmask, :num_ips # :nodoc:
+	attr_accessor :curr_ip, :curr_ip_idx # :nodoc:
+
+end
+
+end
+end