wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/spec/app/models/mdm/task_session_spec.rb

@@ -0,0 +1,46 @@
+RSpec.describe Mdm::TaskSession, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    it 'should be valid' do
+      task_session = FactoryBot.build(:mdm_task_session)
+      expect(task_session).to be_valid
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:task_id).of_type(:integer).with_options(:null => false) }
+      it { is_expected.to have_db_column(:session_id).of_type(:integer).with_options(:null => false) }
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      task_session = FactoryBot.create(:mdm_task_session)
+      expect {
+        task_session.destroy
+      }.to_not raise_error
+      expect {
+        task_session.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context "validations" do
+    it "should not allow duplicate associations" do
+      task = FactoryBot.build(:mdm_task)
+      session = FactoryBot.build(:mdm_session)
+      FactoryBot.create(:mdm_task_session, :task => task, :session => session)
+      task_session2 = FactoryBot.build(:mdm_task_session, :task => task, :session => session)
+      expect(task_session2).not_to be_valid
+    end
+  end
+
+end

data/spec/app/models/mdm/task_spec.rb

@@ -0,0 +1,71 @@
+RSpec.describe Mdm::Task, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    it 'should be valid' do
+      task = FactoryBot.build(:mdm_task)
+      expect(task).to be_valid
+    end
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:completed_at).of_type(:datetime) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:workspace_id).of_type(:integer).with_options(:null => false, :default =>1) }
+      it { is_expected.to have_db_column(:created_by).of_type(:string) }
+      it { is_expected.to have_db_column(:module).of_type(:string) }
+      it { is_expected.to have_db_column(:path).of_type(:string) }
+      it { is_expected.to have_db_column(:info).of_type(:string) }
+      it { is_expected.to have_db_column(:description).of_type(:string) }
+      it { is_expected.to have_db_column(:progress).of_type(:integer) }
+      it { is_expected.to have_db_column(:options).of_type(:text) }
+      it { is_expected.to have_db_column(:error).of_type(:text) }
+      it { is_expected.to have_db_column(:result).of_type(:text) }
+      it { is_expected.to have_db_column(:module_uuid).of_type(:string) }
+      it { is_expected.to have_db_column(:settings).of_type(:binary) }
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      task = FactoryBot.create(:mdm_task)
+      expect {
+        task.destroy
+      }.to_not raise_error
+      expect {
+        task.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context "Associations" do
+    it { is_expected.to have_many(:task_creds).class_name('Mdm::TaskCred').dependent(:destroy) }
+    it { is_expected.to have_many(:creds).class_name('Mdm::Cred').through(:task_creds) }
+    it { is_expected.to have_many(:task_sessions).class_name('Mdm::TaskSession').dependent(:destroy) }
+    it { is_expected.to have_many(:sessions).class_name('Mdm::Session').through(:task_sessions) }
+    it { is_expected.to have_many(:task_hosts).class_name('Mdm::TaskHost').dependent(:destroy) }
+    it { is_expected.to have_many(:hosts).class_name('Mdm::Host').through(:task_hosts) }
+    it { is_expected.to have_many(:task_services).class_name('Mdm::TaskService').dependent(:destroy) }
+    it { is_expected.to have_many(:services).class_name('Mdm::Service').through(:task_services) }
+    it { is_expected.to belong_to(:workspace).class_name('Mdm::Workspace') }
+
+  end
+
+  context 'callbacks' do
+    context 'before_destroy' do
+      it 'should call #delete_file' do
+        task = FactoryBot.create(:mdm_task)
+        expect(task).to receive(:delete_file)
+        task.destroy
+      end
+    end
+  end
+
+
+end

data/spec/app/models/mdm/user_spec.rb

@@ -0,0 +1,50 @@
+RSpec.describe Mdm::User, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'associations' do
+    it { is_expected.to have_many(:owned_workspaces).class_name('Mdm::Workspace') }
+    it { is_expected.to have_many(:tags).class_name('Mdm::Tag') }
+    it { is_expected.to have_and_belong_to_many(:workspaces).class_name('Mdm::Workspace') }
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:username).of_type(:string) }
+      it { is_expected.to have_db_column(:crypted_password).of_type(:string) }
+      it { is_expected.to have_db_column(:password_salt).of_type(:string) }
+      it { is_expected.to have_db_column(:persistence_token).of_type(:string) }
+      it { is_expected.to have_db_column(:fullname).of_type(:string) }
+      it { is_expected.to have_db_column(:email).of_type(:string) }
+      it { is_expected.to have_db_column(:phone).of_type(:string) }
+      it { is_expected.to have_db_column(:company).of_type(:string) }
+      it { is_expected.to have_db_column(:prefs).of_type(:string) }
+      it { is_expected.to have_db_column(:admin).of_type(:boolean).with_options(:null => false, :default =>true) }
+    end
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      user = FactoryBot.build(:mdm_user)
+      expect(user).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      user = FactoryBot.create(:mdm_user)
+      expect {
+        user.destroy
+      }.to_not raise_error
+      expect {
+        user.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+end

data/spec/app/models/mdm/vuln_attempt_spec.rb

@@ -0,0 +1,53 @@
+RSpec.describe Mdm::VulnAttempt, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'association' do
+    it { is_expected.to belong_to(:vuln).class_name('Mdm::Vuln') }
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:attempted_at).of_type(:datetime) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:vuln_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:exploited).of_type(:boolean) }
+      it { is_expected.to have_db_column(:fail_reason).of_type(:string) }
+      it { is_expected.to have_db_column(:username).of_type(:string) }
+      it { is_expected.to have_db_column(:module).of_type(:text) }
+      it { is_expected.to have_db_column(:session_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:loot_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:fail_detail).of_type(:text) }
+    end
+  end
+
+  context 'validations' do
+    it 'should require a vuln_id' do
+      orphan_detail = FactoryBot.build(:mdm_vuln_detail, :vuln => nil)
+      expect(orphan_detail).not_to be_valid
+      expect(orphan_detail.errors[:vuln_id]).to include("can't be blank")
+    end
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      vuln_attempt = FactoryBot.create(:mdm_vuln_attempt)
+      expect(vuln_attempt).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      vuln_attempt = FactoryBot.create(:mdm_vuln_attempt)
+      expect {
+        vuln_attempt.destroy
+      }.to_not raise_error
+      expect {
+        vuln_attempt.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+end

data/spec/app/models/mdm/vuln_detail_spec.rb

@@ -0,0 +1,65 @@
+RSpec.describe Mdm::VulnDetail, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'association' do
+    it { is_expected.to belong_to(:vuln).class_name('Mdm::Vuln') }
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:nx_published).of_type(:datetime) }
+      it { is_expected.to have_db_column(:nx_added).of_type(:datetime) }
+      it { is_expected.to have_db_column(:nx_modified).of_type(:datetime) }
+      it { is_expected.to have_db_column(:nx_vulnerable_since).of_type(:datetime) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:vuln_id).of_type(:integer)}
+      it { is_expected.to have_db_column(:cvss_score).of_type(:float) }
+      it { is_expected.to have_db_column(:cvss_vector).of_type(:string) }
+      it { is_expected.to have_db_column(:title).of_type(:string) }
+      it { is_expected.to have_db_column(:description).of_type(:text) }
+      it { is_expected.to have_db_column(:solution).of_type(:text) }
+      it { is_expected.to have_db_column(:proof).of_type(:binary) }
+      it { is_expected.to have_db_column(:nx_console_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:nx_device_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:nx_severity).of_type(:float) }
+      it { is_expected.to have_db_column(:nx_pci_severity).of_type(:float) }
+      it { is_expected.to have_db_column(:nx_tags).of_type(:text) }
+      it { is_expected.to have_db_column(:nx_vuln_status).of_type(:text) }
+      it { is_expected.to have_db_column(:nx_proof_key).of_type(:text) }
+      it { is_expected.to have_db_column(:src).of_type(:string) }
+      it { is_expected.to have_db_column(:nx_scan_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:nx_pci_compliance_status).of_type(:string) }
+    end
+  end
+
+  context 'validations' do
+    it 'should require a vuln_id' do
+      orphan_detail = FactoryBot.build(:mdm_vuln_detail, :vuln => nil)
+      expect(orphan_detail).not_to be_valid
+      expect(orphan_detail.errors[:vuln_id]).to include("can't be blank")
+    end
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      vuln_detail = FactoryBot.create(:mdm_vuln_detail)
+      expect(vuln_detail).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      vuln_detail = FactoryBot.create(:mdm_vuln_detail)
+      expect {
+        vuln_detail.destroy
+      }.to_not raise_error
+      expect {
+        vuln_detail.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+end

data/spec/app/models/mdm/vuln_ref_spec.rb

@@ -0,0 +1,46 @@
+RSpec.describe Mdm::VulnRef, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factories' do
+    context 'mdm_vuln_ref' do
+      subject(:mdm_vuln_ref) do
+        FactoryBot.build(:mdm_vuln_ref)
+      end
+
+      it { is_expected.to be_valid }
+    end
+  end
+
+  context 'database' do
+    context 'columns' do
+      it { is_expected.to have_db_column(:id).of_type(:integer) }
+      it { is_expected.to have_db_column(:ref_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:vuln_id).of_type(:integer) }
+    end
+  end
+
+  context 'associations' do
+    it { is_expected.to belong_to(:vuln).class_name('Mdm::Vuln') }
+    it { is_expected.to belong_to(:ref).class_name('Mdm::Ref') }
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      vuln_ref = FactoryBot.build(:mdm_vuln_ref)
+      expect(vuln_ref).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      vuln_ref = FactoryBot.create(:mdm_vuln_ref)
+      expect {
+        vuln_ref.destroy
+      }.to_not raise_error
+      expect {
+        vuln_ref.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+  
+end

data/spec/app/models/mdm/vuln_spec.rb

@@ -0,0 +1,299 @@
+RSpec.describe Mdm::Vuln, type: :model do
+  subject(:vuln) do
+    FactoryBot.build(:mdm_vuln)
+  end
+
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context '#destroy' do
+    it 'should successfully destroy the object and dependent objects' do
+      vuln = FactoryBot.create(:mdm_vuln)
+      vuln_attempt = FactoryBot.create(:mdm_vuln_attempt, :vuln => vuln)
+      vuln_detail = FactoryBot.create(:mdm_vuln_detail, :vuln => vuln)
+      vuln_ref = FactoryBot.create(:mdm_vuln_ref, :vuln => vuln)
+      expect {
+        vuln.destroy
+      }.to_not raise_error
+      expect {
+        vuln.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        vuln_attempt.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        vuln_detail.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        vuln_ref.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+
+  context 'associations' do
+    it { is_expected.to belong_to(:host).class_name('Mdm::Host') }
+    it { is_expected.to belong_to(:origin) }
+    it { is_expected.to belong_to(:service).class_name('Mdm::Service') }
+    it { is_expected.to have_many(:module_refs).class_name('Mdm::Module::Ref').through(:refs) }
+    it { is_expected.to have_many(:module_runs).class_name('MetasploitDataModels::ModuleRun') }
+    it { is_expected.to have_many(:refs).class_name('Mdm::Ref').through(:vulns_refs) }
+    it { is_expected.to have_many(:vuln_attempts).class_name('Mdm::VulnAttempt').dependent(:destroy) }
+    it { is_expected.to have_many(:vuln_details).class_name('Mdm::VulnDetail').dependent(:destroy) }
+    it { is_expected.to have_many(:vulns_refs).class_name('Mdm::VulnRef').dependent(:destroy) }
+    it { is_expected.to have_many(:notes).class_name('Mdm::Note').dependent(:delete_all).order('notes.created_at') }
+    it { is_expected.to have_many(:matches).class_name("MetasploitDataModels::AutomaticExploitation::Match").dependent(:destroy) }
+
+    context 'module_details' do
+      it { is_expected.to have_many(:module_details).class_name('Mdm::Module::Detail').through(:module_refs) }
+
+      context 'with Mdm::Refs' do
+        let(:names) do
+          2.times.collect {
+            FactoryBot.generate :mdm_ref_name
+          }
+        end
+
+        let!(:refs) do
+          names.collect do |name|
+            FactoryBot.create(:mdm_ref, :name => name)
+          end
+        end
+
+        context 'with Mdm::VulnRefs' do
+          let!(:vuln_refs) do
+            refs.collect { |ref|
+              FactoryBot.create(:mdm_vuln_ref, :ref => ref, :vuln => vuln)
+            }
+          end
+          
+          it 'should be deletable' do
+            expect {
+              vuln.destroy
+            }.not_to raise_error
+          end
+          
+          context 'with Mdm::Module::Detail' do
+            let!(:module_detail) do
+              FactoryBot.create(
+                  :mdm_module_detail
+              )
+            end
+
+            context 'with Mdm::Module::Refs with same names as Mdm::Refs' do
+              let!(:module_refs) do
+                names.each do |name|
+                  FactoryBot.create(
+                      :mdm_module_ref,
+                      :detail => module_detail,
+                      :name => name
+                  )
+                end
+              end
+
+              it 'should list unique Mdm::Module::Detail' do
+                expect(vuln.module_details).to match_array([module_detail])
+              end
+
+              it 'should have duplicate Mdm::Module::Details if collected through chain' do
+                refs = []
+
+                # @todo https://www.pivotaltracker.com/story/show/49004623
+                vuln.vulns_refs.each do |vuln_ref|
+                  refs << vuln_ref.ref
+                end
+
+                module_refs = []
+
+                refs.each do |ref|
+                  module_refs += ref.module_refs
+                end
+
+                module_details = []
+
+                module_refs.each do |module_ref|
+                  module_details << module_ref.detail
+                end
+
+                expect(vuln.module_details.count).to be < module_details.length
+                expect(module_details.uniq.count).to eq(vuln.module_details.count)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+
+  context 'database' do
+    context 'columns' do
+      it { is_expected.to have_db_column(:exploited_at).of_type(:datetime) }
+      it { is_expected.to have_db_column(:host_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:info).of_type(:string) }
+      it { is_expected.to have_db_column(:name).of_type(:string) }
+      it { is_expected.to have_db_column(:origin_id).of_type(:integer) }
+      it { is_expected.to have_db_column(:origin_type).of_type(:string) }
+      it { is_expected.to have_db_column(:service_id).of_type(:integer) }
+
+      context 'counter caches' do
+        it { is_expected.to have_db_column(:vuln_attempt_count).of_type(:integer).with_options(:default => 0) }
+        it { is_expected.to have_db_column(:vuln_detail_count).of_type(:integer).with_options(:default => 0) }
+      end
+
+      context 'timestamps' do
+        it { is_expected.to have_db_column(:created_at).of_type(:datetime) }
+        it { is_expected.to have_db_column(:updated_at).of_type(:datetime) }
+      end
+    end
+  end
+
+  context 'factories' do
+    context 'mdm_host_vuln' do
+      subject(:mdm_host_vuln) do
+        FactoryBot.build(:mdm_host_vuln)
+      end
+
+      it { is_expected.to be_valid }
+    end
+
+    context 'mdm_service_vuln' do
+      subject(:mdm_service_vuln) do
+        FactoryBot.build(:mdm_service_vuln)
+      end
+
+      it { is_expected.to be_valid }
+    end
+
+    context 'mdm_vuln' do
+      subject(:mdm_vuln) do
+        FactoryBot.build(:mdm_vuln)
+      end
+
+      it { is_expected.to be_valid }
+    end
+  end
+
+  context 'scopes' do
+    context 'search' do
+      context 'with Mdm::Vuln' do
+        subject(:results) do
+          described_class.search(query)
+        end
+
+        let!(:vuln) do
+          FactoryBot.create(:mdm_vuln)
+        end
+
+        context 'with Mdm::Ref' do
+          let!(:ref) do
+            FactoryBot.create(:mdm_ref)
+          end
+
+          context 'with Mdm::VulnRef' do
+            let!(:vuln_ref) do
+              FactoryBot.create(:mdm_vuln_ref, :ref => ref, :vuln => vuln)
+            end
+
+            context 'with query matching Mdm::Ref#name' do
+              let(:query) do
+                ref.name
+              end
+
+              it 'should match Mdm::Vuln' do
+                expect(results).to match_array [vuln]
+              end
+            end
+
+            context 'with query matching Mdm::Ref#name' do
+              let(:query) do
+                "Not #{ref.name}"
+              end
+
+              it 'should not match Mdm::Vuln' do
+                expect(results).to be_empty
+              end
+            end
+          end
+
+          context 'without Mdm::VulnRef' do
+            context 'with query matching Mdm::Vuln#name' do
+              let(:query) do
+                vuln.name
+              end
+
+              it 'should match Mdm::Vuln' do
+                expect(results).to match_array [vuln]
+              end
+            end
+
+            context 'with query not matching Mdm::Vuln#name' do
+              let(:query) do
+                "Not #{vuln.name}"
+              end
+
+              it 'should not match Mdm::Vuln' do
+                expect(results).to be_empty
+              end
+            end
+
+            context 'with query matching Mdm::Vuln#info' do
+              let(:query) do
+                vuln.info
+              end
+
+              it 'should match Mdm::Vuln' do
+                expect(results).to match_array [vuln]
+              end
+            end
+
+            context 'without query matching Mdm::Vuln#info' do
+              let(:query) do
+                "Not #{vuln.info}"
+              end
+
+              it 'should not match Mdm::Vuln' do
+                expect(results).to be_empty
+              end
+            end
+          end
+        end
+
+        context 'with Mdm::Host' do
+          context 'with query matching Mdm::Host address' do
+            let(:vuln_with_host) { FactoryBot.create(:mdm_vuln, :host)}
+            let(:query) { vuln_with_host.host.address}
+
+            it 'should match Mdm::Vuln' do
+              expect(results).to match_array [vuln_with_host]
+            end
+          end
+
+          context 'with query matching Mdm::Host name' do
+            let(:vuln_with_host) { FactoryBot.create(:mdm_vuln, :host)}
+            let(:query) { vuln_with_host.host.name}
+
+            it 'should match Mdm::Vuln' do
+              expect(results).to match_array [vuln_with_host]
+            end
+          end
+        end
+      end
+    end
+  end
+
+  context 'validations' do
+    it { is_expected.to validate_presence_of :name }
+
+    context "invalid" do
+      let(:mdm_vuln) do
+        FactoryBot.build(:mdm_vuln)
+      end
+
+      it "should not allow :name over 255 characters" do
+        str = Faker::Lorem.characters(number: 256)
+        mdm_vuln.name = str
+        mdm_vuln.valid?
+        expect(mdm_vuln.errors[:name][0]).to include "is too long"
+      end
+    end
+  end
+end

data/spec/app/models/mdm/web_form_spec.rb

@@ -0,0 +1,46 @@
+RSpec.describe Mdm::WebForm, type: :model do
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'associations' do
+    it { is_expected.to belong_to(:web_site).class_name('Mdm::WebSite') }
+  end
+
+  context 'database' do
+
+    context 'timestamps'do
+      it { is_expected.to have_db_column(:created_at).of_type(:datetime).with_options(:null => false) }
+      it { is_expected.to have_db_column(:updated_at).of_type(:datetime).with_options(:null => false) }
+    end
+
+    context 'columns' do
+      it { is_expected.to have_db_column(:web_site_id).of_type(:integer).with_options(:null => false) }
+      it { is_expected.to have_db_column(:path).of_type(:text) }
+      it { is_expected.to have_db_column(:method).of_type(:string) }
+      it { is_expected.to have_db_column(:params).of_type(:text) }
+      it { is_expected.to have_db_column(:query).of_type(:text) }
+    end
+
+    context 'indices' do
+      it { is_expected.to have_db_index(:path) }
+    end
+  end
+
+  context 'factory' do
+    it 'should be valid' do
+      web_form = FactoryBot.build(:mdm_web_form)
+      expect(web_form).to be_valid
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object' do
+      web_form = FactoryBot.create(:mdm_web_form)
+      expect {
+        web_form.destroy
+      }.to_not raise_error
+      expect {
+        web_form.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+end