ronin 1.5.1 → 2.0.0.beta1

data/lib/ronin/cli/commands/cert_grab.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+#
+# Copyright (c) 2006-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# Ronin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ronin is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ronin.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/cli/value_processor_command'
+require 'ronin/support/network/ssl/mixin'
+
+require 'uri'
+
+module Ronin
+  class CLI
+    module Commands
+      #
+      # Downloads the SSL/TLS certificate for a SSL/TLS service or `https://`
+      # URL.
+      #
+      # ## Usage
+      #
+      #     ronin cert-grab [options] {HOST:PORT | URL} ...
+      #
+      # ## Options
+      #
+      #     -f, --file FILE                  Optional file to read values from
+      #     -h, --help                       Print help information
+      #
+      # ## Arguments
+      #
+      #     HOST:PORT | URL ...              A HOST:PORT or URL
+      #
+      # ## Examples
+      #
+      #     ronin cert-grab github.com:443
+      #     ronin cert-grab 93.184.216.34:443
+      #     ronin cert-grab https://github.com/
+      #
+      class CertGrab < ValueProcessorCommand
+
+        include Support::Network::SSL::Mixin
+
+        usage '[options] {HOST:PORT | URL} ...'
+
+        argument :target, required: true,
+                          repeats:  true,
+                          usage:   'HOST:PORT | URL',
+                          desc:    'A HOST:PORT or URL'
+
+        description "Downloads SSL/TLS certificates"
+
+        examples [
+          'github.com:443',
+          '93.184.216.34:443',
+          'https://github.com/',
+        ]
+
+        man_page 'ronin-cert-grab.1'
+
+        #
+        # Runs the `ronin cert-grab` command.
+        #
+        # @param [String] value
+        #   The `HOST:PORT` or `URL` value to process.
+        #
+        def process_value(value)
+          case value
+          when /\A[^:]+:\d+\z/
+            host, port = value.split(':',2)
+            port = port.to_i
+
+            grab_cert(host,port)
+          when /\Ahttps:/
+            uri = URI.parse(value)
+            host = uri.host
+            port = uri.port
+
+            grab_cert(host,port)
+          else
+            print_error "invalid target: must be a HOST:PORT or a URL: #{value.inspect}"
+            exit(1)
+          end
+        end
+
+        #
+        # The output file for the given host and port.
+        #
+        # @param [String] host
+        #
+        # @param [Integer] port
+        #
+        # @return [String]
+        #   The output `.crt` file to save the certificate to.
+        #
+        def cert_file_for(host,port)
+          "#{host}:#{port}.crt"
+        end
+
+        #
+        # Downloads the certificate for the given host and port.
+        #
+        # @param [String] host
+        #   The host to connect to.
+        #
+        # @param [Integer] port
+        #   The port to connect to.
+        #
+        def grab_cert(host,port)
+          cert = ssl_cert(host,port)
+
+          cert.save(cert_file_for(host,port))
+        end
+
+      end
+    end
+  end
+end

data/lib/ronin/cli/commands/decode.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+#
+# Copyright (c) 2006-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# Ronin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ronin is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ronin.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/cli/string_methods_command'
+
+module Ronin
+  class CLI
+    module Commands
+      #
+      # Decode each character of data from a variety of encodings.
+      #
+      # ## Usage
+      #
+      #     ronin decode [options] [FILE ...]
+      #
+      # ## Options
+      #
+      #     -f, --file FILE                  Optional file to process
+      #         --string STRING              Optional string to process
+      #     -M, --multiline                  Process each line separately
+      #     -n, --keep-newlines              Preserves newlines at the end of each line
+      #         --base32                     Base32 decodes the data
+      #     -b, --base64=[strict|url]        Base64 decodes the data
+      #     -c, --c                          Encodes the data as a C string
+      #     -X, --hex                        Hex decode the data (ex: "414141...")
+      #     -H, --html                       HTML decodes the data
+      #     -u, --uri                        URI decodes the data
+      #         --http                       HTTP decodes the data
+      #     -j, --js                         JavaScript decodes the data
+      #     -S, --shell                      Encodes the data as a Shell String
+      #     -P, --powershell                 Encodes the data as a PowerShell String
+      #     -R, --ruby                       Ruby decodes the data
+      #     -x, --xml                        XML decodes the data
+      #     -h, --help                       Print help information
+      #
+      # ## Arguments
+      #
+      #     [FILE ...]                       Optional file(s) to process
+      #
+      class Decode < StringMethodsCommand
+
+        option :base32, desc: 'Base32 decodes the data' do
+                          require 'ronin/support/encoding/base32'
+                          @method_calls << :base32_decode
+                        end
+
+        option :base64, short: '-b',
+                        equals: true,
+                        value: {
+                          type:     [:strict, :url],
+                          required: false
+                        },
+                        desc: 'Base64 decodes the data' do |mode=nil|
+                          require 'ronin/support/encoding/base64'
+                          if mode
+                            @method_calls << [:base64_decode, [mode]]
+                          else
+                            @method_calls << :base64_decode
+                          end
+                        end
+
+        option :c, short: '-c',
+                   desc: 'Decodes the data as a C string' do
+                     require 'ronin/support/encoding/c'
+                     @method_calls << :c_decode
+                   end
+
+        option :hex, short: '-X',
+                     desc: 'Hex decode the data (ex: "414141...")' do
+                       require 'ronin/support/encoding/hex'
+                       @method_calls << :hex_decode
+                     end
+
+        option :html, short: '-H',
+                      desc: 'HTML decodes the data' do
+                        require 'ronin/support/encoding/html'
+                        @method_calls << :html_decode
+                      end
+
+        option :uri, short: '-u',
+                     desc: 'URI decodes the data' do
+                       require 'ronin/support/encoding/uri'
+                       @method_calls << :uri_decode
+                     end
+
+        option :http, desc: 'HTTP decodes the data' do
+                        require 'ronin/support/encoding/http'
+                        @method_calls << :http_decode
+                      end
+
+        option :js, short: '-j',
+                    desc: 'JavaScript decodes the data' do
+                      require 'ronin/support/encoding/js'
+                      @method_calls << :js_decode
+                    end
+
+        option :shell, short: '-S',
+                       desc: 'Decodes the data as a Shell String' do
+                         require 'ronin/support/encoding/shell'
+                         @method_calls << :shell_decode
+                       end
+
+        option :powershell, short: '-P',
+                            desc: 'Decodes the data as a PowerShell String' do
+                              require 'ronin/support/encoding/powershell'
+                              @method_calls << :powershell_decode
+                            end
+
+        option :ruby, short: '-R',
+                      desc: 'Ruby decodes the data' do
+                        require 'ronin/support/encoding/ruby'
+                        @method_calls << :ruby_decode
+                      end
+
+        option :xml, short: '-x',
+                     desc: 'XML decodes the data' do
+                       require 'ronin/support/encoding/xml'
+                       @method_calls << :xml_decode
+                     end
+
+        description 'Decodes each character of data from a variety of encodings'
+
+        man_page 'ronin-decode.1'
+
+      end
+    end
+  end
+end

data/lib/ronin/cli/commands/decrypt.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+#
+# Copyright (c) 2006-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# Ronin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ronin is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ronin.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/cli/cipher_command'
+
+module Ronin
+  class CLI
+    module Commands
+      #
+      # Decrypts data.
+      #
+      # ## Usage
+      #
+      #     ronin decrypt [options] [FILE ...]
+      #
+      # ## Options
+      #
+      #     -k, --key STRING                 The key String
+      #     -K, --key-file FILE              The key file
+      #     -c, --cipher NAME                The cipher to decrypt with. See --list-ciphers (Default: aes-256-cbc)
+      #     -P, --password PASSWORD          The password to decrypt with
+      #     -H md5|sha1|sha256|sha512,       The hash algorithm to use for the password (Default: sha256)
+      #         --hash
+      #         --iv STRING                  Sets the Initial Vector (IV) value of the cipher
+      #         --padding NUM                Sets the padding of the decryption cipher
+      #     -b, --block-size NUM             The size in bytes to read data in (Default: 16384)
+      #         --list-ciphers               List all available ciphers
+      #     -h, --help                       Print help information
+      #
+      # ## Arguments
+      #
+      #     [FILE ...]                       The file(s) to decrypt
+      #
+      class Decrypt < CipherCommand
+
+        description 'Decrypts data'
+
+        man_page 'ronin-decrypt.1'
+
+        #
+        # Creates a new decryption cipher.
+        #
+        # @return [Ronin::Support::Crypto::Cipher]
+        #
+        def cipher
+          super(direction: :decrypt)
+        end
+
+      end
+    end
+  end
+end

data/lib/ronin/cli/commands/dns.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+#
+# Copyright (c) 2006-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# Ronin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ronin is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ronin.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/cli/value_processor_command'
+require 'ronin/support/network/dns'
+
+module Ronin
+  class CLI
+    module Commands
+      #
+      # Queries DNS records for the given host name.
+      #
+      # ## Usage
+      #
+      #     ronin dns [options] [HOST [...]]
+      #
+      # ## Options
+      #
+      #     -f, --file FILE                  Optional file to read values from
+      #     -N, --nameserver IP              Send DNS queries to the nameserver
+      #     -t A|AAAA|ANY|CNAME|HINFO|LOC|MINFO|MX|NS|PTR|SOA|SRV|TXT|WKS,
+      #         --type                       Queries a specific type of DNS record
+      #     -h, --help                       Print help information
+      #
+      # ## Arguments
+      #
+      #     HOST                             The host name to query
+      #
+      class Dns < ValueProcessorCommand
+
+        usage '[options] HOST'
+
+        option :nameserver, short: '-N',
+                            value: {
+                              type: String,
+                              usage: 'HOST|IP'
+                            },
+                            desc: 'Send DNS queries to the nameserver' do |ip|
+                              @nameservers << ip
+                            end
+
+        option :type, short: '-t',
+                      value: {
+                        type: {
+                          A:     :a,
+                          AAAA:  :aaaa,
+                          ANY:   :any,
+                          CNAME: :cname,
+                          HINFO: :hinfo,
+                          LOC:   :loc,
+                          MINFO: :minfo,
+                          MX:    :mx,
+                          NS:    :ns,
+                          PTR:   :ptr,
+                          SOA:   :soa,
+                          SRV:   :srv,
+                          TXT:   :txt,
+                          WKS:   :wks
+                        }
+                      },
+                      desc: 'Queries a specific type of DNS record'
+
+        argument :host, required: true,
+                        desc:     'The host name to query'
+
+        description 'Performs a variety of DNS queries'
+
+        man_page 'ronin-dns.1'
+
+        #
+        # Initializes the `ronin dns` command.
+        #
+        def initialize(**kwargs)
+          super(**kwargs)
+
+          @nameservers = []
+        end
+
+        #
+        # The resolver to use.
+        #
+        # @return [Ronin::Network::DNS::Resolver]
+        #   The DNS resolver.
+        #
+        def resolver
+          @resolver ||= unless @nameservers.empty?
+                          Support::Network::DNS.resolver(nameservers: @nameservers)
+                        else
+                          Support::Network::DNS.resolver
+                        end
+        end
+
+        #
+        # Queries the given host.
+        #
+        # @param [String] host
+        #
+        def process_value(host)
+          print_records(query_records(host))
+        end
+
+        #
+        # Queries the records for the given host name.
+        #
+        # @param [String] host
+        #   The host name to query.
+        #
+        # @return [Array<Resolv::DNS::Resource>]
+        #   The returned DNS resource records.
+        #
+        def query_records(host)
+          if options[:type]
+            resolver.get_records(host,options[:type].downcase)
+          else
+            resolver.get_a_records(host) + resolver.get_aaaa_records(host)
+          end
+        end
+
+        #
+        # Prints multiple DNS records.
+        #
+        # @param [Array<Resolv::DNS::Resource>] records
+        #   The DNS resource records to print.
+        #
+        def print_records(records)
+          records.each do |record|
+            print_record(record)
+          end
+        end
+
+        #
+        # Prints a DNS record.
+        #
+        # @param [Resolv::DNS::Resource] record
+        #   The DNS resource record to print.
+        #
+        def print_record(record)
+          case record
+          when Resolv::DNS::Resource::IN::A,
+               Resolv::DNS::Resource::IN::AAAA
+            puts record.address
+          when Resolv::DNS::Resource::IN::NS,
+               Resolv::DNS::Resource::IN::CNAME,
+               Resolv::DNS::Resource::IN::PTR
+            puts record.name
+          when Resolv::DNS::Resource::IN::MX
+            puts record.exchange
+          when Resolv::DNS::Resource::IN::TXT
+            puts record.strings.join
+          when Resolv::DNS::Resource::IN::HINFO
+            puts "#{record.cpu} #{record.os}"
+          when Resolv::DNS::Resource::IN::LOC
+            puts "#{record.latitude} #{record.longitude}"
+          when Resolv::DNS::Resource::IN::MINFO
+            puts "#{record.emailbx}@#{record.rmailbx}"
+          when Resolv::DNS::Resource::IN::SOA
+            puts "#{record.mname} #{record.rname} #{record.serial} #{record.refresh} #{record.retry} #{record.expire} #{record.ttl}"
+          when Resolv::DNS::Resource::IN::SRV
+            puts "#{record.port} #{record.priority} #{record.weight} #{record.target}"
+          when Resolv::DNS::Resource::IN::WKS
+            puts "#{record.address} #{record.protocol}"
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/ronin/cli/commands/email_addr.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+#
+# Copyright (c) 2006-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# Ronin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ronin is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ronin.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/cli/value_processor_command'
+
+require 'ronin/support/network/email_address'
+
+module Ronin
+  class CLI
+    module Commands
+      #
+      # Processes email addresses.
+      #
+      # ## Usage
+      #
+      #     ronin email-addr [options] [EMAIL_ADDR ...]
+      #
+      # ## Options
+      #
+      #     -f, --file FILE                  Optional file to read values from
+      #     -O, --obfuscate                  Obfuscates the email address(es)
+      #         --enum-obfuscations          Enumerate over every obfuscation
+      #     -D, --deobfuscate                Deobfuscates the email address(es)
+      #     -n, --name                       Extracts the name part of the email address(es)
+      #     -m, --mailbox                    Extracts the mailbox part of the email address(es)
+      #     -d, --domain                     Extracts the domain part of the email address(es)
+      #     -N, --normalize                  Normalizes the email address(es)
+      #     -h, --help                       Print help information
+      #
+      # ## Arguments
+      #
+      #     [EMAIL_ADDR ...]                 The email address(es) to process
+      #
+      # ## Examples
+      #
+      #     ronin email-addr --deobfuscate "john{DOT}smith{AT}example{DOT}com"
+      #     ronin email-addr --input emails.txt --domain
+      #
+      class EmailAddr < ValueProcessorCommand
+
+        command_name 'email-addr'
+
+        usage '[options] [EMAIL_ADDR ...]'
+
+        option :obfuscate, short: '-O',
+                           desc:  'Obfuscates the email address(es)'
+
+        option :enum_obfuscations, desc: 'Enumerate over every obfuscation'
+
+        option :deobfuscate, short: '-D',
+                             desc:  'Deobfuscates the email address(es)'
+
+        option :name, short: '-n',
+                      desc:  'Extracts the name part of the email address(es)'
+
+        option :mailbox, short: '-m',
+                         desc: 'Extracts the mailbox part of the email address(es)'
+
+        option :domain, short: '-d',
+                        desc: 'Extracts the domain part of the email address(es)'
+
+        option :normalize, short: '-N',
+                           desc: 'Normalizes the email address(es)'
+
+        argument :email_addr, required: false,
+                              repeats:  true,
+                              desc:     'The email address(es) to process'
+
+        description "Processes email addresses"
+
+        examples [
+          '--deobfuscate "john{DOT}smith{AT}example{DOT}com"',
+          '--input emails.txt --domain'
+        ]
+
+        man_page 'ronin-email-addr.1'
+
+        #
+        # Processes an individual email address.
+        #
+        # @param [String] string
+        #   An individual email address.
+        #
+        def process_value(string)
+          if options[:deobfuscate]
+            string = Support::Network::EmailAddress.deobfuscate(string)
+          end
+
+          email_address = Support::Network::EmailAddress.parse(string)
+          email_address = email_address.normalize if options[:normalize]
+
+          if options[:enum_obfuscations]
+            email_address.each_obfuscation do |obfuscated_email|
+              puts obfuscated_email
+            end
+          elsif options[:obfuscate]
+            puts email_address.obfuscate
+          elsif options[:name]
+            puts email_address.name
+          elsif options[:mailbox]
+            puts email_address.mailbox
+          elsif options[:domain]
+            puts email_address.domain
+          else
+            puts email_address
+          end
+        end
+
+      end
+    end
+  end
+end