librex 0.0.65 → 0.0.66

data/lib/rex/parser/nexpose_simple_nokogiri.rb

@@ -1,9 +1,10 @@
-require File.join(File.expand_path(File.dirname(__FILE__)),"nokogiri_doc_mixin")
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
 
 module Rex
 	module Parser
 
-		# If Nokogiri is available, define Nexpose document class. 
+		# If Nokogiri is available, define Nexpose document class.
 		load_nokogiri && class NexposeSimpleDocument < Nokogiri::XML::SAX::Document
 
 		include NokogiriDocMixin
@@ -81,7 +82,7 @@ module Rex
 		def report_vulns(host_object)
 			vuln_count = 0
 			block = @block
-			return unless host_object.kind_of? Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:vulns]
 			@report_data[:vulns].each do |vuln|
 				if vuln[:refs]
@@ -98,12 +99,12 @@ module Rex
 					:refs => vuln[:refs]
 				}
 				if vuln[:port] && vuln[:proto]
-					data[:port] = vuln[:port] 
+					data[:port] = vuln[:port]
 					data[:proto] = vuln[:proto]
 				end
 				db_report(:vuln,data)
 			end
-			
+
 		end
 
 		def collect_host_vuln_id
@@ -243,7 +244,7 @@ module Rex
 		end
 
 		def report_host_fingerprint(host_object)
-			return unless host_object.kind_of? ::Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:host_fingerprint].kind_of? Hash
 			@report_data[:host_fingerprint].reject! {|k,v| v.nil? || v.empty?}
 			return if @report_data[:host_fingerprint].empty?
@@ -312,7 +313,7 @@ module Rex
 		end
 
 		def report_services(host_object)
-			return unless host_object.kind_of? ::Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:ports]
 			return if @report_data[:ports].empty?
 			reported = []

data/lib/rex/parser/nexpose_xml.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Parser
 

data/lib/rex/parser/nmap_nokogiri.rb

@@ -1,9 +1,10 @@
-require File.join(File.expand_path(File.dirname(__FILE__)),"nokogiri_doc_mixin")
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
 
 module Rex
 	module Parser
 
-		# If Nokogiri is available, define Nmap document class. 
+		# If Nokogiri is available, define Nmap document class.
 		load_nokogiri && class NmapDocument < Nokogiri::XML::SAX::Document
 
 		include NokogiriDocMixin
@@ -49,7 +50,7 @@ module Rex
 			when "hostname"
 				record_hostname(attrs)
 			when "port"
-				record_port(attrs) 
+				record_port(attrs)
 			when "state"
 				record_port_state(attrs)
 			when "service"
@@ -73,16 +74,8 @@ module Rex
 				collect_os_data
 				@state[:os] = {}
 			when "port"
-				collect_port_data 
+				collect_port_data
 				@state[:port] = {}
-			when "script"
-				if in_tag("host")
-					if in_tag("port")
-						@state[:portscripts] = {}
-					else
-						@state[:hostscripts] = {}
-					end
-				end
 			when "host" # Roll everything up now
 				collect_host_data
 				host_object = report_host &block
@@ -126,6 +119,7 @@ module Rex
 			return unless in_tag("os")
 			temp_hash = attr_hash(attrs)
 			if temp_hash["accuracy"].to_i == 100
+				@state[:os] ||= {}
 				@state[:os]["osmatch"] = temp_hash["name"]
 			end
 		end
@@ -151,21 +145,21 @@ module Rex
 			return unless in_tag("host")
 			return if in_tag("port")
 			temp_hash = attr_hash(attrs)
-			@state[:hostscripts] ||= {}
-			@state[:hostscripts].merge! temp_hash
-			temp_hash[:addresses] = @state[:addresses]
-			db.emit(:host_script,temp_hash,&block) if block
+
+			if temp_hash["id"] and temp_hash["output"]
+				@state[:scripts] ||= []
+				@state[:scripts] << { temp_hash["id"] => temp_hash["output"] }
+			end
 		end
 
 		def record_port_script(attrs)
 			return unless in_tag("host")
 			return unless in_tag("port")
 			temp_hash = attr_hash(attrs)
-			@state[:portscripts] ||= {}
-			@state[:portscripts].merge! temp_hash
-			temp_hash[:addresses] = @state[:addresses]
-			temp_hash[:port] = @state[:port]
-			db.emit(:port_script,temp_hash,&block) if block
+			if temp_hash["id"] and temp_hash["output"]
+				@state[:port][:scripts] ||= []
+				@state[:port][:scripts] << { temp_hash["id"] => temp_hash["output"] }
+			end
 		end
 
 		def record_port_service(attrs)
@@ -196,7 +190,7 @@ module Rex
 			return unless in_tag("host")
 			attrs.each do |k,v|
 				next unless k == "state"
-				@state[:host_alive] = (v == "up") 
+				@state[:host_alive] = (v == "up")
 			end
 		end
 
@@ -234,12 +228,12 @@ module Rex
 		end
 
 		def collect_host_data
-			if @state[:host_alive] 
+			if @state[:host_alive]
 				@report_data[:state] = Msf::HostState::Alive
 			else
 				@report_data[:state] = Msf::HostState::Dead
 			end
-			if @state[:addresses] 
+			if @state[:addresses]
 				if @state[:addresses].has_key? "ipv4"
 					@report_data[:host] = @state[:addresses]["ipv4"]
 				elsif @state[:addresses].has_key? "ipv6"
@@ -258,6 +252,9 @@ module Rex
 			if @state[:trace] and @state[:trace].has_key?(:hops)
 				@report_data[:traceroute] = @state[:trace]
 			end
+			if @state[:scripts]
+				@report_data[:scripts] = @state[:scripts]
+			end
 		end
 
 		def collect_port_data
@@ -288,6 +285,8 @@ module Rex
 					extra[1] = v
 				when "extrainfo"
 					extra[2] = v
+				when :scripts
+					port_hash[:scripts] = v
 				end
 			end
 			port_hash[:info] = extra.compact.join(" ") unless extra.empty?
@@ -301,7 +300,7 @@ module Rex
 		end
 
 		def report_traceroute(host_object)
-			return unless host_object.kind_of? ::Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:traceroute]
 			tr_note = {
 				:workspace => host_object.workspace,
@@ -309,25 +308,25 @@ module Rex
 				:type => "host.nmap.traceroute",
 				:data => { 'port' => @report_data[:traceroute]["port"].to_i,
 					'proto' => @report_data[:traceroute]["proto"].to_s,
-					'hops' => @report_data[:traceroute][:hops] } 
+					'hops' => @report_data[:traceroute][:hops] }
 			}
 			db_report(:note, tr_note)
 		end
 
 		def report_uptime(host_object)
-			return unless host_object.kind_of? ::Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:last_boot]
 			up_note = {
 				:workspace => host_object.workspace,
 				:host => host_object,
 				:type => "host.last_boot",
-				:data => { :time => @report_data[:last_boot] } 
+				:data => { :time => @report_data[:last_boot] }
 			}
 			db_report(:note, up_note)
 		end
 
 		def report_fingerprint(host_object)
-			return unless host_object.kind_of? ::Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:os_fingerprint]
 			fp_note = @report_data[:os_fingerprint].merge(
 				{
@@ -339,20 +338,51 @@ module Rex
 
 		def report_host(&block)
 			if host_is_okay
-				host_object = db_report(:host, @report_data.merge(
-					:workspace => @args[:wspace] ) )
+				scripts = @report_data.delete(:scripts) || []
+				host_object = db_report(:host, @report_data.merge( :workspace => @args[:wspace] ) )
 				db.emit(:address,@report_data[:host],&block) if block
+
+				scripts.each do |script|
+					script.each_pair do |k,v|
+						ntype =
+						nse_note = {
+							:workspace => host_object.workspace,
+							:host => host_object,
+							:type => "nmap.nse.#{k}.host",
+							:data => { 'output' => v },
+							:update => :unique_data
+						}
+						db_report(:note, nse_note)
+					end
+				end
+
 				host_object
 			end
 		end
 
 		def report_services(host_object,&block)
-			return unless host_object.kind_of? ::Msf::DBManager::Host
+			return unless host_object.kind_of? ::Mdm::Host
 			return unless @report_data[:ports]
 			return if @report_data[:ports].empty?
 			reported = []
 			@report_data[:ports].each do |svc|
-				reported << db_report(:service, svc.merge(:host => host_object))
+				scripts = svc.delete(:scripts) || []
+				svc_obj = db_report(:service, svc.merge(:host => host_object))
+				scripts.each do |script|
+					script.each_pair do |k,v|
+						ntype =
+						nse_note = {
+							:workspace => host_object.workspace,
+							:host => host_object,
+							:service => svc_obj,
+							:type => "nmap.nse.#{k}." + (svc[:proto] || "tcp") +".#{svc[:port]}",
+							:data => { 'output' => v },
+							:update => :unique_data
+						}
+						db_report(:note, nse_note)
+					end
+				end
+				reported << svc_obj
 			end
 			reported
 		end

data/lib/rex/parser/nmap_xml.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 
 require 'rexml/document'
 

data/lib/rex/parser/nokogiri_doc_mixin.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 	module Parser
 
@@ -49,6 +50,7 @@ module Parser
 			@state[:current_tag] = {}
 			@block = block if block
 			@report_data = {:wspace => args[:wspace]}
+			@nx_console_id = args[:nx_console_id]
 			super()
 		end
 
@@ -70,13 +72,26 @@ module Parser
 			return if ref_type.nil? || ref_type.empty? || ref_value.nil? || ref_value.empty?
 			ref_value = ref_value.strip
 			ref_type = ref_type.strip.upcase
+
 			ret = case ref_type
-				when "CVE" 
+				when "CVE"
 					ref_value.gsub("CAN", "CVE")
-				when "MS"  
-					"MSB-MS-#{ref_value}"
+				when "MS"
+					if ref_value =~ /^MS[0-9]/
+						"MSB-#{ref_value}"
+					else
+						"MSB-MS#{ref_value}"
+					end
 				when "URL", "BID"
 					"#{ref_type}-#{ref_value}"
+				when "APPLE"
+					ref_value
+				when "XF"
+					if ref_value =~ /\((\d+)\)$/
+						"#{ref_type}-#{$1}"
+					else
+						"#{ref_type}-#{ref_value}"
+					end
 				else # Handle others?
 					"#{ref_type}-#{ref_value}"
 				end
@@ -87,6 +102,7 @@ module Parser
 			return [] unless orig_refs
 			refs = []
 			orig_refs.each do |ref_hash|
+			
 				ref_hash_sym = Hash[ref_hash.map {|k, v| [k.to_sym, v] }]
 				ref_type = ref_hash_sym[:source].to_s.strip.upcase
 				ref_value = ref_hash_sym[:value].to_s.strip
@@ -99,7 +115,7 @@ module Parser
 			@state[:current_tag].keys.include? tagname
 		end
 
-		# If there's an address, it's not on the blacklist, 
+		# If there's an address, it's not on the blacklist,
 		# it has ports, and the port list isn't
 		# empty... it's okay.
 		def host_is_okay
@@ -120,7 +136,7 @@ module Parser
 		end
 
 		# Circumvent the unknown attribute logging by the various reporters. They
-		# seem to be there just for debugging anyway. 
+		# seem to be there just for debugging anyway.
 		def db_report(table, data)
 			raise "Data should be a hash" unless data.kind_of? Hash
 			nonempty_data = data.reject {|k,v| v.nil?}
@@ -135,21 +151,25 @@ module Parser
 			just_the_facts.empty? ? return : db.send("report_#{table}", just_the_facts)
 		end
 
-		# XXX: It would be better to either have a single registry of acceptable 
-		# keys if we're going to alert on bad ones, or to be more forgiving if 
-		# the caller is this thing. There is basically no way to tell if 
+		# XXX: It would be better to either have a single registry of acceptable
+		# keys if we're going to alert on bad ones, or to be more forgiving if
+		# the caller is this thing. There is basically no way to tell if
 		# report_host()'s tastes are going to change with this scheme.
 		def db_valid_attributes(table)
 			case table.to_s.to_sym
 			when :host
-				Msf::DBManager::Host.new.attribute_names.map {|x| x.to_sym} |
+				::Mdm::Host.new.attribute_names.map {|x| x.to_sym} |
 					[:host, :workspace]
 			when :service
-				Msf::DBManager::Service.new.attribute_names.map {|x| x.to_sym} |
+				::Mdm::Service.new.attribute_names.map {|x| x.to_sym} |
 					[:host, :host_name, :mac, :workspace]
 			when :vuln
-				Msf::DBManager::Vuln.new.attribute_names.map {|x| x.to_sym} |
-					[:host, :refs, :workspace, :port, :proto]
+				::Mdm::Vuln.new.attribute_names.map {|x| x.to_sym} |
+					[:host, :refs, :workspace, :port, :proto, :details, :exploited_at]
+			when :vuln_details
+				::Mdm::VulnDetails.new.attribute_names.map {|x| x.to_sym} | [ :key ]
+			when :host_details
+				::Mdm::HostDetails.new.attribute_names.map {|x| x.to_sym} | [ :key ]
 			when :note, :web_site, :web_page, :web_form, :web_vuln
 				# These guys don't complain
 				[:anything]
@@ -159,7 +179,7 @@ module Parser
 		end
 
 		# Nokogiri 1.4.4 (and presumably beyond) generates attrs as pairs,
-		# like [["value1","foo"],["value2","bar"]] (but not hashes for some 
+		# like [["value1","foo"],["value2","bar"]] (but not hashes for some
 		# reason). 1.4.3.1 (and presumably 1.4.3.x and prior) generates attrs
 		# as a flat array of strings. We want array_pairs.
 		def normalize_attrs(attrs)
@@ -168,7 +188,7 @@ module Parser
 			when Array, NilClass
 				attr_pairs = attrs
 			when String
-				attrs.each_index {|i| 
+				attrs.each_index {|i|
 					next if i % 2 == 0
 					attr_pairs << [attrs[i-1],attrs[i]]
 				}
@@ -199,7 +219,7 @@ module Parser
 			return unless @report_type_ok
 			unless @state[:current_tag].empty?
 				missing_ends = @state[:current_tag].keys.map {|x| "'#{x}'"}.join(", ")
-				msg = "Warning, the provided file is incomplete, and there may be missing\n"
+	l			msg = "Warning, the provided file is incomplete, and there may be missing\n"
 				msg << "data. The following tags were not closed: #{missing_ends}."
 				db.emit(:warning,msg,&block) if block
 			end

data/lib/rex/parser/openvas_nokogiri.rb

@@ -0,0 +1,172 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+module Parser
+
+	# If Nokogiri is available, define OpenVAS document class.
+	load_nokogiri && class OpenVASDocument < Nokogiri::XML::SAX::Document
+
+	include NokogiriDocMixin
+
+	# ourselves with the @state variable, turning things on when we
+	# get here (and turning things off when we exit in end_element()).
+	def start_element(name=nil,attrs=[])
+		attrs = normalize_attrs(attrs)
+		block = @block
+		@state[:current_tag][name] = true
+		case name
+		when "host"
+			@state[:has_text] = true
+		end
+	end
+
+	# When we exit a tag, this is triggered.
+	def end_element(name=nil)
+		block = @block
+		case name
+		when "name"
+			return if not in_tag("result")
+			@state[:has_text] = true
+			@state[:vuln_name] = @text.strip if @text
+			@text = nil
+		when "description"
+			@state[:has_text] = true
+			@state[:vuln_desc] = @text.strip if @text
+			@text = nil
+		when "bid"
+			return if not in_tag("result")
+			return if not in_tag("nvt")
+			@state[:has_text] = true
+			@state[:bid] = @text.strip if @text
+			@text = nil
+		when "cve"
+			return if not in_tag("result")
+			return if not in_tag("nvt")
+			@state[:has_text] = true
+			@state[:cves] = @text.strip if @text
+			@text = nil
+		when "risk_factor"
+			return if not in_tag("result")
+			return if not in_tag("nvt")
+
+			#we do this to clean out the buffer so to speak
+			#if we don't set text to nil now, the text will show up later
+			@state[:has_text] = true
+			@text = nil
+		when "cvss_base"
+			return if not in_tag("result")
+			return if not in_tag("nvt")
+			@state[:has_text] = true
+			@text = nil
+		when "subnet"
+			@state[:has_text] = true
+			@text = nil
+		when "result"
+			return if not in_tag("results")
+			record_vuln
+		when "threat"
+			return if not in_tag("ports")
+			return if not in_tag("port")
+			@state[:has_text] = true
+
+			if not @text.index('(')
+				@state[:name] = nil
+				@state[:port] = nil
+				@state[:proto] = nil
+				@text = nil
+				return
+			end
+
+			@state[:name] = @text.split(' ')[0] if @text
+			@state[:port] = @text.split('(')[1].split('/')[0] if @text
+			@state[:proto] = @text.split('(')[1].split('/')[1].split(')')[0] if @text
+
+			@text = nil
+		when "host"
+			if in_tag('result')
+				@state[:has_text] = true
+				@state[:host] = @text.strip if @text
+				@text = nil
+			elsif in_tag('ports')
+				return if not in_tag('port')
+				@state[:has_text] = true
+				@state[:host] = @text.strip if @text
+				@text = nil
+			end
+		when "port"
+			if in_tag('result')
+				@state[:has_text] = true
+				if not @text.index('(')
+					@state[:proto] = nil
+					@state[:port] = nil
+					@text = nil
+					return
+				end
+				@state[:proto] = @text.split('(')[0].strip if @text
+				@state[:port] = @text.split('(')[1].split('/')[0].gsub(/\)/, '') if @text
+				@text = nil
+			elsif in_tag('ports')
+				record_service
+			end
+		when "name"
+			return if not in_tag("result")
+			@state[:has_text] = true
+			@text = nil
+		end
+		@state[:current_tag].delete name
+	end
+
+	def record_vuln
+		if (@state[:cves] and @state[:cves] == "NOCVE")  and (@state[:bid] and @state[:bid] == "NOBID")
+			return
+		end
+
+		if @state[:cves] and @state[:cves] != "NOCVE" and !@state[:cves].empty?
+			@state[:cves].split(',').each do |cve|
+				vuln_info = {}
+				vuln_info[:host] = @state[:host]
+				vuln_info[:refs] = normalize_references([{ :source => "CVE", :value => cve}])
+				vuln_info[:name] = @state[:vuln_name]
+				vuln_info[:info] = @state[:vuln_desc]
+				vuln_info[:port] = @state[:port]
+				vuln_info[:proto] = @state[:proto]
+
+				db_report(:vuln, vuln_info)
+			end
+		end
+		if @state[:bid] and @state[:bid] != "NOBID" and !@state[:bid].empty?
+			@state[:bid].split(',').each do |bid|
+				vuln_info = {}
+				vuln_info[:host] = @state[:host]
+				vuln_info[:refs] = normalize_references([{ :source => "BID", :value => bid}])
+				vuln_info[:name] = @state[:vuln_name]
+				vuln_info[:info] = @state[:vuln_desc]
+				vuln_info[:port] = @state[:port]
+				vuln_info[:proto] = @state[:proto]
+
+				db_report(:vuln, vuln_info)
+			end
+		end
+	end
+
+	def record_service
+		return if not @state[:name]
+
+		service_info = {}
+		service_info[:host] = @state[:host]
+		service_info[:name] = @state[:name]
+		service_info[:port] = @state[:port]
+		service_info[:proto] = @state[:proto]
+
+		db_report(:service, service_info)
+
+		host_info = {}
+		host_info[:host] = @state[:host]
+
+		db_report(:host, host_info)
+	end
+end
+end
+end
+