Module: Msf::DBManager::Session

Included in:
Msf::DBManager
Defined in:
lib/msf/core/db_manager/session.rb

Instance Method Summary collapse

Instance Method Details

#create_mdm_session_from_host(opts) ⇒ Object (protected) 



327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
 
# File 'lib/msf/core/db_manager/session.rb', line 327

def create_mdm_session_from_host(opts)
  ::ApplicationRecord.connection_pool.with_connection {
    host = opts[:host]
    raise ArgumentError.new("Invalid :host, expected Host object") unless host.kind_of? ::Mdm::Host
    sess_data = {
      host_id: host.id,
      stype: opts[:stype],
      desc: opts[:desc],
      platform: opts[:platform],
      via_payload: opts[:via_payload],
      via_exploit: opts[:via_exploit],
      routes: opts[:routes] || [],
      datastore: opts[:datastore],
      opened_at: opts[:opened_at],
      closed_at: opts[:closed_at],
      last_seen: opts[:last_seen] || opts[:closed_at],
      close_reason: opts[:close_reason],
    }


    s = ::Mdm::Session.create!(sess_data)
    s
  }
end

#create_mdm_session_from_session(opts) ⇒ Object (protected) 



279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
 
# File 'lib/msf/core/db_manager/session.rb', line 279

def create_mdm_session_from_session(opts)
  ::ApplicationRecord.connection_pool.with_connection {
    session = opts[:session]
    raise ArgumentError.new("Invalid :session, expected Msf::Session") unless session.kind_of? Msf::Session

    wspace = opts[:workspace] || find_workspace(session.workspace)
    h_opts = {
      host: Msf::Util::Host.normalize_host(session),
      workspace: wspace
    }
    h_opts[:arch] = session.arch if session.respond_to?(:arch) && !session.arch.nil? && !session.arch.empty?

    host = find_or_create_host(h_opts)
    sess_data = {
      datastore: session.exploit_datastore.to_h,
      desc: session.info,
      host_id: host.id,
      last_seen: Time.now.utc,
      local_id: session.sid,
      opened_at: Time.now.utc,
      platform: session.session_type,
      port: session.session_port,
      routes: [],
      stype: session.type,
      via_exploit: session.via_exploit,
      via_payload: session.via_payload,
    }

    # In the case of exploit/multi/handler we cannot yet determine the true
    # exploit responsible. But we can at least show the parent versus
    # just the generic handler:
    if session.via_exploit == "exploit/multi/handler" and sess_data[:datastore]['ParentModule']
      sess_data[:via_exploit] = sess_data[:datastore]['ParentModule']
    end

    s = ::Mdm::Session.create!(sess_data)

    if session.exploit_task and session.exploit_task.record
      session_task = session.exploit_task.record
      if session_task.class == Mdm::Task
        Mdm::TaskSession.create(task: session_task, session: s )
      end
    end

    s
  }
end

#get_session(opts) ⇒ Object

Returns a session based on opened_time, host address, and workspace (or returns nil)



32
33
34
35
36
37
38
39
40
41
 
# File 'lib/msf/core/db_manager/session.rb', line 32

def get_session(opts)
  return if not active
::ApplicationRecord.connection_pool.with_connection {
  wspace = Msf::Util::DBManager.process_opts_workspace(opts, framework)
  addr   = opts[:addr] || opts[:address] || opts[:host] || return
  host = get_host(:workspace => wspace, :host => addr)
  time = opts[:opened_at] || opts[:created_at] || opts[:time] || return
  ::Mdm::Session.find_by_host_id_and_opened_at(host.id, time)
}
end

#infer_vuln_from_session(session, wspace) ⇒ void (protected)

This method returns an undefined value.

Parameters:

  • session (Msf::Session) —

    A session with a db_record Msf::Session#db_record

  • wspace (Mdm::Workspace) 


222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
 
# File 'lib/msf/core/db_manager/session.rb', line 222

def infer_vuln_from_session(session, wspace)
  ::ApplicationRecord.connection_pool.with_connection {
    s = session.db_record
    host = s.host

    if session.via_exploit == "exploit/multi/handler" and session.exploit_datastore['ParentModule']
      mod_fullname = session.exploit_datastore['ParentModule']
    else
      mod_fullname = session.via_exploit
    end
    mod_detail = ::Mdm::Module::Detail.find_by_fullname(mod_fullname)

    if mod_detail.nil?
      # Then the cache isn't built yet, take the hit for instantiating the
      # module
      mod_detail = framework.modules.create(mod_fullname)
      refs = mod_detail.references
    else
      refs = mod_detail.refs
    end
    mod_name = mod_detail.name

    vuln_info = {
      exploited_at: Time.now.utc,
      host: host,
      info: "Exploited by #{mod_fullname} to create Session #{s.id}",
      name: mod_name,
      refs: refs,
      workspace: wspace,
    }

    port    = session.exploit_datastore["RPORT"]
    service = (port ? host.services.find_by_port(port.to_i) : nil)

    vuln_info[:service] = service if service

    vuln = report_vuln(vuln_info)

    attempt_info = {
      host: host,
      module: mod_fullname,
      refs: refs,
      service: service,
      session_id: s.id,
      timestamp: Time.now.utc,
      username: session.username,
      vuln: vuln,
      workspace: wspace,
      run_id: session.exploit.user_data.try(:[], :run_id)
    }

    report_exploit_success(attempt_info)

    vuln
  }
end

#infer_vuln_from_session_dto(session_dto, session_db_record, workspace) ⇒ Object (protected) 



352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
 
# File 'lib/msf/core/db_manager/session.rb', line 352

def infer_vuln_from_session_dto(session_dto, session_db_record, workspace)
  ::ApplicationRecord.connection_pool.with_connection {

    vuln_info_dto = session_dto[:vuln_info]
    host = session_db_record.host
    mod_name = vuln_info_dto[:mod_name] || 'unknown'
    refs = vuln_info_dto[:mod_references] || []

    vuln_info = {
        exploited_at: session_dto[:time_stamp],
        host: host,
        info: "Exploited by #{vuln_info_dto[:mod_fullname]} to create Session #{session_db_record.id}",
        name: mod_name,
        refs: refs,
        workspace: workspace,
    }

    port    = vuln_info_dto[:remote_port]
    service = (port ? host.services.find_by_port(port.to_i) : nil)

    vuln_info[:service] = service if service

    vuln = report_vuln(vuln_info)

    attempt_info = {
        host: host,
        module: vuln_info_dto[:mod_fullname],
        refs: refs,
        service: service,
        session_id: session_db_record.id,
        timestamp: session_dto[:time_stamp],
        username: vuln_info_dto[:username],
        vuln: vuln,
        workspace: workspace,
        run_id: vuln_info_dto[:run_id]
    }

    report_exploit_success(attempt_info)

    vuln
  }
end

#remove_stale_sessions(last_seen_interval) ⇒ Object

Clean out any stale sessions that have been orphaned by a dead framework instance.

Parameters:

  • last_seen_interval (Integer) —

    interval, in seconds, open sessions are marked as alive



202
203
204
205
206
207
208
209
210
211
212
213
 
# File 'lib/msf/core/db_manager/session.rb', line 202

def remove_stale_sessions(last_seen_interval)
  return unless active

  ::ApplicationRecord.connection_pool.with_connection {
    ::Mdm::Session.where(closed_at: nil).each do |db_session|
      next unless db_session.last_seen.nil? or ((Time.now.utc - db_session.last_seen) > (2 * last_seen_interval))
      db_session.closed_at    = db_session.last_seen || Time.now.utc
      db_session.close_reason = "Orphaned"
      db_session.save
    end
  }
end

#report_session(opts) ⇒ nil, Mdm::Session #report_session(opts) ⇒ nil, Mdm::Session

TODO:

www.pivotaltracker.com/story/show/48249739

Note:

The Mdm::Session#desc will be truncated to 255 characters.

Overloads:

  • #report_session(opts) ⇒ nil, Mdm::Session

    Creates an Mdm::Session from Msf::Session. If via_exploit is set on the session, then an Mdm::Vuln and Mdm::ExploitAttempt is created for the session’s host. The Mdm::Host for the session_host is created using The session.session_host, session.arch (if session responds to arch), and the workspace derived from opts or the session. The Mdm::Session is assumed to be last_seen and opened_at at the time report_session is called. session.exploit_datastore is used for the Mdm::Session#via_exploit if session.via_exploit is ‘exploit/multi/handler’.

    Parameters:

    • opts (Hash{Symbol => Object}) —

      options

    Options Hash (opts):

    • :workspace (Mdm::Workspace) —

      The workspace for in which the :session host is contained. Also used as the workspace for the Mdm::ExploitAttempt and Mdm::Vuln. Defaults to Mdm::Worksapce with Mdm::Workspace#name equal to session.workspace.

    Returns:

    • (nil) —

      if Msf::DBManager#active is false.

    • (Mdm::Session) —

      if session is saved

    Raises:

    • (ArgumentError) —

      if :session is not an Session.

    • (ActiveRecord::RecordInvalid) —

      if session is invalid and cannot be saved, in which case, the Mdm::ExploitAttempt and Mdm::Vuln will not be created, but the Mdm::Host will have been. (There is no transaction

      to rollback the Mdm::Host creation.)

    See Also:

  • #report_session(opts) ⇒ nil, Mdm::Session

    Creates an Mdm::Session from Mdm::Host.

    Parameters:

    • opts (Hash{Symbol => Object}) —

      options

    Options Hash (opts):

    • :closed_at (DateTime, Time) —

      The date and time the session was closed.

    • :close_reason (String) —

      Reason the session was closed.

    • :datastore (Hash) —

      Msf::DataStore#to_h.

    • :desc (String) —

      Session description. Will be truncated to 255 characters.

    • :host (Mdm::Host) —

      The host on which the session was opened.

    • :last_seen (DateTime, Time) —

      The last date and time the session was seen to be open. Defaults to :closed_at’s value.

    • :opened_at (DateTime, Time) —

      The date and time that the session was opened.

    • :platform (String) —

      The platform of the host.

    • :routes (Array) — default: [] —

      The routes through the session for pivoting.

    • :stype (String) —

      Session type.

    • :via_exploit (String) —

      The Module#fullname of the exploit that was used to open the session.

    Returns:

    • (nil) —

      if Msf::DBManager#active is false.

    • (Mdm::Session) —

      if session is saved.

    Raises:

    • (ArgumentError) —

      if :host is not an Mdm::Host.

    • (ActiveRecord::RecordInvalid) —

      if session is invalid and cannot be saved.

Raises:

  • ArgumentError if :host and :session are both nil



106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'lib/msf/core/db_manager/session.rb', line 106

def report_session(opts)
  return if not active

::ApplicationRecord.connection_pool.with_connection {
  if opts[:session]
    session = opts[:session]
    s = create_mdm_session_from_session(opts)
    session.db_record = s
  elsif opts[:host]
    s = create_mdm_session_from_host(opts)
  else
    raise ArgumentError.new("Missing option :session or :host")
  end

  wspace = s.workspace


  if session and session.via_exploit
    # This is a live session, we know the host is vulnerable to something.
    infer_vuln_from_session(session, wspace)
  end

  s
}
end

#report_session_dto(session_dto) ⇒ Object 



137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
 
# File 'lib/msf/core/db_manager/session.rb', line 137

def report_session_dto(session_dto)
  return if not active

  ::ApplicationRecord.connection_pool.with_connection {
    host_data = session_dto[:host_data]
    workspace = workspaces({ name: host_data[:workspace] }).first
    h_opts = {
      host: host_data[:host],
      workspace: workspace
    }
    h_opts[:arch] = host_data[:arch] if !host_data[:arch].nil? && !host_data[:arch].empty?
    host = find_or_create_host(h_opts)

    session_data = session_dto[:session_data]
    sess_data = {
        datastore: session_data[:datastore],
        desc: session_data[:desc],
        host_id: host.id,
        last_seen: session_dto[:time_stamp],
        local_id: session_data[:local_id],
        opened_at: session_dto[:time_stamp],
        platform: session_data[:platform],
        port: session_data[:port],
        routes: [],
        stype: session_data[:stype],
        via_exploit: session_data[:via_exploit],
        via_payload: session_data[:via_payload],
    }

    if sess_data[:via_exploit] == 'exploit/multi/handler' and sess_data[:datastore] and sess_data[:datastore]['ParentModule']
      sess_data[:via_exploit] = sess_data[:datastore]['ParentModule']
    end

    session_db_record = ::Mdm::Session.create!(sess_data)

    # TODO: Figure out task stuff


    if sess_data[:via_exploit]
      # This is a live session, we know the host is vulnerable to something.
      infer_vuln_from_session_dto(session_dto, session_db_record, workspace)
    end
    session_db_record
  }
end

#report_session_host_dto(host_dto) ⇒ Object 



132
133
134
135
 
# File 'lib/msf/core/db_manager/session.rb', line 132

def report_session_host_dto(host_dto)
  host_dto[:host] = get_host(host_dto)
  create_mdm_session_from_host(host_dto)
end

#sessions(opts) ⇒ Object

Returns a list of all sessions in the database that are selected via the key-value pairs in the specified options.



7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/msf/core/db_manager/session.rb', line 7

def sessions(opts)
  return if not active

  ::ApplicationRecord.connection_pool.with_connection {
    # If we have the ID, there is no point in creating a complex query.
    if opts[:id] && !opts[:id].to_s.empty?
      return Array.wrap(Mdm::Session.find(opts[:id]))
    end

    wspace = Msf::Util::DBManager.process_opts_workspace(opts, framework)
    opts = opts.clone()
    opts.delete(:workspace)

    search_term = opts.delete(:search_term)
    if search_term && !search_term.empty?
      column_search_conditions = Msf::Util::DBManager.create_all_column_search_conditions(Mdm::Session, search_term)
      wspace.sessions.includes(:host).where(opts).where(column_search_conditions)
    else
      wspace.sessions.includes(:host).where(opts)
    end
  }
end

#update_session(opts) ⇒ Mdm::Session

Update the attributes of a session entry with the values in opts. The values in opts should match the attributes to update.

Parameters:

  • opts (Hash) —

    Hash containing the updated values. Key should match the attribute to update. Must contain :id of record to update.

Returns:

  • (Mdm::Session) —

    The updated Mdm::Session object.



188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/msf/core/db_manager/session.rb', line 188

def update_session(opts)
  return if not active

  ::ApplicationRecord.connection_pool.with_connection {
    opts = opts.clone() # protect the original caller's opts
    id = opts.delete(:id)
    session = ::Mdm::Session.find(id)
    session.update!(opts)
    return session
  }
end