metasploit-gs/lib/msf/core/exploit/vim_soap.rb

# -*- coding: binary -*-
module Msf

module Exploit::Remote::VIMSoap
  include Msf::Exploit::Remote::HttpClient

  def vim_soap_envelope(body)
    soap_data = '<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">'
    soap_data << '<env:Body>'
    soap_data << body
    soap_data <<  '</env:Body></env:Envelope>'
  end



  def vim_soap_propset(type,path,all = false)
    soap_data = '<propSet xsi:type="PropertySpec">'
    soap_data << '<type>' + type + '</type>'
    if all
      soap_data << '<all>true</all>'
    else
      soap_data << '<pathSet>' + path + '</pathSet>'
    end
    soap_data << '</propSet>'
  end



  def vim_soap_objset(type, ref)
    soap_data = '<objectSet>'
    soap_data << '<obj type="' + type + '">' + ref + '</obj>'
    soap_data << '</objectSet>'
  end



  def vim_soap_specset(path,type,ref,all=false)
    soap_data = '<specSet>'
    soap_data << vim_soap_propset(type,path,all)
    soap_data << vim_soap_objset(type,ref)
    soap_data << '</specSet>'
  end



  def vim_soap_retrieve_properties(path,type,ref,all=false)
    soap_data = '<RetrieveProperties xmlns="urn:vim25">'
    soap_data << '<_this type="PropertyCollector">' + @server_objects['propertyCollector'] + '</_this>'
    soap_data << vim_soap_specset(path,type,ref,all)
    soap_data << '</RetrieveProperties>'
  end



  def vim_soap_retrieve_service_content
    soap_data = '<RetrieveServiceContent xmlns="urn:vim25">'
    soap_data << '<_this type="ServiceInstance">ServiceInstance</_this>'
    soap_data << '</RetrieveServiceContent>'
  end



  def vim_soap_login(user,pass)
    soap_data = '<Login xmlns="urn:vim25">'
    soap_data << '<_this type="SessionManager">' + @server_objects['sessionManager'] + '</_this>'
    soap_data << '<userName>' + user + '</userName>'
    soap_data << '<password>' + pass + '</password>'
    soap_data << '</Login>'
  end



  def vim_soap_session_active?(key, user)
    soap_data = '<SessionIsActive xmlns="urn:vim25">'
    soap_data << '<_this type="SessionManager">' + @server_objects['sessionManager'] + '</_this>'
    soap_data << '<sessionID>' + key+ '</sessionID>'
    soap_data << '<userName>' + user + '</userName>'
    soap_data << '</SessionIsActive>'
  end




  def vim_soap_terminate_session(key)
    soap_data = '<TerminateSession xmlns="urn:vim25">'
    soap_data << '<_this xsi:type="ManagedObjectReference" type="SessionManager" >' + @server_objects['sessionManager'] + '</_this>'
    soap_data << '<sessionId>' + key + '</sessionId>'
    soap_data << '</TerminateSession>'
  end



  def vim_soap_retrieve_usergroups(domain=nil)
    soap_data = '<RetrieveUserGroups xmlns="urn:internalvim25">'
    soap_data << '<_this xsi:type="ManagedObjectReference" type="UserDirectory">' + @server_objects['userDirectory'] + '</_this>'
    soap_data << '<domain>' + domain + '</domain>' if domain
    soap_data << '<searchStr></searchStr><exactMatch>false</exactMatch><findUsers>true</findUsers><findGroups>true</findGroups>'
    soap_data << '</RetrieveUserGroups>'
  end



  def vim_soap_log_user_event_vm(vm_ref,msg)
    soap_data = '<LogUserEvent xmlns="urn:vim25">'
    soap_data << '<_this type="EventManager">' + @server_objects['eventManager'] + '</_this>'
    soap_data << '<entity type="VirtualMachine">' + vm_ref + '</entity>'
    soap_data << '<msg>' + msg + '</msg>'
    soap_data << '</LogUserEvent>'
  end



  def vim_soap_retrieve_all_permissions
    soap_data = '<RetrieveAllPermissions xmlns="urn:vim25">'
    soap_data << '<_this type="AuthorizationManager">' + @server_objects['authorizationManager'] + '</_this>'
    soap_data << '</RetrieveAllPermissions>'
  end



  def vim_soap_find_child_byname(type,entity,name)
    soap_data = '<FindChild xmlns="urn:vim25">'
    soap_data << '<_this type="SearchIndex">' + @server_objects['searchIndex'] + '</_this>'
    soap_data << '<entity type="' + type + '">' + entity + '</entity>'
    soap_data << '<name>' + name + '</name>'
    soap_data << '</FindChild>'
  end



  def vim_soap_power_on_vm(vm_ref)
    soap_data = '<PowerOnVM_Task xmlns="urn:vim25">'
    soap_data << '<_this type="VirtualMachine">' + vm_ref + '</_this>'
    soap_data << '</PowerOnVM_Task>'
  end



  def vim_soap_power_off_vm(vm_ref)
    soap_data = '<PowerOffVM_Task xmlns="urn:vim25">'
    soap_data << '<_this type="VirtualMachine">' + vm_ref + '</_this>'
    soap_data << '</PowerOffVM_Task>'
  end



  def vim_soap_create_screenshot(vm_ref)
    soap_data = '<CreateScreenshot_Task xmlns="urn:vim25">'
    soap_data << '<_this type="VirtualMachine">' + vm_ref + '</_this>'
    soap_data << '</CreateScreenshot_Task>'
  end



  def vim_send_soap_request(soap_data)
    res = send_request_cgi({
      'uri'     => '/sdk',
      'method'  => 'POST',
      'agent'   => 'VMware VI Client',
      'cookie'  => @vim_cookie,
      'data' => soap_data,
      'headers' => { 'SOAPAction' => @soap_action}
    }, 25)
    return :noresponse unless res
    if res.body.include? "NotAuthenticatedFault"
      return :expired
    elsif res.body.include? "<faultstring>"
      @vim_soap_error = res.body.match(/<faultstring>([^\c ]+?)<\/faultstring>/)[1]
      return :error
    elsif res.code != 200
      @vim_soap_error = "An unknown error was encountered"
      return :error
    else
      return Hash.from_xml(res.body)['Envelope']['Body']
    end
  end

  def vim_get_session
    soap_data = vim_soap_envelope(vim_soap_retrieve_service_content)
    res = send_request_cgi({
      'uri'     => '/sdk',
      'method'  => 'POST',
      'agent'   => 'VMware VI Client',
      'data' => soap_data,
      'headers' => { 'SOAPAction' => @soap_action}
    }, 25)
    return false unless res and res.code == 200
     @server_objects = (((Hash.from_xml(res.body)['Envelope'] || {})['Body'] || {})['RetrieveServiceContentResponse'] || {})['returnval']
     @soap_action = "urn:vim25/#{(@server_objects['about'] || {})['apiVersion']}"
    if res.headers['Set-Cookie']
      @vim_cookie = res.headers['Set-Cookie']
      return true
    else
      return false
    end
  end



  def vim_do_login(user, pass)
    unless vim_get_session
      return false
    end
    soap_data = vim_soap_envelope(vim_soap_login(user,pass))
    res = send_request_cgi({
        'uri'     => '/sdk',
        'method'  => 'POST',
        'agent'   => 'VMware VI Client',
        'cookie'  => @vim_cookie,
        'data' => soap_data,
        'headers' => { 'SOAPAction' => @soap_action}
        }, 25)
    if res.code == 200
      return :success
    else
      return :fail
    end
  end



  def vim_get_session_list
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('sessionList','SessionManager', @server_objects['sessionManager']))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      session_list = []
      session_list << res['RetrievePropertiesResponse']['returnval']['propSet']['val']['UserSession']
      return session_list.flatten.compact
    else
      return res
    end
  end



  def vim_session_is_active(key, username)
    soap_data = vim_soap_envelope(vim_soap_session_active?(key,username))
    res = vim_send_soap_request(soap_data)
    print_status "Error: #{@vim_soap_error}"
    if res.class == Hash
      active = res['SessionIsActiveResponse']['returnval']
      return active
    else
      return res
    end
  end



  def vim_terminate_session(key)
    soap_data = vim_soap_envelope(vim_soap_terminate_session(key))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      return :success
    else
      return res
    end
  end



  def vim_get_domains
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('domainList', 'UserDirectory', @server_objects['userDirectory']))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      domains = []
      domains << res['RetrievePropertiesResponse']['returnval']['propSet']['val']['string']
      return domains.flatten.compact
    else
      return res
    end
  end



  def vim_get_user_list(domain=nil)
    soap_data = vim_soap_envelope(vim_soap_retrieve_usergroups(domain))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      return nil unless res['RetrieveUserGroupsResponse']['returnval']
      user_list = []
      user_list <<  res['RetrieveUserGroupsResponse']['returnval']
      return user_list.flatten.compact
    else
      return res
    end
  end



  def vim_log_event_vm(vm_ref, msg)
    soap_data = vim_soap_envelope(vim_soap_log_user_event_vm(vm_ref,msg))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      return :success
    else
      return res
    end
  end



  def vim_get_all_permissions
    soap_data = vim_soap_envelope(vim_soap_retrieve_all_permissions)
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      permissions = []
      permissions << res['RetrieveAllPermissionsResponse']['returnval']
      return permissions.flatten.compact
    else
      return res
    end
  end



  def vim_get_roles
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('roleList', 'AuthorizationManager', @server_objects['authorizationManager']))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      roles = []
      roles << res['RetrievePropertiesResponse']['returnval']['propSet']['val']['AuthorizationRole']
      return roles.flatten.compact
    else
      return res
    end
  end



  def vim_get_dc_name(dc)
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('name','Datacenter',dc))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      return res['RetrievePropertiesResponse']['returnval']['propSet']['val']
    else
      return res
    end
  end


  def vim_get_dcs
    soap_data = vim_soap_envelope(vim_soap_retrieve_service_content)
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      @server_objects.merge!(res['RetrieveServiceContentResponse']['returnval'])
    else
      return res
    end

    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('content', 'ServiceInstance', 'ServiceInstance'))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      hash = res['RetrievePropertiesResponse']['returnval']['propSet']['val']
      hash.delete('xsi:type')
      @server_objects.merge!(hash)
    else
      return res
    end

    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('childEntity', 'Folder', @server_objects['rootFolder']))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      tmp_dcs = []
      tmp_dcs << res['RetrievePropertiesResponse']['returnval']['propSet']['val']['ManagedObjectReference']
      tmp_dcs.flatten!
      tmp_dcs.each{|dc| @dcs << { 'name' => vim_get_dc_name(dc) , 'ref' => dc}}
    else
      return res
    end
  end



  def vim_get_hosts(datacenter)
    dc_hosts = []
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('hostFolder', 'Datacenter' , datacenter))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      host_folders = []
      host_folders << res['RetrievePropertiesResponse']['returnval']['propSet']['val']
      host_folders.flatten!
    else
      return res
    end

    compute_refs = []
    host_folders.each do |folder|
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('childEntity', 'Folder' , folder))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        ref = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['ManagedObjectReference']
        unless ref.nil?
          compute_refs << ref
        end
      else
        return res
      end
    end
    compute_refs.flatten!

    compute_refs.each do |ref|
      next if ref.start_with? "group-"
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('host', 'ComputeResource' , ref))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        dc_hosts << res['RetrievePropertiesResponse']['returnval']['propSet']['val']['ManagedObjectReference']
      else
        return res
      end
    end
    dc_hosts.flatten!
    return dc_hosts
  end



  def vim_get_all_hosts
    @dcs.each{|dc| @hosts << vim_get_hosts(dc['ref'])}
    @hosts.flatten!
  end



  def vim_get_host_hw(host)
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('hardware', 'HostSystem' , host))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      return res['RetrievePropertiesResponse']['returnval']['propSet']['val']
    else
      return res
    end
  end

  def vim_get_all_host_summary(hw=false)
    vim_setup_references
    summaries = []
    @hosts.each do |host|
      details = {}
      details[host] = vim_get_host_summary(host)
      if details and hw
        details.merge!(vim_get_host_hw(host))
      end
      summaries << details
    end
    return summaries.flatten.compact
  end

  def vim_get_vm_datastore(vm)
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('datastore', 'VirtualMachine' , vm))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      datastore_refs = []
      datastore_refs << res['RetrievePropertiesResponse']['returnval']['propSet']['val']['ManagedObjectReference']
      datastore_refs.flatten!
      datastore_refs.compact!
      datastores = []
    else
      return res
    end

    datastore_refs.each do |datastore_ref|
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('info', 'Datastore' , datastore_ref))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        datastore_name = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['name']
        datastore = { 'name' => datastore_name, 'ref' => datastore_ref}
        datastores << datastore
      else
        return res
      end
    end
    return datastores

  end

  def vim_find_vm_by_name(name)
    vim_setup_references
    @dcs.each do |dc|
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('vmFolder', 'Datacenter' , dc['ref']))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        vm_folders = []
        vm_folders << res['RetrievePropertiesResponse']['returnval']['propSet']['val']
        vm_folders.flatten!
        vm_folders.compact!
      else
        return res
      end


      vm_folders.each do |vm_folder|
        soap_data = vim_soap_envelope(vim_soap_find_child_byname('Folder', vm_folder, name))
        res = vim_send_soap_request(soap_data)
        if res.class == Hash
          vmref = res['FindChildResponse']['returnval']
          if vmref
            return vmref
          else
            next
          end
        else
          return res
        end
      end
    end
    return nil
  end



  def vim_powerON_vm(vm_ref)
    soap_data = vim_soap_envelope(vim_soap_power_on_vm(vm_ref))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      task_id = res['PowerOnVM_TaskResponse']['returnval']
    else
      return res
    end

    state= "running"
    while state == "running"
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('info', 'Task', task_id))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        state = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['state']
        case state
        when 'running'
          select(nil, nil, nil, 5)
        when 'error'
          if res['RetrievePropertiesResponse']['returnval']['propSet']['val']['error']['fault']['existingState'] == 'poweredOn'
            return 'alreadyON'
          end
        end
      else
        return res
      end
    end
    return state
  end



  def vim_powerOFF_vm(vm_ref)
    soap_data = vim_soap_envelope(vim_soap_power_off_vm(vm_ref))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      task_id = res['PowerOffVM_TaskResponse']['returnval']
    else
      return res
    end

    state= "running"
    while state == "running"
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('info', 'Task', task_id))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        state = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['state']
        case state
        when 'running'
          select(nil, nil, nil, 5)
        when 'error'
          if res['RetrievePropertiesResponse']['returnval']['propSet']['val']['error']['fault']['existingState'] == 'poweredOn'
            return 'alreadyON'
          end
        end
      else
        return res
      end
    end
    return state
  end



  def vim_take_screenshot(vm, user, pass)
    soap_data = vim_soap_envelope(vim_soap_create_screenshot(vm['ref']))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      task_id = res['CreateScreenshot_TaskResponse']['returnval']
    else
      return res
    end

    state= "running"
    while state == "running"
      soap_data = vim_soap_envelope(vim_soap_retrieve_properties('info', 'Task', task_id))
      res = vim_send_soap_request(soap_data)
      if res.class == Hash
        state = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['state']
        screenshot_file = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['result']
      else
        return res
      end
    end
    unless screenshot_file
      return :error
    end
    (ss_folder, ss_file) = screenshot_file.split('/').last(2)
    ss_folder = Rex::Text.uri_encode(ss_folder)
    ss_file =  Rex::Text.uri_encode(ss_file)
    ss_path = "#{ss_folder}/#{ss_file}"
    datastores = vim_get_vm_datastore(vm['ref'])
    user_pass = Rex::Text.encode_base64(user + ":" + pass)
    datastores.each do |datastore|
      ss_uri = "/folder/#{ss_path}?dcPath=#{vm['dc_name']}&dsName=#{datastore['name']}"
      res = send_request_cgi({
        'uri'     => ss_uri,
        'method'  => 'GET',
        'agent'   => 'VMware VI Client',
        'cookie'  => @vim_cookie,
        'headers' => { 'Authorization' => "Basic #{user_pass}"}
      }, 25)
      next unless res
      if res.code == 200
        return res.body
      elsif res.code == 404
        next
      end
    end
    return :error
  end



  def vim_get_host_summary(host)
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('summary', 'HostSystem', host))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      hash = res['RetrievePropertiesResponse']['returnval']['propSet']['val']
      hash['runtime'].delete('healthSystemRuntime')
      hash.delete('xsi:type')
      hash.delete('host')
      return hash
    else
      return res
    end
  end



  def vim_get_vms
    vim_setup_references
    @vmrefs = []
    vmlist= []
    @dcs.each do |dc|
      dc_vm_refs = vim_get_dc_vms(dc['ref'])
      next if dc_vm_refs.nil? or dc_vm_refs.empty?
      dc_vm_refs.flatten!
      dc_vm_refs.compact!
      next if dc_vm_refs.nil? or dc_vm_refs.empty?
      print_status "#{datastore['RHOST']} - DataCenter: #{dc['name']} Found a Total of #{dc_vm_refs.length} VMs"
      print_status "#{datastore['RHOST']}  - DataCenter: #{dc['name']} Estimated Time: #{((dc_vm_refs.length * 7) /60)} Minutes"
      dc_vm_refs.each do |ref|
        print_status "#{datastore['RHOST']}  -  DataCenter: #{dc['name']} - Getting Data for VM: #{ref}..."
        details  = vim_get_vm_info(ref)
        if details
          details['ref'] = ref
          details['dc_ref'] = dc['ref']
          details['dc_name'] = dc['name']
          vmlist << details
        end
      end
    end
    return vmlist
  end



  def vim_get_dc_vms(datacenter)
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('vmFolder', 'Datacenter', datacenter))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      vmfolder = res['RetrievePropertiesResponse']['returnval']['propSet']['val']
    else
      return res
    end

    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('childEntity', 'Folder', vmfolder))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      vm_index_array = res['RetrievePropertiesResponse']['returnval']['propSet']['val']['ManagedObjectReference']
      vm_index_array.delete_if{|ref| ref.start_with? "group"} unless vm_index_array.nil? or vm_index_array.empty? or vm_index_array.class != Array
      return vm_index_array
    else
      return res
    end
  end

  def vim_get_vm_info(vm_ref)
    vim_setup_references
    soap_data = vim_soap_envelope(vim_soap_retrieve_properties('summary', 'VirtualMachine', vm_ref))
    res = vim_send_soap_request(soap_data)
    if res.class == Hash
      hash =  res['RetrievePropertiesResponse']['returnval']['propSet']['val']
      vm = hash['config']
      vm['runtime'] = hash['runtime']
      vm['guest'] = hash['guest']
      vm['quickStats'] = hash['quickStats']
      return vm
    else
      return res
    end
  end

  def vim_logged_in?
    return true if @vim_cookie
    return false
  end

  def vim_instance_vars_set?
    return false if @server_objects.nil? or @server_objects.empty?
    return false if @host.nil? or @host.empty?
    return true
  end

  def vim_setup_references
    unless vim_instance_vars_set?
      @dcs = []
      @hosts = []
      vim_get_dcs
      vim_get_all_hosts
      @hosts.flatten!
      @hosts.compact!
    end
  end

end
end