ronin-exploits 0.3.0 → 1.0.0.beta1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (338) hide show
  1. checksums.yaml +7 -0
  2. data/.document +4 -0
  3. data/.editorconfig +11 -0
  4. data/.github/workflows/ruby.yml +31 -0
  5. data/.gitignore +13 -0
  6. data/.mailmap +1 -0
  7. data/.rspec +1 -0
  8. data/.ruby-version +1 -0
  9. data/.yardopts +1 -0
  10. data/COPYING.txt +161 -335
  11. data/{History.txt → ChangeLog.md} +122 -14
  12. data/Gemfile +50 -0
  13. data/README.md +454 -0
  14. data/Rakefile +37 -23
  15. data/bin/ronin-exploits +13 -6
  16. data/data/new/exploit.rb.erb +158 -0
  17. data/gemspec.yml +37 -0
  18. data/lib/ronin/exploits/advisory.rb +84 -0
  19. data/lib/ronin/exploits/cli/command.rb +39 -0
  20. data/lib/ronin/exploits/cli/commands/irb.rb +57 -0
  21. data/lib/ronin/exploits/cli/commands/list.rb +80 -0
  22. data/lib/ronin/exploits/cli/commands/new.rb +332 -0
  23. data/lib/ronin/exploits/cli/commands/run.rb +396 -0
  24. data/lib/ronin/exploits/cli/commands/show.rb +264 -0
  25. data/lib/ronin/exploits/cli/exploit_command.rb +114 -0
  26. data/lib/ronin/exploits/cli/exploit_methods.rb +114 -0
  27. data/lib/ronin/exploits/cli/ruby_shell.rb +51 -0
  28. data/lib/ronin/exploits/cli.rb +46 -0
  29. data/lib/ronin/exploits/client_side_web_vuln.rb +69 -0
  30. data/lib/ronin/exploits/exceptions.rb +27 -17
  31. data/lib/ronin/exploits/exploit.rb +501 -582
  32. data/lib/ronin/exploits/heap_overflow.rb +50 -0
  33. data/lib/ronin/exploits/lfi.rb +141 -0
  34. data/lib/ronin/exploits/loot/file.rb +113 -0
  35. data/lib/ronin/exploits/loot.rb +119 -0
  36. data/lib/ronin/exploits/memory_corruption.rb +53 -0
  37. data/lib/ronin/exploits/metadata/arch.rb +83 -0
  38. data/lib/ronin/exploits/metadata/cookie_param.rb +80 -0
  39. data/lib/ronin/exploits/metadata/default_filename.rb +69 -0
  40. data/lib/ronin/exploits/metadata/default_port.rb +69 -0
  41. data/lib/ronin/exploits/metadata/header_name.rb +80 -0
  42. data/lib/ronin/exploits/metadata/os.rb +117 -0
  43. data/lib/ronin/exploits/metadata/shouts.rb +85 -0
  44. data/lib/ronin/exploits/metadata/url_path.rb +82 -0
  45. data/lib/ronin/exploits/metadata/url_query_param.rb +80 -0
  46. data/lib/ronin/exploits/mixins/binary.rb +106 -0
  47. data/lib/ronin/exploits/mixins/build_dir.rb +61 -0
  48. data/lib/ronin/exploits/mixins/file_builder.rb +102 -0
  49. data/lib/ronin/exploits/mixins/format_string.rb +87 -0
  50. data/lib/ronin/exploits/mixins/has_payload.rb +202 -0
  51. data/lib/ronin/exploits/mixins/has_targets.rb +297 -0
  52. data/lib/ronin/exploits/mixins/html.rb +213 -0
  53. data/lib/ronin/exploits/mixins/http.rb +866 -0
  54. data/lib/ronin/exploits/mixins/loot.rb +84 -0
  55. data/lib/ronin/exploits/mixins/nops.rb +121 -0
  56. data/lib/ronin/exploits/mixins/remote_tcp.rb +272 -0
  57. data/lib/ronin/exploits/mixins/remote_udp.rb +264 -0
  58. data/lib/ronin/exploits/mixins/seh.rb +136 -0
  59. data/lib/ronin/exploits/mixins/stack_overflow.rb +124 -0
  60. data/lib/ronin/exploits/mixins/text.rb +65 -0
  61. data/lib/ronin/exploits/mixins.rb +32 -0
  62. data/lib/ronin/exploits/open_redirect.rb +103 -0
  63. data/lib/ronin/exploits/params/base_url.rb +84 -0
  64. data/lib/ronin/exploits/params/bind_host.rb +53 -0
  65. data/lib/ronin/exploits/params/bind_port.rb +53 -0
  66. data/lib/ronin/exploits/params/filename.rb +71 -0
  67. data/lib/ronin/exploits/params/host.rb +56 -0
  68. data/lib/ronin/exploits/params/port.rb +71 -0
  69. data/lib/ronin/exploits/registry.rb +32 -0
  70. data/lib/ronin/exploits/rfi.rb +106 -0
  71. data/lib/ronin/exploits/root.rb +28 -0
  72. data/lib/ronin/exploits/seh_overflow.rb +90 -0
  73. data/lib/ronin/exploits/sqli.rb +172 -0
  74. data/lib/ronin/exploits/ssti.rb +108 -0
  75. data/lib/ronin/exploits/stack_overflow.rb +90 -0
  76. data/lib/ronin/exploits/target.rb +63 -103
  77. data/lib/ronin/exploits/test_result.rb +80 -0
  78. data/lib/ronin/exploits/use_after_free.rb +50 -0
  79. data/lib/ronin/exploits/version.rb +11 -12
  80. data/lib/ronin/exploits/web.rb +18 -89
  81. data/lib/ronin/exploits/web_vuln.rb +378 -0
  82. data/lib/ronin/exploits/xss.rb +102 -0
  83. data/lib/ronin/exploits.rb +19 -26
  84. data/man/ronin-exploits-irb.1 +31 -0
  85. data/man/ronin-exploits-irb.1.md +22 -0
  86. data/man/ronin-exploits-list.1 +37 -0
  87. data/man/ronin-exploits-list.1.md +27 -0
  88. data/man/ronin-exploits-new.1 +98 -0
  89. data/man/ronin-exploits-new.1.md +73 -0
  90. data/man/ronin-exploits-run.1 +117 -0
  91. data/man/ronin-exploits-run.1.md +87 -0
  92. data/man/ronin-exploits-show.1 +45 -0
  93. data/man/ronin-exploits-show.1.md +33 -0
  94. data/man/ronin-exploits.1 +55 -0
  95. data/man/ronin-exploits.1.md +41 -0
  96. data/ronin-exploits.gemspec +62 -0
  97. data/spec/advisory_spec.rb +71 -0
  98. data/spec/cli/exploit_command_spec.rb +68 -0
  99. data/spec/cli/exploit_methods_spec.rb +208 -0
  100. data/spec/cli/ruby_shell_spec.rb +14 -0
  101. data/spec/client_side_web_vuln_spec.rb +117 -0
  102. data/spec/exploit_spec.rb +538 -0
  103. data/spec/exploits_spec.rb +3 -4
  104. data/spec/heap_overflow_spec.rb +14 -0
  105. data/spec/lfi_spec.rb +162 -0
  106. data/spec/loot/file_spec.rb +131 -0
  107. data/spec/loot_spec.rb +138 -0
  108. data/spec/memory_corruption_spec.rb +22 -0
  109. data/spec/metadata/arch_spec.rb +82 -0
  110. data/spec/metadata/cookie_param_spec.rb +67 -0
  111. data/spec/metadata/default_filename_spec.rb +62 -0
  112. data/spec/metadata/default_port_spec.rb +62 -0
  113. data/spec/metadata/header_name_spec.rb +67 -0
  114. data/spec/metadata/os_spec.rb +164 -0
  115. data/spec/metadata/shouts_spec.rb +100 -0
  116. data/spec/metadata/url_path_spec.rb +67 -0
  117. data/spec/metadata/url_query_param_spec.rb +67 -0
  118. data/spec/mixins/binary_spec.rb +129 -0
  119. data/spec/mixins/build_dir.rb +66 -0
  120. data/spec/mixins/file_builder_spec.rb +67 -0
  121. data/spec/mixins/format_string_spec.rb +44 -0
  122. data/spec/mixins/has_payload_spec.rb +333 -0
  123. data/spec/mixins/has_targets_spec.rb +434 -0
  124. data/spec/mixins/html_spec.rb +772 -0
  125. data/spec/mixins/http_spec.rb +1227 -0
  126. data/spec/mixins/loot_spec.rb +20 -0
  127. data/spec/mixins/nops_spec.rb +165 -0
  128. data/spec/mixins/remote_tcp_spec.rb +217 -0
  129. data/spec/mixins/remote_udp_spec.rb +217 -0
  130. data/spec/mixins/seh_spec.rb +89 -0
  131. data/spec/mixins/stack_overflow_spec.rb +87 -0
  132. data/spec/mixins/text_spec.rb +43 -0
  133. data/spec/open_redirect_spec.rb +71 -0
  134. data/spec/params/base_url_spec.rb +71 -0
  135. data/spec/params/bind_host_spec.rb +34 -0
  136. data/spec/params/bind_port_spec.rb +35 -0
  137. data/spec/params/filename_spec.rb +77 -0
  138. data/spec/params/host_spec.rb +34 -0
  139. data/spec/params/port_spec.rb +77 -0
  140. data/spec/rfi_spec.rb +107 -0
  141. data/spec/seh_overflow_spec.rb +18 -0
  142. data/spec/spec_helper.rb +6 -10
  143. data/spec/sqli_spec.rb +306 -0
  144. data/spec/ssti_spec.rb +121 -0
  145. data/spec/stack_overflow_spec.rb +18 -0
  146. data/spec/target_spec.rb +92 -0
  147. data/spec/test_result_spec.rb +32 -0
  148. data/spec/use_after_free_spec.rb +14 -0
  149. data/spec/web_spec.rb +12 -0
  150. data/spec/web_vuln_spec.rb +854 -0
  151. data/spec/xss_spec.rb +69 -0
  152. metadata +356 -324
  153. data/Manifest.txt +0 -196
  154. data/README.txt +0 -274
  155. data/bin/ronin-exploit +0 -12
  156. data/bin/ronin-gen-binary-payload +0 -12
  157. data/bin/ronin-gen-exploit +0 -12
  158. data/bin/ronin-gen-ftp-exploit +0 -12
  159. data/bin/ronin-gen-http-exploit +0 -12
  160. data/bin/ronin-gen-local-exploit +0 -12
  161. data/bin/ronin-gen-nops +0 -12
  162. data/bin/ronin-gen-payload +0 -12
  163. data/bin/ronin-gen-remote-exploit +0 -12
  164. data/bin/ronin-gen-remote-tcp-exploit +0 -12
  165. data/bin/ronin-gen-remote-udp-exploit +0 -12
  166. data/bin/ronin-gen-shellcode +0 -12
  167. data/bin/ronin-gen-web-exploit +0 -12
  168. data/bin/ronin-payload +0 -12
  169. data/bin/ronin-payloads +0 -12
  170. data/lib/ronin/controls/behaviors.rb +0 -133
  171. data/lib/ronin/controls/exceptions/not_implemented.rb +0 -27
  172. data/lib/ronin/controls/exceptions/program_not_found.rb +0 -27
  173. data/lib/ronin/controls/exceptions.rb +0 -23
  174. data/lib/ronin/controls/file_system.rb +0 -145
  175. data/lib/ronin/controls/helpers/command_exec.rb +0 -143
  176. data/lib/ronin/controls/helpers/dir_create.rb +0 -42
  177. data/lib/ronin/controls/helpers/dir_listing.rb +0 -62
  178. data/lib/ronin/controls/helpers/dir_remove.rb +0 -42
  179. data/lib/ronin/controls/helpers/file_ctime.rb +0 -52
  180. data/lib/ronin/controls/helpers/file_mtime.rb +0 -53
  181. data/lib/ronin/controls/helpers/file_ownership.rb +0 -53
  182. data/lib/ronin/controls/helpers/file_read.rb +0 -62
  183. data/lib/ronin/controls/helpers/file_remove.rb +0 -51
  184. data/lib/ronin/controls/helpers/file_write.rb +0 -62
  185. data/lib/ronin/controls/helpers/memory_read.rb +0 -39
  186. data/lib/ronin/controls/helpers/memory_write.rb +0 -39
  187. data/lib/ronin/controls/helpers.rb +0 -33
  188. data/lib/ronin/controls.rb +0 -23
  189. data/lib/ronin/exploits/control.rb +0 -47
  190. data/lib/ronin/exploits/exceptions/exception.rb +0 -27
  191. data/lib/ronin/exploits/exceptions/exploit_not_built.rb +0 -29
  192. data/lib/ronin/exploits/exceptions/payload_size.rb +0 -29
  193. data/lib/ronin/exploits/exceptions/restricted_char.rb +0 -29
  194. data/lib/ronin/exploits/exceptions/target_data_missing.rb +0 -29
  195. data/lib/ronin/exploits/exceptions/target_unspecified.rb +0 -29
  196. data/lib/ronin/exploits/exceptions/unknown_helper.rb +0 -29
  197. data/lib/ronin/exploits/exploit_author.rb +0 -33
  198. data/lib/ronin/exploits/ftp.rb +0 -45
  199. data/lib/ronin/exploits/helpers/binary.rb +0 -50
  200. data/lib/ronin/exploits/helpers/buffer_overflow.rb +0 -115
  201. data/lib/ronin/exploits/helpers/file_based.rb +0 -112
  202. data/lib/ronin/exploits/helpers/format_string.rb +0 -117
  203. data/lib/ronin/exploits/helpers/padding.rb +0 -101
  204. data/lib/ronin/exploits/helpers.rb +0 -26
  205. data/lib/ronin/exploits/http.rb +0 -52
  206. data/lib/ronin/exploits/local.rb +0 -40
  207. data/lib/ronin/exploits/remote.rb +0 -40
  208. data/lib/ronin/exploits/remote_tcp.rb +0 -87
  209. data/lib/ronin/exploits/remote_udp.rb +0 -87
  210. data/lib/ronin/exploits/targets/buffer_overflow.rb +0 -46
  211. data/lib/ronin/exploits/targets/format_string.rb +0 -43
  212. data/lib/ronin/exploits/targets.rb +0 -27
  213. data/lib/ronin/exploits/verifiers.rb +0 -121
  214. data/lib/ronin/generators/exploits/exploit.rb +0 -70
  215. data/lib/ronin/generators/exploits/ftp.rb +0 -42
  216. data/lib/ronin/generators/exploits/http.rb +0 -42
  217. data/lib/ronin/generators/exploits/local.rb +0 -42
  218. data/lib/ronin/generators/exploits/remote.rb +0 -42
  219. data/lib/ronin/generators/exploits/remote_tcp.rb +0 -44
  220. data/lib/ronin/generators/exploits/remote_udp.rb +0 -44
  221. data/lib/ronin/generators/exploits/static.rb +0 -30
  222. data/lib/ronin/generators/exploits/web.rb +0 -45
  223. data/lib/ronin/generators/exploits.rb +0 -23
  224. data/lib/ronin/generators/payloads/binary_payload.rb +0 -42
  225. data/lib/ronin/generators/payloads/nops.rb +0 -42
  226. data/lib/ronin/generators/payloads/payload.rb +0 -66
  227. data/lib/ronin/generators/payloads/shellcode.rb +0 -42
  228. data/lib/ronin/generators/payloads/static.rb +0 -30
  229. data/lib/ronin/generators/payloads.rb +0 -23
  230. data/lib/ronin/model/has_default_port.rb +0 -54
  231. data/lib/ronin/model/targets_arch.rb +0 -68
  232. data/lib/ronin/model/targets_os.rb +0 -69
  233. data/lib/ronin/model/targets_product.rb +0 -68
  234. data/lib/ronin/payloads/asm_payload.rb +0 -40
  235. data/lib/ronin/payloads/binary_payload.rb +0 -42
  236. data/lib/ronin/payloads/control.rb +0 -47
  237. data/lib/ronin/payloads/encoders/encoder.rb +0 -92
  238. data/lib/ronin/payloads/encoders/xor.rb +0 -79
  239. data/lib/ronin/payloads/encoders.rb +0 -32
  240. data/lib/ronin/payloads/exceptions/exception.rb +0 -27
  241. data/lib/ronin/payloads/exceptions/not_implemented.rb +0 -29
  242. data/lib/ronin/payloads/exceptions/unknown_helper.rb +0 -29
  243. data/lib/ronin/payloads/exceptions.rb +0 -23
  244. data/lib/ronin/payloads/has_payload.rb +0 -111
  245. data/lib/ronin/payloads/helpers/chained.rb +0 -61
  246. data/lib/ronin/payloads/helpers/rpc.rb +0 -93
  247. data/lib/ronin/payloads/helpers.rb +0 -23
  248. data/lib/ronin/payloads/nops.rb +0 -39
  249. data/lib/ronin/payloads/payload.rb +0 -350
  250. data/lib/ronin/payloads/payload_author.rb +0 -33
  251. data/lib/ronin/payloads/shellcode.rb +0 -40
  252. data/lib/ronin/payloads/web_payload.rb +0 -41
  253. data/lib/ronin/payloads.rb +0 -36
  254. data/lib/ronin/ui/command_line/commands/exploit.rb +0 -193
  255. data/lib/ronin/ui/command_line/commands/exploits.rb +0 -154
  256. data/lib/ronin/ui/command_line/commands/gen_binary_payload.rb +0 -34
  257. data/lib/ronin/ui/command_line/commands/gen_exploit.rb +0 -34
  258. data/lib/ronin/ui/command_line/commands/gen_ftp_exploit.rb +0 -34
  259. data/lib/ronin/ui/command_line/commands/gen_http_exploit.rb +0 -34
  260. data/lib/ronin/ui/command_line/commands/gen_local_exploit.rb +0 -34
  261. data/lib/ronin/ui/command_line/commands/gen_nops.rb +0 -34
  262. data/lib/ronin/ui/command_line/commands/gen_payload.rb +0 -34
  263. data/lib/ronin/ui/command_line/commands/gen_remote_exploit.rb +0 -34
  264. data/lib/ronin/ui/command_line/commands/gen_remote_tcp_exploit.rb +0 -34
  265. data/lib/ronin/ui/command_line/commands/gen_remote_udp_exploit.rb +0 -34
  266. data/lib/ronin/ui/command_line/commands/gen_shellcode.rb +0 -34
  267. data/lib/ronin/ui/command_line/commands/gen_web_exploit.rb +0 -34
  268. data/lib/ronin/ui/command_line/commands/payload.rb +0 -129
  269. data/lib/ronin/ui/command_line/commands/payloads.rb +0 -128
  270. data/lib/ronin/vuln/behavior.rb +0 -165
  271. data/spec/controls/behaviors_examples.rb +0 -38
  272. data/spec/exploits/binary_exploit_spec.rb +0 -44
  273. data/spec/exploits/buffer_overflow_exploit_spec.rb +0 -70
  274. data/spec/exploits/exploit_spec.rb +0 -313
  275. data/spec/exploits/file_based_exploit_spec.rb +0 -48
  276. data/spec/exploits/format_string_exploit_spec.rb +0 -32
  277. data/spec/exploits/ftp_spec.rb +0 -13
  278. data/spec/exploits/http_spec.rb +0 -17
  279. data/spec/exploits/padding_exploit_spec.rb +0 -44
  280. data/spec/exploits/remote_tcp_spec.rb +0 -28
  281. data/spec/exploits/remote_udp_spec.rb +0 -28
  282. data/spec/exploits/target_spec.rb +0 -98
  283. data/spec/exploits/targets/buffer_overflow_spec.rb +0 -22
  284. data/spec/exploits/web_spec.rb +0 -35
  285. data/spec/generators/exploits/exploit_examples.rb +0 -24
  286. data/spec/generators/exploits/exploit_spec.rb +0 -42
  287. data/spec/generators/exploits/ftp_spec.rb +0 -42
  288. data/spec/generators/exploits/http_spec.rb +0 -42
  289. data/spec/generators/exploits/local_spec.rb +0 -42
  290. data/spec/generators/exploits/remote_spec.rb +0 -42
  291. data/spec/generators/exploits/remote_tcp_spec.rb +0 -47
  292. data/spec/generators/exploits/remote_udp_spec.rb +0 -47
  293. data/spec/generators/exploits/web_spec.rb +0 -52
  294. data/spec/generators/payloads/binary_payload_spec.rb +0 -31
  295. data/spec/generators/payloads/nops_spec.rb +0 -31
  296. data/spec/generators/payloads/payload_examples.rb +0 -16
  297. data/spec/generators/payloads/payload_spec.rb +0 -31
  298. data/spec/generators/payloads/shellcode_spec.rb +0 -31
  299. data/spec/helpers/database.rb +0 -5
  300. data/spec/helpers/objects.rb +0 -22
  301. data/spec/model/has_default_port_spec.rb +0 -27
  302. data/spec/model/models/default_port_model.rb +0 -13
  303. data/spec/model/models/non_default_port_model.rb +0 -11
  304. data/spec/model/models/targets_arch_model.rb +0 -11
  305. data/spec/model/models/targets_os_model.rb +0 -11
  306. data/spec/model/models/targets_product_model.rb +0 -11
  307. data/spec/model/targets_arch_spec.rb +0 -32
  308. data/spec/model/targets_os_spec.rb +0 -33
  309. data/spec/model/targets_product_spec.rb +0 -35
  310. data/spec/objects/exploits/example.rb +0 -25
  311. data/spec/objects/exploits/simple.rb +0 -24
  312. data/spec/objects/payloads/simple.rb +0 -19
  313. data/spec/payloads/encoders/encoder_spec.rb +0 -30
  314. data/spec/payloads/encoders/xor_spec.rb +0 -20
  315. data/spec/payloads/payload_spec.rb +0 -156
  316. data/spec/vuln/behavior_spec.rb +0 -15
  317. data/static/ronin/generators/exploits/_cache.erb +0 -14
  318. data/static/ronin/generators/exploits/_header.erb +0 -1
  319. data/static/ronin/generators/exploits/_helpers.erb +0 -4
  320. data/static/ronin/generators/exploits/exploit.erb +0 -24
  321. data/static/ronin/generators/exploits/ftp.erb +0 -24
  322. data/static/ronin/generators/exploits/http.erb +0 -26
  323. data/static/ronin/generators/exploits/local.erb +0 -24
  324. data/static/ronin/generators/exploits/remote.erb +0 -24
  325. data/static/ronin/generators/exploits/remote_tcp.erb +0 -26
  326. data/static/ronin/generators/exploits/remote_udp.erb +0 -26
  327. data/static/ronin/generators/exploits/web.erb +0 -28
  328. data/static/ronin/generators/payloads/_cache.erb +0 -10
  329. data/static/ronin/generators/payloads/_header.erb +0 -1
  330. data/static/ronin/generators/payloads/_helpers.erb +0 -2
  331. data/static/ronin/generators/payloads/binary_payload.erb +0 -25
  332. data/static/ronin/generators/payloads/nops.erb +0 -19
  333. data/static/ronin/generators/payloads/payload.erb +0 -25
  334. data/static/ronin/generators/payloads/shellcode.erb +0 -25
  335. data/tasks/spec.rb +0 -10
  336. data/tasks/yard.rb +0 -13
  337. data.tar.gz.sig +0 -2
  338. metadata.gz.sig +0 -0
@@ -1,33 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/author'
23
-
24
- module Ronin
25
- module Exploits
26
- class ExploitAuthor < Author
27
-
28
- # The exploit the author wrote
29
- belongs_to :exploit, :nullable => true
30
-
31
- end
32
- end
33
- end
@@ -1,45 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/remote_tcp'
23
-
24
- module Ronin
25
- module Exploits
26
- class FTP < RemoteTCP
27
-
28
- # Default port to connect to
29
- DEFAULT_PORT = 21
30
-
31
- #
32
- # Creates a new Ronin::Exploits::FTP object using the given _block_.
33
- #
34
- # ronin_ftp_exploit do
35
- # ...
36
- # end
37
- #
38
- contextify :ronin_ftp_exploit
39
-
40
- # Default port to connect to
41
- property :default_port, Integer
42
-
43
- end
44
- end
45
- end
@@ -1,50 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/exceptions/target_data_missing'
23
- require 'ronin/formatting/binary'
24
-
25
- module Ronin
26
- module Exploits
27
- module Helpers
28
- module Binary
29
- #
30
- # Packs an integer using the current targeted architecture
31
- # and the address-length.
32
- #
33
- # @param [Integer] integer
34
- # The integer to pack.
35
- #
36
- # @param [Integer] address_length
37
- # The address-length to pack the integer into.
38
- #
39
- # @return [String]
40
- # The packed integer.
41
- #
42
- def pack(integer,address_length=nil)
43
- verify_arch!
44
-
45
- return integer.pack(arch,(address_length || arch.address_length))
46
- end
47
- end
48
- end
49
- end
50
- end
@@ -1,115 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/exceptions/payload_size'
23
- require 'ronin/exploits/targets/buffer_overflow'
24
- require 'ronin/exploits/helpers/binary'
25
- require 'ronin/exploits/helpers/padding'
26
- require 'ronin/payloads/shellcode'
27
-
28
- module Ronin
29
- module Exploits
30
- module Helpers
31
- module BufferOverflow
32
- def self.extended(obj)
33
- obj.instance_eval do
34
- extend Ronin::Exploits::Helpers::Binary
35
- extend Ronin::Exploits::Helpers::Padding
36
- end
37
- end
38
-
39
- #
40
- # @return [String]
41
- # The buffer to use for the buffer overflow.
42
- #
43
- def buffer
44
- @buffer ||= ''
45
- end
46
-
47
- #
48
- # Adds a new target to the exploit.
49
- #
50
- # @param [Hash] attributes
51
- # Additional attributes to create the new target with.
52
- #
53
- # @yield [target]
54
- # If a block is given, it will be passed the newly created target.
55
- #
56
- # @yieldparam [Targets::BufferOverflow] target
57
- # The new target.
58
- #
59
- def targeting(attributes={},&block)
60
- self.targets << Targets::BufferOverflow.new(attributes,&block)
61
- end
62
-
63
- #
64
- # @return [Payloads::Shellcode]
65
- # The model which will be searched for acceptable payloads.
66
- #
67
- # @since 0.3.0
68
- #
69
- def use_payload_class
70
- Payloads::Shellcode
71
- end
72
-
73
- protected
74
-
75
- #
76
- # Builds the buffer with the current target and payload to be
77
- # used in the buffer overflow exploit.
78
- #
79
- # @return [String]
80
- # The built buffer.
81
- #
82
- # @raise [PayloadSize]
83
- # The encoded payload is too large to fit within the targeted
84
- # buffer length.
85
- #
86
- def build_buffer
87
- verify_target!
88
-
89
- if encoded_payload.length > target.buffer_length
90
- raise(PayloadSize,"the specified payload is too large for the target's buffer length",caller)
91
- end
92
-
93
- buffer = pad(target.buffer_length - encoded_payload.length) + encoded_payload
94
- ip_packed = pack(target.ip)
95
-
96
- if target.bp
97
- buffer << ((pack(target.bp) + ip_packed) * target.frame_repeat)
98
- else
99
- buffer << ((ip_packed * 2) * target.frame_repeat)
100
- end
101
-
102
- return buffer
103
- end
104
-
105
- #
106
- # Default builder method which simply calls build_buffer and sets
107
- # the +@buffer+ instance variable..
108
- #
109
- def build
110
- @buffer = build_buffer
111
- end
112
- end
113
- end
114
- end
115
- end
@@ -1,112 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/config'
23
-
24
- require 'set'
25
- require 'fileutils'
26
-
27
- module Ronin
28
- module Exploits
29
- module Helpers
30
- module FileBased
31
- def self.extended(obj)
32
- obj.instance_eval do
33
- # The output directory for file creation
34
- parameter :output_dir,
35
- :default => Config::TMP_DIR,
36
- :description => 'Directory to save built file in'
37
-
38
- # The name of the output file
39
- parameter :output_file_name,
40
- :default => 'exploit',
41
- :description => 'Name of the file'
42
-
43
- # Whether or not to delete the output file at exit
44
- parameter :clean_file,
45
- :default => true,
46
- :description => 'Delete the file on exit'
47
- end
48
- end
49
-
50
- #
51
- # List of files to delete upon exit.
52
- #
53
- # @return [Set]
54
- # The list of files to delete upon exit.
55
- #
56
- def FileBased.clean_files
57
- @@ronin_exploits_file_based_clean_files ||= Set[]
58
- end
59
-
60
- #
61
- # Will forcibly delete the files listed in FileBased.clean_files.
62
- #
63
- # @return [true]
64
- # The all files were successfully deleted.
65
- #
66
- def FileBased.clean!
67
- FileBased.clean_files.each do |path|
68
- FileUtils.rm(path, :force => true)
69
- end
70
-
71
- FileBased.clean_files.clear
72
- return true
73
- end
74
-
75
- at_exit(&FileBased.method(:clean!))
76
-
77
- #
78
- # @return [String]
79
- # The absolute path of the file to be built.
80
- #
81
- def output_file_path
82
- sanitized_name = File.expand_path(File.join('',@output_file_name))
83
-
84
- return File.expand_path(File.join(@output_dir,sanitized_name))
85
- end
86
-
87
- protected
88
-
89
- #
90
- # Opens the file to be built.
91
- #
92
- # @yield [file]
93
- # If a block is given, it will be passed the newly opened file.
94
- #
95
- # @yieldparam [File] file
96
- # The newly opened file.
97
- #
98
- # @example
99
- # build_file do |file|
100
- # file << 'some data'
101
- # end
102
- #
103
- def build_file(&block)
104
- path = self.output_file_path
105
-
106
- FileBased.clean_files << path if @clean_file
107
- return File.open(path,'w',&block)
108
- end
109
- end
110
- end
111
- end
112
- end
@@ -1,117 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/targets/format_string'
23
- require 'ronin/exploits/helpers/binary'
24
- require 'ronin/payloads/shellcode'
25
-
26
- module Ronin
27
- module Exploits
28
- module Helpers
29
- module FormatString
30
- def self.extended(obj)
31
- obj.instance_eval do
32
- extend Ronin::Exploits::Helpers::Binary
33
- end
34
- end
35
-
36
- #
37
- # @return [String]
38
- # The format string of the exploit.
39
- #
40
- def format_string
41
- @format_string ||= ''
42
- end
43
-
44
- #
45
- # Adds a new target to the exploit.
46
- #
47
- # @param [Hash] attributes
48
- # Additioanl attributes to create the target with.
49
- #
50
- # @yield [target]
51
- # If a block is given, it will be passed the newly created target.
52
- #
53
- # @yieldparam [Targets::FormatString] target
54
- # The newly created target.
55
- #
56
- def targeting(attributes={},&block)
57
- self.targets << Targets::FormatString.new(attributes,&block)
58
- end
59
-
60
- #
61
- # @return [Payloads::Shellcode]
62
- # The model which will be searched for acceptable payloads.
63
- #
64
- # @since 0.3.0
65
- #
66
- def use_payload_class
67
- Payload::Shellcode
68
- end
69
-
70
- protected
71
-
72
- #
73
- # Builds a format string using the current target and payload to
74
- # be used in the format string exploit.
75
- #
76
- # @return [String]
77
- # The built format string.
78
- #
79
- def build_format_string
80
- verify_target!
81
-
82
- buffer = pack(target.overwrite) +
83
- pack(target.overwrite + (target.arch.address_length / 2))
84
-
85
- low_mask = 0xff
86
- (target.arch.address_length/2).times do
87
- low_mask <<= 8
88
- low_mask |= 0xff
89
- end
90
-
91
- high_mask = low_mask << (target.arch.address_length*4)
92
- high = (target.address & high_mask) >> (target.arch.address_length/2)
93
- low = target.address & low_mask
94
-
95
- if low < high
96
- low -= (target.arch.address_length*2)
97
- buffer += format("%%.%ud%%%u$hn%%.%ud%%%u$hn",low,target.pop_length,high-low,target.pop_length+1)
98
- else
99
- high -= (target.arch.address_length*2)
100
- buffer += format("%%.%ud%%%u$hn%%.%ud%%%u$hn",high,target.pop_length+1,low-high,target.pop_length)
101
- end
102
-
103
- buffer << encoded_payload
104
- return buffer
105
- end
106
-
107
- #
108
- # The default builder method which simply calls build_format_string
109
- # and sets the +@format_string+ instance variable.
110
- #
111
- def build
112
- @format_string = build_format_string
113
- end
114
- end
115
- end
116
- end
117
- end
@@ -1,101 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/formatting/text'
23
-
24
- module Ronin
25
- module Exploits
26
- module Helpers
27
- module Padding
28
- def self.extended(obj)
29
- obj.instance_eval do
30
- # String to pad extra space with
31
- parameter :padding,
32
- :default => 'A',
33
- :description => 'padding string'
34
- end
35
- end
36
-
37
- protected
38
-
39
- #
40
- # Creates padding out to a maximum length, using the +padding+
41
- # parameter.
42
- #
43
- # @param [Integer] max_length
44
- # The maximum length to pad out to.
45
- #
46
- # @return [String]
47
- # A padded string.
48
- #
49
- # @example
50
- # pad(28)
51
- # # => "AAAAAAAAAAAAAAAAAAAAAAAAAAAA"
52
- #
53
- def pad(max_length)
54
- ''.pad(@padding.to_s,max_length)
55
- end
56
-
57
- #
58
- # Pads the a string on the right-hand side out to a maximum length,
59
- # using the +padding+ parameter.
60
- #
61
- # @param [String] data
62
- # The string to add padding to.
63
- #
64
- # @param [Integer] max_length
65
- # The amount of padding to add.
66
- #
67
- # @return [String]
68
- # The left-hand side padded string.
69
- #
70
- # @example
71
- # pad_left("\xff\xff",48)
72
- # # => "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xff\xff"
73
- #
74
- def pad_left(data,max_length)
75
- pad(max_length - data.length) + data
76
- end
77
-
78
- #
79
- # Pads the a string on the right-hand side out to a maximum length,
80
- # using the +padding+ parameter.
81
- #
82
- # @param [String] data
83
- # The string to add padding to.
84
- #
85
- # @param [Integer] max_length
86
- # The amount of padding to add.
87
- #
88
- # @return [String]
89
- # The right-hand side padded string.
90
- #
91
- # @example
92
- # pad_right("\xff\xff",48)
93
- # # => "\xff\xffAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
94
- #
95
- def pad_right(data,max_length)
96
- data.to_s.pad(@padding,max_length)
97
- end
98
- end
99
- end
100
- end
101
- end
@@ -1,26 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/helpers/file_based'
23
- require 'ronin/exploits/helpers/binary'
24
- require 'ronin/exploits/helpers/padding'
25
- require 'ronin/exploits/helpers/buffer_overflow'
26
- require 'ronin/exploits/helpers/format_string'
@@ -1,52 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/remote_tcp'
23
- require 'ronin/network/helpers/http'
24
-
25
- module Ronin
26
- module Exploits
27
- class HTTP < RemoteTCP
28
-
29
- # Default port to connect to
30
- DEFAULT_PORT = 80
31
-
32
- include Network::Helpers::HTTP
33
-
34
- #
35
- # Creates a new Ronin::Exploits::HTTP object using the given _block_.
36
- #
37
- # ronin_http_exploit do
38
- # ...
39
- # end
40
- #
41
- contextify :ronin_http_exploit
42
-
43
- # Default port to connect to
44
- property :default_port, Integer, :default => 80
45
-
46
- # The optional URL path prefix
47
- parameter :url_prefix,
48
- :description => 'Optional URL path prefix'
49
-
50
- end
51
- end
52
- end
@@ -1,40 +0,0 @@
1
- #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
3
- # payload crafting functionality.
4
- #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
6
- #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
10
- # (at your option) any later version.
11
- #
12
- # This program is distributed in the hope that it will be useful,
13
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
16
- #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20
- #
21
-
22
- require 'ronin/exploits/exploit'
23
-
24
- module Ronin
25
- module Exploits
26
- class Local < Exploit
27
-
28
- #
29
- # Creates a new Ronin::Exploits::Local object using the given
30
- # _block_.
31
- #
32
- # ronin_local_exploit do
33
- # ...
34
- # end
35
- #
36
- contextify :ronin_local_exploit
37
-
38
- end
39
- end
40
- end