rex 1.0.2 → 2.0.2

data/lib/rex/proto/dcerpc/uuid.rb

@@ -0,0 +1,85 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+class UUID
+
+
+  @@known_uuids =
+  {
+    'MGMT'      => [ 'afa8bd80-7d8a-11c9-bef4-08002b102989', '2.0' ],
+    'REMACT'    => [ '4d9f4ab8-7d1c-11cf-861e-0020af6e7c57', '0.0' ],
+    'SYSACT'    => [ '000001a0-0000-0000-c000-000000000046', '0.0' ],
+    'LSA_DS'    => [ '3919286a-b10c-11d0-9ba8-00c04fd92ef5', '0.0' ],
+    'SAMR'      => [ '12345778-1234-abcd-ef00-0123456789ac', '1.0' ],
+    'MSMQ'      => [ 'fdb3a030-065f-11d1-bb9b-00a024ea5525', '1.0' ],
+    'EVENTLOG'  => [ '82273fdc-e32a-18c3-3f78-827929dc23ea', '0.0' ],
+    'SVCCTL'    => [ '367abb81-9844-35f1-ad32-98f038001003', '2.0' ],
+    'SRVSVC'    => [ '4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0' ],
+    'PNP'       => [ '8d9f4e40-a03d-11ce-8f69-08003e30051b', '1.0' ]
+  }
+
+  # Convert a UUID in binary format to the string representation
+  def self.uuid_unpack(uuid_bin)
+    raise ArgumentError if uuid_bin.length != 16
+    sprintf("%.8x-%.4x-%.4x-%.4x-%s",
+      uuid_bin[ 0, 4].unpack('V')[0],
+      uuid_bin[ 4, 2].unpack('v')[0],
+      uuid_bin[ 6, 2].unpack('v')[0],
+      uuid_bin[ 8, 2].unpack('n')[0],
+      uuid_bin[10, 6].unpack('H*')[0]
+    )
+  end
+
+  # Validate a text based UUID
+  def self.is? (uuid_str)
+    raise ArgumentError if !uuid_str
+    if uuid_str.match(/^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$/)
+      return true
+    else
+      return false
+    end
+  end
+
+  # Convert a UUID in string format to the binary representation
+  def self.uuid_pack (uuid_str)
+    raise ArgumentError if !self.is?(uuid_str)
+    parts = uuid_str.split('-')
+    [ parts[0].hex, parts[1].hex, parts[2].hex, parts[3].hex ].pack('Vvvn') + [ parts[4] ].pack('H*')
+  end
+
+  # Provide the common TransferSyntax UUID in packed format
+  def self.xfer_syntax_uuid ()
+    self.uuid_pack('8a885d04-1ceb-11c9-9fe8-08002b104860')
+  end
+
+  # Provide the common TransferSyntax version number
+  def self.xfer_syntax_vers ()
+    '2.0'
+  end
+
+  # Determine the UUID string for the DCERPC service with this name
+  def self.uuid_by_name (name)
+    if @@known_uuids.key?(name)
+      @@known_uuids[name][0]
+    end
+  end
+
+  # Determine the common version number for the DCERPC service with this name
+  def self.vers_by_name (name)
+    if @@known_uuids.key?(name)
+      @@known_uuids[name][1]
+    end
+  end
+
+  # Convert a string or number in float format to two unique numbers 2.0 => [2, 0]
+  def self.vers_to_nums (vers)
+    vers_maj = vers.to_i
+    vers_min = ((vers.to_f - vers.to_i) * 10).to_i
+    return vers_maj, vers_min
+  end
+
+end
+end
+end
+end

data/lib/rex/proto/dcerpc/wdscp.rb

@@ -0,0 +1,3 @@
+# -*- coding: binary -*-
+require 'rex/proto/dcerpc/wdscp/constants'
+require 'rex/proto/dcerpc/wdscp/packet'

data/lib/rex/proto/dcerpc/wdscp/constants.rb

@@ -0,0 +1,89 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+module WDSCP
+# http://msdn.microsoft.com/en-us/library/dd891406(prot.20).aspx
+# http://msdn.microsoft.com/en-us/library/dd541332(prot.20).aspx
+# Not all values defined by the spec have been imported...
+class Constants
+    WDSCP_RPC_UUID		= "1A927394-352E-4553-AE3F-7CF4AAFCA620"
+    OS_DEPLOYMENT_GUID 	= "\x5a\xeb\xde\xd8\xfd\xef\xb2\x43\x99\xfc\x1a\x8a\x59\x21\xc2\x27"
+
+    VAR_NAME_ARCHITECTURE 	= "ARCHITECTURE"
+    VAR_NAME_CLIENT_GUID 	= "CLIENT_GUID"
+    VAR_NAME_CLIENT_MAC 	= "CLIENT_MAC"
+    VAR_NAME_VERSION 	= "VERSION"
+    VAR_NAME_MESSAGE_TYPE 	= "MESSAGE_TYPE"
+    VAR_NAME_TRANSACTION_ID = "TRANSACTION_ID"
+    VAR_NAME_FLAGS		= "FLAGS"
+    VAR_NAME_CC		= "CC" #Client Capabilities
+    VAR_NAME_IMDC		= "IMDC"
+
+    VAR_TYPE_LOOKUP = {
+      VAR_NAME_ARCHITECTURE 	=> :ULONG,
+      VAR_NAME_CLIENT_GUID	=> :WSTRING,
+      VAR_NAME_CLIENT_MAC	=> :WSTRING,
+      VAR_NAME_VERSION	=> :ULONG,
+      VAR_NAME_MESSAGE_TYPE	=> :ULONG,
+      VAR_NAME_TRANSACTION_ID	=> :WSTRING,
+      VAR_NAME_FLAGS		=> :ULONG,
+      VAR_NAME_CC		=> :ULONG,
+      VAR_NAME_IMDC		=> :ULONG
+    }
+
+    CC_FLAGS = {
+      :V2	=> 1,
+      :VHDX	=> 2
+    }
+
+    DOMAIN_JOIN_FLAGS = {
+      :JOIN_DOMAIN		=> 1,
+      :ACCOUNT_EXISTS		=> 2,
+      :PRESTAGE_USING_MAC	=> 3,
+      :RESET_BOOT_PROGRAM	=> 256
+    }
+
+    ARCHITECTURE = {
+      :X64 	=> 9,
+      :X86 	=> 0,
+      :IA64 	=> 6,
+      :ARM 	=> 5
+    }
+
+    PACKET_TYPE = {
+      :REQUEST 	=> 1,
+      :REPLY 		=> 2
+    }
+
+    OPCODE = {
+      :IMG_ENUMERATE 			=> 2,
+      :LOG_INIT 			=> 3,
+      :LOG_MSG 			=> 4,
+      :GET_CLIENT_UNATTEND 		=> 5,
+      :GET_UNATTEND_VARIABLES 	=> 6,
+      :GET_DOMAIN_JOIN_INFORMATION 	=> 7,
+      :RESET_BOOT_PROGRAM 		=> 8,
+      :GET_MACHINE_DRIVER_PACKAGES 	=> 200
+    }
+
+    BASE_TYPE = {
+      :BYTE		=> 0x0001,
+      :USHORT 	=> 0x0002,
+      :ULONG	 	=> 0x0004,
+      :ULONG64 	=> 0x0008,
+      :STRING 	=> 0x0010,
+      :WSTRING	=> 0x0020,
+      :BLOB	 	=> 0x0040
+    }
+
+    TYPE_MODIFIER = {
+      :NONE 	=> 0x0000,
+      :ARRAY 	=> 0x1000
+    }
+
+end
+end
+end
+end
+end

data/lib/rex/proto/dcerpc/wdscp/packet.rb

@@ -0,0 +1,94 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+module WDSCP
+class Packet
+
+  WDS_CONST 	= Rex::Proto::DCERPC::WDSCP::Constants
+
+  def initialize(packet_type, opcode)
+    if opcode.nil? || packet_type.nil?
+      raise(ArgumentError, "Packet arguments cannot be nil")
+    end
+
+    @variables = []
+    @packet_type = WDS_CONST::PACKET_TYPE[packet_type]
+    @opcode = WDS_CONST::OPCODE[opcode]
+  end
+
+  def add_var(name, type_mod=0, value_length=nil, array_size=0, value)
+    padding = 0
+    vt = WDS_CONST::VAR_TYPE_LOOKUP[name]
+    value_type = WDS_CONST::BASE_TYPE[vt]
+    name = Rex::Text.to_unicode(name).unpack('H*')[0]
+
+    # Terminate strings with null char
+    if vt == :STRING
+      value << "\x00"
+    elsif vt == :WSTRING
+      value = Rex::Text.to_unicode(value)
+      value << "\x00\x00"
+    end
+
+    value_length ||= value.length
+    # Variable block total size should be evenly divisible by 16.
+    len = 16 * (1 + (value_length/16))
+    @variables << 
+      [	name,
+        padding,
+        value_type,
+        type_mod,
+        value_length,
+        array_size,
+        value
+      ].pack('H132vvvVVa%i' % len)
+  end
+
+  def create
+    packet = []
+    var_count = @variables.count
+
+    packet_size = 0
+    @variables.each do |var|
+      packet_size += var.length
+    end
+
+    # variables + operation
+    packet_size += 16
+
+    # These bytes are not part of the spec but are not part of DCERPC according to Wireshark
+    # Perhaps something from MSRPC specific? Basically length of the WDSCP packet twice...
+    packet << [(packet_size+40)].pack('V') * 2
+    packet << create_endpoint_header(packet_size)
+    packet << create_operation_header(packet_size, var_count, @packet_type, @opcode)
+    packet.concat(@variables)
+
+    return packet.join
+  end
+
+  def create_operation_header(packet_size, var_count, packet_type=:REQUEST, opcode)
+    return 	[
+        packet_size, # PacketSize
+        256,         # Version
+        packet_type, # Packet_Type
+        0,           # Padding
+        opcode,      # Opcode
+        var_count,   # Variable Count
+      ].pack('VvCCVV')
+  end
+
+  def create_endpoint_header(packet_size)
+    return [
+        40,                            # Header_Size
+        256,                           # Version
+        packet_size,                   # Packet_Size - This doesn't differ from operation header despite the spec...
+        WDS_CONST::OS_DEPLOYMENT_GUID, # GUID
+        "\x00"*16,                     # Reserved
+      ].pack('vvVa16a16')
+  end
+end
+end
+end
+end
+end

data/lib/rex/proto/dhcp.rb

@@ -0,0 +1,7 @@
+# -*- coding: binary -*-
+#
+# DHCP Server support written by scriptjunkie
+#
+
+require 'rex/proto/dhcp/constants'
+require 'rex/proto/dhcp/server'

data/lib/rex/proto/dhcp/constants.rb

@@ -0,0 +1,34 @@
+# -*- coding: binary -*-
+require 'rex/proto/dhcp'
+
+module Rex
+module Proto
+module DHCP
+
+Request = 1
+Response = 2
+
+DHCPDiscover = 1
+DHCPOffer = 2
+DHCPRequest = 3
+DHCPAck = 5
+
+DHCPMagic = "\x63\x82\x53\x63"
+
+OpDHCPServer = 0x36
+OpLeaseTime = 0x33
+OpSubnetMask = 1
+OpRouter = 3
+OpDns = 6
+OpHostname = 0x0c
+OpEnd = 0xff
+
+PXEMagic = "\xF1\x00\x74\x7E"
+OpPXEMagic = 0xD0
+OpPXEConfigFile = 0xD1
+OpPXEPathPrefix = 0xD2
+OpPXERebootTime = 0xD3
+
+end
+end
+end

data/lib/rex/proto/dhcp/server.rb

@@ -0,0 +1,334 @@
+# -*- coding: binary -*-
+
+require 'rex/socket'
+require 'rex/proto/dhcp'
+
+module Rex
+module Proto
+module DHCP
+
+##
+#
+# DHCP Server class
+# not completely configurable - written specifically for a PXE server
+# - scriptjunkie
+#
+# extended to support testing/exploiting CVE-2011-0997
+# - apconole@yahoo.com
+##
+
+class Server
+
+  include Rex::Socket
+
+  def initialize(hash, context = {})
+    self.listen_host = '0.0.0.0' # clients don't already have addresses. Needs to be 0.0.0.0
+    self.listen_port = 67 # mandatory (bootps)
+    self.context = context
+    self.sock = nil
+
+    self.myfilename = hash['FILENAME'] || ""
+    self.myfilename << ("\x00" * (128 - self.myfilename.length))
+
+    source = hash['SRVHOST'] || Rex::Socket.source_address
+    self.ipstring = Rex::Socket.addr_aton(source)
+
+    ipstart = hash['DHCPIPSTART']
+    if ipstart
+      self.start_ip = Rex::Socket.addr_atoi(ipstart)
+    else
+      # Use the first 3 octects of the server's IP to construct the
+      # default range of x.x.x.32-254
+      self.start_ip = "#{self.ipstring[0..2]}\x20".unpack("N").first
+    end
+    self.current_ip = start_ip
+
+    ipend = hash['DHCPIPEND']
+    if ipend
+      self.end_ip = Rex::Socket.addr_atoi(ipend)
+    else
+      # Use the first 3 octects of the server's IP to construct the
+      # default range of x.x.x.32-254
+      self.end_ip = "#{self.ipstring[0..2]}\xfe".unpack("N").first
+    end
+
+    # netmask
+    netmask = hash['NETMASK'] || "255.255.255.0"
+    self.netmaskn = Rex::Socket.addr_aton(netmask)
+
+    # router
+    router = hash['ROUTER'] || source
+    self.router = Rex::Socket.addr_aton(router)
+
+    # dns
+    dnsserv = hash['DNSSERVER'] || source
+    self.dnsserv = Rex::Socket.addr_aton(dnsserv)
+
+    # broadcast
+    if hash['BROADCAST']
+      self.broadcasta = Rex::Socket.addr_aton(hash['BROADCAST'])
+    else
+      self.broadcasta = Rex::Socket.addr_itoa( self.start_ip | (Rex::Socket.addr_ntoi(self.netmaskn) ^ 0xffffffff) )
+    end
+
+    self.served = {}
+    self.serveOnce = hash.include?('SERVEONCE')
+
+    self.servePXE = (hash.include?('PXE') or hash.include?('FILENAME') or hash.include?('PXEONLY'))
+    self.serveOnlyPXE = hash.include?('PXEONLY')
+
+    # Always assume we don't give out hostnames ...
+    self.give_hostname = false
+    self.served_over = 0
+    if (hash['HOSTNAME'])
+      self.give_hostname = true
+      self.served_hostname = hash['HOSTNAME']
+      if ( hash['HOSTSTART'] )
+        self.served_over = hash['HOSTSTART'].to_i
+      end
+    end
+
+    self.leasetime = 600
+    self.relayip = "\x00\x00\x00\x00" # relay ip - not currently suported
+    self.pxeconfigfile = "update2"
+    self.pxealtconfigfile = "update0"
+    self.pxepathprefix = ""
+    self.pxereboottime = 2000
+  end
+
+  def report(&block)
+    self.reporter = block
+  end
+
+  # Start the DHCP server
+  def start
+    self.sock = Rex::Socket::Udp.create(
+      'LocalHost' => listen_host,
+      'LocalPort' => listen_port,
+      'Context'   => context
+    )
+
+    self.thread = Rex::ThreadFactory.spawn("DHCPServerMonitor", false) {
+      monitor_socket
+    }
+  end
+
+  # Stop the DHCP server
+  def stop
+    self.thread.kill
+    self.served = {}
+    self.sock.close rescue nil
+  end
+
+
+  # Set an option
+  def set_option(opts)
+    allowed_options = [
+      :serveOnce, :pxealtconfigfile, :servePXE, :relayip, :leasetime, :dnsserv,
+      :pxeconfigfile, :pxepathprefix, :pxereboottime, :router,
+      :give_hostname, :served_hostname, :served_over, :serveOnlyPXE
+    ]
+
+    opts.each_pair { |k,v|
+      next if not v
+      if allowed_options.include?(k)
+        self.instance_variable_set("@#{k}", v)
+      end
+    }
+  end
+
+
+  # Send a single packet to the specified host
+  def send_packet(ip, pkt)
+    port = 68 # bootpc
+    if ip
+      self.sock.sendto( pkt, ip, port )
+    else
+      if not self.sock.sendto( pkt, '255.255.255.255', port )
+        self.sock.sendto( pkt, self.broadcasta, port )
+      end
+    end
+  end
+
+  attr_accessor :listen_host, :listen_port, :context, :leasetime, :relayip, :router, :dnsserv
+  attr_accessor :sock, :thread, :myfilename, :ipstring, :served, :serveOnce
+  attr_accessor :current_ip, :start_ip, :end_ip, :broadcasta, :netmaskn
+  attr_accessor :servePXE, :pxeconfigfile, :pxealtconfigfile, :pxepathprefix, :pxereboottime, :serveOnlyPXE
+  attr_accessor :give_hostname, :served_hostname, :served_over, :reporter
+
+protected
+
+
+  # See if there is anything to do.. If so, dispatch it.
+  def monitor_socket
+    while true
+      rds = [@sock]
+      wds = []
+      eds = [@sock]
+
+      r,w,e = ::IO.select(rds,wds,eds,1)
+
+      if (r != nil and r[0] == self.sock)
+        buf,host,port = self.sock.recvfrom(65535)
+        # Lame compatabilitiy :-/
+        from = [host, port]
+        dispatch_request(from, buf)
+      end
+
+    end
+  end
+
+  def dhcpoption(type, val = nil)
+    ret = ''
+    ret << [type].pack('C')
+
+    if val
+      ret << [val.length].pack('C') + val
+    end
+
+    ret
+  end
+
+  # Dispatch a packet that we received
+  def dispatch_request(from, buf)
+    type = buf.unpack('C').first
+    if (type != Request)
+      #dlog("Unknown DHCP request type: #{type}")
+      return
+    end
+
+    # parse out the members
+    hwtype = buf[1,1]
+    hwlen = buf[2,1].unpack("C").first
+    hops = buf[3,1]
+    txid = buf[4..7]
+    elapsed = buf[8..9]
+    flags = buf[10..11]
+    clientip = buf[12..15]
+    givenip = buf[16..19]
+    nextip = buf[20..23]
+    relayip = buf[24..27]
+    clienthwaddr = buf[28..(27+hwlen)]
+    servhostname = buf[44..107]
+    filename = buf[108..235]
+    magic = buf[236..239]
+
+    if (magic != DHCPMagic)
+      #dlog("Invalid DHCP request - bad magic.")
+      return
+    end
+
+    messageType = 0
+    pxeclient = false
+
+    # options parsing loop
+    spot = 240
+    while (spot < buf.length - 3)
+      optionType = buf[spot,1].unpack("C").first
+      break if optionType == 0xff
+
+      optionLen = buf[spot + 1,1].unpack("C").first
+      optionValue = buf[(spot + 2)..(spot + optionLen + 1)]
+      spot = spot + optionLen + 2
+      if optionType == 53
+        messageType = optionValue.unpack("C").first
+      elsif optionType == 150 or (optionType == 60 and optionValue.include? "PXEClient")
+        pxeclient = true
+      end
+    end
+
+    # don't serve if only serving PXE and not PXE request
+    return if pxeclient == false and self.serveOnlyPXE == true
+
+    # prepare response
+    pkt = [Response].pack('C')
+    pkt << buf[1..7] #hwtype, hwlen, hops, txid
+    pkt << "\x00\x00\x00\x00"  #elapsed, flags
+    pkt << clientip
+
+    # if this is somebody we've seen before, use the saved IP
+    if self.served.include?( buf[28..43] )
+      pkt << Rex::Socket.addr_iton(self.served[buf[28..43]][0])
+    else # otherwise go to next ip address
+      self.current_ip += 1
+      if self.current_ip > self.end_ip
+        self.current_ip = self.start_ip
+      end
+      self.served.merge!( buf[28..43] => [ self.current_ip, messageType == DHCPRequest ] )
+      pkt << Rex::Socket.addr_iton(self.current_ip)
+    end
+    pkt << self.ipstring #next server ip
+    pkt << self.relayip
+    pkt << buf[28..43] #client hw address
+    pkt << servhostname
+    pkt << self.myfilename
+    pkt << magic
+    pkt << "\x35\x01" #Option
+
+    if messageType == DHCPDiscover  #DHCP Discover - send DHCP Offer
+      pkt << [DHCPOffer].pack('C')
+      # check if already served an Ack based on hw addr (MAC address)
+      # if serveOnce & PXE, don't reply to another PXE request
+      # if serveOnce & ! PXE, don't reply to anything
+      if self.serveOnce == true and self.served.has_key?(buf[28..43]) and
+          self.served[buf[28..43]][1] and (pxeclient == false or self.servePXE == false)
+        return
+      end
+    elsif messageType == DHCPRequest #DHCP Request - send DHCP ACK
+      pkt << [DHCPAck].pack('C')
+      # now we ignore their discovers (but we'll respond to requests in case a packet was lost)
+      if ( self.served_over != 0 )
+        # NOTE: this is sufficient for low-traffic net
+        # for high-traffic, this will probably lead to
+        # hostname collision
+        self.served_over += 1
+      end
+    else
+      return  # ignore unknown DHCP request
+    end
+
+    # Options!
+    pkt << dhcpoption(OpDHCPServer, self.ipstring)
+    pkt << dhcpoption(OpLeaseTime, [self.leasetime].pack('N'))
+    pkt << dhcpoption(OpSubnetMask, self.netmaskn)
+    pkt << dhcpoption(OpRouter, self.router)
+    pkt << dhcpoption(OpDns, self.dnsserv)
+    if self.servePXE  # PXE options
+      pkt << dhcpoption(OpPXEMagic, PXEMagic)
+      # We already got this one, serve localboot file
+      if self.serveOnce == true and self.served.has_key?(buf[28..43]) and
+          self.served[buf[28..43]][1] and pxeclient == true
+        pkt << dhcpoption(OpPXEConfigFile, self.pxealtconfigfile)
+      else
+        # We are handing out an IP and our PXE attack
+        if(self.reporter)
+          self.reporter.call(buf[28..43],self.ipstring)
+        end
+        pkt << dhcpoption(OpPXEConfigFile, self.pxeconfigfile)
+      end
+      pkt << dhcpoption(OpPXEPathPrefix, self.pxepathprefix)
+      pkt << dhcpoption(OpPXERebootTime, [self.pxereboottime].pack('N'))
+      if ( self.give_hostname == true )
+        send_hostname = self.served_hostname
+        if ( self.served_over != 0 )
+          # NOTE : see above comments for the 'uniqueness' of this value
+          send_hostname += self.served_over.to_s
+        end
+        pkt << dhcpoption(OpHostname, send_hostname)
+      end
+    end
+    pkt << dhcpoption(OpEnd)
+
+    pkt << ("\x00" * 32) #padding
+
+    # And now we mark as requested
+    self.served[buf[28..43]][1] = true if messageType == DHCPRequest
+
+    send_packet(nil, pkt)
+  end
+
+end
+
+end
+end
+end