Class: OffensiveComputing::MalwareSearch

Inherits:
Object
  • Object
show all
Defined in:
lib/offensivecomputing/offensivecomputing.rb

Constant Summary collapse

@@baseurl = 
"http://www.offensivecomputing.net"
@@user_agent = 
"Ruby/#{RUBY_VERSION} offensivecomputing rubygem (https://github.com/chrislee35/offensivecomputing)"

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(username, password) ⇒ MalwareSearch

Returns a new instance of MalwareSearch.



11
12
13
14
15
16
17
18
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 11

def initialize(username, password)
  # login and get a cookie
  # handle failures
  params = {'edit[name]' => username, 'edit[pass]' => password, 'edit[form_id]' => 'user_login_block'}
  @cookie = nil
  @referer = @@baseurl
  _post("?q=node&destination=node&op=Log+in", params)
end

Instance Attribute Details

Returns the value of attribute cookie.



10
11
12
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 10

def cookie
  @cookie
end

Instance Method Details

#_get(path, params = nil) ⇒ Object 



48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 48

def _get(path, params=nil)
  url = URI.parse "#{@@baseurl}/#{path}"
  data = nil
  path = url.path
  if params and params.length > 0
    data = params.map { |k,v|
      "#{k}=#{v}".gsub(/([^ a-zA-Z0-9_.-=]+)/) do
        '%' + $1.unpack('H2' * $1.bytesize).join('%').upcase
      end.tr(' ', '+')
    }.join("&")
  end
  if data and url.query
    path += "?#{url.query}&#{data}"
  elsif data
    path += "?#{data}"
  elsif url.query
    path += "?#{url.query}"
  end
  request = Net::HTTP::Get.new(path)
  _request(request, url)
end

#_post(path, params = nil) ⇒ Object 



36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 36

def _post(path, params=nil)
  url = URI.parse "#{@@baseurl}/#{path}"
  path = url.path
  if url.query
    path += "?"+url.query
  end
  #puts path
  request = Net::HTTP::Post.new(path)
  request.set_form_data(params) if params
  _request(request, url)
end

#_request(request, url) ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 20

def _request(request, url)
  request.add_field("User-Agent", @@user_agent)
  request.add_field("Referer", @referer)
  request.add_field("Cookie", @cookie) if @cookie

  http = Net::HTTP.new(url.host, url.port)
  if url.scheme == 'https'
    http.use_ssl = true
    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
    http.verify_depth = 5
  end
  resp = http.request(request)
  @cookie = resp.header["set-cookie"].split(/[,; ]+/).find_all{|x| x=~ /PHPSESSID/}.last if resp.header["set-cookie"]
  resp.body
end

#download(malwareresult, filename = nil) ⇒ Object 



137
138
139
140
141
142
143
144
145
146
147
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 137

def download(malwareresult,filename=nil)
  if malwareresult.respond_to? :dlurl and malwareresult.dlurl
    doc = _get(malwareresult.dlurl)
    if filename
      File.open(filename,'w') do |f|
        f.write(doc)
      end
    end
    doc
  end
end

#search(hash) ⇒ Object 



70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'lib/offensivecomputing/offensivecomputing.rb', line 70

def search(hash)
  params = {'search'=>hash} # 'slowsearch'=>'on'
  body = _post('?q=ocsearch', params)
  records = []
  table = body.match(/<\!\-\- begin content.*?<\!\-\- end content \-\->/).to_s
  if table
    urls = table.scan(/download[^\"]+/)
    arr = table.gsub(/<.*?>/,"\t").gsub(/\s*\t+/,"\t").split(/\t/)
    #pp arr
    field = nil
    rec = {}
    avname = nil
    arr.each do |item|
      if item == "infected"
        records << MalwareResult.new(rec[:md5],rec[:sha1],rec[:sha256],rec[:filename],rec[:added],rec[:magic],rec[:packer],rec[:avresults],rec[:tags],rec[:dlurl], self)
      elsif item == "MD5:"
        field = :md5
      elsif item == "SHA1:"
        field = :sha1
      elsif item == "SHA256:"
        field = :sha256
      elsif item == "Original Submitted Filename:"
        field = :filename
      elsif item == "Date Added:"
        field = :added
      elsif item == "Magic File Type:"
        field = :magic
      elsif item == "Packer Signature:"
        field = :packer
      elsif item == "Anti-Virus Results:"
        field = :avresults
      elsif item == "Tags:"
        field = :tags
      elsif item == "Add a tag:"
        field = nil
      elsif item == "Download Sample"
        rec[:dlurl] = urls.shift
      elsif field == :md5 and item =~ /^[0-9a-f]{32}$/
        rec[field] = item
      elsif field == :sha1 and item =~ /^[0-9a-f]{40}$/
        rec[field] = item
      elsif field == :sha256 and item =~ /^[0-9a-f]{64}$/
        rec[field] = item
      elsif field == :filename
        rec[field] = item
      elsif field == :added and item =~ /^\d{4}\-\d{2}\-\d{2}/
        rec[field] = Time.parse("#{item} +0000").utc
      elsif field == :magic
        rec[field] = item
      elsif field == :avresults
        #puts "DEBUG: avresults #{item}"
        rec[field] = [] unless rec[field]
        if avname
          rec[field] << AVResult.new(avname,item)
          avname = nil
        else
          avname = item
        end
      elsif field == :tags
        rec[field] = [] unless rec[field]
        rec[field] << item
      end
    end
  end
  records
end