msfrpc-simple 0.0.7 → 0.0.8

data/.gitignore

@@ -0,0 +1 @@
+.DS_Store

data/lib/msfrpc-simple/client.rb

@@ -14,8 +14,6 @@ module Msf
         include Msf::RPC::Simple::Features::Framework
         include Msf::RPC::Simple::Features::Pro
 
-        #attr_accessor :options
-
         # Public: Create a simple client object.
         #
         # user_options - hash of options to include in our initial connection.
@@ -26,16 +24,16 @@ module Msf
 
           # configure default options
           @options = {
-            :project => user_options[:project] || "default", 
+            :project => user_options[:project] || "default",
             :port => user_options[:project] || 55553,
-            :user => user_options[:rpc_user], 
-            :pass => user_options[:rpc_pass], 
+            :user => user_options[:rpc_user],
+            :pass => user_options[:rpc_pass],
             :db_host => user_options[:db_host] || "localhost",
             :db_user => user_options[:db_user],
             :db_pass => user_options[:db_pass],
-            :db => user_options[:db_name] || "msf"
+            :db_name => user_options[:db_name] || "msf"
           }
-          
+
           @options.merge!(user_options)
 
           #
@@ -43,29 +41,46 @@ module Msf
           #
           @client = Msf::RPC::Client.new(@options)
 
-          #
-          # Connect to the database based on the included options
-          #
+          # connect to the database 
           _connect_database
+        end
 
-          #
-          # Add a new workspace
-          #
-          @workspace_name = Time.now.utc.to_s.gsub(" ","_").gsub(":","_")
-          _create_workspace
+        # Public: clean up after ourselves 
+        #
+        # Returns nothing
+        def cleanup
+          _send_command("hosts -d")
+          _send_command("services -d")
+          _send_command("creds -d")
+        end
 
-          #
-          # Create a logger
-          #
-          #@logger = Msf::RPC::Simple::Logger.new
+        # Public: list all running threads
+        #
+        # Returns a hash of running threads
+        def list_threads
+          @client.call("core.thread_list")
+        end
+
+        # Public: determine if we're connected to the RPC server
+        #
+        # returns true/false
+        def rpc_connected?
+          return false unless @client.call("core.version")
+        true
+        end
+        
+        # Public: determine if we're connected to the RPC server
+        #
+        # returns true/false
+        def db_connected?
+          return false unless _send_command("db_status") =~ /connected/
+        true
         end
 
         # Public: Creates and retuns an xml report
         #
         # This method is ugly for a number of reasons, but there doesn't
         # appear to be a way to be notified when the command is completed
-        # nor when the 
-        # 
         #
         # returns a valid xml string
         def create_report
@@ -79,73 +94,73 @@ module Msf
           begin
             xml_string = ""
             status = Timeout::timeout(240) {
-              # We don't know when the file is going to show up, so 
+              # We don't know when the file is going to show up, so
               # wait for it...
               until File.exists? report_path do
-                sleep 1
+              sleep 1
               end
 
-              # Read and clean up the file when it exists...
-              until xml_string.include? "</MetasploitV4>" do
-                  sleep 5
-                  xml_string = File.read(report_path)
-              end
-              
-              File.delete(report_path)
+            # Read and clean up the file when it exists...
+            until xml_string.include? "</MetasploitV4>" do
+              sleep 5
+              xml_string = File.read(report_path)
+            end
+
+            File.delete(report_path)
             }
           rescue Timeout::Error
             xml_string = "<MetasploitV4></MetasploitV4>"
           end
 
-        xml_string
-        end
-
-        def cleanup
-          #_send_command("workspace -d #{@workspace_name}")
-          _send_command("db_disconnect")
+          xml_string
         end
 
-        def connected?
-          return true if @client.call("core.version")   
-        end
 
         private
 
+        # Private: connect to the database given the supplied / default options
+        #
+        # Returns nothing
         def _connect_database
-          _send_command("db_connect #{@options[:db_user]}:#{@options[:db_pass]}@#{@options[:db_host]}/#{@options[:db]}")
-        end
-
-        def _create_workspace
-          _send_command("workspace -a #{@workspace_name}")
+          _send_command("db_connect #{@options[:db_user]}:#{@options[:db_pass]}@#{@options[:db_host]}/#{@options[:db_name]}")
         end
 
+        # Private: provision a console and send the supplied command, capturing output
+        #
+        # Returns a valid string
         def _send_command(command)
-            # Create the console and get its id
-            console = @client.call("console.create")
+          # Create the console and get its id
+          console = @client.call("console.create")
+
+          # Do an initial read / discard to pull out any info on the console
+          # then write the command to the console
+          @client.call("console.read", console["id"])
+          @client.call("console.write", console["id"], "#{command}\n")
 
-            # Do an initial read / discard to pull out any info on the console
-            # then write the command to the console
-            @client.call("console.read", console["id"])
-            @client.call("console.write", console["id"], "#{command}\n")
+          # Initial read
+          output_string = ""
+          output = @client.call("console.read", console["id"])
+          output_string += "#{output['data']}"
 
-            # Initial read
-            output_string = ""
-            output = @client.call("console.read", console["id"])
+          # Very very hacky. -- There should be a way to check
+          # status of a call to make sure that it isn't in an error
+          # state. For now, check the output for known error heuristics
+          return output_string if output_string =~ /(\[-\]|Error)/
 
             # Read until finished
-            while (output["busy"] == true) do
+            while (!output.has_key?("result")) do
+              return unless output["busy"]
               output_string += "#{output['data']}"
               output = @client.call("console.read", console["id"])
-              output_string = "Error" if output["result"] == "failure"
+              return "Error" if output["result"] == "failure"
             end
-          
-            # Clean up console
-            #@client.call("console.destroy", console["id"])
 
-        output_string
-        end
+          # Clean up console
+          @client.call("console.destroy", console["id"])
 
+          output_string
+        end
       end
     end
   end
-end
+end

data/lib/msfrpc-simple/features/framework.rb

@@ -1,114 +1,211 @@
 module Msf
   module RPC
     module Simple
-      module Features 
+      module Features
         module Framework
 
+          # Public: This module runs a db_nmap command
           #
-          # This module runs a number of discovery modules
+          # range - an ipv4 ip address range in cidr format
           #
-          def discover_range(range)
+          # This method should only be run after running setup
+          #
+          # Returns nothing
+          def nmap_range(range)
+
+            unique_string = Time.now.utc.to_s.gsub(" ","_").gsub(":","_")
+            nmap_report_path = "/tmp/metasploit_temp_#{unique_string}.xml"
+
+            # Call out to nmap to scan the given range
+            `nmap --top-ports 100 -oX #{nmap_report_path} #{range}`
+            
+            # Import the XML into metasploit
+            _send_command("db_import #{nmap_report_path}")
+
+            # Wait for a few seconds while the xml is imported
+            sleep 10
+
+            # Remove the file
+            File.delete(nmap_report_path)
+
+          end
+
+          # Public: This module runs a number of discovery modules. This method should only
+          # be run after running setup, then the nmap_range method.
+          #
+          # host - an ipv4 ip address or hostname
+          #
+          # This method should only be run after running setup, and then the 
+          # nmap_range method.
+          #
+          # Returns nothing
+
+          def discover_range(range, threads=25)
 
             # Other Potential options
             #  - auxiliary/scanner/smb/pipe_auditor
             #  - auxiliary/scanner/smb/pipe_dcerpc_auditor
             #  - auxiliary/scanner/smb/smb_enumshares
             #  - auxiliary/scanner/smb/smb_enumusers
-            modules_and_options = [ 
-              {:module_name => "auxiliary/scanner/http/http_version"}, 
-              #{:module_name => "auxiliary/scanner/http/cert"}, 
-              {:module_name => "auxiliary/scanner/ftp/ftp_version"},
-              {:module_name => "auxiliary/scanner/h323/h323_version"},
-              {:module_name => "auxiliary/scanner/imap/imap_version"},
-              #{:module_name => "auxiliary/scanner/portscan/syn"},
-              #{:module_name => "auxiliary/scanner/portscan/tcp"},
-              #{:module_name => "auxiliary/scanner/lotus/lotus_domino_version"},
-              {:module_name => "auxiliary/scanner/mysql/mysql_version"},
-              #{:module_name => "auxiliary/scanner/netbios/nbname"},
-              #{:module_name => "auxiliary/scanner/netbios/nbname_probe"},
-              #{:module_name => "auxiliary/scanner/pcanywhere/pcanywhere_tcp"},
-              #{:module_name => "auxiliary/scanner/pcanywhere/pcanywhere_udp"},
-              {:module_name => "auxiliary/scanner/pop3/pop3_version"},
-              {:module_name => "auxiliary/scanner/postgres/postgres_version"},
-              {:module_name => "auxiliary/scanner/smb/smb_version"},
-              {:module_name => "auxiliary/scanner/snmp/snmp_enum"},
-              {:module_name => "auxiliary/scanner/ssh/ssh_version"},
-              {:module_name => "auxiliary/scanner/telnet/telnet_version"},
-              #{:module_name => "auxiliary/scanner/vmware/vmauthd_version"},
+            modules_and_options = [
+              {:module_name => "auxiliary/scanner/http/http_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/http/cert", :module_options => {}},
+              {:module_name => "auxiliary/scanner/ftp/ftp_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/h323/h323_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/imap/imap_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/portscan/syn", :module_options => {}},
+              {:module_name => "auxiliary/scanner/portscan/tcp", :module_options => {}},
+              #{:module_name => "auxiliary/scanner/lotus/lotus_domino_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/mysql/mysql_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/netbios/nbname", :module_options => {}},
+              {:module_name => "auxiliary/scanner/netbios/nbname_probe"},
+              #{:module_name => "auxiliary/scanner/pcanywhere/pcanywhere_tcp", :module_options => {}},
+              #{:module_name => "auxiliary/scanner/pcanywhere/pcanywhere_udp", :module_options => {}},
+              {:module_name => "auxiliary/scanner/pop3/pop3_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/postgres/postgres_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/smb/smb_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/snmp/snmp_enum", :module_options => {}},
+              {:module_name => "auxiliary/scanner/ssh/ssh_version", :module_options => {}},
+              {:module_name => "auxiliary/scanner/telnet/telnet_version", :module_options => {}},
+              #{:module_name => "auxiliary/scanner/vmware/vmauthd_version", :module_options => {}}
             ]
 
-            output = ""
-            module_list.each do |m|
+            module_list.each do |mod|
               # Merge in default options
-              m[:module_option_string] =  "RHOSTS #{range}"
+              mod[:options] = { 
+                "RHOSTS" => "#{range}", 
+                "THREADS" => "#{threads}"
+              }
 
-              # store this module's name in the output
-              output += "=== #{m[:module_name]} ===\n"
-              output += execute_module_and_return_output(m)
-            end
+              # Module specific options
+              mod[:options].merge!(mod[:module_options])
 
-          output
+              # execute the module
+               execute_module(mod)
+            end
           end
 
 
+          # Public: This module runs a number of bruteforce modules. This method should only
+          # be run after running setup, then the nmap_range method.
+          #
+          # host - an ipv4 ip address or hostname
           #
-          # This module runs a number of _login modules
+          # This method should only be run after running setup, and then the 
+          # nmap_range method.
           #
-          def bruteforce_range(range)
+          # Returns nothing
+          def bruteforce_range(range, user_file, pass_file, threads=25)
 
             module_list = [
-              {:module_name => "auxiliary/scanner/ftp/ftp_login"}, 
-              {:module_name => "auxiliary/scanner/http/http_login"}, 
-              {:module_name => "auxiliary/scanner/smb/smb_login"}, 
-              {:module_name => "auxiliary/scanner/mssql/mssql_login"}, 
-              {:module_name => "auxiliary/scanner/mysql/mysql_login"}, 
-              {:module_name => "auxiliary/scanner/pop3/pop3_login"}, 
-              {:module_name => "auxiliary/scanner/smb/smb_login"}, 
-              {:module_name => "auxiliary/scanner/snmp/snmp_login"}, 
-              {:module_name => "auxiliary/scanner/ssh/ssh_login"}, 
-              {:module_name => "auxiliary/scanner/telnet/telnet_login"}, 
+              {:module_name => "auxiliary/scanner/http/http_login", :module_options => {}},
+              {:module_name => "auxiliary/scanner/smb/smb_login", :module_options => {}},
+              {:module_name => "auxiliary/scanner/snmp/snmp_login", :module_options => {}},
+              {:module_name => "auxiliary/scanner/ssh/ssh_login", :module_options => {"SSH_TIMEOUT" => 3}}
             ]
 
-            output = ""
-            module_list.each do |m|
-              #m[:module_option_string] = "RHOSTS #{range}, USER_FILE /opt/metasploit/msf3/data/wordlists/unix_users.txt, PASS_FILE /opt/metasploit/msf3/data/wordlists/unix_passwords.txt"
-              m[:module_option_string] = "RHOSTS #{range}, USERNAME root, PASSWORD root"
+            # Iterate through modules in the list, adding in generic and module-specific options
+            # if they exist
+            module_list.each do |mod|
+
+              # Generic module options
+              mod[:options] = { 
+                "RHOSTS" => "#{range}",
+                "USER_FILE" => "#{user_file}",
+                "PASS_FILE" => "#{pass_file}",
+                "THREADS" => "#{threads}"
+              }
+              # Module specific options
+              mod[:options].merge!(mod[:module_options])
 
-              # store this module's name in the output
-              output += "=== #{m[:module_name]} ===\n"
-              output += execute_module_and_return_output(m)
+              execute_module(mod)
             end
 
-          output
           end
 
+          # Public: This module runs a number of exploit modules. This method should only
+          # be run after running setup, then the nmap_range method.
+          #
+          # host - an ipv4 ip address or hostname
           #
-          # This module runs a number of exploit modules
+          # This method should only be run after running setup, and then the 
+          # nmap_range method.
           #
-          def exploit_range(range)
-            return "Not Implemented"
+          # Returns nothing
+          def exploit_single(host)
+
+            # TODO - will need to set up / manage a handler - should this go 
+            # back to the console? 
+
+            module_list = [
+              { :module_name => "exploit/windows/smb/ms08_067_netapi", :module_options => {} }
+            ]
+            
+            module_list.each do |mod|
+              mod[:options] = { "RHOST" => "#{host}" }
+              mod[:options].merge!(mod[:module_options])
+              execute_module(mod)
+            end
           end
 
+          # Public: This method executes a specified metasploit module
           #
-          # This module simply runs a module
+          # params - A parameters hash containing:
+          #  - :module_name - a full metasploit module name
+          #  - :options - a hash of options to be "set" for the module
           #
-          def execute_module_and_return_output(options)
-            module_name = options[:module_name]
-            module_option_string = options[:module_option_string]
+          # Note that typical behavior for metasploit when calling "module.execute" is to 
+          # background the task. This method waits for the task to complete, thereby
+          # allowing you to fire this method, then interact with the database to find
+          # the requisite result(s).
+          #
+          # returns nothing
+          def execute_module(params)
+            module_name = params[:module_name]
+            module_type = params[:module_name].split("/").first
+            module_options = params[:options]
+            raise "Error, bad module name" unless ["exploit", "auxiliary", "post", "encoder", "nop"].include? module_type
+            
+            # Execute the module and obtain the job details
+            job_details = @client.call("module.execute", module_type, module_name, module_options)
+
+            while @client.call("job.list").has_key?(job_details["job_id"].to_s)
+              # Wait while the module is executed in the background
+              sleep 1
+            end
+
+          end
+=begin
+          # Public: execute_module_and_return_output
+          #
+          # This method runs a module in a metasploit console and captures the output
+          # to a string which is returned at the end of the module. An attempt is made
+          # to remove the metasploit banner, which is simply noise
+          # 
+          # Note that this is currently deprecated, but preserved here in case a different
+          # approach (text output needed) to running modules is req'd. Please use the 
+          # execute_module method to run a module going forward. While output is not 
+          # preserved when running that method, all appropriate results should be captured
+          # in the database 
+          # 
+          # Returns a string with module output
+          def execute_module_and_return_output(params)
+            module_name = params[:module_name]
+            module_option_string = params[:module_option_string]
 
             # split up the module name into type / name
             module_type = module_name.split("/").first
-            raise "Error, bad module name" unless ["exploit", "auxiliary", "post", "encoder", "nop"].include? module_type  
-            
+            raise "Error, bad module name" unless ["exploit", "auxiliary", "post", "encoder", "nop"].include? module_type
+
             # TODO - we may have to deal w/ targets somehow
 
             #info = @client.call("module.execute", module_type, module_name, module_options)
             #@client.call("job.info", info["job_id"])
 
-            # The module output will be not available when run this way; to 
+            # The module output will be not available when run this way; to
             # capture the result of the print_* commands, you have to set the
             # output driver of the module to something you can read from (Buffer,
-            # File, etc). For your use case, the best bet is to run the module 
+            # File, etc). For your use case, the best bet is to run the module
             # via the Console API instead of module.execute, and use that to read
             # the output from the console itself, which provides buffer output for you.
             output = ""
@@ -148,7 +245,7 @@ module Msf
             # do an initial read of the module's output
             module_output = @client.call("console.read", console_id)
             output += "#{module_output['data']}"
-          
+
             until !module_output["busy"] do
               module_output = @client.call("console.read", console_id)
               output += "#{module_output['data']}"
@@ -161,14 +258,14 @@ module Msf
               output += "#{module_output['data']}"
             end
 
-            # Clean up 
+            # Clean up
             @client.call("console.destroy", console_id)
 
           output
           end
-
+=end
         end
       end
     end
   end
-end
+end

data/lib/msfrpc-simple/version.rb

@@ -1,7 +1,7 @@
 module Msf
   module RPC
     module Simple
-      VERSION = "0.0.7"
+      VERSION = "0.0.8"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: msfrpc-simple
 version: !ruby/object:Gem::Version
-  version: 0.0.7
+  version: 0.0.8
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-21 00:00:00.000000000 Z
+date: 2013-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msfrpc-client
@@ -34,6 +34,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- .gitignore
 - Gemfile
 - Gemfile.lock
 - LICENSE
@@ -41,11 +42,8 @@ files:
 - Rakefile
 - build.sh
 - doc/NOTES
-- lib/.DS_Store
 - lib/msfrpc-simple.rb
-- lib/msfrpc-simple/.DS_Store
 - lib/msfrpc-simple/client.rb
-- lib/msfrpc-simple/features/.DS_Store
 - lib/msfrpc-simple/features/framework.rb
 - lib/msfrpc-simple/features/pro.rb
 - lib/msfrpc-simple/logger.rb
@@ -76,7 +74,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.24
+rubygems_version: 1.8.23
 signing_key: 
 specification_version: 3
 summary: This library provides a simple-to-use wrapper for the Rapid7 Metasploit RPC