diff --git a/lib/helpers/constants.rb b/lib/helpers/constants.rb
index 90267d0e1..21122bfaa 100644
--- a/lib/helpers/constants.rb
+++ b/lib/helpers/constants.rb
@@ -11,6 +11,7 @@ SCENARIO_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/scenario_schema.xsd"
VULNERABILITY_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/vulnerability_metadata_schema.xsd"
SERVICE_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/service_metadata_schema.xsd"
UTILITY_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/utility_metadata_schema.xsd"
+GENERATOR_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/generator_metadata_schema.xsd"
NETWORK_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/network_metadata_schema.xsd"
BASE_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/base_metadata_schema.xsd"
@@ -28,6 +29,7 @@ MODULES_PATH = "#{ROOT_DIR}/modules/"
VULNERABILITIES_PATH = "#{MODULES_PATH}vulnerabilities/"
SERVICES_PATH = "#{MODULES_PATH}services/"
UTILITIES_PATH = "#{MODULES_PATH}utilities/"
+GENERATORS_PATH = "#{MODULES_PATH}generators/"
NETWORKS_PATH = "#{MODULES_PATH}networks/"
BASES_PATH = "#{MODULES_PATH}bases/"
diff --git a/lib/objects/module.rb b/lib/objects/module.rb
index 1a4782e75..aedb8f7fa 100644
--- a/lib/objects/module.rb
+++ b/lib/objects/module.rb
@@ -11,7 +11,8 @@ class Module
# Module *selectors*, store filters in the attributes hash.
# XML validity ensures valid and complete information.
- attr_accessor :inputs
+ attr_accessor :write_outputs_to
+ attr_accessor :unique_id
attr_accessor :conflicts
attr_accessor :requires
@@ -21,7 +22,6 @@ class Module
# @param [Object] module_type: such as 'vulnerability', 'base', 'service', 'network'
def initialize(module_type)
self.module_type = module_type
- self.inputs = []
self.conflicts = []
self.requires = []
self.attributes = {}
diff --git a/lib/readers/module_reader.rb b/lib/readers/module_reader.rb
index 0f59c745d..ce03f9d75 100644
--- a/lib/readers/module_reader.rb
+++ b/lib/readers/module_reader.rb
@@ -25,6 +25,11 @@ class ModuleReader
return read_modules('utility', UTILITIES_PATH, UTILITY_SCHEMA_FILE, true)
end
+ # reads in all utilities
+ def self.read_generators
+ return read_modules('generator', GENERATORS_PATH, GENERATOR_SCHEMA_FILE, true)
+ end
+
# reads in all networks
def self.read_networks
return read_modules('network', NETWORKS_PATH, NETWORK_SCHEMA_FILE, false)
diff --git a/lib/readers/system_reader.rb b/lib/readers/system_reader.rb
index c7dc81b18..32b0e21b7 100644
--- a/lib/readers/system_reader.rb
+++ b/lib/readers/system_reader.rb
@@ -1,4 +1,5 @@
require 'nokogiri'
+require 'digest'
require_relative '../objects/system'
require_relative '../objects/module'
@@ -50,18 +51,36 @@ class SystemReader
end
# for each module selection
- system_node.xpath('vulnerability | service | utility | network | base').each do |module_node|
+ system_node.xpath('//vulnerability | //service | //utility | //network | //base | //generator').each do |module_node|
# create a selector module, which is a regular module instance used as a placeholder for matching requirements
module_selector = Module.new(module_node.name)
+
+ # create a unique id for tracking variables between modules
+ module_selector.unique_id = module_node.path.gsub(/[^a-zA-Z0-9]/, '')
+ # check if we need to be sending the module output to another module
+ module_node.xpath('parent::input').each do |input|
+ # Parent is input -- needs to send write value somewhere
+ input.xpath('..').each do |input_parent|
+ # Print.verbose " -- Sends output to " + input_parent.path.gsub(/[^a-zA-Z0-9]/, '')
+
+ #TODO propagate unique ids and writes to to selected modules
+
+ module_selector.write_outputs_to = input_parent.path.gsub(/[^a-zA-Z0-9]/, '') + '_' + input.xpath('@into').to_s
+ end
+ end
+
module_node.xpath('@*').each do |attr|
module_selector.attributes["#{attr.name}"] = [attr.text] unless attr.text.nil? || attr.text == ''
end
- Print.verbose " #{module_node.name}, selecting based on:"
+ Print.verbose " #{module_node.name} (#{module_selector.unique_id}), selecting based on:"
module_selector.attributes.each do |attr|
if attr[0] && attr[1] && attr[0].to_s != "module_type"
Print.verbose " - #{attr[0].to_s} ~= #{attr[1].to_s}"
end
end
+ if module_selector.write_outputs_to
+ Print.verbose " -- writes to: " + module_selector.write_outputs_to
+ end
module_selectors << module_selector
end
diff --git a/lib/schemas/scenario_schema.xsd b/lib/schemas/scenario_schema.xsd
index 2d7a8d7c0..2b8000e33 100644
--- a/lib/schemas/scenario_schema.xsd
+++ b/lib/schemas/scenario_schema.xsd
@@ -11,6 +11,19 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -23,8 +36,8 @@
-
-
+
+
@@ -48,13 +61,9 @@
-
-
-
-
+
-
@@ -67,6 +76,9 @@
+
+
+
@@ -85,23 +97,7 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
diff --git a/lib/schemas/vulnerability_metadata_schema.xsd b/lib/schemas/vulnerability_metadata_schema.xsd
index 9f733cf1c..3923b62c8 100644
--- a/lib/schemas/vulnerability_metadata_schema.xsd
+++ b/lib/schemas/vulnerability_metadata_schema.xsd
@@ -6,6 +6,7 @@
+
@@ -92,6 +93,9 @@
+
+
+
diff --git a/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp b/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp
index 1fd786ee8..90b708814 100644
--- a/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp
+++ b/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp
@@ -1,25 +1,12 @@
class nfs_overshare::config {
- package { ['nfs-kernel-server', 'nfs-common', 'portmap']:
- ensure => installed
- }
-
-
- file { '/etc/exports':
+ file { '/export_nfs/something':
require => Package['nfs-common'],
ensure => present,
owner => 'root',
group => 'root',
mode => '0777',
- content => template('nfs_overshare/exports.erb')
+ content => template('nfs_overshare/overshare.erb')
}
- exec { "exportfs":
- require => Package['nfs-common'],
- command => "exportfs -a",
- path => "/usr/sbin",
- # path => [ "/usr/local/bin/", "/bin/" ], # alternative syntax
- }
}
-
-
diff --git a/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml b/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml
index cdb7b3fb3..6fe1fff1d 100644
--- a/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml
@@ -3,21 +3,24 @@
- NFS write access to FS
- Lewis Ardern
+ NFS Share Leak
+ Z. Cliffe Schreuders
MIT
- NFS misconfigured to be mountable from anyone that can interact with it.
+ NFS misconfigured to be mountable from anyone that can interact with it, sharing something extra.
nfs
- user
+ info_leak
remote
linux
+ strings_to_leak
+ files_to_leak
+
low
- 6.6
- AV:L/AC:M/Au:S/C:C/I:C/A:C
+ 4.3
+ AV:N/AC:M/Au:N/C:P/I:N/A:N
http://nfs.sourceforge.net/#section_c
nfsd
GPLv2
diff --git a/modules/vulnerabilities/unix/nfs/nfs_overshare/templates/exports.erb b/modules/vulnerabilities/unix/nfs/nfs_overshare/templates/exports.erb
deleted file mode 100644
index 12f34dc9c..000000000
--- a/modules/vulnerabilities/unix/nfs/nfs_overshare/templates/exports.erb
+++ /dev/null
@@ -1,11 +0,0 @@
-# /etc/exports: the access control list for filesystems which may be exported
-# to NFS clients. See exports(5).
-#
-# Example for NFSv2 and NFSv3:
- / 172.0.0.0/8(rw,sync,no_subtree_check)
- / 192.0.0.0/8(rw,sync,no_subtree_check)
-#
-# Example for NFSv4:
-# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
-# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
-#
diff --git a/secgen.rb b/secgen.rb
index eb1d95256..848652f81 100644
--- a/secgen.rb
+++ b/secgen.rb
@@ -54,13 +54,17 @@ def build_config(scenario, out_dir)
all_available_utilities = ModuleReader.read_utilities
Print.std "#{all_available_utilities.size} utility modules loaded"
+ Print.info 'Reading available generator modules...'
+ all_available_generators = ModuleReader.read_generators
+ Print.std "#{all_available_generators.size} generator modules loaded"
+
Print.info 'Reading available network modules...'
all_available_networks = ModuleReader.read_networks
Print.std "#{all_available_networks.size} network modules loaded"
Print.info 'Resolving systems: randomising scenario...'
# for each system, select modules
- all_available_modules = all_available_bases + all_available_vulnerabilties + all_available_services + all_available_utilities + all_available_networks
+ all_available_modules = all_available_bases + all_available_vulnerabilties + all_available_services + all_available_utilities + all_available_generators + all_available_networks
# update systems with module selections
systems.map! {|system|
system.module_selections = system.resolve_module_selection(all_available_modules)