wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/lib/mdm/module.rb

@@ -0,0 +1,13 @@
+# Namespace for all models dealing with module caching.
+module Mdm::Module
+  extend ActiveSupport::Autoload
+
+  autoload :Action
+  autoload :Arch
+  autoload :Author
+  autoload :Detail
+  autoload :Mixin
+  autoload :Platform
+  autoload :Ref
+  autoload :Target
+end

data/lib/mdm.rb

@@ -0,0 +1,57 @@
+# Namespace for models
+module Mdm
+  extend ActiveSupport::Autoload
+
+  autoload :ApiKey
+  autoload :AsyncCallback
+  autoload :Client
+  autoload :Cred
+  autoload :Event
+  autoload :ExploitAttempt
+  autoload :ExploitedHost
+  autoload :Host
+  autoload :HostDetail
+  autoload :HostTag
+  autoload :Listener
+  autoload :Loot
+  autoload :Macro
+  autoload :ModRef
+  autoload :Module
+  autoload :NexposeConsole
+  autoload :Note
+  autoload :Payload
+  autoload :Profile
+  autoload :Ref
+  autoload :Route
+  autoload :Service
+  autoload :Session
+  autoload :SessionEvent
+  autoload :Tag
+  autoload :Task
+  autoload :TaskCred
+  autoload :TaskHost
+  autoload :TaskService
+  autoload :TaskSession
+  autoload :User
+  autoload :Vuln
+  autoload :VulnAttempt
+  autoload :VulnDetail
+  autoload :VulnRef
+  autoload :WebForm
+  autoload :WebPage
+  autoload :WebSite
+  autoload :WebVuln
+  autoload :WmapRequest
+  autoload :WmapTarget
+  autoload :Workspace
+
+  # Causes the model_name for all Mdm modules to not include the Mdm:: prefix in their name.
+  #
+  # This has been supported since ActiveSupport 3.2.1.  In ActiveSupport 3.1.0, it checked for _railtie.  Before that
+  # there was no way to do relative naming without manually overriding model_name in each class.
+  #
+  # @return [true]
+  def self.use_relative_model_naming?
+    true
+  end
+end

data/lib/metasploit_data_models/automatic_exploitation.rb

@@ -0,0 +1,25 @@
+# Namespace for automatic exploitation.  Automatic exploitation
+# {MetasploitDataModels::AutomaticExploitation::Match matches}
+# {MetasploitDataModels::AutomaticExploitation::Match#matchable services or vulnerbatility} with the
+# {MetasploitDataModels::AutomaticExploitation::Match#module_detail Metasploit Module} that can exploit the service or
+# vulnerability.  These matches are grouped into a {MetasploitDataModels::AutomaticExploitation::MatchSet a set} that
+# can be {MetasploitDataModels::AutomaticExploitation::Run run} multiple times.
+module MetasploitDataModels::AutomaticExploitation
+  extend ActiveSupport::Autoload
+
+  autoload :Match
+  autoload :MatchResult
+  autoload :MatchSet
+  autoload :Run
+
+  #
+  # Module Methods
+  #
+
+  # The prefix of the `ApplicationRecord#table_name` of subclasses in this namespace.
+  #
+  # @return [String]
+  def self.table_name_prefix
+    'automatic_exploitation_'
+  end
+end

data/lib/metasploit_data_models/base64_serializer.rb

@@ -0,0 +1,99 @@
+# Provides ActiveRecord 3.1x-friendly serialization for descendants of
+# ApplicationRecord. Backwards compatible with older YAML methods and
+# will fall back to string decoding in the worst case
+#
+# @example Using default default of {}
+#   serialize :foo, MetasploitDataModels::Base64Serializer.new
+#
+# @example Overriding default to []
+#   serialize :bar, MetasploitDataModels::Base64Serializer.new(:default => [])
+#
+class MetasploitDataModels::Base64Serializer
+  #
+  # CONSTANTS
+  #
+
+  # The default for {#default}
+  DEFAULT = {}
+  # Deserializers for {#load}
+  # 1. Base64 decoding and then unmarshalling the value.
+  # 2. Parsing the value as YAML.
+  # 3. The raw value.
+  LOADERS = [
+      lambda { |serialized|
+        marshaled = serialized.unpack('m').first
+        # Load the unpacked Marshal object first
+        Marshal.load(marshaled)
+      },
+      lambda { |serialized|
+        # Support legacy YAML encoding for existing data
+        YAML.load(serialized)
+      },
+      lambda { |serialized|
+        # Fall back to string decoding
+        serialized
+      }
+  ]
+
+  #
+  # Methods
+  #
+
+  # Creates a duplicate of default value
+  #
+  # @return
+  def default
+    @default.dup
+  end
+
+  attr_writer :default
+
+  # Serializes the value by marshalling the value and then base64 encodes the marshaled value.
+  #
+  # @param value [Object] value to serialize
+  # @return [String]
+  def dump(value)
+    # Always store data back in the Marshal format
+    marshalled = Marshal.dump(value)
+    base64_encoded = [ marshalled ].pack('m')
+
+    base64_encoded
+  end
+
+  # @param attributes [Hash] attributes
+  # @option attributes [Object] :default ({}) Value to use for {#default}.
+  def initialize(attributes={})
+    attributes.assert_valid_keys(:default)
+
+    @default = attributes.fetch(:default, DEFAULT)
+  end
+
+  # Deserializes the value by either
+  # 1. Base64 decoding and then unmarshalling the value.
+  # 2. Parsing the value as YAML.
+  # 3. Returns the raw value.
+  #
+  # @param value [String] serialized value
+  # @return [Object]
+  #
+  # @see #default
+  def load(value)
+    loaded = nil
+
+    if value.blank?
+      loaded = default
+    else
+      LOADERS.each do |loader|
+        begin
+          loaded = loader.call(value)
+        rescue
+          next
+        else
+          break
+        end
+      end
+    end
+
+    loaded
+  end
+end

data/lib/metasploit_data_models/change_required_columns_to_null_false.rb

@@ -0,0 +1,21 @@
+# Changes all the COLUMNS in the table with TABLE_NAME that are required from the table's mode, but were previously
+# `:null => true`, to `:null => false`.
+#
+#  @abstract Subclass and define COLUMNS as Array<Symbol> and TABLE_NAME as Symbol.
+class MetasploitDataModels::ChangeRequiredColumnsToNullFalse < ActiveRecord::Migration[4.2]
+  # Marks all the COLUMNS as `:null => true`
+  def down
+    # Use self.class:: so constants are resolved in subclasses instead of this class.
+    self.class::COLUMNS.each do |column|
+      change_column_null(self.class::TABLE_NAME, column, true)
+    end
+  end
+
+  # Marks all the COLUMNS as `:null => false`
+  def up
+    # Use self.class:: so constants are resolved in subclasses instead of this class.
+    self.class::COLUMNS.each do |column|
+      change_column_null(self.class::TABLE_NAME, column, false)
+    end
+  end
+end

data/lib/metasploit_data_models/engine.rb

@@ -0,0 +1,32 @@
+require 'rails'
+
+# `Rails::Engine` that exposes MetasploitDataModel's `ApplicationRecord` subclasses and automatically loads its
+# `FactoryBot` factories, sequences, and traits.
+class MetasploitDataModels::Engine < Rails::Engine
+  # @see http://viget.com/extend/rails-engine-testing-with-rspec-capybara-and-factorygirl
+  config.generators do |g|
+    g.assets false
+    g.fixture_replacement :factory_bot, :dir => 'spec/factories'
+    g.helper false
+    g.test_framework :rspec, :fixture => false
+  end
+
+  # Remove ActiveSupport::Dependencies loading paths to save time during constant resolution and to ensure that
+  # metasploit_data_models is properly declaring all autoloads and not falling back on ActiveSupport::Dependencies
+  config.paths.values.each do |path|
+    path.skip_autoload!
+    path.skip_autoload_once!
+    path.skip_eager_load!
+    path.skip_load_path!
+  end
+
+  initializer 'metasploit_data_models.prepend_factory_path', :after => 'factory_bot.set_factory_paths' do
+    if defined? FactoryBot
+      relative_definition_file_path = config.generators.options[:factory_bot][:dir]
+      definition_file_path = root.join(relative_definition_file_path)
+
+      # unshift so that Pro can modify mdm factories
+      FactoryBot.definition_file_paths.unshift definition_file_path
+    end
+  end
+end

data/lib/metasploit_data_models/ip_address/cidr.rb

@@ -0,0 +1,174 @@
+# Common behavior for Class-InterDomain Routing (`<address>/<prefix-length>`) notation under
+# {MetasploitDataModels::IPAddress},
+module MetasploitDataModels::IPAddress::CIDR
+  # so that translations for errors messages can be filed under metasploit_data_models/ip_address/cidr
+  extend ActiveModel::Naming
+  extend ActiveSupport::Concern
+
+  #
+  # CONSTANTS
+  #
+
+  # Separator between the {#address} and {#prefix_length}
+  SEPARATOR = '/'
+
+  #
+  # Attributes
+  #
+
+  # @!attribute address
+  #   The IP address being masked by {#prefix_length} `1` bits.
+  #
+  #   @return [Object] an instance of {address_class}
+  attr_reader :address
+
+  # @!attribute prefix_length
+  #   The significant number of bits in {#address}.
+  #
+  #   @return [Integer] number of `1` bits in the netmask of {#address}
+  attr_reader :prefix_length
+
+  included do
+    include ActiveModel::Validations
+
+    #
+    #
+    # Validations
+    #
+    #
+
+    #
+    # Validation Methods
+    #
+
+    validate :address_valid
+
+    #
+    # Attribute Validations
+    #
+
+    validates :address,
+              presence: true
+  end
+
+  # Class methods added to the including `Class`.
+  module ClassMethods
+    include MetasploitDataModels::Match::Child
+
+    #
+    # Attributes
+    #
+
+    # @!attribute address_class
+    #   The Class` whose instance are usd for {MetasploitDataModels::IPAddress::CIDR#address}.
+    #
+    #   @return [Class]
+    attr_reader :address_class
+
+    #
+    # Methods
+    #
+
+    # @note `address_class` must respond to `#segment_class` and `#segment_count` so {#maximum_prefix_length} can be
+    #   calculated.
+    #
+    # Sets up the address class and allowed {#maximum_prefix_length} for the including `Class`.
+    #
+    # @param options [Hash{Symbol => Class}]
+    # @option options [Class, #segment_class, #segment_count] :address_class The `Class` whose instances will be used
+    #   for {#address}.
+    def cidr(options={})
+      options.assert_valid_keys(:address_class)
+
+      @address_class = options.fetch(:address_class)
+
+      #
+      # Validations
+      #
+
+      validates :prefix_length,
+                numericality: {
+                    only_integer: true,
+                    greater_than_or_equal_to: 0,
+                    less_than_or_equal_to: maximum_prefix_length
+                }
+    end
+
+    # Regular expression that matches a string that contains only a CIDR IP address.
+    #
+    # @return [Regexp]
+    def match_regexp
+      @match_regexp ||= /\A#{regexp}\z/
+    end
+
+    # The maximum number of bits in a prefix for the {#address_class}.
+    #
+    # @return [Integer] the number of bits across all segments of {#address_class}.
+    def maximum_prefix_length
+      @maximum_prefix_length ||= address_class.segment_count * address_class.segment_class.bits
+    end
+
+    # Regular expression that matches a portion of string that contains a CIDR IP address.
+    #
+    # @return [Regexp]
+    def regexp
+      @regexp ||= /(?<address>#{address_class.regexp})#{Regexp.escape(SEPARATOR)}(?<prefix_length>\d+)/
+    end
+  end
+
+  #
+  # Instance Methods
+  #
+
+  # Set {#address}.
+  #
+  # @param formatted_address [#to_s]
+  def address=(formatted_address)
+    @address = self.class.address_class.new(value: formatted_address)
+  end
+
+  # Set {#prefix_length}.
+  #
+  # @param formatted_prefix_length [#to_s]
+  def prefix_length=(formatted_prefix_length)
+    @prefix_length_before_type_cast = formatted_prefix_length
+
+    begin
+      # use Integer() instead of String#to_i as String#to_i will ignore trailing letters (i.e. '1two' -> 1) and turn all
+      # string without an integer in it to 0.
+      @prefix_length = Integer(formatted_prefix_length.to_s)
+    rescue ArgumentError
+      @prefix_length = formatted_prefix_length
+    end
+  end
+
+  # The formatted_prefix_length passed to {#prefix_length=}
+  #
+  # @return [#to_s]
+  def prefix_length_before_type_cast
+    @prefix_length_before_type_cast
+  end
+
+  # Parses the `formatted_value` into an {#address} and {#prefix_length}.
+  #
+  # @param formatted_value [#to_s]
+  def value=(formatted_value)
+    formatted_address, formatted_prefix_length = formatted_value.to_s.split(SEPARATOR, 2)
+
+    self.address = formatted_address
+    self.prefix_length = formatted_prefix_length
+
+    [address, prefix_length]
+  end
+
+  private
+
+  # Validates that {#address} is valid.
+  #
+  # @return [void]
+  def address_valid
+    if address && !address.valid?
+      errors.add(:address, :invalid)
+    end
+  end
+end

data/lib/metasploit_data_models/ip_address/range.rb

@@ -0,0 +1,181 @@
+# Common behavior for ranges under {MetasploitDataModels::IPAddress}, including ranges of addresses and segments.
+module MetasploitDataModels::IPAddress::Range
+  # so that translations for error messages can be filed under metasploit_data_models/ip_address/range
+  extend ActiveModel::Naming
+  extend ActiveSupport::Concern
+
+  #
+  # CONSTANTS
+  #
+
+  # Separator between the {#begin} and {#end} in the formatted value.
+  SEPARATOR = '-'
+
+  #
+  # Attributes
+  #
+
+  # @!attribute value
+  #   The range.
+  #
+  #   @return [Range<Object, Objectr>] Range with {ClassMethods#extreme_class} instances for `Range#begin` and
+  #     `Range#end`.
+  #   @return [String] if `formatted_value` cannot be parsed into a Range.
+  attr_reader :value
+
+  included do
+    include ActiveModel::Validations
+
+    #
+    #
+    # Validations
+    #
+    #
+
+    #
+    # Validation Methods
+    #
+
+    validate :extremes_valid
+    validate :order
+
+    #
+    # Validation Attributes
+    #
+
+    validates :begin,
+              presence: true
+    validates :end,
+              presence: true
+
+  end
+
+
+  # Class methods added to the including `Class`.
+  module ClassMethods
+    # @note Call {#extremes} first to set {#extreme_class_name}.
+    #
+    # Regular expression that matches a string exactly when it contains an IP address range with the correct
+    # {#extreme_class}.
+    #
+    # @return [Regexp] {#regexp} pinned with `'\A'` and `'\z'` to the whole `String`.
+    def match_regexp
+      @match_regexp ||= /\A#{regexp}\z/
+    end
+
+    # @note Call {#extremes} first to set {#extreme_class_name}.
+    #
+    # The `Class` for each extreme (`Range#begin` and `Range#end`) of the range.
+    #
+    # @return [Class]
+    def extreme_class
+      @extreme_class ||= extreme_class_name.constantize
+    end
+
+    # The name of {#extreme_class}.
+    #
+    # @return [String] `Class#name` passed to :class_name key when {#extremes} was called.
+    # @return [nil] if {#extremes} has not been called.
+    def extreme_class_name
+      @extreme_class_name
+    end
+
+    # Sets {#extreme_class_name}.
+    #
+    # @example Setting extremes class name
+    #   extremes class_name: 'MetasploitDataModels::IPAddress::V4::Single'
+    #
+    # @param options [Hash{Symbol => String}]
+    # @option options [String] :class_name {#extreme_class_name}.
+    # @return [void]
+    def extremes(options={})
+      options.assert_valid_keys(:class_name)
+
+      @extreme_class_name = options.fetch(:class_name)
+    end
+
+    # @note Call {#extremes} first to set {#extreme_class_name}.
+    #
+    # Regular expression match a {SEPARATOR} separated range with {#extreme_class} parseable `Range#begin` and
+    # `Range#end`.
+    #
+    # @return [Regexp]
+    def regexp
+      @regexp ||= /#{extreme_class.regexp}#{SEPARATOR}#{extreme_class.regexp}/
+    end
+  end
+
+  #
+  # Instance Methods
+  #
+
+  # Begin of segment range.
+  #
+  # @return [MetasploitDataModels::IPAddress::V4::NMAP::Segment::Number] if {#value} is a `Range`.
+  # @return [nil] if {#value} is not a `Range`.
+  def begin
+    if value.respond_to? :begin
+      value.begin
+    end
+  end
+
+  # End of segment range.
+  #
+  # @return [MetasploitDataModels::IPAddress::V4::NMAP::Segment::Number] if {#value} is a `Range`.
+  # @return [nil] if {#value} is not a `Range`.
+  def end
+    if value.respond_to? :end
+      value.end
+    end
+  end
+
+  # This range as a string.  Equivalent to the original `formatted_value` passed to {#value}.
+  #
+  # @return [String]
+  def to_s
+    "#{self.begin}#{SEPARATOR}#{self.end}"
+  end
+
+  # Sets {#value} by breaking up the range into its begin and end Integers.
+  #
+  # @param formatted_value [#to_s]
+  # @return [Range<Integer, Integer>] if {SEPARATOR} is used and both extremes are Integers.
+  # @return [#to_s] `formatted_value` if it could not be converted
+  def value=(formatted_value)
+    formatted_extremes = formatted_value.to_s.split(SEPARATOR, 2)
+
+    extremes = formatted_extremes.map { |formatted_extreme|
+      self.class.extreme_class.new(value: formatted_extreme)
+    }
+
+    begin
+      @value = Range.new(*extremes)
+    rescue ArgumentError
+      @value = formatted_value
+    end
+  end
+
+  private
+
+  # Validates that {#begin} and {#end} are valid.
+  #
+  # @return [void]
+  def extremes_valid
+    [:begin, :end].each do |extreme_name|
+      extreme_value = send(extreme_name)
+
+      unless extreme_value.respond_to?(:valid?) && extreme_value.valid?
+        errors.add(extreme_name, :invalid)
+      end
+    end
+  end
+
+  # Validates that {#begin} is `<=` {#end}.
+  #
+  # @return [void]
+  def order
+    if self.begin && self.end && self.begin > self.end
+      errors.add(:value, :order, begin: self.begin, end: self.end)
+    end
+  end
+end

data/lib/metasploit_data_models/ip_address/v4/segment/nmap.rb

@@ -0,0 +1,7 @@
+# A segment in Nmap's IPv4 address format: either a {List comma separated list} or a {Range hyphenated range}.
+module MetasploitDataModels::IPAddress::V4::Segment::Nmap
+  extend ActiveSupport::Autoload
+
+  autoload :List
+  autoload :Range
+end

data/lib/metasploit_data_models/ip_address/v4/segment.rb

@@ -0,0 +1,7 @@
+# A segment (or octet) in an IPv4 address format.
+module MetasploitDataModels::IPAddress::V4::Segment
+  extend ActiveSupport::Autoload
+
+  autoload :Nmap
+  autoload :Single
+end

data/lib/metasploit_data_models/ip_address/v4.rb

@@ -0,0 +1,11 @@
+# Namespace for IPv4 Address format models.
+module MetasploitDataModels::IPAddress::V4
+  extend ActiveSupport::Autoload
+
+  autoload :CIDR
+  autoload :Nmap
+  autoload :Range
+  autoload :Segment
+  autoload :Segmented
+  autoload :Single
+end

data/lib/metasploit_data_models/ip_address.rb

@@ -0,0 +1,9 @@
+# Namespace for models for validating various IPv4 formats beyond those supported by the Ruby standard library's
+# `IPAddr`.
+module MetasploitDataModels::IPAddress
+  extend ActiveSupport::Autoload
+
+  autoload :CIDR
+  autoload :Range
+  autoload :V4
+end

data/lib/metasploit_data_models/match/child.rb

@@ -0,0 +1,48 @@
+# Adds a {#match match class method} to the extending class.  The extending class must define `MATCH_REGEXP`.
+#
+# @example Define `match` class method
+#   class MetasploitDataModels::Format
+#     extend MetasploitDataModels::Match::Child
+#
+#     #
+#     # CONSTANTS
+#     #
+#
+#     # Regular expression {MetasploitDataModels::Match#match} must match against.
+#     MATCH_REGEXP = /\A...\z/
+#   end
+#
+#   # a `MetasploitDataModels::Format` because `'123'` matches `MetasploitDataModels::Format::MATCH_REGEXP`
+#   instance = MetapsloitDataModels::Format.match('123')
+#   # `nil` because string `'12'` doesn't match `MetasploitDataModels::Format::MATCH_REGEXP`
+#   no_instance = MetasploitDataModels::Format.match('12')
+#
+module MetasploitDataModels::Match::Child
+  # Creates a new instance of the extending class if `MATCH_REGEXP`, defined on the extending class, matches
+  # `formatted_value`.
+  #
+  # @param formatted_value [#to_s]
+  def match(formatted_value)
+    instance = nil
+
+    if match_regexp.match(formatted_value)
+      instance = new(value: formatted_value)
+    end
+
+    instance
+  end
+
+  # Regular expression to match against for {#match}.
+  #
+  # @return [Regexp] Defaults to {#regexp} pinned with `\A` and `\z`.
+  def match_regexp
+    @match_regexp ||= /\A#{regexp}\z/
+  end
+
+  # Regular expression to match child as part of {MetasploitDataModels::Match::Parent}.
+  #
+  # @return [Regexp] Default to `REGEXP` from the extending `Class`.
+  def regexp
+    self::REGEXP
+  end
+end