ronin-app 0.1.0.rc1

data/app/scanning.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+#
+# ronin-app - a local web app for Ronin.
+#
+# Copyright (C) 2023-2024 Hal Brodigan (postmodern.mod3@gmail.com)
+#
+# ronin-app is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# ronin-app is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with ronin-app.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# param validations
+require 'ronin/app/validations/recon_params'
+require 'ronin/app/validations/nmap_params'
+require 'ronin/app/validations/masscan_params'
+require 'ronin/app/validations/spider_params'
+require 'ronin/app/validations/vulns_params'
+
+# helpers
+require 'ronin/app/helpers/html'
+
+# worker classes
+require './workers/nmap'
+require './workers/masscan'
+require './workers/spider'
+require './workers/recon'
+require './workers/vulns'
+
+#
+# App class containing routes for scanning.
+#
+class App < Sinatra::Base
+
+  include Ronin::App
+  include Pagy::Backend
+
+  configure do
+    enable :sessions
+    register Sinatra::Flash
+    helpers Sinatra::ContentFor
+    helpers Helpers::HTML
+  end
+
+  configure :development do
+    register Sinatra::Reloader
+  end
+
+  helpers do
+    include Pagy::Frontend
+  end
+
+  get '/recon' do
+    erb :recon
+  end
+
+  post '/recon' do
+    result = Validations::ReconParams.call(params)
+
+    if result.success?
+      @jid = Workers::Recon.perform_async(result.to_h)
+
+      scope = result[:scope]
+
+      flash[:success] = "Recon of #{scope.join(', ')} enqueued"
+      redirect '/recon'
+    else
+      @params = params
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to submit recon request!'
+      halt 400, erb(:recon)
+    end
+  end
+
+  get '/nmap' do
+    erb :nmap
+  end
+
+  post '/nmap' do
+    result = Validations::NmapParams.call(params)
+
+    if result.success?
+      @jid = Workers::Nmap.perform_async(result.to_h)
+
+      targets = result[:targets]
+
+      flash[:success] = "Scan of #{targets.join(',')} enqueued"
+      redirect '/nmap'
+    else
+      @params = params
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to submit nmap scan!'
+      halt 400, erb(:nmap)
+    end
+  end
+
+  get '/masscan' do
+    erb :masscan
+  end
+
+  post '/masscan' do
+    result = Validations::MasscanParams.call(params)
+
+    if result.success?
+      @jid = Workers::Masscan.perform_async(result.to_h)
+
+      targets = result[:ips]
+
+      flash[:success] = "Scan of #{targets.join(',')} enqueued"
+      redirect '/masscan'
+    else
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to submit masscan scan!'
+      halt 400, erb(:masscan)
+    end
+  end
+
+  get '/spider' do
+    erb :spider
+  end
+
+  post '/spider' do
+    result = Validations::SpiderParams.call(params)
+
+    if result.success?
+      @jid = Workers::Spider.perform_async(result.to_h)
+
+      type   = result[:type]
+      target = result[:target]
+
+      flash[:success] = "Web spider of #{type} #{target} enqueued"
+      redirect '/spider'
+    else
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to submit spider scan!'
+      halt 400, erb(:spider)
+    end
+  end
+
+  get '/vulns' do
+    erb :vulns
+  end
+
+  post '/vulns' do
+    result = Validations::VulnsParams.call(params)
+
+    if result.success?
+      @jid = Workers::Vulns.perform_async(result.to_h)
+
+      url = result[:url]
+
+      flash[:success] = "Vulnerabilities scanner of URL #{url} enqueued"
+      redirect '/vulns'
+    else
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to submit vulnerabilities scan!'
+      halt 400, erb(:vulns)
+    end
+  end
+end

data/app.rb

@@ -0,0 +1,372 @@
+# frozen_string_literal: true
+#
+# ronin-app - a local web app for Ronin.
+#
+# Copyright (C) 2023-2024 Hal Brodigan (postmodern.mod3@gmail.com)
+#
+# ronin-app is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# ronin-app is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with ronin-app.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+$LOAD_PATH.unshift(File.join(__dir__,'lib'))
+
+# classes
+require 'sinatra/base'
+require 'sinatra/content_for'
+require 'sinatra/flash'
+require 'sinatra/reloader'
+
+# configuration
+require './config/database'
+require './config/sidekiq'
+
+# ronin libraries
+require 'ronin/repos'
+require 'ronin/payloads'
+require 'ronin/exploits'
+require 'ronin/support/encoding'
+
+# param validations
+require 'ronin/app/validations/install_repo_params'
+require 'ronin/app/validations/import_params'
+
+# schema builders
+require 'ronin/app/schemas/payloads/encoders/encode_schema'
+require 'ronin/app/schemas/payloads/build_schema'
+
+# helpers
+require 'ronin/app/helpers/html'
+
+# worker classes
+require './workers/install_repo'
+require './workers/update_repo'
+require './workers/update_repos'
+require './workers/remove_repo'
+require './workers/purge_repos'
+require './workers/import'
+
+require 'ronin/app/version'
+require 'sidekiq/api'
+
+# others
+require 'pagy'
+require 'pagy/extras/bulma'
+
+#
+# Main app class.
+#
+class App < Sinatra::Base
+
+  include Ronin::App
+  include Pagy::Backend
+
+  configure do
+    enable :sessions
+    enable :method_override
+    register Sinatra::Flash
+    helpers Sinatra::ContentFor
+    helpers Helpers::HTML
+  end
+
+  configure :development do
+    register Sinatra::Reloader
+  end
+
+  helpers do
+    include Pagy::Frontend
+  end
+
+  after do
+    ActiveRecord::Base.connection_handler.clear_active_connections!
+  end
+
+  get '/' do
+    erb :index
+  end
+
+  get '/repos' do
+    @repos = Ronin::Repos.cache_dir
+
+    erb :"repos/index"
+  end
+
+  get '/repos/install' do
+    erb :"repos/install"
+  end
+
+  post '/repos/install' do
+    result = Validations::InstallRepoParams.call(params)
+
+    if result.success?
+      Workers::InstallRepo.perform_async(result[:uri],result[:name])
+
+      flash[:success] = "Installing repo at #{result[:uri]}"
+      redirect '/repos'
+    else
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to install repo!'
+      halt 400, erb(:"repos/install")
+    end
+  end
+
+  post '/repos/update' do
+    Workers::UpdateRepos.perform_async
+
+    flash[:success] = 'All repos will be updated'
+    redirect '/repos'
+  end
+
+  delete '/repos' do
+    Workers::PurgeRepos.perform_async
+
+    flash[:success] = 'All repos will be purged'
+    redirect '/repos'
+  end
+
+  get '/repos/:name' do
+    @repos = Ronin::Repos.cache_dir
+
+    begin
+      @repo = @repos[params[:name]]
+
+      erb :"repos/show"
+    rescue Ronin::Repos::RepositoryNotFound
+      halt 404
+    end
+  end
+
+  post '/repos/:name/update' do
+    @repo = Ronin::Repos.cache_dir[params[:name]]
+
+    Workers::UpdateRepo.perform_async(@repo.name)
+
+    flash[:success] = "Repo #{@repo.name} enqueued for update"
+    redirect "/repos/#{params[:name]}"
+  rescue Ronin::Repos::RepositoryNotFound
+    halt 404
+  end
+
+  delete '/repos/:name' do
+    @repo = Ronin::Repos.cache_dir[params[:name]]
+
+    Workers::RemoveRepo.perform_async(@repo.name)
+
+    flash[:success] = "Repo #{@repo.name} enqueued for removal"
+    redirect '/repos'
+  rescue Ronin::Repos::RepositoryNotFound
+    halt 404
+  end
+
+  get '/payloads' do
+    @payloads = Ronin::Payloads.list_files
+
+    erb :"payloads/index"
+  end
+
+  get '/payloads/encoders' do
+    @payload_encoders = Ronin::Payloads::Encoders.list_files
+
+    erb :"payloads/encoders/index"
+  end
+
+  get %r{/payloads/encoders/encode/(?<encoder_id>[a-z0-9_-]+(?:/[a-z0-9_-]+)*)} do
+    @encoder_class = Ronin::Payloads::Encoders.load_class(params[:encoder_id])
+    @encoder       = @encoder_class.new
+
+    erb :"payloads/encoders/encode"
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  post %r{/payloads/encoders/encode/(?<encoder_id>[a-z0-9_-]+(?:/[a-z0-9_-]+)*)} do
+    @encoder_class = Ronin::Payloads::Encoders.load_class(params[:encoder_id])
+    @encoder       = @encoder_class.new
+
+    form_schema = Schemas::Payloads::Encoders::EncodeSchema(@encoder_class)
+    result      = form_schema.call(params)
+
+    if result.success?
+      encoder_params = result[:params].to_h
+      encoder_params.compact!
+
+      begin
+        @encoder.params = encoder_params
+      rescue Ronin::Core::Params::ParamError => error
+        flash[:error] = "Failed to set params: #{error.message}"
+
+        halt 400, erb(:"payloads/encoders/encode")
+      end
+
+      begin
+        @encoder.validate
+      rescue => error
+        flash[:error] = "Failed to encode encoder: #{error.message}"
+
+        halt 500, erb(:"payloads/encoders/encode")
+      end
+
+      @encoded_data = @encoder.encode(result[:data])
+
+      erb :"payloads/encoders/encode"
+    else
+      @params = params
+      @errors = result.errors
+
+      halt 400, erb(:"payloads/encoders/encode")
+    end
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  get %r{/payloads/encoders/(?<encoder_id>[a-z0-9_-]+(?:/[a-z0-9_-]+)*)} do
+    @encoder = Ronin::Payloads::Encoders.load_class(params[:encoder_id])
+
+    erb :"payloads/encoders/show"
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  get %r{/payloads/build/(?<payload_id>[a-z0-9_-]+(?:/[a-z0-9_-]+)*)} do
+    @payload_class = Ronin::Payloads.load_class(params[:payload_id])
+    @payload       = @payload_class.new
+
+    erb :"payloads/build"
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  post %r{/payloads/build/(?<payload_id>[a-z0-9_-]+(?:/[a-z0-9_-]+)*)} do
+    @payload_class = Ronin::Payloads.load_class(params[:payload_id])
+    @payload       = @payload_class.new
+
+    form_schema = Schemas::Payloads::BuildSchema(@payload_class)
+    result      = form_schema.call(params)
+
+    if result.success?
+      payload_params = result[:params].to_h
+      payload_params.compact!
+
+      begin
+        @payload.params = payload_params
+      rescue Ronin::Core::Params::ParamError => error
+        flash[:error] = "Failed to set params: #{error.message}"
+
+        halt 400, erb(:"payloads/build")
+      end
+
+      begin
+        @payload.perform_validate
+        @payload.perform_build
+      rescue => error
+        flash[:error] = "Failed to build payload: #{error.message}"
+
+        halt 500, erb(:"payloads/build")
+      end
+
+      @built_payload = @payload.to_s
+
+      erb :"payloads/build"
+    else
+      @params = params
+      @errors = result.errors
+
+      halt 400, erb(:"payloads/build")
+    end
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  get %r{/payloads/(?<payload_id>[a-z0-9_-]+(?:/[a-z0-9_-]+)*)} do
+    @payload = Ronin::Payloads.load_class(params[:payload_id])
+
+    erb :"payloads/show"
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  get '/exploits' do
+    @exploits = Ronin::Exploits.list_files
+
+    erb :"exploits/index"
+  end
+
+  get %r{/exploits/(?<exploit_id>[A-Za-z0-9_-]+(?:/[A-Za-z0-9_-]+)*)} do
+    @exploit = Ronin::Exploits.load_class(params[:exploit_id])
+
+    erb :"exploits/show"
+  rescue Ronin::Core::ClassRegistry::ClassNotFound
+    halt 404
+  end
+
+  get '/import' do
+    erb :import
+  end
+
+  post '/import' do
+    result = Validations::ImportParams.call(params)
+
+    if result.success?
+      @jid = Workers::Import.perform_async(result.to_h)
+
+      type = result[:type]
+      path = result[:path]
+
+      flash[:success] = "Import of #{type} file #{path} enqueued"
+      redirect '/import'
+    else
+      @errors = result.errors
+
+      flash[:danger] = 'Failed to submit import job!'
+      halt 400, erb(:import)
+    end
+  end
+
+  get '/about' do
+    @lockfile = Bundler::LockfileParser.new(File.read(Bundler.default_lockfile))
+
+    erb :about
+  end
+
+  get '/queue' do
+    @workers = Sidekiq::Workers.new.map do |_process_id, _thread_id, worker|
+      payload = JSON.parse(worker["payload"])
+      {
+        queue:       worker["queue"],
+        class:       payload["class"],
+        args:        payload["args"],
+        created_at:  Time.at(payload["created_at"]),
+        enqueued_at: Time.at(payload["enqueued_at"]),
+        run_at:      Time.at(worker["run_at"])
+      }
+    end
+
+    erb :queue
+  end
+
+  private
+
+  #
+  # Returns the hash of variables used to initialize the Pagy object.
+  #
+  def pagy_get_vars(collection, vars)
+    {
+      count: collection.count,
+      page:  params["page"],
+      items: vars[:items] || 25
+    }
+  end
+end
+
+require './app/db'
+require './app/scanning'

data/bin/ronin-app

@@ -0,0 +1,34 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+#
+# ronin-app - a local web app for Ronin.
+#
+# Copyright (C) 2023 Hal Brodigan (postmodern.mod3@gmail.com)
+#
+# ronin-app is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# ronin-app is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with ronin-app.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+root = File.expand_path(File.join(__dir__,'..'))
+if File.file?(File.join(root,'Gemfile.lock'))
+  Dir.chdir(root) do
+    require 'bundler/setup'
+  rescue LoadError => e
+    warn e.message
+    warn "Run `gem install bundler` to install Bundler"
+    exit(-1)
+  end
+end
+
+require 'ronin/app/cli'
+Ronin::App::CLI.start

data/config/database.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+require 'ronin/db'
+
+database = if    ENV['DATABASE_URL']  then ENV['DATABASE_URL']
+           elsif ENV['DATABASE_NAME'] then ENV['DATABASE_NAME'].to_sym
+           else                            :default
+           end
+
+pool_size = if ENV['DB_POOL'] then ENV['DB_POOL'].to_i
+            else                   4
+            end
+
+Ronin::DB.connect(database, pool: pool_size)
+
+at_exit do
+  ActiveRecord::Base.connection_pool.disconnect!
+end

data/config/puma.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Puma can serve each request in a thread from an internal thread pool.
+# The `threads` method setting takes two numbers a minimum and maximum.
+# Any libraries that use thread pools should be configured to match
+# the maximum value specified for Puma. Default is set to 5 threads for minimum
+# and maximum, this matches the default thread size of Active Record.
+#
+threads_count = ENV.fetch('PUMA_THREADS',4).to_i
+threads threads_count, threads_count
+
+host = ENV.fetch('HOST','localhost')
+port = ENV.fetch('PORT',1337)
+
+# Default to running on localhost:1337 since this is a local web ap.
+bind "tcp://#{host}:#{port}"
+
+# Specifies the number of `workers` to boot in clustered mode.
+# Workers are forked webserver processes. If using threads and workers together
+# the concurrency of the application would be max `threads` * `workers`.
+# Workers do not work on JRuby or Windows (both of which do not support
+# processes).
+#
+workers ENV.fetch('PUMA_WORKERS',1).to_i

data/config/redis.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+require 'redis'
+
+$redis = Redis.new(url: "redis://#{ENV['REDIS_HOST']}:#{ENV['REDIS_PORT']}")

data/config/sidekiq.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+require 'sidekiq'
+require 'redis/namespace'
+
+require_relative '../lib/middleware/sidekiq/active_record_connection_pool'
+
+redis_config = {
+  url: "redis://#{ENV['REDIS_HOST']}:#{ENV['REDIS_PORT']}"
+}
+
+Sidekiq.configure_server do |config|
+  config.redis = redis_config
+
+  config.server_middleware do |chain|
+    chain.add Middleware::Sidekiq::ActiveRecordConnectionPool
+  end
+end
+
+Sidekiq.configure_client do |config|
+  config.redis = redis_config
+end
+
+Sidekiq.strict_args!(false)

data/config/sidekiq.yml

@@ -0,0 +1,12 @@
+:verbose: true
+:pidfile: ./tmp/sidekiq.pid
+:logfile: ./log/sidekiq.log
+:concurrency: 4
+:queues:
+  - default
+  - repos
+  - recon
+  - scan
+  - import
+  - spider
+  - vulns

data/config.ru

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+#
+# ronin-app - a local web app for Ronin.
+#
+# Copyright (C) 2023 Hal Brodigan (postmodern.mod3@gmail.com)
+#
+# ronin-app is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# ronin-app is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with ronin-app.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require './app'
+require 'sidekiq'
+require 'sidekiq/web'
+
+Sidekiq.configure_client do |config|
+  config.redis = {url: "redis://#{ENV['REDIS_HOST']}:#{ENV['REDIS_PORT']}"}
+end
+
+# give Sidekiq::Web it's own unique rack.session cookie
+Sidekiq::Web.use Rack::Session::Cookie, path:   '/sidekiq',
+                                        secret: SecureRandom.hex(40)
+
+run Rack::URLMap.new('/' => App, '/sidekiq' => Sidekiq::Web)