librex 0.0.68 → 0.0.70

data/lib/rex/parser/retina_xml.rb

@@ -5,106 +5,106 @@ module Parser
 # XXX - Retina XML does not include ANY service/port information export
 class RetinaXMLStreamParser
 
-	attr_accessor :on_found_host
+  attr_accessor :on_found_host
 
-	def initialize(on_found_host = nil)
-		reset_state
-		self.on_found_host = on_found_host if on_found_host
-	end
+  def initialize(on_found_host = nil)
+    reset_state
+    self.on_found_host = on_found_host if on_found_host
+  end
 
-	def reset_state
-		@state = :generic_state
-		@host  = { 'vulns' => [] }
-		reset_audit_state
-	end
-	
-	def reset_audit_state
-		@audit = { 'refs' => [] }
-	end
+  def reset_state
+    @state = :generic_state
+    @host  = { 'vulns' => [] }
+    reset_audit_state
+  end
 
-	def tag_start(name, attributes)
-		@state = "in_#{name.downcase}".intern
-	end
+  def reset_audit_state
+    @audit = { 'refs' => [] }
+  end
 
-	def text(str)
-		case @state
-		when :in_ip
-			@host["address"] = str
-		when :in_dnsname
-			@host["hostname"] = str.split(/\s+/).first
-		when :in_netbiosname
-			@host["netbios"] = str
-		when :in_mac
-			@host["mac"] = str
-		when :in_os
-			@host["os"] = str
-		when :in_rthid
-			@audit['refs'].push(['RETINA', str])
-		when :in_cve
-			str.split(",").each do |cve|
-				cve = cve.to_s.strip
-				next if cve.empty?
-				pre,val = cve.split('-', 2)
-				next if not val
-				next if pre != "CVE"
-				@audit['refs'].push( ['CVE', val] )
-			end
-		when :in_name
-			@audit['name'] = str
-		when :in_description
-			@audit['description'] = str
-		when :in_risk
-			@audit['risk'] = str
-		when :in_cce
-			@audit['cce'] = str
-		when :in_date
-			@audit['data'] = str
-		end
-	end
+  def tag_start(name, attributes)
+    @state = "in_#{name.downcase}".intern
+  end
 
-	def tag_end(name)
-		case name
-		when "host"
-			on_found_host.call(@host) if on_found_host
-			reset_state
-		when "audit"
-			@host['vulns'].push @audit
-			reset_audit_state
-		end
-	end
+  def text(str)
+    case @state
+    when :in_ip
+      @host["address"] = str
+    when :in_dnsname
+      @host["hostname"] = str.split(/\s+/).first
+    when :in_netbiosname
+      @host["netbios"] = str
+    when :in_mac
+      @host["mac"] = str
+    when :in_os
+      @host["os"] = str
+    when :in_rthid
+      @audit['refs'].push(['RETINA', str])
+    when :in_cve
+      str.split(",").each do |cve|
+        cve = cve.to_s.strip
+        next if cve.empty?
+        pre,val = cve.split('-', 2)
+        next if not val
+        next if pre != "CVE"
+        @audit['refs'].push( ['CVE', val] )
+      end
+    when :in_name
+      @audit['name'] = str
+    when :in_description
+      @audit['description'] = str
+    when :in_risk
+      @audit['risk'] = str
+    when :in_cce
+      @audit['cce'] = str
+    when :in_date
+      @audit['data'] = str
+    end
+  end
 
-	# We don't need these methods, but they're necessary to keep REXML happy
-	def xmldecl(version, encoding, standalone); end
-	def cdata; end
-	def comment(str); end
-	def instruction(name, instruction); end
-	def attlist; end
+  def tag_end(name)
+    case name
+    when "host"
+      on_found_host.call(@host) if on_found_host
+      reset_state
+    when "audit"
+      @host['vulns'].push @audit
+      reset_audit_state
+    end
+  end
+
+  # We don't need these methods, but they're necessary to keep REXML happy
+  def xmldecl(version, encoding, standalone); end
+  def cdata; end
+  def comment(str); end
+  def instruction(name, instruction); end
+  def attlist; end
 end
 end
 end
 
 __END__
 <scanJob>
-	<hosts>
-		<host>
-			<ip>10.2.79.98</ip>
-			<netBIOSName>bsmith-10156B07C</netBIOSName>
-			<dnsName>bsmith-10156b07c.core.testcorp.com  random.testcorp.com</dnsName>
-			<mac>00:02:29:0E:38:2B</mac>
-			<os>Windows Server 2003 (X64), Service Pack 2</os>
-			<audit>
-				<rthID>7851</rthID>
-				<cve>CVE-2009-0089,CVE-2009-0550,CVE-2009-0086</cve>
-				<cce>N/A</cce>
-				<name>Microsoft Windows HTTP Services Multiple Vulnerabilities (960803)</name>
-				<description>Microsoft Windows HTTP Services contains multiple vulnerabilities when handling ..</description>
-				<date>09/15/2010</date>
-				<risk>Low</risk>
-				<pciLevel>5 (Urgent)</pciLevel>
-				<cvssScore>10 [AV:N/AC:L/Au:N/C:C/I:C/A:C]</cvssScore>
-				<fixInformation>....</fixInformation>
-			</audit>
-		</host>
-	</hosts>
-</scanJob>		
+  <hosts>
+    <host>
+      <ip>10.2.79.98</ip>
+      <netBIOSName>bsmith-10156B07C</netBIOSName>
+      <dnsName>bsmith-10156b07c.core.testcorp.com  random.testcorp.com</dnsName>
+      <mac>00:02:29:0E:38:2B</mac>
+      <os>Windows Server 2003 (X64), Service Pack 2</os>
+      <audit>
+        <rthID>7851</rthID>
+        <cve>CVE-2009-0089,CVE-2009-0550,CVE-2009-0086</cve>
+        <cce>N/A</cce>
+        <name>Microsoft Windows HTTP Services Multiple Vulnerabilities (960803)</name>
+        <description>Microsoft Windows HTTP Services contains multiple vulnerabilities when handling ..</description>
+        <date>09/15/2010</date>
+        <risk>Low</risk>
+        <pciLevel>5 (Urgent)</pciLevel>
+        <cvssScore>10 [AV:N/AC:L/Au:N/C:C/I:C/A:C]</cvssScore>
+        <fixInformation>....</fixInformation>
+      </audit>
+    </host>
+  </hosts>
+</scanJob>
 

data/lib/rex/parser/unattend.rb

@@ -0,0 +1,171 @@
+# -*- coding: binary -*-
+
+module Rex
+module Parser
+
+# This is a parser for the Windows Unattended Answer File
+# format. It's used by modules/post/windows/gather/enum_unattend.rb
+# and uses REXML (as opposed to Nokogiri) for its XML parsing.
+# See: http://technet.microsoft.com/en-us/library/ff715801
+#      http://technet.microsoft.com/en-us/library/cc749415(v=ws.10).aspx
+# Samples: http://technet.microsoft.com/en-us/library/cc732280%28v=ws.10%29.aspx
+class Unattend
+  
+  require 'rex/text'
+
+  def self.parse(xml)
+    return [] if xml.nil?
+    results = []
+    unattend = xml.elements['unattend']
+    return [] if unattend.nil?
+    unattend.each_element do |settings|
+        next if settings.class != REXML::Element
+        settings.get_elements('component').each do |c|
+          next if c.class != REXML::Element
+          results << extract_useraccounts(c.elements['UserAccounts'])
+          results << extract_autologon(c.elements['AutoLogon'])
+          results << extract_deployment(c.elements['WindowsDeploymentServices'])
+          results << extract_domain_join(c.elements['Identification/Credentials'])
+        end
+      end
+    return results.flatten
+  end
+
+  #
+  # Extract sensitive data from Deployment Services.
+  # We can only seem to add one <Login> with Windows System Image Manager, so
+  # we'll only enum one.
+  #
+  def self.extract_deployment(deployment)
+    return [] if deployment.nil?
+    domain    = deployment.elements['Login/Credentials/Domain'].get_text.value rescue ''
+    username  = deployment.elements['Login/Credentials/Username'].get_text.value rescue ''
+    password  = deployment.elements['Login/Credentials/Password'].get_text.value rescue ''
+    plaintext = deployment.elements['Login/Credentials/Password/PlainText'].get_text.value rescue 'true'
+
+    if plaintext == 'false'
+      password = Rex::Text.decode_base64(password)
+      password = password.gsub(/#{Rex::Text.to_unicode('Password')}$/, '')
+    end
+
+    return {'type' => 'wds', 'domain' => domain, 'username' => username, 'password' => password }
+  end
+
+  #
+  # Extract sensitive data from 'Secure' Domain Join
+  #
+  def self.extract_domain_join(credentials)
+    return [] if credentials.nil?
+    domain    = credentials.elements['Domain'].get_text.value rescue ''
+    username  = credentials.elements['Username'].get_text.value rescue ''
+    password  = credentials.elements['Password'].get_text.value rescue ''
+
+    return {'type' => 'domain_join', 'domain' => domain, 'username' => username, 'password' => password }
+  end
+
+  #
+  # Extract sensitive data from AutoLogon
+  #
+  def self.extract_autologon(auto_logon)
+    return [] if auto_logon.nil?
+
+    domain    = auto_logon.elements['Domain'].get_text.value rescue ''
+    username  = auto_logon.elements['Username'].get_text.value rescue ''
+    password  = auto_logon.elements['Password/Value'].get_text.value rescue ''
+    plaintext = auto_logon.elements['Password/PlainText'].get_text.value rescue 'true'
+
+    if plaintext == 'false'
+      password = Rex::Text.decode_base64(password)
+      password = password.gsub(/#{Rex::Text.to_unicode('Password')}$/, '')
+    end
+
+    return {'type' => 'auto', 'domain' => domain, 'username' => username, 'password' => password }
+  end
+
+  #
+  # Extract sensitive data from UserAccounts
+  #
+  def self.extract_useraccounts(user_accounts)
+    return[] if user_accounts.nil?
+
+    results = []
+    account_types = ['AdministratorPassword', 'DomainAccounts', 'LocalAccounts']
+    account_types.each do |t|
+      element = user_accounts.elements[t]
+      next if element.nil?
+
+      case t
+      #
+      # Extract the password from AdministratorPasswords
+      #
+      when account_types[0]
+        password = element.elements['Value'].get_text.value rescue ''
+        plaintext = element.elements['PlainText'].get_text.value rescue 'true'
+
+        if plaintext == 'false'
+          password = Rex::Text.decode_base64(password)
+          password = password.gsub(/#{Rex::Text.to_unicode('AdministratorPassword')}$/, '')
+        end
+
+        unless password.empty?
+          results << {'type' => 'admin', 'username' => 'Administrator', 'password' => password}
+        end
+
+      #
+      # Extract the sensitive data from DomainAccounts.
+      # According to MSDN, unattend.xml doesn't seem to store passwords for domain accounts
+      #
+      when account_types[1]  #DomainAccounts
+        element.elements.each do |account_list|
+          name = account_list.elements['DomainAccount/Name'].get_text.value rescue ''
+          group = account_list.elements['DomainAccount/Group'].get_text.value rescue 'true'
+
+          results << {'type' => 'domain', 'username' => name, 'group' => group}
+        end
+      #
+      # Extract the username/password from LocalAccounts
+      #
+      when account_types[2]  #LocalAccounts
+        element.elements.each do |local|
+          password = local.elements['Password/Value'].get_text.value rescue ''
+          plaintext = local.elements['Password/PlainText'].get_text.value rescue 'true'
+
+          if plaintext == 'false'
+            password = Rex::Text.decode_base64(password)
+            password = password.gsub(/#{Rex::Text.to_unicode('Password')}$/, '')
+          end
+
+          username = local.elements['Name'].get_text.value rescue ''
+          results << {'type' => 'local', 'username' => username, 'password' => password}
+        end
+      end
+    end
+
+    return results
+  end
+
+  def self.create_table(results)
+    return nil if results.nil? or results.empty?
+    table = Rex::Ui::Text::Table.new({
+      'Header' => 'Unattend Credentials',
+      'Indent' => 1,
+      'Columns' => ['Type', 'Domain', 'Username', 'Password', 'Groups']
+    })
+
+    results.each do |result|
+      case result['type']
+        when 'wds', 'auto', 'domain_join'
+          table << [result['type'], result['domain'], result['username'], result['password'], ""]
+        when 'admin', 'local'
+          table << [result['type'], "", result['username'], result['password'], ""]
+        when 'domain'
+          table << [result['type'], "", result['username'], "", result['group']]
+      end
+    end
+
+    return table
+  end
+end
+end
+end
+

data/lib/rex/parser/wapiti_nokogiri.rb

@@ -2,104 +2,104 @@
 require "rex/parser/nokogiri_doc_mixin"
 
 module Rex
-	module Parser
+  module Parser
 
-	load_nokogiri && class WapitiDocument < Nokogiri::XML::SAX::Document
+  load_nokogiri && class WapitiDocument < Nokogiri::XML::SAX::Document
 
-		include NokogiriDocMixin
+    include NokogiriDocMixin
 
-		def start_element(name=nil,attrs=[])
-			attrs = normalize_attrs(attrs)
-			block = @block
-			@state[:current_tag][name] = true
+    def start_element(name=nil,attrs=[])
+      attrs = normalize_attrs(attrs)
+      block = @block
+      @state[:current_tag][name] = true
 
-			case name
-			when "timestamp"
-				@state[:has_text] = true
-			when "url"
-				@state[:has_text] = true
-			when "addr"
-				@state[:has_text] = true
-			when "port"
-				@state[:has_text] = true
-			when "parameter"
-				@state[:has_text] = true
-			when "info"
-				@state[:has_text] = true
-			when "description"
-				@state[:has_text] = true
-			when "solution"
-				@state[:has_text] = true
-			when "title"
-				@state[:has_text] = true
-			end
-		end
+      case name
+      when "timestamp"
+        @state[:has_text] = true
+      when "url"
+        @state[:has_text] = true
+      when "addr"
+        @state[:has_text] = true
+      when "port"
+        @state[:has_text] = true
+      when "parameter"
+        @state[:has_text] = true
+      when "info"
+        @state[:has_text] = true
+      when "description"
+        @state[:has_text] = true
+      when "solution"
+        @state[:has_text] = true
+      when "title"
+        @state[:has_text] = true
+      end
+    end
 
-		def end_element(name=nil)
-			block = @block
-			case name
-			when "timestamp"
-				@state[:timestamp] = @text.strip
-				@text = nil
-			when "url"
-				@state[:url] = @text.strip
-				@text = nil
-			when "addr"
-				@state[:host] = @text.strip
-				@text = nil
-			when "port"
-				@state[:port] = @text.strip
-				@text = nil
-			when "parameter"
-				@state[:parameter] = @text.strip
-				@text = nil
-			when "info"
-				@state[:info] = @text.strip
-				@text = nil
-			when "bug"
-				report_vuln
-			end
-		end
+    def end_element(name=nil)
+      block = @block
+      case name
+      when "timestamp"
+        @state[:timestamp] = @text.strip
+        @text = nil
+      when "url"
+        @state[:url] = @text.strip
+        @text = nil
+      when "addr"
+        @state[:host] = @text.strip
+        @text = nil
+      when "port"
+        @state[:port] = @text.strip
+        @text = nil
+      when "parameter"
+        @state[:parameter] = @text.strip
+        @text = nil
+      when "info"
+        @state[:info] = @text.strip
+        @text = nil
+      when "bug"
+        report_vuln
+      end
+    end
 
-		def report_vuln(&block)
-			proto = @state[:url].split(":")[0]
-			path = '/' + (@state[:url].split("/")[3..(@state[:url].split("/").length - 1)].join('/'))
-		
-			web_vuln_info = {}
-			web_vuln_info[:web_site] = proto + "://" + @state[:host] + ":" + @state[:port]
-			web_vuln_info[:path] = path
-			web_vuln_info[:query] = @state[:url].split("?")[1]
+    def report_vuln(&block)
+      proto = @state[:url].split(":")[0]
+      path = '/' + (@state[:url].split("/")[3..(@state[:url].split("/").length - 1)].join('/'))
 
-			#if the URL contains the parameter found to be vulnerable, it is probably a GET
-			#if it does not contains the parameter, it is probably a POST
-			if @state[:url].index(@state[:parameter])
-				web_vuln_info[:method] = "GET"
-			else
-				web_vuln_info[:method] = "POST"
-			end
+      web_vuln_info = {}
+      web_vuln_info[:web_site] = proto + "://" + @state[:host] + ":" + @state[:port]
+      web_vuln_info[:path] = path
+      web_vuln_info[:query] = @state[:url].split("?")[1]
 
-			@state[:parameter].split("&").each do |param|
-				if param.index("%27") #apostrophe
-					web_vuln_info[:pname] = param.split('=')[0] #sql injection
-					break
-				elsif param.index("alert")
-					web_vuln_info[:pname] = param.split('=')[0] #xss
-				end
-			end	
+      #if the URL contains the parameter found to be vulnerable, it is probably a GET
+      #if it does not contains the parameter, it is probably a POST
+      if @state[:url].index(@state[:parameter])
+        web_vuln_info[:method] = "GET"
+      else
+        web_vuln_info[:method] = "POST"
+      end
 
-			web_vuln_info[:host] = @state[:host]
-			web_vuln_info[:port] = @state[:port]
-			web_vuln_info[:ssl] = (proto =~ /https/)
-			web_vuln_info[:proof] = ""
-			web_vuln_info[:risk] = ""
-			web_vuln_info[:params] = @state[:parameter]
-			web_vuln_info[:category] = "imported"
-			web_vuln_info[:confidence] = 90
-			web_vuln_info[:name] = @state[:info]
+      @state[:parameter].split("&").each do |param|
+        if param.index("%27") #apostrophe
+          web_vuln_info[:pname] = param.split('=')[0] #sql injection
+          break
+        elsif param.index("alert")
+          web_vuln_info[:pname] = param.split('=')[0] #xss
+        end
+      end
 
-			db.emit(:web_vuln, web_vuln_info[:name], &block) if block
-			vuln = db_report(:web_vuln, web_vuln_info)
-		end
-	end
+      web_vuln_info[:host] = @state[:host]
+      web_vuln_info[:port] = @state[:port]
+      web_vuln_info[:ssl] = (proto =~ /https/)
+      web_vuln_info[:proof] = ""
+      web_vuln_info[:risk] = ""
+      web_vuln_info[:params] = @state[:parameter]
+      web_vuln_info[:category] = "imported"
+      web_vuln_info[:confidence] = 90
+      web_vuln_info[:name] = @state[:info]
+
+      db.emit(:web_vuln, web_vuln_info[:name], &block) if block
+      vuln = db_report(:web_vuln, web_vuln_info)
+    end
+  end
 end
 end