metasploit-framework/plugins/db_tracker.rb

#
# $Id$
# $Revision$
#

module Msf

###
#
# This class hooks all socket calls and updates the database with
# data gathered from the connection parameters
#
###

class Plugin::DB_Tracer < Msf::Plugin

  ###
  #
  # This class implements a socket communication tracker
  #
  ###
  class DBTracerEventHandler
    include Rex::Socket::Comm::Events

    def on_before_socket_create(comm, param)
    end

    def on_socket_created(comm, sock, param)
      # Ignore local listening sockets
      return if not sock.peerhost

      if (sock.peerhost != '0.0.0.0' and sock.peerport)

        # Ignore sockets that didn't set up their context
        # to hold the framework in 'Msf'
        return if not param.context['Msf']

        host = param.context['Msf'].db.find_or_create_host(:host => sock.peerhost, :state => Msf::HostState::Alive)
        return if not host

        param.context['Msf'].db.report_service(:host => host, :proto => param.proto, :port => sock.peerport)
      end
    end
  end

  def initialize(framework, opts)
    super

    if(not framework.db.active)
      raise PluginLoadError.new("The database backend has not been initialized")
    end
    framework.plugins.each { |plugin|
      if (plugin.class == Msf::Plugin::DB_Tracer)
        raise PluginLoadError.new("This plugin should not be loaded more than once")
      end
    }

    @eh = DBTracerEventHandler.new
    Rex::Socket::Comm::Local.register_event_handler(@eh)
  end

  def cleanup
    Rex::Socket::Comm::Local.deregister_event_handler(@eh)
  end

  def name
    "db_tracker"
  end

  def desc
    "Monitors socket calls and updates the database backend"
  end

end
end