# -*- coding: binary -*- require 'rex/socket' require 'rex/encoder/xdr' module Rex module Proto module SunRPC class RPCError < ::StandardError def initialize(msg = 'RPC operation failed') super @msg = msg end def to_s @msg end end class RPCTimeout < ::Interrupt def initialize(msg = 'Operation timed out.') @msg = msg end def to_s @msg end end # XXX: CPORT! class Client AUTH_NULL = 0 AUTH_UNIX = 1 PMAP_PROG = 100000 PMAP_VERS = 2 PMAP_GETPORT = 3 CALL = 0 attr_accessor :rhost, :rport, :proto, :program, :version attr_accessor :pport, :call_sock, :timeout, :context attr_accessor :should_fragment def initialize(opts) self.rhost = opts[:rhost] self.rport = opts[:rport] self.program = opts[:program] self.version = opts[:version] self.timeout = opts[:timeout] || 20 self.context = opts[:context] || {} self.proto = opts[:proto] if self.proto.downcase !~ /^(tcp|udp)$/ raise ::Rex::ArgumentError, 'Protocol is not "tcp" or "udp"' end @pport = nil @auth_type = AUTH_NULL @auth_data = '' @call_sock = nil end # XXX: Add optional parameter to have proto be something else def create() proto_num = 0 if @proto.eql?('tcp') proto_num = 6 elsif @proto.eql?('udp') proto_num = 17 end buf = Rex::Encoder::XDR.encode(CALL, 2, PMAP_PROG, PMAP_VERS, PMAP_GETPORT, @auth_type, [@auth_data, 400], AUTH_NULL, '', @program, @version, proto_num, 0) sock = make_rpc(@proto, @rhost, @rport) send_rpc(sock, buf) ret = recv_rpc(sock) close_rpc(sock) return ret end def call(procedure, buffer, maxwait = self.timeout) buf = Rex::Encoder::XDR.encode(CALL, 2, @program, @version, procedure, @auth_type, [@auth_data, 400], AUTH_NULL, '')+ buffer if ! @call_sock @call_sock = make_rpc(@proto, @rhost, @pport) end send_rpc(@call_sock, buf) recv_rpc(@call_sock, maxwait) end def destroy close_rpc(@call_sock) if @call_sock @call_sock = nil end def authnull_create @auth_type = AUTH_NULL @auth_data = '' end def authunix_create(host, uid, gid, groupz) raise ::Rex::ArgumentError, 'Hostname length is too long' if host.length > 255 # 10? raise ::Rex::ArgumentError, 'Too many groups' if groupz.length > 10 @auth_type = AUTH_UNIX @auth_data = Rex::Encoder::XDR.encode(0, host, uid, gid, groupz) # XXX: TIME! GROUPZ?! end # XXX: Dirty, integrate some sort of request system into create/call? def portmap_req(host, port, rpc_vers, procedure, buffer) buf = Rex::Encoder::XDR.encode(CALL, 2, PMAP_PROG, rpc_vers, procedure, AUTH_NULL, '', AUTH_NULL, '') + buffer sock = make_rpc('tcp', host, port) send_rpc(sock, buf) ret = recv_rpc(sock) close_rpc(sock) return ret end private def make_rpc(proto, host, port) Rex::Socket.create( 'PeerHost' => host, 'PeerPort' => port, 'Proto' => proto, 'Timeout' => self.timeout, 'Context' => self.context ) end def build_tcp(buf) if !self.should_fragment return Rex::Encoder::XDR.encode(0x80000000 | buf.length) + buf end str = buf.dup fragmented = '' while (str.size > 0) frag = str.slice!(0, rand(3) + 1) len = frag.size if str.size == 0 len |= 0x80000000 end fragmented += Rex::Encoder::XDR.encode(len) + frag end return fragmented end def send_rpc(sock, buf) buf = gen_xid() + buf if sock.type?.eql?('tcp') buf = build_tcp(buf) end sock.put(buf) end def recv_rpc(sock, maxwait=self.timeout) buf = nil begin Timeout.timeout(maxwait) { buf = sock.get } rescue ::Timeout end return nil if not buf buf.slice!(0..3) if sock.type?.eql?('tcp') buf.slice!(0..3) end return buf if buf.length > 1 return nil end def close_rpc(sock) sock.close end def gen_xid return Rex::Encoder::XDR.encode(rand(0xffffffff) + 1) end end end end end