ruckus 0.5.4

data/lib/ruckus/mac_addr.rb

@@ -0,0 +1,31 @@
+# instead of dealing with .value directly, this class exposes 'set' and 
+# 'display' methods for handling @value as a mac address string.
+class MacAddr < Ruckus::Str
+  def initialize(opts={})
+    opts[:size] = 6
+    super(opts)
+    @width = 48
+  end
+
+  # mac address may be specified as either
+  #  aa-bb-cc-dd-ee-ff
+  #  or
+  #  aa:bb:cc:dd:ee:ff
+  def set(val)
+    unless m=/^([0-9a-f]{2})([:-]?)([0-9a-f]{2})\2([0-9a-f]{2})\2([0-9a-f]{2})\2([0-9a-f]{2})\2([0-9a-f]{2})$/i.match(val)
+      raise "argument must be a mac_addr string as in aa:bb:cc:dd:ee:ff"
+    end
+    self.value = [$1,$3,$4,$5,$6,$7].join('').dehexify
+  end
+
+    
+  def display
+    self.value.split('').map {|x| x.hexify}.join(':')
+  end
+
+  def to_human(indent=nil)
+    indent ||= ""
+    "#{indent}#{name} = #{self.display}"
+  end
+end
+

data/lib/ruckus/mutator.rb

@@ -0,0 +1,318 @@
+# === Mutator is a half-assed fuzzing framework intended to snap in to Ruckus.
+# Mutator provides a decorator-style interface to fuzzed integers and strings,
+# so that you can chain them to get strings that grow and include metacharacters
+# with X probability, etc.
+#
+# There are two core objects in here:
+# * <tt>Mutator</tt> is a base type, like a String or an Integer, wrapped
+#   in an object that provides a <tt>permute</tt> method to change the
+#   value, and a stack of <tt>Modifier</tt> objects.
+# * <tt>Modifier</tt> is an object that takes a value and changes it
+#   to do evil. Modifiers chain.
+#
+# This stuff is really kind of an afterthought; the real work in building
+# fuzzer is getting the encoding right, so you can reach more of the target
+# code. Ruckus hides the details of how strings and integers are actually
+# encoded, so most of the "fuzzing" part just comes down to making evil
+# looking strings. The Parsel framework takes care of encoding those evil
+# strings properly so that a CIFS stack will read them.
+#
+module Ruckus
+    module Mutator
+
+        # Create me with a String, and I wrap the string, forwarding method
+        # invocations to it. Call "permute" and I'll run through my Modifier
+        # chain to derive a new value (for instance, tripling the number of
+        # characters).
+        #
+        class Mutator
+
+            # <tt>base</tt> is usually a String (like "helu") or Fixnum.
+            # Stack is a set of modifier objects (or class names, if you
+            # just want to use the defaults). A Mutator with an empty
+            # Modifier stack doesn't do anything and behaves just like an
+            # ordinary String or Fixnum.
+            #
+            def initialize(base=nil, stack=[])
+                @base = base
+                @cur = @base
+                @stack = stack.map do |o|
+                    o = o.new if o.kind_of? Class
+                    o
+                end
+            end
+
+            def method_missing(meth, *args)
+                @cur.send(meth, *args)
+            end
+
+            # A fuzzer clock tick; mess up the enclosed value.
+            #
+            def permute
+                @cur = @stack.inject(@cur) {|cur, mod| mod << cur}
+            end
+        end
+
+        # The guts; each Modifier class implements some way of screwing
+        # with a value to catch bugs. Modifiers are all created with
+        # keyword args; the base class catches:
+        # now::        true/false (def: false) fire immediately, just once,
+        #              irrespective of probability, even if probability is
+        #              provided.
+        # prob::       (def: 100) pctg chance this modifier will fire on this
+        #              tick
+        # max_steps::  number of times to fire this modifier before it stops
+        #              and just starts acting like a no-op. -1 equals no max
+        #
+        class Modifier
+            def initialize(opts={})
+                @now = opts[:now] || false
+                @prob = opts[:prob] || 100
+                @max_steps   = opts[:max_steps] || 700
+                @cur   = 0
+                @opts = opts
+            end
+
+            # Should this fire, based on prob?
+            #
+            def go?
+                if @now
+                    @now = false
+                    return true
+                end
+                rand(100) < @prob
+            end
+
+            # Base class stub does nothing. Subclasses override this method
+            # to implement logic. Callers don't use this method, though: they
+            # use operator<<.
+            #
+            def mod(x); x; end
+
+            # This is what callers call. Subclasses do not override this
+            # method. This implements probability and max-steps. How it
+            # looks:
+            #
+            #   str = modifier << str
+            #
+            def <<(x)
+                return x if (@cur += 1) > @max_steps && @max_steps != -1
+                return x if not go?
+                mod(x)
+            end
+        end
+
+        # Geometrically increases size.
+        #
+        # A
+        # AA
+        # AAAA
+        # AAAAAAAA ... etc
+        #
+        class Multiplier < Modifier
+
+            # Takes:
+            # multiplier::    (def: 2) how much to multiply by.
+            #
+            def initialize(opts={})
+                @step  = opts[:multiplier] || 2
+                super
+            end
+
+            def mod(x)
+                x * @step
+            end
+        end
+
+        # Adds fixed amounts of data.
+        #
+        # A
+        # AA
+        # AAA
+        # AAAA ... etc
+        #
+        class Adder < Modifier
+
+            # Takes:
+            # base::       (def: "A") what to add
+            # step::       (def: 100) how much of this to add at each step
+            #
+            def initialize(opts={})
+                @base  = opts[:base] || "A"
+                @step  = opts[:step]  || 100
+                super
+            end
+
+            def mod(x)
+                if x.kind_of? String
+                    x + (@base * @step)
+                else
+                    x + @step
+                end
+            end
+        end
+
+        # Path traversal metacharacters and keywords, cycled. Add new
+        # ones to the STRINGS array.
+        #
+        class PathTraversal < Modifier
+            STRINGS = [ "etc/passwd",
+                        "etc/passwd\x00",
+                        "etc/passwd%00",
+                        "boot.ini",
+                        "boot.ini\x00",
+                        "boot.ini%00" ]
+            def mod(x)
+                x = x + ("../" * (@cur + 1)) + STRINGS[@cur % STRINGS.size]
+                if (@cur % 2) == 0
+                    x.gsub!("/", "\\")
+                end
+                return x
+            end
+        end
+
+        # The format strings, cycled. Add new ones to the STRINGS array.
+        #
+        class FormatStrings < Modifier
+            STRINGS = [ "%n", "%25n", "%s", "%x" ]
+
+            def mod(x)
+                x + STRINGS[@cur % STRINGS.size]
+            end
+        end
+
+        # The most likely evil metachars, but if you're thorough, you
+        # just try all non-isalnums.
+        #
+        class Metacharacters < Modifier
+            STRINGS = [ ".", "/", "\\", "$", "-", "%", "$", ";",
+                        "'", '"', "*", "\x00" ]
+
+            def mod
+                x = x + STRINGS[@cur % STRINGS.size]
+                if opts[:hexify]
+                    0.upto(x.size - 1) do |i|
+                        x[i] = "%#{ x[i].to_s(16) }"
+                    end
+                end
+                return x
+            end
+        end
+
+        # Things that will break SQL queries.
+        #
+        class SQLStrings < Modifier
+            STRINGS = [ "'sql0", "+sql1", "sql2;", "sql3 ;--", "(sql4)" ]
+
+            def mod
+                x + STRINGS[@cur % STRINGS.size]
+            end
+        end
+
+        # Trivial XSS tickler.
+        #
+        class XSS < Modifier
+            def mod
+                x + "<script>alert(document.location);</script>"
+            end
+        end
+
+        # Generate random numbers
+        #
+        class Random < Modifier
+            def initialize(opts={})
+                srand((@seed = opts[:seed])) if opts[:seed]
+                super
+                @max = opts[:max] || 0xFFFFFFFF
+                if opts[:width]
+                    @max = Numeric.mask_for(opts[:width])
+                end
+            end
+
+            def mod(i)
+                rand(@max)
+            end
+        end
+
+        # Randomly sets the top bit of each byte, turning ASCII into
+        # hi-ASCII.
+        #
+        class Hibit < Modifier
+            def initialize(opts={})
+                opts[:prob] ||= 50
+                @width = opts[:width] || 32
+                super
+            end
+
+            def mod(x)
+                if x.kind_of? String
+                    0.upto(x.size - 1) do |i|
+                        x[i] |= 0x80 if go?
+                    end
+                else
+                    x |= (0x80 << (@width - 8))
+                end
+                return x
+            end
+        end
+
+        # Cache the starting value (this is meant to the be first modifier
+        # in the chain, if you're using it) and randomly reset the string
+        # back to that starting value.
+        #
+        class Reset < Modifier
+            def initialize(opts={})
+                opts[:prob] ||= 25
+                super(opts.merge(:now => true))
+            end
+
+            def mod(x)
+                (@orig ||= x.clone).clone
+            end
+        end
+
+        # Randomize a string.
+        #
+        class Randomizer < Modifier
+            def mod(x)
+                0.upto(x.size-1) do |i|
+                    x[i] = rand(0xff)
+                end
+                return x
+            end
+        end
+
+        # Wrap Number with Mutator, make to_i work.
+        #
+        class Number < Mutator
+            def initialize(base=0, stack=[]); super; end
+            def to_i; @cur.to_i; end
+        end
+
+        # Wrap String with Mutator, make to_s work.
+        #
+        class Str < Mutator
+            def initialize(base="", stack=[]); super; end
+            def to_s(off=nil); @cur.to_s; end
+        end
+
+        class << self
+            def random_int(opts={})
+                Number.new(1, [Random.new(opts)])
+            end
+
+            def r8; random_int(:width => 8); end
+            def r16; random_int(:width => 16); end
+            def r32; random_int(:width => 32); end
+            def r64; random_int(:width => 64); end
+
+            def grostring(base="A", opts={})
+                Str.new(base, [Reset, Adder.new(opts)])
+            end
+
+            def randstr(base="A")
+                Str.new(base, [Reset, Randomizer])
+            end
+        end
+    end
+end

data/lib/ruckus/null.rb

@@ -0,0 +1,24 @@
+module Ruckus
+    class Null < Parsel
+        def initialize(opts={})
+            super(opts)
+        end
+
+        def to_s(off=nil)
+            @rendered_offset = off || 0
+            if off
+                return "", off
+            else
+                return ""
+            end
+        end
+
+        def capture(str)
+            return str
+        end
+
+        def size
+            0
+        end
+    end
+end

data/lib/ruckus/number.rb

@@ -0,0 +1,360 @@
+# === Most things you want to render are Numbers
+
+module Ruckus
+    # A Ruckus::Number is a type of Parsel that wraps an Integer.
+    class Number < Parsel
+        attr_accessor :width, :endian, :radix, :pad, :ascii
+        attr_accessor :value
+
+
+        # Options:
+        # width::    (Default: 32) Width in bits --- can be odd!
+        # endian::   (Default: :little) Endianness --- not honored for
+        #            odd widths
+        # value::    Usually a fixnum, but can be a method to call on
+        #            sibling Parsel, e.g. :size for "Length" fields.
+        #
+        # Note: odd-width fields must be parented (see Blob or Structure)
+        # to render or capture their values
+        #
+        def initialize(opts={})
+            opts[:width] ||= 32
+            opts[:endian] ||= :little
+            # opts[:value] ||= 0xABADCAFE
+            opts[:value] ||= 0
+            opts[:radix] ||= 0
+
+            if opts[:endian] == :native
+                opts[:endian] = Parsel.endian?
+            end
+            super(opts)
+        end
+
+        private
+
+        def widthcode
+            case @width
+            when 8;  code = "C"
+            when 16; code = "S"
+            when 32; code = "I"
+            when 64; code = "Q"
+            else
+                nil
+            end
+        end
+
+        public
+
+        # this is some seriously weak shit down here
+
+        # Is this an odd-width (single bit, nibble, etc) number?
+        #
+        def odd_width? ; not widthcode ; end
+
+        private
+
+        def span_start
+            i_am = where_am_i?
+            first = i_am
+            (i_am - 1).downto(0) do |i|
+                begin
+                    break if not parent[i].odd_width?
+                rescue
+                    break
+                end
+                first = i
+            end
+            return first
+        end
+
+        public
+
+        # For odd-width fields --- find how big the span of neighboring odd-width
+        # fields is, in bits.
+        #
+        def span_bits
+            last = where_am_i?
+            span_start.upto(parent.count - 1) do |i|
+                break if not parent[i].respond_to? :odd_width?
+                break if not parent[i].odd_width?
+                last = i
+            end
+
+            tot = 0
+            span_start.upto(last) { |i| tot += parent[i].width }
+            tot
+        end
+
+        # Where are we in the span of neighboring odd-width fields?
+        #
+        def span_offset
+            tot = 0
+            span_start.upto(where_am_i? - 1) {|i| tot += parent[i].width}
+            tot
+        end
+
+        # Given: a string, return: the remainder of the string after
+        # parsing the number, side-effect: populate @value
+        #
+        def capture(str)
+            return ascii_capture(str) if @ascii
+            return odd_width_capture(str) if not (code = widthcode)
+
+            incomplete! if str.size < size
+            cap = str.shift(size)
+            cap = cap.reverse if not Parsel.native?(@endian)
+            @value = cap.unpack(code).first
+            return str
+        end
+
+        BASERX = {
+            2 => /([01]+)/,
+            8 => /([0-7]+)/,
+            10 => /([0-9]+)/,
+            16 => /([0-9a-fA-F]+)/
+        }
+
+        def ascii_capture(str)
+            incomplete! if str.empty?
+
+            # weak
+            if (rad = resolve(@radix)) == 0
+                if str.starts_with? "0x"
+                    rad = 16
+                    str.shift 2
+                else
+                    rad = 10
+                end
+            end
+
+            if(str =~ BASERX[rad])
+                @value = $1.to_i(rad)
+                str.shift($1.size)
+            else
+                @value = 0
+            end
+
+            return str
+        end
+
+        # Quick hack: true is 1, false is 0, nil is 0.
+        #
+        def resolve(x)
+            r = super
+            r = 1 if r == true
+            r = 0 if r == false
+            r = 0 if r == nil
+            return r
+        end
+
+        # Render this number (or, if odd-width, this span of odd-width
+        # values, if we're the first element of the span) as a bit string.
+        #
+        def to_s(off=nil)
+            @rendered_offset = off || 0
+
+            begin
+                if @ascii
+                    r = ascii_to_s
+                elsif not (code = widthcode)
+                    r = odd_width_to_s
+                else
+                    val = resolve(@value).to_i
+                    r = [val].pack(code)
+                    r = r.reverse if @endian != Parsel.endian?
+                end
+
+                if off
+                    return r, off+r.size
+                else
+                    return r
+                end
+            rescue
+                raise
+            end
+        end
+
+        def ascii_to_s
+            if((rad = resolve(@radix)) == 0)
+                rad = 10
+            end
+
+            pad = resolve(@pad) || 0
+            @value.to_s(rad).rjust(pad, "0")
+        end
+
+        # Render a span of odd-width numbers as a byte string
+        #
+        def odd_width_to_s
+            return "" if not odd_width_first?
+
+            acc = 0
+            tot = 0
+            bits = span_bits
+
+            # Cheat horribly: Ruby has bignums, so just treat the whole
+            # span as one giant bignum and math it into place.
+
+            where_am_i?.upto(parent.count - 1) do |i|
+                break if not parent[i].respond_to? :odd_width?
+                break if not parent[i].odd_width?
+                acc <<= parent[i].width
+                tot += parent[i].width
+                acc |= parent[i].resolve(parent[i].value) & Numeric.mask_for(parent[i].width)
+            end
+            acc <<= 8 - (tot % 8) if (tot % 8) != 0
+
+            # Dump the bignum to a binary string
+
+            ret = ""
+            while bits > 0
+                ret << (acc & 0xff).chr
+                acc >>= 8
+                bits -= 8
+            end
+
+            ret.reverse! if @endian == :big
+            return ret
+        end
+
+        # Are we the first odd-width number in the span?
+        #
+        def odd_width_first?
+            return true if odd_width? and where_am_i? == 0
+            begin
+                not parent[where_am_i? - 1].odd_width?
+            rescue
+                true
+            end
+        end
+
+        # Capture a whole span of odd-width numbers, see capture
+        #
+        def odd_width_capture(str)
+            return str if not odd_width_first?
+
+            incomplete! if str.size < (bytes_for_bits = Parsel.bytes_for_bits(span_bits))
+
+            cap = str.shift(bytes_for_bits)
+
+            acc = 0
+            cap.each_byte do |b|
+                acc <<= 8
+                acc |= b
+            end
+            tbits = cap.size * 8
+            tot = 0
+            where_am_i?.upto(parent.count - 1) do |i|
+                break if not parent[i].respond_to? :odd_width?
+                break if not parent[i].odd_width?
+                tot += parent[i].width
+                parent[i].value = (acc >> (tbits - tot)) & Numeric.mask_for(parent[i].width)
+            end
+
+            return str
+        end
+
+        # How big is the encoded number?
+        #
+        def size
+            if not odd_width?
+                s = Parsel.bytes_for_bits(@width);
+            elsif odd_width_first?
+                s = span_bits * 8
+            else
+                s = 0
+            end
+            s
+        end
+    end
+
+    Num = Number.clone
+
+    ## ---------------------------------------------------------
+    ## XXX DRY, refactoring in process
+    ##
+    ## Moved this from classmethods to classes so we can encode
+    ## more into the type, useful for selectors
+
+    class Le16 < Number
+        def initialize(opts={}); super(opts.merge(:width => 16, :endian => :little))
+        end
+    end
+
+    # For no good reason, "halfwords" are little endian, but "shorts" are
+    # network byte order. You're welcome.
+
+    H16, Uint16le, Half, Halfword = [ Le16.clone, Le16.clone, Le16.clone, Le16.clone ]
+
+    class Le32 < Number
+        def initialize(opts={}); super(opts.merge(:width => 32, :endian => :little))
+        end
+    end
+
+    H32 = Le32.clone
+    Uint32le = Le32.clone
+
+    class Le64 < Number
+        def initialize(opts={}); super(opts.merge(:width => 64, :endian => :little))
+        end
+    end
+
+    H64 = Le64.clone
+    Uint64le = Le64.clone
+
+    class Be16 < Number
+        def initialize(opts={}); super(opts.merge(:width => 16, :endian => :big))
+        end
+    end
+
+    N16, Uint16be, Short = [Be16.clone, Be16.clone, Be16.clone]
+
+    class Be32 < Number
+        def initialize(opts={}); super(opts.merge(:width => 32, :endian => :big))
+        end
+    end
+
+    N32 = Be32.clone
+    Uint32be = Be32.clone
+
+    class Be64 < Number
+        def initialize(opts={}); super(opts.merge(:width => 64, :endian => :big))
+        end
+    end
+
+    N64 = Be64.clone
+    Uint64be = Be64.clone
+
+    class Byte < Number
+        def initialize(opts={}); super(opts.merge(:width => 8))
+        end
+    end
+
+    Le8, Be8, N8, H8 = [Byte.clone, Byte.clone, Byte.clone, Byte.clone]
+
+    class Bit < Number
+        def initialize(opts={}); super(opts.merge(:width => 1))
+        end
+    end
+
+    class Nibble < Number
+        def initialize(opts={}); super(opts.merge(:width => 4))
+        end
+    end
+    Nybble = Nibble.clone
+
+    # A length field (specify the width, if it's not 32 bits
+    # little-endian) --- its value will be :size of the following
+    # field (or provide :offset)
+
+    class Len < Number
+        def initialize(opts={})
+            super(opts.merge(:width => 32, :value => :size))
+        end
+    end
+
+    class Decimal < Ruckus::Number
+        OPTIONS = { :ascii => true, :radix => 10 }
+    end
+
+end