librex 0.0.68 → 0.0.70

data/lib/rex/proto/drda/constants.rb

@@ -41,7 +41,7 @@ SECCHKCD   = 0x11a4 # Security Check Code
 ACCRDBRM   = 0x2201 # Access to RDB Completed
 
 def self.const_values
-	self.constants.map {|x| self.const_get x}
+  self.constants.map {|x| self.const_get x}
 end
 
 end

data/lib/rex/proto/drda/packet.rb

@@ -11,72 +11,72 @@ class RespError < Error; end
 # See:
 # http://publib.boulder.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=/com.ibm.db29.doc.drda/db2z_excsat.htm
 class MGRLVLLS_PARAM < Struct.new(:length, :codepoint, :payload)
-	def initialize(args={})
-		self[:codepoint] = Constants::MGRLVLLS
-		self[:payload] = "\x14\x03\x00\x0a\x24\x07\x00\x0a" +
-			"\x14\x74\x00\x05\x24\x0f\x00\x08" +
-			"\x14\x40\x00\x09\x1c\x08\x04\xb8"
-		self[:length] = self[:payload].to_s.size+4
-	end
-	def to_s
-		self.to_a.pack("nna*")
-	end
+  def initialize(args={})
+    self[:codepoint] = Constants::MGRLVLLS
+    self[:payload] = "\x14\x03\x00\x0a\x24\x07\x00\x0a" +
+      "\x14\x74\x00\x05\x24\x0f\x00\x08" +
+      "\x14\x40\x00\x09\x1c\x08\x04\xb8"
+    self[:length] = self[:payload].to_s.size+4
+  end
+  def to_s
+    self.to_a.pack("nna*")
+  end
 end
 
 # Currently, only takes a MGRLVLLS param. Extend the struct
 # when more parameters are defined.
 class EXCSAT_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
-	 :codepoint, :mgrlvlls)
-
-	def initialize(args={})
-		self[:magic] = 0xd0
-		self[:format] = 0x41
-		self[:correlid] = 1
-		self[:codepoint] = Constants::EXCSAT
-		self[:mgrlvlls] = args[:mgrlvlls] || MGRLVLLS_PARAM.new.to_s
-		self[:length] = (10 + self[:mgrlvlls].to_s.size)
-		self[:length2] = self[:length]-6
-	end
-
-	def to_s
-		packstr = "nCCnnn"
-		packstr += "a*"  # Pack smarter as more params are added.
-		self.to_a.pack(packstr)
-	end
+   :codepoint, :mgrlvlls)
+
+  def initialize(args={})
+    self[:magic] = 0xd0
+    self[:format] = 0x41
+    self[:correlid] = 1
+    self[:codepoint] = Constants::EXCSAT
+    self[:mgrlvlls] = args[:mgrlvlls] || MGRLVLLS_PARAM.new.to_s
+    self[:length] = (10 + self[:mgrlvlls].to_s.size)
+    self[:length2] = self[:length]-6
+  end
+
+  def to_s
+    packstr = "nCCnnn"
+    packstr += "a*"  # Pack smarter as more params are added.
+    self.to_a.pack(packstr)
+  end
 end
 
 # See http://publib.boulder.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=/com.ibm.db29.doc.drda/db2z_accsec.htm
 # for all sorts of info about SECMEC.
 class SECMEC_PARAM < Struct.new(:length, :codepoint, :payload)
-	def initialize(args={})
-		self[:length] = 6
-		self[:codepoint] = Constants::SECMEC
-		self[:payload] = 3 # Plaintext username and password.
-	end
-	def to_s
-		self.to_a.pack("nnn")
-	end
+  def initialize(args={})
+    self[:length] = 6
+    self[:codepoint] = Constants::SECMEC
+    self[:payload] = 3 # Plaintext username and password.
+  end
+  def to_s
+    self.to_a.pack("nnn")
+  end
 end
 
 # Relational Database name parameter.
 class RDBNAM_PARAM < Struct.new(:length, :codepoint, :payload)
-	def initialize(args={})
-		self[:length] = 22 # Since the database name is padded out.
-		self[:codepoint] = Constants::RDBNAM
-		self[:payload] = encode(args[:payload].to_s)
-	end
+  def initialize(args={})
+    self[:length] = 22 # Since the database name is padded out.
+    self[:codepoint] = Constants::RDBNAM
+    self[:payload] = encode(args[:payload].to_s)
+  end
 
-	def encode(str)
-		Rex::Text.to_ebcdic([str].pack("A18"))
-	end
+  def encode(str)
+    Rex::Text.to_ebcdic([str].pack("A18"))
+  end
 
-	def payload=(str)
-		self[:payload] = encode(str.to_s)
-	end
+  def payload=(str)
+    self[:payload] = encode(str.to_s)
+  end
 
-	def to_s
-		self.to_a.pack("nna18")
-	end
+  def to_s
+    self.to_a.pack("nna18")
+  end
 
 end
 
@@ -85,166 +85,166 @@ end
 # also sets the relational database name (RDBNAM), if specified. You need
 # one to login, but not to probe.
 class ACCSEC_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
-	 :codepoint, :secmec, :rdbnam)
-	def initialize(args={})
-		self[:magic] = 0xd0
-		self[:format] = args[:format] || 0x01
-		self[:correlid] = 2
-		self[:codepoint] = Constants::ACCSEC
-		self[:secmec] = SECMEC_PARAM.new.to_s
-		if args[:dbname] # Include a database name if we're given one.
-			self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
-		end
-		self[:length] =  10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size
-		self[:length2] = self[:length]-6
-	end
-	def dbname=(str)
-		self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
-	end
-	def to_s
-		packstr = "nCCnnna6"
-		packstr += "a22" if self[:rdbnam]
-		self.to_a.pack(packstr)
-	end
+   :codepoint, :secmec, :rdbnam)
+  def initialize(args={})
+    self[:magic] = 0xd0
+    self[:format] = args[:format] || 0x01
+    self[:correlid] = 2
+    self[:codepoint] = Constants::ACCSEC
+    self[:secmec] = SECMEC_PARAM.new.to_s
+    if args[:dbname] # Include a database name if we're given one.
+      self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+    end
+    self[:length] =  10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size
+    self[:length2] = self[:length]-6
+  end
+  def dbname=(str)
+    self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+  end
+  def to_s
+    packstr = "nCCnnna6"
+    packstr += "a22" if self[:rdbnam]
+    self.to_a.pack(packstr)
+  end
 end
 
 class DDM_PARAM < Struct.new(:length, :codepoint, :payload)
 
-	def read(str="")
-		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
-		raise DRDA::RespError, "DDM_PARAM is too short" if str.size < 4
-		(self[:length], self[:codepoint]) =
-			str.unpack("nn")
-		raise DRDA::RespError, "DDM_PARAM Length is too short" if self[:length] < 4
-		rest = str[4,self[:length]-4] # If it's negative or whatever, it'll end up as "".
-		self[:payload] = rest.to_s[0,self[:length]-4]
-		return self
-	end
-
-	def to_s
-		self.to_a.pack("nna*")
-	end
+  def read(str="")
+    raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+    raise DRDA::RespError, "DDM_PARAM is too short" if str.size < 4
+    (self[:length], self[:codepoint]) =
+      str.unpack("nn")
+    raise DRDA::RespError, "DDM_PARAM Length is too short" if self[:length] < 4
+    rest = str[4,self[:length]-4] # If it's negative or whatever, it'll end up as "".
+    self[:payload] = rest.to_s[0,self[:length]-4]
+    return self
+  end
+
+  def to_s
+    self.to_a.pack("nna*")
+  end
 
 end
 
 class BASIC_DDM < Struct.new(:length, :magic, :format, :correlid,
-	:length2, :codepoint, :payload)
-	def initialize
-		self[:payload] = []
-	end
-
-	def read(str="")
-		self[:payload].clear
-		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
-		raise DRDA::RespError, "Response is too short." if str.size < 10
-		(self[:length],self[:magic],self[:format],
-		 self[:correlid],self[:length2],self[:codepoint]) =
-		 str.unpack("nCCnnn")
-		sanity_check
-		rest = str[10,self[:length2]-4]
-		i = 0
-		while (i < rest.size)
-			if self[:codepoint] == Constants::SQLCARD # These aren't DDM's.
-				this_param = rest[i,self[:length]-10]
-			else
-				this_param = DDM_PARAM.new.read(rest[i,rest.size])
-			end
-			self[:payload] << this_param
-			i += this_param.to_s.size
-		end
-		return self
-	end
-
-	# Just a quick test.
-	def sanity_check
-		if self[:length] < 10
-			raise DRDA::RespError, "DDM Length is too short."
-		elsif self[:length2] < 4
-			raise DRDA::RespError, "DDM Length2 is too short."
-		elsif self[:length]-6 != self[:length2]
-			raise DRDA::RespError, "Codepoint: 0x#{self[:codepoint].to_s(16)} DDM Length2 (0x#{self[:length2].to_s(16)}) isn't six less than Length (0x#{self[:length].to_s(16)})"
-		end
-	end
-
-	def to_s
-		self.to_a.pack("nCCnnn") + self[:payload].map {|x| x.to_s}.join
-	end
+  :length2, :codepoint, :payload)
+  def initialize
+    self[:payload] = []
+  end
+
+  def read(str="")
+    self[:payload].clear
+    raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+    raise DRDA::RespError, "Response is too short." if str.size < 10
+    (self[:length],self[:magic],self[:format],
+     self[:correlid],self[:length2],self[:codepoint]) =
+     str.unpack("nCCnnn")
+    sanity_check
+    rest = str[10,self[:length2]-4]
+    i = 0
+    while (i < rest.size)
+      if self[:codepoint] == Constants::SQLCARD # These aren't DDM's.
+        this_param = rest[i,self[:length]-10]
+      else
+        this_param = DDM_PARAM.new.read(rest[i,rest.size])
+      end
+      self[:payload] << this_param
+      i += this_param.to_s.size
+    end
+    return self
+  end
+
+  # Just a quick test.
+  def sanity_check
+    if self[:length] < 10
+      raise DRDA::RespError, "DDM Length is too short."
+    elsif self[:length2] < 4
+      raise DRDA::RespError, "DDM Length2 is too short."
+    elsif self[:length]-6 != self[:length2]
+      raise DRDA::RespError, "Codepoint: 0x#{self[:codepoint].to_s(16)} DDM Length2 (0x#{self[:length2].to_s(16)}) isn't six less than Length (0x#{self[:length].to_s(16)})"
+    end
+  end
+
+  def to_s
+    self.to_a.pack("nCCnnn") + self[:payload].map {|x| x.to_s}.join
+  end
 
 end
 
 class SERVER_PACKET < Array
 
-	def read(str="")
-		raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
-		self.clear
-		i = 0
-		while(i < str.size)
-			this_ddm = BASIC_DDM.new.read(str[i,str.size])
-			self << this_ddm
-			i += this_ddm.to_s.size
-		end
-		return self
-	end
-
-	def to_s; self.join; end
-	def sz; self.to_s.size; end
+  def read(str="")
+    raise DRDA::Error, "Input isn't a String." if !str.kind_of? String
+    self.clear
+    i = 0
+    while(i < str.size)
+      this_ddm = BASIC_DDM.new.read(str[i,str.size])
+      self << this_ddm
+      i += this_ddm.to_s.size
+    end
+    return self
+  end
+
+  def to_s; self.join; end
+  def sz; self.to_s.size; end
 
 end
 
 class PASSWORD_PARAM < Struct.new(:length, :codepoint, :payload)
-	def initialize(args={})
-		self[:codepoint] = Constants::PASSWORD
-		self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
-		self[:length] = self[:payload].size + 4
-	end
-	def encode(str)
-		Rex::Text.to_ebcdic(str)
-	end
-	def to_s
-		self.to_a.pack("nna*")
-	end
+  def initialize(args={})
+    self[:codepoint] = Constants::PASSWORD
+    self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
+    self[:length] = self[:payload].size + 4
+  end
+  def encode(str)
+    Rex::Text.to_ebcdic(str)
+  end
+  def to_s
+    self.to_a.pack("nna*")
+  end
 end
 
 class USERID_PARAM < Struct.new(:length, :codepoint, :payload)
-	def initialize(args={})
-		self[:codepoint] = Constants::USERID
-		self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
-		self[:length] = self[:payload].size + 4
-	end
-	def encode(str)
-		Rex::Text.to_ebcdic(str)
-	end
-	def to_s
-		self.to_a.pack("nna*")
-	end
+  def initialize(args={})
+    self[:codepoint] = Constants::USERID
+    self[:payload] = Rex::Text.to_ebcdic(args[:payload].to_s)
+    self[:length] = self[:payload].size + 4
+  end
+  def encode(str)
+    Rex::Text.to_ebcdic(str)
+  end
+  def to_s
+    self.to_a.pack("nna*")
+  end
 end
 
 class SECCHK_DDM < Struct.new(:length, :magic, :format, :correlid, :length2,
-	:codepoint, :secmec, :rdbnam, :password, :userid)
-	def initialize(args={}) # Takes :dbname, :dbpass, :dbuser
-		self[:magic] = 0xd0
-		self[:format] = 0x01
-		self[:correlid] = 2
-		self[:codepoint] = Constants::SECCHK
-		self[:secmec] = SECMEC_PARAM.new.to_s
-		if args[:dbname] # Include a database name if we're given one.
-			self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
-		end
-		self[:password] = PASSWORD_PARAM.new(:payload => args[:dbpass]).to_s
-		self[:userid] = USERID_PARAM.new(:payload => args[:dbuser]).to_s
-		self[:length] = ( 10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size +
-					 self[:password].to_s.size + self[:userid].to_s.size )
-		self[:length2] = self[:length]-6
-	end
-	def dbname=(str)
-		self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
-	end
-	def to_s
-		packstr = "nCCnnna6"
-		packstr += "a22" if self[:rdbnam]
-		packstr += "a*a*" # username and password
-		self.to_a.pack(packstr)
-	end
+  :codepoint, :secmec, :rdbnam, :password, :userid)
+  def initialize(args={}) # Takes :dbname, :dbpass, :dbuser
+    self[:magic] = 0xd0
+    self[:format] = 0x01
+    self[:correlid] = 2
+    self[:codepoint] = Constants::SECCHK
+    self[:secmec] = SECMEC_PARAM.new.to_s
+    if args[:dbname] # Include a database name if we're given one.
+      self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+    end
+    self[:password] = PASSWORD_PARAM.new(:payload => args[:dbpass]).to_s
+    self[:userid] = USERID_PARAM.new(:payload => args[:dbuser]).to_s
+    self[:length] = ( 10 + self[:secmec].to_s.size + self[:rdbnam].to_s.size +
+           self[:password].to_s.size + self[:userid].to_s.size )
+    self[:length2] = self[:length]-6
+  end
+  def dbname=(str)
+    self[:rdbnam] = RDBNAM_PARAM.new(:payload => args[:dbname]).to_s
+  end
+  def to_s
+    packstr = "nCCnnna6"
+    packstr += "a22" if self[:rdbnam]
+    packstr += "a*a*" # username and password
+    self.to_a.pack(packstr)
+  end
 end
 
 end

data/lib/rex/proto/drda/utils.rb

@@ -6,116 +6,116 @@ module Proto
 module DRDA
 class Utils
 
-	# Creates a packet with EXCSAT_DDM and an ACCSEC_DDM. This will elicit
-	# a reponse from the target server.
-	def self.client_probe(dbname=nil)
-		pkt = [
-			EXCSAT_DDM.new,
-			ACCSEC_DDM.new(:dbname => dbname)
-		]
-		pkt.map {|x| x.to_s}.join
-	end
+  # Creates a packet with EXCSAT_DDM and an ACCSEC_DDM. This will elicit
+  # a reponse from the target server.
+  def self.client_probe(dbname=nil)
+    pkt = [
+      EXCSAT_DDM.new,
+      ACCSEC_DDM.new(:dbname => dbname)
+    ]
+    pkt.map {|x| x.to_s}.join
+  end
 
-	# Creates a packet with EXCSAT_DDM and an SECCHK_DDM.
-	# In order to ever succeed, you do need a successful probe first.
-	def self.client_auth(args={})
-		dbname = args[:dbname]
-		dbuser = args[:dbuser]
-		dbpass = args[:dbpass]
-		pkt = [
-			ACCSEC_DDM.new(:format => 0x41),
-			SECCHK_DDM.new(:dbname => dbname, :dbuser => dbuser, :dbpass => dbpass)
-		]
-		pkt.map {|x| x.to_s}.join
-	end
+  # Creates a packet with EXCSAT_DDM and an SECCHK_DDM.
+  # In order to ever succeed, you do need a successful probe first.
+  def self.client_auth(args={})
+    dbname = args[:dbname]
+    dbuser = args[:dbuser]
+    dbpass = args[:dbpass]
+    pkt = [
+      ACCSEC_DDM.new(:format => 0x41),
+      SECCHK_DDM.new(:dbname => dbname, :dbuser => dbuser, :dbpass => dbpass)
+    ]
+    pkt.map {|x| x.to_s}.join
+  end
 
-	def self.server_packet_info(obj)
-		info_hash = {}
-		return info_hash unless obj.kind_of? Rex::Proto::DRDA::SERVER_PACKET
-		obj.each do |ddm|
-			case ddm.codepoint
-			when Constants::EXCSATRD
-				info_hash.merge!(_info_excsatrd(ddm))
-			when Constants::ACCSECRD
-				info_hash.merge!(_info_accsecrd(ddm))
-			when Constants::RDBNFNRM
-				info_hash.merge!(_info_rdbnfnrm(ddm))
-			when Constants::SECCHKRM
-				info_hash.merge!(_info_secchkrm(ddm))
-			else
-				next
-			end
-		end
-		return info_hash
-	end
+  def self.server_packet_info(obj)
+    info_hash = {}
+    return info_hash unless obj.kind_of? Rex::Proto::DRDA::SERVER_PACKET
+    obj.each do |ddm|
+      case ddm.codepoint
+      when Constants::EXCSATRD
+        info_hash.merge!(_info_excsatrd(ddm))
+      when Constants::ACCSECRD
+        info_hash.merge!(_info_accsecrd(ddm))
+      when Constants::RDBNFNRM
+        info_hash.merge!(_info_rdbnfnrm(ddm))
+      when Constants::SECCHKRM
+        info_hash.merge!(_info_secchkrm(ddm))
+      else
+        next
+      end
+    end
+    return info_hash
+  end
 
-	def self._info_excsatrd(ddm)
-		info_hash = {:excsatrd => true}
-		ddm.payload.each do |param|
-			case param.codepoint
-			when Constants::SRVNAM
-				info_hash[:instance_name] = Rex::Text.from_ebcdic(param.payload)
-			when Constants::SRVCLSNM
-				info_hash[:platform] = Rex::Text.from_ebcdic(param.payload)
-			when Constants::SRVRLSLV
-				info_hash[:version] = Rex::Text.from_ebcdic(param.payload)
-			else
-				next
-			end
-		end
-		return info_hash
-	end
+  def self._info_excsatrd(ddm)
+    info_hash = {:excsatrd => true}
+    ddm.payload.each do |param|
+      case param.codepoint
+      when Constants::SRVNAM
+        info_hash[:instance_name] = Rex::Text.from_ebcdic(param.payload)
+      when Constants::SRVCLSNM
+        info_hash[:platform] = Rex::Text.from_ebcdic(param.payload)
+      when Constants::SRVRLSLV
+        info_hash[:version] = Rex::Text.from_ebcdic(param.payload)
+      else
+        next
+      end
+    end
+    return info_hash
+  end
 
-	def self._info_accsecrd(ddm)
-		info_hash = {:accsecrd => true}
-		ddm.payload.each do |param|
-			case param.codepoint
-			when Constants::SECMEC
-				info_hash[:plaintext_auth] = true if param.payload =~ /\x00\x03/
-			when Constants::SECCHKCD
-				info_hash[:security_check_code] = param.payload.unpack("C").first
-				# A little spurious? This is always nonzero when there's no SECCHKRM DDM.
-				info_hash[:db_login_success] = false unless info_hash[:security_check_code].zero?
-			else
-				next
-			end
-		end
-		return info_hash
-	end
+  def self._info_accsecrd(ddm)
+    info_hash = {:accsecrd => true}
+    ddm.payload.each do |param|
+      case param.codepoint
+      when Constants::SECMEC
+        info_hash[:plaintext_auth] = true if param.payload =~ /\x00\x03/n
+      when Constants::SECCHKCD
+        info_hash[:security_check_code] = param.payload.unpack("C").first
+        # A little spurious? This is always nonzero when there's no SECCHKRM DDM.
+        info_hash[:db_login_success] = false unless info_hash[:security_check_code].zero?
+      else
+        next
+      end
+    end
+    return info_hash
+  end
 
-	def self._info_rdbnfnrm(ddm)
-		info_hash = {:rdbnfnrm => true}
-		info_hash[:database_found] = false
-		ddm.payload.each do |param|
-			case param.codepoint
-			when Constants::RDBNAM
-				info_hash[:db_name] = Rex::Text.from_ebcdic(param.payload).unpack("A*").first
-			when Constants::SRVDGN
-				info_hash[:error_message] = Rex::Text.from_ebcdic(param.payload)
-			else
-				next
-			end
-		end
-		return info_hash
-	end
+  def self._info_rdbnfnrm(ddm)
+    info_hash = {:rdbnfnrm => true}
+    info_hash[:database_found] = false
+    ddm.payload.each do |param|
+      case param.codepoint
+      when Constants::RDBNAM
+        info_hash[:db_name] = Rex::Text.from_ebcdic(param.payload).unpack("A*").first
+      when Constants::SRVDGN
+        info_hash[:error_message] = Rex::Text.from_ebcdic(param.payload)
+      else
+        next
+      end
+    end
+    return info_hash
+  end
 
-	def self._info_secchkrm(ddm)
-		info_hash = {:secchkrm => true}
-		ddm.payload.each do |param|
-			case param.codepoint
-			when Constants::SRVCOD
-				info_hash[:severity_code] = param.payload.unpack("n").first
-			when Constants::SECCHKCD
-				info_hash[:security_check_code] = param.payload.unpack("C").first
-			else
-				next
-			end
-		end
-		if info_hash[:serverity].to_i.zero? and info_hash[:security_check_code].to_i.zero?
-			info_hash[:db_login_success] = true
-		end
-		return info_hash
-	end
+  def self._info_secchkrm(ddm)
+    info_hash = {:secchkrm => true}
+    ddm.payload.each do |param|
+      case param.codepoint
+      when Constants::SRVCOD
+        info_hash[:severity_code] = param.payload.unpack("n").first
+      when Constants::SECCHKCD
+        info_hash[:security_check_code] = param.payload.unpack("C").first
+      else
+        next
+      end
+    end
+    if info_hash[:serverity].to_i.zero? and info_hash[:security_check_code].to_i.zero?
+      info_hash[:db_login_success] = true
+    end
+    return info_hash
+  end
 
 end