nexpose 0.8.4 → 0.8.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: dba4421357b0475f091f72cd2fd61ced926fb6ad
-  data.tar.gz: e7d37e55dcf159045a3249932c9dfa426e8f0705
+  metadata.gz: a14fda65d152d074a2adba56c7180417b04c9569
+  data.tar.gz: 6e349f9013e13f8b2972ada209543dee513d612a
 SHA512:
-  metadata.gz: abdef9b08034c3fce94402180e33af5dc7c01a05c4a48bb8a8a877e21f8599a19abfc0710fea5b22a5562ae24884198ebaaa4b19849e6b7e3cdf2713bc4adf14
-  data.tar.gz: 12f470900347b5cac2927cf3138f561f110fdab1246b232dd12dd1167035fd872db9dc9fcab2d87282c9ac8e71345dda73b2f8d76c0ac3e1b618eecadf081257
+  metadata.gz: aaf259cadc6172ca32f9a07d6a15240dab9c0baf0f565ffe070c16472c7d3c0768ae86850cc4850eaf9221bf292d00f9c5619566fa62f447e83289e930ef0b04
+  data.tar.gz: a7b6825ce9cd0898acdd6784e106c7a3823c88ec1bf227ccd13de18d0355132aea1532d14cf3b458af9f412bb7561a9f900d02715a745edaab7b9f9f6e9724f0

data/lib/nexpose.rb

@@ -103,3 +103,11 @@ module Nexpose
     puts 'response: ' + object.response_xml.to_s
   end
 end
+
+# Monkey patch from ActiveSupport which rex 2.0.3 incorrectly replies upon.
+# This enables the multipart MIME handling in Connection#import_scan
+class String
+  def blank?
+    self !~ /\S/
+  end
+end

data/lib/nexpose/discovery.rb

@@ -35,6 +35,11 @@ module Nexpose
       HTTPS = 'HTTPS'
     end
 
+    module Type
+      V_SPHERE = 'VSPHERE'
+      AWS = 'AWS'
+    end
+
     # A unique identifier for this connection.
     attr_accessor :id
 
@@ -42,6 +47,7 @@ module Nexpose
     attr_accessor :name
 
     # The IP address or fully qualified domain name of the server.
+    # For AWS connections, this is the address of the regional server.
     attr_accessor :address
 
     # A user name that can be used to log into the server.
@@ -56,6 +62,12 @@ module Nexpose
     # The port used for connecting to the server. A valid port from 1 to 65535.
     attr_accessor :port
 
+    # The type of discovery connection.
+    attr_accessor :type
+    
+    # Whether the console and scan engine are inside the AWS network.
+    attr_accessor :inside_network
+
     # Whether or not the connection is active.
     # Discovery is only possible when the connection is active.
     attr_accessor :status
@@ -73,6 +85,7 @@ module Nexpose
       @id = -1
       @port = 443
       @protocol = Protocol::HTTPS
+      @type = Type::V_SPHERE
     end
 
     # Save this discovery connection to a Nexpose console.
@@ -130,13 +143,35 @@ module Nexpose
     end
 
     def as_xml
+      # TODO
+      # <DiscoveryConfig id="-1" name="aws" port="443" protocol="HTTPS" username="asdf" type="AWS" usePrivateIPAddress="0" engineid="2" region="ec2.us-west-1.amazonaws.com" password="asdf"> </DiscoveryConfig>
+      # <DiscoveryConfig id="-1" name="external AWS" port="443" protocol="HTTPS" username="acess-key-id" type="AWS" usePrivateIPAddress="0" engineid="2" region="ec2.sa-east-1.amazonaws.com" password="secret Access Key">
+      # <DiscoveryConfig id="-1" name="internal-aws" port="443" protocol="HTTPS" username=" " type="AWS" usePrivateIPAddress="1" engineid="2" region="ec2.ap-northeast-1.amazonaws.com" password="Not required">
+      # <DiscoveryConfig id="-1" name="V the Final Battle" fqdn="vcenter001.osdc.lax.rapid7.com" port="443" protocol="HTTPS" username="TOR\lmnexpose" type="VSPHERE" usePrivateIPAddress="0" engineid="2" region="ec2.us-east-1.amazonaws.com" password="22yQCA0P8nSvfrE">
+      # <DiscoveryConfig id="-1" name="duplicate vSphere" fqdn="vcenter001.osdc.lax.rapid7.com" port="443" protocol="HTTPS" username="blah" type="VSPHERE" usePrivateIPAddress="0" engineid="2" region="ec2.us-east-1.amazonaws.com" password="blah">
+      # <DiscoveryConfig id="10" name ="vCenter" fqdn ="vcenter001.osdc.lax.rapid7.com" port ="443" protocol ="HTTPS" username ="TOR\lmnexpose" type="VSPHERE" usePrivateIPAddress="0"> </DiscoveryConfig>
       xml = REXML::Element.new('DiscoveryConnection')
-      xml.add_attributes({ 'name' => @name,
-                           'address' => @address,
+      xml.add_attributes({ 'id' => @id,
+                           'name' => @name,
                            'port' => @port,
-                           'protocol' => @protocol,
-                           'user-name' => @user,
-                           'password' => @password })
+                           'protocol' => @protocol })
+      case @type
+      when Type::AWS
+        xml.add_attributes({ 'region' => @address })
+        if @inside_network
+          xml.add_attributes({ 'usePrivateIPAddress' => 1,
+                               'username' => ' ',
+                               'password' => 'Not required' })
+        else
+          xml.add_attributes({ 'usePrivateIPAddress' => 0,
+                               'username' => @user,
+                               'password' => @password })
+        end
+      when Type::V_SPHERE
+        xml.add_attributes({ 'fqdn' => @address,
+                             'username' => @user,
+                             'password' => @password })
+      end
       xml
     end
 
@@ -145,6 +180,9 @@ module Nexpose
     end
 
     def self.parse(xml)
+      # <DiscoveryConfig id="10" name ="vCenter" fqdn ="vcenter001.osdc.lax.rapid7.com" port ="443" protocol ="HTTPS" username ="TOR\lmnexpose" type="VSPHERE" usePrivateIPAddress="0"> </DiscoveryConfig>
+      # <DiscoveryConfig id="34" name ="external AWS" region ="ec2.sa-east-1.amazonaws.com" port ="443" protocol ="HTTPS" username ="acess-key-id" type="AWS" usePrivateIPAddress="0">
+      # <DiscoveryConfig id="32" name ="my-aws" region ="ec2.ap-northeast-1.amazonaws.com" port ="443" protocol ="HTTPS" username =" " type="AWS" usePrivateIPAddress="1">
       conn = new(xml.attributes['name'],
                  xml.attributes['address'],
                  xml.attributes['user-name'])

data/lib/nexpose/scan.rb

@@ -256,51 +256,28 @@ module Nexpose
     # @return [String] An empty string on success.
     #
     def import_scan(site_id, zip_file)
+      data = Rex::MIME::Message.new
+      data.add_part(site_id.to_s, nil, nil, 'form-data; name="siteid"')
+      data.add_part(self.session_id, nil, nil, 'form-data; name="nexposeCCSessionID"')
+      scan = File.new(zip_file, 'rb')
+      data.add_part(scan.read, 'application/zip', 'binary',
+                    "form-data; name=\"scan\"; filename=\"#{zip_file}\"")
 
-      # ## Ideally, this code should not depend upon rest-client, but should be
-      # #  able to use the Rex library to generate the MIME message. I haven't
-      # #  been able to figure out how, though. Leaving it here, commented out,
-      # #  pending discovery of what to do.
-
-      # data = Rex::MIME::Message.new
-      # data.add_part(site_id.to_s, nil, nil, 'form-data; name="siteid"')
-      # data.add_part(self.session_id, nil, nil, 'form-data; name="nexposeCCSessionID"')
-
-      # scan = File.new(zip_file, 'rb')
-      # data.add_part(scan.read, 'application/zip', nil,
-      #               "form-data; name=\"scan\"; filename=\"#{zip_file}\"")
-
-      # post = Net::HTTP::Post.new('/data/scan/import')
-      # ## rex 2.0.3 has a bug that requires this monkey-patch for Message#to_s
-      # # class String
-      # #   def blank?
-      # #     self !~ /\S/
-      # #   end
-      # # end
-      # post.body = data.to_s
-      # post.set_content_type("multipart/form-data; boundary=#{data.bound}")
-      # AJAX._headers(nsc, post)
-
-      # http = AJAX._https(nsc)
-      # http.request(post)
+      post = Net::HTTP::Post.new('/data/scan/import')
+      post.body = data.to_s
+      post.set_content_type('multipart/form-data', boundary: data.bound)
 
-      scan = File.new(zip_file, 'rb')
-      url = "https://#{self.host}:#{self.port}/data/scan/import"
-      payload = { :siteid => site_id,
-                  :scan => scan,
-                  'nexposeCCSessionID' => self.session_id }
-      request = RestClient::Request.new(:method     => :post,
-                                        :url        => url,
-                                        :verify_ssl => OpenSSL::SSL::VERIFY_NONE,
-                                        :payload    => payload,
-                                        :cookies    => { 'nexposeCCSessionID' => self.session_id })
-
-      begin
-        request.execute
-      rescue RestClient::Forbidden => fourOhThree
-        raise Nexpose::PermissionError.new(fourOhThree)
-      rescue RestClient::InternalServerError => e
-        raise Nexpose::APIError.new(request, e)
+      # Avoiding AJAX#request, because the data can cause binary dump on error.
+      http = AJAX._https(self)
+      AJAX._headers(self, post)
+      response = http.request(post)
+      case response
+      when Net::HTTPOK
+        response.body
+      when Net::HTTPUnauthorized
+        raise Nexpose::PermissionError.new(response)
+      else
+        raise Nexpose::APIError.new(post, response.body)
       end
     end
 

data/lib/nexpose/site.rb

@@ -174,6 +174,13 @@ module Nexpose
       @assets << HostName.new(hostname)
     end
 
+    # Remove an asset to this site by host name.
+    #
+    # @param [String] hostname FQDN or DNS-resolvable host name of an asset.
+    def remove_host(hostname)
+      @assets = assets.reject { |asset| asset == HostName.new(hostname) } 
+    end
+
     # Adds an asset to this site by IP address.
     #
     # @param [String] ip IP address of an asset.
@@ -181,6 +188,13 @@ module Nexpose
       @assets << IPRange.new(ip)
     end
 
+    # Remove an asset to this site by IP address.
+    #
+    # @param [String] ip IP address of an asset.
+    def remove_ip(ip)
+      @assets = assets.reject { |asset| asset == IPRange.new(ip) }
+    end
+
     # Adds assets to this site by IP address range.
     #
     # @param [String] from Beginning IP address of a range.
@@ -189,6 +203,14 @@ module Nexpose
       @assets << IPRange.new(from, to)
     end
 
+    # Remove assets to this site by IP address range.
+    #
+    # @param [String] from Beginning IP address of a range.
+    # @param [String] to Ending IP address of a range.
+    def remove_ip_range(from, to)
+      @assets = assets.reject { |asset| asset == IPRange.new(from, to) }
+    end
+
     # Adds an asset to this site, resolving whether an IP or hostname is
     # provided.
     #
@@ -208,6 +230,25 @@ module Nexpose
       end
     end
 
+    # Remove an asset to this site, resolving whether an IP or hostname is
+    # provided.
+    #
+    # @param [String] asset Identifier of an asset, either IP or host name.
+    #
+    def remove_asset(asset)
+      begin
+        # If the asset registers as a valid IP, store as IP.
+        ip = IPAddr.new(asset)
+        remove_ip(asset)
+      rescue ArgumentError => e
+        if e.message == 'invalid address'
+          remove_host(asset)
+        else
+          raise "Unable to parse asset: '#{asset}'. #{e.message}"
+        end
+      end
+    end
+
     # Load an existing configuration from a Nexpose instance.
     #
     # @param [Connection] connection Connection to console where site exists.
@@ -253,8 +294,8 @@ module Nexpose
 
         # Have to retrieve and attach shared creds, or saving will fail.
         xml = _append_shared_creds_to_xml(connection, as_xml)
-        response = AJAX.post(connection, '/ajax/save_site_config.txml', xml)
-        saved = REXML::XPath.first(REXML::Document.new(response), 'SaveConfig')
+        response = AJAX.post(connection, '/data/site/config', xml)
+        saved = REXML::XPath.first(REXML::Document.new(response), 'ajaxResponse')
         raise APIError.new(response, 'Failed to save dynamic site.') if saved.nil? || saved.attributes['success'].to_i != 1
 
         save_dynamic_criteria(connection) unless new_site
@@ -297,8 +338,22 @@ module Nexpose
     # @return [Fixnum] Site ID.
     #
     def save_dynamic_criteria(nsc)
-      params = to_dynamic_map
-      response = AJAX.form_post(nsc, '/data/site/saveSite', params)
+      # Several parameters are passed through the URI
+      params = { 'configID' => @discovery_connection_id,
+                 'entityid' => @id > 0 ? @id : false,
+                 'mode' => @id > 0 ? 'edit' : false }
+      uri = AJAX.parameterize_uri('/data/site/saveSite', params)
+
+      # JSON body of POST request contains details.
+      details = { 'dynamic' => true,
+                  'name' => @name,
+                  'tag' => @description.nil? ? '' : @description,
+                  'riskFactor' => @risk_factor,
+                  # 'vCenter' => @discovery_connection_id,
+                  'searchCriteria' => @criteria.nil? ? { 'operator' => 'AND' } : @criteria.to_map }
+      json = JSON.generate(details)
+
+      response = AJAX.post(nsc, uri, json, AJAX::CONTENT_TYPE::JSON)
       json = JSON.parse(response)
       if json['response'] =~ /success/
         if @id < 1
@@ -335,7 +390,9 @@ module Nexpose
       xml.attributes['name'] = @name
       xml.attributes['description'] = @description
       xml.attributes['riskfactor'] = @risk_factor
-      xml.attributes['isDynamic'] == '1' if dynamic?
+      xml.attributes['isDynamic'] = '1' if dynamic?
+      # TODO This should be set to 'Amazon Web Services' for AWS.
+      xml.attributes['dynamicConfigType'] = 'vSphere' if dynamic?
 
       if @description && !@description.empty?
         elem = REXML::Element.new('Description')
@@ -394,19 +451,6 @@ module Nexpose
       as_xml.to_s
     end
 
-    def to_dynamic_map
-      details = { 'dynamic' => true,
-                  'name' => @name,
-                  'tag' => @description.nil? ? '' : @description,
-                  'riskFactor' => @risk_factor,
-                  # 'vCenter' => @discovery_connection_id,
-                  'searchCriteria' => @criteria.nil? ? { 'operator' => 'AND' } : @criteria.to_map }
-      params = { 'configID' => @discovery_connection_id,
-                 'entityid' => @id > 0 ? @id : false,
-                 'mode' => @id > 0 ? 'edit' : false,
-                 'entityDetails' => details }
-    end
-
     # Parse a response from a Nexpose console into a valid Site object.
     #
     # @param [REXML::Document] rexml XML document to parse.
@@ -475,7 +519,7 @@ module Nexpose
     end
 
     def _append_shared_creds_to_xml(connection, xml)
-      xml_w_creds = AJAX.get(connection, "/ajax/site_config.txml?siteid=#{@id}")
+      xml_w_creds = AJAX.get(connection, "/data/site/config?siteid=#{@id}")
       cred_xml = REXML::XPath.first(REXML::Document.new(xml_w_creds), 'Site/Credentials')
       unless cred_xml.nil?
         creds = REXML::XPath.first(xml, 'Credentials')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nexpose
 version: !ruby/object:Gem::Version
-  version: 0.8.4
+  version: 0.8.5
 platform: ruby
 authors:
 - HD Moore
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-01 00:00:00.000000000 Z
+date: 2014-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rex