librex 0.0.68 → 0.0.70

Sign up to get free protection for your applications and to get access to all the features.
Files changed (528) hide show
  1. checksums.yaml +15 -0
  2. data/README.markdown +1 -1
  3. data/Rakefile +18 -16
  4. data/lib/rex.rb +14 -10
  5. data/lib/rex/LICENSE +2 -2
  6. data/lib/rex/arch.rb +76 -76
  7. data/lib/rex/arch/sparc.rb +57 -58
  8. data/lib/rex/arch/x86.rb +506 -496
  9. data/lib/rex/assembly/nasm.rb +83 -84
  10. data/lib/rex/compat.rb +228 -173
  11. data/lib/rex/constants.rb +47 -37
  12. data/lib/rex/elfparsey.rb +0 -3
  13. data/lib/rex/elfparsey/elf.rb +107 -110
  14. data/lib/rex/elfparsey/elfbase.rb +244 -247
  15. data/lib/rex/elfparsey/exceptions.rb +0 -3
  16. data/lib/rex/elfscan.rb +0 -3
  17. data/lib/rex/elfscan/scanner.rb +184 -166
  18. data/lib/rex/elfscan/search.rb +35 -38
  19. data/lib/rex/encoder/alpha2.rb +1 -2
  20. data/lib/rex/encoder/alpha2/alpha_mixed.rb +52 -53
  21. data/lib/rex/encoder/alpha2/alpha_upper.rb +62 -63
  22. data/lib/rex/encoder/alpha2/generic.rb +77 -78
  23. data/lib/rex/encoder/alpha2/unicode_mixed.rb +101 -97
  24. data/lib/rex/encoder/alpha2/unicode_upper.rb +106 -107
  25. data/lib/rex/encoder/bloxor/bloxor.rb +326 -0
  26. data/lib/rex/encoder/ndr.rb +68 -68
  27. data/lib/rex/encoder/nonalpha.rb +50 -51
  28. data/lib/rex/encoder/nonupper.rb +50 -51
  29. data/lib/rex/encoder/xdr.rb +78 -78
  30. data/lib/rex/encoder/xor.rb +52 -53
  31. data/lib/rex/encoder/xor/dword.rb +1 -2
  32. data/lib/rex/encoder/xor/dword_additive.rb +1 -2
  33. data/lib/rex/encoders/xor_dword.rb +17 -18
  34. data/lib/rex/encoders/xor_dword_additive.rb +35 -36
  35. data/lib/rex/encoding/xor.rb +0 -1
  36. data/lib/rex/encoding/xor/byte.rb +3 -4
  37. data/lib/rex/encoding/xor/dword.rb +3 -4
  38. data/lib/rex/encoding/xor/dword_additive.rb +72 -73
  39. data/lib/rex/encoding/xor/exceptions.rb +2 -3
  40. data/lib/rex/encoding/xor/generic.rb +129 -130
  41. data/lib/rex/encoding/xor/qword.rb +3 -4
  42. data/lib/rex/encoding/xor/word.rb +3 -4
  43. data/lib/rex/exceptions.rb +100 -101
  44. data/lib/rex/exploitation/cmdstager.rb +3 -3
  45. data/lib/rex/exploitation/cmdstager/base.rb +170 -156
  46. data/lib/rex/exploitation/cmdstager/bourne.rb +105 -0
  47. data/lib/rex/exploitation/cmdstager/debug_asm.rb +110 -113
  48. data/lib/rex/exploitation/cmdstager/debug_write.rb +106 -109
  49. data/lib/rex/exploitation/cmdstager/echo.rb +164 -0
  50. data/lib/rex/exploitation/cmdstager/printf.rb +122 -0
  51. data/lib/rex/exploitation/cmdstager/tftp.rb +34 -27
  52. data/lib/rex/exploitation/cmdstager/vbs.rb +95 -98
  53. data/lib/rex/exploitation/egghunter.rb +359 -346
  54. data/lib/rex/exploitation/encryptjs.rb +60 -60
  55. data/lib/rex/exploitation/heaplib.rb +76 -76
  56. data/lib/rex/exploitation/js.rb +6 -0
  57. data/lib/rex/exploitation/js/detect.rb +69 -0
  58. data/lib/rex/exploitation/js/memory.rb +81 -0
  59. data/lib/rex/exploitation/js/network.rb +84 -0
  60. data/lib/rex/exploitation/js/utils.rb +33 -0
  61. data/lib/rex/exploitation/jsobfu.rb +448 -424
  62. data/lib/rex/exploitation/obfuscatejs.rb +301 -301
  63. data/lib/rex/exploitation/omelet.rb +257 -257
  64. data/lib/rex/exploitation/opcodedb.rb +699 -699
  65. data/lib/rex/exploitation/ropdb.rb +189 -0
  66. data/lib/rex/exploitation/seh.rb +68 -68
  67. data/lib/rex/file.rb +96 -49
  68. data/lib/rex/image_source.rb +0 -3
  69. data/lib/rex/image_source/disk.rb +45 -48
  70. data/lib/rex/image_source/image_source.rb +33 -36
  71. data/lib/rex/image_source/memory.rb +17 -20
  72. data/lib/rex/io/bidirectional_pipe.rb +118 -115
  73. data/lib/rex/io/datagram_abstraction.rb +13 -14
  74. data/lib/rex/io/ring_buffer.rb +273 -273
  75. data/lib/rex/io/stream.rb +284 -284
  76. data/lib/rex/io/stream_abstraction.rb +183 -181
  77. data/lib/rex/io/stream_server.rb +193 -193
  78. data/lib/rex/job_container.rb +167 -167
  79. data/lib/rex/logging.rb +0 -1
  80. data/lib/rex/logging/log_dispatcher.rb +113 -113
  81. data/lib/rex/logging/log_sink.rb +17 -17
  82. data/lib/rex/logging/sinks/flatfile.rb +36 -36
  83. data/lib/rex/logging/sinks/stderr.rb +27 -27
  84. data/lib/rex/mac_oui.rb +16572 -16571
  85. data/lib/rex/machparsey.rb +0 -1
  86. data/lib/rex/machparsey/exceptions.rb +0 -1
  87. data/lib/rex/machparsey/mach.rb +160 -161
  88. data/lib/rex/machparsey/machbase.rb +367 -368
  89. data/lib/rex/machscan.rb +0 -1
  90. data/lib/rex/machscan/scanner.rb +175 -176
  91. data/lib/rex/mime/encoding.rb +17 -0
  92. data/lib/rex/mime/header.rb +58 -58
  93. data/lib/rex/mime/message.rb +140 -137
  94. data/lib/rex/mime/part.rb +41 -12
  95. data/lib/rex/nop/opty2.rb +90 -90
  96. data/lib/rex/nop/opty2_tables.rb +273 -273
  97. data/lib/rex/ole.rb +0 -4
  98. data/lib/rex/ole/clsid.rb +26 -30
  99. data/lib/rex/ole/difat.rb +121 -125
  100. data/lib/rex/ole/directory.rb +205 -209
  101. data/lib/rex/ole/direntry.rb +217 -221
  102. data/lib/rex/ole/fat.rb +79 -83
  103. data/lib/rex/ole/header.rb +178 -182
  104. data/lib/rex/ole/minifat.rb +49 -53
  105. data/lib/rex/ole/propset.rb +113 -117
  106. data/lib/rex/ole/samples/create_ole.rb +8 -9
  107. data/lib/rex/ole/samples/dir.rb +10 -11
  108. data/lib/rex/ole/samples/dump_stream.rb +14 -15
  109. data/lib/rex/ole/samples/ole_info.rb +5 -6
  110. data/lib/rex/ole/storage.rb +372 -376
  111. data/lib/rex/ole/stream.rb +33 -37
  112. data/lib/rex/ole/substorage.rb +20 -24
  113. data/lib/rex/ole/util.rb +137 -141
  114. data/lib/rex/parser/acunetix_nokogiri.rb +398 -398
  115. data/lib/rex/parser/apple_backup_manifestdb.rb +116 -116
  116. data/lib/rex/parser/appscan_nokogiri.rb +359 -359
  117. data/lib/rex/parser/arguments.rb +88 -88
  118. data/lib/rex/parser/burp_session_nokogiri.rb +258 -258
  119. data/lib/rex/parser/ci_nokogiri.rb +184 -184
  120. data/lib/rex/parser/foundstone_nokogiri.rb +334 -333
  121. data/lib/rex/parser/fusionvm_nokogiri.rb +94 -94
  122. data/lib/rex/parser/ini.rb +167 -167
  123. data/lib/rex/parser/ip360_aspl_xml.rb +84 -84
  124. data/lib/rex/parser/ip360_xml.rb +77 -77
  125. data/lib/rex/parser/mbsa_nokogiri.rb +224 -224
  126. data/lib/rex/parser/nessus_xml.rb +100 -100
  127. data/lib/rex/parser/netsparker_xml.rb +89 -75
  128. data/lib/rex/parser/nexpose_raw_nokogiri.rb +677 -677
  129. data/lib/rex/parser/nexpose_simple_nokogiri.rb +322 -322
  130. data/lib/rex/parser/nexpose_xml.rb +105 -105
  131. data/lib/rex/parser/nmap_nokogiri.rb +386 -386
  132. data/lib/rex/parser/nmap_xml.rb +116 -116
  133. data/lib/rex/parser/nokogiri_doc_mixin.rb +223 -221
  134. data/lib/rex/parser/openvas_nokogiri.rb +162 -162
  135. data/lib/rex/parser/outpost24_nokogiri.rb +239 -0
  136. data/lib/rex/parser/retina_xml.rb +90 -90
  137. data/lib/rex/parser/unattend.rb +171 -0
  138. data/lib/rex/parser/wapiti_nokogiri.rb +89 -89
  139. data/lib/rex/payloads/win32/common.rb +14 -14
  140. data/lib/rex/payloads/win32/kernel.rb +36 -36
  141. data/lib/rex/payloads/win32/kernel/common.rb +32 -32
  142. data/lib/rex/payloads/win32/kernel/recovery.rb +27 -27
  143. data/lib/rex/payloads/win32/kernel/stager.rb +170 -170
  144. data/lib/rex/peparsey.rb +0 -3
  145. data/lib/rex/peparsey/exceptions.rb +0 -3
  146. data/lib/rex/peparsey/pe.rb +196 -199
  147. data/lib/rex/peparsey/pe_memdump.rb +35 -38
  148. data/lib/rex/peparsey/pebase.rb +1633 -1652
  149. data/lib/rex/peparsey/section.rb +115 -124
  150. data/lib/rex/pescan.rb +0 -3
  151. data/lib/rex/pescan/analyze.rb +351 -351
  152. data/lib/rex/pescan/scanner.rb +182 -182
  153. data/lib/rex/pescan/search.rb +59 -59
  154. data/lib/rex/platforms/windows.rb +37 -37
  155. data/lib/rex/poly.rb +111 -110
  156. data/lib/rex/poly/block.rb +419 -417
  157. data/lib/rex/poly/machine.rb +12 -0
  158. data/lib/rex/poly/machine/machine.rb +829 -0
  159. data/lib/rex/poly/machine/x86.rb +508 -0
  160. data/lib/rex/poly/register.rb +70 -70
  161. data/lib/rex/poly/register/x86.rb +22 -22
  162. data/lib/rex/post.rb +0 -1
  163. data/lib/rex/post/dir.rb +35 -36
  164. data/lib/rex/post/file.rb +140 -141
  165. data/lib/rex/post/file_stat.rb +198 -199
  166. data/lib/rex/post/io.rb +167 -168
  167. data/lib/rex/post/meterpreter.rb +1 -1
  168. data/lib/rex/post/meterpreter/channel.rb +389 -390
  169. data/lib/rex/post/meterpreter/channel_container.rb +33 -34
  170. data/lib/rex/post/meterpreter/channels/pool.rb +129 -130
  171. data/lib/rex/post/meterpreter/channels/pools/file.rb +35 -36
  172. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +72 -73
  173. data/lib/rex/post/meterpreter/channels/stream.rb +62 -63
  174. data/lib/rex/post/meterpreter/client.rb +442 -436
  175. data/lib/rex/post/meterpreter/client_core.rb +326 -310
  176. data/lib/rex/post/meterpreter/dependencies.rb +0 -1
  177. data/lib/rex/post/meterpreter/extension.rb +12 -13
  178. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +35 -36
  179. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +71 -0
  180. data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb +169 -0
  181. data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +45 -0
  182. data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb +104 -0
  183. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +77 -0
  184. data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb +56 -0
  185. data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +75 -0
  186. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +70 -71
  187. data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb +361 -0
  188. data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb +76 -0
  189. data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb +78 -0
  190. data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb +22 -78
  191. data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb +49 -0
  192. data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb +4 -4
  193. data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb +128 -0
  194. data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb +16 -0
  195. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +38 -39
  196. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +1 -1
  197. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +95 -96
  198. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +39 -40
  199. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +80 -85
  200. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +94 -95
  201. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +207 -147
  202. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +258 -259
  203. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +366 -301
  204. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +72 -73
  205. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +24 -25
  206. data/lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb +59 -0
  207. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +227 -149
  208. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +107 -108
  209. data/lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb +97 -0
  210. data/lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb +106 -0
  211. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +41 -42
  212. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +102 -101
  213. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +151 -152
  214. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +142 -142
  215. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +185 -185
  216. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +38118 -38117
  217. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +7 -7
  218. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +2086 -2084
  219. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +15 -15
  220. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +80 -80
  221. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +3835 -3833
  222. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +84 -28
  223. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +151 -137
  224. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +15 -6
  225. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +3155 -3155
  226. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_version.rb +41 -0
  227. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +70 -70
  228. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb +128 -0
  229. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +596 -596
  230. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +310 -301
  231. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +71 -61
  232. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +100 -100
  233. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +14 -14
  234. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +488 -488
  235. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +273 -264
  236. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb +5 -5
  237. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +240 -238
  238. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +17 -15
  239. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb +61 -61
  240. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +654 -635
  241. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +49 -49
  242. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +103 -102
  243. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +98 -68
  244. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +165 -166
  245. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +16 -17
  246. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +34 -36
  247. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +363 -364
  248. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +102 -103
  249. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +28 -29
  250. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +303 -304
  251. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +113 -114
  252. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +260 -261
  253. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +165 -166
  254. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +69 -70
  255. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +160 -161
  256. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +143 -144
  257. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +29 -12
  258. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +230 -231
  259. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +181 -44
  260. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +12 -13
  261. data/lib/rex/post/meterpreter/object_aliases.rb +56 -57
  262. data/lib/rex/post/meterpreter/packet.rb +591 -592
  263. data/lib/rex/post/meterpreter/packet_dispatcher.rb +506 -496
  264. data/lib/rex/post/meterpreter/packet_parser.rb +72 -73
  265. data/lib/rex/post/meterpreter/packet_response_waiter.rb +56 -57
  266. data/lib/rex/post/meterpreter/ui/console.rb +112 -112
  267. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +53 -53
  268. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +911 -854
  269. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +86 -86
  270. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb +65 -0
  271. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +198 -0
  272. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb +444 -0
  273. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb +199 -0
  274. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb +118 -0
  275. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb +108 -0
  276. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +220 -220
  277. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb +509 -0
  278. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb +60 -0
  279. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +254 -0
  280. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb +159 -0
  281. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb +182 -0
  282. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +173 -173
  283. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +40 -40
  284. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +75 -77
  285. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +30 -30
  286. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +105 -105
  287. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +182 -182
  288. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +37 -37
  289. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +504 -482
  290. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +401 -330
  291. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +883 -581
  292. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +296 -299
  293. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +320 -153
  294. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +78 -78
  295. data/lib/rex/post/permission.rb +0 -1
  296. data/lib/rex/post/process.rb +39 -40
  297. data/lib/rex/post/thread.rb +41 -42
  298. data/lib/rex/post/ui.rb +35 -36
  299. data/lib/rex/proto/addp.rb +218 -0
  300. data/lib/rex/proto/dcerpc/client.rb +344 -344
  301. data/lib/rex/proto/dcerpc/exceptions.rb +128 -128
  302. data/lib/rex/proto/dcerpc/handle.rb +32 -32
  303. data/lib/rex/proto/dcerpc/ndr.rb +56 -56
  304. data/lib/rex/proto/dcerpc/packet.rb +249 -245
  305. data/lib/rex/proto/dcerpc/response.rb +170 -170
  306. data/lib/rex/proto/dcerpc/uuid.rb +65 -65
  307. data/lib/rex/proto/dcerpc/wdscp.rb +3 -0
  308. data/lib/rex/proto/dcerpc/wdscp/constants.rb +89 -0
  309. data/lib/rex/proto/dcerpc/wdscp/packet.rb +94 -0
  310. data/lib/rex/proto/dhcp.rb +0 -1
  311. data/lib/rex/proto/dhcp/constants.rb +0 -1
  312. data/lib/rex/proto/dhcp/server.rb +303 -304
  313. data/lib/rex/proto/drda/constants.rb +1 -1
  314. data/lib/rex/proto/drda/packet.rb +186 -186
  315. data/lib/rex/proto/drda/utils.rb +104 -104
  316. data/lib/rex/proto/http.rb +1 -0
  317. data/lib/rex/proto/http/client.rb +692 -820
  318. data/lib/rex/proto/http/client_request.rb +472 -0
  319. data/lib/rex/proto/http/handler.rb +25 -25
  320. data/lib/rex/proto/http/handler/erb.rb +104 -104
  321. data/lib/rex/proto/http/handler/proc.rb +37 -37
  322. data/lib/rex/proto/http/header.rb +149 -149
  323. data/lib/rex/proto/http/packet.rb +388 -382
  324. data/lib/rex/proto/http/request.rb +332 -335
  325. data/lib/rex/proto/http/response.rb +132 -72
  326. data/lib/rex/proto/http/server.rb +348 -338
  327. data/lib/rex/proto/iax2/call.rb +310 -310
  328. data/lib/rex/proto/iax2/client.rb +197 -197
  329. data/lib/rex/proto/iax2/codecs/alaw.rb +4 -4
  330. data/lib/rex/proto/iax2/codecs/mulaw.rb +4 -4
  331. data/lib/rex/proto/ipmi.rb +57 -0
  332. data/lib/rex/proto/ipmi/channel_auth_reply.rb +88 -0
  333. data/lib/rex/proto/ipmi/open_session_reply.rb +35 -0
  334. data/lib/rex/proto/ipmi/rakp2.rb +35 -0
  335. data/lib/rex/proto/ipmi/utils.rb +125 -0
  336. data/lib/rex/proto/natpmp.rb +1 -5
  337. data/lib/rex/proto/natpmp/constants.rb +4 -4
  338. data/lib/rex/proto/natpmp/packet.rb +25 -25
  339. data/lib/rex/proto/ntlm/base.rb +271 -271
  340. data/lib/rex/proto/ntlm/constants.rb +61 -61
  341. data/lib/rex/proto/ntlm/crypt.rb +348 -352
  342. data/lib/rex/proto/ntlm/exceptions.rb +3 -3
  343. data/lib/rex/proto/ntlm/message.rb +468 -471
  344. data/lib/rex/proto/ntlm/utils.rb +746 -746
  345. data/lib/rex/proto/pjl.rb +30 -0
  346. data/lib/rex/proto/pjl/client.rb +162 -0
  347. data/lib/rex/proto/proxy/socks4a.rb +440 -440
  348. data/lib/rex/proto/rfb.rb +1 -8
  349. data/lib/rex/proto/rfb/cipher.rb +46 -49
  350. data/lib/rex/proto/rfb/client.rb +179 -182
  351. data/lib/rex/proto/rfb/constants.rb +18 -21
  352. data/lib/rex/proto/smb/client.rb +1954 -1843
  353. data/lib/rex/proto/smb/constants.rb +533 -516
  354. data/lib/rex/proto/smb/crypt.rb +21 -21
  355. data/lib/rex/proto/smb/evasions.rb +43 -43
  356. data/lib/rex/proto/smb/exceptions.rb +791 -791
  357. data/lib/rex/proto/smb/simpleclient.rb +142 -286
  358. data/lib/rex/proto/smb/simpleclient/open_file.rb +106 -0
  359. data/lib/rex/proto/smb/simpleclient/open_pipe.rb +57 -0
  360. data/lib/rex/proto/smb/utils.rb +81 -81
  361. data/lib/rex/proto/sunrpc/client.rb +158 -158
  362. data/lib/rex/proto/tftp.rb +0 -1
  363. data/lib/rex/proto/tftp/client.rb +289 -289
  364. data/lib/rex/proto/tftp/constants.rb +9 -10
  365. data/lib/rex/proto/tftp/server.rb +466 -467
  366. data/lib/rex/random_identifier_generator.rb +176 -0
  367. data/lib/rex/registry.rb +1 -1
  368. data/lib/rex/registry/hive.rb +88 -88
  369. data/lib/rex/registry/lfkey.rb +25 -25
  370. data/lib/rex/registry/nodekey.rb +30 -30
  371. data/lib/rex/registry/regf.rb +10 -10
  372. data/lib/rex/registry/valuekey.rb +43 -43
  373. data/lib/rex/registry/valuelist.rb +13 -13
  374. data/lib/rex/ropbuilder/rop.rb +254 -253
  375. data/lib/rex/script.rb +21 -22
  376. data/lib/rex/script/base.rb +51 -50
  377. data/lib/rex/script/meterpreter.rb +2 -2
  378. data/lib/rex/service.rb +24 -24
  379. data/lib/rex/service_manager.rb +132 -132
  380. data/lib/rex/services/local_relay.rb +398 -398
  381. data/lib/rex/socket.rb +758 -763
  382. data/lib/rex/socket/comm.rb +95 -95
  383. data/lib/rex/socket/comm/local.rb +507 -440
  384. data/lib/rex/socket/ip.rb +118 -118
  385. data/lib/rex/socket/parameters.rb +351 -350
  386. data/lib/rex/socket/range_walker.rb +445 -368
  387. data/lib/rex/socket/ssl_tcp.rb +323 -317
  388. data/lib/rex/socket/ssl_tcp_server.rb +173 -158
  389. data/lib/rex/socket/subnet_walker.rb +48 -48
  390. data/lib/rex/socket/switch_board.rb +259 -259
  391. data/lib/rex/socket/tcp.rb +58 -56
  392. data/lib/rex/socket/tcp_server.rb +42 -42
  393. data/lib/rex/socket/udp.rb +152 -152
  394. data/lib/rex/sslscan/result.rb +200 -0
  395. data/lib/rex/sslscan/scanner.rb +205 -0
  396. data/lib/rex/struct2.rb +0 -1
  397. data/lib/rex/struct2/c_struct.rb +162 -163
  398. data/lib/rex/struct2/c_struct_template.rb +21 -22
  399. data/lib/rex/struct2/constant.rb +6 -7
  400. data/lib/rex/struct2/element.rb +30 -31
  401. data/lib/rex/struct2/generic.rb +60 -61
  402. data/lib/rex/struct2/restraint.rb +40 -41
  403. data/lib/rex/struct2/s_string.rb +60 -61
  404. data/lib/rex/struct2/s_struct.rb +97 -98
  405. data/lib/rex/sync.rb +0 -1
  406. data/lib/rex/sync/event.rb +62 -72
  407. data/lib/rex/sync/read_write_lock.rb +149 -149
  408. data/lib/rex/sync/ref.rb +42 -42
  409. data/lib/rex/sync/thread_safe.rb +59 -59
  410. data/lib/rex/text.rb +1803 -1315
  411. data/lib/rex/thread_factory.rb +25 -25
  412. data/lib/rex/time.rb +44 -44
  413. data/lib/rex/transformer.rb +91 -91
  414. data/lib/rex/ui/interactive.rb +265 -265
  415. data/lib/rex/ui/output.rb +66 -60
  416. data/lib/rex/ui/progress_tracker.rb +79 -79
  417. data/lib/rex/ui/subscriber.rb +144 -134
  418. data/lib/rex/ui/text/color.rb +76 -76
  419. data/lib/rex/ui/text/dispatcher_shell.rb +512 -505
  420. data/lib/rex/ui/text/input.rb +96 -96
  421. data/lib/rex/ui/text/input/buffer.rb +58 -58
  422. data/lib/rex/ui/text/input/readline.rb +114 -114
  423. data/lib/rex/ui/text/input/socket.rb +77 -77
  424. data/lib/rex/ui/text/input/stdio.rb +24 -24
  425. data/lib/rex/ui/text/irb_shell.rb +45 -41
  426. data/lib/rex/ui/text/output.rb +64 -60
  427. data/lib/rex/ui/text/output/buffer.rb +42 -42
  428. data/lib/rex/ui/text/output/buffer/stdout.rb +25 -0
  429. data/lib/rex/ui/text/output/file.rb +24 -24
  430. data/lib/rex/ui/text/output/socket.rb +24 -24
  431. data/lib/rex/ui/text/output/stdio.rb +29 -29
  432. data/lib/rex/ui/text/output/tee.rb +36 -36
  433. data/lib/rex/ui/text/progress_tracker.rb +37 -37
  434. data/lib/rex/ui/text/shell.rb +371 -361
  435. data/lib/rex/ui/text/table.rb +320 -284
  436. data/lib/rex/zip.rb +0 -1
  437. data/lib/rex/zip/archive.rb +115 -94
  438. data/lib/rex/zip/blocks.rb +101 -100
  439. data/lib/rex/zip/entry.rb +108 -99
  440. data/lib/rex/zip/jar.rb +261 -206
  441. data/lib/rex/zip/samples/comment.rb +1 -2
  442. data/lib/rex/zip/samples/mkwar.rb +12 -13
  443. data/lib/rex/zip/samples/mkzip.rb +1 -2
  444. data/lib/rex/zip/samples/recursive.rb +29 -30
  445. metadata +424 -446
  446. data/lib/rex/arch/sparc.rb.ut.rb +0 -19
  447. data/lib/rex/arch/x86.rb.ut.rb +0 -94
  448. data/lib/rex/assembly/nasm.rb.ut.rb +0 -23
  449. data/lib/rex/encoder/ndr.rb.ut.rb +0 -45
  450. data/lib/rex/encoder/xdr.rb.ut.rb +0 -30
  451. data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +0 -13
  452. data/lib/rex/encoding/xor.rb.ts.rb +0 -15
  453. data/lib/rex/encoding/xor/byte.rb.ut.rb +0 -22
  454. data/lib/rex/encoding/xor/dword.rb.ut.rb +0 -16
  455. data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +0 -16
  456. data/lib/rex/encoding/xor/generic.rb.ut.rb +0 -121
  457. data/lib/rex/encoding/xor/word.rb.ut.rb +0 -14
  458. data/lib/rex/exceptions.rb.ut.rb +0 -45
  459. data/lib/rex/exploitation/egghunter.rb.ut.rb +0 -28
  460. data/lib/rex/exploitation/javascriptosdetect.js +0 -1014
  461. data/lib/rex/exploitation/javascriptosdetect.rb +0 -43
  462. data/lib/rex/exploitation/omelet.rb.ut.rb +0 -27
  463. data/lib/rex/exploitation/opcodedb.rb.ut.rb +0 -280
  464. data/lib/rex/exploitation/seh.rb.ut.rb +0 -20
  465. data/lib/rex/file.rb.ut.rb +0 -17
  466. data/lib/rex/io/ring_buffer.rb.ut.rb +0 -135
  467. data/lib/rex/nop/opty2.rb.ut.rb +0 -24
  468. data/lib/rex/parser/arguments.rb.ut.rb +0 -68
  469. data/lib/rex/parser/ini.rb.ut.rb +0 -30
  470. data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +0 -18
  471. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb +0 -39
  472. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +0 -37
  473. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb +0 -52
  474. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +0 -43
  475. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +0 -128
  476. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb +0 -64
  477. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb.ut.rb +0 -29
  478. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb +0 -155
  479. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb.ut.rb +0 -128
  480. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +0 -124
  481. data/lib/rex/proto.rb.ts.rb +0 -9
  482. data/lib/rex/proto/dcerpc.rb.ts.rb +0 -10
  483. data/lib/rex/proto/dcerpc/client.rb.ut.rb +0 -492
  484. data/lib/rex/proto/dcerpc/handle.rb.ut.rb +0 -86
  485. data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +0 -42
  486. data/lib/rex/proto/dcerpc/packet.rb.ut.rb +0 -57
  487. data/lib/rex/proto/dcerpc/response.rb.ut.rb +0 -16
  488. data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +0 -47
  489. data/lib/rex/proto/drda.rb.ts.rb +0 -18
  490. data/lib/rex/proto/drda/constants.rb.ut.rb +0 -24
  491. data/lib/rex/proto/drda/packet.rb.ut.rb +0 -110
  492. data/lib/rex/proto/drda/utils.rb.ut.rb +0 -85
  493. data/lib/rex/proto/http.rb.ts.rb +0 -13
  494. data/lib/rex/proto/http/client.rb.ut.rb +0 -96
  495. data/lib/rex/proto/http/handler/erb.rb.ut.rb +0 -22
  496. data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +0 -1
  497. data/lib/rex/proto/http/handler/proc.rb.ut.rb +0 -25
  498. data/lib/rex/proto/http/header.rb.ut.rb +0 -47
  499. data/lib/rex/proto/http/packet.rb.ut.rb +0 -166
  500. data/lib/rex/proto/http/request.rb.ut.rb +0 -215
  501. data/lib/rex/proto/http/response.rb.ut.rb +0 -150
  502. data/lib/rex/proto/http/server.rb.ut.rb +0 -80
  503. data/lib/rex/proto/ntlm.rb.ut.rb +0 -181
  504. data/lib/rex/proto/rfb.rb.ut.rb +0 -40
  505. data/lib/rex/proto/smb.rb.ts.rb +0 -9
  506. data/lib/rex/proto/smb/client.rb.ut.rb +0 -224
  507. data/lib/rex/proto/smb/constants.rb.ut.rb +0 -19
  508. data/lib/rex/proto/smb/simpleclient.rb.ut.rb +0 -129
  509. data/lib/rex/proto/smb/utils.rb.ut.rb +0 -21
  510. data/lib/rex/proto/tftp/server.rb.ut.rb +0 -29
  511. data/lib/rex/service_manager.rb.ut.rb +0 -33
  512. data/lib/rex/socket.rb.ut.rb +0 -108
  513. data/lib/rex/socket/comm/local.rb.ut.rb +0 -76
  514. data/lib/rex/socket/parameters.rb.ut.rb +0 -52
  515. data/lib/rex/socket/range_walker.rb.ut.rb +0 -56
  516. data/lib/rex/socket/ssl_tcp.rb.ut.rb +0 -40
  517. data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +0 -62
  518. data/lib/rex/socket/subnet_walker.rb.ut.rb +0 -29
  519. data/lib/rex/socket/switch_board.rb.ut.rb +0 -53
  520. data/lib/rex/socket/tcp.rb.ut.rb +0 -65
  521. data/lib/rex/socket/tcp_server.rb.ut.rb +0 -45
  522. data/lib/rex/socket/udp.rb.ut.rb +0 -45
  523. data/lib/rex/test.rb +0 -36
  524. data/lib/rex/text.rb.ut.rb +0 -193
  525. data/lib/rex/transformer.rb.ut.rb +0 -39
  526. data/lib/rex/ui/text/color.rb.ut.rb +0 -19
  527. data/lib/rex/ui/text/progress_tracker.rb.ut.rb +0 -35
  528. data/lib/rex/ui/text/table.rb.ut.rb +0 -56
@@ -1,5 +1,4 @@
1
1
  # -*- coding: binary -*-
2
- # $Id: constants.rb 15548 2012-06-29 06:08:20Z rapid7 $
3
2
  require 'rex/proto/tftp'
4
3
 
5
4
  module Rex
@@ -15,15 +14,15 @@ OpError = 5
15
14
  OpOptAck = 6
16
15
 
17
16
  ERRCODES = [
18
- "Undefined",
19
- "File not found",
20
- "Access violation",
21
- "Disk full or allocation exceeded",
22
- "Illegal TFTP operation",
23
- "Unknown transfer ID",
24
- "File already exists",
25
- "No such user",
26
- "Failed option negotiation"
17
+ "Undefined",
18
+ "File not found",
19
+ "Access violation",
20
+ "Disk full or allocation exceeded",
21
+ "Illegal TFTP operation",
22
+ "Unknown transfer ID",
23
+ "File already exists",
24
+ "No such user",
25
+ "Failed option negotiation"
27
26
  ]
28
27
 
29
28
  ErrFileNotFound = 1
@@ -1,5 +1,4 @@
1
1
  # -*- coding: binary -*-
2
- # $Id: server.rb 15548 2012-06-29 06:08:20Z rapid7 $
3
2
  require 'rex/socket'
4
3
  require 'rex/proto/tftp'
5
4
 
@@ -11,12 +10,12 @@ module TFTP
11
10
  # Little util function
12
11
  #
13
12
  def self.get_string(data)
14
- idx = data.index("\x00")
15
- return nil if not idx
16
- ret = data.slice!(0, idx)
17
- # Slice off the nul byte.
18
- data.slice!(0,1)
19
- ret
13
+ idx = data.index("\x00")
14
+ return nil if not idx
15
+ ret = data.slice!(0, idx)
16
+ # Slice off the nul byte.
17
+ data.slice!(0,1)
18
+ ret
20
19
  end
21
20
 
22
21
 
@@ -27,469 +26,469 @@ end
27
26
  ##
28
27
  class Server
29
28
 
30
- def initialize(port = 69, listen_host = '0.0.0.0', context = {})
31
- self.listen_host = listen_host
32
- self.listen_port = port
33
- self.context = context
34
- self.sock = nil
35
- @shutting_down = false
36
- @output_dir = nil
37
- @tftproot = nil
38
-
39
- self.files = []
40
- self.uploaded = []
41
- self.transfers = []
42
- end
43
-
44
-
45
- #
46
- # Start the TFTP server
47
- #
48
- def start
49
- self.sock = Rex::Socket::Udp.create(
50
- 'LocalHost' => listen_host,
51
- 'LocalPort' => listen_port,
52
- 'Context' => context
53
- )
54
-
55
- self.thread = Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
56
- monitor_socket
57
- }
58
- end
59
-
60
-
61
- #
62
- # Stop the TFTP server
63
- #
64
- def stop
65
- @shutting_down = true
66
-
67
- # Wait a maximum of 30 seconds for all transfers to finish.
68
- start = ::Time.now
69
- while (self.transfers.length > 0)
70
- ::IO.select(nil, nil, nil, 0.5)
71
- dur = ::Time.now - start
72
- break if (dur > 30)
73
- end
74
-
75
- self.files.clear
76
- self.thread.kill
77
- self.sock.close rescue nil # might be closed already
78
- end
79
-
80
-
81
- #
82
- # Register a filename and content for a client to request
83
- #
84
- def register_file(fn, content, once = false)
85
- self.files << {
86
- :name => fn,
87
- :data => content,
88
- :once => once
89
- }
90
- end
91
-
92
-
93
- #
94
- # Register an entire directory to serve files from
95
- #
96
- def set_tftproot(rootdir)
97
- @tftproot = rootdir if ::File.directory?(rootdir)
98
- end
99
-
100
-
101
- #
102
- # Register a directory to write uploaded files to
103
- #
104
- def set_output_dir(outdir)
105
- @output_dir = outdir if ::File.directory?(outdir)
106
- end
107
-
108
-
109
- #
110
- # Send an error packet w/the specified code and string
111
- #
112
- def send_error(from, num)
113
- if (num < 1 or num >= ERRCODES.length)
114
- # ignore..
115
- return
116
- end
117
- pkt = [OpError, num].pack('nn')
118
- pkt << ERRCODES[num]
119
- pkt << "\x00"
120
- send_packet(from, pkt)
121
- end
122
-
123
-
124
- #
125
- # Send a single packet to the specified host
126
- #
127
- def send_packet(from, pkt)
128
- self.sock.sendto(pkt, from[0], from[1])
129
- end
130
-
131
-
132
- #
133
- # Find the hash entry for a file that may be offered
134
- #
135
- def find_file(fname)
136
- # Files served via register_file() take precedence.
137
- self.files.each do |f|
138
- if (fname == f[:name])
139
- return f
140
- end
141
- end
142
-
143
- # Now, if we have a tftproot, see if it can serve from it
144
- if @tftproot
145
- return find_file_in_root(fname)
146
- end
147
-
148
- nil
149
- end
150
-
151
-
152
- #
153
- # Find the file in the specified tftp root and add a temporary
154
- # entry to the files hash.
155
- #
156
- def find_file_in_root(fname)
157
- fn = ::File.expand_path(::File.join(@tftproot, fname))
158
-
159
- # Don't allow directory traversal
160
- return nil if fn.index(@tftproot) != 0
161
-
162
- return nil if not ::File.file?(fn) or not ::File.readable?(fn)
163
-
164
- # Read the file contents, and register it as being served once
165
- data = data = ::File.open(fn, "rb") { |fd| fd.read(fd.stat.size) }
166
- register_file(fname, data)
167
-
168
- # Return the last file in the array
169
- return self.files[-1]
170
- end
171
-
172
-
173
- attr_accessor :listen_host, :listen_port, :context
174
- attr_accessor :sock, :files, :transfers, :uploaded
175
- attr_accessor :thread
176
-
177
- attr_accessor :incoming_file_hook
29
+ def initialize(port = 69, listen_host = '0.0.0.0', context = {})
30
+ self.listen_host = listen_host
31
+ self.listen_port = port
32
+ self.context = context
33
+ self.sock = nil
34
+ @shutting_down = false
35
+ @output_dir = nil
36
+ @tftproot = nil
37
+
38
+ self.files = []
39
+ self.uploaded = []
40
+ self.transfers = []
41
+ end
42
+
43
+
44
+ #
45
+ # Start the TFTP server
46
+ #
47
+ def start
48
+ self.sock = Rex::Socket::Udp.create(
49
+ 'LocalHost' => listen_host,
50
+ 'LocalPort' => listen_port,
51
+ 'Context' => context
52
+ )
53
+
54
+ self.thread = Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
55
+ monitor_socket
56
+ }
57
+ end
58
+
59
+
60
+ #
61
+ # Stop the TFTP server
62
+ #
63
+ def stop
64
+ @shutting_down = true
65
+
66
+ # Wait a maximum of 30 seconds for all transfers to finish.
67
+ start = ::Time.now
68
+ while (self.transfers.length > 0)
69
+ ::IO.select(nil, nil, nil, 0.5)
70
+ dur = ::Time.now - start
71
+ break if (dur > 30)
72
+ end
73
+
74
+ self.files.clear
75
+ self.thread.kill
76
+ self.sock.close rescue nil # might be closed already
77
+ end
78
+
79
+
80
+ #
81
+ # Register a filename and content for a client to request
82
+ #
83
+ def register_file(fn, content, once = false)
84
+ self.files << {
85
+ :name => fn,
86
+ :data => content,
87
+ :once => once
88
+ }
89
+ end
90
+
91
+
92
+ #
93
+ # Register an entire directory to serve files from
94
+ #
95
+ def set_tftproot(rootdir)
96
+ @tftproot = rootdir if ::File.directory?(rootdir)
97
+ end
98
+
99
+
100
+ #
101
+ # Register a directory to write uploaded files to
102
+ #
103
+ def set_output_dir(outdir)
104
+ @output_dir = outdir if ::File.directory?(outdir)
105
+ end
106
+
107
+
108
+ #
109
+ # Send an error packet w/the specified code and string
110
+ #
111
+ def send_error(from, num)
112
+ if (num < 1 or num >= ERRCODES.length)
113
+ # ignore..
114
+ return
115
+ end
116
+ pkt = [OpError, num].pack('nn')
117
+ pkt << ERRCODES[num]
118
+ pkt << "\x00"
119
+ send_packet(from, pkt)
120
+ end
121
+
122
+
123
+ #
124
+ # Send a single packet to the specified host
125
+ #
126
+ def send_packet(from, pkt)
127
+ self.sock.sendto(pkt, from[0], from[1])
128
+ end
129
+
130
+
131
+ #
132
+ # Find the hash entry for a file that may be offered
133
+ #
134
+ def find_file(fname)
135
+ # Files served via register_file() take precedence.
136
+ self.files.each do |f|
137
+ if (fname == f[:name])
138
+ return f
139
+ end
140
+ end
141
+
142
+ # Now, if we have a tftproot, see if it can serve from it
143
+ if @tftproot
144
+ return find_file_in_root(fname)
145
+ end
146
+
147
+ nil
148
+ end
149
+
150
+
151
+ #
152
+ # Find the file in the specified tftp root and add a temporary
153
+ # entry to the files hash.
154
+ #
155
+ def find_file_in_root(fname)
156
+ fn = ::File.expand_path(::File.join(@tftproot, fname))
157
+
158
+ # Don't allow directory traversal
159
+ return nil if fn.index(@tftproot) != 0
160
+
161
+ return nil if not ::File.file?(fn) or not ::File.readable?(fn)
162
+
163
+ # Read the file contents, and register it as being served once
164
+ data = data = ::File.open(fn, "rb") { |fd| fd.read(fd.stat.size) }
165
+ register_file(fname, data)
166
+
167
+ # Return the last file in the array
168
+ return self.files[-1]
169
+ end
170
+
171
+
172
+ attr_accessor :listen_host, :listen_port, :context
173
+ attr_accessor :sock, :files, :transfers, :uploaded
174
+ attr_accessor :thread
175
+
176
+ attr_accessor :incoming_file_hook
178
177
 
179
178
  protected
180
179
 
181
- def find_transfer(type, from, block)
182
- self.transfers.each do |tr|
183
- if (tr[:type] == type and tr[:from] == from and tr[:block] == block)
184
- return tr
185
- end
186
- end
187
- nil
188
- end
189
-
190
- def save_output(tr)
191
- self.uploaded << tr[:file]
192
-
193
- return incoming_file_hook.call(tr) if incoming_file_hook
194
-
195
- if @output_dir
196
- fn = tr[:file][:name].split(File::SEPARATOR)[-1]
197
- if fn
198
- fn = ::File.join(@output_dir, Rex::FileUtils.clean_path(fn))
199
- ::File.open(fn, "wb") { |fd|
200
- fd.write(tr[:file][:data])
201
- }
202
- end
203
- end
204
- end
205
-
206
-
207
- def check_retransmission(tr)
208
- elapsed = ::Time.now - tr[:last_sent]
209
- if (elapsed >= tr[:timeout])
210
- # max retries reached?
211
- if (tr[:retries] < 3)
212
- #if (tr[:type] == OpRead)
213
- # puts "[-] ack timed out, resending block"
214
- #else
215
- # puts "[-] block timed out, resending ack"
216
- #end
217
- tr[:last_sent] = nil
218
- tr[:retries] += 1
219
- else
220
- #puts "[-] maximum tries reached, terminating transfer"
221
- self.transfers.delete(tr)
222
- end
223
- end
224
- end
225
-
226
-
227
- #
228
- # See if there is anything to do.. If so, dispatch it.
229
- #
230
- def monitor_socket
231
- while true
232
- rds = [@sock]
233
- wds = []
234
- self.transfers.each do |tr|
235
- if (not tr[:last_sent])
236
- wds << @sock
237
- break
238
- end
239
- end
240
- eds = [@sock]
241
-
242
- r,w,e = ::IO.select(rds,wds,eds,1)
243
-
244
- if (r != nil and r[0] == self.sock)
245
- buf,host,port = self.sock.recvfrom(65535)
246
- # Lame compatabilitiy :-/
247
- from = [host, port]
248
- dispatch_request(from, buf)
249
- end
250
-
251
- #
252
- # Check to see if transfers need maintenance
253
- #
254
- self.transfers.each do |tr|
255
- # We handle RRQ and WRQ separately
256
- #
257
- if (tr[:type] == OpRead)
258
- # Are we awaiting an ack?
259
- if (tr[:last_sent])
260
- check_retransmission(tr)
261
- elsif (w != nil and w[0] == self.sock)
262
- # No ack waiting, send next block..
263
- chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
264
- if (chunk and chunk.length >= 0)
265
- pkt = [OpData, tr[:block]].pack('nn')
266
- pkt << chunk
267
-
268
- send_packet(tr[:from], pkt)
269
- tr[:last_sent] = ::Time.now
270
-
271
- # If the file is a one-serve, mark it as started
272
- tr[:file][:started] = true if (tr[:file][:once])
273
- else
274
- # No more chunks.. transfer is most likely done.
275
- # However, we can only delete it once the last chunk has been
276
- # acked.
277
- end
278
- end
279
- else
280
- # Are we awaiting data?
281
- if (tr[:last_sent])
282
- check_retransmission(tr)
283
- elsif (w != nil and w[0] == self.sock)
284
- # Not waiting for data, send an ack..
285
- #puts "[*] sending ack for block %d" % [tr[:block]]
286
- pkt = [OpAck, tr[:block]].pack('nn')
287
-
288
- send_packet(tr[:from], pkt)
289
- tr[:last_sent] = ::Time.now
290
-
291
- # If we had a 0-511 byte chunk, we're done.
292
- if (tr[:last_size] and tr[:last_size] < tr[:blksize])
293
- #puts "[*] Transfer complete, saving output"
294
- save_output(tr)
295
- self.transfers.delete(tr)
296
- end
297
- end
298
- end
299
- end
300
- end
301
- end
302
-
303
-
304
- def next_block(tr)
305
- tr[:block] += 1
306
- tr[:last_sent] = nil
307
- tr[:retries] = 0
308
- end
309
-
310
-
311
- #
312
- # Dispatch a packet that we received
313
- #
314
- def dispatch_request(from, buf)
315
-
316
- op = buf.unpack('n')[0]
317
- buf.slice!(0,2)
318
-
319
- #XXX: todo - create call backs for status
320
- #start = "[*] TFTP - %s:%u - %s" % [from[0], from[1], OPCODES[op]]
321
-
322
- case op
323
- when OpRead
324
- # Process RRQ packets
325
- fn = TFTP::get_string(buf)
326
- mode = TFTP::get_string(buf).downcase
327
-
328
- #puts "%s %s %s" % [start, fn, mode]
329
-
330
- if (not @shutting_down) and (file = self.find_file(fn))
331
- if (file[:once] and file[:started])
332
- send_error(from, ErrFileNotFound)
333
- else
334
- transfer = {
335
- :type => OpRead,
336
- :from => from,
337
- :file => file,
338
- :block => 1,
339
- :blksize => 512,
340
- :offset => 0,
341
- :timeout => 3,
342
- :last_sent => nil,
343
- :retries => 0
344
- }
345
-
346
- process_options(from, buf, transfer)
347
-
348
- self.transfers << transfer
349
- end
350
- else
351
- #puts "[-] file not found!"
352
- send_error(from, ErrFileNotFound)
353
- end
354
-
355
- when OpWrite
356
- # Process WRQ packets
357
- fn = TFTP::get_string(buf)
358
- mode = TFTP::get_string(buf).downcase
359
-
360
- #puts "%s %s %s" % [start, fn, mode]
361
-
362
- if not @shutting_down
363
- transfer = {
364
- :type => OpWrite,
365
- :from => from,
366
- :file => { :name => fn, :data => '' },
367
- :block => 0, # WRQ starts at 0
368
- :blksize => 512,
369
- :timeout => 3,
370
- :last_sent => nil,
371
- :retries => 0
372
- }
373
-
374
- process_options(from, buf, transfer)
375
-
376
- self.transfers << transfer
377
- else
378
- send_error(from, ErrIllegalOperation)
379
- end
380
-
381
- when OpAck
382
- # Process ACK packets
383
- block = buf.unpack('n')[0]
384
-
385
- #puts "%s %d" % [start, block]
386
-
387
- tr = find_transfer(OpRead, from, block)
388
- if not tr
389
- # NOTE: some clients, such as pxelinux, send an ack for block 0.
390
- # To deal with this, we simply ignore it as we start with block 1.
391
- return if block == 0
392
-
393
- # If we didn't find it, send an error.
394
- send_error(from, ErrUnknownTransferId)
395
- else
396
- # acked! send the next block
397
- tr[:offset] += tr[:blksize]
398
- next_block(tr)
399
-
400
- # If the transfer is finished, delete it
401
- if (tr[:offset] > tr[:file][:data].length)
402
- #puts "[*] Transfer complete"
403
- self.transfers.delete(tr)
404
-
405
- # if the file is a one-serve, delete it from the files array
406
- if tr[:file][:once]
407
- #puts "[*] Removed one-serve file: #{tr[:file][:name]}"
408
- self.files.delete(tr[:file])
409
- end
410
- end
411
- end
412
-
413
- when OpData
414
- # Process Data packets
415
- block = buf.unpack('n')[0]
416
- data = buf.slice(2, buf.length)
417
-
418
- #puts "%s %d %d bytes" % [start, block, data.length]
419
-
420
- tr = find_transfer(OpWrite, from, (block-1))
421
- if not tr
422
- # If we didn't find it, send an error.
423
- send_error(from, ErrUnknownTransferId)
424
- else
425
- tr[:file][:data] << data
426
- tr[:last_size] = data.length
427
- next_block(tr)
428
-
429
- # Similar to RRQ transfers, we cannot detect that the
430
- # transfer finished here. We must do so after transmitting
431
- # the final ACK.
432
- end
433
-
434
- else
435
- # Other packets are unsupported
436
- #puts start
437
- send_error(from, ErrAccessViolation)
438
-
439
- end
440
- end
441
-
442
- def process_options(from, buf, tr)
443
- found = 0
444
- to_ack = []
445
- while buf.length >= 4
446
- opt = TFTP::get_string(buf)
447
- break if not opt
448
- val = TFTP::get_string(buf)
449
- break if not val
450
-
451
- found += 1
452
-
453
- # Is it one we support?
454
- opt.downcase!
455
-
456
- case opt
457
- when "blksize"
458
- val = val.to_i
459
- if val > 0
460
- tr[:blksize] = val
461
- to_ack << [ opt, val.to_s ]
462
- end
463
-
464
- when "timeout"
465
- val = val.to_i
466
- if val >= 1 and val <= 255
467
- tr[:timeout] = val
468
- to_ack << [ opt, val.to_s ]
469
- end
470
-
471
- when "tsize"
472
- if tr[:type] == OpRead
473
- len = tr[:file][:data].length
474
- else
475
- val = val.to_i
476
- len = val
477
- end
478
- to_ack << [ opt, len.to_s ]
479
-
480
- end
481
- end
482
-
483
- return if to_ack.length < 1
484
-
485
- # if we have anything to ack, do it
486
- data = [OpOptAck].pack('n')
487
- to_ack.each { |el|
488
- data << el[0] << "\x00" << el[1] << "\x00"
489
- }
490
-
491
- send_packet(from, data)
492
- end
180
+ def find_transfer(type, from, block)
181
+ self.transfers.each do |tr|
182
+ if (tr[:type] == type and tr[:from] == from and tr[:block] == block)
183
+ return tr
184
+ end
185
+ end
186
+ nil
187
+ end
188
+
189
+ def save_output(tr)
190
+ self.uploaded << tr[:file]
191
+
192
+ return incoming_file_hook.call(tr) if incoming_file_hook
193
+
194
+ if @output_dir
195
+ fn = tr[:file][:name].split(File::SEPARATOR)[-1]
196
+ if fn
197
+ fn = ::File.join(@output_dir, Rex::FileUtils.clean_path(fn))
198
+ ::File.open(fn, "wb") { |fd|
199
+ fd.write(tr[:file][:data])
200
+ }
201
+ end
202
+ end
203
+ end
204
+
205
+
206
+ def check_retransmission(tr)
207
+ elapsed = ::Time.now - tr[:last_sent]
208
+ if (elapsed >= tr[:timeout])
209
+ # max retries reached?
210
+ if (tr[:retries] < 3)
211
+ #if (tr[:type] == OpRead)
212
+ # puts "[-] ack timed out, resending block"
213
+ #else
214
+ # puts "[-] block timed out, resending ack"
215
+ #end
216
+ tr[:last_sent] = nil
217
+ tr[:retries] += 1
218
+ else
219
+ #puts "[-] maximum tries reached, terminating transfer"
220
+ self.transfers.delete(tr)
221
+ end
222
+ end
223
+ end
224
+
225
+
226
+ #
227
+ # See if there is anything to do.. If so, dispatch it.
228
+ #
229
+ def monitor_socket
230
+ while true
231
+ rds = [@sock]
232
+ wds = []
233
+ self.transfers.each do |tr|
234
+ if (not tr[:last_sent])
235
+ wds << @sock
236
+ break
237
+ end
238
+ end
239
+ eds = [@sock]
240
+
241
+ r,w,e = ::IO.select(rds,wds,eds,1)
242
+
243
+ if (r != nil and r[0] == self.sock)
244
+ buf,host,port = self.sock.recvfrom(65535)
245
+ # Lame compatabilitiy :-/
246
+ from = [host, port]
247
+ dispatch_request(from, buf)
248
+ end
249
+
250
+ #
251
+ # Check to see if transfers need maintenance
252
+ #
253
+ self.transfers.each do |tr|
254
+ # We handle RRQ and WRQ separately
255
+ #
256
+ if (tr[:type] == OpRead)
257
+ # Are we awaiting an ack?
258
+ if (tr[:last_sent])
259
+ check_retransmission(tr)
260
+ elsif (w != nil and w[0] == self.sock)
261
+ # No ack waiting, send next block..
262
+ chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
263
+ if (chunk and chunk.length >= 0)
264
+ pkt = [OpData, tr[:block]].pack('nn')
265
+ pkt << chunk
266
+
267
+ send_packet(tr[:from], pkt)
268
+ tr[:last_sent] = ::Time.now
269
+
270
+ # If the file is a one-serve, mark it as started
271
+ tr[:file][:started] = true if (tr[:file][:once])
272
+ else
273
+ # No more chunks.. transfer is most likely done.
274
+ # However, we can only delete it once the last chunk has been
275
+ # acked.
276
+ end
277
+ end
278
+ else
279
+ # Are we awaiting data?
280
+ if (tr[:last_sent])
281
+ check_retransmission(tr)
282
+ elsif (w != nil and w[0] == self.sock)
283
+ # Not waiting for data, send an ack..
284
+ #puts "[*] sending ack for block %d" % [tr[:block]]
285
+ pkt = [OpAck, tr[:block]].pack('nn')
286
+
287
+ send_packet(tr[:from], pkt)
288
+ tr[:last_sent] = ::Time.now
289
+
290
+ # If we had a 0-511 byte chunk, we're done.
291
+ if (tr[:last_size] and tr[:last_size] < tr[:blksize])
292
+ #puts "[*] Transfer complete, saving output"
293
+ save_output(tr)
294
+ self.transfers.delete(tr)
295
+ end
296
+ end
297
+ end
298
+ end
299
+ end
300
+ end
301
+
302
+
303
+ def next_block(tr)
304
+ tr[:block] += 1
305
+ tr[:last_sent] = nil
306
+ tr[:retries] = 0
307
+ end
308
+
309
+
310
+ #
311
+ # Dispatch a packet that we received
312
+ #
313
+ def dispatch_request(from, buf)
314
+
315
+ op = buf.unpack('n')[0]
316
+ buf.slice!(0,2)
317
+
318
+ #XXX: todo - create call backs for status
319
+ #start = "[*] TFTP - %s:%u - %s" % [from[0], from[1], OPCODES[op]]
320
+
321
+ case op
322
+ when OpRead
323
+ # Process RRQ packets
324
+ fn = TFTP::get_string(buf)
325
+ mode = TFTP::get_string(buf).downcase
326
+
327
+ #puts "%s %s %s" % [start, fn, mode]
328
+
329
+ if (not @shutting_down) and (file = self.find_file(fn))
330
+ if (file[:once] and file[:started])
331
+ send_error(from, ErrFileNotFound)
332
+ else
333
+ transfer = {
334
+ :type => OpRead,
335
+ :from => from,
336
+ :file => file,
337
+ :block => 1,
338
+ :blksize => 512,
339
+ :offset => 0,
340
+ :timeout => 3,
341
+ :last_sent => nil,
342
+ :retries => 0
343
+ }
344
+
345
+ process_options(from, buf, transfer)
346
+
347
+ self.transfers << transfer
348
+ end
349
+ else
350
+ #puts "[-] file not found!"
351
+ send_error(from, ErrFileNotFound)
352
+ end
353
+
354
+ when OpWrite
355
+ # Process WRQ packets
356
+ fn = TFTP::get_string(buf)
357
+ mode = TFTP::get_string(buf).downcase
358
+
359
+ #puts "%s %s %s" % [start, fn, mode]
360
+
361
+ if not @shutting_down
362
+ transfer = {
363
+ :type => OpWrite,
364
+ :from => from,
365
+ :file => { :name => fn, :data => '' },
366
+ :block => 0, # WRQ starts at 0
367
+ :blksize => 512,
368
+ :timeout => 3,
369
+ :last_sent => nil,
370
+ :retries => 0
371
+ }
372
+
373
+ process_options(from, buf, transfer)
374
+
375
+ self.transfers << transfer
376
+ else
377
+ send_error(from, ErrIllegalOperation)
378
+ end
379
+
380
+ when OpAck
381
+ # Process ACK packets
382
+ block = buf.unpack('n')[0]
383
+
384
+ #puts "%s %d" % [start, block]
385
+
386
+ tr = find_transfer(OpRead, from, block)
387
+ if not tr
388
+ # NOTE: some clients, such as pxelinux, send an ack for block 0.
389
+ # To deal with this, we simply ignore it as we start with block 1.
390
+ return if block == 0
391
+
392
+ # If we didn't find it, send an error.
393
+ send_error(from, ErrUnknownTransferId)
394
+ else
395
+ # acked! send the next block
396
+ tr[:offset] += tr[:blksize]
397
+ next_block(tr)
398
+
399
+ # If the transfer is finished, delete it
400
+ if (tr[:offset] > tr[:file][:data].length)
401
+ #puts "[*] Transfer complete"
402
+ self.transfers.delete(tr)
403
+
404
+ # if the file is a one-serve, delete it from the files array
405
+ if tr[:file][:once]
406
+ #puts "[*] Removed one-serve file: #{tr[:file][:name]}"
407
+ self.files.delete(tr[:file])
408
+ end
409
+ end
410
+ end
411
+
412
+ when OpData
413
+ # Process Data packets
414
+ block = buf.unpack('n')[0]
415
+ data = buf.slice(2, buf.length)
416
+
417
+ #puts "%s %d %d bytes" % [start, block, data.length]
418
+
419
+ tr = find_transfer(OpWrite, from, (block-1))
420
+ if not tr
421
+ # If we didn't find it, send an error.
422
+ send_error(from, ErrUnknownTransferId)
423
+ else
424
+ tr[:file][:data] << data
425
+ tr[:last_size] = data.length
426
+ next_block(tr)
427
+
428
+ # Similar to RRQ transfers, we cannot detect that the
429
+ # transfer finished here. We must do so after transmitting
430
+ # the final ACK.
431
+ end
432
+
433
+ else
434
+ # Other packets are unsupported
435
+ #puts start
436
+ send_error(from, ErrAccessViolation)
437
+
438
+ end
439
+ end
440
+
441
+ def process_options(from, buf, tr)
442
+ found = 0
443
+ to_ack = []
444
+ while buf.length >= 4
445
+ opt = TFTP::get_string(buf)
446
+ break if not opt
447
+ val = TFTP::get_string(buf)
448
+ break if not val
449
+
450
+ found += 1
451
+
452
+ # Is it one we support?
453
+ opt.downcase!
454
+
455
+ case opt
456
+ when "blksize"
457
+ val = val.to_i
458
+ if val > 0
459
+ tr[:blksize] = val
460
+ to_ack << [ opt, val.to_s ]
461
+ end
462
+
463
+ when "timeout"
464
+ val = val.to_i
465
+ if val >= 1 and val <= 255
466
+ tr[:timeout] = val
467
+ to_ack << [ opt, val.to_s ]
468
+ end
469
+
470
+ when "tsize"
471
+ if tr[:type] == OpRead
472
+ len = tr[:file][:data].length
473
+ else
474
+ val = val.to_i
475
+ len = val
476
+ end
477
+ to_ack << [ opt, len.to_s ]
478
+
479
+ end
480
+ end
481
+
482
+ return if to_ack.length < 1
483
+
484
+ # if we have anything to ack, do it
485
+ data = [OpOptAck].pack('n')
486
+ to_ack.each { |el|
487
+ data << el[0] << "\x00" << el[1] << "\x00"
488
+ }
489
+
490
+ send_packet(from, data)
491
+ end
493
492
 
494
493
  end
495
494