Module: Msf::DBManager::Import::IP360::V3

Included in:
Msf::DBManager::Import::IP360
Defined in:
lib/msf/core/db_manager/import/ip360/v3.rb

Instance Method Summary collapse

Instance Method Details

#handle_ip360_v3_svc(wspace, hobj, port, proto, hname, task = nil) ⇒ Object (protected)

IP360 v3 svc



132
133
134
135
136
137
138
139
140
141
142
143
144
 
# File 'lib/msf/core/db_manager/import/ip360/v3.rb', line 132

def handle_ip360_v3_svc(wspace,hobj,port,proto,hname,task=nil)
  addr = hobj.address
  msf_import_host(:workspace => wspace, :host => hobj, :state => Msf::HostState::Alive, :task => task)

  info = { :workspace => wspace, :host => hobj, :port => port, :proto => proto, :task => task }
  if hname != "unknown" and hname[-1,1] != "?"
    info[:name] = hname
  end

  if port.to_i != 0
    msf_import_service(info)
  end
end

#handle_ip360_v3_vuln(wspace, hobj, port, proto, hname, vulnid, vulnname, cves, bids, task = nil) ⇒ Object (protected)

IP360 v3 vuln



149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
 
# File 'lib/msf/core/db_manager/import/ip360/v3.rb', line 149

def handle_ip360_v3_vuln(wspace,hobj,port,proto,hname,vulnid,vulnname,cves,bids,task=nil)
  info = { :workspace => wspace, :host => hobj, :port => port, :proto => proto, :task => task }
  if hname != "unknown" and hname[-1,1] != "?"
    info[:name] = hname
  end

  if port.to_i != 0
    msf_import_service(info)
  end

  refs = []

  cves.split(/,/).each do |cve|
    refs.push(cve.to_s)
  end if cves

  bids.split(/,/).each do |bid|
    refs.push('BID-' + bid.to_s)
  end if bids

  description = nil   # not working yet
  vuln = {
    :workspace => wspace,
    :host => hobj,
    :name => vulnname,
    :info => description ? description : "",
    :refs => refs,
    :task => task
  }

  if port.to_i != 0
    vuln[:port]  = port
    vuln[:proto] = proto
  end

  msf_import_vuln(vuln)
end

#import_ip360_xml_file(args = {}) ⇒ Object

Import IP360 XML v3 output



6
7
8
9
10
11
12
13
14
 
# File 'lib/msf/core/db_manager/import/ip360/v3.rb', line 6

def import_ip360_xml_file(args={})
  filename = args[:filename]

  data = ""
  ::File.open(filename, 'rb') do |f|
    data = f.read(f.stat.size)
  end
  import_ip360_xml_v3(args.merge(:data => data))
end

#import_ip360_xml_v3(args = {}, &block) ⇒ Object

Import IP360’s xml output



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'lib/msf/core/db_manager/import/ip360/v3.rb', line 19

def import_ip360_xml_v3(args={}, &block)
  data = args[:data]
  wspace = Msf::Util::DBManager.process_opts_workspace(args, framework).name
  bl = validate_ips(args[:blacklist]) ? args[:blacklist].split : []

  # @aspl = {'vulns' => {'name' => { }, 'cve' => { }, 'bid' => { } }
  # 'oses' => {'name' } }

  aspl_path  = nil
  aspl_paths = [
    ::File.join(Msf::Config.config_directory, "data", "ncircle", "ip360.aspl"),
    ::File.join(Msf::Config.data_directory, "ncircle", "ip360.aspl")
  ]

  aspl_paths.each do |tpath|
    next if not (::File.exist?(tpath) and ::File.readable?(tpath))
    aspl_path = tpath
    break
  end

  if not aspl_path
    raise Msf::DBImportError.new("The nCircle IP360 ASPL file is not present.\n    Download ASPL from nCircle VNE | Administer | Support | Resources, unzip it, and import it first")
  end

  # parse nCircle ASPL file
  aspl = ""
  ::File.open(aspl_path, "rb") do |f|
    aspl = f.read(f.stat.size)
  end

  @asplhash = nil
  parser = Rex::Parser::IP360ASPLXMLStreamParser.new
  parser.on_found_aspl = Proc.new { |asplh|
    @asplhash = asplh
  }
  REXML::Document.parse_stream(aspl, parser)

  # nCircle has some quotes escaped which causes the parser to break
  # we don't need these lines so just replace \" with "
  data.gsub!(/\\"/,'"')

  # parse nCircle Scan Output
  parser = Rex::Parser::IP360XMLStreamParser.new
  parser.on_found_host = Proc.new { |host|
    hobj = nil
    addr = host['addr'] || host['hname']

    next unless ipv46_validator(addr) # Catches SCAN-ERROR, among others.

    if bl.include? addr
      next
    else
      yield(:address,addr) if block
    end

    os = host['os']
    hname = host['hname']
    mac = host['mac']

    host_hash = {
      :workspace => wspace,
      :host => addr,
      :task => args[:task]
    }
    host_hash[:name] = hname.to_s.strip if hname
    host_hash[:mac]  = mac.to_s.strip.upcase if mac

    hobj = msf_import_host(host_hash)

    yield(:os, os) if block
    if os
      msf_import_note(
        :workspace => wspace,
        :task => args[:task],
        :host => hobj,
        :type => 'host.os.ip360_fingerprint',
        :data => {
          :os => @asplhash['oses'][os].to_s.strip
        }
      )
    end

    host['apps'].each do |item|
      port = item['port'].to_s
      proto = item['proto'].to_s

      handle_ip360_v3_svc(wspace, hobj, port, proto, hname, args[:task])
    end


    host['vulns'].each do |item|
      vulnid = item['vulnid'].to_s
      port = item['port'].to_s
      proto = item['proto'] || "tcp"
      vulnname = @asplhash['vulns']['name'][vulnid]
      cves = @asplhash['vulns']['cve'][vulnid]
      bids = @asplhash['vulns']['bid'][vulnid]

      yield(:port, port) if block

      handle_ip360_v3_vuln(wspace, hobj, port, proto, hname, vulnid, vulnname, cves, bids, args[:task])

    end

    yield(:end, hname) if block
  }

  REXML::Document.parse_stream(data, parser)
end