rbkb 0.6.12 → 0.7.0

checksums.yaml

@@ -0,0 +1,15 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: !binary |-
+    NmUwMGU3OGM4ZTEwZTZjMWViOTQxODg1NWNjODVmZWRhOWI1ZTY3Mg==
+  data.tar.gz: !binary |-
+    YWIwMTg4MjliZWVjOTZjNjg3ZjQ4YWI5NTE2MTQ5ZDk1MzNhNTQwMg==
+SHA512:
+  metadata.gz: !binary |-
+    MzAwYjE4ZDEyNDdjZDZhZTJiODFkNDc5MWU0NDNhZjQ4YTM4Y2JiMzY4NWQx
+    MzMwMDk5MTJjNzA1OGM0ZGRhOTU3NDRiNTVhMWIzNGJlYWU5NjBjZTYwZDc4
+    Y2Q0ODY0YjE3NGNjOGY4ZTE3MmY0MTA3MTY0NmI2YWZiMGMzMDU=
+  data.tar.gz: !binary |-
+    ODkwNzFkZWY2ZmQ2NzIzZWM2NWNmM2NkMDIyM2ZkYWQzNjcwYjQwZTc0NzM2
+    MzE2YjBhN2E4NjQ3YWU1NjkzMTY0NTg0Y2UzMzZlMjk2M2Y3ZWJmODBiZDY2
+    MDBhNjdiNDc2YTY3YzE2M2RjMzhjY2FkMzg5NjEwMzA1OTZjOTc=

data/.bnsignore

@@ -0,0 +1,25 @@
+# The list of files that should be ignored by Mr Bones.
+# Lines that start with '#' are comments.
+#
+# A .gitignore file can be used instead by setting it as the ignore
+# file in your Rakefile:
+#
+#   PROJ.ignore_file = '.gitignore'
+#
+# For a project with a C extension, the following would be a good set of
+# exclude patterns (uncomment them if you want to use them):
+# *.[oa]
+
+.*
+*~
+*.swp
+.*.swp
+.yardoc
+announcement.txt
+coverage*/
+doc
+pkg
+bin/experimental
+reference
+*.gem
+.DS_Store

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format nested

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in rbkb.gemspec
+gemspec

data/Gemfile.lock

@@ -0,0 +1,27 @@
+PATH
+  remote: .
+  specs:
+    rbkb (0.7.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    diff-lcs (1.2.1)
+    rake (10.1.0)
+    rspec (2.13.0)
+      rspec-core (~> 2.13.0)
+      rspec-expectations (~> 2.13.0)
+      rspec-mocks (~> 2.13.0)
+    rspec-core (2.13.1)
+    rspec-expectations (2.13.0)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-mocks (2.13.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 1.3)
+  rake
+  rbkb!
+  rspec

data/History.txt

@@ -1,3 +1,11 @@
+== 0.6.14 / 2010-11-29
+  * Minor fixes to cli offset and integer hexification formatting
+  * Unit tests got some more love for ruby 1.9 unit test compatability
+
+== 0.6.13 / 2009-10-15
+  * got strings working using scan() in 1.9 had to punt ':align' option for now
+  * Added -S (starttls) arg. to blit for initiating SSL on a plug peer
+
 == 0.6.12 / 2009-10-15
   * better ruby 1.8 <-> 1.9 portability
   * tweaked rotate_bytes to "wrap" on char boundary and rotate backwards safely

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2009 Eric Monti
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/Rakefile

@@ -1,47 +1,12 @@
-# Look in the tasks/setup.rb file for the various options that can be
-# configured in this Rakefile. The .rake files in the tasks directory
-# are where the options are used.
+require "bundler/gem_tasks"
 
-begin
-  require 'bones'
-  Bones.setup
-rescue LoadError
-  begin
-    load 'tasks/setup.rb'
-  rescue LoadError
-    raise RuntimeError, '### please install the "bones" gem ###'
-  end
-end
-
-ensure_in_path 'lib'
-require 'rbkb'
-
-task :default => 'test:run'
-
-PROJ.name = 'rbkb'
-PROJ.authors = 'Eric Monti'
-PROJ.email = 'emonti@matasano.com'
-PROJ.description = 'Rbkb is a collection of ruby-based pen-testing and reversing tools. Inspired by Matasano Blackbag.'
-PROJ.url = 'http://emonti.github.com/rbkb'
-PROJ.version = Rbkb::VERSION
-PROJ.rubyforge.name = 'rbkb'
-PROJ.readme_file = 'README.rdoc'
-
-PROJ.spec.opts << '--color'
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new
+task :default => :spec
 
-PROJ.rdoc.opts << '--line-numbers'
-
-#PROJ.rdoc.opts << '--diagram'
-PROJ.notes.tags << "X"+"XX" # muhah! so we don't note our-self
-
-# exclude rcov.rb and external libs from rcov report
-PROJ.rcov.opts += [
-  "--exclude",  "rcov.rb", 
-  "--exclude", "eventmachine",
-  "--exclude", "pcap_misc.rb",
-  "--exclude", "pcaplet.rb"
-]
-
-depend_on 'eventmachine', '>= 0.12.8'
-
-# EOF
+require 'rake/testtask'
+Rake::TestTask.new do |t|
+  t.libs << "test"
+  t.test_files = FileList['test/test*.rb']
+  t.verbose = true
+end

data/experimental/cap2files

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+# extracts UDP/TCP data payload from packets to numbered files
+#   Usage: cap2files out_prefix pcap-file [filter]]
+
+require 'rbkb/plug/feed_import'
+
+begin
+  unless prefix = ARGV.shift and file = ARGV.shift
+    raise "Usage: #{File.basename $0} out_prefix pcap-file [filter]"
+  end
+
+  filter = ARGV.join(" ")
+
+  caps = FeedImport.import_pcap(file, filter)
+  i=0
+  caps.each {|p| File.open("#{prefix}.#{i}", "w") {|f| f.write p }; i+=1 }
+rescue
+  STDERR.puts $!
+  exit 1
+end
+

data/experimental/cap2yaml

@@ -0,0 +1,20 @@
+#!/usr/bin/env ruby
+# extracts UDP/TCP data payload from packets to an array encapsulated in yaml
+#   Usage: cap2yaml pcap-file [filter]]
+
+require 'rbkb/plug/feed_import'
+
+begin
+  unless file = ARGV.shift
+    raise "Usage: #{File.basename $0} pcap-file [filter]"
+  end
+
+  filter = ARGV.join(" ")
+
+  caps = FeedImport.import_pcap(file, filter)
+  puts caps.to_yaml
+rescue
+  STDERR.puts $!
+  exit 1
+end
+

data/experimental/colordif.rb

@@ -0,0 +1,72 @@
+#!/usr/bin/env ruby
+
+# Sort of like vbindiff, except smaller with less functionality, and in our toolshed ;)
+# Useful for encoded HTTP parameters, raw dumped pkts and other little things
+# todo: print out like hexdump -C
+# Chris at mtso
+
+module ColorConstants
+	BLACK = "\e[1;30m"
+	RED = "\e[1;31m"
+	GREEN = "\e[1;32m"
+	BROWN = "\e[1;33m"
+	BLUE = "\e[1;34m"
+	PURPLE = "\e[1;35m"
+	CYAN = "\e[1;36m"
+	GRAY = "\e[1;37m"
+	NO_COLOR = "\e[0m"
+end
+
+class ColorDif
+
+	attr_accessor :file1, :file2
+
+	def initialize(file1, file2)
+		@file1 = IO.read(file1)
+		@file2 = IO.read(file2)
+	end
+
+	# Theres definitely a more elegant way to do this, whatever ...
+	def diffem
+		puts "\nFile 1 [#{file1.size} bytes]"
+		puts "File 2 [#{file2.size} bytes]\n\n"
+
+		count = 0
+
+		@file1.each_byte do |byte|
+			if byte == @file2[count]
+				print sprintf(ColorConstants::BLUE + "%02x ", byte)
+			else
+				print sprintf(ColorConstants::RED + "%02x ", byte)
+			end
+
+			count = count+1
+
+			if count % 32 == 0
+				print "\n"
+			end
+		end
+
+		puts ColorConstants::NO_COLOR + "\n---"
+		count = 0
+
+		@file2.each_byte do |byte|
+			if byte == @file1[count]
+				print sprintf(ColorConstants::BLUE + "%02x ", byte)
+			else
+				print sprintf(ColorConstants::RED + "%02x ", byte)
+			end
+
+			count = count+1
+
+			if count % 32 == 0
+				print "\n"
+			end
+		end
+	end
+end
+
+f = ColorDif.new(ARGV[0], ARGV[1])
+f.diffem
+
+puts ColorConstants::NO_COLOR  + "\n\n"

data/experimental/deezee

@@ -0,0 +1,91 @@
+#!/usr/bin/env ruby
+# (emonti at matasano) Matasano Security LLC 2008
+
+require 'rbkb'
+require 'rbkb/command_line'
+require 'stringio'
+
+include RBkB::CommandLine
+
+first = 0
+last = nil
+verbose=true
+
+#------------------------------------------------------------------------------
+# Init options and arg parsing
+OPTS = {:len => 16}
+arg = bkb_stdargs(nil, OPTS)
+
+arg.banner += " <input-file | blank for stdin>"
+
+arg.on("-q", "--[no-]quiet", "Stifle extra data info") {|q| verbose=(!q)}
+arg.on("-s", "--start=OFF", Numeric, "Start at offset") {|s| first=s}
+arg.on("-e", "--end=OFF", Numeric, "End at offset") {|e| last=e}
+
+begin
+  #----------------------------------------------------------------------------
+  # Parse arguments
+
+  arg.parse!(ARGV)
+
+  inp = nil
+
+  if inpname=ARGV.shift
+    inp=File.open(inpname, "rb") rescue "Error: Can't open file '#{a}'"
+  else
+    inp = StringIO.new(STDIN.read())
+    inpname="stdin"
+  end
+
+  # catchall
+  if ARGV.length != 0 
+      raise "bad arguments - #{ARGV.join(' ')}"
+  end
+
+  #----------------------------------------------------------------------------
+  # Do stuff
+
+  # Right now this only handles gzip files... no deflate, no stream, no raw LZ
+  gzc = "\x1f\x8b"
+
+  off = inp.pos = first
+  until inp.eof? or (last and inp.pos >= last)
+    # grab 2 byte signature
+    sig = inp.read(2)
+
+    break if inp.eof?
+
+    # compare with gzip signature
+    if sig == gzc
+      # return to start position
+      off = (inp.pos -= 2)
+
+      begin
+        gz = Zlib::GzipReader.new(inp)
+        dat = gz.read
+        gz_size = inp.pos
+
+        STDERR.puts "** %d bytes of gzip @ %0.8x" %[gz_size, off]
+        if verbose
+          STDERR.puts "  Extra info:"
+          STDERR.puts "    inflated size = #{ dat.size}"
+          gz.get_xtra_info.sort {|a,b| a.to_s <=> b.to_s }.each do |k,v|
+            STDERR.puts "#{k.to_s.rjust(18)} = #{v.inspect}"
+          end
+        end
+
+        # XXX assuming no better than 15% compression rate?
+        inp.pos = inp.pos / 4
+        next
+      rescue
+      end
+    end
+
+    # start again from next byte
+    off = (inp.pos -= 1)
+  end
+rescue
+  bail $!
+end
+
+

data/experimental/feed

@@ -0,0 +1,225 @@
+#!/usr/bin/env ruby
+# feed <emonti at matasano> 3/15/2008
+#----------------------------------------------------------------------
+#
+# This is an eventmachine message feeder from static data sources.
+# The "feed" handles messages opaquely and just plays them in the given 
+# sequence.
+#
+# Feed can do the following things with minimum fuss: 
+#   - Import messages from files, yaml, or pcap
+#   - Inject custom/modified messages with "blit"
+#   - Run as a server or client using UDP or TCP
+#   - Bootstrap protocols without a lot of work up front
+#   - Skip uninteresting messages and focus attention on the fun ones.
+#   - Replay conversations for relatively unfamiliar protocols.
+#   - Observe client/server behaviors using different messages at
+#     various phases of a conversation.
+# 
+#----------------------------------------------------------------------
+#
+# Usage: feed -h
+#
+#----------------------------------------------------------------------
+# To-dos / Ideas:
+#  - Unix Domain Socket support?
+#  - more import options?
+#  - dynamic feed elements?
+#  - add/control feed elements while 'stepping'?
+#
+
+require 'rubygems'
+require 'eventmachine'
+require 'rbkb'
+require 'rbkb/plug'
+require 'rbkb/plug/feed_import'
+require 'rbkb/command_line'
+
+include RBkB::CommandLine
+
+## Default "UI" options
+Plug::UI::LOGCFG[:verbose] = true
+Plug::UI::LOGCFG[:dump] = :hex
+
+## Default options sent to the Feed handler
+FEED_OPTS = { 
+  :close_at_end => false,
+  :step => false,
+  :go_first => false
+}
+
+my_addr = "0.0.0.0"
+my_port = nil
+listen = false
+persist = false
+
+transport = :TCP
+
+svr_method = :start_server
+cli_method = :connect
+
+
+b_addr = Plug::Blit::DEFAULT_IPADDR
+b_port = Plug::Blit::DEFAULT_PORT
+
+##  Parse command-line options
+arg = bkb_stdargs(nil, {})
+arg.banner += " host:port"
+
+arg.separator  "  Options:"
+
+arg.on("-o", "--output=FILE", "Output to file") do |o|
+  Plug::UI::LOGCFG[:out] = File.open(o, "w")
+end
+
+arg.on("-l", "--listen=(ADDR:?)PORT", "Server - on port (and addr?)") do |p|
+  if m=/^(?:([\w\.]+):)?(\d+)$/.match(p)
+    my_addr = $1 if $1
+    my_port = $2.to_i
+    listen = true
+  else
+    raise "Invalid listen argument: #{p.inspect}"
+  end
+end
+
+arg.on("-b", "--blit=(ADDR:)?PORT", "Where to listen for blit") do |b|
+  puts b
+  unless(m=/^(?:([\w\.]+):)?(\d+)$/.match(b))
+    raise "Invalid blit argument: #{b.inspect}"
+  end
+  b_port = m[2].to_i
+  b_addr = m[1] if m[1]
+end
+
+arg.on("-i", "--[no-]initiate", "Send the first message on connect") do |i|
+  FEED_OPTS[:go_first] = i
+end
+
+arg.on("-e", "--[no-]end", "End connection when feed is exhausted") do |c|
+  FEED_OPTS[:close_at_end] = c
+end
+ 
+arg.on("-s", "--[no-]step", "'Continue' prompt between messages") do |s|
+  FEED_OPTS[:step] = s
+end
+
+arg.on("-u", "--udp", "Use UDP instead of TCP" ) do
+  transport = :UDP
+  svr_method = cli_method = :open_datagram_socket
+end
+
+arg.on("-r", "--reconnect", "Attempt to reconnect endlessly.") do
+  persist=true
+end
+
+arg.on("-q", "--quiet", "Suppress verbose messages/dumps") do
+  Plug::UI::LOGCFG[:verbose] = false
+end
+
+arg.on("-S", "--squelch-exhausted", "Squelch 'FEED EXHAUSTED' messages") do |s|
+  FEED_OPTS[:squelch_exhausted] = true
+end
+
+arg.separator  "  Sources: (can be combined)"
+
+arg.on("-f", "--from-files=GLOB", "Import messages from raw files") do |f|
+  FEED_OPTS[:feed] ||= []
+  FEED_OPTS[:feed] += FeedImport.import_rawfiles(f)
+end
+
+arg.on("-x", "--from-hex=FILE", "Import messages from hexdumps") do |x|
+  FEED_OPTS[:feed] ||= []
+  FEED_OPTS[:feed] += FeedImport.import_dump(x)
+end
+
+arg.on("-y", "--from-yaml=FILE", "Import messages from yaml") do |y|
+  FEED_OPTS[:feed] ||= []
+  FEED_OPTS[:feed] += FeedImport.import_yaml(y)
+end
+
+arg.on("-p", "--from-pcap=FILE[:FILTER]", "Import messages from pcap") do |p|
+  if /^([^:]+):(.+)$/.match(p)
+    file = $1
+    filter = $2
+  else
+    file = p
+    filter = nil
+  end
+
+  FEED_OPTS[:feed] ||= []
+  FEED_OPTS[:feed] += FeedImport.import_pcap(file, filter)
+end
+
+arg.parse!(ARGV) rescue bail "Error: #{$!}\nUse -h|--help for more info."
+
+# parse OptionParser and import feed
+begin 
+  arg.parse!(ARGV) 
+
+  # Prepare EventMachine arguments based on whether we are a client or server
+  if listen
+    evma_addr = my_addr
+    evma_port = my_port
+    meth = svr_method
+    FEED_OPTS[:kind] = :server
+  else
+
+    ## Get target/listen argument for client mode
+    unless (m = /^([\w\.]+):(\d+)$/.match(ARGV.shift)) and ARGV.shift.nil?
+      bail arg
+    end
+
+    t_addr = m[1]
+    t_port = m[2].to_i
+
+    if transport == :UDP
+      evma_addr = my_addr
+      evma_port = my_port || 0
+    else
+      evma_addr = t_addr
+      evma_port = t_port
+    end
+
+    meth = cli_method
+    FEED_OPTS[:kind] = :client
+  end
+
+  FEED_OPTS[:feed] ||= []
+  Plug::UI.verbose "** FEED CONTAINS #{FEED_OPTS[:feed].size} MESSAGES"
+
+  ## error out on unexpected arguments
+  raise "too many arguments" if ARGV.shift
+rescue 
+  bail "Error: #{$!}\nUse -h|--help for more information"
+end
+
+
+em_args=[ 
+  meth, 
+  evma_addr, 
+  evma_port, 
+  Plug::ArrayFeeder, 
+  transport, 
+  FEED_OPTS
+].flatten
+
+
+## Start the eventmachine
+loop do
+  EventMachine::run do
+    EventMachine.send(*em_args) do |c|
+      EventMachine.start_server(b_addr, b_port, Plug::Blit, :TCP, c)
+      Plug::UI::verbose("** BLITSRV-#{b_addr}:#{b_port}(TCP) Started")
+
+      # if this is a UDP client, we will always send the first message
+      if transport == :UDP and c.kind == :client and 
+        c.feed_data(c.peers.add_peer_manually(t_addr, t_port))
+        c.go_first = false
+      end
+    end
+  end
+
+  break unless persist
+  Plug::UI::verbose("** RECONNECTING")
+end
+