wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/spec/app/models/mdm/service_spec.rb

@@ -0,0 +1,232 @@
+RSpec.describe Mdm::Service, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'CONSTANTS' do
+    context 'PROTOS' do
+      subject(:protos) {
+        described_class::PROTOS
+      }
+
+      it { is_expected.to include 'tcp' }
+      it { is_expected.to include 'udp' }
+    end
+
+    context 'STATES' do
+      subject(:states) {
+        described_class::STATES
+      }
+
+      it { is_expected.to include 'closed' }
+      it { is_expected.to include 'filtered' }
+      it { is_expected.to include 'open' }
+      it { is_expected.to include 'unknown' }
+    end
+  end
+
+  context "Associations" do
+
+    it { is_expected.to have_many(:task_services).class_name('Mdm::TaskService').dependent(:destroy) }
+    it { is_expected.to have_many(:tasks).class_name('Mdm::Task').through(:task_services) }
+    it { is_expected.to have_many(:creds).class_name('Mdm::Cred').dependent(:destroy) }
+    it { is_expected.to have_many(:exploited_hosts).class_name('Mdm::ExploitedHost').dependent(:destroy) }
+    it { is_expected.to have_many(:notes).class_name('Mdm::Note').dependent(:destroy) }
+    it { is_expected.to have_many(:vulns).class_name('Mdm::Vuln').dependent(:destroy) }
+    it { is_expected.to have_many(:web_sites).class_name('Mdm::WebSite').dependent(:destroy) }
+    it { is_expected.to have_many(:web_pages).class_name('Mdm::WebPage').through(:web_sites) }
+    it { is_expected.to have_many(:web_forms).class_name('Mdm::WebForm').through(:web_sites) }
+    it { is_expected.to have_many(:web_vulns).class_name('Mdm::WebVuln').through(:web_sites) }
+    it { is_expected.to belong_to(:host).class_name('Mdm::Host') }
+  end
+
+  context 'scopes' do
+    context "inactive" do
+      it "should exclude open services" do
+        open_service = FactoryBot.create(:mdm_service, :state => 'open')
+        expect(Mdm::Service.inactive).not_to include(open_service)
+      end
+    end
+
+    context "with_state open" do
+      it "should exclude closed services" do
+        closed_service = FactoryBot.create(:mdm_service, :state => 'closed')
+        expect(Mdm::Service.with_state('open')).not_to include(closed_service)
+      end
+    end
+
+    context 'search' do
+      it 'should find only services that match for \'tcp\'' do
+        tcp_service   = FactoryBot.create(:mdm_service, proto: 'tcp')
+        udp_service    =  FactoryBot.create(:mdm_service, proto: 'udp')
+        search_results = Mdm::Service.search('tcp')
+        expect(search_results).to     include(tcp_service)
+        expect(search_results).not_to include(udp_service)
+      end
+
+      it 'should query host name of services' do
+        service = FactoryBot.create(:mdm_service)
+        host_name = service.host.name
+        expect(Mdm::Service.search(host_name)).to include(service)
+      end
+    end
+  end
+
+  context 'callbacks' do
+    context 'after_save' do
+      include_context 'Rex::Text'
+
+      it 'should call #normalize_host_os' do
+        svc = FactoryBot.create(:mdm_service)
+        expect(svc).to receive(:normalize_host_os)
+        svc.run_callbacks(:save)
+      end
+
+      it 'should include recog data when there is a match' do
+        host = FactoryBot.create(:mdm_host)
+        host.name = 'example.com'
+        FactoryBot.create(
+          :mdm_service,
+          :host => host,
+          :name => 'ftp',
+          :info => 'example.com Microsoft FTP Service (Version 3.0).'
+        )
+        expect(host.name).to eq('example.com')
+        expect(host.os_name).to eq('Windows NT')
+      end
+
+      it 'should not include recog data when there is not a match' do
+        host = FactoryBot.create(:mdm_host)
+        FactoryBot.create(
+          :mdm_service,
+          :host => host,
+          :name => 'ftp',
+          :info => 'THISSHOULDNEVERMATCH'
+        )
+        expect(host.os_name).to eq('Unknown')
+      end
+    end
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      service = FactoryBot.build(:mdm_service)
+      expect(service).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      service = FactoryBot.create(:mdm_service)
+      expect {
+        service.destroy
+      }.to_not raise_error
+      expect {
+        service.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:host_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:port).of_type(:integer).with_options(:null => false) }
+      it { is_expected.to have_db_column(:proto).of_type(:string).with_options(:null => false) }
+      it { is_expected.to have_db_column(:state).of_type(:string) }
+      it { is_expected.to have_db_column(:name).of_type(:string) }
+      it { is_expected.to have_db_column(:info).of_type(:text) }
+    end
+
+    context 'indices' do
+      it { is_expected.to have_db_index(:name) }
+      it { is_expected.to have_db_index(:port) }
+      it { is_expected.to have_db_index(:proto) }
+      it { is_expected.to have_db_index(:state) }
+    end
+  end
+
+  context 'search' do
+    let(:base_class) {
+      described_class
+    }
+
+    context 'attributes' do
+      it_should_behave_like 'search_attribute',
+                            :info,
+                            type: :string
+      it_should_behave_like 'search_attribute',
+                            :name,
+                            type: :string
+      it_should_behave_like 'search_attribute',
+                            :proto,
+                            type: {
+                                set: :string
+                            }
+      it_should_behave_like 'search_with',
+                             MetasploitDataModels::Search::Operator::Port::List,
+                             name: :port
+    end
+
+    context 'associations' do
+      it_should_behave_like 'search_association', :host
+    end
+  end
+
+  context "validations" do
+
+    context 'port' do
+      it 'should require a port' do
+        portless_service= FactoryBot.build(:mdm_service, :port => nil)
+        expect(portless_service).not_to be_valid
+        expect(portless_service.errors[:port]).to include("is not a number")
+      end
+
+      it 'should not be valid for out-of-range numbers' do
+        out_of_range = FactoryBot.build(:mdm_service, :port => 70000)
+        expect(out_of_range).not_to be_valid
+        expect(out_of_range.errors[:port]).to include("is not included in the list")
+      end
+
+      it 'should not be valid for port 0' do
+        out_of_range = FactoryBot.build(:mdm_service, :port => 0)
+        expect(out_of_range).not_to be_valid
+        expect(out_of_range.errors[:port]).to include("is not included in the list")
+      end
+
+      it 'should not be valid for decimal numbers' do
+        out_of_range = FactoryBot.build(:mdm_service, :port => 5.67)
+        expect(out_of_range).not_to be_valid
+        expect(out_of_range.errors[:port]).to include("must be an integer")
+      end
+
+      it 'should not be valid for a negative number' do
+        out_of_range = FactoryBot.build(:mdm_service, :port => -8)
+        expect(out_of_range).not_to be_valid
+        expect(out_of_range.errors[:port]).to include("is not included in the list")
+      end
+    end
+
+    subject(:mdm_service) {
+      FactoryBot.build(:mdm_service)
+    }
+
+    it 'validate port is only an integer' do
+      is_expected.to validate_numericality_of(:port).only_integer
+    end
+
+    it { is_expected.to validate_inclusion_of(:proto).in_array(described_class::PROTOS) }
+
+    context 'when a duplicate service already exists' do
+      let(:service1) { FactoryBot.create(:mdm_service)}
+      let(:service2) { FactoryBot.build(:mdm_service, :host => service1.host, :port => service1.port, :proto => service1.proto )}
+      it 'is not valid' do
+        expect(service2).to_not be_valid
+      end
+    end
+
+  end
+end

data/spec/app/models/mdm/session_event_spec.rb

@@ -0,0 +1,42 @@
+RSpec.describe Mdm::SessionEvent, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'associations' do
+    it { is_expected.to belong_to(:session).class_name('Mdm::Session') }
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      session_event = FactoryBot.build(:mdm_session_event)
+      expect(session_event).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      session_event = FactoryBot.create(:mdm_session_event)
+      expect {
+        session_event.destroy
+      }.to_not raise_error
+      expect {
+        session_event.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context 'database' do
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:session_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:etype).of_type(:string) }
+      it { is_expected.to have_db_column(:command).of_type(:binary) }
+      it { is_expected.to have_db_column(:output).of_type(:binary) }
+      it { is_expected.to have_db_column(:remote_path).of_type(:string) }
+      it { is_expected.to have_db_column(:local_path).of_type(:string) }
+    end
+  end
+
+end

data/spec/app/models/mdm/session_spec.rb

@@ -0,0 +1,118 @@
+RSpec.describe Mdm::Session, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    it 'should be valid' do
+      session = FactoryBot.build(:mdm_session)
+      expect(session).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      session = FactoryBot.create(:mdm_session)
+      expect {
+        session.destroy
+      }.to_not raise_error
+      expect {
+        session.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:closed_at).of_type(:datetime) }
+      it { is_expected.to have_db_column(:last_seen).of_type(:datetime) }
+      it { is_expected.to have_db_column(:opened_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:datastore).of_type(:text) }
+      it { is_expected.to have_db_column(:desc).of_type(:string) }
+      it { is_expected.to have_db_column(:host_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:local_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:module_run_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:platform).of_type(:string) }
+      it { is_expected.to have_db_column(:port).of_type(:integer) }
+      it { is_expected.to have_db_column(:stype).of_type(:string) }
+      it { is_expected.to have_db_column(:via_exploit).of_type(:string) }
+      it { is_expected.to have_db_column(:via_payload).of_type(:string) }
+    end
+  end
+
+  context 'associations' do
+    it { is_expected.to have_many(:events).class_name('Mdm::SessionEvent').dependent(:delete_all) }
+    it { is_expected.to belong_to(:host).class_name('Mdm::Host') }
+    it { is_expected.to belong_to(:originating_module_run).class_name('MetasploitDataModels::ModuleRun') }
+    it { is_expected.to have_many(:routes).class_name('Mdm::Route').dependent(:delete_all) }
+    it { is_expected.to have_many(:target_module_runs).class_name('MetasploitDataModels::ModuleRun') }
+    it { is_expected.to have_many(:tasks).class_name('Mdm::Task').through(:task_sessions)}
+    it { is_expected.to have_many(:task_sessions).class_name('Mdm::TaskSession').dependent(:destroy) }
+    it { is_expected.to have_one(:workspace).class_name('Mdm::Workspace').through(:host) }
+  end
+
+  context 'scopes' do
+    context 'alive' do
+      it 'should return sessions that have not been closed' do
+        alive_session = FactoryBot.create(:mdm_session)
+        dead_session = FactoryBot.create(:mdm_session, :closed_at => Time.now)
+        alive_set = Mdm::Session.alive
+        expect(alive_set).to include(alive_session)
+        expect(alive_set).not_to include(dead_session)
+      end
+    end
+
+    context 'dead'  do
+      it 'should return sessions that have been closed' do
+        alive_session = FactoryBot.create(:mdm_session)
+        dead_session = FactoryBot.create(:mdm_session, :closed_at => Time.now)
+        dead_set = Mdm::Session.dead
+        expect(dead_set).not_to include(alive_session)
+        expect(dead_set).to include(dead_session)
+      end
+    end
+
+    context 'upgradeable' do
+      it 'should return sessions that can be upgraded to meterpreter' do
+        win_shell = FactoryBot.create(:mdm_session, :stype => 'shell', :platform => 'Windows')
+        linux_shell = FactoryBot.create(:mdm_session, :stype => 'shell', :platform => 'Linux')
+        win_meterp = FactoryBot.create(:mdm_session, :stype => 'meterpreter', :platform => 'Windows')
+        upgrade_set = Mdm::Session.upgradeable
+        expect(upgrade_set).to include(win_shell)
+        expect(upgrade_set).not_to include(linux_shell)
+        expect(upgrade_set).not_to include(win_meterp)
+      end
+    end
+  end
+
+  context 'callbacks' do
+    context 'before_destroy' do
+      it 'should call #stop' do
+        mysession = FactoryBot.create(:mdm_session)
+        expect(mysession).to receive(:stop)
+        mysession.destroy
+      end
+    end
+  end
+
+  context 'methods' do
+    context '#upgradeable?' do
+      it 'should return true for windows shells' do
+        win_shell = FactoryBot.create(:mdm_session, :stype => 'shell', :platform => 'Windows')
+        expect(win_shell.upgradeable?).to eq(true)
+      end
+
+      it 'should return false for non-windows shells' do
+        linux_shell = FactoryBot.create(:mdm_session, :stype => 'shell', :platform => 'Linux')
+        expect(linux_shell.upgradeable?).to eq(false)
+      end
+
+      it 'should return false for Windows Meterpreter Sessions' do
+        win_meterp = FactoryBot.create(:mdm_session, :stype => 'meterpreter', :platform => 'Windows')
+        expect(win_meterp.upgradeable?).to eq(false)
+      end
+    end
+  end
+end

data/spec/app/models/mdm/tag_spec.rb

@@ -0,0 +1,116 @@
+require 'securerandom'
+
+RSpec.describe Mdm::Tag, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'associations' do
+    it { is_expected.to have_many(:hosts_tags).class_name('Mdm::HostTag') }
+    it { is_expected.to have_many(:hosts).class_name('Mdm::Host').through(:hosts_tags) }
+    it { is_expected.to belong_to(:user).class_name('Mdm::User') }
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:user_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:name).of_type(:string) }
+      it { is_expected.to have_db_column(:desc).of_type(:text) }
+      it { is_expected.to have_db_column(:report_summary).of_type(:boolean).with_options(:null => false, :default =>false) }
+      it { is_expected.to have_db_column(:report_detail).of_type(:boolean).with_options(:null => false, :default =>false) }
+      it { is_expected.to have_db_column(:critical).of_type(:boolean).with_options(:null => false, :default =>false) }
+    end
+  end
+
+  context 'validations' do
+    context 'desc'  do
+      it 'should not ba valid for a length over 8k' do
+        desc = SecureRandom.hex(9001) #over 9000?!
+        large_tag = FactoryBot.build(:mdm_tag, :desc => desc)
+        expect(large_tag).not_to be_valid
+        expect(large_tag.errors[:desc]).to include('desc must be less than 8k.')
+      end
+    end
+
+    context 'name' do
+      let(:error_msg) {I18n.t('activerecord.ancestors.mdm/tag.model.errors.messages.character')}
+      it 'must be present' do
+        nameless_tag = FactoryBot.build(:mdm_tag, :name => nil)
+        expect(nameless_tag).not_to be_valid
+        expect(nameless_tag.errors[:name]).to include("can't be blank")
+      end
+
+      it 'may only contain alphanumerics, dot, dashes, and underscores' do
+        mytag = FactoryBot.build(:mdm_tag, :name => 'A.1-B_2')
+        expect(mytag).to be_valid
+        #Test for various bad inputs we should never allow
+        mytag = FactoryBot.build(:mdm_tag, :name => "A'1")
+        expect(mytag).not_to be_valid
+        expect(mytag.errors[:name]).to include(error_msg)
+        mytag = FactoryBot.build(:mdm_tag, :name => "A;1")
+        expect(mytag).not_to be_valid
+        expect(mytag.errors[:name]).to include(error_msg)
+        mytag = FactoryBot.build(:mdm_tag, :name => "A%1")
+        expect(mytag).not_to be_valid
+        expect(mytag.errors[:name]).to include(error_msg)
+        mytag = FactoryBot.build(:mdm_tag, :name => "A=1")
+        expect(mytag).not_to be_valid
+        expect(mytag.errors[:name]).to include(error_msg)
+        mytag = FactoryBot.build(:mdm_tag, :name => "#A1")
+        expect(mytag).not_to be_valid
+        expect(mytag.errors[:name]).to include(error_msg)
+      end
+    end
+  end
+
+  context 'instance methods' do
+    context '#to_s' do
+      it 'should return the name of the tag as a string' do
+        mytag = FactoryBot.build(:mdm_tag, :name => 'mytag')
+        expect(mytag.to_s).to eq('mytag')
+      end
+    end
+  end
+
+  context 'factories' do
+    context 'mdm_tag' do
+      subject(:mdm_tag) do
+        FactoryBot.build(:mdm_tag)
+      end
+
+      it { is_expected.to be_valid }
+    end
+  end
+
+  context '#destroy' do
+    let!(:tag) do
+      FactoryBot.create(:mdm_tag)
+    end
+
+    it 'should successfully destroy the object' do
+      expect {
+        tag.destroy
+      }.to change(Mdm::Tag, :count).by(-1)
+    end
+  end
+
+
+  context 'search' do
+    let(:base_class) {
+      described_class
+    }
+
+    context 'attributes' do
+      it_should_behave_like 'search_attribute',
+                            :name,
+                            type: :string
+      it_should_behave_like 'search_attribute',
+                            :desc,
+                            type: :string
+    end
+  end
+end

data/spec/app/models/mdm/task_cred_spec.rb

@@ -0,0 +1,51 @@
+RSpec.describe Mdm::TaskCred, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    it 'should be valid' do
+      task_cred = FactoryBot.build(:mdm_task_cred)
+      expect(task_cred).to be_valid
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:task_id).of_type(:integer).with_options(:null => false) }
+      it { is_expected.to have_db_column(:cred_id).of_type(:integer).with_options(:null => false) }
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      task_cred = FactoryBot.create(:mdm_task_cred)
+      expect {
+        task_cred.destroy
+      }.to_not raise_error
+      expect {
+        task_cred.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context "Associations" do
+    it { is_expected.to belong_to(:task).class_name('Mdm::Task') }
+    it { is_expected.to belong_to(:cred).class_name('Mdm::Cred') }
+  end
+
+  context "validations" do
+    it "should not allow duplicate associations" do
+      task = FactoryBot.build(:mdm_task)
+      cred = FactoryBot.build(:mdm_cred)
+      FactoryBot.create(:mdm_task_cred, :task => task, :cred => cred)
+      task_cred2 = FactoryBot.build(:mdm_task_cred, :task => task, :cred => cred)
+      expect(task_cred2).not_to be_valid
+    end
+  end
+
+end

data/spec/app/models/mdm/task_host_spec.rb

@@ -0,0 +1,50 @@
+RSpec.describe Mdm::TaskHost, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    it 'should be valid' do
+      task_host = FactoryBot.build(:mdm_task_host)
+      expect(task_host).to be_valid
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:task_id).of_type(:integer).with_options(:null => false) }
+      it { is_expected.to have_db_column(:host_id).of_type(:integer).with_options(:null => false) }
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      task_host = FactoryBot.create(:mdm_task_host)
+      expect {
+        task_host.destroy
+      }.to_not raise_error
+      expect {
+        task_host.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context "Associations" do
+    it { is_expected.to belong_to(:task).class_name('Mdm::Task') }
+    it { is_expected.to belong_to(:host).class_name('Mdm::Host') }
+  end
+
+  context "validations" do
+    it "should not allow duplicate associations" do
+      task = FactoryBot.build(:mdm_task)
+      host = FactoryBot.build(:mdm_host)
+      FactoryBot.create(:mdm_task_host, :task => task, :host => host)
+      task_host2 = FactoryBot.build(:mdm_task_host, :task => task, :host => host)
+      expect(task_host2).not_to be_valid
+    end
+  end
+end

data/spec/app/models/mdm/task_service_spec.rb

@@ -0,0 +1,50 @@
+RSpec.describe Mdm::TaskService, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    it 'should be valid' do
+      task_service = FactoryBot.build(:mdm_task_service)
+      expect(task_service).to be_valid
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:task_id).of_type(:integer).with_options(:null => false) }
+      it { is_expected.to have_db_column(:service_id).of_type(:integer).with_options(:null => false) }
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      task_service = FactoryBot.create(:mdm_task_service)
+      expect {
+        task_service.destroy
+      }.to_not raise_error
+      expect {
+        task_service.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context "Associations" do
+    it { is_expected.to belong_to(:task).class_name('Mdm::Task') }
+    it { is_expected.to belong_to(:service).class_name('Mdm::Service') }
+  end
+
+  context "validations" do
+    it "should not allow duplicate associations" do
+      task = FactoryBot.build(:mdm_task)
+      service = FactoryBot.build(:mdm_service)
+      FactoryBot.create(:mdm_task_service, :task => task, :service => service)
+      task_service2 = FactoryBot.build(:mdm_task_service, :task => task, :service => service)
+      expect(task_service2).not_to be_valid
+    end
+  end
+end