metasploit_data_models 0.3.0 installed in gemcache

Author: limhoff-r7

lib/gemcache/ruby/1.9.1/bin/mdm_console

@@ -10,13 +10,9 @@ require 'rubygems'
 
 version = ">= 0"
 
-if ARGV.first
-  str = ARGV.first
-  str = str.dup.force_encoding("BINARY") if str.respond_to? :force_encoding
-  if str =~ /\A_(.*)_\z/
-    version = $1
-    ARGV.shift
-  end
+if ARGV.first =~ /^_(.*)_$/ and Gem::Version.correct? $1 then
+  version = $1
+  ARGV.shift
 end
 
 gem 'metasploit_data_models', version

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/.gitignore

@@ -1,6 +1,18 @@
-.rvmrc
+# bundler configuration
+.bundle
+# Mac OS X folder attributes
 .DS_Store
+# built gems
 *.gem
-.bundle
+# Rubymine project configuration
+.idea
+# Don't check in rvmrc since this is a gem
+.rvmrc
+# Installed gem versions.  Not stored for the same reasons as .rvmrc
 Gemfile.lock
+# Packaging directory for builds
 pkg/*
+# Database configuration (with passwords) for specs
+spec/dummy/config/database.yml
+# logs
+*.log

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/Gemfile

@@ -2,3 +2,9 @@ source "http://rubygems.org"
 
 # Specify your gem's dependencies in metasploit_data_models.gemspec
 gemspec
+
+group :test do
+  # rails is only used for testing with a dummy application in spec/dummy
+  gem 'rails'
+  gem 'rspec-rails'
+end

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/README.md

@@ -17,35 +17,48 @@ __MetasploitDataModels__ exists to do several key things:
 
 ### Rails
 
-In a Rails application we simply include the ActiveRecord mixins directly, usually inside models with similar names.
-
-### MSF
-When MetasploitDataModels is included by MSF, the gem dynamically creates
-ActiveRecord model classes.
-
-Both of these behaviors are based on the assumption that the files in
-__lib/metasploit_data_models/active_record_models__, though implemented here as
-mixins, actually represent the basic ActiveRecord model structure that both Metasploit Framework and Metasploit Pro use.
+In a Rails application, MetasploitDataModels acts a
+[Rails Engine](http://edgeapi.rubyonrails.org/classes/Rails/Engine.html) and the models are available to application
+just as if they were defined under app/models.  If your Rails appliation needs to modify the models, this can be done
+using ActiveSupport.on_load hooks in initializers.  The block passed to on_load hook is evaluated in the context of the
+model class, so defining method and including modules will work just like reopeninng the class, but
+ActiveSupport.on_load ensures that the monkey patches will work after reloading in development mode.  Each class has a
+different on_load name, which is just the class name converted to an underscored symbol, so Mdm::ApiKey runs the
+:mdm_api_key load hooks, etc.
+
+    # Gemfile
+    gem :metasploiit_data_models, :git => git://github.com/rapid7/metasploit_data_models.git, :tag => 'v0.3.0'
+
+    # config/initializers/metasploit_data_models.rb
+    ActiveSupport.on_load(:mdm_api_key) do
+        # Returns the String obfuscated token for display. Meant to avoid CSRF
+        # api-key stealing attackes.
+        def obfuscated_token
+          token[0..3] + "****************************"
+        end
+    end
+
+### Metasploit Framework
+
+In Metasploit Framework, `MetasploitDataModels.require_models` is called by the `Msf::DbManager` to use the data models
+only if the user wants to use the database.
 
 ### Elsewhere
 
-__NOTE: This isn't in RubyGems yet.  Using a Gemfile entry pointing to this repo (i.e., using [Bundler](http://gembundler.com)) is the suggested option for now.__
+__NOTE: This isn't in RubyGems yet.  Using a Gemfile entry pointing to this repo (i.e., using
+[Bundler](http://gembundler.com)) is the suggested option for now.__
 
+Usage outside of Rapid7 is still alpha, as reflected in the pre-1.0.0 version, and we're not making many promises.  That
+being said, usage is easy:
 
-Usage outside of Rapid7 is still alpha, and we're not making many promises.  That being said, usage is easy:
-
-```ruby
-connection_info = YAML.load_file("path/to/rails-style/db_config_file")
-ActiveRecord::Base.establish_connection(connection_info['development'])
-include MetasploitDataModels
-MetasploitDataModels.create_and_load_ar_classes
-```
+    connection_info = YAML.load_file("path/to/rails-style/db_config_file")
+    ActiveRecord::Base.establish_connection(connection_info['development'])
+    MetasploitDataModels.require_models
 
 Basically you need to do the following things:
 
 1. Establish an ActiveRecord connection.  A Rails __config/database.yml__ is ideal for this.
-2. Include the MetasploitDataModels module.
-3. Call the class method that builds the AR models into the Mdm namespace( __MetasploitDataModels.create_and_load_ar_classes__ ).
+2. `MetasploitDataModels.require_models`
 
 
 ## Developer Info
@@ -57,19 +70,3 @@ Give it a path to a working MSF database.yml file for full
 ActiveRecord-based access to your data.
 
 __Note:__ "development" mode is hardcoded into the console currently.
-
-### ActiveRecord::ConnectionError issues
-Because the gem is defining mixins, there can be no knowledge of the
-specifics of any "current" ActiveRecord connection.  But if ActiveRecord
-encounters something in a child class that would require knowledge of
-the connection adapter (e.g. the use of an RDBMS-specific function in
-a named scope's "WHERE" clause), it will check to see if the adapter
-supports it and then throw an exception when the connection object
-(which provides the adapter) is nil.
-
-This means that, for all but the most trivial cases, you need to use Arel 
-versions of queries instead of ones utilizing straight SQL.
-
-You'll encounter this sometimes if you do dev work on this gem.  A good
-rule of thumb: anything that goes into the class_eval block must be able
-to work without knowledge of the AR connection adapter type.

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/Rakefile

@@ -1 +1,7 @@
-require "bundler/gem_tasks"
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec
+

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/app/models/mdm/api_key.rb

@@ -1,22 +1,20 @@
-module MetasploitDataModels::ActiveRecordModels::ApiKey
-  def self.included(base)
-    base.class_eval {
+class Mdm::ApiKey < ActiveRecord::Base
+  #
+  # Validators
+  #
 
-      validate do |key|
-        lic = License.get
+  validate :supports_api
+  validates :token, :presence => true, :length => { :minimum => 8 }
 
-        if lic and not lic.supports_api?
-          key.errors[:unsupported_product] = " - this product does not support API access"
-        end
+  protected
 
-        if key.token.to_s.empty?
-          key.errors[:blank_token] = " - the specified authentication token is empty"
-        end
+  def supports_api
+    license = License.get
 
-        if key.token.to_s.length < 8
-          key.errors[:token_too_short] = " - the specified authentication token must be at least 8 characters long"
-        end
-      end
-    }
+    if license and not license.supports_api?
+      errors[:license] = " - this product does not support API access"
+    end
   end
+
+  ActiveSupport.run_load_hooks(:mdm_api_key, self)
 end

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/app/models/mdm/client.rb

@@ -1,8 +1,9 @@
-module MetasploitDataModels::ActiveRecordModels::Client
-  def self.included(base)
-    base.class_eval {
-      belongs_to :host, :class_name => "Mdm::Host"
-      belongs_to :campaign, :class_name => "Campaign"
-    }
-  end
+class Mdm::Client < ActiveRecord::Base
+  #
+  # Relations
+  #
+  belongs_to :campaign, :class_name => 'Mdm::Campaign'
+  belongs_to :host, :class_name => 'Mdm::Host'
+
+  ActiveSupport.run_load_hooks(:mdm_client, self)
 end

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/app/models/mdm/cred.rb

@@ -1,78 +1,80 @@
-module MetasploitDataModels::ActiveRecordModels::Cred
-  def self.included(base)
-    base.class_eval{
-      belongs_to :service, :class_name => "Mdm::Service"
+class Mdm::Cred < ActiveRecord::Base
+  #
+  # CONSTANTS
+  #
+  KEY_ID_REGEX = /([0-9a-fA-F:]{47})/
+  PTYPES = {
+      'read/write password' => 'password_rw',
+      'read-only password' => 'password_ro',
+      'SMB hash' => 'smb_hash',
+      'SSH private key' => 'ssh_key',
+      'SSH public key' => 'ssh_pubkey'
+  }
 
-      unless defined? PTYPES
-        const_def =<<-CONST_DEF 
-          PTYPES = {
-            "read/write password" => "password_rw",
-            "read-only password" => "password_ro",
-            "SMB hash" => "smb_hash",
-            "SSH private key" => "ssh_key",
-            "SSH public key" => "ssh_pubkey"
-          }
-        CONST_DEF
-        eval(const_def)
-      end
+  #
+  # Relations
+  #
+  belongs_to :service, :class_name => "Mdm::Service"
 
-      eval("KEY_ID_REGEX = /([0-9a-fA-F:]{47})/") unless defined?(KEY_ID_REGEX) # Could be more strict
+  def ptype_human
+    humanized = PTYPES.select do |k, v|
+      v == ptype
+    end.keys[0]
 
-      def ptype_human
-        humanized = PTYPES.select do |k, v|
-          v == ptype
-        end.keys[0]
-
-        humanized ? humanized : ptype
-      end
+    humanized ? humanized : ptype
+  end
 
-      # Returns its workspace
-      def workspace
-        self.service.host.workspace
-      end
+  # Returns its key id. If this is not an ssh-type key, returns nil.
+  def ssh_key_id
+    return nil unless self.ptype =~ /^ssh_/
+    return nil unless self.proof =~ KEY_ID_REGEX
+    $1.downcase # Can't run into NilClass problems.
+  end
 
-      # Returns its key id. If this is not an ssh-type key, returns nil.
-      def ssh_key_id
-        return nil unless self.ptype =~ /^ssh_/
-          return nil unless self.proof =~ KEY_ID_REGEX
-        $1.downcase # Can't run into NilClass problems.
-      end
+  def ssh_key_matches?(other_cred)
+    return false unless other_cred.kind_of? self.class
+    return false unless self.ptype == other_cred.ptype
+    case self.ptype
+      when "ssh_key"
+        matches = self.ssh_private_keys
+      when "ssh_pubkey"
+        matches = self.ssh_public_keys
+      else
+        false
+    end
+    matches.include?(self) and matches.include?(other_cred)
+  end
 
-      # Returns all private keys with matching key ids, including itself
-      # If this is not an ssh-type key, always returns an empty array.
-      def ssh_private_keys
-        return [] unless self.ssh_key_id
-        matches = self.class.all(:conditions => ["creds.ptype = ? AND creds.proof ILIKE ?", "ssh_key", "%#{self.ssh_key_id}%"])
-        matches.select {|c| c.workspace == self.workspace}
-      end
+  # Returns all keys with matching key ids, including itself
+  # If this is not an ssh-type key, always returns an empty array.
+  def ssh_keys
+    (self.ssh_private_keys | self.ssh_public_keys)
+  end
 
-      # Returns all public keys with matching key ids, including itself
-      # If this is not an ssh-type key, always returns an empty array.
-      def ssh_public_keys
-        return [] unless self.ssh_key_id
-        matches = self.class.all(:conditions => ["creds.ptype = ? AND creds.proof ILIKE ?", "ssh_pubkey", "%#{self.ssh_key_id}%"])
-        matches.select {|c| c.workspace == self.workspace}
-      end
+  # Returns all private keys with matching key ids, including itself
+  # If this is not an ssh-type key, always returns an empty array.
+  def ssh_private_keys
+    return [] unless self.ssh_key_id
+    matches = self.class.all(
+        :conditions => ["creds.ptype = ? AND creds.proof ILIKE ?", "ssh_key", "%#{self.ssh_key_id}%"]
+    )
+    matches.select {|c| c.workspace == self.workspace}
+  end
 
-      # Returns all keys with matching key ids, including itself
-      # If this is not an ssh-type key, always returns an empty array.
-      def ssh_keys
-        (self.ssh_private_keys | self.ssh_public_keys)
-      end
+  # Returns all public keys with matching key ids, including itself
+  # If this is not an ssh-type key, always returns an empty array.
+  def ssh_public_keys
+    return [] unless self.ssh_key_id
+    matches = self.class.all(
+        :conditions => ["creds.ptype = ? AND creds.proof ILIKE ?", "ssh_pubkey", "%#{self.ssh_key_id}%"]
+    )
+    matches.select {|c| c.workspace == self.workspace}
+  end
 
-      def ssh_key_matches?(other_cred)
-        return false unless other_cred.kind_of? self.class
-        return false unless self.ptype == other_cred.ptype
-        case self.ptype
-        when "ssh_key"
-          matches = self.ssh_private_keys
-        when "ssh_pubkey"
-          matches = self.ssh_public_keys
-        else
-          false
-        end
-        matches.include?(self) and matches.include?(other_cred)
-      end
-    }
+  # Returns its workspace
+  def workspace
+    self.service.host.workspace
   end
+
+  ActiveSupport.run_load_hooks(:mdm_cred, self)
 end

lib/gemcache/ruby/1.9.1/gems/metasploit_data_models-0.3.0/app/models/mdm/cred_file.rb

@@ -1,8 +1,8 @@
-module MetasploitDataModels::ActiveRecordModels::CredFile
-  def self.included(base)
-    base.class_eval{
+class Mdm::CredFile < ActiveRecord::Base
+  #
+  # Relations
+  #
+  belongs_to :workspace, :class_name => 'Mdm::Workspace'
 
-      belongs_to :workspace, :class_name => "Mdm::Workspace"
-    }
-  end
+  ActiveSupport.run_load_hooks(:mdm_cred_file, self)
 end