nasl_wmi.c

Go to the documentation of this file.

/* SPDX-FileCopyrightText: 2023 Greenbone AG
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */
 
#include "nasl_wmi.h"
 
#include "../misc/plugutils.h"
#include "openvas_wmi_interface.h"
 
#include <arpa/inet.h>
#include <ctype.h>
#include <gvm/base/logging.h>
#include <gvm/base/networking.h>
#include <inttypes.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
 
#define IMPORT(var) char *var = get_str_var_by_name (lexic, #var)
#define max 5
 
#undef G_LOG_DOMAIN
 
#define G_LOG_DOMAIN "lib  nasl"
 
static int
check_alpha (char *val)
{
  int i, val_len;
  val_len = strlen (val);
 
  if ((strcmp (val, "-1")) != 0)
    {
      for (i = 0; i < val_len; i++)
        if (!isdigit (val[i]))
          return 0;
    }
  else
    return 0;
 
  return 1;
}
 
static uint32_t
stoi_uint32_t (char *s)
{
  uint32_t v;
  sscanf (s, "%" PRIu32, &v);
  return v;
}
 
static uint64_t
stoi_uint64_t (char *s)
{
  uint64_t v;
  sscanf (s, "%" PRIu64, &v);
  return v;
}
 
tree_cell *
nasl_wmi_versioninfo (lex_ctxt *lexic)
{
  char *version = wmi_versioninfo ();
  tree_cell *retc;
  (void) lexic;
 
  if (!version)
    return NULL;
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = strdup (version);
  retc->size = strlen (version);
  return retc;
}
 
/*
################################################################################
 WMI_FUNCTIONS
################################################################################
*/
 
tree_cell *
nasl_wmi_connect (lex_ctxt *lexic)
{
  struct script_infos *script_infos = lexic->script_infos;
  struct in6_addr *host = plug_get_host_ip (script_infos);
  char *ip;
  char *argv[max];
  WMI_HANDLE handle;
  int argc = 5;
  IMPORT (username);
  IMPORT (password);
  IMPORT (ns);
  IMPORT (options);
 
  if (ns == NULL)
    ns = "root\\cimv2";
 
  if ((host == NULL) || (username == NULL) || (password == NULL))
    {
      g_message ("nasl_wmi_connect: Invalid input arguments");
      return NULL;
    }
 
  ip = addr6_as_str (host);
  if ((strlen (password) == 0) || (strlen (username) == 0) || strlen (ip) == 0)
    {
      g_message ("nasl_wmi_connect: Invalid input arguments");
      g_free (ip);
      return NULL;
    }
 
  // Construct the WMI query
  argv[0] = g_strdup ("wmic");
  argv[1] = g_strdup ("-U");
  argv[2] = g_strdup_printf ("%s%%%s", username, password);
  argv[3] = g_strdup_printf ("//%s%s", ip, options ? options : "[sign]");
  argv[4] = g_strdup (ns);
  g_free (ip);
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  handle = wmi_connect (argc, argv);
  if (!handle)
    {
      g_message ("nasl_wmi_connect: WMI Connect failed or missing WMI support "
                 "for the scanner");
      return NULL;
    }
 
  retc->x.ref_val = handle;
  return retc;
}
 
tree_cell *
nasl_wmi_close (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
  if (!handle)
    return NULL;
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
 
  if (wmi_close (handle) == 0)
    {
      retc->x.i_val = 1;
      return retc;
    }
  return NULL;
}
 
tree_cell *
nasl_wmi_query (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
  char *query = get_str_var_by_name (lexic, "query");
  char *res = NULL;
  int value;
 
  if (!handle)
    return NULL;
 
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_query (handle, query, &res);
  if ((value == -1) && (res != NULL))
    {
      g_message ("wmi_query: WMI query failed '%s' with error: '%s'", query,
                 res);
      g_free (res);
      return NULL;
    }
  else if ((value == -1) && (res == NULL))
    {
      g_debug ("wmi_query: WMI query failed '%s'", query);
      return NULL;
    }
  else if (res == NULL)
    return NULL;
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
 
  return retc;
}
 
/*
################################################################################
 WMI_RSOP_FUNCTIONS
################################################################################
*/
 
tree_cell *
nasl_wmi_connect_rsop (lex_ctxt *lexic)
{
  struct script_infos *script_infos = lexic->script_infos;
  struct in6_addr *host = plug_get_host_ip (script_infos);
  char *ip;
  IMPORT (username);
  IMPORT (password);
  IMPORT (options);
 
  char *argv[4];
  WMI_HANDLE handle;
  int argc = 4;
 
  if ((host == NULL) || (username == NULL) || (password == NULL))
    {
      g_message ("nasl_wmi_connect_rsop: Invalid input arguments");
      return NULL;
    }
 
  ip = addr6_as_str (host);
  if ((strlen (password) == 0) || (strlen (username) == 0) || strlen (ip) == 0)
    {
      g_message ("nasl_wmi_connect_rsop: Invalid input arguments");
      g_free (ip);
      return NULL;
    }
 
  // Construct the WMI query
  argv[0] = g_strdup ("wmic");
  argv[1] = g_strdup ("-U");
  argv[2] = g_strdup_printf ("%s%%%s", username, password);
  argv[3] = g_strdup_printf ("//%s%s", ip, options ? options : "[sign]");
  g_free (ip);
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  handle = wmi_connect_rsop (argc, argv);
  if (!handle)
    {
      g_message ("nasl_wmi_connect_rsop: WMI Connect failed or missing WMI "
                 "support for the scanner");
      return NULL;
    }
 
  retc->x.ref_val = handle;
  return retc;
}
 
tree_cell *
nasl_wmi_query_rsop (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
  if (!handle)
    return NULL;
 
  char *query = get_str_var_by_name (lexic, "query"); // WQL query
  char *res = NULL;
  int value;
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_query_rsop (handle, query, &res);
  if ((value == -1) && (res != NULL))
    {
      g_message ("wmi_query_rsop: WMI query failed '%s' with error: '%s'",
                 query, res);
      g_free (res);
      return NULL;
    }
  else if ((value == -1) && (res == NULL))
    {
      g_debug ("wmi_query_rsop: WMI query failed");
      return NULL;
    }
  else if (res == NULL)
    return NULL;
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
 
  return retc;
}
 
/*
################################################################################
 WMI_REGISTRY_FUNCTIONS
################################################################################
*/
 
tree_cell *
nasl_wmi_connect_reg (lex_ctxt *lexic)
{
  struct script_infos *script_infos = lexic->script_infos;
  struct in6_addr *host = plug_get_host_ip (script_infos);
  char *ip;
  IMPORT (username);
  IMPORT (password);
  IMPORT (options);
 
  char *argv[4];
  WMI_HANDLE handle;
  int argc = 4;
 
  if ((host == NULL) || (username == NULL) || (password == NULL))
    {
      g_message ("nasl_wmi_connect_reg: Invalid input arguments");
      return NULL;
    }
 
  ip = addr6_as_str (host);
  if ((strlen (password) == 0) || (strlen (username) == 0) || strlen (ip) == 0)
    {
      g_message ("nasl_wmi_connect_reg: Invalid input arguments");
      g_free (ip);
      return NULL;
    }
 
  // Construct the WMI query
  argv[0] = g_strdup ("wmic");
  argv[1] = g_strdup ("-U");
  argv[2] = g_strdup_printf ("%s%%%s", username, password);
  argv[3] = g_strdup_printf ("//%s%s", ip, options ? options : "[sign]");
  g_free (ip);
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  handle = wmi_connect_reg (argc, argv);
  if (!handle)
    {
      g_message ("nasl_wmi_connect_reg: WMI Connect failed or missing WMI "
                 "support for the scanner");
      return NULL;
    }
 
  retc->x.ref_val = handle;
  return retc;
}
 
tree_cell *
nasl_wmi_reg_get_sz (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
  char *key_name =
    get_str_var_by_name (lexic, "key_name"); // REGISTRY value name
 
  char *res = NULL;
  int value;
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_get_sz (handle, hive, key, key_name, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_get_sz: WMI Registry get failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
 
  return retc;
}
 
tree_cell *
nasl_wmi_reg_enum_value (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
 
  char *res = NULL;
  int value;
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_enum_value (handle, hive, key, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_enum_value: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
 
  return retc;
}
 
tree_cell *
nasl_wmi_reg_enum_key (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
 
  char *res = NULL;
  int value;
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_enum_key (handle, hive, key, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_enum_key: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
 
  return retc;
}
 
tree_cell *
nasl_wmi_reg_get_bin_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name"); // REGISTRY VALUE NAME
 
  char *res = NULL;
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_get_bin_val (handle, hive, key, val_name, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_get_bin_val: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
  return retc;
}
 
tree_cell *
nasl_wmi_reg_get_dword_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name"); // REGISTRY VALUE NAME
 
  char *res = NULL;
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_get_dword_val (handle, hive, key, val_name, &res);
 
  if ((value == 0) && (res == 0))
    res = "0";
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_get_dword_val: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
  return retc;
}
 
tree_cell *
nasl_wmi_reg_get_ex_string_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name"); // REGISTRY VALUE NAME
 
  char *res = NULL;
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_get_ex_string_val (handle, hive, key, val_name, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_get_ex_string_val: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
  return retc;
}
 
tree_cell *
nasl_wmi_reg_get_mul_string_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name"); // REGISTRY VALUE NAME
 
  char *res = NULL;
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_get_mul_string_val (handle, hive, key, val_name, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_get_mul_string_val: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
  return retc;
}
 
tree_cell *
nasl_wmi_reg_get_qword_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  unsigned int hive = get_int_var_by_name (lexic, "hive", 0); // REGISTRY Hive
  char *key = get_str_var_by_name (lexic, "key");             // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name"); // REGISTRY VALUE NAME
 
  char *res = NULL;
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = NULL;
  retc->size = 0;
 
  value = wmi_reg_get_qword_val (handle, hive, key, val_name, &res);
 
  if ((value == -1) || (res == NULL))
    {
      g_message ("nasl_wmi_reg_get_qword_val: WMI query failed");
      return NULL;
    }
 
  retc->x.str_val = strdup (res);
  retc->size = strlen (res);
  return retc;
}
 
tree_cell *
nasl_wmi_reg_set_dword_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  char *key = get_str_var_by_name (lexic, "key"); // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name");      // REGISTRY VALUE NAME
  char *val = get_str_var_by_name (lexic, "val"); // REGISTRY VALUE TO SET
 
  uint32_t val1;
  int value;
 
  // Return NULL if any alphabet is present
  if (check_alpha (val) == 0)
    return NULL;
 
  // Convert string to proper 64 bit integer
  val1 = stoi_uint32_t (val);
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = 1;
 
  value = wmi_reg_set_dword_val (handle, key, val_name, val1);
 
  if (value == -1)
    {
      g_message ("nasl_wmi_reg_set_dword_val: WMI registry set"
                 " operation failed");
      return NULL;
    }
  return retc;
}
 
tree_cell *
nasl_wmi_reg_set_qword_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  char *key = get_str_var_by_name (lexic, "key"); // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name");      // REGISTRY VALUE NAME
  char *val = get_str_var_by_name (lexic, "val"); // REGISTRY VALUE TO SET
 
  uint64_t val1;
  int value;
 
  // Return if alphabets present
  if (check_alpha (val) == 0)
    return NULL;
 
  // Convert string to proper integer
  val1 = stoi_uint64_t (val);
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = 1;
 
  value = wmi_reg_set_qword_val (handle, key, val_name, val1);
 
  if (value == -1)
    {
      g_message ("nasl_wmi_reg_set_qword_val: WMI register"
                 " set operation failed");
      return NULL;
    }
  return retc;
}
 
tree_cell *
nasl_wmi_reg_set_ex_string_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  char *key = get_str_var_by_name (lexic, "key"); // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name");      // REGISTRY VALUE NAME
  char *val = get_str_var_by_name (lexic, "val"); // REGISTRY VALUE TO SET
 
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = 1;
 
  value = wmi_reg_set_ex_string_val (handle, key, val_name, val);
 
  if (value == -1)
    {
      g_message (
        "nasl_wmi_reg_set_ex_string_val: WMI registry set operation failed");
      return NULL;
    }
  return retc;
}
 
tree_cell *
nasl_wmi_reg_set_string_val (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  char *key = get_str_var_by_name (lexic, "key"); // REGISTRY KEY
  char *val_name =
    get_str_var_by_name (lexic, "val_name");      // REGISTRY VALUE NAME
  char *val = get_str_var_by_name (lexic, "val"); // REGISTRY VALUE TO SET
 
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = 1;
 
  value = wmi_reg_set_string_val (handle, key, val_name, val);
 
  if (value == -1)
    {
      g_message ("nasl_wmi_reg_set_string_val: WMI registry"
                 " set operation failed");
      return NULL;
    }
  return retc;
}
 
tree_cell *
nasl_wmi_reg_create_key (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  char *key = get_str_var_by_name (lexic, "key"); // REGISTRY KEY
 
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = 1;
 
  value = wmi_reg_create_key (handle, key);
 
  if (value == -1)
    {
      g_message ("nasl_wmi_reg_create_key: WMI registry key create"
                 " operation failed");
      return NULL;
    }
  return retc;
}
 
tree_cell *
nasl_wmi_reg_delete_key (lex_ctxt *lexic)
{
  WMI_HANDLE handle = (WMI_HANDLE) get_int_var_by_name (lexic, "wmi_handle", 0);
 
  if (!handle)
    return NULL;
 
  char *key = get_str_var_by_name (lexic, "key"); // REGISTRY KEY
 
  int value;
 
  tree_cell *retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = 1;
 
  value = wmi_reg_delete_key (handle, key);
 
  if (value == -1)
    {
      g_message ("nasl_wmi_reg_delete_key: WMI registry key"
                 " delete operation failed");
      return NULL;
    }
  return retc;
}