ronin-exploits 0.3.1 → 1.0.0.beta1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (338) hide show
  1. checksums.yaml +7 -0
  2. data/.document +4 -0
  3. data/.editorconfig +11 -0
  4. data/.github/workflows/ruby.yml +31 -0
  5. data/.gitignore +13 -0
  6. data/.mailmap +1 -0
  7. data/.rspec +1 -0
  8. data/.ruby-version +1 -0
  9. data/.yardopts +1 -0
  10. data/COPYING.txt +161 -335
  11. data/{History.txt → ChangeLog.md} +119 -16
  12. data/Gemfile +50 -0
  13. data/README.md +454 -0
  14. data/Rakefile +37 -23
  15. data/bin/ronin-exploits +13 -6
  16. data/data/new/exploit.rb.erb +158 -0
  17. data/gemspec.yml +37 -0
  18. data/lib/ronin/exploits/advisory.rb +84 -0
  19. data/lib/ronin/exploits/cli/command.rb +39 -0
  20. data/lib/ronin/exploits/cli/commands/irb.rb +57 -0
  21. data/lib/ronin/exploits/cli/commands/list.rb +80 -0
  22. data/lib/ronin/exploits/cli/commands/new.rb +332 -0
  23. data/lib/ronin/exploits/cli/commands/run.rb +396 -0
  24. data/lib/ronin/exploits/cli/commands/show.rb +264 -0
  25. data/lib/ronin/exploits/cli/exploit_command.rb +114 -0
  26. data/lib/ronin/exploits/cli/exploit_methods.rb +114 -0
  27. data/lib/ronin/exploits/cli/ruby_shell.rb +51 -0
  28. data/lib/ronin/exploits/cli.rb +46 -0
  29. data/lib/ronin/exploits/client_side_web_vuln.rb +69 -0
  30. data/lib/ronin/exploits/exceptions.rb +27 -17
  31. data/lib/ronin/exploits/exploit.rb +501 -582
  32. data/lib/ronin/exploits/heap_overflow.rb +50 -0
  33. data/lib/ronin/exploits/lfi.rb +141 -0
  34. data/lib/ronin/exploits/loot/file.rb +113 -0
  35. data/lib/ronin/exploits/loot.rb +119 -0
  36. data/lib/ronin/exploits/memory_corruption.rb +53 -0
  37. data/lib/ronin/exploits/metadata/arch.rb +83 -0
  38. data/lib/ronin/exploits/metadata/cookie_param.rb +80 -0
  39. data/lib/ronin/exploits/metadata/default_filename.rb +69 -0
  40. data/lib/ronin/exploits/metadata/default_port.rb +69 -0
  41. data/lib/ronin/exploits/metadata/header_name.rb +80 -0
  42. data/lib/ronin/exploits/metadata/os.rb +117 -0
  43. data/lib/ronin/exploits/metadata/shouts.rb +85 -0
  44. data/lib/ronin/exploits/metadata/url_path.rb +82 -0
  45. data/lib/ronin/exploits/metadata/url_query_param.rb +80 -0
  46. data/lib/ronin/exploits/mixins/binary.rb +106 -0
  47. data/lib/ronin/exploits/mixins/build_dir.rb +61 -0
  48. data/lib/ronin/exploits/mixins/file_builder.rb +102 -0
  49. data/lib/ronin/exploits/mixins/format_string.rb +87 -0
  50. data/lib/ronin/exploits/mixins/has_payload.rb +202 -0
  51. data/lib/ronin/exploits/mixins/has_targets.rb +297 -0
  52. data/lib/ronin/exploits/mixins/html.rb +213 -0
  53. data/lib/ronin/exploits/mixins/http.rb +866 -0
  54. data/lib/ronin/exploits/mixins/loot.rb +84 -0
  55. data/lib/ronin/exploits/mixins/nops.rb +121 -0
  56. data/lib/ronin/exploits/mixins/remote_tcp.rb +272 -0
  57. data/lib/ronin/exploits/mixins/remote_udp.rb +264 -0
  58. data/lib/ronin/exploits/mixins/seh.rb +136 -0
  59. data/lib/ronin/exploits/mixins/stack_overflow.rb +124 -0
  60. data/lib/ronin/exploits/mixins/text.rb +65 -0
  61. data/lib/ronin/exploits/mixins.rb +32 -0
  62. data/lib/ronin/exploits/open_redirect.rb +103 -0
  63. data/lib/ronin/exploits/params/base_url.rb +84 -0
  64. data/lib/ronin/exploits/params/bind_host.rb +53 -0
  65. data/lib/ronin/exploits/params/bind_port.rb +53 -0
  66. data/lib/ronin/exploits/params/filename.rb +71 -0
  67. data/lib/ronin/exploits/params/host.rb +56 -0
  68. data/lib/ronin/exploits/params/port.rb +71 -0
  69. data/lib/ronin/exploits/registry.rb +32 -0
  70. data/lib/ronin/exploits/rfi.rb +106 -0
  71. data/lib/ronin/exploits/root.rb +28 -0
  72. data/lib/ronin/exploits/seh_overflow.rb +90 -0
  73. data/lib/ronin/exploits/sqli.rb +172 -0
  74. data/lib/ronin/exploits/ssti.rb +108 -0
  75. data/lib/ronin/exploits/stack_overflow.rb +90 -0
  76. data/lib/ronin/exploits/target.rb +63 -103
  77. data/lib/ronin/exploits/test_result.rb +80 -0
  78. data/lib/ronin/exploits/use_after_free.rb +50 -0
  79. data/lib/ronin/exploits/version.rb +11 -12
  80. data/lib/ronin/exploits/web.rb +18 -89
  81. data/lib/ronin/exploits/web_vuln.rb +378 -0
  82. data/lib/ronin/exploits/xss.rb +102 -0
  83. data/lib/ronin/exploits.rb +19 -26
  84. data/man/ronin-exploits-irb.1 +31 -0
  85. data/man/ronin-exploits-irb.1.md +22 -0
  86. data/man/ronin-exploits-list.1 +37 -0
  87. data/man/ronin-exploits-list.1.md +27 -0
  88. data/man/ronin-exploits-new.1 +98 -0
  89. data/man/ronin-exploits-new.1.md +73 -0
  90. data/man/ronin-exploits-run.1 +117 -0
  91. data/man/ronin-exploits-run.1.md +87 -0
  92. data/man/ronin-exploits-show.1 +45 -0
  93. data/man/ronin-exploits-show.1.md +33 -0
  94. data/man/ronin-exploits.1 +55 -0
  95. data/man/ronin-exploits.1.md +41 -0
  96. data/ronin-exploits.gemspec +62 -0
  97. data/spec/advisory_spec.rb +71 -0
  98. data/spec/cli/exploit_command_spec.rb +68 -0
  99. data/spec/cli/exploit_methods_spec.rb +208 -0
  100. data/spec/cli/ruby_shell_spec.rb +14 -0
  101. data/spec/client_side_web_vuln_spec.rb +117 -0
  102. data/spec/exploit_spec.rb +538 -0
  103. data/spec/exploits_spec.rb +3 -4
  104. data/spec/heap_overflow_spec.rb +14 -0
  105. data/spec/lfi_spec.rb +162 -0
  106. data/spec/loot/file_spec.rb +131 -0
  107. data/spec/loot_spec.rb +138 -0
  108. data/spec/memory_corruption_spec.rb +22 -0
  109. data/spec/metadata/arch_spec.rb +82 -0
  110. data/spec/metadata/cookie_param_spec.rb +67 -0
  111. data/spec/metadata/default_filename_spec.rb +62 -0
  112. data/spec/metadata/default_port_spec.rb +62 -0
  113. data/spec/metadata/header_name_spec.rb +67 -0
  114. data/spec/metadata/os_spec.rb +164 -0
  115. data/spec/metadata/shouts_spec.rb +100 -0
  116. data/spec/metadata/url_path_spec.rb +67 -0
  117. data/spec/metadata/url_query_param_spec.rb +67 -0
  118. data/spec/mixins/binary_spec.rb +129 -0
  119. data/spec/mixins/build_dir.rb +66 -0
  120. data/spec/mixins/file_builder_spec.rb +67 -0
  121. data/spec/mixins/format_string_spec.rb +44 -0
  122. data/spec/mixins/has_payload_spec.rb +333 -0
  123. data/spec/mixins/has_targets_spec.rb +434 -0
  124. data/spec/mixins/html_spec.rb +772 -0
  125. data/spec/mixins/http_spec.rb +1227 -0
  126. data/spec/mixins/loot_spec.rb +20 -0
  127. data/spec/mixins/nops_spec.rb +165 -0
  128. data/spec/mixins/remote_tcp_spec.rb +217 -0
  129. data/spec/mixins/remote_udp_spec.rb +217 -0
  130. data/spec/mixins/seh_spec.rb +89 -0
  131. data/spec/mixins/stack_overflow_spec.rb +87 -0
  132. data/spec/mixins/text_spec.rb +43 -0
  133. data/spec/open_redirect_spec.rb +71 -0
  134. data/spec/params/base_url_spec.rb +71 -0
  135. data/spec/params/bind_host_spec.rb +34 -0
  136. data/spec/params/bind_port_spec.rb +35 -0
  137. data/spec/params/filename_spec.rb +77 -0
  138. data/spec/params/host_spec.rb +34 -0
  139. data/spec/params/port_spec.rb +77 -0
  140. data/spec/rfi_spec.rb +107 -0
  141. data/spec/seh_overflow_spec.rb +18 -0
  142. data/spec/spec_helper.rb +6 -10
  143. data/spec/sqli_spec.rb +306 -0
  144. data/spec/ssti_spec.rb +121 -0
  145. data/spec/stack_overflow_spec.rb +18 -0
  146. data/spec/target_spec.rb +92 -0
  147. data/spec/test_result_spec.rb +32 -0
  148. data/spec/use_after_free_spec.rb +14 -0
  149. data/spec/web_spec.rb +12 -0
  150. data/spec/web_vuln_spec.rb +854 -0
  151. data/spec/xss_spec.rb +69 -0
  152. metadata +356 -324
  153. data/Manifest.txt +0 -196
  154. data/README.txt +0 -274
  155. data/bin/ronin-exploit +0 -12
  156. data/bin/ronin-gen-binary-payload +0 -12
  157. data/bin/ronin-gen-exploit +0 -12
  158. data/bin/ronin-gen-ftp-exploit +0 -12
  159. data/bin/ronin-gen-http-exploit +0 -12
  160. data/bin/ronin-gen-local-exploit +0 -12
  161. data/bin/ronin-gen-nops +0 -12
  162. data/bin/ronin-gen-payload +0 -12
  163. data/bin/ronin-gen-remote-exploit +0 -12
  164. data/bin/ronin-gen-remote-tcp-exploit +0 -12
  165. data/bin/ronin-gen-remote-udp-exploit +0 -12
  166. data/bin/ronin-gen-shellcode +0 -12
  167. data/bin/ronin-gen-web-exploit +0 -12
  168. data/bin/ronin-payload +0 -12
  169. data/bin/ronin-payloads +0 -12
  170. data/lib/ronin/controls/behaviors.rb +0 -133
  171. data/lib/ronin/controls/exceptions/not_implemented.rb +0 -27
  172. data/lib/ronin/controls/exceptions/program_not_found.rb +0 -27
  173. data/lib/ronin/controls/exceptions.rb +0 -23
  174. data/lib/ronin/controls/file_system.rb +0 -145
  175. data/lib/ronin/controls/helpers/command_exec.rb +0 -143
  176. data/lib/ronin/controls/helpers/dir_create.rb +0 -42
  177. data/lib/ronin/controls/helpers/dir_listing.rb +0 -62
  178. data/lib/ronin/controls/helpers/dir_remove.rb +0 -42
  179. data/lib/ronin/controls/helpers/file_ctime.rb +0 -52
  180. data/lib/ronin/controls/helpers/file_mtime.rb +0 -53
  181. data/lib/ronin/controls/helpers/file_ownership.rb +0 -53
  182. data/lib/ronin/controls/helpers/file_read.rb +0 -62
  183. data/lib/ronin/controls/helpers/file_remove.rb +0 -51
  184. data/lib/ronin/controls/helpers/file_write.rb +0 -62
  185. data/lib/ronin/controls/helpers/memory_read.rb +0 -39
  186. data/lib/ronin/controls/helpers/memory_write.rb +0 -39
  187. data/lib/ronin/controls/helpers.rb +0 -33
  188. data/lib/ronin/controls.rb +0 -23
  189. data/lib/ronin/exploits/control.rb +0 -47
  190. data/lib/ronin/exploits/exceptions/exception.rb +0 -27
  191. data/lib/ronin/exploits/exceptions/exploit_not_built.rb +0 -29
  192. data/lib/ronin/exploits/exceptions/payload_size.rb +0 -29
  193. data/lib/ronin/exploits/exceptions/restricted_char.rb +0 -29
  194. data/lib/ronin/exploits/exceptions/target_data_missing.rb +0 -29
  195. data/lib/ronin/exploits/exceptions/target_unspecified.rb +0 -29
  196. data/lib/ronin/exploits/exceptions/unknown_helper.rb +0 -29
  197. data/lib/ronin/exploits/exploit_author.rb +0 -33
  198. data/lib/ronin/exploits/ftp.rb +0 -42
  199. data/lib/ronin/exploits/helpers/binary.rb +0 -50
  200. data/lib/ronin/exploits/helpers/buffer_overflow.rb +0 -115
  201. data/lib/ronin/exploits/helpers/file_based.rb +0 -112
  202. data/lib/ronin/exploits/helpers/format_string.rb +0 -117
  203. data/lib/ronin/exploits/helpers/padding.rb +0 -101
  204. data/lib/ronin/exploits/helpers.rb +0 -26
  205. data/lib/ronin/exploits/http.rb +0 -49
  206. data/lib/ronin/exploits/local.rb +0 -40
  207. data/lib/ronin/exploits/remote.rb +0 -40
  208. data/lib/ronin/exploits/remote_tcp.rb +0 -87
  209. data/lib/ronin/exploits/remote_udp.rb +0 -87
  210. data/lib/ronin/exploits/targets/buffer_overflow.rb +0 -46
  211. data/lib/ronin/exploits/targets/format_string.rb +0 -43
  212. data/lib/ronin/exploits/targets.rb +0 -27
  213. data/lib/ronin/exploits/verifiers.rb +0 -121
  214. data/lib/ronin/generators/exploits/exploit.rb +0 -70
  215. data/lib/ronin/generators/exploits/ftp.rb +0 -42
  216. data/lib/ronin/generators/exploits/http.rb +0 -42
  217. data/lib/ronin/generators/exploits/local.rb +0 -42
  218. data/lib/ronin/generators/exploits/remote.rb +0 -42
  219. data/lib/ronin/generators/exploits/remote_tcp.rb +0 -44
  220. data/lib/ronin/generators/exploits/remote_udp.rb +0 -44
  221. data/lib/ronin/generators/exploits/static.rb +0 -30
  222. data/lib/ronin/generators/exploits/web.rb +0 -45
  223. data/lib/ronin/generators/exploits.rb +0 -23
  224. data/lib/ronin/generators/payloads/binary_payload.rb +0 -42
  225. data/lib/ronin/generators/payloads/nops.rb +0 -42
  226. data/lib/ronin/generators/payloads/payload.rb +0 -66
  227. data/lib/ronin/generators/payloads/shellcode.rb +0 -42
  228. data/lib/ronin/generators/payloads/static.rb +0 -30
  229. data/lib/ronin/generators/payloads.rb +0 -23
  230. data/lib/ronin/model/has_default_port.rb +0 -54
  231. data/lib/ronin/model/targets_arch.rb +0 -68
  232. data/lib/ronin/model/targets_os.rb +0 -69
  233. data/lib/ronin/model/targets_product.rb +0 -68
  234. data/lib/ronin/payloads/asm_payload.rb +0 -40
  235. data/lib/ronin/payloads/binary_payload.rb +0 -42
  236. data/lib/ronin/payloads/control.rb +0 -47
  237. data/lib/ronin/payloads/encoders/encoder.rb +0 -92
  238. data/lib/ronin/payloads/encoders/xor.rb +0 -79
  239. data/lib/ronin/payloads/encoders.rb +0 -32
  240. data/lib/ronin/payloads/exceptions/exception.rb +0 -27
  241. data/lib/ronin/payloads/exceptions/not_implemented.rb +0 -29
  242. data/lib/ronin/payloads/exceptions/unknown_helper.rb +0 -29
  243. data/lib/ronin/payloads/exceptions.rb +0 -23
  244. data/lib/ronin/payloads/has_payload.rb +0 -111
  245. data/lib/ronin/payloads/helpers/chained.rb +0 -61
  246. data/lib/ronin/payloads/helpers/rpc.rb +0 -93
  247. data/lib/ronin/payloads/helpers.rb +0 -23
  248. data/lib/ronin/payloads/nops.rb +0 -39
  249. data/lib/ronin/payloads/payload.rb +0 -350
  250. data/lib/ronin/payloads/payload_author.rb +0 -33
  251. data/lib/ronin/payloads/shellcode.rb +0 -40
  252. data/lib/ronin/payloads/web_payload.rb +0 -41
  253. data/lib/ronin/payloads.rb +0 -36
  254. data/lib/ronin/ui/command_line/commands/exploit.rb +0 -193
  255. data/lib/ronin/ui/command_line/commands/exploits.rb +0 -154
  256. data/lib/ronin/ui/command_line/commands/gen_binary_payload.rb +0 -34
  257. data/lib/ronin/ui/command_line/commands/gen_exploit.rb +0 -34
  258. data/lib/ronin/ui/command_line/commands/gen_ftp_exploit.rb +0 -34
  259. data/lib/ronin/ui/command_line/commands/gen_http_exploit.rb +0 -34
  260. data/lib/ronin/ui/command_line/commands/gen_local_exploit.rb +0 -34
  261. data/lib/ronin/ui/command_line/commands/gen_nops.rb +0 -34
  262. data/lib/ronin/ui/command_line/commands/gen_payload.rb +0 -34
  263. data/lib/ronin/ui/command_line/commands/gen_remote_exploit.rb +0 -34
  264. data/lib/ronin/ui/command_line/commands/gen_remote_tcp_exploit.rb +0 -34
  265. data/lib/ronin/ui/command_line/commands/gen_remote_udp_exploit.rb +0 -34
  266. data/lib/ronin/ui/command_line/commands/gen_shellcode.rb +0 -34
  267. data/lib/ronin/ui/command_line/commands/gen_web_exploit.rb +0 -34
  268. data/lib/ronin/ui/command_line/commands/payload.rb +0 -129
  269. data/lib/ronin/ui/command_line/commands/payloads.rb +0 -128
  270. data/lib/ronin/vuln/behavior.rb +0 -165
  271. data/spec/controls/behaviors_examples.rb +0 -38
  272. data/spec/exploits/binary_exploit_spec.rb +0 -44
  273. data/spec/exploits/buffer_overflow_exploit_spec.rb +0 -70
  274. data/spec/exploits/exploit_spec.rb +0 -313
  275. data/spec/exploits/file_based_exploit_spec.rb +0 -48
  276. data/spec/exploits/format_string_exploit_spec.rb +0 -32
  277. data/spec/exploits/ftp_spec.rb +0 -13
  278. data/spec/exploits/http_spec.rb +0 -17
  279. data/spec/exploits/padding_exploit_spec.rb +0 -44
  280. data/spec/exploits/remote_tcp_spec.rb +0 -28
  281. data/spec/exploits/remote_udp_spec.rb +0 -28
  282. data/spec/exploits/target_spec.rb +0 -98
  283. data/spec/exploits/targets/buffer_overflow_spec.rb +0 -22
  284. data/spec/exploits/web_spec.rb +0 -35
  285. data/spec/generators/exploits/exploit_examples.rb +0 -24
  286. data/spec/generators/exploits/exploit_spec.rb +0 -42
  287. data/spec/generators/exploits/ftp_spec.rb +0 -42
  288. data/spec/generators/exploits/http_spec.rb +0 -42
  289. data/spec/generators/exploits/local_spec.rb +0 -42
  290. data/spec/generators/exploits/remote_spec.rb +0 -42
  291. data/spec/generators/exploits/remote_tcp_spec.rb +0 -47
  292. data/spec/generators/exploits/remote_udp_spec.rb +0 -47
  293. data/spec/generators/exploits/web_spec.rb +0 -52
  294. data/spec/generators/payloads/binary_payload_spec.rb +0 -31
  295. data/spec/generators/payloads/nops_spec.rb +0 -31
  296. data/spec/generators/payloads/payload_examples.rb +0 -16
  297. data/spec/generators/payloads/payload_spec.rb +0 -31
  298. data/spec/generators/payloads/shellcode_spec.rb +0 -31
  299. data/spec/helpers/database.rb +0 -5
  300. data/spec/helpers/objects.rb +0 -22
  301. data/spec/model/has_default_port_spec.rb +0 -27
  302. data/spec/model/models/default_port_model.rb +0 -13
  303. data/spec/model/models/non_default_port_model.rb +0 -11
  304. data/spec/model/models/targets_arch_model.rb +0 -11
  305. data/spec/model/models/targets_os_model.rb +0 -11
  306. data/spec/model/models/targets_product_model.rb +0 -11
  307. data/spec/model/targets_arch_spec.rb +0 -32
  308. data/spec/model/targets_os_spec.rb +0 -33
  309. data/spec/model/targets_product_spec.rb +0 -35
  310. data/spec/objects/exploits/example.rb +0 -25
  311. data/spec/objects/exploits/simple.rb +0 -24
  312. data/spec/objects/payloads/simple.rb +0 -19
  313. data/spec/payloads/encoders/encoder_spec.rb +0 -30
  314. data/spec/payloads/encoders/xor_spec.rb +0 -20
  315. data/spec/payloads/payload_spec.rb +0 -156
  316. data/spec/vuln/behavior_spec.rb +0 -15
  317. data/static/ronin/generators/exploits/_cache.erb +0 -14
  318. data/static/ronin/generators/exploits/_header.erb +0 -1
  319. data/static/ronin/generators/exploits/_helpers.erb +0 -4
  320. data/static/ronin/generators/exploits/exploit.erb +0 -24
  321. data/static/ronin/generators/exploits/ftp.erb +0 -24
  322. data/static/ronin/generators/exploits/http.erb +0 -26
  323. data/static/ronin/generators/exploits/local.erb +0 -24
  324. data/static/ronin/generators/exploits/remote.erb +0 -24
  325. data/static/ronin/generators/exploits/remote_tcp.erb +0 -26
  326. data/static/ronin/generators/exploits/remote_udp.erb +0 -26
  327. data/static/ronin/generators/exploits/web.erb +0 -28
  328. data/static/ronin/generators/payloads/_cache.erb +0 -10
  329. data/static/ronin/generators/payloads/_header.erb +0 -1
  330. data/static/ronin/generators/payloads/_helpers.erb +0 -2
  331. data/static/ronin/generators/payloads/binary_payload.erb +0 -25
  332. data/static/ronin/generators/payloads/nops.erb +0 -19
  333. data/static/ronin/generators/payloads/payload.erb +0 -25
  334. data/static/ronin/generators/payloads/shellcode.erb +0 -25
  335. data/tasks/spec.rb +0 -10
  336. data/tasks/yard.rb +0 -13
  337. data.tar.gz.sig +0 -0
  338. metadata.gz.sig +0 -0
@@ -0,0 +1,80 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2022 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ module Ronin
22
+ module Exploits
23
+ #
24
+ # Base class for all test results.
25
+ #
26
+ # @api semipublic
27
+ #
28
+ # @since 1.0.0
29
+ #
30
+ class TestResult
31
+
32
+ # The descriptive message of the test result.
33
+ #
34
+ # @api public
35
+ attr_reader :message
36
+
37
+ #
38
+ # Initializes the test result.
39
+ #
40
+ # @param [String] message
41
+ # The descriptive message for the result.
42
+ #
43
+ # @api public
44
+ #
45
+ def initialize(message)
46
+ @message = message
47
+ end
48
+
49
+ #
50
+ # Converts the test result to a String.
51
+ #
52
+ # @return [String]
53
+ # The test result message.
54
+ #
55
+ # @api public
56
+ #
57
+ def to_s
58
+ @message
59
+ end
60
+
61
+ #
62
+ # Indicates the presence of a vulnerability.
63
+ #
64
+ class Vulnerable < TestResult
65
+ end
66
+
67
+ #
68
+ # Indicates no vulnerability was found.
69
+ #
70
+ class NotVulnerable < TestResult
71
+ end
72
+
73
+ #
74
+ # Indicates inconclusive results.
75
+ #
76
+ class Unknown < TestResult
77
+ end
78
+ end
79
+ end
80
+ end
@@ -0,0 +1,50 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2022 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ require 'ronin/exploits/memory_corruption'
22
+
23
+ module Ronin
24
+ module Exploits
25
+ #
26
+ # Represents a Use After Free (UAF) exploit.
27
+ #
28
+ # @api public
29
+ #
30
+ # @since 1.0.0
31
+ #
32
+ class UseAfterFree < MemoryCorruption
33
+
34
+ #
35
+ # Returns the type or kind of exploit.
36
+ #
37
+ # @return [Symbol]
38
+ #
39
+ # @note
40
+ # This is used internally to map an exploit class to a printable type.
41
+ #
42
+ # @api private
43
+ #
44
+ def self.exploit_type
45
+ :use_after_free
46
+ end
47
+
48
+ end
49
+ end
50
+ end
@@ -1,27 +1,26 @@
1
1
  #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
3
  # payload crafting functionality.
4
4
  #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
5
+ # Copyright (c) 2007-2022 Hal Brodigan (postmodern.mod3 at gmail.com)
6
6
  #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
10
  # (at your option) any later version.
11
11
  #
12
- # This program is distributed in the hope that it will be useful,
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
13
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
14
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
15
+ # GNU Lesser General Public License for more details.
16
16
  #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
20
19
  #
21
20
 
22
21
  module Ronin
23
22
  module Exploits
24
- # Ronin Exploits version
25
- VERSION = '0.3.1'
23
+ # ronin-exploits version
24
+ VERSION = '1.0.0.beta1'
26
25
  end
27
26
  end
@@ -1,108 +1,37 @@
1
1
  #
2
- # Ronin Exploits - A Ruby library for Ronin that provides exploitation and
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
3
  # payload crafting functionality.
4
4
  #
5
- # Copyright (c) 2007-2009 Hal Brodigan (postmodern.mod3 at gmail.com)
5
+ # Copyright (c) 2007-2022 Hal Brodigan (postmodern.mod3 at gmail.com)
6
6
  #
7
- # This program is free software; you can redistribute it and/or modify
8
- # it under the terms of the GNU General Public License as published by
9
- # the Free Software Foundation; either version 2 of the License, or
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
10
  # (at your option) any later version.
11
11
  #
12
- # This program is distributed in the hope that it will be useful,
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
13
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
14
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- # GNU General Public License for more details.
15
+ # GNU Lesser General Public License for more details.
16
16
  #
17
- # You should have received a copy of the GNU General Public License
18
- # along with this program; if not, write to the Free Software
19
- # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
20
19
  #
21
20
 
22
- require 'ronin/exploits/remote'
23
- require 'ronin/network/helpers/http'
24
- require 'ronin/extensions/uri/http'
21
+ require 'ronin/exploits/exploit'
22
+ require 'ronin/exploits/mixins/http'
25
23
 
26
- require 'uri'
24
+ require 'uri/query_params'
27
25
 
28
26
  module Ronin
29
27
  module Exploits
30
- class Web < Remote
28
+ #
29
+ # An {Exploit} class that represents exploits that run against Web
30
+ # services.
31
+ #
32
+ class Web < Exploit
31
33
 
32
- include Network::Helpers::HTTP
33
-
34
- #
35
- # Creates a new Ronin::Exploits::Web object using the given
36
- # _block_.
37
- #
38
- # ronin_web_exploit do
39
- # ...
40
- # end
41
- #
42
- contextify :ronin_web_exploit
43
-
44
- # The targeted URL path
45
- property :url_path, String
46
-
47
- # The targeted URL query string
48
- property :url_query, String
49
-
50
- # The targeted HTTP host
51
- parameter :host, :description => 'The targeted HTTP host'
52
-
53
- # The targeted HTTP port
54
- parameter :port, :description => 'The targeted HTTP port'
55
-
56
- # The HTTP Request method to use
57
- parameter :http_method,
58
- :default => :get,
59
- :description => 'HTTP Request method to use'
60
-
61
- # The optional URL path prefix
62
- parameter :url_prefix, :description => 'Optional URL path prefix'
63
-
64
- #
65
- # Builds the targeted URL path based on the +url_prefix+ parameter,
66
- # as well as the +url_path+ and +url_query+ properties.
67
- #
68
- # @return [String]
69
- # The targeted URL path.
70
- #
71
- def targeted_url_path
72
- url = self.url_path.to_s
73
- url << "?#{self.url_query}" if self.url_query
74
-
75
- if @url_prefix
76
- url = @url_prefix.to_s + url
77
- end
78
-
79
- return url
80
- end
81
-
82
- #
83
- # Builds the targeted URL based on the +http_host+, +http_port+
84
- # and +url_prefix+ parameters as well as the +url_path+ and
85
- # +url_query+ properties.
86
- #
87
- # @return [URI::Generic]
88
- # The built URI object.
89
- #
90
- def targeted_url
91
- require_params :host
92
-
93
- url = ::URI::HTTP.build(
94
- :host => @host,
95
- :port => @port,
96
- :path => self.url_path,
97
- :query => self.url_query
98
- )
99
-
100
- if @url_prefix
101
- url.path = @url_prefix.to_s + url.path
102
- end
103
-
104
- return url
105
- end
34
+ include Mixins::HTTP
106
35
 
107
36
  end
108
37
  end
@@ -0,0 +1,378 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2022 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ require 'ronin/exploits/web'
22
+ require 'ronin/exploits/mixins/has_payload'
23
+
24
+ module Ronin
25
+ module Exploits
26
+ #
27
+ # An {Exploit} class that represents a common web vulnerability
28
+ # (ex: RFI, LFI, SQLI, XSS, etc).
29
+ #
30
+ # @since 1.0.0
31
+ #
32
+ class WebVuln < Web
33
+
34
+ include Mixins::HasPayload
35
+
36
+ #
37
+ # Gets or sets the HTTP request method to use.
38
+ #
39
+ # @param [:copy, :delete, :get, :head, :lock, :mkcol, :move,
40
+ # :options, :patch, :post, :propfind, :proppatch, :put,
41
+ # :trace, :unlock, nil] new_request_method
42
+ #
43
+ # @return [:copy, :delete, :get, :head, :lock, :mkcol, :move,
44
+ # :options, :patch, :post, :propfind, :proppatch, :put,
45
+ # :trace, :unlock]
46
+ # The previously set HTTP request method or `:get`.
47
+ #
48
+ def self.request_method(new_request_method=nil)
49
+ if new_request_method
50
+ @request_method = new_request_method
51
+ else
52
+ @request_method ||= if superclass < WebVuln
53
+ superclass.request_method
54
+ else
55
+ :get
56
+ end
57
+ end
58
+ end
59
+
60
+ #
61
+ # Gets or sets the base path for the web vulnerability.
62
+ #
63
+ # @param [String, nil] new_base_path
64
+ # The optional new base path value to set.
65
+ #
66
+ # @return [String]
67
+ # The base path for the web vulnerability.
68
+ #
69
+ # @raise [NotImplementedError]
70
+ # The exploit class did not set a base path.
71
+ #
72
+ # @example
73
+ # base_path '/path/to/page.php'
74
+ #
75
+ def self.base_path(new_base_path=nil)
76
+ if new_base_path
77
+ @base_path = new_base_path
78
+ else
79
+ @base_path ||= if superclass < WebVuln
80
+ superclass.base_path
81
+ else
82
+ raise(NotImplementedError,"#{self} did not set base_path")
83
+ end
84
+ end
85
+ end
86
+
87
+ #
88
+ # Gets or sets the query param to exploit.
89
+ #
90
+ # @param [String, nil] new_query_param
91
+ # The optional new query param value to set.
92
+ #
93
+ # @return [String, nil]
94
+ # The query param for the web vulnerability.
95
+ #
96
+ # @example
97
+ # query_param 'id'
98
+ #
99
+ def self.query_param(new_query_param=nil)
100
+ if new_query_param
101
+ @query_param = new_query_param
102
+ else
103
+ @query_param ||= if superclass < WebVuln
104
+ superclass.query_param
105
+ end
106
+ end
107
+ end
108
+
109
+ #
110
+ # Gets or sets the HTTP header name to exploit.
111
+ #
112
+ # @param [String, nil] new_header_name
113
+ # The optional new header name value to set.
114
+ #
115
+ # @return [String, nil]
116
+ # The header name for the web vulnerability.
117
+ #
118
+ # @example
119
+ # header_name 'User-Agent'
120
+ #
121
+ def self.header_name(new_header_name=nil)
122
+ if new_header_name
123
+ @header_name = new_header_name
124
+ else
125
+ @header_name ||= if superclass < WebVuln
126
+ superclass.header_name
127
+ end
128
+ end
129
+ end
130
+
131
+ #
132
+ # Gets or sets the HTTP cookie param to exploit.
133
+ #
134
+ # @param [String, nil] new_cookie_param
135
+ # The optional new cookie param value to set.
136
+ #
137
+ # @return [String, nil]
138
+ # The cookie param for the web vulnerability.
139
+ #
140
+ # @example
141
+ # cookie_param 'foo'
142
+ #
143
+ def self.cookie_param(new_cookie_param=nil)
144
+ if new_cookie_param
145
+ @cookie_param = new_cookie_param
146
+ else
147
+ @cookie_param ||= if superclass < WebVuln
148
+ superclass.cookie_param
149
+ end
150
+ end
151
+ end
152
+
153
+ #
154
+ # Gets or sets the form param to exploit.
155
+ #
156
+ # @param [String, nil] new_form_param
157
+ # The optional new form param value to set.
158
+ #
159
+ # @return [String, nil]
160
+ # The form param for the web vulnerability.
161
+ #
162
+ # @example
163
+ # form_param 'user'
164
+ #
165
+ def self.form_param(new_form_param=nil)
166
+ if new_form_param
167
+ @form_param = new_form_param
168
+ else
169
+ @form_param ||= if superclass < WebVuln
170
+ superclass.form_param
171
+ end
172
+ end
173
+ end
174
+
175
+ #
176
+ # Gets or sets the exploit's default headers.
177
+ #
178
+ # @param [Hash{Symbol,String => String}, nil] new_headers
179
+ # The optional new default headers values to set.
180
+ #
181
+ # @return [Hash{Symbol,String => String}, nil]
182
+ # The default headers for the web vulnerability.
183
+ #
184
+ # @example
185
+ # headers 'X-Foo' => 'foo', 'X-Bar' => 'bar'
186
+ #
187
+ def self.headers(new_headers=nil)
188
+ if new_headers
189
+ @headers = new_headers
190
+ else
191
+ @headers ||= if superclass < WebVuln
192
+ superclass.headers
193
+ end
194
+ end
195
+ end
196
+
197
+ #
198
+ # Gets or sets the exploit's default HTTP cookie data.
199
+ #
200
+ # @param [String, Hash{String => String}, nil] new_cookie
201
+ # The optional new default cookie values to set.
202
+ #
203
+ # @return [String, Hash{String => String}, nil]
204
+ # The default cookie values for the web vulnerability.
205
+ #
206
+ # @example
207
+ # cookie 'lang' => 'en', 'foo' => 'bar'
208
+ #
209
+ def self.cookie(new_cookie=nil)
210
+ if new_cookie
211
+ @cookie = new_cookie
212
+ else
213
+ @cookie ||= if superclass < WebVuln
214
+ superclass.cookie
215
+ end
216
+ end
217
+ end
218
+
219
+ #
220
+ # Gets or sets the exploit's default form data.
221
+ #
222
+ # @param [String, Hash, nil] new_form_data
223
+ # The optional new default form data values to set.
224
+ #
225
+ # @return [String, Hash, nil]
226
+ # The default form data values for the web vulnerability.
227
+ #
228
+ # @example
229
+ # form_data 'foo' => 'a', 'bar' => 'b'
230
+ #
231
+ def self.form_data(new_form_data=nil)
232
+ if new_form_data
233
+ @form_data = new_form_data
234
+ else
235
+ @form_data ||= if superclass < WebVuln
236
+ superclass.form_data
237
+ end
238
+ end
239
+ end
240
+
241
+ #
242
+ # Gets or sets the exploit's default `Referer` path.
243
+ #
244
+ # @param [String, nil] new_referer
245
+ # The optional new default `Referer` value to set.
246
+ # May be either a path or a fully qualified URL.
247
+ #
248
+ # @return [String, nil]
249
+ # The default `Referer` values for the web vulnerability.
250
+ #
251
+ # @example with a path:
252
+ # referer '/previous/page.php'
253
+ #
254
+ # @example with a fully qualified URL:
255
+ # referer 'https://other.website.com/page.php'
256
+ #
257
+ def self.referer(new_referer=nil)
258
+ if new_referer
259
+ @referer = new_referer
260
+ else
261
+ @referer ||= if superclass < WebVuln
262
+ superclass.referer
263
+ end
264
+ end
265
+ end
266
+
267
+ param :http_user, String, desc: 'The user for HTTP Basic-Auth'
268
+
269
+ param :http_password, String, desc: 'The password for HTTP Basic-Auth'
270
+
271
+ #
272
+ # The target URL for the web vulnerability.
273
+ #
274
+ # @return [URI::HTTP]
275
+ #
276
+ def url
277
+ @url ||= url_for(self.class.base_path)
278
+ end
279
+
280
+ #
281
+ # Additional HTTP header names and values to add to the exploit request.
282
+ #
283
+ # @return [Hash{Symbol,String => String}, nil]
284
+ #
285
+ # @see headers
286
+ #
287
+ def headers
288
+ self.class.headers
289
+ end
290
+
291
+ #
292
+ # Additional `Cookie` header to send with the exploit request.
293
+ #
294
+ # @return [String, Hash{String => String}, nil]
295
+ #
296
+ # @see cookie
297
+ #
298
+ def cookie
299
+ self.class.cookie
300
+ end
301
+
302
+ #
303
+ # The form data that may be sent in the body of the exploit request.
304
+ #
305
+ # @return [Hash, String, nil]
306
+ #
307
+ # @see form_data
308
+ #
309
+ def form_data
310
+ self.class.form_data
311
+ end
312
+
313
+ #
314
+ # The optional HTTP `Referer` header to send with the exploit request.
315
+ #
316
+ # @return [String, nil]
317
+ #
318
+ # @see referer
319
+ #
320
+ def referer
321
+ if (referer = self.class.referer)
322
+ url_for(referer)
323
+ end
324
+ end
325
+
326
+ #
327
+ # Common keyword arguments for `Ronin::Vulns::Web#initialize`.
328
+ #
329
+ # @return [Hash{Symbol => Object}]
330
+ #
331
+ # @api private
332
+ #
333
+ def web_vuln_kwargs
334
+ {
335
+ query_param: self.class.query_param,
336
+ header_name: self.class.header_name,
337
+ cookie_param: self.class.cookie_param,
338
+ form_param: self.class.form_param,
339
+ request_method: self.class.request_method,
340
+ http: http,
341
+ user: params[:http_user],
342
+ password: params[:http_password],
343
+ headers: headers,
344
+ cookie: cookie,
345
+ form_data: form_data,
346
+ referer: referer
347
+ }
348
+ end
349
+
350
+ #
351
+ # Creates the `Ronin::Vulns::WebVuln` object based on the information
352
+ # defined in the exploit class and params.
353
+ #
354
+ # @return [Ronin::Vulns::WebVuln]
355
+ #
356
+ # @abstract
357
+ #
358
+ def vuln
359
+ raise(NotImplementedError,"#{self.class}##{__method__} was not implemented")
360
+ end
361
+
362
+ #
363
+ # Determines if the URL is vulnerable to the web vulnerability.
364
+ #
365
+ # @return [TestResult::Vulnerable, TestResult::NotVulnerable]
366
+ # Indicates whether the URL is vulnerable or not vulnerable.
367
+ #
368
+ def test
369
+ if vuln.vulnerable?
370
+ Vulnerable("The target URL is vulnerable")
371
+ else
372
+ NotVulnerable("The target URL is not vulnerable")
373
+ end
374
+ end
375
+
376
+ end
377
+ end
378
+ end