Class: Ronin::Exploits::Exploit
Included Modules
Parameters, Cacheable, Model::HasName, Model::HasDescription, Model::HasVersion, Model::HasLicense, Ronin::Payloads::HasPayload, Ronin::Controls::Behaviors, UI::Output::Helpers, Ronin::Exploits::Verifiers
Attributes
Instance Attributes
| encoded_payload | [R] | public |
The encoded payload. |
|---|---|---|---|
| encoders | [R] | public |
Encoders to run on the payload. |
| raw_payload | [R] | public |
The raw unencoded payload. |
| restricted_chars | [R] | public |
Characters to restrict. |
| target | [W] | public |
Exploit target. |
Constructor Summary
Creates a new Exploit object.
129 130 131 132 133 134 135 136 137 138 139 140 141 142 |
# File 'lib/ronin/exploits/exploit.rb', line 129 def initialize(attributes={},&block) super(attributes) initialize_params(attributes) @target = nil @built = false @deployed = false @restricted_chars = Chars::CharSet.new @encoders = [] instance_eval(&block) if block end |
Dynamic Method Handling
This class handles dynamic methods through the method_missing method
Relays method calls to the payload, if the payload is a kind of Ronin::Payloads::Payload.
781 782 783 784 785 786 787 |
# File 'lib/ronin/exploits/exploit.rb', line 781 def method_missing(name,*arguments,&block) if @payload.kind_of?(Ronin::Payloads::Payload) return @payload.send(name,*arguments,&block) end super(name,*arguments,&block) end |
Public Visibility
Public Class Method Summary
| authors(repository = nil) |
Author(s) of the exploit. |
|---|---|
| controls(repository = nil) |
Behaviors that the exploit allows. |
| disclosure(repository = nil) |
The disclosure status of the exploit (any of, :private, :vendor_aware, :in_wild and :public). |
| id(repository = nil) |
Primary key of the exploit. |
| status(repository = nil) |
The status of the exploit (either, :potential, :proven or :weaponized). |
| targeting_arch(name) |
Finds all exploits which target a given architecture. Returns: Array<Exploit> |
| targeting_os(name) |
Finds all exploits which target a given OS. Returns: Array<Exploit> |
| targeting_product(name) |
Finds all exploits which target a given product. Returns: Array<Exploit> |
| targets(repository = nil) |
Targets for the exploit. |
| written_by(name) |
Finds all exploits written by a specific author. Returns: Array<Exploit> |
| written_for(name) |
Finds all exploits written for a specific organization. Returns: Array<Exploit> |
Public Instance Method Summary
| #arch |
Returns: Arch |
|---|---|
| #author(attributes = {}, &block) {|author| ... } |
Adds a new author to the exploit. |
| #authors |
Author(s) of the exploit. |
| #behaviors |
Lists the behaviors controlled by the exploit and the payload, if. Returns: Array<Symbol> |
| #build!(options = {}, &block) |
Builds the exploit and checks for restricted characters or patterns. |
| #build_payload!(options = {}) |
Builds the current payload, saving the result to the @raw_payload. Returns: String |
| #built? |
Returns: Boolean |
| #controls |
Behaviors that the exploit allows. |
| #deploy!(&block) {|exploit| ... } |
Verifies then deploys the exploit. Returns: Exploit |
| #deployed? |
Returns: Boolean |
| #disclosure |
The disclosure status of the exploit (any of, :private, :vendor_aware, :in_wild and :public). |
| #disclosure=(value) |
The disclosure status of the exploit (any of, :private, :vendor_aware, :in_wild and :public). |
| #encode_payload(encoder = nil, &block) {|payload| ... } |
Adds a new encoder to the list of encoders to use for encoding the. Returns: Array |
| #encode_payload! |
Encodes the current payload and saves the result in the. Returns: String |
| #exploit!(options = {}, &block) {|exploit| ... } |
Builds, verified and then deploys the exploit. Returns: Exploit |
| #id |
Primary key of the exploit. |
| #id=(value) |
Primary key of the exploit. |
| #inspect |
Inspects the contents of the exploit. Returns: String |
| #os |
Returns: OS |
| #payload=(new_payload) |
Associates a payload with the exploit, and the exploit with the. Returns: Payload |
| #product |
Returns: Product |
| #raw_payload=(new_raw_payload) |
Sets the raw payload to use with the exploit. Returns: String |
| #restrict(*chars) |
Adds new characters to the list of restricted characters. Returns: Array<String> |
| #status |
The status of the exploit (either, :potential, :proven or :weaponized). |
| #status=(value) |
The status of the exploit (either, :potential, :proven or :weaponized). |
| #target |
Returns: Target |
| #targeted_archs |
Returns: Array<Arch> |
| #targeted_oses |
Returns: Array<OS> |
| #targeted_products |
Returns: Array<Product> |
| #targeting(attributes = {}, &block) {|target| ... } |
Adds a new target to the exploit. |
| #targets |
Targets for the exploit. |
| #to_s |
Converts the exploit to a String. Returns: String |
| #use_target!(index_or_query = 0, &block) {|target| ... } |
Selects a target to use in exploitation. |
| #verify! |
Verifies the exploit is built, properly configured, built and. Returns: true |
Public Instance Methods Included from Ronin::Payloads::HasPayload
Public Instance Methods Included from Ronin::Controls::Behaviors
Public Instance Methods Included from Ronin::Exploits::Verifiers
verify_arch!, verify_os!, verify_product!, verify_restricted!, verify_target!
Public Class Method Details
authors
controls
Behaviors that the exploit allows
94 |
# File 'lib/ronin/exploits/exploit.rb', line 94 has n, :controls, :model => 'Ronin::Exploits::Control' |
disclosure
The disclosure status of the exploit (any of, :private, :vendor_aware, :in_wild and :public)
83 84 85 86 87 88 |
# File 'lib/ronin/exploits/exploit.rb', line 83 property :disclosure, Flag[ :private, :in_wild, :vendor_aware, :public ] |
id
Primary key of the exploit
71 |
# File 'lib/ronin/exploits/exploit.rb', line 71 property :id, Serial |
status
The status of the exploit (either, :potential, :proven or :weaponized)
75 76 77 78 79 |
# File 'lib/ronin/exploits/exploit.rb', line 75 property :status, Enum[ :potential, :proven, :weaponized ], :default => :potential |
targeting_arch
Finds all exploits which target a given architecture.
179 180 181 |
# File 'lib/ronin/exploits/exploit.rb', line 179 def self.targeting_arch(name) all(self.targets.arch.name => name.to_s) end |
targeting_os
Finds all exploits which target a given OS.
192 193 194 |
# File 'lib/ronin/exploits/exploit.rb', line 192 def self.targeting_os(name) all(self.targets.os.name => name.to_s) end |
targeting_product
Finds all exploits which target a given product.
205 206 207 |
# File 'lib/ronin/exploits/exploit.rb', line 205 def self.targeting_product(name) all(self.targets.product.name => "%#{name}%") end |
targets
Targets for the exploit
97 |
# File 'lib/ronin/exploits/exploit.rb', line 97 has n, :targets |
written_by
Finds all exploits written by a specific author.
153 154 155 |
# File 'lib/ronin/exploits/exploit.rb', line 153 def self.written_by(name) all(self..name.like => "%#{name}%") end |
written_for
Finds all exploits written for a specific organization.
166 167 168 |
# File 'lib/ronin/exploits/exploit.rb', line 166 def self.written_for(name) all(self..organization.like => "%#{name}%") end |
Public Instance Method Details
arch
403 404 405 |
# File 'lib/ronin/exploits/exploit.rb', line 403 def arch target.arch if target end |
author
authors
behaviors
Lists the behaviors controlled by the exploit and the payload, if one is being used.
323 324 325 326 327 328 329 330 331 |
# File 'lib/ronin/exploits/exploit.rb', line 323 def behaviors total_behaviors = super if @payload total_behaviors = (total_behaviors + @payload.behaviors).uniq end return total_behaviors end |
build!
Builds the exploit and checks for restricted characters or patterns.
533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 |
# File 'lib/ronin/exploits/exploit.rb', line 533 def build!(={},&block) self.params = print_debug "Exploit parameters: #{self.params.inspect}" @built = false build_payload!() encode_payload! print_info "Building exploit ..." build print_info "Exploit built!" @built = true if block if block.arity == 1 block.call(self) else block.call() end end return self end |
build_payload!
Builds the current payload, saving the result to the @raw_payload instance variable.
481 482 483 484 485 486 487 488 489 490 491 492 |
# File 'lib/ronin/exploits/exploit.rb', line 481 def build_payload!(={}) if @payload @raw_payload = '' @payload.build!() @raw_payload = @payload.raw_payload else @raw_payload ||= '' end return @raw_payload end |
built?
523 524 525 |
# File 'lib/ronin/exploits/exploit.rb', line 523 def built? @built == true end |
controls
Behaviors that the exploit allows
94 |
# File 'lib/ronin/exploits/exploit.rb', line 94 has n, :controls, :model => 'Ronin::Exploits::Control' |
deploy!
Verifies then deploys the exploit. If a payload has been set, the payload will also be deployed.
609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 |
# File 'lib/ronin/exploits/exploit.rb', line 609 def deploy!(&block) verify! print_info "Deploying exploit ..." @deployed = false deploy() print_info "Exploit deployed!" @deployed = true @payload.deploy!() if @payload if block if block.arity == 1 block.call(self) else block.call() end end return self end |
deployed?
589 590 591 |
# File 'lib/ronin/exploits/exploit.rb', line 589 def deployed? @deployed == true end |
disclosure
The disclosure status of the exploit (any of, :private, :vendor_aware, :in_wild and :public)
83 84 85 86 87 88 |
# File 'lib/ronin/exploits/exploit.rb', line 83 property :disclosure, Flag[ :private, :in_wild, :vendor_aware, :public ] |
disclosure=
The disclosure status of the exploit (any of, :private, :vendor_aware, :in_wild and :public)
83 84 85 86 87 88 |
# File 'lib/ronin/exploits/exploit.rb', line 83 property :disclosure, Flag[ :private, :in_wild, :vendor_aware, :public ] |
encode_payload
Adds a new encoder to the list of encoders to use for encoding the payload.
302 303 304 305 306 307 308 309 310 311 312 313 314 |
# File 'lib/ronin/exploits/exploit.rb', line 302 def encode_payload(encoder=nil,&block) if encoder unless encoder.respond_to?(:encode) raise(RuntimeError,"The payload encoder must provide an encode method",caller) end @encoders << encoder elsif (encoder.nil? && block) @encoders << block else raise(ArgumentError,"either a payload encoder or a block can be given",caller) end end |
encode_payload!
Encodes the current payload and saves the result in the @encoded_payload instance variable.
501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 |
# File 'lib/ronin/exploits/exploit.rb', line 501 def encode_payload! @encoded_payload = @raw_payload.to_s @encoders.each do |encoder| print_debug "Encoding payload: #{@encoded_payload.dump}" new_payload = if encoder.respond_to?(:encode) encoder.encode(@encoded_payload) elsif encoder.respond_to?(:call) encoder.call(@encoded_payload) end @encoded_payload = (new_payload || @encoded_payload).to_s end return @encoded_payload end |
exploit!
Builds, verified and then deploys the exploit.
654 655 656 657 658 659 660 661 662 |
# File 'lib/ronin/exploits/exploit.rb', line 654 def exploit!(={},&block) build!() unless [:dry_run] deploy!(&block) end return self end |
id
Primary key of the exploit
71 |
# File 'lib/ronin/exploits/exploit.rb', line 71 property :id, Serial |
id=
Primary key of the exploit
71 |
# File 'lib/ronin/exploits/exploit.rb', line 71 property :id, Serial |
inspect
Inspects the contents of the exploit.
686 687 688 689 690 691 |
# File 'lib/ronin/exploits/exploit.rb', line 686 def inspect str = "#{self.class}: #{self}" str << " #{self.params.inspect}" unless self.params.empty? return "#<#{str}>" end |
os
411 412 413 |
# File 'lib/ronin/exploits/exploit.rb', line 411 def os target.os if target end |
payload=
Associates a payload with the exploit, and the exploit with the payload.
435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 |
# File 'lib/ronin/exploits/exploit.rb', line 435 def payload=(new_payload) if (@payload && new_payload.nil?) @payload.exploit = nil end super(new_payload) if @payload print_info "Using payload: #{new_payload}" @payload.exploit = self end return @payload end |
product
419 420 421 |
# File 'lib/ronin/exploits/exploit.rb', line 419 def product target.product if target end |
raw_payload=
Sets the raw payload to use with the exploit.
460 461 462 463 464 465 466 |
# File 'lib/ronin/exploits/exploit.rb', line 460 def raw_payload=(new_raw_payload) new_raw_payload = new_raw_payload.to_s print_debug "Using raw payload: #{new_raw_payload.dump}" @raw_payload = new_raw_payload end |
restrict
Adds new characters to the list of restricted characters.
266 267 268 |
# File 'lib/ronin/exploits/exploit.rb', line 266 def restrict(*chars) @restricted_chars += chars end |
status
The status of the exploit (either, :potential, :proven or :weaponized)
75 76 77 78 79 |
# File 'lib/ronin/exploits/exploit.rb', line 75 property :status, Enum[ :potential, :proven, :weaponized ], :default => :potential |
status=
The status of the exploit (either, :potential, :proven or :weaponized)
75 76 77 78 79 |
# File 'lib/ronin/exploits/exploit.rb', line 75 property :status, Enum[ :potential, :proven, :weaponized ], :default => :potential |
target
395 396 397 |
# File 'lib/ronin/exploits/exploit.rb', line 395 def target @target ||= self.targets.first end |
targeted_archs
337 338 339 |
# File 'lib/ronin/exploits/exploit.rb', line 337 def targeted_archs self.targets.map { |target| target.arch }.compact end |
targeted_oses
345 346 347 |
# File 'lib/ronin/exploits/exploit.rb', line 345 def targeted_oses self.targets.map { |target| target.os }.compact end |
targeted_products
353 354 355 |
# File 'lib/ronin/exploits/exploit.rb', line 353 def targeted_products self.targets.map { |target| target.product }.compact end |
targeting
Adds a new target to the exploit.
249 250 251 |
# File 'lib/ronin/exploits/exploit.rb', line 249 def targeting(attributes={},&block) self.targets << Target.new(attributes,&block) end |
targets
Targets for the exploit
97 |
# File 'lib/ronin/exploits/exploit.rb', line 97 has n, :targets |
to_s
Converts the exploit to a String.
670 671 672 673 674 675 676 677 678 |
# File 'lib/ronin/exploits/exploit.rb', line 670 def to_s if (self.name && self.version) "#{self.name} #{self.version}" elsif self.name self.name elsif self.version self.version end end |
use_target!
Selects a target to use in exploitation.
381 382 383 384 385 386 387 388 389 |
# File 'lib/ronin/exploits/exploit.rb', line 381 def use_target!(index_or_query=0,&block) @target = if block self.targets.find(&block) elsif index_or_query.kind_of?(Hash) self.targets.first(index_or_query) elsif index_or_query.kind_of?(Integer) self.targets[index_or_query] end end |
verify!
Verifies the exploit is built, properly configured, built and ready deployment.
572 573 574 575 576 577 578 579 580 581 582 583 |
# File 'lib/ronin/exploits/exploit.rb', line 572 def verify! unless built? raise(ExploitNotBuilt,"cannot deploy an unbuilt exploit",caller) end print_info "Verifying exploit ..." verify print_info "Exploit verified!" return true end |
Protected Visibility
Protected Instance Method Summary
| #build |
Default build method. |
|---|---|
| #deploy(&block) |
Default exploit deploy method. |
| #helper(name) |
Extends the exploit with the helper module defined in. Returns: true |
| #is_restricted?(text) |
Reviews the text for restricted characters. Returns: Boolean |
| #verify |
Default exploit verify method. |
Protected Instance Method Details
build
Default build method.
759 760 |
# File 'lib/ronin/exploits/exploit.rb', line 759 def build end |
deploy
Default exploit deploy method.
771 772 773 |
# File 'lib/ronin/exploits/exploit.rb', line 771 def deploy(&block) block.call(self) if block end |
helper
Extends the exploit with the helper module defined in Ronin::Exploits::Helpers that has the similar name.
713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 |
# File 'lib/ronin/exploits/exploit.rb', line 713 def helper(name) name = name.to_s module_name = name.to_const_string begin require_within File.join('ronin','exploits','helpers'), name rescue Gem::LoadError => e raise(e) rescue ::LoadError raise(UnknownHelper,"unknown helper #{name.dump}",caller) end unless Ronin::Exploits::Helpers.const_defined?(module_name) raise(UnknownHelper,"unknown helper #{name.dump}",caller) end helper_module = Ronin::Exploits::Helpers.const_get(module_name) unless helper_module.kind_of?(Module) raise(UnknownHelper,"unknown helper #{name.dump}",caller) end extend helper_module return true end |
is_restricted?
Reviews the text for restricted characters.
748 749 750 751 752 753 754 |
# File 'lib/ronin/exploits/exploit.rb', line 748 def is_restricted?(text) text.each_byte do |b| return true if @restricted_chars.include?(b) end return false end |
verify
Default exploit verify method.
765 766 |
# File 'lib/ronin/exploits/exploit.rb', line 765 def verify end |