metasploit_data_models 0.7.0-java

data/app/models/mdm/user.rb

@@ -0,0 +1,25 @@
+class Mdm::User < ActiveRecord::Base
+  extend MetasploitDataModels::SerializedPrefs
+
+  #
+  # Relations
+  #
+
+  has_many :owned_workspaces, :foreign_key => 'owner_id', :class_name => 'Mdm::Workspace'
+  has_many :tags, :class_name => 'Mdm::Tag'
+  has_and_belongs_to_many :workspaces, :join_table => 'workspace_members', :uniq => true, :class_name => 'Mdm::Workspace'
+
+  #
+  # Serialziations
+  #
+
+  serialize :prefs, MetasploitDataModels::Base64Serializer.new
+
+  serialized_prefs_attr_accessor :nexpose_host, :nexpose_port, :nexpose_user, :nexpose_pass, :nexpose_creds_type, :nexpose_creds_user, :nexpose_creds_pass
+  serialized_prefs_attr_accessor :http_proxy_host, :http_proxy_port, :http_proxy_user, :http_proxy_pass
+  serialized_prefs_attr_accessor :time_zone, :session_key
+  serialized_prefs_attr_accessor :last_login_address # specifically NOT last_login_ip to prevent confusion with AuthLogic magic columns (which dont work for serialized fields)
+
+  ActiveSupport.run_load_hooks(:mdm_user, self)
+end
+

data/app/models/mdm/vuln.rb

@@ -0,0 +1,60 @@
+class Mdm::Vuln < ActiveRecord::Base
+  #
+  # Callbacks
+  #
+
+  after_update :save_refs
+
+  #
+  # Relations
+  #
+
+  belongs_to :host, :class_name => 'Mdm::Host', :counter_cache => :vuln_count
+  belongs_to :service, :class_name => 'Mdm::Service', :foreign_key => :service_id
+  has_many :vuln_attempts,  :dependent => :destroy, :class_name => 'Mdm::VulnAttempt'
+  has_many :vuln_details,  :dependent => :destroy, :class_name => 'Mdm::VulnDetail'
+  has_many :vulns_refs, :class_name => 'Mdm::VulnRef'
+
+  #
+  # Through :vuln_refs
+  #
+  has_many :refs, :through => :vulns_refs, :class_name => 'Mdm::Ref'
+
+  #
+  # Scopes
+  #
+
+  scope :search, lambda { |*args|
+    where(
+        [
+            '(vulns.name ILIKE ? or vulns.info ILIKE ? or refs.name ILIKE ?)',
+            "%#{args[0]}%",
+            "%#{args[0]}%",
+            "%#{args[0]}%"
+        ]
+    ).joins(
+        'LEFT OUTER JOIN vulns_refs ON vulns_refs.vuln_id=vulns.id LEFT OUTER JOIN refs ON refs.id=vulns_refs.ref_id'
+    )
+  }
+
+  #
+  # Validations
+  #
+
+  validates :name, :presence => true
+  validates_associated :refs
+
+  private
+
+  def before_destroy
+    Mdm::VulnRef.delete_all('vuln_id = ?', self.id)
+    Mdm::VulnDetail.delete_all('vuln_id = ?', self.id)
+    Mdm::VulnAttempt.delete_all('vuln_id = ?', self.id)
+  end
+
+  def save_refs
+    refs.each { |ref| ref.save(:validate => false) }
+  end
+
+  ActiveSupport.run_load_hooks(:mdm_vuln, self)
+end

data/app/models/mdm/vuln_attempt.rb

@@ -0,0 +1,15 @@
+class Mdm::VulnAttempt < ActiveRecord::Base
+  #
+  # Relations
+  #
+
+  belongs_to :vuln, :class_name => 'Mdm::Vuln', :counter_cache => :vuln_attempt_count
+
+  #
+  # Validations
+  #
+
+  validates :vuln_id, :presence => true
+
+  ActiveSupport.run_load_hooks(:mdm_vuln_attempt, self)
+end

data/app/models/mdm/vuln_detail.rb

@@ -0,0 +1,14 @@
+class Mdm::VulnDetail < ActiveRecord::Base
+  #
+  # Relations
+  #
+  belongs_to :vuln, :class_name => 'Mdm::Vuln', :counter_cache => :vuln_detail_count
+
+  #
+  # Validations
+  #
+
+  validates :vuln_id, :presence => true
+
+  ActiveSupport.run_load_hooks(:mdm_vuln_detail, self)
+end

data/app/models/mdm/vuln_ref.rb

@@ -0,0 +1,13 @@
+class Mdm::VulnRef < ActiveRecord::Base
+  self.table_name = 'vulns_refs'
+
+  #
+  # Relations
+  #
+
+  belongs_to :ref, :class_name => 'Mdm::Ref'
+  belongs_to :vuln, :class_name => 'Mdm::Vuln'
+
+  ActiveSupport.run_load_hooks(:mdm_vuln_ref, self)
+end
+

data/app/models/mdm/web_form.rb

@@ -0,0 +1,16 @@
+class Mdm::WebForm < ActiveRecord::Base
+  #
+  # Relations
+  #
+
+  belongs_to :web_site, :class_name => 'Mdm::WebSite'
+
+  #
+  # Serializations
+  #
+
+  serialize :params, MetasploitDataModels::Base64Serializer.new
+
+  ActiveSupport.run_load_hooks(:mdm_web_form, self)
+end
+

data/app/models/mdm/web_page.rb

@@ -0,0 +1,16 @@
+class Mdm::WebPage < ActiveRecord::Base
+  #
+  # Relations
+  #
+
+  belongs_to :web_site, :class_name => 'Mdm::WebSite'
+
+  #
+  # Serializations
+  #
+
+  serialize :headers, MetasploitDataModels::Base64Serializer.new
+
+  ActiveSupport.run_load_hooks(:mdm_web_page, self)
+end
+

data/app/models/mdm/web_site.rb

@@ -0,0 +1,47 @@
+class Mdm::WebSite < ActiveRecord::Base
+  #
+  # Relations
+  #
+
+  belongs_to :service, :class_name => 'Mdm::Service', :foreign_key => 'service_id'
+  has_many :web_forms, :dependent => :destroy, :class_name => 'Mdm::WebForm'
+  has_many :web_pages, :dependent => :destroy, :class_name => 'Mdm::WebPage'
+  has_many :web_vulns, :dependent => :destroy, :class_name => 'Mdm::WebVuln'
+
+  #
+  # Serializations
+  #
+
+  serialize :options, ::MetasploitDataModels::Base64Serializer.new
+
+  def form_count
+    web_forms.size
+  end
+
+  def page_count
+    web_pages.size
+  end
+
+  def to_url(ignore_vhost=false)
+    proto = self.service.name == "https" ? "https" : "http"
+    host = ignore_vhost ? self.service.host.address : self.vhost
+    port = self.service.port
+
+    if Rex::Socket.is_ipv6?(host)
+      host = "[#{host}]"
+    end
+
+    url = "#{proto}://#{host}"
+    if not ((proto == "http" and port == 80) or (proto == "https" and port == 443))
+      url += ":#{port}"
+    end
+    url
+  end
+
+  def vuln_count
+    web_vulns.size
+  end
+
+  ActiveSupport.run_load_hooks(:mdm_web_site, self)
+end
+

data/app/models/mdm/web_vuln.rb

@@ -0,0 +1,190 @@
+# A Web Vulnerability found during a web scan or web audit.
+#
+# If you need to modify Mdm::WebVuln you can use ActiveSupport.on_load(:mdm_web_vuln) inside an initializer so that
+# your patches are reloaded on each request in development mode for your Rails application.
+#
+# @example extending Mdm::WebVuln
+#   # config/initializers/mdm_web_vuln.rb
+#   ActiveSupport.on_load(:mdm_web_vuln) do
+#     def confidence_percentage
+#       "#{confidence}%"
+#     end
+#   end
+class Mdm::WebVuln < ActiveRecord::Base
+  #
+  # CONSTANTS
+  #
+
+  # A percentage {#confidence} that the vulnerability is real and not a false positive.
+  CONFIDENCE_RANGE = 0 .. 100
+
+  # Default value for {#params}
+  DEFAULT_PARAMS = []
+
+  # Allowed {#method methods}.
+  METHODS = [
+      'GET',
+      # XXX I don't know why PATH is a valid method when it's not an HTTP Method/Verb
+      'PATH',
+      'POST'
+  ]
+
+  # {#risk Risk} is rated on a scale from 0 (least risky) to 5 (most risky).
+  RISK_RANGE = 0 .. 5
+
+  #
+  # Associations
+  #
+
+  belongs_to :web_site, :class_name => 'Mdm::WebSite'
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] blame
+  #   Who to blame for the vulnerability
+  #
+  #   @return [String]
+
+  # @!attribute [rw] category
+  #   Category of this vulnerability.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] confidence
+  #   Percentage confidence scanner or auditor has that this vulnerability is not a false positive
+  #
+  #   @return [Integer] 1% to 100%
+
+  # @!attribute [rw] description
+  #   Description of the vulnerability
+  #
+  #   @return [String, nil]
+
+  # @!attribute [rw] method
+  #   HTTP Methods for request that found vulnerability.  'PATH' is also allowed even though it is not an HTTP Method.
+  #
+  #   @return [String]
+  #   @see METHODS
+
+  # @!attribute [rw] name
+  #   Name of the vulnerability
+  #
+  #   @return [String]
+
+  # @!attribute [rw] path
+  #   Path portion of URL
+  #
+  #   @return [String]
+
+  # @!attribute [rw] payload
+  #   Web audit payload that gets executed by the remote server.  Used for code injection vulnerabilities.
+  #
+  #   @return [String, nil]
+
+  # @!attribute [rw] pname
+  #   Name of parameter that demonstrates vulnerability
+  #
+  #   @return [String]
+
+  # @!attribute [rw] proof
+  #   String that proves vulnerability, such as a code snippet, etc.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] query
+  #   The GET query.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] request
+  #
+  #   @return [String]
+
+  # @!attribute [rw] risk
+  #   {RISK_RANGE Risk} of leaving this vulnerability unpatched.
+  #
+  #   @return [Integer]
+
+  #
+  # Validations
+  #
+
+  validates :category, :presence => true
+  validates :confidence,
+            :inclusion => {
+                :in => CONFIDENCE_RANGE
+            }
+  validates :method,
+            :inclusion => {
+                :in => METHODS
+            }
+  validates :name, :presence => true
+  validates :path, :presence => true
+  validates :pname, :presence => true
+  validates :proof, :presence => true
+  validates :risk,
+            :inclusion => {
+                :in => RISK_RANGE
+            }
+  validates :web_site, :presence => true
+
+  #
+  # Serializations
+  #
+
+  # @!attribute [rw] params
+  #   Parameters sent as part of request
+  #
+  #   @return [Array<Array<(String, String)>>] Array of parameter key value pairs
+  serialize :params, MetasploitDataModels::Base64Serializer.new(:default => DEFAULT_PARAMS)
+
+  #
+  # Methods
+  #
+
+  # Parameters sent as part of request.
+  #
+  # @return [Array<Array<(String, String)>>]
+  def params
+    normalize_params(
+        read_attribute(:params)
+    )
+  end
+
+  # Set parameters sent as part of request.
+  #
+  # @param params [Array<Array<(String, String)>>, nil] Array of parameter key value pairs
+  # @return [void]
+  def params=(params)
+    write_attribute(
+        :params,
+        normalize_params(params)
+    )
+  end
+
+  private
+
+  # Creates a duplicate of {DEFAULT_PARAMS} that is safe to modify.
+  #
+  # @return [Array] an empty array
+  def default_params
+    DEFAULT_PARAMS.dup
+  end
+
+  # Returns either the given params or {DEFAULT_PARAMS} if params is `nil`
+  #
+  # @param [Array<Array<(String, String)>>, nil] params
+  # @return [Array<<Array<(String, String)>>] params if not `nil`
+  # @return [nil] if params is `nil`
+  def normalize_params(params)
+    params || default_params
+  end
+
+  # switch back to public for load hooks
+  public
+
+  ActiveSupport.run_load_hooks(:mdm_web_vuln, self)
+end
+

data/app/models/mdm/wmap_request.rb

@@ -0,0 +1,3 @@
+class Mdm::WmapRequest < ActiveRecord::Base
+  ActiveSupport.run_load_hooks(:mdm_wmap_request, self)
+end

data/app/models/mdm/wmap_target.rb

@@ -0,0 +1,3 @@
+class Mdm::WmapTarget < ActiveRecord::Base
+  ActiveSupport.run_load_hooks(:mdm_wmap_target, self)
+end

data/app/models/mdm/workspace.rb

@@ -0,0 +1,196 @@
+class Mdm::Workspace < ActiveRecord::Base
+  #
+  # Callbacks
+  #
+
+  before_save :normalize
+
+  #
+  # CONSTANTS
+  #
+
+  DEFAULT = 'default'
+
+  #
+  # Relations
+  #
+
+  has_many :creds, :through => :services, :class_name => 'Mdm::Cred'
+  has_many :events, :class_name => 'Mdm::Event'
+  has_many :hosts, :dependent => :destroy, :class_name => 'Mdm::Host'
+  has_many :imported_creds, :dependent => :destroy, :class_name => 'Mdm::ImportedCred'
+  has_many :listeners, :dependent => :destroy, :class_name => 'Mdm::Listener'
+  has_many :notes, :class_name => 'Mdm::Note'
+  belongs_to :owner, :class_name => 'Mdm::User', :foreign_key => 'owner_id'
+  has_many :report_templates, :dependent => :destroy, :class_name => 'Mdm::ReportTemplate'
+  has_many :reports, :dependent => :destroy, :class_name => 'Mdm::Report'
+  has_many :tasks, :dependent => :destroy, :class_name => 'Mdm::Task', :order => 'created_at DESC'
+  has_and_belongs_to_many :users, :join_table => 'workspace_members', :uniq => true, :class_name => 'Mdm::User'
+
+  #
+  # Through :hosts
+  #
+  has_many :clients, :through => :hosts, :class_name => 'Mdm::Client'
+  has_many :exploited_hosts, :through => :hosts, :class_name => 'Mdm::ExploitedHost'
+  has_many :loots, :through => :hosts, :class_name => 'Mdm::Loot'
+  has_many :vulns, :through => :hosts, :class_name => 'Mdm::Vuln'
+  has_many :services, :through => :hosts, :class_name => 'Mdm::Service', :foreign_key => 'service_id'
+  has_many :sessions, :through => :hosts, :class_name => 'Mdm::Session'
+
+  #
+  # Validations
+  #
+
+  validates :name, :presence => true, :uniqueness => true, :length => {:maximum => 255}
+  validates :description, :length => {:maximum => 4096}
+  validate :boundary_must_be_ip_range
+
+  #
+  # If limit_to_network is disabled, this will always return true.
+  # Otherwise, return true only if all of the given IPs are within the project
+  # boundaries.
+  #
+  def allow_actions_on?(ips)
+    return true unless limit_to_network
+    return true unless boundary
+    return true if boundary.empty?
+    boundaries = Shellwords.split(boundary)
+    return true if boundaries.empty? # It's okay if there is no boundary range after all
+    given_range = Rex::Socket::RangeWalker.new(ips)
+    return false unless given_range # Can't do things to nonexistant IPs
+    allowed = false
+    boundaries.each do |boundary_range|
+      ok_range = Rex::Socket::RangeWalker.new(boundary)
+      allowed = true if ok_range.include_range? given_range
+    end
+    return allowed
+  end
+
+  def boundary_must_be_ip_range
+    errors.add(:boundary, "must be a valid IP range") unless valid_ip_or_range?(boundary)
+  end
+
+  def creds
+    Mdm::Cred.find(
+        :all,
+        :include => {:service => :host},
+        :conditions => ["hosts.workspace_id = ?", self.id]
+    )
+  end
+
+  def self.default
+    find_or_create_by_name(DEFAULT)
+  end
+
+  def default?
+    name == DEFAULT
+  end
+
+  #
+  # This method iterates the creds table calling the supplied block with the
+  # cred instance of each entry.
+  #
+  def each_cred(&block)
+    creds.each do |cred|
+      block.call(cred)
+    end
+  end
+
+  def each_host_tag(&block)
+    host_tags.each do |host_tag|
+      block.call(host_tag)
+    end
+  end
+
+  def host_tags
+    Mdm::Tag.find(
+        :all,
+        :include => :hosts,
+        :conditions => ["hosts.workspace_id = ?", self.id]
+    )
+  end
+
+  def web_forms
+    query = <<-EOQ
+          SELECT DISTINCT web_forms.*
+          FROM hosts, services, web_sites, web_forms
+          WHERE hosts.workspace_id = #{id} AND
+            services.host_id = hosts.id AND
+            web_sites.service_id = services.id AND
+            web_forms.web_site_id = web_sites.id
+    EOQ
+    Mdm::WebForm.find_by_sql(query)
+  end
+
+  def web_pages
+    query = <<-EOQ
+          SELECT DISTINCT web_pages.*
+            FROM hosts, services, web_sites, web_pages
+            WHERE hosts.workspace_id = #{id} AND
+            services.host_id = hosts.id AND
+            web_sites.service_id = services.id AND
+            web_pages.web_site_id = web_sites.id
+    EOQ
+    Mdm::WebPage.find_by_sql(query)
+  end
+
+  def web_sites
+    query = <<-EOQ
+          SELECT DISTINCT web_sites.*
+            FROM hosts, services, web_sites
+            WHERE hosts.workspace_id = #{id} AND
+            services.host_id = hosts.id AND
+            web_sites.service_id = services.id
+    EOQ
+    Mdm::WebSite.find_by_sql(query)
+  end
+
+  def web_vulns
+    query = <<-EOQ
+          SELECT DISTINCT web_vulns.*
+          FROM hosts, services, web_sites, web_vulns
+            WHERE hosts.workspace_id = #{id} AND
+            services.host_id = hosts.id AND
+            web_sites.service_id = services.id AND
+            web_vulns.web_site_id = web_sites.id
+    EOQ
+    Mdm::WebVuln.find_by_sql(query)
+  end
+
+  def unique_web_forms
+    query = <<-EOQ
+          SELECT DISTINCT web_forms.web_site_id, web_forms.path, web_forms.method, web_forms.query  
+            FROM hosts, services, web_sites, web_forms  
+            WHERE hosts.workspace_id = #{id} AND        
+            services.host_id = hosts.id AND         
+            web_sites.service_id = services.id AND  
+            web_forms.web_site_id = web_sites.id
+    EOQ
+    Mdm::WebForm.find_by_sql(query)
+  end
+
+  def web_unique_forms(addrs=nil)
+    forms = unique_web_forms
+    if addrs
+      forms.reject!{|f| not addrs.include?( f.web_site.service.host.address ) }
+    end
+    forms
+  end
+
+  private
+
+  def normalize
+    boundary.strip! if boundary
+  end
+
+  def valid_ip_or_range?(string)
+    begin
+      Rex::Socket::RangeWalker.new(string)
+    rescue
+      return false
+    end
+  end
+
+  ActiveSupport.run_load_hooks(:mdm_workspace, self)
+end
+