plunder 2.0.0a

data/ext/fsdb/vault.h

@@ -0,0 +1,44 @@
+// 
+// Plunder - SMB scanning and auditing tool
+// Copyright (C) 2017 Joshua Stone
+// 
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+// 
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// 
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+// 
+
+#ifndef VAULT_H
+#define VAULT_H
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+#include "utilities.h"
+
+typedef struct {
+  uint8_t *base;
+  uint32_t top;
+  uint32_t count;
+  uint32_t size;
+} vault;
+
+vault vault_init(uint32_t size);
+uint8_t *vault_get(vault v, uint32_t offset);
+uint32_t vault_insert_string(vault *v, char *s);
+uint32_t vault_insert_bytes(vault *v, void *p, uint32_t bytes);
+void vault_info(vault v, char *name);
+void vault_free(vault v);
+
+#endif

data/ext/smbclient/extconf.rb

@@ -0,0 +1,32 @@
+# Loads mkmf which is used to make makefiles for Ruby extensions
+require 'mkmf'
+
+extension_name = 'smbclient'
+
+success = true
+
+unless have_header("samba-4.0/libsmbclient.h")
+  puts "\x1b[31;1m"
+  puts "-------- missing dependency --------"
+  puts "must have 'samba-4.0/libsmbclient.h' to compile smbclient extension"
+  puts "perhaps you need to install 'libsmbclient-devel' or 'libsmbclient-dev'?"
+  puts ""
+  puts "Note: if libsmbclient is installed, but not the *-dev[el] package,"
+  puts "      then I can't find the headers to compile."
+  puts "\x1b[0m"
+  success = false
+end
+
+unless have_library("smbclient")
+  puts "\x1b[31;1m"
+  puts "-------- missing dependency --------"
+  puts "must have smbclient library to compile smbclient extension"
+  puts "perhaps you need to install 'libsmbclient' package?"
+  puts "\x1b[0m"
+  success = false
+end
+
+exit 1 unless success
+
+dir_config(extension_name)
+create_makefile(extension_name)

data/ext/smbclient/smb.c

@@ -0,0 +1,234 @@
+// 
+// Plunder - SMB scanning and auditing tool
+// Copyright (C) 2017 Joshua Stone
+// 
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+// 
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// 
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+// 
+
+#include "smb.h"
+
+// We want to dynamically grow the buffer sizes to make sure they
+// are always big enough for the values they need to store.  This
+// is an ugly conditional to splatter all over, so we can clean
+// it up a big with a macro.
+
+#define CHECK_SIZE(ptr, len)   if(ptr == NULL) {\
+    ptr = (char *) malloc(len);\
+  } else if(strlen(ptr) < len) {\
+    ptr = (char *) realloc(ptr, len);\
+  }
+
+void smb_init() {
+  SMBC_DOMAIN   = NULL;
+  SMBC_USERNAME = NULL;
+  SMBC_PASSWORD = NULL;
+  cred_root     = NULL;
+}
+
+SMBCCTX *get_context() {
+  SMBCCTX *context = smbc_new_context();
+
+  smbc_setFunctionAuthDataWithContext(context, smb_auth_fn);
+  smbc_setOptionNoAutoAnonymousLogin(context, 1);
+  smbc_setOptionUrlEncodeReaddirEntries(context, 1);
+  smbc_setTimeout(context, 5000);
+  smbc_init_context(context);
+  smbc_set_context(context);
+
+  return context;
+}
+
+void free_node(cred_node *node) {
+  free(node->domain);
+  free(node->username);
+  free(node->password);
+  free(node);
+}
+
+void free_context(SMBCCTX *context) {
+  cred_node *prev = NULL;
+  cred_node *node = NULL;
+
+  if(cred_root) {
+    if(cred_root->context == context) {
+      node = cred_root;
+      cred_root = (cred_node *)cred_root->next;
+      free_node(node);
+    } else if(cred_root->next) {
+      prev = cred_root;
+      node = (cred_node *)cred_root->next;
+      while(node) {
+	if(node->context == context) {
+	  prev->next = node->next;
+	  free_node(node);
+	  break;
+	}
+	prev = node;
+	node = (cred_node *)node->next;
+      }
+    }
+  }
+
+  smbc_free_context(context, 1);
+}
+
+void smb_set_creds(SMBCCTX *context, char *domain, char *user, char *password) {
+  int d_len = strlen(domain)   + 1;
+  int u_len = strlen(user)     + 1;
+  int p_len = strlen(password) + 1;
+  cred_node *node;
+
+  node = cred_root;
+
+  while(node) {
+    if(node->context == context) {
+      break;
+    }
+    node = (cred_node *)node->next;
+  }
+  
+  if(node) {
+    free(node->domain);
+    free(node->username);
+    free(node->password);
+  } else {
+    node = (cred_node *) malloc(sizeof(cred_node));
+    node->context = context;
+    node->next    = (struct cred_node *)cred_root;
+    cred_root     = node;
+  }
+
+  node->domain   = (char *)malloc(d_len);
+  node->username = (char *)malloc(u_len);
+  node->password = (char *)malloc(p_len);
+
+  strncpy(node->domain,   domain,   d_len);
+  strncpy(node->username, user,     u_len);
+  strncpy(node->password, password, p_len);
+}
+
+int smb_test_creds(SMBCCTX *context, char *url, int type) {
+  int dir;
+  int result;
+
+  smbc_set_context(context);
+  if(type == 0) {
+    dir = smbc_opendir(url);
+  } else {
+    dir = smbc_open(url, O_RDONLY, 'r');
+  }
+  result = dir < 0 ? 0 : 1;
+  smbc_close(dir);
+  
+  return result;
+}
+
+int smb_is_container(struct smbc_dirent *dirent) {
+  int len = strlen(dirent->name);
+  return (dirent->smbc_type == SMBC_WORKGROUP ||
+	  dirent->smbc_type == SMBC_SERVER ||
+	  dirent->smbc_type == SMBC_FILE_SHARE ||
+	  dirent->smbc_type == SMBC_DIR) &&
+    strncmp(".", dirent->name, len) &&
+    strncmp("..", dirent->name, len);
+}
+
+int smb_list_contents(SMBCCTX *context, char *url, VALUE dirs, VALUE files) {
+  int dir = 0;
+  int len;
+  struct smbc_dirent *dirent;
+  
+  smbc_set_context(context);
+
+  if((dir = smbc_opendir(url)) >= 0) {
+    while(dir >= 0 && (dirent = smbc_readdir(dir))) {
+      len = strlen(dirent->name);
+      if(smb_is_container(dirent)) {
+	rb_ary_push(dirs, rb_str_new2(dirent->name));
+      } else if(strncmp(".", dirent->name, len) &&
+	        strncmp("..", dirent->name, len)) {
+	rb_ary_push(files, rb_str_new2(dirent->name));
+      }
+    }
+  } else {
+    FILE *f;
+    if(dir == -1 && errno == 1) {
+      f = fopen("agent.log", "a");
+      fprintf(f, "EACCES at %s\n", url);
+      fclose(f);
+      return 0;
+    } else if(errno == 13) {
+      // permission error
+    } else {
+      f = fopen("agent.log", "a");
+      fprintf(f, "SMB operation failed with handle %d, errno: %d at %s\n", dir, errno, url);
+      fclose(f);
+    }
+  }
+
+  smbc_closedir(dir);
+  return 1;
+}
+
+void smb_auth_fn(SMBCCTX * context,
+		 const char * pServer,
+		 const char * pShare,
+		 char * pWorkgroup,
+		 int maxLenWorkgroup,
+		 char * pUsername,
+		 int maxLenUsername,
+		 char * pPassword,
+		 int maxLenPassword) {
+  
+  cred_node *node = cred_root;
+
+  while(node) {
+    if(node->context == context) {
+      break;
+    }
+    node = (cred_node *)node->next;
+  }
+
+  if(node) {
+    strncpy(pWorkgroup, node->domain,   maxLenWorkgroup - 1);
+    strncpy(pUsername,  node->username, maxLenUsername  - 1);
+    strncpy(pPassword,  node->password, maxLenPassword  - 1);
+  } else {
+    fprintf(stderr, "Error: cannot set credentials for uninitialized context!\n");
+  }
+}
+
+char *slurp_file(SMBCCTX *context, char *url, int *size) {
+  int fd;
+  char *buffer;
+  struct stat st;
+
+  *size = 0;
+  smbc_set_context(context);
+  if((fd = smbc_open(url, O_RDONLY, 0)) >= 0) {
+    if(smbc_fstat(fd, &st) >= 0) {
+      buffer = (char *)malloc(st.st_size);
+      smbc_read(fd, buffer, st.st_size);
+      *size = st.st_size;
+      return buffer;
+    } else {
+      fprintf(stderr, "ERROR: Cannot stat file %s\n", url);
+      return NULL;
+    }
+  } else {
+    fprintf(stderr, "ERROR: Cannot open file %s\n", url);
+    return NULL;
+  }
+}

data/ext/smbclient/smb.h

@@ -0,0 +1,61 @@
+// 
+// Plunder - SMB scanning and auditing tool
+// Copyright (C) 2017 Joshua Stone
+// 
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+// 
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// 
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+// 
+
+#ifndef SMB_H
+#define SMB_H
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <ruby.h>
+
+#include <samba-4.0/libsmbclient.h>
+
+char *SMBC_DOMAIN;
+char *SMBC_USERNAME;
+char *SMBC_PASSWORD;
+
+typedef struct {
+  SMBCCTX *context;
+  char *domain;
+  char *username;
+  char *password;
+  struct cred_node *next;
+} cred_node;
+   
+cred_node *cred_root;
+
+SMBCCTX *get_context();
+
+void  smb_init();
+void  smb_set_creds(SMBCCTX *context, char *domain, char *user, char *password);
+int   smb_test_creds(SMBCCTX *context, char *url, int type);
+void  free_context(SMBCCTX *context);
+int   smb_is_container(struct smbc_dirent *dirent);
+int   smb_list_contents(SMBCCTX *context, char *url, VALUE dirs, VALUE files);
+char *slurp_file(SMBCCTX *context, char *url, int *size);
+
+void smb_auth_fn(SMBCCTX *, const char *, const char *, char *,
+		 int, char *, int, char *, int);
+
+#endif

data/ext/smbclient/smbclient.c

@@ -0,0 +1,116 @@
+// 
+// Plunder - SMB scanning and auditing tool
+// Copyright (C) 2017 Joshua Stone
+// 
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+// 
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+// 
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+// 
+
+#include <ruby.h>
+#include <ctype.h>
+
+#include "smb.h"
+
+VALUE module = Qnil;
+VALUE smb_klass = Qnil;
+
+void Init_smbclient();
+VALUE smb_method_new(VALUE self, VALUE dom, VALUE user, VALUE pass);
+VALUE smb_method_set_creds(VALUE self, VALUE dom, VALUE user, VALUE pass);
+VALUE smb_method_login(VALUE self, VALUE url);
+VALUE smb_method_list_contents(VALUE self, VALUE url);
+VALUE smb_method_slurp(VALUE self, VALUE url);
+
+void Init_smbclient() {
+  smb_init();
+
+  smb_klass  = rb_define_class("SMBClient", rb_cObject);
+
+  rb_define_singleton_method(smb_klass, "new",  smb_method_new, 3);
+
+  rb_define_method(smb_klass, "set_creds",   smb_method_set_creds,     3);
+  rb_define_method(smb_klass, "login",       smb_method_login,         1);
+  rb_define_method(smb_klass, "list",        smb_method_list_contents, 1);
+  rb_define_method(smb_klass, "slurp",       smb_method_slurp,          1);
+}
+
+VALUE smb_method_new(VALUE self, VALUE dom, VALUE user, VALUE pass) {
+  SMBCCTX *context;
+
+  context = get_context();
+  smb_set_creds(context,
+		StringValueCStr(dom),
+		StringValueCStr(user),
+		StringValueCStr(pass));
+
+  return Data_Wrap_Struct(smb_klass, NULL, free_context, context);
+}
+
+VALUE smb_method_set_creds(VALUE self, VALUE dom, VALUE user, VALUE pass) {
+  SMBCCTX *context;
+  char *d = StringValueCStr(dom);
+  char *u = StringValueCStr(user);
+  char *p = StringValueCStr(pass);
+  
+  Data_Get_Struct(self, SMBCCTX, context);
+  smb_set_creds(context, d, u, p);
+
+  return Qtrue;
+}
+
+VALUE smb_method_login(VALUE self, VALUE url) {
+  SMBCCTX *context;
+  char *u  = StringValueCStr(url);
+  int len  = strlen(u);
+  int type = u[len-1] != '/';
+  
+  Data_Get_Struct(self, SMBCCTX, context);
+  int value = smb_test_creds(context, u, type);
+  return (value == 1) ? Qtrue : Qfalse;
+}
+
+VALUE smb_method_list_contents(VALUE self, VALUE url) {
+  SMBCCTX *context;
+  VALUE dirs;
+  VALUE files;
+  VALUE ret;
+
+  char *u = StringValueCStr(url);
+  dirs    = rb_ary_new();
+  files   = rb_ary_new();
+  ret     = rb_ary_new();
+
+  Data_Get_Struct(self, SMBCCTX, context);
+  if(!smb_list_contents(context, u, dirs, files)) {
+    return Qnil;
+  }
+
+  rb_ary_push(ret, dirs);
+  rb_ary_push(ret, files);
+
+  return ret;
+}
+
+VALUE smb_method_slurp(VALUE self, VALUE url) {
+  SMBCCTX *context;
+  int size;
+  char *u = StringValueCStr(url);
+  Data_Get_Struct(self, SMBCCTX, context);
+  char *b = slurp_file(context, u, &size);
+  VALUE v = rb_str_new(b, size);
+  free(b);
+
+  return v;  
+}
+