Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adhoc scan of hostname calls a non-existent accessor in method #267

Closed
BrianWGray opened this issue Apr 6, 2017 · 0 comments · Fixed by #276
Closed

Adhoc scan of hostname calls a non-existent accessor in method #267

BrianWGray opened this issue Apr 6, 2017 · 0 comments · Fixed by #276
Labels

Comments

@BrianWGray
Copy link

BrianWGray commented Apr 6, 2017

scan.rb includes a method _append_asset! which calls an accessor that does not appear to be set at any point.

On line 238 host.text is assigned asset.host but asset is passed as a string value to the method.
host.text = asset.host

By changing asset.host to asset so it's string value is used allows the methods that call _append_asset! to function properly. Specifically, scan_asset -> scan_assets.

Ruby code that reproduces the issue:

#!/usr/bin/env ruby
require 'optparse'
require 'rubygems'
require 'highline/import'
require 'nexpose'
include Nexpose
 
@host = '<hostname>'
@port = 3780
@user = 'nxadmin'
 
OptionParser.new do |opts|
  opts.banner = "Usage: ruby #{File::basename($0)} [options] <asset> <site-id>"
  opts.separator ''
  opts.separator 'This script will add an asset to a specified site and then launch a scan on that asset with the sites configurations'
  opts.separator ''
  opts.separator %Q{A site must already exist for this script to run against.}
  opts.separator ''
  opts.separator 'Note that this script will always prompt for a connection password.'
  opts.separator ''
  opts.separator 'Options:'
  opts.on('-h', "--host HOST", "IP or hostname of Nexpose console. Defaults to #{@host} if not provided.") { |host| @host = host }
  opts.on('-p', "--port PORT", Integer, "Port of Nexpose console. Defaults to #{@port} if not provided.") { |port| @port = port }
  opts.on('-u', "--user USER", "Username to connect to Nexpose with. Defaults to #{@user} if not provided.") { |user| @user = user }
  opts.on_tail('--help', "Print this help message.") { puts opts; exit }
end.parse!
 
unless ARGV[0]
  $stderr.puts 'Asset is required.'
  exit(1)
end
asset = ARGV[0]
 
unless ARGV[1]
  $stderr.puts 'Site ID is required.'
  exit(1)
end
site_id = ARGV[1]
 
def get_password(prompt = 'Password: ')
  ask(prompt) { |query| query.echo = false }
end
@password = get_password
 
nsc = Nexpose::Connection.new(@host, @user, @password, @port)

begin
    nsc.login
    rescue ::Nexpose::APIError => err
    $stderr.puts("Connection to #{@host} failed: #{err.reason}")
    exit(1)
    raise
end

at_exit { nsc.logout }

site = Site.load(nsc, site_id)
puts "Adding the asset #{asset} to the site #{site_id}"
site.include_asset(asset)
site.save(nsc)

=begin
## Patch
class Nexpose::Connection

    # Utility method for appending a HostName or IPRange object into an
    # XML object, in preparation for ad hoc scanning.
    #
    # @param [REXML::Document] xml Prepared API call to execute.
    # @param [HostName|IPRange] asset Asset to append to XML.
    #
    def _append_asset!(xml, asset)
      if asset.is_a? IPRange
        xml.add_element('range', 'from' => asset.from, 'to' => asset.to)
      else  # Assume HostName
        host = REXML::Element.new('host')
        host.text = asset
        xml.add_element(host)
      end
    end
end
=end

puts "Now Scanning asset #{asset}."
scan = nsc.scan_asset(site_id, asset)
 
begin 
  sleep(30) 
  status = nsc.scan_status(scan.id) 
  puts "Current scan status: #{status.to_s}" 
end while status == Nexpose::Scan::Status::RUNNING 

Context

Submitting the issue on behalf of https://community.rapid7.com/thread/9166

Error posted to community:
C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/nexpose-5.3.1/lib/nexpose/scan.rb:238:in _append_asset!': undefined method host
' for "beans.domains.com":String (NoMethodError)
from C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/nexpose-5.3.1/lib/nexpose/scan.rb:112:in block in scan_assets' from C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/nexpose-5.3.1/lib/nexpose/scan.rb:112:in each'
from C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/nexpose-5.3.1/lib/nexpose/scan.rb:112:in scan_assets' from C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/nexpose-5.3.1/lib/nexpose/scan.rb:83:in scan_asset'
from ./add_asset_to_site_and_scan.rb:57:in `

'

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants