librex 0.0.65 → 0.0.66

data/lib/rex/script/base.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Script
 class Base

data/lib/rex/script/meterpreter.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 
 module Rex
 module Script

data/lib/rex/script/shell.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 
 module Rex
 module Script

data/lib/rex/service.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex'
 require 'rex/proto'
 
@@ -45,4 +46,4 @@ module Service
 
 end
 
-end
+end

data/lib/rex/service_manager.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'singleton'
 require 'rex'
 require 'rex/service'
@@ -23,7 +24,7 @@ class ServiceManager < Hash
 	def self.start(klass, *args)
 		self.instance.start(klass, *args)
 	end
-	
+
 	#
 	# Calls the instance method to stop a service.
 	#
@@ -75,7 +76,7 @@ class ServiceManager < Hash
 		# Re-aliases the instance.
 		inst.alias = als
 
-		# Fire up the engines.  If an error occurs an exception will be 
+		# Fire up the engines.  If an error occurs an exception will be
 		# raised.
 		inst.start
 
@@ -138,16 +139,16 @@ class ServiceManager < Hash
 		end
 		list.each(&block)
 	end
-	
+
 protected
 
-	# 
+	#
 	# Returns the alias for a given service instance.
 	#
 	def hardcore_alias(klass, *args)
 		"__#{klass.name}#{args}"
 	end
-	
+
 end
 
 end

data/lib/rex/service_manager.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..'))
 
@@ -29,4 +30,4 @@ class Rex::ServiceManager::UnitTest < Test::Unit::TestCase
 
 	end
 
-end
+end

data/lib/rex/services/local_relay.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'thread'
 require 'rex/socket'
 

data/lib/rex/socket.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'socket'
 require 'thread'
 require 'resolv'
@@ -73,16 +74,16 @@ module Socket
 	def self.create_ip(opts = {})
 		return create_param(Rex::Socket::Parameters.from_hash(opts.merge('Proto' => 'ip')))
 	end
-	
-	
+
+
 	#
 	# Common Regular Expressions
 	#
-	
+
 	MATCH_IPV6 = /^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$/
 
 	MATCH_IPV4 = /^\s*(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))\s*$/
-	
+
 	MATCH_IPV4_PRIVATE = /^\s*(?:10\.|192\.168|172.(?:1[6-9]|2[0-9]|3[01])\.|169\.254)/
 
 	##
@@ -119,32 +120,26 @@ module Socket
 	# Determine whether this is an IPv4 address
 	#
 	def self.is_ipv4?(addr)
-		return false if addr =~ MATCH_IPV6
-		return true if addr =~ MATCH_IPV4
-		res = Rex::Socket.getaddress(addr)
-		res.match(/:/) ? false : true
+		( addr =~ MATCH_IPV4 ) ? true : false
 	end
 
 	#
 	# Determine whether this is an IPv6 address
 	#
 	def self.is_ipv6?(addr)
-		return true if addr =~ MATCH_IPV6
-		return false if addr =~ MATCH_IPV4
-		res = Rex::Socket.getaddress(addr)
-		res.match(/:/) ? true : false
+		( addr =~ MATCH_IPV6 ) ? true : false
 	end
 
 	#
-	# Checks to see if the supplied address is in "dotted" form 
+	# Checks to see if the supplied address is in "dotted" form
 	#
 	def self.dotted_ip?(addr)
 		# Match IPv6
 		return true if (support_ipv6? and addr =~ MATCH_IPV6)
-	
+
 		# Match IPv4
 		return true if (addr =~ MATCH_IPV4)
-		
+
 		false
 	end
 
@@ -169,7 +164,7 @@ module Socket
 	#
 	def self.getaddress(addr, accept_ipv6 = true)
 		begin
-			if dotted_ip?(addr)
+			if addr =~ MATCH_IPV4 or (accept_ipv6 and addr =~ MATCH_IPV6)
 				return addr
 			end
 
@@ -181,6 +176,19 @@ module Socket
 			ralias = res.shift
 			rtype  = res.shift
 
+			# Rubinius has a bug where gethostbyname returns dotted quads instead of
+			# NBO, but that's what we want anyway, so just short-circuit here.
+			if res[0] =~ MATCH_IPV4 || res[0] =~ MATCH_IPV6
+				res.each { |r|
+					# if the caller doesn't mind ipv6, just return whatever we have
+					return r if accept_ipv6
+					# otherwise, take the first v4 address
+					return r if r =~ MATCH_IPV4
+				}
+				# didn't find one
+				return nil
+			end
+
 			# Reject IPv6 addresses if we don't accept them
 			if not accept_ipv6
 				res.reject!{|nbo| nbo.length != 4}
@@ -205,12 +213,12 @@ module Socket
 	#
 	def self.getaddresses(addr, accept_ipv6 = true)
 		begin
-			if dotted_ip?(addr)
-				return addr
+			if addr =~ MATCH_IPV4 or (accept_ipv6 and addr =~ MATCH_IPV6)
+				return [addr]
 			end
 
 			res = ::Socket.gethostbyname(addr)
-			return nil if not res
+			return [] if not res
 
 			# Shift the first three elements out
 			rname  = res.shift
@@ -223,15 +231,15 @@ module Socket
 			end
 
 			# Make sure we have at least one name
-			return nil if res.length == 0
+			return [] if res.length == 0
 
 			# Return an array of all addresses
 			res.map{ |addr| self.addr_ntoa(addr) }
 		rescue ::ArgumentError # Win32 bug
-			nil
+			[]
 		end
 	end
-	
+
 	#
 	# Wrapper for Socket.gethostbyname which takes into account whether or not
 	# an IP address is supplied.  If it is, then reverse DNS resolution does
@@ -239,10 +247,12 @@ module Socket
 	# on Windows.
 	#
 	def self.gethostbyname(host)
-		if (dotted_ip?(host))
-			if (is_ipv4?(host))
-				return [ host, host, 2, host.split('.').map{ |c| c.to_i }.pack("C4") ]
-			end
+		if (is_ipv4?(host))
+			return [ host, [], 2, host.split('.').map{ |c| c.to_i }.pack("C4") ]
+		end
+
+		if is_ipv6?(host)
+			host, scope_id = host.split('%', 2)
 		end
 
 		::Socket.gethostbyname(host)
@@ -278,7 +288,7 @@ module Socket
 	# Resolves a host to raw network-byte order.
 	#
 	def self.resolv_nbo(host)
-		self.gethostbyname(Rex::Socket.getaddress(host))[3]
+		self.gethostbyname( Rex::Socket.getaddress(host, true) )[3]
 	end
 
 	#
@@ -301,7 +311,7 @@ module Socket
 	def self.resolv_nbo_i_list(host)
 		resolv_nbo_list(host).map{|addr| addr_ntoi(addr) }
 	end
-	
+
 	#
 	# Converts an ASCII IP address to a CIDR mask. Returns
 	# nil if it's not convertable.
@@ -347,7 +357,7 @@ module Socket
 	def self.addr_atoi_list(addr)
 		resolv_nbo_i_list(addr)
 	end
-	
+
 	#
 	# Converts an integer address into ascii
 	#
@@ -357,10 +367,10 @@ module Socket
 
 		# IPv4
 		if (addr < 0x100000000 and not v6)
-			nboa.unpack('C4').join('.')
+			addr_ntoa(nboa)
 		# IPv6
 		else
-			nboa.unpack('n8').map{ |c| "%.4x" % c }.join(":")
+			addr_ntoa(nboa)
 		end
 	end
 
@@ -375,7 +385,6 @@ module Socket
 	# Converts a network byte order address to ascii
 	#
 	def self.addr_ntoa(addr)
-
 		# IPv4
 		if (addr.length == 4)
 			return addr.unpack('C4').join('.')
@@ -383,12 +392,33 @@ module Socket
 
 		# IPv6
 		if (addr.length == 16)
-			return addr.unpack('n8').map{ |c| "%.4x" % c }.join(":")
+			return compress_address(addr.unpack('n8').map{ |c| "%x" % c }.join(":"))
 		end
 
 		raise RuntimeError, "Invalid address format"
 	end
 
+	#
+	# Implement zero compression for IPv6 addresses.
+	# Uses the compression method from Marco Ceresa's IPAddress GEM
+	#	https://github.com/bluemonk/ipaddress/blob/master/lib/ipaddress/ipv6.rb
+	#
+	def self.compress_address(addr)
+		return addr unless is_ipv6?(addr)
+		addr = addr.dup
+		while true
+			break if addr.sub!(/\A0:0:0:0:0:0:0:0\Z/, '::')
+			break if addr.sub!(/\b0:0:0:0:0:0:0\b/, ':')
+			break if addr.sub!(/\b0:0:0:0:0:0\b/, ':')
+			break if addr.sub!(/\b0:0:0:0:0\b/, ':')
+			break if addr.sub!(/\b0:0:0:0\b/, ':')
+			break if addr.sub!(/\b0:0:0\b/, ':')
+			break if addr.sub!(/\b0:0\b/, ':')
+			break
+		end
+		addr.sub(/:{3,}/, '::')
+	end
+
 	#
 	# Converts a network byte order address to an integer
 	#
@@ -477,10 +507,15 @@ module Socket
 
 	#
 	# Converts a bitmask (28) into a netmask (255.255.255.240)
-	# TODO: IPv6 (use is ambiguous right now)
 	#
-	def self.bit2netmask(bitmask)
-		[ (~((2 ** (32 - bitmask)) - 1)) & 0xffffffff ].pack('N').unpack('CCCC').join('.')
+	def self.bit2netmask(bitmask, ipv6=false)
+		if bitmask > 32 or ipv6
+			i = ((~((2 ** (128 - bitmask)) - 1)) & (2**128-1))
+			n = Rex::Socket.addr_iton(i, true)
+			return Rex::Socket.addr_ntoa(n)
+		else
+			[ (~((2 ** (32 - bitmask)) - 1)) & 0xffffffff ].pack('N').unpack('CCCC').join('.')
+		end
 	end
 
 
@@ -656,6 +691,7 @@ module Socket
 		return [lsock, rsock]
 	end
 
+
 	##
 	#
 	# Class initialization

data/lib/rex/socket.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..'))
 

data/lib/rex/socket/comm.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/socket'
 
 module Rex

data/lib/rex/socket/comm/local.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'singleton'
 require 'rex/socket'
 require 'rex/socket/tcp'
@@ -154,7 +155,7 @@ class Rex::Socket::Comm::Local
 					elsif (local == "\x7f\x00\x00\x01")
 						param.localhost = '::1'
 					else
-						param.localhost = '::ffff:' + Rex::Socket.getaddress(param.localhost)
+						param.localhost = '::ffff:' + Rex::Socket.getaddress(param.localhost, true)
 					end
 				end
 
@@ -164,7 +165,7 @@ class Rex::Socket::Comm::Local
 					elsif (peer == "\x7f\x00\x00\x01")
 						param.peerhost = '::1'
 					else
-						param.peerhost = '::ffff:' + Rex::Socket.getaddress(param.peerhost)
+						param.peerhost = '::ffff:' + Rex::Socket.getaddress(param.peerhost, true)
 					end
 				end
 
@@ -187,10 +188,9 @@ class Rex::Socket::Comm::Local
 		end
 
 		# Bind to a given local address and/or port if they are supplied
-		if (param.localhost || param.localport)
+		if param.localport or param.localhost
 			begin
 				sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, true)
-
 				sock.bind(Rex::Socket.to_sockaddr(param.localhost, param.localport))
 
 			rescue ::Errno::EADDRNOTAVAIL,::Errno::EADDRINUSE
@@ -223,16 +223,55 @@ class Rex::Socket::Comm::Local
 
 			# If we were supplied with host information
 			if (param.peerhost)
-				begin
-					ip = param.peerhost
-					port = param.peerport
-
-					if param.proxies
-						chain = param.proxies.dup
-						chain.push(['host',param.peerhost,param.peerport])
-						ip = chain[0][1]
-						port = chain[0][2].to_i
+
+				# A flag that indicates whether we need to try multiple scopes
+				retry_scopes = false
+
+				# Always retry with link-local IPv6 addresses
+				if Rex::Socket.is_ipv6?( param.peerhost ) and param.peerhost =~ /^fe80::/
+					retry_scopes = true
+				end
+
+				# Prepare a list of scope IDs to try when connecting to
+				# link-level addresses. Read from /proc if it is available,
+				# otherwise increment through the first 255 IDs.
+				@@ip6_lla_scopes ||= []
+
+				if @@ip6_lla_scopes.length == 0 and retry_scopes
+
+					# Linux specific interface lookup code
+					if ::File.exists?( "/proc/self/net/igmp6" )
+						::File.open("/proc/self/net/igmp6") do |fd|
+							fd.each_line do |line|
+								line = line.strip
+								tscope, tint, junk = line.split(/\s+/, 3)
+								next if not tint
+
+								# Specifying lo in any connect call results in the socket
+								# being unusable, even if the correct interface is set.
+								next if tint == "lo"
+
+								@@ip6_lla_scopes << tscope
+							end
+						end
+					else
+					# Other Unix-like platforms should support a raw scope ID
+						[*(1 .. 255)].map{ |x| @@ip6_lla_scopes << x.to_s }
 					end
+				end
+
+				ip6_scope_idx = 0
+				ip   = param.peerhost
+				port = param.peerport
+
+				if param.proxies
+					chain = param.proxies.dup
+					chain.push(['host',param.peerhost,param.peerport])
+					ip = chain[0][1]
+					port = chain[0][2].to_i
+				end
+
+				begin
 
 					begin
 						Timeout.timeout(param.timeout) do
@@ -243,6 +282,14 @@ class Rex::Socket::Comm::Local
 					end
 
 				rescue ::Errno::EHOSTUNREACH,::Errno::ENETDOWN,::Errno::ENETUNREACH,::Errno::ENETRESET,::Errno::EHOSTDOWN,::Errno::EACCES,::Errno::EINVAL
+
+					# Rescue errors caused by a bad Scope ID for a link-local address
+					if retry_scopes and @@ip6_lla_scopes[ ip6_scope_idx ]
+						ip = param.peerhost + "%" + @@ip6_lla_scopes[ ip6_scope_idx ]
+						ip6_scope_idx += 1
+						retry
+					end
+
 					sock.close
 					raise Rex::HostUnreachable.new(param.peerhost, param.peerport), caller