wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/app/models/mdm/async_callback.rb

@@ -0,0 +1,64 @@
+# An asychronous callback that has been received by the Mettle Pingback Listener and is logged
+class Mdm::AsyncCallback < ApplicationRecord
+  extend ActiveSupport::Autoload
+
+  include Metasploit::Model::Search
+
+  #
+  # Associations
+  #
+
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] uuid
+  #   A 16-byte unique identifier for this payload. The UUID is encoded to include specific information.
+  #   See lib/msf/core/payload/uuid.rb in the https://github.com/rapid7/metasploit-framework repo.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] timestamp
+  #   The Unix format timestamp when this payload called back.
+  #
+  #   @return [Integer]
+
+  # @!attribute [rw] listener_uri
+  #   Non-unique URIs (eg. "tcp://192.168.1.7:4444") which received callbacks from this payload.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] target_host
+  #   The IP address (eg. "192.168.1.7" or "fe80::1") from which the callback originated, from the view of the callback listener.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] target_port
+  #   The IP port (eg. "4444") from which the callback originated, from the view of the callback listener.
+  #
+  #   @return [Integer]
+
+  #
+  # Validations
+  #
+
+
+  #
+  # Search Attributes
+  #
+
+  search_attribute :uuid,
+                   type: :string
+
+  #
+  # Serializations
+  #
+
+  # NONE
+
+
+  public
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/client.rb

@@ -0,0 +1,50 @@
+# Client used for `report_client` in metasploit-framework Metasploit Modules.
+class Mdm::Client < ApplicationRecord
+  #
+  # Associations
+  #
+
+  # {Mdm::Host} from which this client connected.
+  belongs_to :host,
+             class_name: 'Mdm::Host',
+             inverse_of: :clients
+
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this client was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute updated_at
+  #   When this client was last updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # @!group User Agent
+  #
+
+  # @!attribute ua_name
+  #   Parsed name from {#ua_string user agent string}
+  #
+  #   @return [String]
+
+  # @!attribute ua_string
+  #   Raw user agent string from client browser
+  #
+  #   @return [String]
+
+  # @!attribute ua_ver
+  #   Version of user agent.
+  #
+  #   @return [String]
+
+  #
+  # @!endgroup
+  #
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/cred.rb

@@ -0,0 +1,205 @@
+# @deprecated Use metasploit-credential's `Metasploit::Credential::Core`.
+#
+# A credential captured from a {#service}.
+class Mdm::Cred < ApplicationRecord
+  #
+  # CONSTANTS
+  #
+
+  # Checks if {#proof} is an SSH Key in {#ssh_key_id}.
+  KEY_ID_REGEX = /([0-9a-fA-F:]{47})/
+
+  # Maps {#ptype_human} to {#ptype}.
+  PTYPES = {
+      'read/write password' => 'password_rw',
+      'read-only password' => 'password_ro',
+      'SMB hash' => 'smb_hash',
+      'SSH private key' => 'ssh_key',
+      'SSH public key' => 'ssh_pubkey'
+  }
+
+  #
+  #
+  # Associations
+  #
+  #
+
+  # The {Mdm::Service} this Cred is for.
+  belongs_to :service,
+             class_name: 'Mdm::Service',
+             inverse_of: :creds
+
+  # Joins {#tasks} to this Cred.
+  has_many :task_creds,
+           class_name: 'Mdm::TaskCred',
+           dependent: :destroy,
+           inverse_of: :cred
+
+  #
+  # through: :task_creds
+  #
+
+  # Tasks that touched this service
+  has_many :tasks, :through => :task_creds
+
+  #
+  # Attributes
+  #
+
+  # @!attribute active
+  #   Whether the credential is active.
+  #
+  #   @return [false] if a captured credential cannot be used to log into {#service}.
+  #   @return [true] otherwise
+
+  # @!attribute created_at
+  #   When this credential was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute pass
+  #   Pass of credential.
+  #
+  #   @return [String, nil]
+
+  # @!attribute proof
+  #   Proof of credential capture.
+  #
+  #   @return [String]
+
+  # @!attribute ptype
+  #   Type of {#pass}.
+  #
+  #   @return [String]
+
+  # @!attribute source_id
+  #   Id of source of this credential.
+  #
+  #   @return [Integer, nil]
+
+  # @!attribute source_type
+  #   Type of source with {#source_id}.
+  #
+  #   @return [String, nil]
+
+  # @!attribute updated_at
+  #   The last time this credential was updated.
+  #
+  #   @return [DateTime]
+
+  # @!attribute user
+  #   User name of credential.
+  #
+  #   @return [String, nil]
+
+  #
+  # Callbacks
+  #
+
+  after_create :increment_host_counter_cache
+  after_destroy :decrement_host_counter_cache
+
+  #
+  # Instance methods
+  #
+
+  # Humanized {#ptype}.
+  #
+  # @return [String, nil]
+  def ptype_human
+    humanized = PTYPES.select do |k, v|
+      v == ptype
+    end.keys[0]
+
+    humanized ? humanized : ptype
+  end
+
+  # Returns SSH Key ID.
+  #
+  # @return [String] SSH Key Id if ssh-type key and {#proof} matches {KEY_ID_REGEX}.
+  # @return [nil] otherwise
+  def ssh_key_id
+    return nil unless self.ptype =~ /^ssh_/
+    return nil unless self.proof =~ KEY_ID_REGEX
+    $1.downcase # Can't run into NilClass problems.
+  end
+
+  # Returns whether `other`'s SSH private key or public key matches.
+  #
+  # @return [false] if `other` is not same class as `self`.
+  # @return [false] if {#ptype} does not match.
+  # @return [false] if {#ptype} is neither `"ssh_key"` nor `"ssh_pubkey"`.
+  # @return [false] if {#ssh_key_id} is `nil`.
+  # @return [false] if {#ssh_key_id} does not match.
+  # @return [true] if {#ssh_key_id} matches.
+  def ssh_key_matches?(other_cred)
+    return false unless other_cred.kind_of? self.class
+    return false unless self.ptype == other_cred.ptype
+    case self.ptype
+      when "ssh_key"
+        matches = self.ssh_private_keys
+      when "ssh_pubkey"
+        matches = self.ssh_public_keys
+      else
+        return false
+    end
+    matches.include?(self) and matches.include?(other_cred)
+  end
+
+  # Returns all keys with matching key ids, including itself.
+  #
+  # @return [ActiveRecord::Relation<Mdm::Cred>] ssh_key and ssh_pubkey creds with matching {#ssh_key_id}.
+  def ssh_keys
+    (self.ssh_private_keys | self.ssh_public_keys)
+  end
+
+  # Returns all private keys with matching {#ssh_key_id}, including itself.
+  #
+  # @return [ActiveRecord::Relation<Mdm::Cred>] ssh_key creds with matching {#ssh_key_id}.
+  def ssh_private_keys
+    return [] unless self.ssh_key_id
+    matches = Mdm::Cred.where(
+        "ptype = ? AND proof ILIKE ?", "ssh_key", "%#{self.ssh_key_id}%"
+    ).to_a
+    matches.select {|c| c.workspace == self.workspace}
+  end
+
+  # Returns all public keys with matching {#ssh_key_id}, including itself.
+  #
+  # @return [ActiveRecord::Relation<Mdm::Cred>] ssh_pubkey creds with matching {#ssh_key_id}.
+  def ssh_public_keys
+    return [] unless self.ssh_key_id
+    matches = Mdm::Cred.where(
+        "ptype = ? AND proof ILIKE ?", "ssh_pubkey", "%#{self.ssh_key_id}%"
+    ).to_a
+    matches.select {|c| c.workspace == self.workspace}
+  end
+
+  # Returns its workspace
+  #
+  # @return [Mdm::Workspace]
+  def workspace
+    self.service.host.workspace
+  end
+
+  private
+
+  # Decrements {Mdm::Host#cred_count}.
+  #
+  # @return [void]
+  def decrement_host_counter_cache
+    Mdm::Host.decrement_counter("cred_count", self.service.host_id)
+  end
+
+  # Increments {Mdm::Host#cred_count}.
+  #
+  # @return [void]
+  def increment_host_counter_cache
+    Mdm::Host.increment_counter("cred_count", self.service.host_id)
+  end
+
+  # Switch back to public for load hooks.
+  public
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/event.rb

@@ -0,0 +1,83 @@
+# Records framework events to the database.
+class Mdm::Event < ApplicationRecord
+    
+  #
+  # Associations
+  #
+
+  # Host on which this event occurred.
+  #
+  # @return [Mdm::Host]
+  # @return [nil] if event did not occur on a host.
+  belongs_to :host,
+             class_name: 'Mdm::Host',
+             inverse_of: :events
+
+  # {Mdm::Workspace} in which this event occured.  If {#host} is present, then this will match
+  # {Mdm::Host#workspace `host.workspace`}.
+  belongs_to :workspace,
+             class_name: 'Mdm::Workspace',
+             inverse_of: :events
+  
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this event was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute critical
+  #   Indicates if the event is critical.
+  #
+  #   @return [false] event is not critical.
+  #   @return [true] event is critical.
+
+  # @!attribute  name
+  #   Name of the event, such as 'module_run'.
+  #
+  #   @return [String]
+
+  # @!attribute seen
+  #   Whether a user has seen these events.
+  #
+  #   @return [false] if the event has not been seen.
+  #   @return [true] if any user has seen the event.
+
+  # @!attribute  updated_at
+  #   The last time this event was updated.
+  #
+  #   @return [DateTime]
+
+  # @!attribute username
+  #   Name of user that triggered the event.  Not necessarily a {Mdm::User#username}, as {#username} may be set to
+  #   the username of the user inferred from `ENV` when using metasploit-framework.
+  #
+  #   @return [String]
+
+  #
+  # Scopes
+  #
+
+  scope :flagged, -> { where(:critical => true, :seen => false) }
+  scope :module_run, -> { where(:name => 'module_run') }
+
+  #
+  # Serializations
+  #
+
+  # {#name}-specific information about this event.
+  #
+  # @return [Hash]
+  serialize :info, MetasploitDataModels::Base64Serializer.new
+
+  #
+  # Validations
+  #
+
+  validates :name, :presence => true
+
+  Metasploit::Concern.run(self)
+end
+

data/app/models/mdm/exploit_attempt.rb

@@ -0,0 +1,105 @@
+# An attempt to exploit {#host}.
+class Mdm::ExploitAttempt < ApplicationRecord
+  
+  #
+  # Associations
+  #
+
+  # Host that was attempted to be exploited.
+  #
+  # @return [Mdm::Host]
+  belongs_to :host,
+             class_name: 'Mdm::Host',
+             counter_cache: :exploit_attempt_count,
+             inverse_of: :exploit_attempts
+
+  # Loot gathers from the successful exploit.
+  #
+  # @return [Mdm::Loot, nil]
+  belongs_to :loot,
+             class_name: 'Mdm::Loot',
+             inverse_of: :exploit_attempt
+
+  # The service being exploited on {#host}.
+  #
+  # @return [Mdm::Service, nil]
+  belongs_to :service,
+             class_name: 'Mdm::Service',
+             inverse_of: :exploit_attempts
+
+  # The session that was established when this attempt was successful.
+  #
+  # @return [Mdm::Session]
+  # @return [nil] if session was not established.
+  belongs_to :session,
+             class_name: 'Mdm::Session',
+             inverse_of: :exploit_attempt
+
+  # The vulnerability that was attempted to be exploited.
+  #
+  # @return [Mdm::Vuln, nil]
+  belongs_to :vuln,
+             class_name: 'Mdm::Vuln',
+             inverse_of: :exploit_attempts
+
+  #
+  # Attributes
+  #
+
+  # @!attribute attempted_at
+  #   When the attempt was made.
+  #
+  #   @return [DateTime]
+
+  # @!attribute exploited
+  #   Whether the attempt was successful.
+  #
+  #   @return [true] attempt was successful.
+  #   @return [false] attempt was not successful.
+
+  # @!attribute fail_detail
+  #   A more verbose reason (compared to {#fail_reason} for the failure.
+  #
+  #   @return [String, nil]
+
+  # @!attribute fail_reason
+  #   Summary of why the attempt failed if {#exploited} is `false`.  For more details see {#fail_detail}.
+  #
+  #   @return [String, nil]
+
+  # @!attribute host_id
+  #   Foreign key to look up {#host}.
+  #
+  #   @return [Integer]
+
+  # @!attribute  module
+  #   The full name of the exploit module that made the attempt.
+  #
+  #   @return [String]
+  #   @todo Remove deprecated Mdm::Exploit#module (MSP-9281)
+
+  # @!attribute port
+  #   The port on {#host} which the exploit was attempted.
+  #
+  #   @return [Integer]
+  #   @todo Mdm::ExploitAttempt#port and Mdm::ExploitAttempt#proto are obsolete and should be removed (MSP-9284)
+
+  # @!attribute proto
+  #   The protocol name used on {#port}.
+  #
+  #   @return [String]
+  #   @todo Mdm::ExploitAttempt#port and Mdm::ExploitAttempt#proto are obsolete and should be removed (MSP-9284)
+
+  # @!attribute username
+  #   Name of user that made the attempt.  May be an {Mdm::User#name} or a system username.
+  #
+  #   @return [String]
+
+  #
+  # Validations
+  #
+
+  validates :host_id, :presence => true
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/exploited_host.rb

@@ -0,0 +1,42 @@
+# @deprecated use {Mdm::ExploitAttempt} instead.
+#
+# When a {#host} or {#service} on a {#host} is exploited.
+class Mdm::ExploitedHost < ApplicationRecord
+  #
+  # Associations
+  #
+
+  # The host that was exploited.
+  belongs_to :host,
+             class_name: 'Mdm::Host',
+             inverse_of: :exploited_hosts
+
+  # The service on {#host} that was exploited.
+  belongs_to :service,
+             class_name: 'Mdm::Service',
+             inverse_of: :exploited_hosts
+
+  #
+  # Attributes
+  #
+
+  # @!attribute name
+  #   Name of exploit.
+  #
+  #   @return [String]
+
+  # @!attribute payload
+  #   {Mdm::Module::Class#full_name Full name of the payload module} used to exploit the {#host} or {#service} on
+  #   {#host}.
+  #
+  #   @return [String]
+
+  # @!attribute session_uuid
+  #   UUID of local session.
+  #
+  #   @return [String]
+  #   @deprecated Sessions no longer have UUIDs.  They have {Mdm::Session#local_id} that reflects the in-memory
+  #     Msf::Session ID and an in-database {Mdm::Session#id}.
+
+  Metasploit::Concern.run(self)
+end