librex 0.0.68 → 0.0.70

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (528) hide show
  1. checksums.yaml +15 -0
  2. data/README.markdown +1 -1
  3. data/Rakefile +18 -16
  4. data/lib/rex.rb +14 -10
  5. data/lib/rex/LICENSE +2 -2
  6. data/lib/rex/arch.rb +76 -76
  7. data/lib/rex/arch/sparc.rb +57 -58
  8. data/lib/rex/arch/x86.rb +506 -496
  9. data/lib/rex/assembly/nasm.rb +83 -84
  10. data/lib/rex/compat.rb +228 -173
  11. data/lib/rex/constants.rb +47 -37
  12. data/lib/rex/elfparsey.rb +0 -3
  13. data/lib/rex/elfparsey/elf.rb +107 -110
  14. data/lib/rex/elfparsey/elfbase.rb +244 -247
  15. data/lib/rex/elfparsey/exceptions.rb +0 -3
  16. data/lib/rex/elfscan.rb +0 -3
  17. data/lib/rex/elfscan/scanner.rb +184 -166
  18. data/lib/rex/elfscan/search.rb +35 -38
  19. data/lib/rex/encoder/alpha2.rb +1 -2
  20. data/lib/rex/encoder/alpha2/alpha_mixed.rb +52 -53
  21. data/lib/rex/encoder/alpha2/alpha_upper.rb +62 -63
  22. data/lib/rex/encoder/alpha2/generic.rb +77 -78
  23. data/lib/rex/encoder/alpha2/unicode_mixed.rb +101 -97
  24. data/lib/rex/encoder/alpha2/unicode_upper.rb +106 -107
  25. data/lib/rex/encoder/bloxor/bloxor.rb +326 -0
  26. data/lib/rex/encoder/ndr.rb +68 -68
  27. data/lib/rex/encoder/nonalpha.rb +50 -51
  28. data/lib/rex/encoder/nonupper.rb +50 -51
  29. data/lib/rex/encoder/xdr.rb +78 -78
  30. data/lib/rex/encoder/xor.rb +52 -53
  31. data/lib/rex/encoder/xor/dword.rb +1 -2
  32. data/lib/rex/encoder/xor/dword_additive.rb +1 -2
  33. data/lib/rex/encoders/xor_dword.rb +17 -18
  34. data/lib/rex/encoders/xor_dword_additive.rb +35 -36
  35. data/lib/rex/encoding/xor.rb +0 -1
  36. data/lib/rex/encoding/xor/byte.rb +3 -4
  37. data/lib/rex/encoding/xor/dword.rb +3 -4
  38. data/lib/rex/encoding/xor/dword_additive.rb +72 -73
  39. data/lib/rex/encoding/xor/exceptions.rb +2 -3
  40. data/lib/rex/encoding/xor/generic.rb +129 -130
  41. data/lib/rex/encoding/xor/qword.rb +3 -4
  42. data/lib/rex/encoding/xor/word.rb +3 -4
  43. data/lib/rex/exceptions.rb +100 -101
  44. data/lib/rex/exploitation/cmdstager.rb +3 -3
  45. data/lib/rex/exploitation/cmdstager/base.rb +170 -156
  46. data/lib/rex/exploitation/cmdstager/bourne.rb +105 -0
  47. data/lib/rex/exploitation/cmdstager/debug_asm.rb +110 -113
  48. data/lib/rex/exploitation/cmdstager/debug_write.rb +106 -109
  49. data/lib/rex/exploitation/cmdstager/echo.rb +164 -0
  50. data/lib/rex/exploitation/cmdstager/printf.rb +122 -0
  51. data/lib/rex/exploitation/cmdstager/tftp.rb +34 -27
  52. data/lib/rex/exploitation/cmdstager/vbs.rb +95 -98
  53. data/lib/rex/exploitation/egghunter.rb +359 -346
  54. data/lib/rex/exploitation/encryptjs.rb +60 -60
  55. data/lib/rex/exploitation/heaplib.rb +76 -76
  56. data/lib/rex/exploitation/js.rb +6 -0
  57. data/lib/rex/exploitation/js/detect.rb +69 -0
  58. data/lib/rex/exploitation/js/memory.rb +81 -0
  59. data/lib/rex/exploitation/js/network.rb +84 -0
  60. data/lib/rex/exploitation/js/utils.rb +33 -0
  61. data/lib/rex/exploitation/jsobfu.rb +448 -424
  62. data/lib/rex/exploitation/obfuscatejs.rb +301 -301
  63. data/lib/rex/exploitation/omelet.rb +257 -257
  64. data/lib/rex/exploitation/opcodedb.rb +699 -699
  65. data/lib/rex/exploitation/ropdb.rb +189 -0
  66. data/lib/rex/exploitation/seh.rb +68 -68
  67. data/lib/rex/file.rb +96 -49
  68. data/lib/rex/image_source.rb +0 -3
  69. data/lib/rex/image_source/disk.rb +45 -48
  70. data/lib/rex/image_source/image_source.rb +33 -36
  71. data/lib/rex/image_source/memory.rb +17 -20
  72. data/lib/rex/io/bidirectional_pipe.rb +118 -115
  73. data/lib/rex/io/datagram_abstraction.rb +13 -14
  74. data/lib/rex/io/ring_buffer.rb +273 -273
  75. data/lib/rex/io/stream.rb +284 -284
  76. data/lib/rex/io/stream_abstraction.rb +183 -181
  77. data/lib/rex/io/stream_server.rb +193 -193
  78. data/lib/rex/job_container.rb +167 -167
  79. data/lib/rex/logging.rb +0 -1
  80. data/lib/rex/logging/log_dispatcher.rb +113 -113
  81. data/lib/rex/logging/log_sink.rb +17 -17
  82. data/lib/rex/logging/sinks/flatfile.rb +36 -36
  83. data/lib/rex/logging/sinks/stderr.rb +27 -27
  84. data/lib/rex/mac_oui.rb +16572 -16571
  85. data/lib/rex/machparsey.rb +0 -1
  86. data/lib/rex/machparsey/exceptions.rb +0 -1
  87. data/lib/rex/machparsey/mach.rb +160 -161
  88. data/lib/rex/machparsey/machbase.rb +367 -368
  89. data/lib/rex/machscan.rb +0 -1
  90. data/lib/rex/machscan/scanner.rb +175 -176
  91. data/lib/rex/mime/encoding.rb +17 -0
  92. data/lib/rex/mime/header.rb +58 -58
  93. data/lib/rex/mime/message.rb +140 -137
  94. data/lib/rex/mime/part.rb +41 -12
  95. data/lib/rex/nop/opty2.rb +90 -90
  96. data/lib/rex/nop/opty2_tables.rb +273 -273
  97. data/lib/rex/ole.rb +0 -4
  98. data/lib/rex/ole/clsid.rb +26 -30
  99. data/lib/rex/ole/difat.rb +121 -125
  100. data/lib/rex/ole/directory.rb +205 -209
  101. data/lib/rex/ole/direntry.rb +217 -221
  102. data/lib/rex/ole/fat.rb +79 -83
  103. data/lib/rex/ole/header.rb +178 -182
  104. data/lib/rex/ole/minifat.rb +49 -53
  105. data/lib/rex/ole/propset.rb +113 -117
  106. data/lib/rex/ole/samples/create_ole.rb +8 -9
  107. data/lib/rex/ole/samples/dir.rb +10 -11
  108. data/lib/rex/ole/samples/dump_stream.rb +14 -15
  109. data/lib/rex/ole/samples/ole_info.rb +5 -6
  110. data/lib/rex/ole/storage.rb +372 -376
  111. data/lib/rex/ole/stream.rb +33 -37
  112. data/lib/rex/ole/substorage.rb +20 -24
  113. data/lib/rex/ole/util.rb +137 -141
  114. data/lib/rex/parser/acunetix_nokogiri.rb +398 -398
  115. data/lib/rex/parser/apple_backup_manifestdb.rb +116 -116
  116. data/lib/rex/parser/appscan_nokogiri.rb +359 -359
  117. data/lib/rex/parser/arguments.rb +88 -88
  118. data/lib/rex/parser/burp_session_nokogiri.rb +258 -258
  119. data/lib/rex/parser/ci_nokogiri.rb +184 -184
  120. data/lib/rex/parser/foundstone_nokogiri.rb +334 -333
  121. data/lib/rex/parser/fusionvm_nokogiri.rb +94 -94
  122. data/lib/rex/parser/ini.rb +167 -167
  123. data/lib/rex/parser/ip360_aspl_xml.rb +84 -84
  124. data/lib/rex/parser/ip360_xml.rb +77 -77
  125. data/lib/rex/parser/mbsa_nokogiri.rb +224 -224
  126. data/lib/rex/parser/nessus_xml.rb +100 -100
  127. data/lib/rex/parser/netsparker_xml.rb +89 -75
  128. data/lib/rex/parser/nexpose_raw_nokogiri.rb +677 -677
  129. data/lib/rex/parser/nexpose_simple_nokogiri.rb +322 -322
  130. data/lib/rex/parser/nexpose_xml.rb +105 -105
  131. data/lib/rex/parser/nmap_nokogiri.rb +386 -386
  132. data/lib/rex/parser/nmap_xml.rb +116 -116
  133. data/lib/rex/parser/nokogiri_doc_mixin.rb +223 -221
  134. data/lib/rex/parser/openvas_nokogiri.rb +162 -162
  135. data/lib/rex/parser/outpost24_nokogiri.rb +239 -0
  136. data/lib/rex/parser/retina_xml.rb +90 -90
  137. data/lib/rex/parser/unattend.rb +171 -0
  138. data/lib/rex/parser/wapiti_nokogiri.rb +89 -89
  139. data/lib/rex/payloads/win32/common.rb +14 -14
  140. data/lib/rex/payloads/win32/kernel.rb +36 -36
  141. data/lib/rex/payloads/win32/kernel/common.rb +32 -32
  142. data/lib/rex/payloads/win32/kernel/recovery.rb +27 -27
  143. data/lib/rex/payloads/win32/kernel/stager.rb +170 -170
  144. data/lib/rex/peparsey.rb +0 -3
  145. data/lib/rex/peparsey/exceptions.rb +0 -3
  146. data/lib/rex/peparsey/pe.rb +196 -199
  147. data/lib/rex/peparsey/pe_memdump.rb +35 -38
  148. data/lib/rex/peparsey/pebase.rb +1633 -1652
  149. data/lib/rex/peparsey/section.rb +115 -124
  150. data/lib/rex/pescan.rb +0 -3
  151. data/lib/rex/pescan/analyze.rb +351 -351
  152. data/lib/rex/pescan/scanner.rb +182 -182
  153. data/lib/rex/pescan/search.rb +59 -59
  154. data/lib/rex/platforms/windows.rb +37 -37
  155. data/lib/rex/poly.rb +111 -110
  156. data/lib/rex/poly/block.rb +419 -417
  157. data/lib/rex/poly/machine.rb +12 -0
  158. data/lib/rex/poly/machine/machine.rb +829 -0
  159. data/lib/rex/poly/machine/x86.rb +508 -0
  160. data/lib/rex/poly/register.rb +70 -70
  161. data/lib/rex/poly/register/x86.rb +22 -22
  162. data/lib/rex/post.rb +0 -1
  163. data/lib/rex/post/dir.rb +35 -36
  164. data/lib/rex/post/file.rb +140 -141
  165. data/lib/rex/post/file_stat.rb +198 -199
  166. data/lib/rex/post/io.rb +167 -168
  167. data/lib/rex/post/meterpreter.rb +1 -1
  168. data/lib/rex/post/meterpreter/channel.rb +389 -390
  169. data/lib/rex/post/meterpreter/channel_container.rb +33 -34
  170. data/lib/rex/post/meterpreter/channels/pool.rb +129 -130
  171. data/lib/rex/post/meterpreter/channels/pools/file.rb +35 -36
  172. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +72 -73
  173. data/lib/rex/post/meterpreter/channels/stream.rb +62 -63
  174. data/lib/rex/post/meterpreter/client.rb +442 -436
  175. data/lib/rex/post/meterpreter/client_core.rb +326 -310
  176. data/lib/rex/post/meterpreter/dependencies.rb +0 -1
  177. data/lib/rex/post/meterpreter/extension.rb +12 -13
  178. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +35 -36
  179. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +71 -0
  180. data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb +169 -0
  181. data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +45 -0
  182. data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb +104 -0
  183. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +77 -0
  184. data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb +56 -0
  185. data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +75 -0
  186. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +70 -71
  187. data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb +361 -0
  188. data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb +76 -0
  189. data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb +78 -0
  190. data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb +22 -78
  191. data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb +49 -0
  192. data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb +4 -4
  193. data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb +128 -0
  194. data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb +16 -0
  195. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +38 -39
  196. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +1 -1
  197. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +95 -96
  198. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +39 -40
  199. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +80 -85
  200. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +94 -95
  201. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +207 -147
  202. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +258 -259
  203. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +366 -301
  204. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +72 -73
  205. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +24 -25
  206. data/lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb +59 -0
  207. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +227 -149
  208. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +107 -108
  209. data/lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb +97 -0
  210. data/lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb +106 -0
  211. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +41 -42
  212. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +102 -101
  213. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +151 -152
  214. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +142 -142
  215. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +185 -185
  216. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +38118 -38117
  217. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +7 -7
  218. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +2086 -2084
  219. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +15 -15
  220. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +80 -80
  221. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +3835 -3833
  222. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +84 -28
  223. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +151 -137
  224. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +15 -6
  225. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +3155 -3155
  226. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_version.rb +41 -0
  227. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +70 -70
  228. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb +128 -0
  229. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +596 -596
  230. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +310 -301
  231. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +71 -61
  232. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +100 -100
  233. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +14 -14
  234. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +488 -488
  235. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +273 -264
  236. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb +5 -5
  237. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +240 -238
  238. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +17 -15
  239. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb +61 -61
  240. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +654 -635
  241. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +49 -49
  242. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +103 -102
  243. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +98 -68
  244. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +165 -166
  245. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +16 -17
  246. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +34 -36
  247. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +363 -364
  248. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +102 -103
  249. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +28 -29
  250. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +303 -304
  251. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +113 -114
  252. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +260 -261
  253. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +165 -166
  254. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +69 -70
  255. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +160 -161
  256. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +143 -144
  257. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +29 -12
  258. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +230 -231
  259. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +181 -44
  260. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +12 -13
  261. data/lib/rex/post/meterpreter/object_aliases.rb +56 -57
  262. data/lib/rex/post/meterpreter/packet.rb +591 -592
  263. data/lib/rex/post/meterpreter/packet_dispatcher.rb +506 -496
  264. data/lib/rex/post/meterpreter/packet_parser.rb +72 -73
  265. data/lib/rex/post/meterpreter/packet_response_waiter.rb +56 -57
  266. data/lib/rex/post/meterpreter/ui/console.rb +112 -112
  267. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +53 -53
  268. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +911 -854
  269. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +86 -86
  270. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb +65 -0
  271. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +198 -0
  272. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb +444 -0
  273. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb +199 -0
  274. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb +118 -0
  275. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb +108 -0
  276. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +220 -220
  277. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb +509 -0
  278. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb +60 -0
  279. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +254 -0
  280. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb +159 -0
  281. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb +182 -0
  282. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +173 -173
  283. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +40 -40
  284. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +75 -77
  285. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +30 -30
  286. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +105 -105
  287. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +182 -182
  288. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +37 -37
  289. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +504 -482
  290. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +401 -330
  291. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +883 -581
  292. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +296 -299
  293. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +320 -153
  294. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +78 -78
  295. data/lib/rex/post/permission.rb +0 -1
  296. data/lib/rex/post/process.rb +39 -40
  297. data/lib/rex/post/thread.rb +41 -42
  298. data/lib/rex/post/ui.rb +35 -36
  299. data/lib/rex/proto/addp.rb +218 -0
  300. data/lib/rex/proto/dcerpc/client.rb +344 -344
  301. data/lib/rex/proto/dcerpc/exceptions.rb +128 -128
  302. data/lib/rex/proto/dcerpc/handle.rb +32 -32
  303. data/lib/rex/proto/dcerpc/ndr.rb +56 -56
  304. data/lib/rex/proto/dcerpc/packet.rb +249 -245
  305. data/lib/rex/proto/dcerpc/response.rb +170 -170
  306. data/lib/rex/proto/dcerpc/uuid.rb +65 -65
  307. data/lib/rex/proto/dcerpc/wdscp.rb +3 -0
  308. data/lib/rex/proto/dcerpc/wdscp/constants.rb +89 -0
  309. data/lib/rex/proto/dcerpc/wdscp/packet.rb +94 -0
  310. data/lib/rex/proto/dhcp.rb +0 -1
  311. data/lib/rex/proto/dhcp/constants.rb +0 -1
  312. data/lib/rex/proto/dhcp/server.rb +303 -304
  313. data/lib/rex/proto/drda/constants.rb +1 -1
  314. data/lib/rex/proto/drda/packet.rb +186 -186
  315. data/lib/rex/proto/drda/utils.rb +104 -104
  316. data/lib/rex/proto/http.rb +1 -0
  317. data/lib/rex/proto/http/client.rb +692 -820
  318. data/lib/rex/proto/http/client_request.rb +472 -0
  319. data/lib/rex/proto/http/handler.rb +25 -25
  320. data/lib/rex/proto/http/handler/erb.rb +104 -104
  321. data/lib/rex/proto/http/handler/proc.rb +37 -37
  322. data/lib/rex/proto/http/header.rb +149 -149
  323. data/lib/rex/proto/http/packet.rb +388 -382
  324. data/lib/rex/proto/http/request.rb +332 -335
  325. data/lib/rex/proto/http/response.rb +132 -72
  326. data/lib/rex/proto/http/server.rb +348 -338
  327. data/lib/rex/proto/iax2/call.rb +310 -310
  328. data/lib/rex/proto/iax2/client.rb +197 -197
  329. data/lib/rex/proto/iax2/codecs/alaw.rb +4 -4
  330. data/lib/rex/proto/iax2/codecs/mulaw.rb +4 -4
  331. data/lib/rex/proto/ipmi.rb +57 -0
  332. data/lib/rex/proto/ipmi/channel_auth_reply.rb +88 -0
  333. data/lib/rex/proto/ipmi/open_session_reply.rb +35 -0
  334. data/lib/rex/proto/ipmi/rakp2.rb +35 -0
  335. data/lib/rex/proto/ipmi/utils.rb +125 -0
  336. data/lib/rex/proto/natpmp.rb +1 -5
  337. data/lib/rex/proto/natpmp/constants.rb +4 -4
  338. data/lib/rex/proto/natpmp/packet.rb +25 -25
  339. data/lib/rex/proto/ntlm/base.rb +271 -271
  340. data/lib/rex/proto/ntlm/constants.rb +61 -61
  341. data/lib/rex/proto/ntlm/crypt.rb +348 -352
  342. data/lib/rex/proto/ntlm/exceptions.rb +3 -3
  343. data/lib/rex/proto/ntlm/message.rb +468 -471
  344. data/lib/rex/proto/ntlm/utils.rb +746 -746
  345. data/lib/rex/proto/pjl.rb +30 -0
  346. data/lib/rex/proto/pjl/client.rb +162 -0
  347. data/lib/rex/proto/proxy/socks4a.rb +440 -440
  348. data/lib/rex/proto/rfb.rb +1 -8
  349. data/lib/rex/proto/rfb/cipher.rb +46 -49
  350. data/lib/rex/proto/rfb/client.rb +179 -182
  351. data/lib/rex/proto/rfb/constants.rb +18 -21
  352. data/lib/rex/proto/smb/client.rb +1954 -1843
  353. data/lib/rex/proto/smb/constants.rb +533 -516
  354. data/lib/rex/proto/smb/crypt.rb +21 -21
  355. data/lib/rex/proto/smb/evasions.rb +43 -43
  356. data/lib/rex/proto/smb/exceptions.rb +791 -791
  357. data/lib/rex/proto/smb/simpleclient.rb +142 -286
  358. data/lib/rex/proto/smb/simpleclient/open_file.rb +106 -0
  359. data/lib/rex/proto/smb/simpleclient/open_pipe.rb +57 -0
  360. data/lib/rex/proto/smb/utils.rb +81 -81
  361. data/lib/rex/proto/sunrpc/client.rb +158 -158
  362. data/lib/rex/proto/tftp.rb +0 -1
  363. data/lib/rex/proto/tftp/client.rb +289 -289
  364. data/lib/rex/proto/tftp/constants.rb +9 -10
  365. data/lib/rex/proto/tftp/server.rb +466 -467
  366. data/lib/rex/random_identifier_generator.rb +176 -0
  367. data/lib/rex/registry.rb +1 -1
  368. data/lib/rex/registry/hive.rb +88 -88
  369. data/lib/rex/registry/lfkey.rb +25 -25
  370. data/lib/rex/registry/nodekey.rb +30 -30
  371. data/lib/rex/registry/regf.rb +10 -10
  372. data/lib/rex/registry/valuekey.rb +43 -43
  373. data/lib/rex/registry/valuelist.rb +13 -13
  374. data/lib/rex/ropbuilder/rop.rb +254 -253
  375. data/lib/rex/script.rb +21 -22
  376. data/lib/rex/script/base.rb +51 -50
  377. data/lib/rex/script/meterpreter.rb +2 -2
  378. data/lib/rex/service.rb +24 -24
  379. data/lib/rex/service_manager.rb +132 -132
  380. data/lib/rex/services/local_relay.rb +398 -398
  381. data/lib/rex/socket.rb +758 -763
  382. data/lib/rex/socket/comm.rb +95 -95
  383. data/lib/rex/socket/comm/local.rb +507 -440
  384. data/lib/rex/socket/ip.rb +118 -118
  385. data/lib/rex/socket/parameters.rb +351 -350
  386. data/lib/rex/socket/range_walker.rb +445 -368
  387. data/lib/rex/socket/ssl_tcp.rb +323 -317
  388. data/lib/rex/socket/ssl_tcp_server.rb +173 -158
  389. data/lib/rex/socket/subnet_walker.rb +48 -48
  390. data/lib/rex/socket/switch_board.rb +259 -259
  391. data/lib/rex/socket/tcp.rb +58 -56
  392. data/lib/rex/socket/tcp_server.rb +42 -42
  393. data/lib/rex/socket/udp.rb +152 -152
  394. data/lib/rex/sslscan/result.rb +200 -0
  395. data/lib/rex/sslscan/scanner.rb +205 -0
  396. data/lib/rex/struct2.rb +0 -1
  397. data/lib/rex/struct2/c_struct.rb +162 -163
  398. data/lib/rex/struct2/c_struct_template.rb +21 -22
  399. data/lib/rex/struct2/constant.rb +6 -7
  400. data/lib/rex/struct2/element.rb +30 -31
  401. data/lib/rex/struct2/generic.rb +60 -61
  402. data/lib/rex/struct2/restraint.rb +40 -41
  403. data/lib/rex/struct2/s_string.rb +60 -61
  404. data/lib/rex/struct2/s_struct.rb +97 -98
  405. data/lib/rex/sync.rb +0 -1
  406. data/lib/rex/sync/event.rb +62 -72
  407. data/lib/rex/sync/read_write_lock.rb +149 -149
  408. data/lib/rex/sync/ref.rb +42 -42
  409. data/lib/rex/sync/thread_safe.rb +59 -59
  410. data/lib/rex/text.rb +1803 -1315
  411. data/lib/rex/thread_factory.rb +25 -25
  412. data/lib/rex/time.rb +44 -44
  413. data/lib/rex/transformer.rb +91 -91
  414. data/lib/rex/ui/interactive.rb +265 -265
  415. data/lib/rex/ui/output.rb +66 -60
  416. data/lib/rex/ui/progress_tracker.rb +79 -79
  417. data/lib/rex/ui/subscriber.rb +144 -134
  418. data/lib/rex/ui/text/color.rb +76 -76
  419. data/lib/rex/ui/text/dispatcher_shell.rb +512 -505
  420. data/lib/rex/ui/text/input.rb +96 -96
  421. data/lib/rex/ui/text/input/buffer.rb +58 -58
  422. data/lib/rex/ui/text/input/readline.rb +114 -114
  423. data/lib/rex/ui/text/input/socket.rb +77 -77
  424. data/lib/rex/ui/text/input/stdio.rb +24 -24
  425. data/lib/rex/ui/text/irb_shell.rb +45 -41
  426. data/lib/rex/ui/text/output.rb +64 -60
  427. data/lib/rex/ui/text/output/buffer.rb +42 -42
  428. data/lib/rex/ui/text/output/buffer/stdout.rb +25 -0
  429. data/lib/rex/ui/text/output/file.rb +24 -24
  430. data/lib/rex/ui/text/output/socket.rb +24 -24
  431. data/lib/rex/ui/text/output/stdio.rb +29 -29
  432. data/lib/rex/ui/text/output/tee.rb +36 -36
  433. data/lib/rex/ui/text/progress_tracker.rb +37 -37
  434. data/lib/rex/ui/text/shell.rb +371 -361
  435. data/lib/rex/ui/text/table.rb +320 -284
  436. data/lib/rex/zip.rb +0 -1
  437. data/lib/rex/zip/archive.rb +115 -94
  438. data/lib/rex/zip/blocks.rb +101 -100
  439. data/lib/rex/zip/entry.rb +108 -99
  440. data/lib/rex/zip/jar.rb +261 -206
  441. data/lib/rex/zip/samples/comment.rb +1 -2
  442. data/lib/rex/zip/samples/mkwar.rb +12 -13
  443. data/lib/rex/zip/samples/mkzip.rb +1 -2
  444. data/lib/rex/zip/samples/recursive.rb +29 -30
  445. metadata +424 -446
  446. data/lib/rex/arch/sparc.rb.ut.rb +0 -19
  447. data/lib/rex/arch/x86.rb.ut.rb +0 -94
  448. data/lib/rex/assembly/nasm.rb.ut.rb +0 -23
  449. data/lib/rex/encoder/ndr.rb.ut.rb +0 -45
  450. data/lib/rex/encoder/xdr.rb.ut.rb +0 -30
  451. data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +0 -13
  452. data/lib/rex/encoding/xor.rb.ts.rb +0 -15
  453. data/lib/rex/encoding/xor/byte.rb.ut.rb +0 -22
  454. data/lib/rex/encoding/xor/dword.rb.ut.rb +0 -16
  455. data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +0 -16
  456. data/lib/rex/encoding/xor/generic.rb.ut.rb +0 -121
  457. data/lib/rex/encoding/xor/word.rb.ut.rb +0 -14
  458. data/lib/rex/exceptions.rb.ut.rb +0 -45
  459. data/lib/rex/exploitation/egghunter.rb.ut.rb +0 -28
  460. data/lib/rex/exploitation/javascriptosdetect.js +0 -1014
  461. data/lib/rex/exploitation/javascriptosdetect.rb +0 -43
  462. data/lib/rex/exploitation/omelet.rb.ut.rb +0 -27
  463. data/lib/rex/exploitation/opcodedb.rb.ut.rb +0 -280
  464. data/lib/rex/exploitation/seh.rb.ut.rb +0 -20
  465. data/lib/rex/file.rb.ut.rb +0 -17
  466. data/lib/rex/io/ring_buffer.rb.ut.rb +0 -135
  467. data/lib/rex/nop/opty2.rb.ut.rb +0 -24
  468. data/lib/rex/parser/arguments.rb.ut.rb +0 -68
  469. data/lib/rex/parser/ini.rb.ut.rb +0 -30
  470. data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +0 -18
  471. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb +0 -39
  472. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +0 -37
  473. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb +0 -52
  474. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +0 -43
  475. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +0 -128
  476. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb +0 -64
  477. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb.ut.rb +0 -29
  478. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb +0 -155
  479. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb.ut.rb +0 -128
  480. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +0 -124
  481. data/lib/rex/proto.rb.ts.rb +0 -9
  482. data/lib/rex/proto/dcerpc.rb.ts.rb +0 -10
  483. data/lib/rex/proto/dcerpc/client.rb.ut.rb +0 -492
  484. data/lib/rex/proto/dcerpc/handle.rb.ut.rb +0 -86
  485. data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +0 -42
  486. data/lib/rex/proto/dcerpc/packet.rb.ut.rb +0 -57
  487. data/lib/rex/proto/dcerpc/response.rb.ut.rb +0 -16
  488. data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +0 -47
  489. data/lib/rex/proto/drda.rb.ts.rb +0 -18
  490. data/lib/rex/proto/drda/constants.rb.ut.rb +0 -24
  491. data/lib/rex/proto/drda/packet.rb.ut.rb +0 -110
  492. data/lib/rex/proto/drda/utils.rb.ut.rb +0 -85
  493. data/lib/rex/proto/http.rb.ts.rb +0 -13
  494. data/lib/rex/proto/http/client.rb.ut.rb +0 -96
  495. data/lib/rex/proto/http/handler/erb.rb.ut.rb +0 -22
  496. data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +0 -1
  497. data/lib/rex/proto/http/handler/proc.rb.ut.rb +0 -25
  498. data/lib/rex/proto/http/header.rb.ut.rb +0 -47
  499. data/lib/rex/proto/http/packet.rb.ut.rb +0 -166
  500. data/lib/rex/proto/http/request.rb.ut.rb +0 -215
  501. data/lib/rex/proto/http/response.rb.ut.rb +0 -150
  502. data/lib/rex/proto/http/server.rb.ut.rb +0 -80
  503. data/lib/rex/proto/ntlm.rb.ut.rb +0 -181
  504. data/lib/rex/proto/rfb.rb.ut.rb +0 -40
  505. data/lib/rex/proto/smb.rb.ts.rb +0 -9
  506. data/lib/rex/proto/smb/client.rb.ut.rb +0 -224
  507. data/lib/rex/proto/smb/constants.rb.ut.rb +0 -19
  508. data/lib/rex/proto/smb/simpleclient.rb.ut.rb +0 -129
  509. data/lib/rex/proto/smb/utils.rb.ut.rb +0 -21
  510. data/lib/rex/proto/tftp/server.rb.ut.rb +0 -29
  511. data/lib/rex/service_manager.rb.ut.rb +0 -33
  512. data/lib/rex/socket.rb.ut.rb +0 -108
  513. data/lib/rex/socket/comm/local.rb.ut.rb +0 -76
  514. data/lib/rex/socket/parameters.rb.ut.rb +0 -52
  515. data/lib/rex/socket/range_walker.rb.ut.rb +0 -56
  516. data/lib/rex/socket/ssl_tcp.rb.ut.rb +0 -40
  517. data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +0 -62
  518. data/lib/rex/socket/subnet_walker.rb.ut.rb +0 -29
  519. data/lib/rex/socket/switch_board.rb.ut.rb +0 -53
  520. data/lib/rex/socket/tcp.rb.ut.rb +0 -65
  521. data/lib/rex/socket/tcp_server.rb.ut.rb +0 -45
  522. data/lib/rex/socket/udp.rb.ut.rb +0 -45
  523. data/lib/rex/test.rb +0 -36
  524. data/lib/rex/text.rb.ut.rb +0 -193
  525. data/lib/rex/transformer.rb.ut.rb +0 -39
  526. data/lib/rex/ui/text/color.rb.ut.rb +0 -19
  527. data/lib/rex/ui/text/progress_tracker.rb.ut.rb +0 -35
  528. data/lib/rex/ui/text/table.rb.ut.rb +0 -56
@@ -1,5 +1,4 @@
1
1
  # -*- coding: binary -*-
2
- # $Id: constants.rb 15548 2012-06-29 06:08:20Z rapid7 $
3
2
  require 'rex/proto/tftp'
4
3
 
5
4
  module Rex
@@ -15,15 +14,15 @@ OpError = 5
15
14
  OpOptAck = 6
16
15
 
17
16
  ERRCODES = [
18
- "Undefined",
19
- "File not found",
20
- "Access violation",
21
- "Disk full or allocation exceeded",
22
- "Illegal TFTP operation",
23
- "Unknown transfer ID",
24
- "File already exists",
25
- "No such user",
26
- "Failed option negotiation"
17
+ "Undefined",
18
+ "File not found",
19
+ "Access violation",
20
+ "Disk full or allocation exceeded",
21
+ "Illegal TFTP operation",
22
+ "Unknown transfer ID",
23
+ "File already exists",
24
+ "No such user",
25
+ "Failed option negotiation"
27
26
  ]
28
27
 
29
28
  ErrFileNotFound = 1
@@ -1,5 +1,4 @@
1
1
  # -*- coding: binary -*-
2
- # $Id: server.rb 15548 2012-06-29 06:08:20Z rapid7 $
3
2
  require 'rex/socket'
4
3
  require 'rex/proto/tftp'
5
4
 
@@ -11,12 +10,12 @@ module TFTP
11
10
  # Little util function
12
11
  #
13
12
  def self.get_string(data)
14
- idx = data.index("\x00")
15
- return nil if not idx
16
- ret = data.slice!(0, idx)
17
- # Slice off the nul byte.
18
- data.slice!(0,1)
19
- ret
13
+ idx = data.index("\x00")
14
+ return nil if not idx
15
+ ret = data.slice!(0, idx)
16
+ # Slice off the nul byte.
17
+ data.slice!(0,1)
18
+ ret
20
19
  end
21
20
 
22
21
 
@@ -27,469 +26,469 @@ end
27
26
  ##
28
27
  class Server
29
28
 
30
- def initialize(port = 69, listen_host = '0.0.0.0', context = {})
31
- self.listen_host = listen_host
32
- self.listen_port = port
33
- self.context = context
34
- self.sock = nil
35
- @shutting_down = false
36
- @output_dir = nil
37
- @tftproot = nil
38
-
39
- self.files = []
40
- self.uploaded = []
41
- self.transfers = []
42
- end
43
-
44
-
45
- #
46
- # Start the TFTP server
47
- #
48
- def start
49
- self.sock = Rex::Socket::Udp.create(
50
- 'LocalHost' => listen_host,
51
- 'LocalPort' => listen_port,
52
- 'Context' => context
53
- )
54
-
55
- self.thread = Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
56
- monitor_socket
57
- }
58
- end
59
-
60
-
61
- #
62
- # Stop the TFTP server
63
- #
64
- def stop
65
- @shutting_down = true
66
-
67
- # Wait a maximum of 30 seconds for all transfers to finish.
68
- start = ::Time.now
69
- while (self.transfers.length > 0)
70
- ::IO.select(nil, nil, nil, 0.5)
71
- dur = ::Time.now - start
72
- break if (dur > 30)
73
- end
74
-
75
- self.files.clear
76
- self.thread.kill
77
- self.sock.close rescue nil # might be closed already
78
- end
79
-
80
-
81
- #
82
- # Register a filename and content for a client to request
83
- #
84
- def register_file(fn, content, once = false)
85
- self.files << {
86
- :name => fn,
87
- :data => content,
88
- :once => once
89
- }
90
- end
91
-
92
-
93
- #
94
- # Register an entire directory to serve files from
95
- #
96
- def set_tftproot(rootdir)
97
- @tftproot = rootdir if ::File.directory?(rootdir)
98
- end
99
-
100
-
101
- #
102
- # Register a directory to write uploaded files to
103
- #
104
- def set_output_dir(outdir)
105
- @output_dir = outdir if ::File.directory?(outdir)
106
- end
107
-
108
-
109
- #
110
- # Send an error packet w/the specified code and string
111
- #
112
- def send_error(from, num)
113
- if (num < 1 or num >= ERRCODES.length)
114
- # ignore..
115
- return
116
- end
117
- pkt = [OpError, num].pack('nn')
118
- pkt << ERRCODES[num]
119
- pkt << "\x00"
120
- send_packet(from, pkt)
121
- end
122
-
123
-
124
- #
125
- # Send a single packet to the specified host
126
- #
127
- def send_packet(from, pkt)
128
- self.sock.sendto(pkt, from[0], from[1])
129
- end
130
-
131
-
132
- #
133
- # Find the hash entry for a file that may be offered
134
- #
135
- def find_file(fname)
136
- # Files served via register_file() take precedence.
137
- self.files.each do |f|
138
- if (fname == f[:name])
139
- return f
140
- end
141
- end
142
-
143
- # Now, if we have a tftproot, see if it can serve from it
144
- if @tftproot
145
- return find_file_in_root(fname)
146
- end
147
-
148
- nil
149
- end
150
-
151
-
152
- #
153
- # Find the file in the specified tftp root and add a temporary
154
- # entry to the files hash.
155
- #
156
- def find_file_in_root(fname)
157
- fn = ::File.expand_path(::File.join(@tftproot, fname))
158
-
159
- # Don't allow directory traversal
160
- return nil if fn.index(@tftproot) != 0
161
-
162
- return nil if not ::File.file?(fn) or not ::File.readable?(fn)
163
-
164
- # Read the file contents, and register it as being served once
165
- data = data = ::File.open(fn, "rb") { |fd| fd.read(fd.stat.size) }
166
- register_file(fname, data)
167
-
168
- # Return the last file in the array
169
- return self.files[-1]
170
- end
171
-
172
-
173
- attr_accessor :listen_host, :listen_port, :context
174
- attr_accessor :sock, :files, :transfers, :uploaded
175
- attr_accessor :thread
176
-
177
- attr_accessor :incoming_file_hook
29
+ def initialize(port = 69, listen_host = '0.0.0.0', context = {})
30
+ self.listen_host = listen_host
31
+ self.listen_port = port
32
+ self.context = context
33
+ self.sock = nil
34
+ @shutting_down = false
35
+ @output_dir = nil
36
+ @tftproot = nil
37
+
38
+ self.files = []
39
+ self.uploaded = []
40
+ self.transfers = []
41
+ end
42
+
43
+
44
+ #
45
+ # Start the TFTP server
46
+ #
47
+ def start
48
+ self.sock = Rex::Socket::Udp.create(
49
+ 'LocalHost' => listen_host,
50
+ 'LocalPort' => listen_port,
51
+ 'Context' => context
52
+ )
53
+
54
+ self.thread = Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
55
+ monitor_socket
56
+ }
57
+ end
58
+
59
+
60
+ #
61
+ # Stop the TFTP server
62
+ #
63
+ def stop
64
+ @shutting_down = true
65
+
66
+ # Wait a maximum of 30 seconds for all transfers to finish.
67
+ start = ::Time.now
68
+ while (self.transfers.length > 0)
69
+ ::IO.select(nil, nil, nil, 0.5)
70
+ dur = ::Time.now - start
71
+ break if (dur > 30)
72
+ end
73
+
74
+ self.files.clear
75
+ self.thread.kill
76
+ self.sock.close rescue nil # might be closed already
77
+ end
78
+
79
+
80
+ #
81
+ # Register a filename and content for a client to request
82
+ #
83
+ def register_file(fn, content, once = false)
84
+ self.files << {
85
+ :name => fn,
86
+ :data => content,
87
+ :once => once
88
+ }
89
+ end
90
+
91
+
92
+ #
93
+ # Register an entire directory to serve files from
94
+ #
95
+ def set_tftproot(rootdir)
96
+ @tftproot = rootdir if ::File.directory?(rootdir)
97
+ end
98
+
99
+
100
+ #
101
+ # Register a directory to write uploaded files to
102
+ #
103
+ def set_output_dir(outdir)
104
+ @output_dir = outdir if ::File.directory?(outdir)
105
+ end
106
+
107
+
108
+ #
109
+ # Send an error packet w/the specified code and string
110
+ #
111
+ def send_error(from, num)
112
+ if (num < 1 or num >= ERRCODES.length)
113
+ # ignore..
114
+ return
115
+ end
116
+ pkt = [OpError, num].pack('nn')
117
+ pkt << ERRCODES[num]
118
+ pkt << "\x00"
119
+ send_packet(from, pkt)
120
+ end
121
+
122
+
123
+ #
124
+ # Send a single packet to the specified host
125
+ #
126
+ def send_packet(from, pkt)
127
+ self.sock.sendto(pkt, from[0], from[1])
128
+ end
129
+
130
+
131
+ #
132
+ # Find the hash entry for a file that may be offered
133
+ #
134
+ def find_file(fname)
135
+ # Files served via register_file() take precedence.
136
+ self.files.each do |f|
137
+ if (fname == f[:name])
138
+ return f
139
+ end
140
+ end
141
+
142
+ # Now, if we have a tftproot, see if it can serve from it
143
+ if @tftproot
144
+ return find_file_in_root(fname)
145
+ end
146
+
147
+ nil
148
+ end
149
+
150
+
151
+ #
152
+ # Find the file in the specified tftp root and add a temporary
153
+ # entry to the files hash.
154
+ #
155
+ def find_file_in_root(fname)
156
+ fn = ::File.expand_path(::File.join(@tftproot, fname))
157
+
158
+ # Don't allow directory traversal
159
+ return nil if fn.index(@tftproot) != 0
160
+
161
+ return nil if not ::File.file?(fn) or not ::File.readable?(fn)
162
+
163
+ # Read the file contents, and register it as being served once
164
+ data = data = ::File.open(fn, "rb") { |fd| fd.read(fd.stat.size) }
165
+ register_file(fname, data)
166
+
167
+ # Return the last file in the array
168
+ return self.files[-1]
169
+ end
170
+
171
+
172
+ attr_accessor :listen_host, :listen_port, :context
173
+ attr_accessor :sock, :files, :transfers, :uploaded
174
+ attr_accessor :thread
175
+
176
+ attr_accessor :incoming_file_hook
178
177
 
179
178
  protected
180
179
 
181
- def find_transfer(type, from, block)
182
- self.transfers.each do |tr|
183
- if (tr[:type] == type and tr[:from] == from and tr[:block] == block)
184
- return tr
185
- end
186
- end
187
- nil
188
- end
189
-
190
- def save_output(tr)
191
- self.uploaded << tr[:file]
192
-
193
- return incoming_file_hook.call(tr) if incoming_file_hook
194
-
195
- if @output_dir
196
- fn = tr[:file][:name].split(File::SEPARATOR)[-1]
197
- if fn
198
- fn = ::File.join(@output_dir, Rex::FileUtils.clean_path(fn))
199
- ::File.open(fn, "wb") { |fd|
200
- fd.write(tr[:file][:data])
201
- }
202
- end
203
- end
204
- end
205
-
206
-
207
- def check_retransmission(tr)
208
- elapsed = ::Time.now - tr[:last_sent]
209
- if (elapsed >= tr[:timeout])
210
- # max retries reached?
211
- if (tr[:retries] < 3)
212
- #if (tr[:type] == OpRead)
213
- # puts "[-] ack timed out, resending block"
214
- #else
215
- # puts "[-] block timed out, resending ack"
216
- #end
217
- tr[:last_sent] = nil
218
- tr[:retries] += 1
219
- else
220
- #puts "[-] maximum tries reached, terminating transfer"
221
- self.transfers.delete(tr)
222
- end
223
- end
224
- end
225
-
226
-
227
- #
228
- # See if there is anything to do.. If so, dispatch it.
229
- #
230
- def monitor_socket
231
- while true
232
- rds = [@sock]
233
- wds = []
234
- self.transfers.each do |tr|
235
- if (not tr[:last_sent])
236
- wds << @sock
237
- break
238
- end
239
- end
240
- eds = [@sock]
241
-
242
- r,w,e = ::IO.select(rds,wds,eds,1)
243
-
244
- if (r != nil and r[0] == self.sock)
245
- buf,host,port = self.sock.recvfrom(65535)
246
- # Lame compatabilitiy :-/
247
- from = [host, port]
248
- dispatch_request(from, buf)
249
- end
250
-
251
- #
252
- # Check to see if transfers need maintenance
253
- #
254
- self.transfers.each do |tr|
255
- # We handle RRQ and WRQ separately
256
- #
257
- if (tr[:type] == OpRead)
258
- # Are we awaiting an ack?
259
- if (tr[:last_sent])
260
- check_retransmission(tr)
261
- elsif (w != nil and w[0] == self.sock)
262
- # No ack waiting, send next block..
263
- chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
264
- if (chunk and chunk.length >= 0)
265
- pkt = [OpData, tr[:block]].pack('nn')
266
- pkt << chunk
267
-
268
- send_packet(tr[:from], pkt)
269
- tr[:last_sent] = ::Time.now
270
-
271
- # If the file is a one-serve, mark it as started
272
- tr[:file][:started] = true if (tr[:file][:once])
273
- else
274
- # No more chunks.. transfer is most likely done.
275
- # However, we can only delete it once the last chunk has been
276
- # acked.
277
- end
278
- end
279
- else
280
- # Are we awaiting data?
281
- if (tr[:last_sent])
282
- check_retransmission(tr)
283
- elsif (w != nil and w[0] == self.sock)
284
- # Not waiting for data, send an ack..
285
- #puts "[*] sending ack for block %d" % [tr[:block]]
286
- pkt = [OpAck, tr[:block]].pack('nn')
287
-
288
- send_packet(tr[:from], pkt)
289
- tr[:last_sent] = ::Time.now
290
-
291
- # If we had a 0-511 byte chunk, we're done.
292
- if (tr[:last_size] and tr[:last_size] < tr[:blksize])
293
- #puts "[*] Transfer complete, saving output"
294
- save_output(tr)
295
- self.transfers.delete(tr)
296
- end
297
- end
298
- end
299
- end
300
- end
301
- end
302
-
303
-
304
- def next_block(tr)
305
- tr[:block] += 1
306
- tr[:last_sent] = nil
307
- tr[:retries] = 0
308
- end
309
-
310
-
311
- #
312
- # Dispatch a packet that we received
313
- #
314
- def dispatch_request(from, buf)
315
-
316
- op = buf.unpack('n')[0]
317
- buf.slice!(0,2)
318
-
319
- #XXX: todo - create call backs for status
320
- #start = "[*] TFTP - %s:%u - %s" % [from[0], from[1], OPCODES[op]]
321
-
322
- case op
323
- when OpRead
324
- # Process RRQ packets
325
- fn = TFTP::get_string(buf)
326
- mode = TFTP::get_string(buf).downcase
327
-
328
- #puts "%s %s %s" % [start, fn, mode]
329
-
330
- if (not @shutting_down) and (file = self.find_file(fn))
331
- if (file[:once] and file[:started])
332
- send_error(from, ErrFileNotFound)
333
- else
334
- transfer = {
335
- :type => OpRead,
336
- :from => from,
337
- :file => file,
338
- :block => 1,
339
- :blksize => 512,
340
- :offset => 0,
341
- :timeout => 3,
342
- :last_sent => nil,
343
- :retries => 0
344
- }
345
-
346
- process_options(from, buf, transfer)
347
-
348
- self.transfers << transfer
349
- end
350
- else
351
- #puts "[-] file not found!"
352
- send_error(from, ErrFileNotFound)
353
- end
354
-
355
- when OpWrite
356
- # Process WRQ packets
357
- fn = TFTP::get_string(buf)
358
- mode = TFTP::get_string(buf).downcase
359
-
360
- #puts "%s %s %s" % [start, fn, mode]
361
-
362
- if not @shutting_down
363
- transfer = {
364
- :type => OpWrite,
365
- :from => from,
366
- :file => { :name => fn, :data => '' },
367
- :block => 0, # WRQ starts at 0
368
- :blksize => 512,
369
- :timeout => 3,
370
- :last_sent => nil,
371
- :retries => 0
372
- }
373
-
374
- process_options(from, buf, transfer)
375
-
376
- self.transfers << transfer
377
- else
378
- send_error(from, ErrIllegalOperation)
379
- end
380
-
381
- when OpAck
382
- # Process ACK packets
383
- block = buf.unpack('n')[0]
384
-
385
- #puts "%s %d" % [start, block]
386
-
387
- tr = find_transfer(OpRead, from, block)
388
- if not tr
389
- # NOTE: some clients, such as pxelinux, send an ack for block 0.
390
- # To deal with this, we simply ignore it as we start with block 1.
391
- return if block == 0
392
-
393
- # If we didn't find it, send an error.
394
- send_error(from, ErrUnknownTransferId)
395
- else
396
- # acked! send the next block
397
- tr[:offset] += tr[:blksize]
398
- next_block(tr)
399
-
400
- # If the transfer is finished, delete it
401
- if (tr[:offset] > tr[:file][:data].length)
402
- #puts "[*] Transfer complete"
403
- self.transfers.delete(tr)
404
-
405
- # if the file is a one-serve, delete it from the files array
406
- if tr[:file][:once]
407
- #puts "[*] Removed one-serve file: #{tr[:file][:name]}"
408
- self.files.delete(tr[:file])
409
- end
410
- end
411
- end
412
-
413
- when OpData
414
- # Process Data packets
415
- block = buf.unpack('n')[0]
416
- data = buf.slice(2, buf.length)
417
-
418
- #puts "%s %d %d bytes" % [start, block, data.length]
419
-
420
- tr = find_transfer(OpWrite, from, (block-1))
421
- if not tr
422
- # If we didn't find it, send an error.
423
- send_error(from, ErrUnknownTransferId)
424
- else
425
- tr[:file][:data] << data
426
- tr[:last_size] = data.length
427
- next_block(tr)
428
-
429
- # Similar to RRQ transfers, we cannot detect that the
430
- # transfer finished here. We must do so after transmitting
431
- # the final ACK.
432
- end
433
-
434
- else
435
- # Other packets are unsupported
436
- #puts start
437
- send_error(from, ErrAccessViolation)
438
-
439
- end
440
- end
441
-
442
- def process_options(from, buf, tr)
443
- found = 0
444
- to_ack = []
445
- while buf.length >= 4
446
- opt = TFTP::get_string(buf)
447
- break if not opt
448
- val = TFTP::get_string(buf)
449
- break if not val
450
-
451
- found += 1
452
-
453
- # Is it one we support?
454
- opt.downcase!
455
-
456
- case opt
457
- when "blksize"
458
- val = val.to_i
459
- if val > 0
460
- tr[:blksize] = val
461
- to_ack << [ opt, val.to_s ]
462
- end
463
-
464
- when "timeout"
465
- val = val.to_i
466
- if val >= 1 and val <= 255
467
- tr[:timeout] = val
468
- to_ack << [ opt, val.to_s ]
469
- end
470
-
471
- when "tsize"
472
- if tr[:type] == OpRead
473
- len = tr[:file][:data].length
474
- else
475
- val = val.to_i
476
- len = val
477
- end
478
- to_ack << [ opt, len.to_s ]
479
-
480
- end
481
- end
482
-
483
- return if to_ack.length < 1
484
-
485
- # if we have anything to ack, do it
486
- data = [OpOptAck].pack('n')
487
- to_ack.each { |el|
488
- data << el[0] << "\x00" << el[1] << "\x00"
489
- }
490
-
491
- send_packet(from, data)
492
- end
180
+ def find_transfer(type, from, block)
181
+ self.transfers.each do |tr|
182
+ if (tr[:type] == type and tr[:from] == from and tr[:block] == block)
183
+ return tr
184
+ end
185
+ end
186
+ nil
187
+ end
188
+
189
+ def save_output(tr)
190
+ self.uploaded << tr[:file]
191
+
192
+ return incoming_file_hook.call(tr) if incoming_file_hook
193
+
194
+ if @output_dir
195
+ fn = tr[:file][:name].split(File::SEPARATOR)[-1]
196
+ if fn
197
+ fn = ::File.join(@output_dir, Rex::FileUtils.clean_path(fn))
198
+ ::File.open(fn, "wb") { |fd|
199
+ fd.write(tr[:file][:data])
200
+ }
201
+ end
202
+ end
203
+ end
204
+
205
+
206
+ def check_retransmission(tr)
207
+ elapsed = ::Time.now - tr[:last_sent]
208
+ if (elapsed >= tr[:timeout])
209
+ # max retries reached?
210
+ if (tr[:retries] < 3)
211
+ #if (tr[:type] == OpRead)
212
+ # puts "[-] ack timed out, resending block"
213
+ #else
214
+ # puts "[-] block timed out, resending ack"
215
+ #end
216
+ tr[:last_sent] = nil
217
+ tr[:retries] += 1
218
+ else
219
+ #puts "[-] maximum tries reached, terminating transfer"
220
+ self.transfers.delete(tr)
221
+ end
222
+ end
223
+ end
224
+
225
+
226
+ #
227
+ # See if there is anything to do.. If so, dispatch it.
228
+ #
229
+ def monitor_socket
230
+ while true
231
+ rds = [@sock]
232
+ wds = []
233
+ self.transfers.each do |tr|
234
+ if (not tr[:last_sent])
235
+ wds << @sock
236
+ break
237
+ end
238
+ end
239
+ eds = [@sock]
240
+
241
+ r,w,e = ::IO.select(rds,wds,eds,1)
242
+
243
+ if (r != nil and r[0] == self.sock)
244
+ buf,host,port = self.sock.recvfrom(65535)
245
+ # Lame compatabilitiy :-/
246
+ from = [host, port]
247
+ dispatch_request(from, buf)
248
+ end
249
+
250
+ #
251
+ # Check to see if transfers need maintenance
252
+ #
253
+ self.transfers.each do |tr|
254
+ # We handle RRQ and WRQ separately
255
+ #
256
+ if (tr[:type] == OpRead)
257
+ # Are we awaiting an ack?
258
+ if (tr[:last_sent])
259
+ check_retransmission(tr)
260
+ elsif (w != nil and w[0] == self.sock)
261
+ # No ack waiting, send next block..
262
+ chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
263
+ if (chunk and chunk.length >= 0)
264
+ pkt = [OpData, tr[:block]].pack('nn')
265
+ pkt << chunk
266
+
267
+ send_packet(tr[:from], pkt)
268
+ tr[:last_sent] = ::Time.now
269
+
270
+ # If the file is a one-serve, mark it as started
271
+ tr[:file][:started] = true if (tr[:file][:once])
272
+ else
273
+ # No more chunks.. transfer is most likely done.
274
+ # However, we can only delete it once the last chunk has been
275
+ # acked.
276
+ end
277
+ end
278
+ else
279
+ # Are we awaiting data?
280
+ if (tr[:last_sent])
281
+ check_retransmission(tr)
282
+ elsif (w != nil and w[0] == self.sock)
283
+ # Not waiting for data, send an ack..
284
+ #puts "[*] sending ack for block %d" % [tr[:block]]
285
+ pkt = [OpAck, tr[:block]].pack('nn')
286
+
287
+ send_packet(tr[:from], pkt)
288
+ tr[:last_sent] = ::Time.now
289
+
290
+ # If we had a 0-511 byte chunk, we're done.
291
+ if (tr[:last_size] and tr[:last_size] < tr[:blksize])
292
+ #puts "[*] Transfer complete, saving output"
293
+ save_output(tr)
294
+ self.transfers.delete(tr)
295
+ end
296
+ end
297
+ end
298
+ end
299
+ end
300
+ end
301
+
302
+
303
+ def next_block(tr)
304
+ tr[:block] += 1
305
+ tr[:last_sent] = nil
306
+ tr[:retries] = 0
307
+ end
308
+
309
+
310
+ #
311
+ # Dispatch a packet that we received
312
+ #
313
+ def dispatch_request(from, buf)
314
+
315
+ op = buf.unpack('n')[0]
316
+ buf.slice!(0,2)
317
+
318
+ #XXX: todo - create call backs for status
319
+ #start = "[*] TFTP - %s:%u - %s" % [from[0], from[1], OPCODES[op]]
320
+
321
+ case op
322
+ when OpRead
323
+ # Process RRQ packets
324
+ fn = TFTP::get_string(buf)
325
+ mode = TFTP::get_string(buf).downcase
326
+
327
+ #puts "%s %s %s" % [start, fn, mode]
328
+
329
+ if (not @shutting_down) and (file = self.find_file(fn))
330
+ if (file[:once] and file[:started])
331
+ send_error(from, ErrFileNotFound)
332
+ else
333
+ transfer = {
334
+ :type => OpRead,
335
+ :from => from,
336
+ :file => file,
337
+ :block => 1,
338
+ :blksize => 512,
339
+ :offset => 0,
340
+ :timeout => 3,
341
+ :last_sent => nil,
342
+ :retries => 0
343
+ }
344
+
345
+ process_options(from, buf, transfer)
346
+
347
+ self.transfers << transfer
348
+ end
349
+ else
350
+ #puts "[-] file not found!"
351
+ send_error(from, ErrFileNotFound)
352
+ end
353
+
354
+ when OpWrite
355
+ # Process WRQ packets
356
+ fn = TFTP::get_string(buf)
357
+ mode = TFTP::get_string(buf).downcase
358
+
359
+ #puts "%s %s %s" % [start, fn, mode]
360
+
361
+ if not @shutting_down
362
+ transfer = {
363
+ :type => OpWrite,
364
+ :from => from,
365
+ :file => { :name => fn, :data => '' },
366
+ :block => 0, # WRQ starts at 0
367
+ :blksize => 512,
368
+ :timeout => 3,
369
+ :last_sent => nil,
370
+ :retries => 0
371
+ }
372
+
373
+ process_options(from, buf, transfer)
374
+
375
+ self.transfers << transfer
376
+ else
377
+ send_error(from, ErrIllegalOperation)
378
+ end
379
+
380
+ when OpAck
381
+ # Process ACK packets
382
+ block = buf.unpack('n')[0]
383
+
384
+ #puts "%s %d" % [start, block]
385
+
386
+ tr = find_transfer(OpRead, from, block)
387
+ if not tr
388
+ # NOTE: some clients, such as pxelinux, send an ack for block 0.
389
+ # To deal with this, we simply ignore it as we start with block 1.
390
+ return if block == 0
391
+
392
+ # If we didn't find it, send an error.
393
+ send_error(from, ErrUnknownTransferId)
394
+ else
395
+ # acked! send the next block
396
+ tr[:offset] += tr[:blksize]
397
+ next_block(tr)
398
+
399
+ # If the transfer is finished, delete it
400
+ if (tr[:offset] > tr[:file][:data].length)
401
+ #puts "[*] Transfer complete"
402
+ self.transfers.delete(tr)
403
+
404
+ # if the file is a one-serve, delete it from the files array
405
+ if tr[:file][:once]
406
+ #puts "[*] Removed one-serve file: #{tr[:file][:name]}"
407
+ self.files.delete(tr[:file])
408
+ end
409
+ end
410
+ end
411
+
412
+ when OpData
413
+ # Process Data packets
414
+ block = buf.unpack('n')[0]
415
+ data = buf.slice(2, buf.length)
416
+
417
+ #puts "%s %d %d bytes" % [start, block, data.length]
418
+
419
+ tr = find_transfer(OpWrite, from, (block-1))
420
+ if not tr
421
+ # If we didn't find it, send an error.
422
+ send_error(from, ErrUnknownTransferId)
423
+ else
424
+ tr[:file][:data] << data
425
+ tr[:last_size] = data.length
426
+ next_block(tr)
427
+
428
+ # Similar to RRQ transfers, we cannot detect that the
429
+ # transfer finished here. We must do so after transmitting
430
+ # the final ACK.
431
+ end
432
+
433
+ else
434
+ # Other packets are unsupported
435
+ #puts start
436
+ send_error(from, ErrAccessViolation)
437
+
438
+ end
439
+ end
440
+
441
+ def process_options(from, buf, tr)
442
+ found = 0
443
+ to_ack = []
444
+ while buf.length >= 4
445
+ opt = TFTP::get_string(buf)
446
+ break if not opt
447
+ val = TFTP::get_string(buf)
448
+ break if not val
449
+
450
+ found += 1
451
+
452
+ # Is it one we support?
453
+ opt.downcase!
454
+
455
+ case opt
456
+ when "blksize"
457
+ val = val.to_i
458
+ if val > 0
459
+ tr[:blksize] = val
460
+ to_ack << [ opt, val.to_s ]
461
+ end
462
+
463
+ when "timeout"
464
+ val = val.to_i
465
+ if val >= 1 and val <= 255
466
+ tr[:timeout] = val
467
+ to_ack << [ opt, val.to_s ]
468
+ end
469
+
470
+ when "tsize"
471
+ if tr[:type] == OpRead
472
+ len = tr[:file][:data].length
473
+ else
474
+ val = val.to_i
475
+ len = val
476
+ end
477
+ to_ack << [ opt, len.to_s ]
478
+
479
+ end
480
+ end
481
+
482
+ return if to_ack.length < 1
483
+
484
+ # if we have anything to ack, do it
485
+ data = [OpOptAck].pack('n')
486
+ to_ack.each { |el|
487
+ data << el[0] << "\x00" << el[1] << "\x00"
488
+ }
489
+
490
+ send_packet(from, data)
491
+ end
493
492
 
494
493
  end
495
494