rex-java 0.1.0

data/lib/rex/java/serialization/model/reset.rb

@@ -0,0 +1,12 @@
+# -*- coding: binary -*-
+
+module Rex
+  module Java
+    module Serialization
+      module Model
+        class Reset < Element
+        end
+      end
+    end
+  end
+end

data/lib/rex/java/serialization/model/stream.rb

@@ -0,0 +1,123 @@
+# -*- coding: binary -*-
+
+module Rex
+  module Java
+    module Serialization
+      module Model
+        # This class provides a Java Stream representation
+        class Stream < Element
+
+          include Rex::Java::Serialization::Model::Contents
+
+          # @!attribute magic
+          #   @return [Fixnum] The stream signature
+          attr_accessor :magic
+          # @!attribute version
+          #   @return [Fixnum] The stream version
+          attr_accessor :version
+          # @!attribute contents
+          #   @return [Array] The stream contents
+          attr_accessor :contents
+          # @!attribute references
+          #   @return [Array] The stream objects to be referenced through handles
+          attr_accessor :references
+
+          def initialize(stream = nil)
+            super(nil)
+            self.magic = STREAM_MAGIC
+            self.version = STREAM_VERSION
+            self.contents = []
+            self.references = []
+          end
+
+          # Deserializes a Rex::Java::Serialization::Model::Stream
+          #
+          # @param io [IO] the io to read from
+          # @return [self] if deserialization succeeds
+          # @raise [Rex::Java::Serialization::DecodeError] if deserialization doesn't succeed
+          def decode(io)
+            self.magic = decode_magic(io)
+            self.version = decode_version(io)
+
+            until io.eof?
+              content = decode_content(io, self)
+              self.contents << content
+            end
+
+            self
+          end
+
+          # Serializes the Rex::Java::Serialization::Model::Stream
+          #
+          # @return [String] if serialization succeeds
+          # @raise [Rex::Java::Serialization::EncodeError] if serialization doesn't succeed
+          def encode
+            encoded = ''
+            encoded << [magic].pack('n')
+            encoded << [version].pack('n')
+            contents.each do |content|
+              encoded << encode_content(content)
+            end
+            encoded
+          end
+
+          # Adds an element to the references array
+          #
+          # @param ref [Rex::Java::Serialization::Model::Element] the object to save as reference dst
+          def add_reference(ref)
+            self.references.push(ref)
+          end
+
+          # Creates a print-friendly string representation
+          #
+          # @return [String]
+          def to_s
+            str = "@magic: 0x#{magic.to_s(16)}\n"
+            str << "@version: #{version}\n"
+            str << "@contents: [\n"
+            contents.each do |content|
+              str << "  #{print_content(content)}\n"
+            end
+            str << "]\n"
+            str << "@references: [\n"
+            references.each do |ref|
+                str << "  [#{(references.index(ref) + BASE_WIRE_HANDLE).to_s(16)}] #{print_content(ref)}\n"
+            end
+            str << "]\n"
+          end
+
+          private
+
+          # Deserializes the magic stream value
+          #
+          # @param io [IO] the io to read from
+          # @return [String] if deserialization succeeds
+          # @raise [Rex::Java::Serialization::DecodeError] if deserialization doesn't succeed
+          def decode_magic(io)
+            magic = io.read(2)
+
+            unless magic && magic.length == 2 && magic.unpack('n')[0] == STREAM_MAGIC
+              raise Rex::Java::Serialization::DecodeError, 'Failed to unserialize Stream'
+            end
+
+            STREAM_MAGIC
+          end
+
+          # Deserializes the version stream
+          #
+          # @param io [IO] the io to read from
+          # @return [Fixnum] if deserialization succeeds
+          # @raise [Rex::Java::Serialization::DecodeError] if deserialization doesn't succeed
+          def decode_version(io)
+            version = io.read(2)
+            unless version && version.unpack('n')[0] == STREAM_VERSION
+              raise Rex::Java::Serialization::DecodeError, 'Failed to unserialize Stream'
+            end
+
+            STREAM_VERSION
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rex/java/serialization/model/utf.rb

@@ -0,0 +1,69 @@
+# -*- coding: binary -*-
+
+module Rex
+  module Java
+    module Serialization
+      module Model
+        # This class provides a Utf string representation
+        class Utf < Element
+
+          # @!attribute length
+          #   @return [Integer] the length of the string
+          attr_accessor :length
+          # @!attribute contents
+          #   @return [String] the contents of the string
+          attr_accessor :contents
+
+          # @param stream [Rex::Java::Serialization::Model::Stream] the stream where it belongs to
+          # @param contents [String] the contents of the utf string
+          def initialize(stream = nil, contents = '')
+            super(stream)
+            self.contents = contents
+            self.length = contents.length
+          end
+
+          # Deserializes a Rex::Java::Serialization::Model::Utf
+          #
+          # @param io [IO] the io to read from
+          # @return [self] if deserialization succeeds
+          # @raise [Rex::Java::Serialization::DecodeError] if deserialization doesn't succeed
+          def decode(io)
+            raw_length = io.read(2)
+            if raw_length.nil? || raw_length.length != 2
+              raise Rex::Java::Serialization::DecodeError, 'Failed to unserialize Utf'
+            end
+            self.length = raw_length.unpack('n')[0]
+
+            if length == 0
+              self.contents = ''
+            else
+              self.contents = io.read(length)
+              if contents.nil? || contents.length != length
+                raise Rex::Java::Serialization::DecodeError, 'Failed to unserialize Utf'
+              end
+            end
+
+            self
+          end
+
+          # Serializes the Rex::Java::Serialization::Model::Utf
+          #
+          # @return [String]
+          def encode
+            encoded = [length].pack('n')
+            encoded << contents
+
+            encoded
+          end
+
+          # Creates a print-friendly string representation
+          #
+          # @return [String]
+          def to_s
+            contents
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rex/java/version.rb

@@ -0,0 +1,5 @@
+module Rex
+  module Java
+    VERSION = "0.1.0"
+  end
+end

data/rex-java.gemspec

@@ -0,0 +1,24 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'rex/java/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "rex-java"
+  spec.version       = Rex::Java::VERSION
+  spec.authors       = ["dmohanty-r7"]
+  spec.email         = ["Dev_Mohanty@rapid7.com"]
+
+  spec.summary       = %q{Rex library for parsing serialized Java streams.}
+  spec.description   = %q{Ruby Exploitation(Rex) library for parsing Java serialized streams.}
+  spec.homepage      = "https://github.com/rapid7/rex-java"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 1.12"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rspec", "~> 3.0"
+end

metadata

@@ -0,0 +1,199 @@
+--- !ruby/object:Gem::Specification
+name: rex-java
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- dmohanty-r7
+autorequire: 
+bindir: exe
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
+  A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+  b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
+  MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+  YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
+  aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
+  jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
+  xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
+  1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
+  snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
+  U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
+  9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
+  BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
+  AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
+  yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
+  38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
+  AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
+  DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
+  HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
+  -----END CERTIFICATE-----
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIEKDCCAxCgAwIBAgILBAAAAAABL07hNVwwDQYJKoZIhvcNAQEFBQAwVzELMAkG
+  A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+  b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw0xMTA0MTMxMDAw
+  MDBaFw0xOTA0MTMxMDAwMDBaMFExCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+  YWxTaWduIG52LXNhMScwJQYDVQQDEx5HbG9iYWxTaWduIENvZGVTaWduaW5nIENB
+  IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCyTxTnEL7XJnKr
+  NpfvU79ChF5Y0Yoo/ENGb34oRFALdV0A1zwKRJ4gaqT3RUo3YKNuPxL6bfq2RsNq
+  o7gMJygCVyjRUPdhOVW4w+ElhlI8vwUd17Oa+JokMUnVoqni05GrPjxz7/Yp8cg1
+  0DB7f06SpQaPh+LO9cFjZqwYaSrBXrta6G6V/zuAYp2Zx8cvZtX9YhqCVVrG+kB3
+  jskwPBvw8jW4bFmc/enWyrRAHvcEytFnqXTjpQhU2YM1O46MIwx1tt6GSp4aPgpQ
+  STic0qiQv5j6yIwrJxF+KvvO3qmuOJMi+qbs+1xhdsNE1swMfi9tBoCidEC7tx/0
+  O9dzVB/zAgMBAAGjgfowgfcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
+  Af8CAQAwHQYDVR0OBBYEFAhu2Lacir/tPtfDdF3MgB+oL1B6MEcGA1UdIARAMD4w
+  PAYEVR0gADA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNv
+  bS9yZXBvc2l0b3J5LzAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmdsb2Jh
+  bHNpZ24ubmV0L3Jvb3QuY3JsMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQY
+  MBaAFGB7ZhpFDZfKiVAvfQTNNKj//P1LMA0GCSqGSIb3DQEBBQUAA4IBAQAiXMXd
+  PfQLcNjj9efFjgkBu7GWNlxaB63HqERJUSV6rg2kGTuSnM+5Qia7O2yX58fOEW1o
+  kdqNbfFTTVQ4jGHzyIJ2ab6BMgsxw2zJniAKWC/wSP5+SAeq10NYlHNUBDGpeA07
+  jLBwwT1+170vKsPi9Y8MkNxrpci+aF5dbfh40r5JlR4VeAiR+zTIvoStvODG3Rjb
+  88rwe8IUPBi4A7qVPiEeP2Bpen9qA56NSvnwKCwwhF7sJnJCsW3LZMMSjNaES2dB
+  fLEDF3gJ462otpYtpH6AA0+I98FrWkYVzSwZi9hwnOUtSYhgcqikGVJwQ17a1kYD
+  sGgOJO9K9gslJO8k
+  -----END CERTIFICATE-----
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIEyjCCA7KgAwIBAgISESEyE8rNriS4+1dc8jOHEUL8MA0GCSqGSIb3DQEBBQUA
+  MFExCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMScwJQYD
+  VQQDEx5HbG9iYWxTaWduIENvZGVTaWduaW5nIENBIC0gRzIwHhcNMTMxMDExMTUx
+  NTM4WhcNMTYxMDExMTUxNTM4WjBgMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFz
+  c2FjaHVzZXR0czEPMA0GA1UEBxMGQm9zdG9uMRMwEQYDVQQKEwpSYXBpZDcgTExD
+  MRMwEQYDVQQDEwpSYXBpZDcgTExDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+  CgKCAQEAhD//7+739c69hssg0mD6CXgf2JkuWTcU81dgD7aKcoEPqU8e1FseBvDW
+  /Q5fNK2H2NgHV/Msn18zXuK0PkaJXqj/vDsuKB3Hq0BiR2AwyDdEw8K5MK5bgQc2
+  tmcVtEAejRoy1Uv5UyfaAYAxG6zsma3buV1fjnEAC3VouRg4+EX/f65H/a6srntK
+  5Etp3D71k2f0oUl8dOqOmSsRJQQ5zSs4ktDvpjAmsvzoA+1svceLYU95mvQsIw2T
+  edpmibGMwGw/HmgV+YWBgF5UGvax6zbC2i6DF2YHnDfkNb8/1MEIaxOTAbJTazTK
+  8laCQOyay6L1BNPQKjZBgOge8LZq1wIDAQABo4IBizCCAYcwDgYDVR0PAQH/BAQD
+  AgeAMEwGA1UdIARFMEMwQQYJKwYBBAGgMgEyMDQwMgYIKwYBBQUHAgEWJmh0dHBz
+  Oi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMAkGA1UdEwQCMAAwEwYD
+  VR0lBAwwCgYIKwYBBQUHAwMwPgYDVR0fBDcwNTAzoDGgL4YtaHR0cDovL2NybC5n
+  bG9iYWxzaWduLmNvbS9ncy9nc2NvZGVzaWduZzIuY3JsMIGGBggrBgEFBQcBAQR6
+  MHgwQAYIKwYBBQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2Fj
+  ZXJ0L2dzY29kZXNpZ25nMi5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwMi5n
+  bG9iYWxzaWduLmNvbS9nc2NvZGVzaWduZzIwHQYDVR0OBBYEFE536JwFx9SpaEi3
+  w8pcq2GRFA5BMB8GA1UdIwQYMBaAFAhu2Lacir/tPtfDdF3MgB+oL1B6MA0GCSqG
+  SIb3DQEBBQUAA4IBAQAGpGXHtFLjTTivV+xQPwtZhfPuJ7f+VGTMSAAYWmfzyHXM
+  YMFYUWJzSFcuVR2YfxtbS45P7U5Qopd7jBQ0Ygk5h2a+B5nE4+UlhHj665d0zpYM
+  1eWndMaO6WBOYnqtNyi8Dqqc1foKZDNHEDggYhGso7OIBunup+N4sPL9PwQ3eYe6
+  mUu8z0E4GXYViaMPOFkqaYnoYgf2L+7L5zKYT4h/NE/P7kj7EbduHgy/v/aAIrNl
+  2SpuQH+SWteq3NXkAmFEEqvLJQ4sbptZt8OP8ghL3pVAvZNFmww/YVszSkShSzcg
+  QdihYCSEL2drS2cFd50jBeq71sxUtxbv82DUa2b+
+  -----END CERTIFICATE-----
+date: 2016-06-27 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.12'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: Ruby Exploitation(Rex) library for parsing Java serialized streams.
+email:
+- Dev_Mohanty@rapid7.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- CODE_OF_CONDUCT.md
+- Gemfile
+- README.md
+- Rakefile
+- bin/console
+- bin/setup
+- lib/rex/java.rb
+- lib/rex/java/serialization.rb
+- lib/rex/java/serialization/builder.rb
+- lib/rex/java/serialization/decode_error.rb
+- lib/rex/java/serialization/encode_error.rb
+- lib/rex/java/serialization/model.rb
+- lib/rex/java/serialization/model/annotation.rb
+- lib/rex/java/serialization/model/block_data.rb
+- lib/rex/java/serialization/model/block_data_long.rb
+- lib/rex/java/serialization/model/class_desc.rb
+- lib/rex/java/serialization/model/contents.rb
+- lib/rex/java/serialization/model/element.rb
+- lib/rex/java/serialization/model/end_block_data.rb
+- lib/rex/java/serialization/model/field.rb
+- lib/rex/java/serialization/model/long_utf.rb
+- lib/rex/java/serialization/model/new_array.rb
+- lib/rex/java/serialization/model/new_class.rb
+- lib/rex/java/serialization/model/new_class_desc.rb
+- lib/rex/java/serialization/model/new_enum.rb
+- lib/rex/java/serialization/model/new_object.rb
+- lib/rex/java/serialization/model/null_reference.rb
+- lib/rex/java/serialization/model/proxy_class_desc.rb
+- lib/rex/java/serialization/model/reference.rb
+- lib/rex/java/serialization/model/reset.rb
+- lib/rex/java/serialization/model/stream.rb
+- lib/rex/java/serialization/model/utf.rb
+- lib/rex/java/version.rb
+- rex-java.gemspec
+homepage: https://github.com/rapid7/rex-java
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.8
+signing_key: 
+specification_version: 4
+summary: Rex library for parsing serialized Java streams.
+test_files: []

metadata.gz.sig

@@ -0,0 +1 @@
+x���n�G�'�ih0��yNL�uMg-��r�ظ�ܶ��
B���6�8�y��c�
��c�{�7�_t}i�˶���+G��xp���\`�?��ʻi�����Mif��)���#_Z������Q۴J�~�y�R�݆'u��0�oP�