Class: Msf::Plugin::BeSECURE::BeSECURECommandDispatcher

Inherits:
Object
  • Object
show all
Includes:
Ui::Console::CommandDispatcher
Defined in:
plugins/besecure.rb

Instance Attribute Summary

Attributes included from Ui::Console::CommandDispatcher

#driver

Attributes included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#shell, #tab_complete_items

Instance Method Summary collapse

Methods included from Ui::Console::CommandDispatcher

#active_module, #active_module=, #active_session, #active_session=, #build_range_array, #docs_dir, #framework, #initialize, #load_config, #log_error, #remove_lines

Methods included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #docs_dir, #help_to_s, included, #initialize, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_directory, #tab_complete_filenames, #tab_complete_generic, #tab_complete_source_address, #unknown_command, #update_prompt

Instance Method Details

#args?(args, min = 1, max = nil) ⇒ Boolean

Verify correct number of arguments and verify -h was not given. Return true if correct number of arguments and help was not requested.

Returns:

  • (Boolean) 


66
67
68
69
70
71
72
73
 
# File 'plugins/besecure.rb', line 66

def args?(args, min = 1, max = nil)
  if !max then max = min end
  if ((args.length < min) || (args.length > max) || (args[0] == '-h'))
    return false
  end

  return true
end

#cmd_besecure_apikey(*args) ⇒ Object 



88
89
90
91
92
93
94
95
96
 
# File 'plugins/besecure.rb', line 88

def cmd_besecure_apikey(*args)
  if args?(args)
    @apikey = args[0]
    print_good(@apikey)
  else
    print_status('Usage:')
    print_status('besecure_apikey string')
  end
end

#cmd_besecure_debug(*args) ⇒ Object 



111
112
113
114
115
116
117
118
119
 
# File 'plugins/besecure.rb', line 111

def cmd_besecure_debug(*args)
  if args?(args)
    @debug = args[0].to_i
    print_good(@debug)
  else
    print_status('Usage:')
    print_status('besecure_debug integer')
  end
end

#cmd_besecure_help ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'plugins/besecure.rb', line 39

def cmd_besecure_help
  print_status('besecure_help                  Display this help')
  print_status('besecure_debug                 Enable/Disable debugging')
  print_status('besecure_version               Display the version of the beSECURE server')
  print_status('besecure_apikey                Set the beSECURE API Key')
  print_status('besecure_ssl_verify            Set whether to verify or not SSL')
  print_status('besecure_hostname              Set the beSECURE Hostname')

  print_status
  print_status('REPORTS')
  print_status('=======')
  print_status('besecure_report_list           Lists reports')
  print_status('besecure_report_download       Downloads an beSECURE report specified by ID')
  print_status('besecure_report_import         Import report specified by ID into framework')
end

#cmd_besecure_hostname(*args) ⇒ Object

Basic Functions



78
79
80
81
82
83
84
85
86
 
# File 'plugins/besecure.rb', line 78

def cmd_besecure_hostname(*args)
  if args?(args)
    @hostname = args[0]
    print_good(@hostname)
  else
    print_status('Usage:')
    print_status('besecure_hostname string')
  end
end

#cmd_besecure_report_download(*args) ⇒ Object 



228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
 
# File 'plugins/besecure.rb', line 228

def cmd_besecure_report_download(*args)
  if args?(args, 4)
    req = Net::HTTP::Post.new('/json.cgi', { 'Host' => @hostname })
    format_file = args[1]
    req.set_form_data({ 'apikey' => @apikey, 'primary' => 'vulnerabilities', 'secondary' => 'report', 'action' => 'getreport', 'network' => args[0], 'format' => format_file })

    http = Net::HTTP.new(@hostname, 443)
    if @debug
      http.set_debug_output($stdout) # Logger.new("foo.log") works too
    end

    http.use_ssl = true
    if @ssl_verify == 'no'
      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
    end

    res = http.start { |h| h.request(req) }

    unless res
      print_error("#{@hostname} - Connection timed out")
      return ''
    end

    body = ''
    begin
      body = JSON.parse(res.body)
    rescue JSON::ParserError
      print_error("#{@hostname} - Unable to parse the response")
      return ''
    end

    if body['error']
      print_error("#{@hostname} - An error occurred:")
      print_error(body)
      return ''
    end

    decompressed = ''
    if format_file != 'json'
      compressed_base64 = body['compresseddata']
      compressed = Base64.decode64(compressed_base64)
      decompressed = Zlib::Inflate.inflate(compressed)
    else
      decompressed = body
    end

    if @debug
      print_status(decompressed)
    end

    ::FileUtils.mkdir_p(args[2])
    name = ::File.join(args[2], args[3])
    print_status("Saving report to #{name}")
    output = ::File.new(name, 'w')
    output.puts(decompressed)
    output.close

    ###
    # Return the report
    return decompressed
  else
    print_status('Usage: besecure_report_download <network_id> <format_name> <path> <report_name>')
  end

  return ''
end

#cmd_besecure_report_import(*args) ⇒ Object 



295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
 
# File 'plugins/besecure.rb', line 295

def cmd_besecure_report_import(*args)
  if args?(args, 2)
    if !database?
      print_error('Database not ready')
      return ''
    end

    tempfile = Tempfile.new('results')

    res = cmd_besecure_report_download(args[0], 'nbe', File.dirname(tempfile) + '/', File.basename(tempfile))
    if res.empty?
      print_error('An empty report has been received')
      return ''
    end

    print_status('Importing report to database.')
    framework.db.import_file({ filename: tempfile })

    tempfile.unlink
  else
    print_status('Usage: besecure_report_import <network_id> <format_name>')
    print_status('Only the NBE and XML formats are supported for importing.')
  end
end

#cmd_besecure_report_list(*_args) ⇒ Object

Report Functions



167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
 
# File 'plugins/besecure.rb', line 167

def cmd_besecure_report_list(*_args)
  tbl = Rex::Text::Table.new(
    'Columns' => ['ID', 'Name', 'Hosts']
  )

  if @hostname.empty?
    print_error('Missing host value')
    return ''
  end

  req = Net::HTTP::Post.new('/json.cgi', { 'Host' => @hostname })
  req.set_form_data({ 'apikey' => @apikey, 'primary' => 'admin', 'secondary' => 'networks', 'action' => 'returnnetworks', 'search_limit' => 10000 })

  if @debug
    print_status(req.body)
  end

  http = Net::HTTP.new(@hostname, 443)
  if @debug
    http.set_debug_output($stdout) # Logger.new("foo.log") works too
  end

  http.use_ssl = true
  if @ssl_verify == 'no'
    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
  end

  res = http.start { |h| h.request(req) }

  unless res
    print_error("#{@hostname} - Connection timed out")
    return ''
  end

  body = ''
  begin
    body = JSON.parse(res.body)
  rescue JSON::ParserError
    print_error("#{@hostname} - Unable to parse the response")
    return ''
  end

  if body['error']
    print_error("#{@hostname} - An error occurred:")
    print_error(body)
    return ''
  end

  data = body['data']
  data.each do |item|
    tbl << [ item['ID'], item['Name'], item['PrettyRange']]
  end

  # print_good(body)

  print_good('beSECURE list of reports')
  print_line
  print_line tbl.to_s
  print_line
end

#cmd_besecure_ssl_verify(*args) ⇒ Object 



98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'plugins/besecure.rb', line 98

def cmd_besecure_ssl_verify(*args)
  if args?(args)
    @ssl_verify = args[0]
    if (@ssl_verify != 'yes') && (@ssl_verify != 'no')
      @ssl_verify = 'yes'
    end
    print_good(@ssl_verify)
  else
    print_status('Usage:')
    print_status("besecure_ssl_verify 'yes'/'no' (default is yes)")
  end
end

#cmd_besecure_version ⇒ Object 



121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
 
# File 'plugins/besecure.rb', line 121

def cmd_besecure_version
  req = Net::HTTP::Post.new('/json.cgi', { 'Host' => @hostname })
  req.set_form_data({ 'apikey' => @apikey, 'primary' => 'interface' })

  if @debug
    print_status(req.body)
  end

  http = Net::HTTP.new(@hostname, 443)
  if @debug
    http.set_debug_output($stdout) # Logger.new("foo.log") works too
  end

  http.use_ssl = true
  if @ssl_verify == 'no'
    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
  end

  res = http.start { |h| h.request(req) }

  unless res
    print_error("#{@hostname} - Connection timed out")
    return ''
  end

  body = ''
  begin
    body = JSON.parse(res.body)
  rescue JSON::ParserError
    print_error("#{@hostname} - Unable to parse the response")
    return ''
  end

  if body['error']
    print_error("#{@hostname} - An error occurred:")
    print_error(body)
    return ''
  end

  print_good(body['version'])
end

#commands ⇒ Object 



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'plugins/besecure.rb', line 23

def commands
  {
    'besecure_help' => 'Displays help',
    'besecure_version' => 'Display the version of the beSECURE server',
    'besecure_apikey' => 'Set the beSECURE API Key',
    'besecure_hostname' => 'Set the beSECURE Hostname',
    'besecure_debug' => 'Enable/Disable debugging',
    'besecure_ssl_verify' => 'Enable/Disable SSL verification',

    'besecure_report_list' => 'Display list of reports',

    'besecure_report_download' => 'Save a report to disk',
    'besecure_report_import' => 'Import report specified by ID into framework'
  }
end

#database? ⇒ Boolean

Verify the database is connected and usable

Returns:

  • (Boolean) 


56
57
58
59
60
61
62
 
# File 'plugins/besecure.rb', line 56

def database?
  if !(framework.db && framework.db.usable)
    return false
  else
    return true
  end
end

#name ⇒ Object 



19
20
21
 
# File 'plugins/besecure.rb', line 19

def name
  'beSECURE'
end