wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/app/models/mdm/session.rb

@@ -0,0 +1,203 @@
+# A session opened on a {#host} using an {#via_exploit exploit} and controlled through a {#via_payload payload} to
+# connect back to the local host using meterpreter or a cmd shell.
+class Mdm::Session < ApplicationRecord
+  
+  #
+  # Associations
+  #
+
+  # @!attribute [rw] events
+  #   Events that occurred when this session was open.
+  #
+  #   @return [Array<Mdm::Event>]
+  has_many :events,
+            -> { order('created_at') },
+            class_name: 'Mdm::SessionEvent',
+            dependent: :delete_all,
+            inverse_of: :session
+
+  # @!attribute exploit_attempt
+  #   Exploit attempt that created this session.
+  #
+  #   @return [Mdm::ExploitAttempt]
+  has_one :exploit_attempt,
+          class_name: 'Mdm::ExploitAttempt',
+          inverse_of: :session
+
+  # @!attribute [rw] host
+  #   {Mdm::Host Host} on which this session was opened.
+  #
+  #   @return [Mdm::Host]
+  belongs_to :host,
+             class_name: 'Mdm::Host',
+             inverse_of: :sessions
+
+  # @!attribute [rw] routes
+  #   Routes tunneled throug this session.
+  #
+  #   @return [ActiveRecord::Relation<Mdm::Route>]
+  has_many :routes,
+           class_name: 'Mdm::Route',
+           dependent: :delete_all,
+           inverse_of: :session
+
+  # @!attribute [rw] originating_module_run
+  #   Records the Metasploit modules run that created this session
+  #
+  #   @return [MetasploitDataModels::ModuleRun]
+  belongs_to :originating_module_run,
+           class_name: 'MetasploitDataModels::ModuleRun',
+           foreign_key: :module_run_id,
+           inverse_of: :spawned_session
+
+  # @!attribute [rw] target_module_runs
+  #   Records the Metasploit modules run on this session
+  #
+  #   @return [ActiveRecord::Relation<MetasploitDataModels::ModuleRun>]
+  has_many :target_module_runs,
+           class_name: 'MetasploitDataModels::ModuleRun',
+           inverse_of: :target_session
+
+  # @!attribute vuln_attempt
+  #   Vulnerability attempt that created this session.
+  #
+  #   @return [Mdm::VulnAttempt]
+  has_one :vuln_attempt,
+          class_name: 'Mdm::VulnAttempt',
+          inverse_of: :session
+
+  #
+  # Through :host
+  #
+
+  # @!attribute [r] workspace
+  #   The workspace in which this session exists.
+  #
+  #   @return [Mdm::Workspace]
+  has_one :workspace, :through => :host, :class_name => 'Mdm::Workspace'
+
+  # @!attribute [rw] task_sessions
+  #   Details about sessions this task touched
+  #
+  #   @return [Array<Mdm::TaskSession>]
+  has_many :task_sessions, :dependent => :destroy, :class_name => 'Mdm::TaskSession'
+
+  # @!attribute [rw] task
+  #   Session this task touched
+  #
+  #   @return [Mdm::Session]
+  has_many :tasks, :through => :task_sessions, :class_name => 'Mdm::Task'
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] closed_at
+  #   When the session was closed on {#host}.
+  #
+  #   @return [DateTime]
+
+  # @!attribute [rw] close_reason
+  #   Why the session was closed.  Used to differentiate between user killing it local and the session being killed on
+  #   the remote end.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] datastore
+  #   Options for {#via_exploit exploit} and {#via_payload} modules.
+  #
+  #   @return [Hash]
+
+  # @!attribute [rw] desc
+  #   Description of session.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] last_seen
+  #   The last time the session was checked to see that it was still open.
+  #
+  #   @return [DateTime]
+
+  # @!attribute [rw] local_id
+  #   The ID number of the in-memory session.
+  #
+  #   @return [Integer]
+
+  # @!attribute [rw] opened_at
+  #   When the session was opened on {#host}.
+  #
+  #   @return [DateTime]
+
+  # @!attribute [rw] platform
+  #   The {#host} platform.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] port
+  #   The remote port on which this session is running on {#host}.
+  #
+  #   @return [Integer]
+
+  # @!attribute [rw] stype
+  #   The type of the session.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] via_exploit
+  #   The {Mdm::Module::Detail#fullname full name} of the exploit module that opened this session.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] via_payload
+  #   The {Mdm::Module::Detail#fullname full name} if the payload module that's running this session.
+  #
+  #   @return [String]
+
+  #
+  # Callbacks
+  #
+
+  before_destroy :stop
+
+  #
+  # Scopes
+  #
+
+  scope :alive, -> { where('closed_at IS NULL') }
+  scope :dead, -> { where('closed_at IS NOT NULL') }
+  scope :upgradeable, -> { where("closed_at IS NULL AND stype = 'shell' and platform ILIKE '%win%'") }
+
+  #
+  # Serializations
+  #
+
+  serialize :datastore, ::MetasploitDataModels::Base64Serializer.new
+
+  # Returns whether the session can be upgraded to a meterpreter session from a shell session on Windows.
+  #
+  # @return [true] if {#platform} is some version of Windows and {#stype} is `'shell'`.
+  # @return [false] otherwise.
+  def upgradeable?
+    if (self.platform =~ /win/i and self.stype == 'shell')
+      return true
+    else
+      return false
+    end
+  end
+
+  private
+
+  # Stops and closes the session.
+  #
+  # @todo https://www.pivotaltracker.com/story/show/49026497
+  # @return [void]
+  def stop
+    c = Pro::Client.get rescue nil
+    # ignore exceptions (XXX - ideally, stopped an already-stopped session wouldn't throw XMLRPCException)
+    c.session_stop(self.local_id) rescue nil
+  end
+
+  public
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/session_event.rb

@@ -0,0 +1,44 @@
+# Events that occurred when using a {#session}.
+class Mdm::SessionEvent < ApplicationRecord
+  
+  #
+  # Associations
+  #
+
+  # The session in which the event occurred.
+  belongs_to :session,
+             class_name: 'Mdm::Session',
+             inverse_of: :events
+
+  # @!attribute command
+  #   The command that was run through the session that triggered this event.
+  #
+  #   @return [String]
+
+  # @!attribute created_at
+  #   When this event occurred.
+  #
+  #   @return [DateTime]
+
+  # @!attribute etype
+  #   The type of the event.
+  #
+  #   @return [String]
+
+  # @!attribute local_path
+  #   The current local directory when {#command} was run.
+  #
+  #   @return [String]
+
+  # @!attribute output
+  #   The {#output} of running {#command}.
+  #
+  #   @return [String]
+
+  # @!attribute remote_path
+  #   The current remote directory when {#command} was run.
+  #
+  #   @return [String]
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/tag.rb

@@ -0,0 +1,114 @@
+# Tag {#hosts_tags assigned} to {#hosts}.  Tags can be used to group together hosts for targeting and reporting.
+class Mdm::Tag < ApplicationRecord
+  include Metasploit::Model::Search
+
+  #
+  # Associations
+  #
+
+  # Joins {#hosts} to this tag.
+  has_many :hosts_tags,
+           class_name: 'Mdm::HostTag',
+           dependent: :destroy,
+           inverse_of: :tag
+
+  # User that created this tag.
+  belongs_to :user,
+             class_name: 'Mdm::User',
+             inverse_of: :tags
+
+  #
+  # through: :hosts_tags
+  #
+
+  # Hosts that are tagged with this tag.
+  has_many :hosts, :through => :hosts_tags, :class_name => 'Mdm::Host'
+
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this tag was created by {#user}.
+  #
+  #   @return [DateTime]
+
+  # @!attribute critical
+  #   Whether this tag represents a critical finding about the {#hosts}.
+  #
+  #   @return [true] this tag is critical.
+  #   @return [false] this tag is non-critical.
+
+  # @!attribute desc
+  #   Longer description of what this tag should be used for or means when applied to a {#hosts host}.
+  #
+  #   @return [String]
+
+  # @!attribute name
+  #   The name of the tag.  The name is what a user actually enters to tag a {#hosts host}.
+  #
+  #   @return [String]
+
+  # @!attribute report_detail
+  #   Whether to include this tag in a report details section.
+  #
+  #   @return [true] include this tag in the report details section.
+  #   @return [false] do not include this tag in the report details section.
+
+  # @!attribute report_summary
+  #   Whether to include this tag in a report summary section.
+  #
+  #   @return [true] include this tag in the report summary section.
+  #   @return [false] do not include this tag in the report summary section.
+
+  # @!attribute updated_at
+  #   The last time this tag was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Search
+  #
+
+  search_attribute :desc,
+                   type: :string
+  search_attribute :name,
+                   type: :string
+
+  #
+  # Validations
+  #
+
+  validates :desc,
+            :length => {
+                :maximum => ((8 * (2 ** 10)) - 1),
+                :message => I18n.t('activerecord.ancestors.mdm/tag.model.errors.messages.length')
+            }
+  validates :name,
+            :format => {
+                :with => /\A[A-Za-z0-9\x2e\x2d_]+\z/, :message => I18n.t('activerecord.ancestors.mdm/tag.model.errors.messages.character')
+            },
+            :presence => true
+
+  #
+  # Instance Methods
+  #
+
+  # Destroy this tag if it has no {#hosts_tags}
+  #
+  # @return [void]
+  def destroy_if_orphaned
+    self.class.transaction do
+      if hosts_tags.empty?
+        destroy
+      end
+    end
+  end
+
+  # (see #name)
+  def to_s
+    name
+  end
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/task.rb

@@ -0,0 +1,168 @@
+# A task run by Metasploit Pro.
+class Mdm::Task < ApplicationRecord
+  #
+  #
+  # Associations
+  #
+  #
+
+  # Listeners spawned by this task
+  has_many :listeners,
+           class_name: 'Mdm::Listener',
+           dependent: :destroy,
+           inverse_of: :task
+
+  # Joins this to {#creds}.
+  has_many :task_creds,
+           class_name: 'Mdm::TaskCred',
+           dependent: :destroy,
+           inverse_of: :task
+
+  # Joins this to {#hosts}.
+  has_many :task_hosts,
+           class_name: 'Mdm::TaskHost',
+           dependent: :destroy,
+           inverse_of: :task
+
+  # Joins this to {#services}.
+  has_many :task_services,
+           class_name: 'Mdm::TaskService',
+           dependent: :destroy,
+           inverse_of: :task
+
+  # Joins this to {#sessions}.
+  has_many :task_sessions,
+           class_name: 'Mdm::TaskSession',
+           dependent: :destroy,
+           inverse_of: :task
+
+  # The Workspace the Task belongs to
+  belongs_to :workspace,
+             class_name: 'Mdm::Workspace',
+             inverse_of: :tasks
+
+  #
+  # through: :task_creds
+  #
+
+  # Creds this task touched
+  has_many :creds, :through => :task_creds, :class_name => 'Mdm::Cred'
+
+  #
+  # through: :task_hosts
+  #
+
+  # Hosts this task touched
+  has_many :hosts, :through => :task_hosts, :class_name => 'Mdm::Host'
+
+  #
+  # through: :task_services
+  #
+
+  # Services this task touched
+  has_many :services, :through => :task_services, :class_name => 'Mdm::Service'
+
+  #
+  # through: :task_sessions
+  #
+
+  # Session this task touched
+  has_many :sessions, :through => :task_sessions, :class_name => 'Mdm::Session'
+
+
+
+
+  # @!attribute created_by
+  #   {Mdm::User#username Name of user} that created this task.
+  #
+  #   @return [String]
+
+  # @!attribute description
+  #   Description of what the this task does.
+  #
+  #   @return [String]
+
+  # @!attribute error
+  #   Error raised while task was running that caused this task to fail.
+  #
+  #   @return [String]
+
+  # @!attribute info
+  #   Information about the task's current status.  What the task is currently doing.
+  #
+  #   @return [String]
+
+  # @!attribute module
+  #   {Mdm::Module::Class#full_name Module full name} that was run for this task.
+  #
+  #   @return [String]
+
+  # @!attribute module_uuid
+  #   UUID of `#module` that was run by this task.
+  #
+  #   @return [String]
+
+  # @!attribute path
+  #   Path to the log for this task.
+  #
+  #   @return [String]
+
+  # @!attribute progress
+  #   Percentage complete.
+  #
+  #   @return [Integer]
+
+  # @!attribute updated_at
+  #   When this task was last updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Callbacks
+  #
+
+  before_destroy :delete_file
+
+  #
+  # Serializations
+  #
+
+  # Options passed to `#module`.
+  #
+  # @return [Hash]
+  serialize :options, MetasploitDataModels::Base64Serializer.new
+
+  # Result of task running.
+  #
+  # @return [Hash]
+  serialize :result, MetasploitDataModels::Base64Serializer.new
+
+  # Settings used to configure this task outside of the {#options module options}.
+  #
+  # @return [Hash]
+  serialize :settings, MetasploitDataModels::Base64Serializer.new
+
+  #
+  # Instance Methods
+  #
+
+  private
+
+  # Deletes {#path log} on-disk, so that disk is cleaned up when this task is deleted from the database.
+  #
+  # @return [void]
+  def delete_file
+    c = Pro::Client.get rescue nil
+    if c
+      c.task_delete_log(self[:id]) if c
+    else
+      ::File.unlink(self.path) rescue nil
+    end
+  end
+
+  # Restore public for load hooks
+  public
+
+  Metasploit::Concern.run(self)
+end
+

data/app/models/mdm/task_cred.rb

@@ -0,0 +1,45 @@
+# @deprecated {Mdm::Task} has and belongs to many `Metasploit::Credential::Cores` in `Mdm::Task#credential_cores` and
+#   has and belongs to many `Metasploit::Credential::Logins` in `Mdm::Task#credential_logins` when the
+#   `Metasploit::Credential::Engine` is installed.
+#
+# Join model between {Mdm::Cred} and {Mdm::Task} that signifies that the {#task} found the {#cred}.
+class Mdm::TaskCred < ApplicationRecord
+  #
+  # Associations
+  #
+
+  # The {Mdm::Cred} found by {#task}.
+  belongs_to :cred,
+             class_name: 'Mdm::Cred',
+             inverse_of: :task_creds
+
+  # An {Mdm::Task} that found {#cred}.
+  belongs_to :task,
+             class_name: 'Mdm::Task',
+             inverse_of: :task_creds
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] created_at
+  #   When this task cred was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute [rw] updated_at
+  #   The last time this task cred was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Validations
+  #
+
+  validates :cred_id,
+            :uniqueness => {
+                :scope => :task_id
+            }
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/task_host.rb

@@ -0,0 +1,41 @@
+# Join model between {Mdm::Host} and {Mdm::Task} that signifies that the {#task} found the {#host}.
+class Mdm::TaskHost < ApplicationRecord
+  #
+  # Associations
+  #
+
+  # The {Mdm::Host} found by {#task}.
+  belongs_to :host,
+             class_name: 'Mdm::Host',
+             inverse_of: :task_hosts
+
+  # An {Mdm::Task} that found {#host}.
+  belongs_to :task,
+             class_name: 'Mdm::Task',
+             inverse_of: :task_hosts
+
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this task host was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute updated_at
+  #   The last time this task host was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Validations
+  #
+
+  validates :host_id,
+            :uniqueness => {
+                :scope => :task_id
+            }
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/task_service.rb

@@ -0,0 +1,41 @@
+# Join model between {Mdm::Service} and {Mdm::Task} that signifies that the {#task} found the {#service}.
+class Mdm::TaskService < ApplicationRecord
+  #
+  # Associations
+  #
+
+  # The {Mdm::Service} found by {#task}.
+  belongs_to :service,
+             class_name: 'Mdm::Service',
+             inverse_of: :task_services
+
+  # An {Mdm::Task} that found {#service}.
+  belongs_to :task,
+             class_name: 'Mdm::Task',
+             inverse_of: :task_services
+
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this task service was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute updated_at
+  #   The last time this task service was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Validations
+  #
+
+  validates :service_id,
+            :uniqueness => {
+                :scope => :task_id
+            }
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/task_session.rb

@@ -0,0 +1,41 @@
+# Join model between {Mdm::Session} and {Mdm::Task} that signifies that the {#task} spawned the {#session}.
+class Mdm::TaskSession < ApplicationRecord
+  #
+  # Associations
+  #
+
+  # The {Mdm::Session} found by {#task}.
+  belongs_to :session,
+             class_name: 'Mdm::Session',
+             inverse_of: :task_sessions
+
+  # An {Mdm::Task} that found {#session}
+  belongs_to :task,
+             class_name: 'Mdm::Task',
+             inverse_of: :task_sessions
+
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this task session was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute updated_at
+  #   The last time this task session was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Validations
+  #
+
+  validates :session_id,
+            :uniqueness => {
+                :scope => :task_id
+            }
+
+  Metasploit::Concern.run(self)
+end