gitlabrat 1.0__py3-none-any.whl

labrat/core/agent.py

@@ -0,0 +1,120 @@
+from urllib.parse import urlparse
+import requests
+from bs4 import BeautifulSoup
+import gitlab
+
+class Agent:
+    def __init__(self, url, use_ldap=False, username=None, password=None, private_token=None, api_version=4, section=None):
+        self.url = url
+        self.host = urlparse(url).hostname
+        self.use_ldap = use_ldap
+        self.username = username
+        self.password = password
+        self.private_token = private_token
+        self.api_version = api_version
+        self.section = section
+
+        self.session = requests.Session()
+        self.gitlab = None
+        self.id = None
+        self.is_admin = False
+        self.is_bot = False
+        self.is_authenticated = False
+
+    @property
+    def label(self):
+        return f"{self.username}@{self.host}"
+
+    def auth(self, private_token=None):
+        if private_token is not None:
+            self.private_token = private_token
+
+        self.gitlab = gitlab.Gitlab(self.url, private_token=self.private_token, keep_base_url=True, api_version=self.api_version)
+        self.gitlab.auth()
+        self.is_authenticated = True
+
+        user = self.gitlab.user
+        self.id = user.id
+        self.username = user.username
+        self.section = self.section if self.section else f"{self.id}@{self.host}"
+        self.is_admin = getattr(self.gitlab.user, 'is_admin', False)
+        self.is_bot = getattr(self.gitlab.user, 'bot', False)
+
+    def get_csrf_token(self):
+        r = self.session.get(f"{self.url}/")
+        soup = BeautifulSoup(r.text, "html.parser")
+        return soup.find("meta", {"name": "csrf-token"})["content"]
+
+    def login(self):
+        csrf_token = self.get_csrf_token()
+        if self.use_ldap:
+            payload = {
+                "authenticity_token": csrf_token,
+                "username": self.username,
+                "password": self.password,
+                "user[remember_me]": 1,
+            }
+            self.session.post(f"{self.url}/users/auth/ldapmain/callback", data=payload)
+        else:
+            payload = {
+                "authenticity_token": csrf_token,
+                "user[login]": self.username,
+                "user[password]": self.password,
+                "user[remember_me]": 1,
+            }
+            self.session.post(f"{self.url}/users/sign_in", data=payload)
+
+    def create_pat(self, token_name="private token", token_scopes=["api", "read_repository", "write_repository"]):
+        csrf_token = self.get_csrf_token()
+        payload = {
+            "personal_access_token[name]": token_name,
+            "personal_access_token[scopes][]": token_scopes,
+        }
+        headers = {"X-CSRF-Token": csrf_token}
+        r = self.session.post(
+            f"{self.url}/-/user_settings/personal_access_tokens",
+            data=payload,
+            headers=headers
+        )
+
+        try:
+            response_json = r.json()
+            if "new_token" in response_json:
+                return response_json.get("new_token")
+            else:
+                return response_json.get("token")
+        except ValueError:
+            return None
+        
+    def add_ssh_key(self, title, key):
+        self.gitlab.user.keys.create({'title': title, 'key': key})
+
+    def to_dict(self):
+        return {
+            key: value
+            for key, value in {
+                "url": self.url,
+                "username": self.username,
+                "password": self.password,
+                "private_token": self.private_token,
+                "is_admin": self.is_admin,
+                "use_ldap": self.use_ldap,
+                "api_version": self.api_version,
+            }.items()
+            if value is not None
+        }
+    
+    @classmethod
+    def from_dict(cls, data):
+        return cls(
+            url=data.get("url"),
+            username=data.get("username"),
+            password=data.get("password"),
+            private_token=data.get("private_token"),
+            use_ldap=(True if data.get("use_ldap") == "True" else False),
+            api_version=int(data.get("api_version", 4)),
+            section=data.get("_name", None)
+        )
+    
+    def __repr__(self):
+        return self.to_dict().__repr__()

labrat/core/config.py

@@ -0,0 +1,63 @@
+import configparser
+from pathlib import Path
+
+from labrat.core.agent import Agent
+from labrat.core.utils import obj_filter
+
+class Config:
+    def __init__(self, config_file="~/.python-gitlab.cfg", preauth=False, authed_only=False):
+        self.config_file = str(Path(config_file).expanduser())
+        self._config = configparser.ConfigParser()
+        self._config.read(self.config_file)
+        self.preauth = preauth
+        self.authed_only = authed_only
+
+    def __getitem__(self, section):
+        try:
+            return self._config[section]
+        except KeyError:
+            return {}
+
+    def __setitem__(self, section, value):
+        self._config[section] = value
+        self._save()
+
+    def _save(self):
+        with open(self.config_file, "w") as file:
+            self._config.write(file)
+
+    def __iter__(self, filter=None):
+        for section in self.sections():
+            if section not in ["DEFAULT", "global"]:  # Skip special sections
+                
+                data = self[section]
+                agent = Agent.from_dict(data)  # Create an Agent instance from the section data
+
+                if self.preauth or self.authed_only:
+                    try:
+                        agent.auth()
+                    except Exception as e:
+                        pass
+
+                if filter and not obj_filter(agent, filter):
+                    continue
+
+                if agent.is_authenticated or not self.authed_only:
+                    yield section, agent
+
+    def filter(self, filter):
+        return self.__iter__(filter)
+
+    def sections(self):
+        return self._config.sections()
+        
+    def has_section(self, section):
+        return self._config.has_section(section)
+    
+    def remove_section(self, section):
+        if section in self._config:
+            self._config.remove_section(section)
+            self._save()
+            return True
+        else:
+            return False

labrat/core/utils.py

@@ -0,0 +1,106 @@
+import re
+
+def parse_host_range(host_pattern):
+    """Parse a host pattern and generate a list of individual host addresses.
+
+    Keyword arguments:
+    - host_pattern: The host pattern to parse (e.g., "team{01..15}.ccdc.local")
+    """
+
+    hosts = []
+
+    # Match brace expansion pattern (e.g., "team{01..15}.ccdc.local")
+    brace_expansion_match = re.match(r"(.*)\{(\d+)\.\.(\d+)\}(.*)", host_pattern)
+    if brace_expansion_match:
+        prefix = brace_expansion_match.group(1)
+        start = brace_expansion_match.group(2)
+        end = brace_expansion_match.group(3)
+        suffix = brace_expansion_match.group(4)
+
+        # Padding for leading zeros
+        padding = max(len(start), len(end)) if start[0] == '0' or end[0] == '0' else 0
+
+        for i in range(int(start), int(end) + 1):
+            hosts.append(f"{prefix}{i:0{padding}d}{suffix}")
+        return hosts
+
+    # If no range is detected, return the host as-is
+    return [host_pattern]
+
+def obj_filter(obj, queries):
+    """Filter an object based on a list of filters. Filters can include simple substrings or field selection and regex patterns.
+
+    Filter criteria:
+    - Searching on all fields (e.g., `j\\.doe`)
+    - Field selection (e.g., `username=j.doe`)
+
+    Operators:
+    - `=`: Equal
+    - `!=`: Not equal
+    - `=~`: Regex match
+    - `!~`: Regex not match
+
+    Keyword arguments:
+    - obj: The object to filter.
+    - queries: A list of filter strings to apply.
+    """
+
+    result = False
+    for query in queries:
+        equals_op = True
+        regex_op = True
+
+        # Operator parsing
+        parsed_query = re.match(r"([a-zA-Z_]+)(!=|=~|!~|=)(.*)", query)
+        if parsed_query:
+            field = parsed_query.group(1)
+            operator = parsed_query.group(2)
+            pattern = parsed_query.group(3)
+
+            equals_op = not operator[0] == "!"
+            regex_op = operator[-1] == "~"
+
+            value = getattr(obj, field, None)
+        else:
+            pattern = query
+            value = get_attrs(obj)
+
+        # Ensure value is searchable
+        if value is not None:
+            # Exclude keys from search
+            if isinstance(value, dict):
+                value = str(value.values())
+            else:
+                value = str(value)
+
+            # Regex or literal search
+            if regex_op:
+                search = re.search(pattern, value, flags=re.IGNORECASE) is not None
+            else:
+                search = pattern.casefold() == value.casefold()
+
+            # Negate search if using not-operator
+            if search == equals_op:
+                result = True
+            else:
+                return False
+        elif equals_op:
+            return False
+
+    return result
+
+def get_attrs(obj):
+    """Get attributes of an object as a dictionary.
+
+    Keyword arguments:
+    - obj: The object to get attributes from.
+    """
+    attrs = {}
+    if hasattr(obj, "_attrs"):
+        attrs.update(obj._attrs) # Include extended GitLab attributes
+    if hasattr(obj, "_updated_attrs"):
+        attrs.update(obj._updated_attrs) # Include updated attributes
+    if not attrs:
+        attrs = {k: v for k, v in vars(obj).items() if not hasattr(v, '__dict__')}
+
+    return attrs if attrs else None

labrat/main.py

@@ -0,0 +1,19 @@
+# labrat/main.py
+import argparse
+from labrat.cli import agents, auth, projects, users
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="labrat",
+        description="LabRat: GitLab exploitation orchestrator"
+    )
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    for command in [agents, auth, projects, users]:
+        command.build_parser(subparsers)
+
+    args = parser.parse_args()
+    args.func(args)
+
+if __name__ == "__main__":
+    main()