Land 5042, fix issues on reporting exploit success

Author: shuckins-r7

lib/msf/core/db_manager.rb

@@ -23,6 +23,10 @@
 class Msf::DBManager
   extend Metasploit::Framework::Require
 
+  # Default proto for making new `Mdm::Service`s. This should probably be a
+  # const on `Mdm::Service`
+  DEFAULT_SERVICE_PROTO = "tcp"
+
   autoload :Adapter, 'msf/core/db_manager/adapter'
   autoload :Client, 'msf/core/db_manager/client'
   autoload :Connection, 'msf/core/db_manager/connection'

lib/msf/core/db_manager/exploit_attempt.rb

@@ -27,186 +27,152 @@ def report_exploit_attempt(host, opts)
   }
   end
 
+  # Create an `Mdm::ExploitAttempt` (and possibly an `Mdm::VulnAttempt`, if
+  # the `vuln` option is passed).
+  #
+  # @option (see #do_report_failure_or_success)
+  # @return (see #do_report_failure_or_success)
   def report_exploit_failure(opts)
+    return unless opts.has_key?(:refs) && !opts[:refs].blank?
+    host   = opts[:host] || return
 
-  ::ActiveRecord::Base.connection_pool.with_connection {
-    wspace = opts.delete(:workspace) || workspace
-    mrefs  = opts.delete(:refs) || return
-    host   = opts.delete(:host)
-    port   = opts.delete(:port)
-    prot   = opts.delete(:proto)
-    svc    = opts.delete(:service)
-    vuln   = opts.delete(:vuln)
-
-    timestamp  = opts.delete(:timestamp)
-    freason    = opts.delete(:fail_reason)
-    fdetail    = opts.delete(:fail_detail)
-    username   = opts.delete(:username)
-    mname      = opts.delete(:module)
+    wspace = opts[:workspace] || workspace
+    port   = opts[:port]
+    prot   = opts[:proto] || Msf::DBManager::DEFAULT_SERVICE_PROTO
+    svc    = opts[:service]
+
+    # Look up the service as appropriate
+    if port and svc.nil?
+      svc = get_service(wspace, host, prot, port)
+    end
 
     # Look up the host as appropriate
-    if not (host and host.kind_of? ::Mdm::Host)
+    if !host || !host.kind_of?(::Mdm::Host)
       if svc.kind_of? ::Mdm::Service
         host = svc.host
       else
-        host = get_host( :workspace => wspace, :address => host )
+        host = get_host(workspace: wspace, address: host)
       end
     end
 
     # Bail if we dont have a host object
     return if not host
 
-    # Look up the service as appropriate
-    if port and svc.nil?
-      prot ||= "tcp"
-      svc = get_service(wspace, host, prot, port) if port
-    end
-
-    if not vuln
-      # Create a references map from the module list
-      ref_objs = ::Mdm::Ref.where(:name => mrefs.map { |ref|
-        if ref.respond_to?(:ctx_id) and ref.respond_to?(:ctx_val)
-          "#{ref.ctx_id}-#{ref.ctx_val}"
-        else
-          ref.to_s
-        end
-      })
-
-      # Try find a matching vulnerability
-      vuln = find_vuln_by_refs(ref_objs, host, svc)
-    end
-
-    # Report a vuln_attempt if we found a match
-    if vuln
-      attempt_info = {
-        :attempted_at => timestamp || Time.now.utc,
-        :exploited    => false,
-        :fail_reason  => freason,
-        :fail_detail  => fdetail,
-        :username     => username  || "unknown",
-        :module       => mname
-      }
-
-      vuln.vuln_attempts.create(attempt_info)
-    end
-
-    # Report an exploit attempt all the same
-    attempt_info = {
-      :attempted_at => timestamp || Time.now.utc,
-      :exploited    => false,
-      :username     => username  || "unknown",
-      :module       => mname,
-      :fail_reason  => freason,
-      :fail_detail  => fdetail
-    }
-
-    attempt_info[:vuln_id] = vuln.id if vuln
-
-    if svc
-      attempt_info[:port]  = svc.port
-      attempt_info[:proto] = svc.proto
-    end
-
-    if port and svc.nil?
-      attempt_info[:port]  = port
-      attempt_info[:proto] = prot || "tcp"
-    end
+    opts = opts.dup
+    opts[:service] = svc
+    opts[:host] = host
 
-    host.exploit_attempts.create(attempt_info)
-  }
+    do_report_failure_or_success(opts)
   end
 
+  # Create an `Mdm::ExploitAttempt` (and possibly an `Mdm::VulnAttempt`, if
+  # the `vuln` option is passed).
+  #
+  # @return (see #do_report_failure_or_success)
   def report_exploit_success(opts)
-  ::ActiveRecord::Base.connection_pool.with_connection {
-
-    wspace = opts.delete(:workspace) || workspace
-    mrefs  = opts.delete(:refs) || return
-    host   = opts.delete(:host)
-    port   = opts.delete(:port)
-    prot   = opts.delete(:proto)
-    svc    = opts.delete(:service)
-    vuln   = opts.delete(:vuln)
-
-    timestamp = opts.delete(:timestamp)
-    username  = opts.delete(:username)
-    mname     = opts.delete(:module)
-
-    # Look up or generate the host as appropriate
-    if not (host and host.kind_of? ::Mdm::Host)
-      if svc.kind_of? ::Mdm::Service
-        host = svc.host
-      else
-        host = report_host(:workspace => wspace, :address => host )
-      end
-    end
+    return unless opts[:refs]
+    host   = opts[:host] || return
 
-    # Bail if we dont have a host object
-    return if not host
+    wspace = opts[:workspace] || workspace
+    port   = opts[:port]
+    prot   = opts[:proto] || Msf::DBManager::DEFAULT_SERVICE_PROTO
+    svc    = opts[:service]
 
     # Look up or generate the service as appropriate
     if port and svc.nil?
-      svc = report_service(:workspace => wspace, :host => host, :port => port, :proto => prot ) if port
+      # it is rude to modify arguments in place
+      opts = opts.dup
+      opts[:proto] ||= Msf::DBManager::DEFAULT_SERVICE_PROTO
+      opts[:service] = report_service(
+        workspace: wspace, host: host, port: port, proto: prot
+      )
     end
 
-    if not vuln
-      # Create a references map from the module list
-      ref_objs = ::Mdm::Ref.where(:name => mrefs.map { |ref|
-        if ref.respond_to?(:ctx_id) and ref.respond_to?(:ctx_val)
-          "#{ref.ctx_id}-#{ref.ctx_val}"
-        else
-          ref.to_s
-        end
-      })
+    do_report_failure_or_success(opts)
+  end
 
-      # Try find a matching vulnerability
-      vuln = find_vuln_by_refs(ref_objs, host, svc)
-    end
+  private
+
+  # @option opts [Array<String>, Array<Msf::Module::Reference>] :refs
+  # @option opts [Mdm::Host] :host
+  # @option opts [Mdm::Service] :service
+  # @option opts [Integer] :port (nil)
+  # @option opts ["tcp","udp"] :proto (Msf::DBManager::DEFAULT_SERVICE_PROTO) See `Mdm::Service::PROTOS`
+  # @option opts [Mdm::Vuln] :vuln (nil)
+  # @option opts [Time] :timestamp (nil)
+  # @option opts [Mdm::Vuln] :timestamp (nil)
+  # @option opts [String] :module (nil)
+  # @return [void]
+  def do_report_failure_or_success(opts)
+    return unless opts[:refs]
+    ::ActiveRecord::Base.connection_pool.with_connection {
+      mrefs  = opts[:refs]
+      host   = opts[:host]
+      port   = opts[:port]
+      prot   = opts[:proto]
+      svc    = opts[:service]
+      vuln   = opts[:vuln]
+
+      timestamp  = opts[:timestamp]
+      freason    = opts[:fail_reason]
+      fdetail    = opts[:fail_detail]
+      username   = opts[:username]
+      mname      = opts[:module]
+
+      if vuln.nil?
+        ref_names = mrefs.map { |ref|
+          if ref.respond_to?(:ctx_id) and ref.respond_to?(:ctx_val)
+            "#{ref.ctx_id}-#{ref.ctx_val}"
+          else
+            ref.to_s
+          end
+        }
+
+        # Create a references map from the module list
+        ref_objs = ::Mdm::Ref.where(name: ref_names)
+
+        # Try find a matching vulnerability
+        vuln = find_vuln_by_refs(ref_objs, host, svc)
+      end
 
-    # We have match, lets create a vuln_attempt record
-    if vuln
       attempt_info = {
-        :vuln_id      => vuln.id,
         :attempted_at => timestamp || Time.now.utc,
-        :exploited    => true,
+        :exploited    => (freason.nil? ? true : false),
+        :fail_detail  => fdetail,
+        :fail_reason  => freason,
+        :module       => mname,
         :username     => username  || "unknown",
-        :module       => mname
       }
 
       attempt_info[:session_id] = opts[:session_id] if opts[:session_id]
       attempt_info[:loot_id]    = opts[:loot_id]    if opts[:loot_id]
 
-      vuln.vuln_attempts.create(attempt_info)
+      # We have match, lets create a vuln_attempt record
+      if vuln
+        attempt_info[:vuln_id] = vuln.id
+        vuln.vuln_attempts.create(attempt_info)
 
-      # Correct the vuln's associated service if necessary
-      if svc and vuln.service_id.nil?
-        vuln.service = svc
-        vuln.save
+        # Correct the vuln's associated service if necessary
+        if svc and vuln.service_id.nil?
+          vuln.service = svc
+          vuln.save
+        end
       end
-    end
 
-    # Report an exploit attempt all the same
-    attempt_info = {
-      :attempted_at => timestamp || Time.now.utc,
-      :exploited    => true,
-      :username     => username  || "unknown",
-      :module       => mname
-    }
+      # Report an exploit attempt all the same
 
-    attempt_info[:vuln_id]    = vuln.id           if vuln
-    attempt_info[:session_id] = opts[:session_id] if opts[:session_id]
-    attempt_info[:loot_id]    = opts[:loot_id]    if opts[:loot_id]
+      if svc
+        attempt_info[:port]  = svc.port
+        attempt_info[:proto] = svc.proto
+      end
 
-    if svc
-      attempt_info[:port]  = svc.port
-      attempt_info[:proto] = svc.proto
-    end
+      if port and svc.nil?
+        attempt_info[:port]  = port
+        attempt_info[:proto] = prot || Msf::DBManager::DEFAULT_SERVICE_PROTO
+      end
 
-    if port and svc.nil?
-      attempt_info[:port]  = port
-      attempt_info[:proto] = prot || "tcp"
-    end
+      host.exploit_attempts.create(attempt_info)
+    }
 
-    host.exploit_attempts.create(attempt_info)
-  }
   end
 end

lib/msf/core/db_manager/host.rb

@@ -96,8 +96,7 @@ def normalize_host(host)
       norm_host = host.host
     elsif host.respond_to?(:session_host)
       # Then it's an Msf::Session object
-      thost = host.session_host
-      norm_host = thost
+      norm_host = host.session_host
     end
 
     # If we got here and don't have a norm_host yet, it could be a
@@ -325,4 +324,4 @@ def update_host_via_sysinfo(opts)
     host
   }
   end
-end
+end

lib/msf/core/db_manager/service.rb

@@ -85,7 +85,7 @@ def report_service(opts)
     end
 =end
 
-    proto = opts[:proto] || 'tcp'
+    proto = opts[:proto] || Msf::DBManager::DEFAULT_SERVICE_PROTO
 
     service = host.services.where(port: opts[:port].to_i, proto: proto).first_or_initialize
     opts.each { |k,v|
@@ -126,4 +126,4 @@ def services(wspace = workspace, only_up = false, proto = nil, addresses = nil,
     wspace.services.includes(:host).where(conditions).order("hosts.address, port")
   }
   end
-end
+end