rex 1.0.2 → 2.0.2

data/lib/rex/parser/arguments.rb

@@ -0,0 +1,108 @@
+# -*- coding: binary -*-
+require 'shellwords'
+
+module Rex
+module Parser
+
+###
+#
+# This class parses arguments in a getopt style format, kind of.
+# Unfortunately, the default ruby getopt implementation will only
+# work on ARGV, so we can't use it.
+#
+###
+class Arguments
+
+  #
+  # Specifies that an option is expected to have an argument
+  #
+  HasArgument = (1 << 0)
+
+  #
+  # Initializes the format list with an array of formats like:
+  #
+  # Arguments.new(
+  #    '-b' => [ false, "some text" ]
+  # )
+  #
+  def initialize(fmt)
+    self.fmt = fmt
+    # I think reduce is a better name for this method, but it doesn't exist
+    # before 1.8.7, so use the stupid inject instead.
+    self.longest = fmt.keys.inject(0) { |max, str|
+      max = ((max > str.length) ? max : str.length)
+    }
+  end
+
+  #
+  # Takes a string and converts it into an array of arguments.
+  #
+  def self.from_s(str)
+    Shellwords.shellwords(str)
+  end
+
+  #
+  # Parses the supplied arguments into a set of options.
+  #
+  def parse(args, &block)
+    skip_next = false
+
+    args.each_with_index { |arg, idx|
+      if (skip_next == true)
+        skip_next = false
+        next
+      end
+
+      if (arg.match(/^-/))
+        cfs = arg[0..2]
+
+        fmt.each_pair { |fmtspec, val|
+          next if (fmtspec != cfs)
+
+          param = nil
+
+          if (val[0])
+            param = args[idx+1]
+            skip_next = true
+          end
+
+          yield fmtspec, idx, param
+        }
+      else
+        yield nil, idx, arg
+      end
+    }
+  end
+
+  #
+  # Returns usage information for this parsing context.
+  #
+  def usage
+    txt = "\nOPTIONS:\n\n"
+
+    fmt.sort.each { |entry|
+      fmtspec, val = entry
+
+      txt << "    #{fmtspec.ljust(longest)}" + ((val[0] == true) ? " <opt>  " : "        ")
+      txt << val[1] + "\n"
+    }
+
+    txt << "\n"
+
+    return txt
+  end
+  def include?(search)
+    return fmt.include?(search)
+  end
+
+  def arg_required?(opt)
+    fmt[opt][0] if fmt[opt]
+  end
+
+  attr_accessor :fmt     # :nodoc:
+  attr_accessor :longest # :nodoc:
+
+end
+
+end
+end

data/lib/rex/parser/burp_session_nokogiri.rb

@@ -0,0 +1,291 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+  module Parser
+
+    # If Nokogiri is available, define Burp Session document class.
+    #
+    # Burp Session XML files actually provide a lot, but since it also
+    # provides the originating url, we can pull most of the detail from
+    # the URI object.
+    load_nokogiri && class BurpSessionDocument < Nokogiri::XML::SAX::Document
+
+    include NokogiriDocMixin
+
+    # The resolver prefers your local /etc/hosts (or windows equiv), but will
+    # fall back to regular DNS. It retains a cache for the import to avoid
+    # spamming your network with DNS requests.
+    attr_reader :resolv_cache
+
+    # Since we try to resolve every time we hit a new web page, need to
+    # hang on to our misses. Presume that it's a permanent enough failure
+    # that it won't get fixed during this particular import
+    attr_reader :missed_cache
+
+    # If name resolution of the host fails out completely, you will not be
+    # able to import that Scan task. Other scan tasks in the same report
+    # should be unaffected.
+    attr_reader :parse_warning
+
+    def start_document
+      @parse_warnings = []
+      @parse_warned = []
+      @resolv_cache = {}
+      @missed_cache = []
+    end
+
+    def start_element(name=nil,attrs=[])
+      attrs = normalize_attrs(attrs)
+      block = @block
+      @state[:current_tag][name] = true
+      case name
+      when "host", "port", "protocol", "path"
+        @state[:has_text] = true
+      when "status"
+        @state[:has_text] = true
+      when "response"
+        @state[:has_text] = true
+      end
+    end
+
+    def end_element(name=nil)
+      block = @block
+      case name
+      when "item" # Wrap up this item, but keep resolved web sites
+        collect_uri
+        report_web_site(&block)
+        handle_parse_warnings(&block)
+        report_web_page(&block)
+        report_web_service_info
+        report_web_host_info
+        # Reset the state once we close a host
+        @state = @state.select {|k| [:current_tag, :web_sites].include? k}
+      when "host"
+        @state[:has_text] = false
+        collect_host
+        @text = nil
+      when "port"
+        @state[:has_text] = false
+        collect_port
+        @text = nil
+      when "protocol"
+        @state[:has_text] = false
+        collect_protocol
+        @text = nil
+      when "path"
+        @state[:has_text] = false
+        collect_path_and_query
+        @text = nil
+      when "status"
+        @state[:has_text] = false
+        collect_status
+        @text = nil
+      when "response"
+        @state[:has_text] = false
+        collect_response
+        @text = nil
+      end
+      @state[:current_tag].delete name
+    end
+
+    def collect_host
+      return unless in_item
+      return unless has_text
+      @state[:host] = @text
+    end
+
+    def collect_port
+      return unless in_item
+      return unless has_text
+      return unless @text.to_i.to_s == @text.to_s
+      @state[:port] = @text.to_i
+    end
+
+    def collect_protocol
+      return unless in_item
+      return unless has_text
+      @state[:protocol] = @text
+    end
+
+    def collect_path_and_query
+      return unless in_item
+      return unless has_text
+      path,query = @text.split(/\?+/,2)
+      return unless path
+      if query
+        @state[:query] = "?#{query}" # Can be nil
+      end
+      if path =~ /https?:[\x5c\x2f][\x5c\x2f]+[^\x5c\x2f][^\x5c\x2f]+([^?]+)/n
+        real_path = "/#{$1}"
+      else
+        real_path = path
+      end
+      @state[:path] = real_path
+    end
+
+    def collect_status
+      return unless in_item
+      return unless has_text
+      return unless @text.to_i.to_s == @text
+      @state[:status] = @text.to_i
+    end
+
+    def collect_uri
+      return unless in_item
+      return unless @state[:host]
+      return unless @state[:port]
+      return unless @state[:protocol]
+      return unless @state[:path]
+      url = @state[:protocol].to_s
+      url << "://"
+      url << @state[:host].to_s
+      url << ":"
+      url << @state[:port].to_s
+      url << @state[:path]
+      if @state[:query]
+        url << "?"
+        url << @state[:query]
+      end
+      @state[:uri] = URI.parse(url) rescue nil
+    end
+
+    def report_web_host_info
+      return unless @state[:web_site]
+      return unless @state[:uri].kind_of? URI::HTTP
+      return unless @state[:web_site].service.host.name.to_s.empty?
+      host_info = {:workspace => @args[:wspace]}
+      host_info[:address] = @state[:web_site].service.host.address
+      host_info[:name] = @state[:uri].host
+      report_db(:host, host_info)
+    end
+
+    def report_web_service_info
+      return unless @state[:web_site]
+      return unless @state[:service_info]
+      return unless @state[:web_site].service.info.to_s.empty?
+      service_info = {}
+      service_info[:host] = @state[:web_site].service.host
+      service_info[:port] = @state[:web_site].service.port
+      service_info[:proto] = @state[:web_site].service.proto
+      service_info[:info] = @state[:service_info]
+      db_report(:service, service_info)
+    end
+
+    def report_web_page(&block)
+      return unless @state[:uri].kind_of? URI::HTTP
+      return unless @state[:status]
+      return unless @state[:web_site]
+      return unless @state[:response_headers].kind_of? Hash
+      headers = {}
+      @state[:response_headers].each do |k,v|
+        headers[k.to_s.downcase] ||= []
+        headers[k.to_s.downcase] << v
+      end
+      if headers["server"].kind_of? Array
+        @state[:service_info] = headers["server"].first
+      end
+      return unless @state[:response_body]
+      web_page_info = {:workspace => @args[:wspace]}
+      web_page_info[:web_site] = @state[:web_site]
+      web_page_info[:code] = @state[:status]
+      web_page_info[:path] = @state[:uri].path
+      web_page_info[:headers] = headers
+      web_page_info[:body] = @state[:response_body]
+      web_page_info[:query] = @state[:uri].query
+      url = @state[:uri].to_s.gsub(/\?.*/,"")
+      db.emit(:web_page, url, &block) if block
+      db_report(:web_page, web_page_info)
+    end
+
+    def report_web_site(&block)
+      return unless @state[:uri].kind_of? URI::HTTP
+      vhost = @state[:uri].host
+      web_site_info = {:workspace => @args[:wspace]}
+      web_site_info[:vhost] = vhost
+      address = resolve_vhost_address(@state[:uri])
+      return unless address
+      web_site_info[:host] = address
+      web_site_info[:port] = @state[:uri].port
+      web_site_info[:ssl]  = @state[:uri].kind_of? URI::HTTPS
+      web_site_obj = db_report(:web_site, web_site_info)
+      return unless web_site_obj
+      @state[:web_sites] ||= []
+      url = "#{@state[:uri].scheme}://#{@state[:uri].host}:#{@state[:uri].port}"
+      unless @state[:web_sites].include? web_site_obj
+        db.emit(:web_site, url, &block)
+        @state[:web_sites] << web_site_obj
+      end
+      @state[:web_site] = web_site_obj
+    end
+
+    def collect_response
+      return unless in_item
+      return unless has_text
+      response_text = @text.dup
+      response_header_text,response_body_text = response_text.split(/\r*\n\r*\n/n,2)
+      return unless response_header_text
+      response_header = Rex::Proto::Http::Packet::Header.new
+      response_header.from_s response_header_text
+      @state[:response_headers] = response_header
+      @state[:response_body] = response_body_text
+    end
+
+    def in_item
+      return false unless in_tag("item")
+      return false unless in_tag("items")
+      return true
+    end
+
+    def has_text
+      return false unless @text
+      return false if @text.strip.empty?
+      @text = @text.strip
+    end
+
+    def handle_parse_warnings(&block)
+      return if @parse_warnings.empty?
+      return unless block
+      @parse_warnings.each_with_index do |pwarn,i|
+        unless @parse_warned.include? i
+          db.emit(:warning, pwarn, &block)
+          @parse_warned << i
+        end
+      end
+    end
+
+    def resolve_address(host)
+      return @resolv_cache[host] if @resolv_cache[host]
+      return false if @missed_cache.include? host
+      address = Rex::Socket.resolv_to_dotted(host) rescue nil
+      @resolv_cache[host] = address
+      if address
+        block = @block
+        db.emit(:address, address, &block) if block
+      else
+        @missed_cache << host
+      end
+      return address
+    end
+
+    # Alias this
+    def resolve_vhost_address(uri)
+      if uri.host
+        address = resolve_address(uri.host)
+        case address
+        when false
+          return false
+        when nil
+          @parse_warnings << "Could not resolve address for '#{uri.host}', skipping."
+        end
+      else
+        @parse_warnings << "Could not determine a host for this import."
+      end
+      address
+    end
+
+  end
+
+end
+end
+

data/lib/rex/parser/ci_nokogiri.rb

@@ -0,0 +1,193 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+require 'msf/core'
+
+module Rex
+  module Parser
+
+    # If Nokogiri is available, define the document class.
+    load_nokogiri && class CIDocument < Nokogiri::XML::SAX::Document
+
+    include NokogiriDocMixin
+
+    attr_reader :text
+
+    def initialize(*args)
+      super(*args)
+      @state[:has_text] = true
+    end
+
+    # Triggered every time a new element is encountered. We keep state
+    # ourselves with the @state variable, turning things on when we
+    # get here (and turning things off when we exit in end_element()).
+    def start_element(name=nil,attrs=[])
+      attrs = normalize_attrs(attrs)
+      block = @block
+
+      r = { :e => name }
+      attrs.each { |pair| r[pair[0]] = pair[1] }
+
+      if @state[:path]
+        @state[:path].push r
+      end
+
+      case name
+      when "entity"
+        @state[:path] = [ r ]
+        record_device(r)
+      when "property"
+        return if not @state[:address]
+        return if not @state[:props]
+        @state[:props] << [ r["type"], r["key"]]
+      end
+    end
+
+    # When we exit a tag, this is triggered.
+    def end_element(name=nil)
+      block = @block
+      case name
+      when "entity" # Wrap it up
+        if @state[:address]
+          host_object = report_host &block
+          report_services(host_object)
+          report_vulns(host_object)
+        end
+        # Reset the state once we close a host
+        @report_data = {:wspace => @args[:wspace]}
+        @state[:root] = {}
+      when "property"
+        if @state[:props]
+          @text.strip! if @text
+          process_property
+          @state[:props].pop
+        end
+      end
+      @state[:path].pop
+      @text = nil
+    end
+
+    def record_device(info)
+      if info["class"] and info["class"] == "host" and info["name"]
+        address = info["name"].to_s.gsub(/^.*\//, '')
+        return if address !~ /^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/
+        @state[:address] = address
+        @state[:props]   = []
+      end
+    end
+
+    def process_property
+      return if not @state[:props]
+      return if not @state[:props].length > 0
+      @state[:root] ||= {}
+      @cobj = @state[:root]
+      property_parser(0)
+    end
+
+    def property_parser(idx)
+      return if not @state[:props][idx]
+      case @state[:props][idx][0]
+      when "container", "ports", "entity", "properties"
+        @cobj[ @state[:props][idx][1] ] ||= {}
+        @cobj = @cobj[ @state[:props][idx][1] ]
+      else
+        @cobj[ state[:props][idx][1] ] = @text
+      end
+      property_parser(idx + 1)
+    end
+
+    def report_host(&block)
+      @report_data = {
+        :ports  => [:ignore],
+        :state  => Msf::HostState::Alive,
+        :host   => @state[:address]
+      }
+
+      if @state[:root]["dns names"] and @state[:root]["dns names"].keys.length > 0
+        @report_data[:name] = @state[:root]["dns names"].keys.first
+      end
+
+      if host_is_okay
+        @report_data.delete(:ports)
+
+        db.emit(:address, @report_data[:host],&block) if block
+        host_object = db_report(:host, @report_data.merge(
+          :workspace => @args[:wspace] ) )
+        if host_object
+          db.report_import_note(host_object.workspace, host_object)
+        end
+        host_object
+      end
+    end
+
+    def report_services(host_object)
+      return unless host_object.kind_of? ::Mdm::Host
+
+      snames = {}
+      ( @state[:root]["services"] || {} ).each_pair do |sname, sinfo|
+        sinfo.each_pair do |pinfo,pdata|
+          snames[pinfo] = sname.dup
+        end
+      end
+
+      reported = []
+      if @state[:root]["tcp_ports"]
+        @state[:root]["tcp_ports"].each_pair do |pn, ps|
+          ps = "open" if ps == "listen"
+          svc = { :port => pn.to_i, :state => ps, :proto => 'tcp'}
+          if @state[:root]["Banners"] and @state[:root]["Banners"][pn.to_s]
+            svc[:info] = @state[:root]["Banners"][pn.to_s]
+          end
+          svc[:name] = snames["#{pn}-tcp"] if snames["#{pn}-tcp"]
+          reported << db_report(:service, svc.merge(:host => host_object))
+        end
+      end
+
+      if @state[:root]["udp_ports"]
+        @state[:root]["udp_ports"].each_pair do |pn, ps|
+          ps = "open" if ps == "listen"
+          svc = { :port => pn.to_i, :state => ps, :proto => 'udp'}
+          svc[:name] = snames["#{pn}-udp"] if snames["#{pn}-tcp"]
+          reported << db_report(:service, svc.merge(:host => host_object))
+        end
+      end
+
+      ( @state[:root]["services"] || {} ).each_pair do |sname, sinfo|
+        sinfo.each_pair do |pinfo,pdata|
+          sport,sproto = pinfo.split("-")
+          db_report(:note, {
+            :host => host_object,
+            :port => sport.to_i,
+            :proto => sproto,
+            :ntype => "ci.#{sname}.fingerprint",
+            :data => pdata
+          })
+        end
+      end
+
+      reported
+    end
+
+    def report_vulns(host_object)
+      vuln_count = 0
+      block = @block
+      return unless host_object.kind_of? ::Mdm::Host
+      return unless @state[:root]["Vulnerabilities"]
+      @state[:root]["Vulnerabilities"].each_pair do |cve, vinfo|
+        vinfo.each_pair do |vname, vdesc|
+          data = {
+            :workspace => host_object.workspace,
+            :host => host_object,
+            :name => vname,
+            :info => vdesc,
+            :refs => [ cve ]
+          }
+          db_report(:vuln, data)
+        end
+      end
+    end
+
+  end
+end
+end
+