From 279c0e3e527884647dbba5cebdb9e48e9f003035 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Tue, 30 Jan 2007 04:48:35 +0000 Subject: [PATCH] defanged mode git-svn-id: file:///home/svn/framework3/trunk@4303 4d416f70-5f16-0410-b530-b9f4589650da --- lib/msf/core/framework.rb | 2 +- lib/msf/ui/console/command_dispatcher.rb | 7 +++++ .../console/command_dispatcher/auxiliary.rb | 1 + lib/msf/ui/console/command_dispatcher/core.rb | 10 +++++++ .../ui/console/command_dispatcher/exploit.rb | 5 ++++ lib/msf/ui/console/driver.rb | 29 +++++++++++++++++++ lib/rex/proto/http/client.rb | 2 +- lib/rex/services/local_relay.rb | 4 +-- msfconsole | 3 ++ 9 files changed, 59 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/framework.rb b/lib/msf/core/framework.rb index c8c516686f..117aece82b 100644 --- a/lib/msf/core/framework.rb +++ b/lib/msf/core/framework.rb @@ -132,7 +132,7 @@ class Framework # maintains the database db and handles db events # attr_reader :db - + protected attr_writer :events # :nodoc: diff --git a/lib/msf/ui/console/command_dispatcher.rb b/lib/msf/ui/console/command_dispatcher.rb index 17a91267cf..e0dfaa05f2 100644 --- a/lib/msf/ui/console/command_dispatcher.rb +++ b/lib/msf/ui/console/command_dispatcher.rb @@ -43,6 +43,13 @@ module CommandDispatcher driver.active_module = mod end + # + # Checks to see if the driver is defanged. + # + def defanged? + driver.defanged? + end + # # Logs an error message to the screen and the log file. The callstack is # also printed. diff --git a/lib/msf/ui/console/command_dispatcher/auxiliary.rb b/lib/msf/ui/console/command_dispatcher/auxiliary.rb index 192b0ebc0f..467ad91032 100644 --- a/lib/msf/ui/console/command_dispatcher/auxiliary.rb +++ b/lib/msf/ui/console/command_dispatcher/auxiliary.rb @@ -99,6 +99,7 @@ class Auxiliary # Executes an auxiliary module # def cmd_run(*args) + defanged? opt_str = nil action = mod.datastore['ACTION'] diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index d196617975..baeeac7449 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -194,6 +194,8 @@ class Core # Goes into IRB scripting mode # def cmd_irb(*args) + defanged? + print_status("Starting IRB shell...\n") begin @@ -254,6 +256,8 @@ class Core # the framework root plugin directory is used. # def cmd_load(*args) + defanged? + if (args.length == 0) print_line( "Usage: load [var=val var=val ...]\n\n" + @@ -311,6 +315,8 @@ class Core # storage medium, such as a flatfile. # def cmd_persist(*args) + defanged? + if (args.length == 0) args.unshift("-h") end @@ -499,6 +505,8 @@ class Core # restarts of the console. # def cmd_save(*args) + defanged? + # Save the console config driver.save_config @@ -521,6 +529,8 @@ class Core # Adds one or more search paths. # def cmd_loadpath(*args) + defanged? + if (args.length == 0) print_error("No search paths were provided.") return true diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb index 3c25522094..05a7134676 100644 --- a/lib/msf/ui/console/command_dispatcher/exploit.rb +++ b/lib/msf/ui/console/command_dispatcher/exploit.rb @@ -45,7 +45,10 @@ class Exploit # Checks to see if a target is vulnerable. # def cmd_check(*args) + defanged? + begin + mod.init_ui( driver.input, driver.output) @@ -75,6 +78,8 @@ class Exploit # Launches an exploitation attempt. # def cmd_exploit(*args) + defanged? + opt_str = nil payload = mod.datastore['PAYLOAD'] encoder = mod.datastore['ENCODER'] diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index 0426d385c4..f870780bdd 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -95,6 +95,14 @@ class Driver < Msf::Ui::Driver # Whether or not command passthru should be allowed self.command_passthru = (opts['AllowCommandPassthru'] == false) ? false : true + + # Disables "dangerous" functionality of the console + @defanged = opts['Defanged'] == true + + # If we're defanged, then command passthru should be disabled + if @defanged + self.command_passthru = false + end end # @@ -259,6 +267,17 @@ class Driver < Msf::Ui::Driver # attr_accessor :active_module + # + # If defanged is true, dangerous functionality, such as exploitation, irb, + # and command shell passthru is disabled. In this case, an exception is + # raised. + # + def defanged? + if @defanged + raise DefangedException + end + end + protected attr_writer :framework # :nodoc: @@ -330,6 +349,16 @@ protected end +# +# This exception is used to indicate that functionality is disabled due to +# defanged being true +# +class DefangedException < ::Exception + def to_s + "This functionality is currently disabled (defanged mode)" + end +end + end end end diff --git a/lib/rex/proto/http/client.rb b/lib/rex/proto/http/client.rb index 41c4a33bee..00f5aa0f26 100644 --- a/lib/rex/proto/http/client.rb +++ b/lib/rex/proto/http/client.rb @@ -121,7 +121,7 @@ class Client pstr << '=' pstr << set_encode_uri(val) end - + req = '' req += set_method(c_meth) req += set_method_uri_spacer() diff --git a/lib/rex/services/local_relay.rb b/lib/rex/services/local_relay.rb index 9230212e2f..cfa1ecc5d2 100644 --- a/lib/rex/services/local_relay.rb +++ b/lib/rex/services/local_relay.rb @@ -180,11 +180,11 @@ class LocalRelay if ((opts['PeerHost'] == nil or opts['PeerPort'] == nil) and (opts['Stream'] != true)) raise ArgumentError, "Missing peer host or peer port.", caller end - + listener = Rex::Socket.create_tcp_server( 'LocalHost' => opts['LocalHost'], 'LocalPort' => lport) - + opts['LocalPort'] = lport opts['__RelayType'] = 'tcp' diff --git a/msfconsole b/msfconsole index a400111792..8e2193a448 100755 --- a/msfconsole +++ b/msfconsole @@ -24,6 +24,9 @@ class OptsConsole opts.separator "" opts.separator "Specific options:" + opts.on("-d", "-d", "Execute the console as defanged") do + options['Defanged'] = true + end opts.on("-r", "-r ", "Execute the specified resource file") do |r| options['Resource'] = r