metasploit_data_models 2.0.11 → 2.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d804588ca2b3cf19ee1562d3c57e4cf5aef85868
-  data.tar.gz: d75b48caa5ccec93901f13f722349c046898a79d
+  metadata.gz: 90ffe84c79eb486db5b44a939b2280eceb90c30e
+  data.tar.gz: 14715f51541a688945983570a22ee547facb1e43
 SHA512:
-  metadata.gz: f540c5f9f847c41f3fe568be23aea49d2a7f33681d7da5b042455bf7cbd3588cbf4e67c78eaec5817ca956bcbf2b27399dde636d066d61c76c3b2b79f7e6e538
-  data.tar.gz: de31e9840a0e9ec02749ac640bf443916f4bbaf6948f0759ce62795ece06d88f7e5bc7c85254655e5f0cb925ccfba9291b1db1d2f6e59efd9dbc00a40668ba84
+  metadata.gz: 5c25e6d978843923725dbc50fa64ccb8017901de4057634bae8d4ec345174d4b8319afadf560ffae74fd8d462333fb51c7fc8bd9792a77c23ee810ffce890055
+  data.tar.gz: db480474fa17085808961564fca2bfbc333b56f69765738683508633a3509c25c21efebf0d99385ddcfed149f6901b204c4e29dd284abae275f09af5c25c885e

data/.travis.yml

@@ -10,7 +10,7 @@ addons:
       - libpcap-dev
       - graphviz
 rvm:
-  - 2.3.2
+  - 2.3.3
 before_script:
   - cp spec/dummy/config/database.yml.travis spec/dummy/config/database.yml
   - bundle exec rake --version

data/db/migrate/20161227212223_add_os_family_to_hosts.rb

@@ -0,0 +1,5 @@
+class AddOsFamilyToHosts < ActiveRecord::Migration
+  def change
+    add_column :hosts, :os_family, :string
+  end
+end

data/lib/mdm/host/operating_system_normalization.rb

@@ -342,11 +342,38 @@ module Mdm::Host::OperatingSystemNormalization
       if m['os.product'] =~ /^Windows Server/
         m['os.product'] = m['os.product'].gsub(/Windows Server/, 'Windows')
       end
+
+      # Normalize OS Family
+      m = normalize_match_family(m)
     end
 
     m
   end
 
+  # Normalize matches in order to ensure that an os.family entry exists
+  # if we have enough data to put one together.
+  def normalize_match_family(m)
+    # If the os.family already exists, we don't need to do anything
+    return m if m['os.family'].present?
+    case m['os.product']
+      when /Windows/
+        m['os.family'] = 'Windows'
+      when /Linux/
+        m['os.family'] = 'Linux'
+      when /Solaris/
+        m['os.family'] = 'Solaris'
+      when /SunOS/
+        m['os.family'] = 'SunOS'
+      when /AIX/
+        m['os.family'] = 'AIX'
+      when /HP-UX/
+        m['os.family'] = 'HP-UX'
+      when /OS X/
+        m['os.family'] = 'OS X'
+    end
+    m
+  end
+
   #
   # Recog assumes that the protocol version of the SSH banner has been removed
   #
@@ -417,6 +444,10 @@ module Mdm::Host::OperatingSystemNormalization
       end
     end
 
+    if match.has_key?('os.family')
+      host.os_family = sanitize(match['os.family'])
+    end
+
     # Select the flavor from os.edition if available
     if match.has_key?('os.edition') and ! host.attribute_locked?(:os_flavor)
       host.os_flavor = sanitize(match['os.edition'])

data/lib/metasploit_data_models/version.rb

@@ -1,6 +1,6 @@
 module MetasploitDataModels
   # VERSION is managed by GemRelease
-  VERSION = '2.0.11'
+  VERSION = '2.0.12'
 
   # @return [String]
   #

data/spec/app/models/mdm/host_spec.rb

@@ -352,6 +352,7 @@ RSpec.describe Mdm::Host, type: :model do
       it { is_expected.to have_db_column(:info).of_type(:string).with_options(:limit => 2 ** 16) }
       it { is_expected.to have_db_column(:mac).of_type(:string) }
       it { is_expected.to have_db_column(:name).of_type(:string) }
+      it { is_expected.to have_db_column(:os_family).of_type(:string) }
       it { is_expected.to have_db_column(:os_flavor).of_type(:string) }
       it { is_expected.to have_db_column(:os_lang).of_type(:string) }
       it { is_expected.to have_db_column(:os_name).of_type(:string) }
@@ -864,6 +865,44 @@ RSpec.describe Mdm::Host, type: :model do
       end
     end
 
+    context '#normalize_match_family' do
+      it 'should set the family to Windows if the product contains Windows' do
+        match  = { 'os.product' => 'Microsoft Windows 7' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'Windows'
+      end
+
+      it 'should set the family to Linux if the product contains Linux' do
+        match  = { 'os.product' => 'Linux (Ubuntu)' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'Linux'
+      end
+
+      it 'should set the family to Solaris if the product contains Solaris' do
+        match  = { 'os.product' => 'Solaris' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'Solaris'
+      end
+
+      it 'should set the family to SunOS if the product contains SunOS' do
+        match  = { 'os.product' => 'SunOS' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'SunOS'
+      end
+
+      it 'should set the family to AIX if the product contains AIX' do
+        match  = { 'os.product' => 'AIX' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'AIX'
+      end
+
+      it 'should set the family to HP-UX if the product contains HP-UX' do
+        match  = { 'os.product' => 'HP-UX' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'HP-UX'
+      end
+    end
+
     context '#guess_purpose_from_match' do
 
       it 'should detect Windows XP as a client' do

data/spec/dummy/db/structure.sql

@@ -451,7 +451,8 @@ CREATE TABLE hosts (
     host_detail_count integer DEFAULT 0,
     exploit_attempt_count integer DEFAULT 0,
     cred_count integer DEFAULT 0,
-    detected_arch character varying
+    detected_arch character varying,
+    os_family character varying
 );
 
 
@@ -3402,6 +3403,8 @@ INSERT INTO schema_migrations (version) VALUES ('20160415153312');
 
 INSERT INTO schema_migrations (version) VALUES ('20161004165612');
 
+INSERT INTO schema_migrations (version) VALUES ('20161227212223');
+
 INSERT INTO schema_migrations (version) VALUES ('21');
 
 INSERT INTO schema_migrations (version) VALUES ('22');

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit_data_models
 version: !ruby/object:Gem::Version
-  version: 2.0.11
+  version: 2.0.12
 platform: ruby
 authors:
 - Samuel Huckins
@@ -91,7 +91,7 @@ cert_chain:
   G+Hmcg1v810agasPdoydE0RTVZgEOOMoQ07qu7JFXVWZ9ZQpHT7qJATWL/b2csFG
   8mVuTXnyJOKRJA==
   -----END CERTIFICATE-----
-date: 2016-12-28 00:00:00.000000000 Z
+date: 2016-12-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: metasploit-yard
@@ -552,6 +552,7 @@ files:
 - db/migrate/20150514182921_add_origin_to_mdm_vuln.rb
 - db/migrate/20160415153312_remove_not_null_from_web_vuln_p_arams.rb
 - db/migrate/20161004165612_add_fingerprinted_to_workspace.rb
+- db/migrate/20161227212223_add_os_family_to_hosts.rb
 - lib/mdm.rb
 - lib/mdm/host/operating_system_normalization.rb
 - lib/mdm/module.rb