793 lines
21 KiB
Ruby
793 lines
21 KiB
Ruby
#
|
|
# $Id$
|
|
# $Revision$
|
|
#
|
|
$:.unshift(File.join(File.expand_path(File.dirname(__FILE__)), '..', 'lib', 'lab'))
|
|
|
|
require 'yaml'
|
|
require 'lab_controller'
|
|
|
|
module Msf
|
|
|
|
class Plugin::Lab < Msf::Plugin
|
|
class LabCommandDispatcher
|
|
include Msf::Ui::Console::CommandDispatcher
|
|
|
|
attr_accessor :controller
|
|
attr_accessor :target_map
|
|
|
|
def initialize(driver)
|
|
super(driver)
|
|
@controller = nil
|
|
@target_map = nil
|
|
end
|
|
|
|
#
|
|
# Returns the hash of commands supported by this dispatcher.
|
|
#
|
|
def commands
|
|
{
|
|
|
|
### Lab Management!
|
|
"lab_help" => "lab_help <lab command> - Show that command's description.",
|
|
"lab_load_file" => "lab_load_file [file] - load a lab definition from disk.",
|
|
"lab_load_running" => "lab_load_running - use the running vms to create a lab definition.",
|
|
"lab_load_dir" => "lab_load_dir [file] - load a lab definition from a directory.",
|
|
"lab_clear" => "lab_clear - clear the running lab_definition.",
|
|
"lab_save" => "lab_save [filename] - save a lab_definition to filename.",
|
|
"lab_show" => "lab_show - show all vms in the lab.",
|
|
"lab_show_running" => "lab_show_running - show running vms.",
|
|
"lab_start" => "lab_start [vmid+|all] start all targets for this exploit.",
|
|
"lab_reset" => "lab_reset [vmid+|all] reset all targets for this exploit.",
|
|
"lab_suspend" => "lab_suspend [vmid+|all] suspend all targets for this exploit.",
|
|
"lab_stop" => "lab_stop [vmid+|all] stop all targets for this exploit.",
|
|
"lab_revert" => "lab_revert [vmid+|all] [snapshot] revert all targets for this exploit.",
|
|
"lab_run_command" => "lab_run_command [vmid+|all] [command] run a command on all targets.",
|
|
"lab_snapshot" => "lab_snapshot [vmid+|all] [snapshot] snapshot all targets for this exploit.",
|
|
"lab_browse_to" => "lab_browse_to [vmid+|all] [uri] use the default browser to browse to a uri.",
|
|
|
|
### Target map management
|
|
"target_map_load" => "target_map_load",
|
|
"target_map_unload" => "target_map_unload",
|
|
"target_map_save" => "targets_map_save",
|
|
"target_map_show" => "target_map_show",
|
|
|
|
### Target (module-specific mappings) commands
|
|
"targets_show" => "targets_show - show all targets for this exploit",
|
|
"targets_add" => "target_add [vmid] - add a target for this exploit",
|
|
# "targets_add_running" => "target_add_running [vmid] - add a target for this exploit",
|
|
"targets_remove" => "target_remove [vmid] - remove a target for this exploit",
|
|
"targets_clear" => "targets_clear - clear targets list for this exploit",
|
|
"targets_start" => "targets_start - start all targets for this exploit",
|
|
"targets_stop" => "targets_stop - stop all targets for this exploit",
|
|
"targets_reset" => "targets_reset - reset all targets for this exploit",
|
|
"targets_suspend" => "targets_suspend - suspend all targets for this exploit",
|
|
"targets_snapshot" => "targets_snapshot [snapshot] - snapshot all targets for this exploit",
|
|
"targets_revert" => "targets_revert [revert] - snapshot all targets for this exploit",
|
|
# "targets_run_command" => "targets_run_command run a command on all targets",
|
|
# "targets_browse_to" => "targets_browse_to [uri] use the default browser to browse to a uri"
|
|
# "targets_exploit" => "targets_exploit exploit all targets",
|
|
# "targets_verify" => "targets_verify - exploit and verify against all targets",
|
|
# "targets_auto_verify" => "targets_verify - exploit and verify by querying targets that should work, and matching to the lab"
|
|
}
|
|
end
|
|
|
|
def name
|
|
"Lab"
|
|
end
|
|
|
|
|
|
##
|
|
## Commands for help
|
|
##
|
|
|
|
def longest_cmd_size
|
|
commands.keys.map {|x| x.size}.sort.last
|
|
end
|
|
|
|
# No extended help yet, but this is where more detailed documentation
|
|
# on particular commands would live. Key is command, (not cmd_command),
|
|
# value is the documentation.
|
|
def extended_help
|
|
{
|
|
"lab_fake_cmd" => "This is a fake command. It's got its own special docs.\n" +
|
|
(" " * longest_cmd_size) + "It might be long so so deal with formatting somehow."
|
|
}
|
|
end
|
|
|
|
# Map for usages
|
|
def lab_usage
|
|
caller[0][/`cmd_(.*)'/]
|
|
cmd = $1
|
|
if extended_help[cmd] || commands[cmd]
|
|
cmd_lab_help cmd
|
|
else # Should never really get here...
|
|
print_error "Unknown command. Try 'help'"
|
|
end
|
|
end
|
|
|
|
def cmd_lab_help(*args)
|
|
if args.empty?
|
|
commands.each_pair {|k,v| print_line "%-#{longest_cmd_size}s - %s" % [k,v] }
|
|
else
|
|
args.each do |c|
|
|
if extended_help[c] || commands[c]
|
|
print_line "%-#{longest_cmd_size}s - %s" % [c,extended_help[c] || commands[c]]
|
|
else
|
|
print_error "Unknown command '#{c}'"
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
def cmd_lab_load_file(*args)
|
|
if args[0]
|
|
labdef = YAML::load_file(args[0])
|
|
@controller = LabController.new(labdef)
|
|
@target_map = {}
|
|
hlp_print_lab
|
|
else
|
|
lab_usage
|
|
end
|
|
end
|
|
|
|
def cmd_lab_load_dir(*args)
|
|
if args[0]
|
|
x = @controller.build_lab_from_files(args[0])
|
|
@target_map = {}
|
|
hlp_print_lab
|
|
else
|
|
lab_usage
|
|
end
|
|
end
|
|
|
|
def cmd_lab_load_running(*args)
|
|
@controller.build_lab_from_running
|
|
@target_map = {}
|
|
hlp_print_lab
|
|
end
|
|
|
|
|
|
def cmd_lab_clear(*args)
|
|
|
|
@controller = LabController.new({})
|
|
hlp_print_lab
|
|
end
|
|
|
|
def cmd_lab_save(*args)
|
|
return lab_usage if args.empty?
|
|
File.open(args[0], 'w') {|f| f.write(@controller.labdef.to_yaml) }
|
|
hlp_print_lab
|
|
end
|
|
|
|
|
|
##
|
|
## Commands for dealing with a currently-loaded lab
|
|
##
|
|
|
|
def cmd_lab_show(*args)
|
|
hlp_print_lab
|
|
end
|
|
|
|
def cmd_lab_show_running(*args)
|
|
hlp_print_lab_running
|
|
end
|
|
|
|
def cmd_lab_start(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
if args[0] == "all"
|
|
print_line "Starting all lab vms.\n"
|
|
@controller.start_lab
|
|
else
|
|
args.each do |arg|
|
|
if @controller.exists?(arg)
|
|
if !@controller.running?(arg)
|
|
print_line "Starting lab vm '" + arg + "'."
|
|
@controller.start_lab_vm(arg)
|
|
else
|
|
print_error "Lab vm '" + arg + "' " + "already running."
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
hlp_print_lab_running
|
|
end
|
|
|
|
def cmd_lab_stop(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
if args[0] == "all"
|
|
print_line "Stopping all running lab vms.\n"
|
|
@controller.stop_lab
|
|
else
|
|
args.each do |arg|
|
|
if @controller.exists?(arg)
|
|
if @controller.running?(arg)
|
|
print_line "Stopping lab vm '" + arg + "'."
|
|
@controller.stop_lab_vm(arg)
|
|
else
|
|
print_error "Lab vm '" + arg + "' " + "not running."
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
hlp_print_lab_running
|
|
end
|
|
|
|
def cmd_lab_suspend(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
if args[0] == "all"
|
|
print_line "Suspending all running lab vms.\n"
|
|
@controller.suspend_lab
|
|
else
|
|
args.each do |arg|
|
|
if @controller.exists?(arg)
|
|
if @controller.running?(arg)
|
|
print_line "Suspending lab vm '" + arg + "'."
|
|
@controller.suspend_lab_vm(arg)
|
|
else
|
|
print_error "Lab vm '" + arg + "' " + "not running."
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
hlp_print_lab_running
|
|
end
|
|
|
|
def cmd_lab_reset(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
if args[0] == "all"
|
|
print_line "Resetting all running lab vms.\n"
|
|
@controller.reset_lab
|
|
else
|
|
args.each do |arg|
|
|
if @controller.exists?(arg)
|
|
if @controller.running?(arg)
|
|
print_line "Resetting lab vm '" + arg + "'."
|
|
@controller.reset_lab_vm(arg)
|
|
else
|
|
print_error "Lab vm '" + arg + "' " + "not running."
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
hlp_print_lab_running
|
|
end
|
|
|
|
|
|
def cmd_lab_snapshot(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
snapshot = args[args.count-1]
|
|
|
|
if args[0] == "all"
|
|
print_line "Snapshotting all running lab vms.\n"
|
|
@controller.snapshot_lab(snapshot)
|
|
else
|
|
args.each do |arg|
|
|
if @controller.exists?(arg)
|
|
print_line "snapshotting lab vm '" + arg + "'."
|
|
@controller.snapshot_lab_vm(arg,snapshot)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
|
|
def cmd_lab_revert(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
snapshot = args[args.count-1]
|
|
|
|
if args[0] == "all"
|
|
print_line "Reverting all running lab vms.\n"
|
|
@controller.revert_lab(snapshot)
|
|
else
|
|
args.each do |arg|
|
|
if @controller.exists?(arg)
|
|
print_line "Reverting lab vm '" + arg + "'."
|
|
@controller.revert_lab_vm(arg, snapshot)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
|
|
def cmd_lab_run_command(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
command = args[args.count-1]
|
|
|
|
if args[0] == "all"
|
|
print_line "Running command '" + command + "' on all running lab vms.\n"
|
|
@controller.run_command_on_lab(args[1])
|
|
else
|
|
args.each do |arg|
|
|
if arg != command ## Make sure we don't use the command as a vmid
|
|
if @controller.exists?(arg)
|
|
if @controller.running?(arg)
|
|
print_line "Running command '" + command + "' on lab vm '" + arg + "'."
|
|
@controller.run_command_on_lab_vm(arg, command)
|
|
else
|
|
print_error "Lab vm '" + arg + "' " + "not running."
|
|
end
|
|
else
|
|
print_error "Unknown lab vm '" + arg + "'."
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# hlp_print_lab_running
|
|
end
|
|
|
|
def cmd_lab_browse_to(*args)
|
|
return lab_usage if args.empty?
|
|
|
|
uri = args[args.count-1] ## where's that final argument, that's our command, boiiii
|
|
|
|
if args[0] == "all"
|
|
print_line "Browsing to uri '" + url + "' on all running lab vms.\n"
|
|
@controller.run_command_on_lab(args[1])
|
|
else
|
|
args.each do |arg|
|
|
if arg != uri ## Make sure we don't use the uri as a vmid
|
|
if @controller.exists?(arg)
|
|
if @controller.running?(arg)
|
|
@controller.run_browser_on_lab_vm(arg,uri)
|
|
else
|
|
print_error "Lab vm '" + arg + "' " + "not running."
|
|
end
|
|
else
|
|
print_error "Unknown lab vm '" + arg + "'."
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# hlp_print_lab_running
|
|
end
|
|
|
|
##
|
|
## Commands for dealing with a target map
|
|
##
|
|
|
|
|
|
def cmd_target_map_show(*args)
|
|
hlp_print_targets
|
|
end
|
|
|
|
def cmd_target_map_load(*args)
|
|
## Set up a mapping of exploits -> vms
|
|
default_target_map_file = args[0]
|
|
@target_map = YAML::load_file(default_target_map_file)
|
|
hlp_print_targets
|
|
end
|
|
|
|
def cmd_target_map_unload(*args)
|
|
@target_map = {}
|
|
hlp_print_targets
|
|
end
|
|
|
|
def cmd_target_map_save(*args)
|
|
File.open(args[0], 'w') {|f| f.write(@target_map.to_yaml) }
|
|
hlp_print_targets
|
|
end
|
|
|
|
|
|
## Commands for dealing with targets for a loaded
|
|
|
|
def cmd_targets_show(*args)
|
|
if (not active_module) then
|
|
print_error "No active module. Try 'use [modulename]' first."
|
|
return nil
|
|
end
|
|
|
|
hlp_print_targets(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_add(*args)
|
|
if (not active_module) then
|
|
print_error "No active module. Try 'use [modulename]' first."
|
|
return nil
|
|
end
|
|
|
|
if args[0]
|
|
if @controller.exists?(args[0])
|
|
if @target_map == {}
|
|
@target_map[active_module.fullname] = []
|
|
@target_map[active_module.fullname] << args[0]
|
|
else
|
|
@target_map[active_module.fullname] << args[0]
|
|
end
|
|
else
|
|
print_error "VM: '" + "' doesn't exist in this lab."
|
|
end
|
|
end
|
|
|
|
hlp_print_targets(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_remove(*args)
|
|
if (not active_module) then
|
|
print_error "No active module. Try 'use [modulename]' first."
|
|
return nil
|
|
end
|
|
|
|
if args[0]
|
|
if @controller.exists?(args[0])
|
|
@target_map[active_module.fullname].delete(args[0])
|
|
else
|
|
print_error "VM: '" + "' doesn't exist in this lab."
|
|
end
|
|
end
|
|
|
|
hlp_print_targets(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_start(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
@target_map[active_module.fullname].each { |target| @controller.start_lab_vm(target) }
|
|
|
|
hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_stop(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
@target_map[active_module.fullname].each { |target| @controller.stop_lab_vm(target) }
|
|
|
|
hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_reset(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
@target_map[active_module.fullname].each { |target| @controller.reset_lab_vm(target) }
|
|
|
|
hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_suspend(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
@target_map[active_module.fullname].each { |target| @controller.suspend_lab_vm(target) }
|
|
|
|
hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
|
|
def cmd_targets_snapshot(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
if args[0]
|
|
@target_map[active_module.fullname].each { |target| @controller.snapshot_lab_vm(target, args[0]) }
|
|
else
|
|
print_error "Please enter a snapshot name."
|
|
end
|
|
|
|
hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
def cmd_targets_revert(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
if args[0]
|
|
@target_map[active_module.fullname].each { |target| @controller.revert_lab_vm(target, args[0]) }
|
|
else
|
|
print_error "Please enter a snapshot name."
|
|
end
|
|
|
|
hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
|
|
##
|
|
## This stuff needs a lot more thought before it should be exposed
|
|
##
|
|
def cmd_targets_exploit(*args)
|
|
if (not active_module) then
|
|
print_error "No active module selected. Please select a module first."
|
|
return nil
|
|
end
|
|
|
|
if @target_map
|
|
@target_map[active_module.fullname].each do |target|
|
|
|
|
## auto start targets that aren't running
|
|
if !@controller.running?(target)
|
|
print_status target + " isn't running, starting it for you :)"
|
|
@controller.start_lab_vm(target)
|
|
print_status "I'll hang out for a second while it gets going. Note, this value may need tweaking if you've got a slow box."
|
|
sleep 20 ##resonable default? Guess?
|
|
end
|
|
|
|
hostname = @controller.labdef[target]['hostname']
|
|
username = @controller.labdef[target]['username']
|
|
password = @controller.labdef[target]['password']
|
|
os = @controller.labdef[target]['os']
|
|
#x64 = @controller.labdef[target]['x64']
|
|
|
|
active_module.datastore["RHOST"] = hostname
|
|
|
|
### G.H.E.TT.O.
|
|
if os == "windows"
|
|
active_module.datastore["PAYLOAD"] = "windows/meterpreter/bind_tcp"
|
|
elsif os == "linux"
|
|
active_module.datastore["PAYLOAD"] = "cmd/unix/bind_perl"
|
|
else
|
|
active_module.datastore["PAYLOAD"] = "windows/meterpreter/bind_tcp"
|
|
print_error "Unknown OS, please set it in the lab. Guessing windows."
|
|
end
|
|
|
|
|
|
### Hmm, this is good for demo purposes, but how do we abstract this
|
|
if active_module.fullname == "windows/smb/psexec"
|
|
active_module.datastore["SMBUser"] = username
|
|
active_module.datastore["SMBPass"] = password
|
|
end
|
|
|
|
active_module.exploit
|
|
|
|
### Now, our on-session handler should handle this
|
|
end
|
|
else
|
|
print_error "No target map found. Something went wrong. Try loading a ne"
|
|
end
|
|
|
|
# hlp_print_targets_running(active_module.fullname)
|
|
end
|
|
|
|
|
|
def cmd_targets_clear(*args)
|
|
if (not active_module) then
|
|
print_error "No active module. Try 'use [modulename]' first."
|
|
return nil
|
|
end
|
|
|
|
@target_map[active_module.fullname] = {}
|
|
|
|
hlp_print_targets(active_module.fullname)
|
|
end
|
|
|
|
|
|
private
|
|
def hlp_print_lab
|
|
indent = ' '
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Header' => 'Available Lab VMs',
|
|
'Indent' => indent.length,
|
|
'Columns' => [ 'vmid', 'file', "powered on" ]
|
|
)
|
|
|
|
@controller.labdef.each do |key, value|
|
|
tbl << [ key,
|
|
@controller.get_full_path(key),
|
|
@controller.running?(key)]
|
|
end
|
|
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def hlp_print_lab_running
|
|
indent = ' '
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Header' => 'Running Lab VMs',
|
|
'Indent' => indent.length,
|
|
'Columns' => [ 'vmid', 'file', 'powered on' ]
|
|
)
|
|
|
|
@controller.labdef.each do |key, value|
|
|
if @controller.running?(key)
|
|
tbl << [ key,
|
|
@controller.get_full_path(key),
|
|
true]
|
|
end
|
|
end
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def hlp_print_targets(mod_id=nil)
|
|
indent = ' '
|
|
|
|
if @target_map[mod_id]
|
|
begin
|
|
if mod_id
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Header' => 'Mapped Targets for ' + mod_id,
|
|
'Indent' => indent.length,
|
|
'Columns' => [ 'vmid', 'file', "powered on" ]
|
|
)
|
|
|
|
@target_map[mod_id].each do |target|
|
|
tbl << [ target.to_s,
|
|
@controller.get_full_path(target),
|
|
@controller.running?(target)]
|
|
end
|
|
else
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Header' => 'All Mapped Targets',
|
|
'Indent' => indent.length,
|
|
'Columns' => [ 'module', 'vmid', 'file', "powered on" ]
|
|
)
|
|
|
|
@target_map.each do |key, value|
|
|
value.each do |target|
|
|
|
|
tbl << [ key.to_s,
|
|
target.to_s,
|
|
@controller.get_full_path(target.to_s),
|
|
@controller.running?(target.to_s)]
|
|
end
|
|
end
|
|
end
|
|
rescue Exception => e
|
|
end
|
|
|
|
else
|
|
print_error "No target map"
|
|
end
|
|
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
def hlp_print_targets_running(mod_id = nil)
|
|
indent = ' '
|
|
|
|
begin
|
|
if @target_map
|
|
if mod_id
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Header' => 'Running Targets for ' + mod_id,
|
|
'Indent' => indent.length,
|
|
'Columns' => [ 'vmid', 'file', "powered on" ]
|
|
)
|
|
|
|
@target_map[mod_id].each do |target|
|
|
tbl << [ target.to_s,
|
|
@controller.get_full_path(target),
|
|
@controller.running?(target)]
|
|
end
|
|
else
|
|
|
|
tbl = Rex::Ui::Text::Table.new(
|
|
'Header' => 'All Running Targets',
|
|
'Indent' => indent.length,
|
|
'Columns' => [ 'module', 'vmid', 'file', "powered on" ]
|
|
)
|
|
|
|
@target_map.each do |key, value|
|
|
value.each do |target|
|
|
if @controller.running?(target)
|
|
tbl << [ key.to_s,
|
|
target.to_s,
|
|
@controller.get_full_path(target),
|
|
true]
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
rescue Exception => e
|
|
end
|
|
print_line tbl.to_s
|
|
end
|
|
|
|
end
|
|
|
|
#
|
|
# The constructor is called when an instance of the plugin is created. The
|
|
# framework instance that the plugin is being associated with is passed in
|
|
# the framework parameter. Plugins should call the parent constructor when
|
|
# inheriting from Msf::Plugin to ensure that the framework attribute on
|
|
# their instance gets set.
|
|
#
|
|
def initialize(framework, opts)
|
|
super
|
|
|
|
#self.framework.events.add_session_subscriber(self)
|
|
|
|
## Register the commands above
|
|
console_dispatcher = add_console_dispatcher(LabCommandDispatcher)
|
|
|
|
## Set up a lab here. Note that we're going directly to the controller, so all data's gonna
|
|
## have to get stored here, and not in a separate lab class (probably the right way to do)
|
|
#default_lab_file = File.join(File.dirname(__FILE__), "..", "data", "lab", "test_lab.yml" )
|
|
#labdef = YAML::load_file(default_lab_file)
|
|
|
|
labdef = {}
|
|
|
|
@lab_controller = LabController.new(labdef)
|
|
|
|
## Set up a mapping of exploits -> vms
|
|
## default_target_map_file = File.join(File.dirname(__FILE__), "..", "data", "lab", "test_targets.yml" )
|
|
|
|
|
|
#@lab_target_map = YAML::load_file(default_target_map_file)
|
|
@lab_target_map = {}
|
|
|
|
## Share the controller & target map with the console_dispatcher
|
|
console_dispatcher.controller = @lab_controller
|
|
console_dispatcher.target_map = @lab_target_map
|
|
|
|
## Great Success!
|
|
|
|
end
|
|
|
|
|
|
#
|
|
# The cleanup routine for plugins gives them a chance to undo any actions
|
|
# they may have done to the framework. For instance, if a console
|
|
# dispatcher was added, then it should be removed in the cleanup routine.
|
|
#
|
|
def cleanup
|
|
# If we had previously registered a console dispatcher with the console,
|
|
# deregister it now.
|
|
remove_console_dispatcher('Lab')
|
|
end
|
|
|
|
#
|
|
# This method returns a short, friendly name for the plugin.
|
|
#
|
|
def name
|
|
"lab"
|
|
end
|
|
|
|
#
|
|
# This method returns a brief description of the plugin. It should be no
|
|
# more than 60 characters, but there are no hard limits.
|
|
#
|
|
def desc
|
|
"Adds the ability to manage vms and targets"
|
|
end
|
|
|
|
#def on_session_open(session)
|
|
|
|
#return if not session.type == 'meterpreter'
|
|
#session.load_stdapi
|
|
#sb = Rex::Socket::SwitchBoard.instance
|
|
#session.net.config.each_route { |route|
|
|
# # Remove multicast and loopback interfaces
|
|
# next if route.subnet =~ /^(224\.|127\.)/
|
|
# next if route.subnet == '0.0.0.0'
|
|
# next if route.netmask == '255.255.255.255'
|
|
# if not sb.route_exists?(route.subnet, route.netmask)
|
|
# print_status("AutoAddRoute: Routing new subnet #{route.subnet}/#{route.netmask} through session #{session.sid}")
|
|
# sb.add_route(route.subnet, route.netmask, session)
|
|
# end
|
|
#}
|
|
|
|
#end
|
|
end ## End Class
|
|
end ## End Module
|