librex 0.0.65 → 0.0.66

data/lib/rex/proto/tftp/constants.rb

@@ -1,4 +1,5 @@
-# $Id: constants.rb 9962 2010-08-06 17:21:22Z jduck $
+# -*- coding: binary -*-
+# $Id: constants.rb 15548 2012-06-29 06:08:20Z rapid7 $
 require 'rex/proto/tftp'
 
 module Rex

data/lib/rex/proto/tftp/server.rb

@@ -1,4 +1,5 @@
-# $Id: server.rb 13551 2011-08-12 20:26:03Z scriptjunkie $
+# -*- coding: binary -*-
+# $Id: server.rb 15548 2012-06-29 06:08:20Z rapid7 $
 require 'rex/socket'
 require 'rex/proto/tftp'
 

data/lib/rex/proto/tftp/server.rb.ut.rb

@@ -1,8 +1,9 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 #
-# $Revision: 9333 $
+# $Revision: 15548 $
 #
-# $Id: server.rb.ut.rb 9333 2010-05-21 00:03:04Z jduck $
+# $Id: server.rb.ut.rb 15548 2012-06-29 06:08:20Z rapid7 $
 #
 
 require 'rex/compat'

data/lib/rex/registry.rb

@@ -0,0 +1,14 @@
+# -*- coding: binary -*-
+require 'rex/registry/hive'
+require 'rex/registry/regf'
+require 'rex/registry/nodekey'
+require 'rex/registry/lfkey'
+require 'rex/registry/valuekey'
+require 'rex/registry/valuelist'
+
+module Rex
+module Registry
+
+	attr_accessor :alias
+end
+end

data/lib/rex/registry/hive.rb

@@ -0,0 +1,132 @@
+# -*- coding: binary -*-
+require_relative "regf"
+require_relative "nodekey"
+
+module Rex
+module Registry
+
+class Hive
+	attr_accessor :root_key, :hive_regf, :hive_name
+
+	def initialize(hivepath)
+
+		hive_blob = open(hivepath, "rb") { |io| io.read }
+
+		@hive_regf = RegfBlock.new(hive_blob)
+		return nil if !@hive_regf.root_key_offset
+
+		@root_key = NodeKey.new(hive_blob, 0x1000 + @hive_regf.root_key_offset)
+		return nil if !@root_key.lf_record
+
+		keys = []
+		root_key.lf_record.children.each do |key|
+			keys << key.name
+		end
+
+		if keys.include? "LastKnownGoodRecovery"
+			@hive_name = "SYSTEM"
+		elsif keys.include? "Microsoft"
+			@hive_name = "SOFTWARE"
+		elsif keys.include? "Environment"
+			@hive_name = "NTUSER.DAT"
+		elsif keys.include? "SAM"
+			@hive_name = "SAM"
+		elsif keys.include? "Policy"
+			@hive_name = "SECURITY"
+		else
+			@hive_name = "UNKNOWN"
+		end
+
+	end
+
+	def relative_query(path)
+
+		if path == "" || path == "\\"
+			return @root_key
+		end
+
+		current_child = nil
+		paths = path.split("\\")
+
+		return if !@root_key.lf_record
+
+		@root_key.lf_record.children.each do |child|
+			next if child.name.downcase != paths[1].downcase
+
+			current_child = child
+
+			if paths.length == 2
+				current_child.full_path = path
+				return current_child
+			end
+
+			2.upto(paths.length) do |i|
+
+				if i == paths.length
+					current_child.full_path = path
+					return current_child
+				else
+					if current_child.lf_record && current_child.lf_record.children
+						current_child.lf_record.children.each do |c|
+							next if c.name.downcase != paths[i].downcase
+
+							current_child = c
+
+							break
+						end
+					end
+				end
+			end
+		end
+
+		return if !current_child
+
+		current_child.full_path = path
+		return current_child
+		end
+
+		def value_query(path)
+			if path == "" || path == "\\"
+			return nil
+		end
+
+		paths = path.split("\\")
+
+		return if !@root_key.lf_record
+
+		@root_key.lf_record.children.each do |root_child|
+			next if root_child.name.downcase != paths[1].downcase
+
+			current_child = root_child
+
+			if paths.length == 2
+				return nil
+			end
+
+			2.upto(paths.length - 1) do |i|
+				next if !current_child.lf_record
+
+				current_child.lf_record.children.each do |c|
+					next if c.name != paths[i]
+					current_child = c
+
+					break
+				end
+			end
+
+			if !current_child.value_list || current_child.value_list.values.length == 0
+				return nil
+			end
+
+			current_child.value_list.values.each do |value|
+				next if value.name.downcase != paths[paths.length - 1].downcase
+
+				value.full_path = path
+				return value
+			end
+		end
+	end
+end
+
+end
+end

data/lib/rex/registry/lfkey.rb

@@ -0,0 +1,51 @@
+# -*- coding: binary -*-
+require_relative "nodekey"
+
+module Rex
+module Registry
+
+class LFBlock
+
+	attr_accessor :number_of_keys, :hash_records, :children
+
+	def initialize(hive_blob, offset)
+		offset = offset + 4
+		lf_header = hive_blob[offset, 2]
+
+		if lf_header !~ /lf/ && lf_header !~ /lh/
+			return
+		end
+
+		@number_of_keys = hive_blob[offset + 0x02, 2].unpack('C').first
+
+		@hash_records = []
+		@children = []
+
+		hash_offset = offset + 0x04
+
+		1.upto(@number_of_keys) do |h|
+			
+			hash = LFHashRecord.new(hive_blob, hash_offset)
+
+			@hash_records << hash
+
+			hash_offset = hash_offset + 0x08
+
+			@children << NodeKey.new(hive_blob, hash.nodekey_offset + 0x1000)
+		end
+	end
+end
+
+class LFHashRecord
+
+	attr_accessor :nodekey_offset, :nodekey_name_verification
+		
+	def initialize(hive_blob, offset)
+		@nodekey_offset = hive_blob[offset, 4].unpack('l').first
+		@nodekey_name_verification = hive_blob[offset+0x04, 4].to_s
+	end
+
+end
+
+end
+end

data/lib/rex/registry/nodekey.rb

@@ -0,0 +1,54 @@
+# -*- coding: binary -*-
+require_relative "lfkey"
+require_relative "valuelist"
+
+module Rex
+module Registry
+
+class NodeKey
+
+	attr_accessor :timestamp, :parent_offset, :subkeys_count, :lf_record_offset
+	attr_accessor :value_count, :value_list_offset, :security_key_offset
+	attr_accessor :class_name_offset, :name_length, :class_name_length, :full_path
+	attr_accessor :name, :lf_record, :value_list, :class_name_data, :readable_timestamp
+
+	def initialize(hive, offset)
+
+		offset = offset + 0x04
+
+		nk_header = hive[offset, 2]
+		nk_type = hive[offset+0x02, 2]
+
+		if nk_header !~ /nk/
+			return
+		end
+
+		@timestamp = hive[offset+0x04, 8].unpack('q').first
+		@parent_offset = hive[offset+0x10, 4].unpack('l').first
+		@subkeys_count = hive[offset+0x14, 4].unpack('l').first
+		@lf_record_offset = hive[offset+0x1c, 4].unpack('l').first
+		@value_count = hive[offset+0x24, 4].unpack('l').first
+		@value_list_offset = hive[offset+0x28, 4].unpack('l').first
+		@security_key_offset = hive[offset+0x2c, 4].unpack('l').first
+		@class_name_offset = hive[offset+0x30, 4].unpack('l').first
+		@name_length = hive[offset+0x48, 2].unpack('c').first
+		@class_name_length = hive[offset+0x4a, 2].unpack('c').first
+		@name = hive[offset+0x4c, @name_length].to_s
+
+		windows_time = @timestamp
+		unix_time = windows_time/10000000-11644473600
+		ruby_time = Time.at(unix_time)
+
+		@readable_timestamp = ruby_time
+
+		@lf_record = LFBlock.new(hive, @lf_record_offset + 0x1000) if @lf_record_offset != -1
+		@value_list = ValueList.new(hive, @value_list_offset + 0x1000, @value_count) if @value_list_offset != -1
+
+		@class_name_data = hive[@class_name_offset + 0x04 + 0x1000, @class_name_length]
+
+	end
+
+end
+
+end
+end

data/lib/rex/registry/regf.rb

@@ -0,0 +1,25 @@
+# -*- coding: binary -*-
+module Rex
+module Registry
+
+class RegfBlock
+
+	attr_accessor :timestamp, :root_key_offset
+
+	def initialize(hive)
+
+		regf_header = hive[0x00, 4]
+
+		if regf_header !~ /regf/
+			puts "Not a registry hive"
+			return
+		end
+
+		@timestamp = hive[0x0C, 8].unpack('q').first
+		@root_key_offset = 0x20
+
+	end
+end
+
+end
+end

data/lib/rex/registry/valuekey.rb

@@ -0,0 +1,67 @@
+# -*- coding: binary -*-
+module Rex
+module Registry
+
+class ValueKey
+
+	attr_accessor :name_length, :length_of_data, :data_offset, :full_path
+	attr_accessor :value_type, :readable_value_type, :name, :value
+
+	def initialize(hive, offset)
+		offset = offset + 4
+
+		vk_header = hive[offset, 2]
+
+		if vk_header !~ /vk/
+			puts "no vk at offset #{offset}"
+			return
+		end
+
+		@name_length = hive[offset+0x02, 2].unpack('c').first
+		@length_of_data = hive[offset+0x04, 4].unpack('l').first
+		@data_offset = hive[offset+ 0x08, 4].unpack('l').first
+		@value_type = hive[offset+0x0C, 4].unpack('c').first
+
+		if @value_type == 1
+			@readable_value_type = "Unicode character string"
+		elsif @value_type == 2
+			@readable_value_type = "Unicode string with %VAR% expanding"
+		elsif @value_type == 3
+			@readable_value_type = "Raw binary value"
+		elsif @value_type == 4
+			@readable_value_type = "Dword"
+		elsif @value_type == 7
+			@readable_value_type = "Multiple unicode strings separated with '\\x00'"
+		end
+
+		flag = hive[offset+0x10, 2].unpack('c').first
+
+		if flag == 0
+			@name = "Default"
+		else
+			@name = hive[offset+0x14, @name_length].to_s
+		end
+
+		@value = ValueKeyData.new(hive, @data_offset, @length_of_data, @value_type, offset)
+	end
+end
+
+class ValueKeyData
+
+	attr_accessor :data
+
+	def initialize(hive, offset, length, datatype, parent_offset)
+		offset = offset + 4
+
+		#If the data-size is lower than 5, the data-offset value is used to store
+		#the data itself!
+		if length < 5
+			@data = hive[parent_offset + 0x08, 4]
+		else
+			@data = hive[offset + 0x1000, length]
+		end
+	end
+end
+
+end
+end

data/lib/rex/registry/valuelist.rb

@@ -0,0 +1,29 @@
+# -*- coding: binary -*-
+require_relative "valuekey"
+
+module Rex
+module Registry
+
+class ValueList
+
+	attr_accessor :values
+
+	def initialize(hive, offset, number_of_values)
+		offset = offset + 4
+		inner_offset = 0
+
+		@values = []
+
+		1.upto(number_of_values) do |v|
+			valuekey_offset = hive[offset + inner_offset, 4]
+			next if !valuekey_offset
+
+			valuekey_offset = valuekey_offset.unpack('l').first
+			@values << ValueKey.new(hive, valuekey_offset + 0x1000)
+			inner_offset = inner_offset + 4
+		end
+	end
+end
+
+end
+end

data/lib/rex/ropbuilder.rb

@@ -1,7 +1,8 @@
+# -*- coding: binary -*-
 module Rex
 module RopBuilder
 
 require 'rex/ropbuilder/rop'
 require 'metasm/metasm'
 end
-end
+end

data/lib/rex/ropbuilder/rop.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'metasm'
 require 'rex/compat'
 require 'rex/ui/text/table'
@@ -57,7 +58,7 @@ class RopBase
 		data.gsub!("Address,Raw,Disassembly\n", '')
 
 		@gadgets = []
-		
+
 		data.each_line do |line|
 			addr, raw, disasm = line.split(',', 3)
 			if addr.nil? or raw.nil? or disasm.nil?
@@ -182,7 +183,7 @@ class RopCollect < RopBase
 
 			# color the remaining parts of the gadget
 			if colors and line.index("%bld%grn").nil?
-				asm << "%bld%grn" + line 
+				asm << "%bld%grn" + line
 			else
 				asm << line
 			end

data/lib/rex/script.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex