Metabrik Core And Repository 1.10 Released

Following our lightning talk from Hack.lu 2015 conference, we are proud to release the version 1.10 of Metabrik Core and Repository. Update using Mercurial or follow the installation procedure.

You can find the few slides which were presented at the following link.

Lots of new awesome Briks

We added many Briks for this new release, here is the description for them:

  • api::bluecoat: play with Bluecoat REST API
  • api::splunk: play with the Splunk REST API
  • api::virustotal: play with Virustotal REST API
  • client::udp: a UDP socket client (UDP netcat)
  • client::ssl: check various stuff about a SSL/TLS connection
  • client::rest: the base REST client for use with Briks from API Category
  • client::rsync: a wrapper around rsync program
  • client::twitter: a Twitter client
  • database::mysql: interract with MySQL databases
  • file::dump: read and write dump files
  • file::hash: genrated various digests from files
  • file::ole: play with Microsoft files that embed OLE components
  • lookup::iplocation: geolocation for IP addresses
  • string::ascii: convert ASCII characters
  • string::csv: encode/decode CSV strings
  • string::hostname: parse a FQDN
  • string::regex: experiment with regexes
  • system::freebsd::pf: control Packet Filter
  • system::freebsd::jail: control jails

Just type help <Brik> to know more:

Meta:~> use string::regex 
[*] core::shell: use: Brik [string::regex] success
Meta:~> help string::regex 
[+] run string::regex encode <$regex|$regex_list>

Complete list of changes

Core

1.10 Tue Oct 27 20:13:36 CET 2015
   - FEATURE: core::context: allows to pass complex structs arguments to run and set Commands
     Example: run network::arp scan $info->{subnet}
   - FEATURE: core::context: allows also to execute Perl code within an Argument of a
     run Command
     Example: run client::dns ptr_lookup "[ map { @$_ } values %$RUN ]"
   - FEATURE: core::shell: allows to complete aliases (can be disabled via
     aliases_completion Attribute
   - FEATURE: shell::command: use_sudo Attribute to launch sudo on executing external command
   - FEATURE: shell::command: file globbing enabled with capture Command
   - UPDATE: moved attributes_default() from brik_use_properties to brik_properties when
     there is no need to use $self. It allows instanciated Attributes inheritage to work.
   - UPDATE: shell::command: do not print STDERR when using capture Command when there is no
     STDERR string captured.
   - new: shell::command: execute Command to use capture_mode Attribute to launch either
     capture or system Command
   - bugfix: core::context: save_state to use Metabrik brik_attributes Command to correctly
     retrieve all Brik Attributes even those inherited
   - bugfix: core::shell: display error on chdir() failure
   - bugfix: core::shell: escapes " character when executing a multiline Perl/Metabrik Code
             example:
             my $test = 'root'
             for (0..1) {
                'run shell::command system "ls /$test"'
             }
   - bugfix: Metabrik: error checking within new_from_brik_init Command
   - bugfix: Metabrik: logging correctly on class calls to _log_*()

Repository

- bugfixes and new Briks

20151011
   AFFECT: network::arp

   - network::arp scan Command now returns a hashref with results sorted
     with keys named by_mac, by_ipv4 and by_ipv6

20151003
   AFFECT: network::rsync

   - network::rsync renamed to client::rsync

20150418
   AFFECT: crypto::x509

   - Argument order changed for ca_sign_csr and cert_verify Commands

20150322
   AFFECT: file::csv

   - removed get_col_by_name and get_col_by_number obsolete Commands

IP location with Metabrik: different ways of doing it

We just released a new Brik: lookup::iplocation. Thanks to this Brik, you will be able to easily geo-locate any IP address. Well, it has to be in MaxMind’s database for that to work, of course. In this post, we propose to explore different ways of using a Metabrik Brik with this lookup::iplocation example.

Using The Metabrik Shell

Of course, the simplest way of doing is using The Metabrik Shell (which is just a simple Brik called core::shell). A screenshot is what best demonstrates the power of Metabrik.

The first call to ‘use lookup::location‘ fails because we currently lack one Perl module: Geo::IP. Metabrik tells you so and you can install it by using the perl::module Brik.

Then, you want to update the Geo::IP database. If you don’t, you will not have the required data to perform the lookup. You have to call ‘run lookup::location update‘.

Finally, you can geo-locate the IP address by calling ‘run lookup::location from_ip <IP>‘.

iplocation01

Using a Metabrik script

Before being able to execute Metabrik scripts (.meta files), you have to initiate the .metabrik_script_rc file. Just edit it using vi, for instance, and put in the lines below:

vi ~/.metabrik_script_rc
set core::shell echo 0
my $home = $ENV{HOME}
my $repository = "$HOME/metabrik/repository/lib"
push @INC, $repository
run core::context update_available

Now you are ready to write your very own Metabrik script. Create one using vi and put in this content:

vi iplocation-script.meta
use lookup::iplocation
if ($ERR) { exit }

run lookup::iplocation update
if ($ERR) { exit }

run lookup::iplocation from_ip 106.219.10.202
if ($ERR) { exit }

use Data::Dumper
print Dumper($RUN)

You can mix Metabrik Commands with Perl code. Wonderful, isn’t it? Ah, maybe you want to execute it:

metabrik --script iplocation-script.meta

The third way: use a Perl script

And finally, this is Perl. You can use a Brik as a plain Perl module if you want to. Try that:

vi iplocation-standalone-brik.pl
#!/usr/bin/perl
use strict;
use warnings;

use Data::Dumper;
use Metabrik::Core::Context;
use Metabrik::Lookup::Iplocation;

my $context = Metabrik::Core::Context->new;
$context->brik_init or die("[FATAL] context init failed\n");

my $li = Metabrik::Lookup::Iplocation->new_from_brik_init($context)
   or exit(1);

$li->update
   or exit(2);

my $info = $li->from_ip("104.47.125.219")
   or exit(3);

print Dumper($info);

Conclusion

You see you can play with Metabrik in different ways. Even though Metabrik has been thought as a shell from the beginning, you are not bound to it in any way. And you, what is your favorite way of using Briks?