Class: MigrateCredData

Inherits:
ActiveRecord::Migration
  • Object
show all
Defined in:
db/migrate/20100819123300_migrate_cred_data.rb

Class Method Summary collapse

Class Method Details

.down ⇒ Object

Raises:

  • (ActiveRecord::IrreversibleMigration) 


149
150
151
 
# File 'db/migrate/20100819123300_migrate_cred_data.rb', line 149

def self.down
  raise ActiveRecord::IrreversibleMigration
end

.up ⇒ Object 



3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
 
# File 'db/migrate/20100819123300_migrate_cred_data.rb', line 3

def self.up
  begin # Wrap the whole thing in a giant rescue.
  skipped_notes = []
  new_creds = []
  Mdm::Note.find(:all).each do |note|
    next unless note.ntype[/^auth\.(.*)/]
    service_name = $1
    if !service_name
      skipped_notes << note
      next
    end
    if note.host and note.host.respond_to?(:address)
      if note.service
        svc_id = note.service.id
      else
        candidate_services = []
        note.host.services.each do |service|
          if service.name == service_name
            candidate_services << service
          end
        end
        # Use the default port, or the first port that matches the protocol name.
        default_port = case service_name.downcase
          when 'ftp'; 21
          when /^smb/; 445
          when /^imap/; 143
          when 'telnet'; 23
          when 'pop3'; 110
          when 'http','domino','axis','wordpress','tomcat'; 80
          when 'tns'; 1521
          when 'snmp'; 161
          when 'mssql'; 1433
          when 'ssh'; 22
          when 'https'; 443
          when 'mysql'; 3306
          when 'db2'; 50000
          when 'postgres'; 5432
          else nil
        end
        if !default_port
          skipped_notes << note
          next
        end
        if candidate_services.size == 1
          svc_id = candidate_services.first.id
        elsif candidate_services.empty?
          Mdm::Service.new do |svc|
            svc.host_id = note.host.id
            svc.port = default_port
            svc.proto = 'tcp'
            svc.state = 'open'
            svc.name = service_name.downcase
            svc.save!
            svc_id = svc.id
          end
        elsif candidate_services.size > 1
          svc_ports = candidate_services.map{|s| s.port}
          if svc_ports.index(default_port)
            svc_id = candidate_services[svc_ports.index(default_port)].id
          else
            svc_id = candidate_services.first.id
          end
        end
      end
    else
      skipped_notes << note
      next
    end
    if note.data[:hash]
      ptype = 'smb_hash'
      pass = note.data[:hash]
    elsif note.data[:ssh_key]
      ptype = 'ssh_key'
      pass = note.data[:extra]
    else
      ptype = 'password'
      pass = note.data[:pass]
    end
    # Format domains and databases into the usernames.
    if note.ntype == "auth.smb_challenge"
      domain = note.data[:extra].match(/DOMAIN=([^\s]+)/)[1]
      if domain
        user = [domain, note.data[:user]].join("/")
      else
        user = note.data[:user]
      end
    elsif note.ntype =~ /auth\.(postgres|db2)/
      if note.data[:database]
        user = [note.data[:database], note.data[:user]].join("/")
      else
        user = note.data[:user]
      end
    else
      user = note.data[:user]
    end
    # Not actually a credentials, convert to migrated notes
    if service_name == 'smb' && note.data[:token]
      skipped_notes << note
      next
    end
    if service_name == 'tns' && note.data[:type] == "bruteforced_sid"
      skipped_notes << note
      next
    end
    # Special case for the bizarre reporting for aux/admin/oracle/oracle_login
    if service_name == 'tns' && note.data[:type] == "bruteforced_account"
      note.data[:data] =~ /([^\x2f]+)\x2f([^\s]+).*with sid (.*)/
      user = "#{$3}/#{$1}"
      pass = $2
    end
    new_creds << [svc_id, ptype, user, pass]
  end

  say "Migrating #{new_creds.size} credentials."
  new_creds.uniq.each do |note|
    Mdm::Cred.new do |cred|
      cred.service_id = note[0]
      cred.user = note[2]
      cred.pass = note[3]
      cred.ptype = note[1]
      cred.save!
    end
  end

  say "Migrating #{skipped_notes.size} notes."
  skipped_notes.uniq.each do |note|
    Mdm::Note.new do |new_note|
      new_note.host_id = note.host_id
      new_note.ntype = "migrated_auth"
      new_note.data = note.data.merge(:migrated_auth_type => note.ntype)
      new_note.save!
    end
  end

  say "Deleting migrated auth notes."
  Mdm::Note.find(:all).each do |note|
    next unless note.ntype[/^auth\.(.*)/]
    note.delete
  end
  rescue 
    say "There was a problem migrating auth credentials. Skipping."
    return true # Never fail!
  end
end