diff --git a/lib/helpers/constants.rb b/lib/helpers/constants.rb index 90267d0e1..21122bfaa 100644 --- a/lib/helpers/constants.rb +++ b/lib/helpers/constants.rb @@ -11,6 +11,7 @@ SCENARIO_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/scenario_schema.xsd" VULNERABILITY_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/vulnerability_metadata_schema.xsd" SERVICE_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/service_metadata_schema.xsd" UTILITY_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/utility_metadata_schema.xsd" +GENERATOR_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/generator_metadata_schema.xsd" NETWORK_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/network_metadata_schema.xsd" BASE_SCHEMA_FILE = "#{ROOT_DIR}/lib/schemas/base_metadata_schema.xsd" @@ -28,6 +29,7 @@ MODULES_PATH = "#{ROOT_DIR}/modules/" VULNERABILITIES_PATH = "#{MODULES_PATH}vulnerabilities/" SERVICES_PATH = "#{MODULES_PATH}services/" UTILITIES_PATH = "#{MODULES_PATH}utilities/" +GENERATORS_PATH = "#{MODULES_PATH}generators/" NETWORKS_PATH = "#{MODULES_PATH}networks/" BASES_PATH = "#{MODULES_PATH}bases/" diff --git a/lib/objects/module.rb b/lib/objects/module.rb index 1a4782e75..aedb8f7fa 100644 --- a/lib/objects/module.rb +++ b/lib/objects/module.rb @@ -11,7 +11,8 @@ class Module # Module *selectors*, store filters in the attributes hash. # XML validity ensures valid and complete information. - attr_accessor :inputs + attr_accessor :write_outputs_to + attr_accessor :unique_id attr_accessor :conflicts attr_accessor :requires @@ -21,7 +22,6 @@ class Module # @param [Object] module_type: such as 'vulnerability', 'base', 'service', 'network' def initialize(module_type) self.module_type = module_type - self.inputs = [] self.conflicts = [] self.requires = [] self.attributes = {} diff --git a/lib/readers/module_reader.rb b/lib/readers/module_reader.rb index 0f59c745d..ce03f9d75 100644 --- a/lib/readers/module_reader.rb +++ b/lib/readers/module_reader.rb @@ -25,6 +25,11 @@ class ModuleReader return read_modules('utility', UTILITIES_PATH, UTILITY_SCHEMA_FILE, true) end + # reads in all utilities + def self.read_generators + return read_modules('generator', GENERATORS_PATH, GENERATOR_SCHEMA_FILE, true) + end + # reads in all networks def self.read_networks return read_modules('network', NETWORKS_PATH, NETWORK_SCHEMA_FILE, false) diff --git a/lib/readers/system_reader.rb b/lib/readers/system_reader.rb index c7dc81b18..32b0e21b7 100644 --- a/lib/readers/system_reader.rb +++ b/lib/readers/system_reader.rb @@ -1,4 +1,5 @@ require 'nokogiri' +require 'digest' require_relative '../objects/system' require_relative '../objects/module' @@ -50,18 +51,36 @@ class SystemReader end # for each module selection - system_node.xpath('vulnerability | service | utility | network | base').each do |module_node| + system_node.xpath('//vulnerability | //service | //utility | //network | //base | //generator').each do |module_node| # create a selector module, which is a regular module instance used as a placeholder for matching requirements module_selector = Module.new(module_node.name) + + # create a unique id for tracking variables between modules + module_selector.unique_id = module_node.path.gsub(/[^a-zA-Z0-9]/, '') + # check if we need to be sending the module output to another module + module_node.xpath('parent::input').each do |input| + # Parent is input -- needs to send write value somewhere + input.xpath('..').each do |input_parent| + # Print.verbose " -- Sends output to " + input_parent.path.gsub(/[^a-zA-Z0-9]/, '') + + #TODO propagate unique ids and writes to to selected modules + + module_selector.write_outputs_to = input_parent.path.gsub(/[^a-zA-Z0-9]/, '') + '_' + input.xpath('@into').to_s + end + end + module_node.xpath('@*').each do |attr| module_selector.attributes["#{attr.name}"] = [attr.text] unless attr.text.nil? || attr.text == '' end - Print.verbose " #{module_node.name}, selecting based on:" + Print.verbose " #{module_node.name} (#{module_selector.unique_id}), selecting based on:" module_selector.attributes.each do |attr| if attr[0] && attr[1] && attr[0].to_s != "module_type" Print.verbose " - #{attr[0].to_s} ~= #{attr[1].to_s}" end end + if module_selector.write_outputs_to + Print.verbose " -- writes to: " + module_selector.write_outputs_to + end module_selectors << module_selector end diff --git a/lib/schemas/scenario_schema.xsd b/lib/schemas/scenario_schema.xsd index 2d7a8d7c0..2b8000e33 100644 --- a/lib/schemas/scenario_schema.xsd +++ b/lib/schemas/scenario_schema.xsd @@ -11,6 +11,19 @@ + + + + + + + + + + + + + @@ -23,8 +36,8 @@ - - + + @@ -48,13 +61,9 @@ - - - - + - @@ -67,6 +76,9 @@ + + + @@ -85,23 +97,7 @@ - - - - - - - - - - - - - - - - - + diff --git a/lib/schemas/vulnerability_metadata_schema.xsd b/lib/schemas/vulnerability_metadata_schema.xsd index 9f733cf1c..3923b62c8 100644 --- a/lib/schemas/vulnerability_metadata_schema.xsd +++ b/lib/schemas/vulnerability_metadata_schema.xsd @@ -6,6 +6,7 @@ + @@ -92,6 +93,9 @@ + + + diff --git a/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp b/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp index 1fd786ee8..90b708814 100644 --- a/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp +++ b/modules/vulnerabilities/unix/nfs/nfs_overshare/manifests/config.pp @@ -1,25 +1,12 @@ class nfs_overshare::config { - package { ['nfs-kernel-server', 'nfs-common', 'portmap']: - ensure => installed - } - - - file { '/etc/exports': + file { '/export_nfs/something': require => Package['nfs-common'], ensure => present, owner => 'root', group => 'root', mode => '0777', - content => template('nfs_overshare/exports.erb') + content => template('nfs_overshare/overshare.erb') } - exec { "exportfs": - require => Package['nfs-common'], - command => "exportfs -a", - path => "/usr/sbin", - # path => [ "/usr/local/bin/", "/bin/" ], # alternative syntax - } } - - diff --git a/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml b/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml index cdb7b3fb3..6fe1fff1d 100644 --- a/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml +++ b/modules/vulnerabilities/unix/nfs/nfs_overshare/secgen_metadata.xml @@ -3,21 +3,24 @@ - NFS write access to FS - Lewis Ardern + NFS Share Leak + Z. Cliffe Schreuders MIT - NFS misconfigured to be mountable from anyone that can interact with it. + NFS misconfigured to be mountable from anyone that can interact with it, sharing something extra. nfs - user + info_leak remote linux + strings_to_leak + files_to_leak + low - 6.6 - AV:L/AC:M/Au:S/C:C/I:C/A:C + 4.3 + AV:N/AC:M/Au:N/C:P/I:N/A:N http://nfs.sourceforge.net/#section_c nfsd GPLv2 diff --git a/modules/vulnerabilities/unix/nfs/nfs_overshare/templates/exports.erb b/modules/vulnerabilities/unix/nfs/nfs_overshare/templates/exports.erb deleted file mode 100644 index 12f34dc9c..000000000 --- a/modules/vulnerabilities/unix/nfs/nfs_overshare/templates/exports.erb +++ /dev/null @@ -1,11 +0,0 @@ -# /etc/exports: the access control list for filesystems which may be exported -# to NFS clients. See exports(5). -# -# Example for NFSv2 and NFSv3: - / 172.0.0.0/8(rw,sync,no_subtree_check) - / 192.0.0.0/8(rw,sync,no_subtree_check) -# -# Example for NFSv4: -# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check) -# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check) -# diff --git a/secgen.rb b/secgen.rb index eb1d95256..848652f81 100644 --- a/secgen.rb +++ b/secgen.rb @@ -54,13 +54,17 @@ def build_config(scenario, out_dir) all_available_utilities = ModuleReader.read_utilities Print.std "#{all_available_utilities.size} utility modules loaded" + Print.info 'Reading available generator modules...' + all_available_generators = ModuleReader.read_generators + Print.std "#{all_available_generators.size} generator modules loaded" + Print.info 'Reading available network modules...' all_available_networks = ModuleReader.read_networks Print.std "#{all_available_networks.size} network modules loaded" Print.info 'Resolving systems: randomising scenario...' # for each system, select modules - all_available_modules = all_available_bases + all_available_vulnerabilties + all_available_services + all_available_utilities + all_available_networks + all_available_modules = all_available_bases + all_available_vulnerabilties + all_available_services + all_available_utilities + all_available_generators + all_available_networks # update systems with module selections systems.map! {|system| system.module_selections = system.resolve_module_selection(all_available_modules)