rex 1.0.2 → 2.0.2

data/lib/rex/parser/retina_xml.rb

@@ -0,0 +1,110 @@
+# -*- coding: binary -*-
+module Rex
+module Parser
+
+# XXX - Retina XML does not include ANY service/port information export
+class RetinaXMLStreamParser
+
+  attr_accessor :on_found_host
+
+  def initialize(on_found_host = nil)
+    reset_state
+    self.on_found_host = on_found_host if on_found_host
+  end
+
+  def reset_state
+    @state = :generic_state
+    @host  = { 'vulns' => [] }
+    reset_audit_state
+  end
+
+  def reset_audit_state
+    @audit = { 'refs' => [] }
+  end
+
+  def tag_start(name, attributes)
+    @state = "in_#{name.downcase}".intern
+  end
+
+  def text(str)
+    case @state
+    when :in_ip
+      @host["address"] = str
+    when :in_dnsname
+      @host["hostname"] = str.split(/\s+/).first
+    when :in_netbiosname
+      @host["netbios"] = str
+    when :in_mac
+      @host["mac"] = str
+    when :in_os
+      @host["os"] = str
+    when :in_rthid
+      @audit['refs'].push(['RETINA', str])
+    when :in_cve
+      str.split(",").each do |cve|
+        cve = cve.to_s.strip
+        next if cve.empty?
+        pre,val = cve.split('-', 2)
+        next if not val
+        next if pre != "CVE"
+        @audit['refs'].push( ['CVE', val] )
+      end
+    when :in_name
+      @audit['name'] = str
+    when :in_description
+      @audit['description'] = str
+    when :in_risk
+      @audit['risk'] = str
+    when :in_cce
+      @audit['cce'] = str
+    when :in_date
+      @audit['data'] = str
+    end
+  end
+
+  def tag_end(name)
+    case name
+    when "host"
+      on_found_host.call(@host) if on_found_host
+      reset_state
+    when "audit"
+      @host['vulns'].push @audit
+      reset_audit_state
+    end
+  end
+
+  # We don't need these methods, but they're necessary to keep REXML happy
+  def xmldecl(version, encoding, standalone); end
+  def cdata; end
+  def comment(str); end
+  def instruction(name, instruction); end
+  def attlist; end
+end
+end
+end
+
+__END__
+<scanJob>
+  <hosts>
+    <host>
+      <ip>10.2.79.98</ip>
+      <netBIOSName>bsmith-10156B07C</netBIOSName>
+      <dnsName>bsmith-10156b07c.core.testcorp.com  random.testcorp.com</dnsName>
+      <mac>00:02:29:0E:38:2B</mac>
+      <os>Windows Server 2003 (X64), Service Pack 2</os>
+      <audit>
+        <rthID>7851</rthID>
+        <cve>CVE-2009-0089,CVE-2009-0550,CVE-2009-0086</cve>
+        <cce>N/A</cce>
+        <name>Microsoft Windows HTTP Services Multiple Vulnerabilities (960803)</name>
+        <description>Microsoft Windows HTTP Services contains multiple vulnerabilities when handling ..</description>
+        <date>09/15/2010</date>
+        <risk>Low</risk>
+        <pciLevel>5 (Urgent)</pciLevel>
+        <cvssScore>10 [AV:N/AC:L/Au:N/C:C/I:C/A:C]</cvssScore>
+        <fixInformation>....</fixInformation>
+      </audit>
+    </host>
+  </hosts>
+</scanJob>
+

data/lib/rex/parser/unattend.rb

@@ -0,0 +1,171 @@
+# -*- coding: binary -*-
+
+module Rex
+module Parser
+
+# This is a parser for the Windows Unattended Answer File
+# format. It's used by modules/post/windows/gather/enum_unattend.rb
+# and uses REXML (as opposed to Nokogiri) for its XML parsing.
+# See: http://technet.microsoft.com/en-us/library/ff715801
+#      http://technet.microsoft.com/en-us/library/cc749415(v=ws.10).aspx
+# Samples: http://technet.microsoft.com/en-us/library/cc732280%28v=ws.10%29.aspx
+class Unattend
+  
+  require 'rex/text'
+
+  def self.parse(xml)
+    return [] if xml.nil?
+    results = []
+    unattend = xml.elements['unattend']
+    return [] if unattend.nil?
+    unattend.each_element do |settings|
+        next if settings.class != REXML::Element
+        settings.get_elements('component').each do |c|
+          next if c.class != REXML::Element
+          results << extract_useraccounts(c.elements['UserAccounts'])
+          results << extract_autologon(c.elements['AutoLogon'])
+          results << extract_deployment(c.elements['WindowsDeploymentServices'])
+          results << extract_domain_join(c.elements['Identification/Credentials'])
+        end
+      end
+    return results.flatten
+  end
+
+  #
+  # Extract sensitive data from Deployment Services.
+  # We can only seem to add one <Login> with Windows System Image Manager, so
+  # we'll only enum one.
+  #
+  def self.extract_deployment(deployment)
+    return [] if deployment.nil?
+    domain    = deployment.elements['Login/Credentials/Domain'].get_text.value rescue ''
+    username  = deployment.elements['Login/Credentials/Username'].get_text.value rescue ''
+    password  = deployment.elements['Login/Credentials/Password'].get_text.value rescue ''
+    plaintext = deployment.elements['Login/Credentials/Password/PlainText'].get_text.value rescue 'true'
+
+    if plaintext == 'false'
+      password = Rex::Text.decode_base64(password)
+      password = password.gsub(/#{Rex::Text.to_unicode('Password')}$/, '')
+    end
+
+    return {'type' => 'wds', 'domain' => domain, 'username' => username, 'password' => password }
+  end
+
+  #
+  # Extract sensitive data from 'Secure' Domain Join
+  #
+  def self.extract_domain_join(credentials)
+    return [] if credentials.nil?
+    domain    = credentials.elements['Domain'].get_text.value rescue ''
+    username  = credentials.elements['Username'].get_text.value rescue ''
+    password  = credentials.elements['Password'].get_text.value rescue ''
+
+    return {'type' => 'domain_join', 'domain' => domain, 'username' => username, 'password' => password }
+  end
+
+  #
+  # Extract sensitive data from AutoLogon
+  #
+  def self.extract_autologon(auto_logon)
+    return [] if auto_logon.nil?
+
+    domain    = auto_logon.elements['Domain'].get_text.value rescue ''
+    username  = auto_logon.elements['Username'].get_text.value rescue ''
+    password  = auto_logon.elements['Password/Value'].get_text.value rescue ''
+    plaintext = auto_logon.elements['Password/PlainText'].get_text.value rescue 'true'
+
+    if plaintext == 'false'
+      password = Rex::Text.decode_base64(password)
+      password = password.gsub(/#{Rex::Text.to_unicode('Password')}$/, '')
+    end
+
+    return {'type' => 'auto', 'domain' => domain, 'username' => username, 'password' => password }
+  end
+
+  #
+  # Extract sensitive data from UserAccounts
+  #
+  def self.extract_useraccounts(user_accounts)
+    return[] if user_accounts.nil?
+
+    results = []
+    account_types = ['AdministratorPassword', 'DomainAccounts', 'LocalAccounts']
+    account_types.each do |t|
+      element = user_accounts.elements[t]
+      next if element.nil?
+
+      case t
+      #
+      # Extract the password from AdministratorPasswords
+      #
+      when account_types[0]
+        password = element.elements['Value'].get_text.value rescue ''
+        plaintext = element.elements['PlainText'].get_text.value rescue 'true'
+
+        if plaintext == 'false'
+          password = Rex::Text.decode_base64(password)
+          password = password.gsub(/#{Rex::Text.to_unicode('AdministratorPassword')}$/, '')
+        end
+
+        unless password.empty?
+          results << {'type' => 'admin', 'username' => 'Administrator', 'password' => password}
+        end
+
+      #
+      # Extract the sensitive data from DomainAccounts.
+      # According to MSDN, unattend.xml doesn't seem to store passwords for domain accounts
+      #
+      when account_types[1]  #DomainAccounts
+        element.elements.each do |account_list|
+          name = account_list.elements['DomainAccount/Name'].get_text.value rescue ''
+          group = account_list.elements['DomainAccount/Group'].get_text.value rescue 'true'
+
+          results << {'type' => 'domain', 'username' => name, 'group' => group}
+        end
+      #
+      # Extract the username/password from LocalAccounts
+      #
+      when account_types[2]  #LocalAccounts
+        element.elements.each do |local|
+          password = local.elements['Password/Value'].get_text.value rescue ''
+          plaintext = local.elements['Password/PlainText'].get_text.value rescue 'true'
+
+          if plaintext == 'false'
+            password = Rex::Text.decode_base64(password)
+            password = password.gsub(/#{Rex::Text.to_unicode('Password')}$/, '')
+          end
+
+          username = local.elements['Name'].get_text.value rescue ''
+          results << {'type' => 'local', 'username' => username, 'password' => password}
+        end
+      end
+    end
+
+    return results
+  end
+
+  def self.create_table(results)
+    return nil if results.nil? or results.empty?
+    table = Rex::Ui::Text::Table.new({
+      'Header' => 'Unattend Credentials',
+      'Indent' => 1,
+      'Columns' => ['Type', 'Domain', 'Username', 'Password', 'Groups']
+    })
+
+    results.each do |result|
+      case result['type']
+        when 'wds', 'auto', 'domain_join'
+          table << [result['type'], result['domain'], result['username'], result['password'], ""]
+        when 'admin', 'local'
+          table << [result['type'], "", result['username'], result['password'], ""]
+        when 'domain'
+          table << [result['type'], "", result['username'], "", result['group']]
+      end
+    end
+
+    return table
+  end
+end
+end
+end
+

data/lib/rex/parser/wapiti_nokogiri.rb

@@ -0,0 +1,105 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+  module Parser
+
+  load_nokogiri && class WapitiDocument < Nokogiri::XML::SAX::Document
+
+    include NokogiriDocMixin
+
+    def start_element(name=nil,attrs=[])
+      attrs = normalize_attrs(attrs)
+      block = @block
+      @state[:current_tag][name] = true
+
+      case name
+      when "timestamp"
+        @state[:has_text] = true
+      when "url"
+        @state[:has_text] = true
+      when "addr"
+        @state[:has_text] = true
+      when "port"
+        @state[:has_text] = true
+      when "parameter"
+        @state[:has_text] = true
+      when "info"
+        @state[:has_text] = true
+      when "description"
+        @state[:has_text] = true
+      when "solution"
+        @state[:has_text] = true
+      when "title"
+        @state[:has_text] = true
+      end
+    end
+
+    def end_element(name=nil)
+      block = @block
+      case name
+      when "timestamp"
+        @state[:timestamp] = @text.strip
+        @text = nil
+      when "url"
+        @state[:url] = @text.strip
+        @text = nil
+      when "addr"
+        @state[:host] = @text.strip
+        @text = nil
+      when "port"
+        @state[:port] = @text.strip
+        @text = nil
+      when "parameter"
+        @state[:parameter] = @text.strip
+        @text = nil
+      when "info"
+        @state[:info] = @text.strip
+        @text = nil
+      when "bug"
+        report_vuln
+      end
+    end
+
+    def report_vuln(&block)
+      proto = @state[:url].split(":")[0]
+      path = '/' + (@state[:url].split("/")[3..(@state[:url].split("/").length - 1)].join('/'))
+
+      web_vuln_info = {}
+      web_vuln_info[:web_site] = proto + "://" + @state[:host] + ":" + @state[:port]
+      web_vuln_info[:path] = path
+      web_vuln_info[:query] = @state[:url].split("?")[1]
+
+      #if the URL contains the parameter found to be vulnerable, it is probably a GET
+      #if it does not contains the parameter, it is probably a POST
+      if @state[:url].index(@state[:parameter])
+        web_vuln_info[:method] = "GET"
+      else
+        web_vuln_info[:method] = "POST"
+      end
+
+      @state[:parameter].split("&").each do |param|
+        if param.index("%27") #apostrophe
+          web_vuln_info[:pname] = param.split('=')[0] #sql injection
+          break
+        elsif param.index("alert")
+          web_vuln_info[:pname] = param.split('=')[0] #xss
+        end
+      end
+
+      web_vuln_info[:host] = @state[:host]
+      web_vuln_info[:port] = @state[:port]
+      web_vuln_info[:ssl] = (proto =~ /https/)
+      web_vuln_info[:proof] = ""
+      web_vuln_info[:risk] = ""
+      web_vuln_info[:params] = @state[:parameter]
+      web_vuln_info[:category] = "imported"
+      web_vuln_info[:confidence] = 90
+      web_vuln_info[:name] = @state[:info]
+
+      db.emit(:web_vuln, web_vuln_info[:name], &block) if block
+      vuln = db_report(:web_vuln, web_vuln_info)
+    end
+  end
+end
+end

data/lib/rex/payloads.rb

@@ -0,0 +1,2 @@
+# -*- coding: binary -*-
+require 'rex/payloads/win32'

data/lib/rex/payloads/win32.rb

@@ -0,0 +1,3 @@
+# -*- coding: binary -*-
+require 'rex/payloads/win32/common'
+require 'rex/payloads/win32/kernel'

data/lib/rex/payloads/win32/common.rb

@@ -0,0 +1,27 @@
+# -*- coding: binary -*-
+module Rex
+module Payloads
+module Win32
+
+module Common
+
+  #
+  # Returns a stub that resolves the location of a symbol and then
+  # calls it.  Refer to the following link for more details:
+  #
+  # http://uninformed.org/index.cgi?v=3&a=4&p=10
+  #
+  def self.resolve_call_sym
+    "\x60\x31\xc9\x8b\x7d\x3c\x8b\x7c\x3d\x78\x01\xef\x8b" +
+    "\x57\x20\x01\xea\x8b\x34\x8a\x01\xee\x31\xc0\x99\xac" +
+    "\xc1\xca\x0d\x01\xc2\x84\xc0\x75\xf6\x41\x66\x39\xda" +
+    "\x75\xe3\x49\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b" +
+    "\x5f\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c" +
+    "\x61\xff\xe0"
+  end
+
+end
+
+end
+end
+end

data/lib/rex/payloads/win32/kernel.rb

@@ -0,0 +1,54 @@
+# -*- coding: binary -*-
+module Rex
+module Payloads
+module Win32
+
+require 'rex/payloads/win32/kernel/common'
+require 'rex/payloads/win32/kernel/recovery'
+require 'rex/payloads/win32/kernel/stager'
+require 'rex/payloads/win32/kernel/migration'
+
+module Kernel
+
+  #
+  # Constructs a kernel-mode payload using the supplied options.  The options
+  # can be:
+  #
+  # Recovery      : The recovery method to use, such as 'spin'.
+  # Stager        : The stager method to use, such as 'sud_syscall_hook'.
+  # RecoveryStub  : The recovery stub that should be used, if any.
+  # UserModeStub  : The user-mode payload to execute, if any.
+  # KernelModeStub: The kernel-mode payload to execute, if any.
+  #
+  def self.construct(opts = {})
+    payload = nil
+
+    # Generate the recovery stub
+    if opts['Recovery'] and Kernel::Recovery.respond_to?(opts['Recovery'])
+      opts['RecoveryStub'] = Kernel::Recovery.send(opts['Recovery'], opts)
+    end
+
+    # Append supplied recovery stub information in case there is some
+    # context specific recovery that must be done.
+    if opts['AppendRecoveryStub']
+      opts['RecoveryStub'] = (opts['RecoveryStub'] || '') + opts['AppendRecoveryStub']
+    end
+
+    # Generate the stager
+    if opts['Stager'] and Kernel::Stager.respond_to?(opts['Stager'])
+      payload = Kernel::Stager.send(opts['Stager'], opts)
+    # Or, generate the migrator
+    elsif opts['Migrator'] and Kernel::Migration.respond_to?(opts['Migrator'])
+      payload = Kernel::Migration.send(opts['Migrator'], opts)
+    else
+      raise ArgumentError, "A stager or a migrator must be specified."
+    end
+
+    payload
+  end
+
+end
+
+end
+end
+end