exploitmanager.py

#! /usr/bin/env python

#Proprietary CANVAS source code - use only under the license agreement
#specified in LICENSE.txt in your CANVAS distribution
#Copyright Immunity, Inc, 2002-2006
#http://www.immunityinc.com/CANVAS/ for more information

"""
exploitmanager.py - operates a thread and manages an exploit for the engine
"""

import sys
import time
from threading import Thread
from internal import *
import socket

from StringIO import StringIO
import logging

#list of exploits to not add to knowledge tree
ignorelist=["CANVAS Exploit"]

class exploitmanager(Thread):
    """
    Runs in its own thread so the exploit doesn't have to
    handles teardown of the exploits globally, setting the progressbar
    and any other variables that need to be set, such as state
    """
    def __init__(self,exploit,engine, daemonFlag=None):
        Thread.__init__(self, verbose=debug_threads)
        self.runcrashtest=0 #by default we do not run our crash test
        self.exploit=exploit
        self.engine=engine
        self.listLog=None

        #initialize this for reporting later
        self.newnode = None

        # XXX: do not re-init self.prompt if we want to have randomisation ;)
        # switched from self.prompt to self.localPrompt
        self.localPrompt = "(CANVAS)"

        # do we really need this ?
        if not hasattr(self.exploit, 'shutdown'):
            self.setDaemon(1) # XXX should not be used if we use threadutils_add()

        # XXX: we want to be able to force a daemonFlag for the threading
        # XXX: if isDaemon() is True for SILICA context runs (the above code sets it true)
        # XXX: then run() never gets inited

        if daemonFlag in [True, False]:
            self.setDaemon(daemonFlag)

        threadutils_add(self)
        self.name = "CANVAS Exploit"
        if hasattr(self.exploit, 'name'):
            self.name = self.exploit.name
        devlog('exploitmanager::__init__', "initialized")
        self.exploit.setInfo("%s" % self.name)
        self.ret=None #return value from exploit
        self.newnode=None
        #We wait many minutes here for a node to start up
        #largely because SILICA takes that long
        #exploits should NOT return 1 unless successfully starting a new node on Silica
        if hasattr(self.engine, "silica") and self.engine.silica:
            self.waitfornewnode=60*20 #after an exploit has finished, we wait this long for a new node to startup()
        else:
            self.waitfornewnode=60*2 #two minutes by default otherwise
        self.state="Running"

    def getprompt(self):
        if hasattr(self.exploit, 'argsDict') and self.exploit.argsDict.has_key('passednodes'):
            node = self.exploit.argsDict['passednodes'][0]
            if hasattr(node, 'shell') and hasattr(node.shell, 'getprompt') and \
                node.shell.getprompt != getattr(self, 'getprompt'):
                return node.shell.getprompt(self.localPrompt)
            if hasattr(node, 'getprompt') and node.getprompt != getattr(self, 'getprompt'):
                return node.getprompt(self.localPrompt)
        return self.localPrompt + ' '

    def listener_log(self,log):
        self.listLog = log

    def test(self):
        """
        This code runs the exploit's test function and then using that information
        will start up a listener of the correct type
        """
        devlog('exploitmanager', "exploitmanager::test()")
        app=self.exploit

        # msrpcexploit is buggy when we call app.test() with a version != 0
        # because version selection is coupled with testing which should obviously
        # never be the case
        ret = False
        if hasattr(app, 'version') and app.version == 0:
            #app.test() will set the version, and possibly the neededListenerTypes()
            ret=app.test()
            if ret:
                #if test succeeded, we then can do our crashtest()
                self.runcrashtest=1

        # make sure we update the argsdict
        app.argsDict["version"] = app.version
        sys.stdout.flush()

        #this code is duplicated in canvasengine, be careful
        neededlistenertypes=app.neededListenerTypes()

        if neededlistenertypes!=[]:
            devlog("exploitmanager", "Exploit wants %s listener"%neededlistenertypes)

            # XXX fix for autofind control needed in httpserver (and likewise) situations
            # XXX where app.target.interface != actual wanted matching callback for autofind

            autoFind = True
            if hasattr(app, 'autoFind'):
                autoFind = app.autoFind

            devlog("canvasengine", "Doing autolistener from exploitmanager:test()")

            # check for http proxy port control from httpserver
            if 'HTTPPROXYPORT' in app.listenerArgsDict:
                HTTPPROXYPORT = int(app.listenerArgsDict['HTTPPROXYPORT'])
            else:
                HTTPPROXYPORT = 0

            target_ip = app.target.interface
            listener=self.engine.autoListener(app, neededlistenertypes[0],\
                                              target_ip,\
                                              autoFind=autoFind,\
                                              HTTPPROXYPORT=HTTPPROXYPORT)

            if listener==None: #still none? Then print error message
                self.engine.log("You need to select a valid listener %s for this exploit!" % \
                    (app.neededListenerTypes()))
                return 0
            #print "Setting listener %s argsdict to %s"%(listener, app.listenerArgsDict)
            #don't use argsDict for UNIVERSAL Listeners, as they are not held to one exploit only!
            from canvasengine import UNIVERSAL_MOSDEF
            if listener.type!=UNIVERSAL_MOSDEF:
                listener.argsDict=app.listenerArgsDict
        else:
            devlog("exploitmanager","No need for a listener for this exploit")
            listener=None
        devlog("exploitmanager","Setting app.callback to %s"%listener)
        app.callback=listener #note: this is a listener, not an interface!
        if app.callback and not app.callback.type==UNIVERSAL_MOSDEF:
            #clear this so we can know if we succeeded
            #universal listeners don't have a lastnewnode.
            app.callback.lastnewnode=None
        return ret

    def _return_from_run(self, retval):
        threadutils_exiting(self)
        return retval

    def run(self):
        """
        Run the exploit...called from Thread.start()
        """
        devlog('exploitmanager', "Exploitmanager running")
        self.exploit.dispshellcmd = None

        self.report_started(self.exploit)

        #self.test() is not called by the engine before getting into here. We do
        #it manually
        if 1:
            try:
                self.runcrashtest=True
                if not self.test():
                    self.runcrashtest=False
                    #possible we were meant to be at 0
                    pass
                    #self.exploit.log("Testing failed!")
                    #return 0
            except AttributeError:
                # exploit doesn't have a version
                pass

        callback=self.exploit.callback
        devlog("exploitmanager", "Set callback to %s"%callback)
        #so he knows who to inform when successful
        #In the case of universal listeners this is a bit different...
        from canvasengine import UNIVERSAL_MOSDEF
        if callback and callback.type != UNIVERSAL_MOSDEF:
            devlog('exploitmanager',"Setting callback's current_exploit")
            callback.current_exploit=self.exploit
            callback.busy=1

        target=self.exploit.target

        #removed temporarally
        if False and (self.exploit.version==0):
            #didn't we already do this?
            devlog('exploitmanager', "Exploit testing")
            if self.test():
                self.runcrashtest=1

        try:
            devlog('exploitmanager', "Exploit create shellcode")
            self.exploit.createShellcode()
        except:
            #error in creating shellcode
            import traceback
            import sys
            logging.error("Error in %s" % self.exploit.name)
            traceback.print_exc(sys.stdout)
            return self._return_from_run(0)

        #so he knows who to inform when successful
        if callback and callback.type != UNIVERSAL_MOSDEF:
            callback.current_exploit=self.exploit
            callback.busy=1
            #now we need to unset lastnewnode
            callback.lastnewnode=None

        ret = 0

        #
        # this is in order to replicate the same functionality of the old logging
        # mechanism with self.loggedInformation displayed in module_log_window
        #
        # We have to put this here and not in canvasexploit because of the way
        # we currently run modules, which is not through a standard manager
        #
        root = logging.getLogger()

        self.exploit.log_capture_io = StringIO()
        self.exploit.sh = logging.StreamHandler(self.exploit.log_capture_io)
        self.exploit.sh.setLevel(logging.INFO)

        f = logging.Formatter("%(asctime)s [%(filename)24s] - %(levelname)s - %(message)s")

        self.exploit.sh.setFormatter(f)
        root.addHandler(self.exploit.sh)

        try:
            devlog('exploitmanager', "Exploit running")

            ret = self.exploit.run()

            devlog('exploitmanager', "self.exploit.run() returned %s" % ret)
        except self.exploit.error,msg:
            import traceback
            import sys
            traceback.print_exc(file=sys.stdout)
            self.exploit.log("Failed: %s" % str(msg))
        except:
            from exploitutils import bugreport
            bugreport()
            import sys,traceback,string
            s=StringIO()
            traceback.print_exc(file=s)
            s.seek(0)
            self.exploit.debuglog("=-=-=- Traceback -=-=-=\n" +string.join(s.readlines(), ""))
            info=sys.exc_info()
            # do we print traceback here?
            self.exploit.log("Failed (%s):  %s" % (str(info[0]), str(info[1])))

        self.ret = ret #set our state to match that of the exploit
        devlog("exploitmanager", "Exploit %s returned %s"%(self.exploit.name,ret))

        self.report_returned(self.exploit, ret)

        if ret in [0,None,-1]:
            #Exploit failed...
            self.exploit.setProgress(-1)

            if self.runcrashtest:
                self.exploit.check_crashed() #check to see if it died...
            if self.exploit.target:
                #we first assume the target is a host object, as it normally is
                try:
                    self.exploit.target.add_knowledge("Not Vuln To", self.exploit.name,0)
                except AttributeError:
                    #try this, although it's not perfect, if you passed in a string as self.exploit.target
                    #we try to get the node you are using
                    node=self.exploit.argsDict["passednodes"][0]
                    try:
                        #and hopefully it has a target with that ip
                        target=node.get_known_host(self.exploit.target)
                        if target:
                            #if so, we'll add the knowlege,hoping it was correct :>
                            target.add_knowledge("Not Vuln To", self.exploit.name,0)
                    except:
                        pass
        else:
            #exploit succeeded - it either returned a new node or it returned 1
            self.exploit.setProgress(100)

            if type(ret) == str:
                devlog("exploitmanager", "Exploit has no node it just returns us the value we need")

            elif ret!=1:
                if type(ret) in [type(1), type(1L)]:
                    devlog("exploitmanager","Warning: exploit returned an integer that was neither 0 nor 1! %s"%type(ret))

                #must have returned a new node...
                self.newnode=ret
                #exploits are responsible for setting the parent node!
                ret.startup() #get the interfaces and whatnot.

                #startup=self.engine.getModuleExploit("startup")
                #startup.link(self)
                #argsDict={}
                #argsDict["host"]=self.exploit.target
                #argsDict["passednodes"]=[ret]
                #startup.argsDict=argsDict
                #startup.run()

                if ret.parentnode==None:
                    self.exploit.log("THIS EXPLOIT HAS A BUG: did not properly set parentnode")
                else:
                    ret.parentnode.newNode(ret)
                    ret.update_gui()
                app=self.exploit
                self.engine.newNode(ret, app)
                devlog('exploitmanager', "Stole socket: Calling the postactions handlers on the new node!")
                self.engine.do_post_actions(ret, app)

            else:
                #Fixed, see below
                #The CANVAS engine will inform the exploit that it has succeeded before
                #it has initialized the new Node. So we reach this point in our code
                #and the new node is still initializing ... future actions should
                #get caught by the new node's startup() though. So we should be ok.

                #ret WAS a 1, indicating success. Now we need to see if
                #there is a listener that connected back to us
                devlog('exploitmanager', "Exploit returned success but did not steal the socket")
                if self.exploit.callback:
                    devlog('exploitmanager', "Exploit has a callback, as it probably should")
                    self.engine.log("Exploitmanager: waiting %d seconds for our new node from an exploit" % self.waitfornewnode)

                    # XXX: This is horrible hack to get the node for a
                    # successful exploit run from a given listener.

                    # Whatever was here previously was horribly broken in the
                    # context of massattack2 as it would check
                    # self.exploit.callback.lastnewnode which could be shared
                    # amongst threads and continuously overwritten

                    # Right now, we depend on canvasengine updating
                    # self.callback.totalnodes list.

                    # A better solution would be to rewrite this whole mess
                    # using async queues which i will do once i have a better
                    # understanding of it.

                    # chris: i assume target.interface will always be an ip
                    # let me know if this is wrong
                    ip   = self.exploit.target.interface

                    # if our target is the current node, we want a node's ip
                    if ip == '127.0.0.1':
                        ips  = [x.get_interesting_interface()
                            for x in self.exploit.argsDict['passednodes']]
                    else:
                        ips = [ip]

                    node = None

                    for i in xrange(self.waitfornewnode):
                        devlog('exploitmanager', 'polling for new node: %s in %s' % (ips,
                            [x.get_interesting_interface() for x in self.exploit.callback.totalnodes]))

                        res = [x for x in self.exploit.callback.totalnodes
                               if x.get_interesting_interface() in ips]
                        if res:
                            node = res[0]
                            break
                        time.sleep(1)

                    if node:
                        # XXX: Citrix NetScaler Keep-Alive temporary fix
                        if self.exploit.name == 'netscaler_traversal_rce':
                            logging.warning('Enabling Keep-Alive for Citrix')
                            node.shell.connection.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
                            node.shell.connection.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 1)
                            node.shell.connection.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 10)
                            node.shell.connection.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 5)

                        self.newnode = node
                        devlog('exploitmanager', "Calling the postactions handlers on the new node!")
                        self.engine.do_post_actions(self.newnode, self.exploit)
                    else:
                        devlog('exploitmanager', "Callback did not have a lastnewnode!?")

            if self.exploit.name not in ignorelist:
                if self.exploit.target:
                    self.exploit.target.add_knowledge("Vuln To", self.exploit.name,100)

        #
        # In order to avoid breaking compatibility, we introduce a new cleanup
        # post-exploitation phase rather than reusing engine.do_post_actions
        # (do_post_actions is only executed in case of failure or new node while
        #  the cleanup phase must be always executed, if requested)
        #
        if len(self.exploit.cleanup_files):
            self.exploit.perform_cleanup()

        if hasattr(self.exploit, "summary") and len(self.exploit.summary):
            logging.info("Summary for %s" % self.exploit.name)
            for n in self.exploit.argsDict['passednodes']:
                if n not in self.exploit.summary:
                    continue

                if self.exploit.summary[n] == 1:
                    logging.warning("%s [%s]: Success" % (self.exploit.name, n))
                else:
                    logging.error("%s [%s]: Fail" % (self.exploit.name, n))

        # Close and remove logging StreamHandler
        self.exploit.sh.close()
        root.removeHandler(self.exploit.sh)

        self.exploit.setState("done")
        self.report_finished(self.exploit, self.newnode)

        if self.listLog != None:
            if self.exploit.dispshellcmd:
                dispshellcmd = self.getprompt() + self.exploit.dispshellcmd
            else:
                dispshellcmd = self.getprompt() + self.exploit.name
            self.engine.gui.gui_queue_append("shellwindow log", [self.listLog, dispshellcmd + "\n"])
            result=self.exploit.result
            if type(result)!=type(u''):
                result=str(result)
            self.engine.gui.gui_queue_append("shellwindow log", [self.listLog, result+"\n"])


        if callback and callback.type != UNIVERSAL_MOSDEF:
            callback.current_exploit=None
            callback.busy=0

        if self.exploit.target:
            try:
                self.exploit.target.update_gui()
            except AttributeError:
                #it was probably a string of some kind
                try:
                    #give it a shot if we got it correctly upstairs :>
                    target.update_gui()
                except:
                    #I guess not. :<
                    pass
        self.state="Done"

        devlog('exploitmanager', "Return from run: %s" % ret)
        if type(ret) == str:
            return ret

        return self._return_from_run(ret)

    def report_started(self, exploit):
        from ExploitTypes.localcommand import LocalCommand
        from ExploitTypes.localexploit import LocalExploit
        from ExploitTypes.utility import Utility

        arguments = {}
        for key, value in exploit.argsDict.iteritems():
            if key not in ['passednodes']:
                arguments[key] = str(value)

        nodes = [self._report_get_node_data(n)
            for n in exploit.argsDict['passednodes']]

        if isinstance(exploit, (LocalCommand, LocalExploit)):
            module_type = 'local'
        elif isinstance(exploit, Utility):
            module_type = 'utility'
        else:
            module_type = 'remote'

        data = {
            'name'        : exploit.module_name,
            'id'          : exploit.id,
            'parent id'   : getattr(exploit.parent, 'id', None),
            'target'      : exploit.target.interface if exploit.target else None,
            'fromnodes'   : nodes,
            'arguments'   : arguments,
            'type'        : module_type,
            'callback'    : str(exploit.callback) if exploit.callback else None,
            }
        self.engine.new_event('exploit started', data)

    def report_returned(self, exploit, result):
        data = {
            'name': exploit.module_name,
            'id': exploit.id,
            'logdata': exploit.loggedInformation,
            'result': str(result),
            'success': result not in [0, None, -1],
            }
        self.engine.new_event('exploit returned', data)

    def report_finished(self, exploit, node):
        data = {
            'name': exploit.module_name,
            'id': exploit.id,
            'node': self._report_get_node_data(node) if node else None,
            }
        self.engine.new_event('exploit finished', data)

    def _report_get_node_data(self, node):
        return {
            'type': node.nodetype,
            'name': node.getname(),
            'ip': node.get_interesting_interface(),
            'ips': node.getallips(),
            }

    def shutdown(self):
        if hasattr(self.exploit, 'shutdown'):
            self.exploit.shutdown()
        else:
            name = self.name
            if name == "CANVAS Exploit":
                name = self.exploit
            devlog('exploitmanager::shutdown', "%s doesn't have shutdown() function!" % name)