librex 0.0.16 → 0.0.17

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb

@@ -0,0 +1,180 @@
+#!/usr/bin/env ruby
+
+require 'thread'
+require 'rex/post/meterpreter/channel'
+require 'rex/post/meterpreter/channels/stream'
+require 'rex/post/meterpreter/extensions/stdapi/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Net
+module SocketSubsystem
+
+###
+#
+# This class represents a logical TCP client connection
+# that is established from the remote machine and tunnelled
+# through the established meterpreter connection, similar to an
+# SSH port forward.
+#
+###
+class TcpClientChannel < Rex::Post::Meterpreter::Stream
+
+	class << self
+		def cls
+			return CHANNEL_CLASS_STREAM
+		end
+	end
+
+	module SocketInterface
+		def type?
+			'tcp'
+		end
+
+		def getsockname
+			return super if not channel
+			# Find the first host in our chain (our address)
+			hops = 0
+			csock = channel.client.sock
+			while(csock.respond_to?('channel'))
+				csock = csock.channel.client.sock
+				hops += 1
+			end
+			tmp,caddr,cport = csock.getsockname
+			tmp,raddr,rport = csock.getpeername
+			maddr,mport = [ channel.params.localhost, channel.params.localport ]
+			[ tmp, "#{caddr}#{(hops > 0) ? "-_#{hops}_" : ""}-#{raddr}", "#{mport}" ]
+		end
+
+		def getpeername
+			return super if not channel
+			tmp,caddr,cport = channel.client.sock.getpeername
+			maddr,mport = [ channel.params.peerhost, channel.params.peerport ]
+			[ tmp, "#{maddr}", "#{mport}" ]
+		end
+
+		attr_accessor :channel
+	end
+
+	#
+	# Simple mixin for lsock in order to help avoid a ruby interpreter issue with ::Socket.pair
+	# Instead of writing to the lsock, reading from the rsock and then writing to the channel,
+	# we use this mixin to directly write to the channel.
+	#
+	# Note: This does not work with OpenSSL as OpenSSL is implemented natively and requires a real
+	# socket to write to and we cant intercept the sockets syswrite at a native level.
+	#
+	# Note: The deadlock only seems to effect the Ruby build for cygwin.
+	#
+	module DirectChannelWrite
+
+		def syswrite( buf )
+			channel._write( buf )
+		end
+
+		attr_accessor :channel
+	end
+
+	##
+	#
+	# Factory
+	#
+	##
+
+	#
+	# Opens a TCP client channel using the supplied parameters.
+	#
+	def TcpClientChannel.open(client, params)
+		c = Channel.create(client, 'stdapi_net_tcp_client', self, CHANNEL_FLAG_SYNCHRONOUS,
+			[
+				{
+					'type'  => TLV_TYPE_PEER_HOST,
+					'value' => params.peerhost
+				},
+				{
+					'type'  => TLV_TYPE_PEER_PORT,
+					'value' => params.peerport
+				},
+				{
+					'type'  => TLV_TYPE_LOCAL_HOST,
+					'value' => params.localhost
+				},
+				{
+					'type'  => TLV_TYPE_LOCAL_PORT,
+					'value' => params.localport
+				},
+				{
+					'type'  => TLV_TYPE_CONNECT_RETRIES,
+					'value' => params.retries
+				}
+			])
+		c.params = params
+		c
+	end
+
+	##
+	#
+	# Constructor
+	#
+	##
+
+	#
+	# Passes the channel initialization information up to the base class.
+	#
+	def initialize( client, cid, type, flags )
+		super( client, cid, type, flags )
+
+		lsock.extend( SocketInterface )
+		lsock.extend( DirectChannelWrite )
+		lsock.channel = self
+
+		rsock.extend( SocketInterface )
+		rsock.channel = self
+
+	end
+
+	#
+	# Closes the write half of the connection.
+	#
+	def close_write
+		return shutdown(1)
+	end
+
+	#
+	# Shutdown the connection
+	#
+	# 0 -> future reads
+	# 1 -> future sends
+	# 2 -> both
+	#
+	def shutdown(how = 1)
+		request = Packet.create_request('stdapi_net_socket_tcp_shutdown')
+
+		request.add_tlv(TLV_TYPE_SHUTDOWN_HOW, how)
+		request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)
+
+		response = client.send_request(request)
+
+		return true
+	end
+
+	#
+	# Wrap the _write() call in order to catch some common, but harmless Windows exceptions
+	#
+	def _write(*args)
+		begin
+			super(*args)
+		rescue ::Rex::Post::Meterpreter::RequestError => e
+			case e.code
+			when 10000 .. 10100
+				raise ::Rex::ConnectionError.new
+			end
+		end
+	end
+end
+
+end; end; end; end; end; end; end
+

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb

@@ -0,0 +1,167 @@
+require 'timeout'
+require 'thread'
+require 'rex/socket/parameters'
+require 'rex/post/meterpreter/channels/stream'
+require 'rex/post/meterpreter/extensions/stdapi/tlv'
+require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Net
+module SocketSubsystem
+
+class TcpServerChannel < Rex::Post::Meterpreter::Channel
+	
+	#
+	# This is a class variable to store all pending client tcp connections which have not been passed
+	# off via a call to the respective server tcp channels accept method. The dictionary key is the
+	# tcp server channel instance and the values held are an array of pending tcp client channels 
+	# connected to the tcp server channel.
+	#
+	@@server_channels = {}
+	
+	class << self
+		include Rex::Post::Meterpreter::InboundPacketHandler
+		
+		#
+		# This is the request handler which is registerd to the respective meterpreter instance via
+		# Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket. All incoming requests from the meterpreter
+		# for a 'tcp_channel_open' will be processed here. We create a new TcpClientChannel for each request 
+		# received and store it in the respective tcp server channels list of new pending client channels.
+		# These new tcp client channels are passed off via a call the the tcp server channels accept() method.
+		#
+		def request_handler( client, packet )
+			
+			if( packet.method == "tcp_channel_open" )
+				
+				cid       = packet.get_tlv_value( TLV_TYPE_CHANNEL_ID )
+				pid       = packet.get_tlv_value( TLV_TYPE_CHANNEL_PARENTID )
+				localhost = packet.get_tlv_value( TLV_TYPE_LOCAL_HOST )
+				localport = packet.get_tlv_value( TLV_TYPE_LOCAL_PORT )
+				peerhost  = packet.get_tlv_value( TLV_TYPE_PEER_HOST )
+				peerport  = packet.get_tlv_value( TLV_TYPE_PEER_PORT )
+			
+				if( cid == nil or pid == nil )
+					return false
+				end
+				
+				server_channel = client.find_channel( pid )
+				if( server_channel == nil )
+					return false
+				end
+				
+				params = Rex::Socket::Parameters.from_hash( 
+					{ 
+						'Proto'     => 'tcp',
+						'LocalHost' => localhost,
+						'LocalPort' => localport,
+						'PeerHost'  => peerhost,
+						'PeerPort'  => peerport,
+						'Comm'      => server_channel.client
+					} 
+				)
+				
+				client_channel = TcpClientChannel.new( client, cid, TcpClientChannel, CHANNEL_FLAG_SYNCHRONOUS )
+				
+				client_channel.params = params
+				
+				if( @@server_channels[server_channel] == nil )
+					@@server_channels[server_channel] = [] 
+				end
+				
+				@@server_channels[server_channel] << client_channel
+				
+				return true
+			end
+			
+			return false
+		end
+		
+		def cls
+			return CHANNEL_CLASS_STREAM
+		end
+		
+	end
+	
+	#
+	# Open a new tcp server channel on the remote end.
+	#
+	def TcpServerChannel.open(client, params)
+		c = Channel.create(client, 'stdapi_net_tcp_server', self, CHANNEL_FLAG_SYNCHRONOUS,
+			[
+				{
+				'type'  => TLV_TYPE_LOCAL_HOST,
+				'value' => params.localhost
+				},
+				{
+				'type'  => TLV_TYPE_LOCAL_PORT,
+				'value' => params.localport
+				}
+			] )
+		c.params = params
+		c
+	end
+	
+	#
+	# Simply initilize this instance.
+	#
+	def initialize(client, cid, type, flags)
+		super(client, cid, type, flags)
+		# add this instance to the class variables dictionary of tcp server channels
+		@@server_channels[self] = []
+	end
+	
+	#
+	# Accept a new tcp client connection form this tcp server channel. This method does not block
+	# and returns nil if no new client connection is available.
+	#
+	def accept_nonblock
+		result = nil
+		if( @@server_channels[self].length > 0 )
+			channel = @@server_channels[self].shift
+			result = channel.lsock
+		end
+		return result
+	end
+	
+	#
+	# Accept a new tcp client connection form this tcp server channel. This method will block indefinatly
+	# if no timeout is specified.
+	#
+	def accept( opts={} )
+		timeout = opts['Timeout'] || -1
+		if( timeout == -1 )
+			result = _accept
+		else
+			begin
+				::Timeout.timeout( timeout ) {
+					result = _accept
+				}
+			rescue Timeout::Error
+				result = nil
+			end
+		end
+		return result
+	end
+
+protected
+
+	def _accept
+		while( true )  
+			if( @@server_channels[self].empty? )
+				Rex::ThreadSafe.sleep( 0.2 )
+				next
+			end
+			result = accept_nonblock
+			break if result != nil
+		end
+		return result
+	end
+
+end
+
+end; end; end; end; end; end; end
+

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb

@@ -0,0 +1,208 @@
+require 'timeout'
+require 'rex/sync/thread_safe'
+require 'rex/socket/udp'
+require 'rex/socket/parameters'
+require 'rex/post/meterpreter/extensions/stdapi/tlv'
+require 'rex/post/meterpreter/channel'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Net
+module SocketSubsystem
+
+class UdpChannel < Rex::Post::Meterpreter::Channel
+
+	#
+	# We inclue Rex::Socket::Udp as this channel is effectivly a UDP socket.
+	#
+	include Rex::Socket::Udp
+
+	#
+	# We are a datagram channel.
+	#
+	class << self
+		def cls
+			return CHANNEL_CLASS_DATAGRAM
+		end
+	end
+
+	#
+	# Open a new UDP channel on the remote end. The local host/port are optional, if none are specified
+	# the remote end will bind to INADDR_ANY with a random port number. The peer host/port are also
+	# optional, if specified all default send(), write() call will sendto the specified peer. If no peer
+	# host/port is specified you must use sendto() and specify the remote peer you wish to send to. This
+	# effectivly lets us create bound/unbound and connected/unconnected UDP sockets with ease.
+	#
+	def UdpChannel.open(client, params)
+		c = Channel.create(client, 'stdapi_net_udp_client', self, CHANNEL_FLAG_SYNCHRONOUS,
+		[
+			{
+				'type'  => TLV_TYPE_LOCAL_HOST,
+				'value' => params.localhost
+			},
+			{
+				'type'  => TLV_TYPE_LOCAL_PORT,
+				'value' => params.localport
+			},
+			{
+				'type'  => TLV_TYPE_PEER_HOST,
+				'value' => params.peerhost
+			},
+			{
+				'type'  => TLV_TYPE_PEER_PORT,
+				'value' => params.peerport
+			}
+		] )
+		c.params = params
+		c
+	end
+
+	#
+	# Simply initialize this instance.
+	#
+	def initialize(client, cid, type, flags)
+		super(client, cid, type, flags)
+		# the instance variable that holds all incoming datagrams.
+		@datagrams = []
+	end
+
+	#
+	# We overwrite Rex::Socket::Udp.timed_read in order to avoid the call to Kernel.select
+	# which wont be of use as we are not a natively backed ::Socket or ::IO instance.
+	#
+	def timed_read( length=65535, timeout=def_read_timeout )
+		result = ''
+
+		begin
+			Timeout.timeout( timeout ) {
+				while( true )
+					if( @datagrams.empty? )
+						Rex::ThreadSafe.sleep( 0.2 )
+						next
+					end
+					result = self.read( length )
+					break
+				end
+			}
+		rescue Timeout::Error
+			result = ''
+		end
+
+		return result
+	end
+
+	#
+	# We overwrite Rex::Socket::Udp.recvfrom in order to correctly hand out the
+	# datagrams which the remote end of this channel has received and are in the
+	# queue.
+	#
+	def recvfrom( length=65535, timeout=def_read_timeout )
+		result = nil
+		# force a timeout on the wait for an incoming datagram
+		begin
+			Timeout.timeout( timeout ) {
+				while( true )
+					# wait untill we have at least one datagram in the queue
+					if( @datagrams.empty? )
+						Rex::ThreadSafe.sleep( 0.2 )
+						next
+					end
+					# grab the oldest datagram we have received...
+					result = @datagrams.shift
+					# break as we have a result...
+					break
+				end
+			}
+		rescue Timeout::Error
+			result = nil
+		end
+		# if no result return nothing
+		if( result == nil )
+			return [ '', nil, nil ]
+		end
+		# get the data from this datagram
+		data = result[0]
+		# if its only a partial read of this datagram, slice it, loosing the remainder.
+		result[0] = data[0,length-1] if data.length > length
+		# return the result in the form [ data, host, port ]
+		return result
+	end
+
+	#
+	# Overwrite the low level sysread to read data off our datagram queue. Calls
+	# to read() will end up calling this.
+	#
+	def sysread( length )
+		result = self.recvfrom( length )
+		return result[0]
+	end
+
+	#
+	# Overwrite the low level syswrite to write data to the remote end of the channel.
+	# Calls to write() will end up calling this.
+	#
+	def syswrite( buf )
+		return _write( buf )
+	end
+
+	#
+	# This function is called by Rex::Socket::Udp.sendto and writes data to a specified
+	# remote peer host/port via the remote end of the channel.
+	#
+	def send( buf, flags, saddr )
+		af, peerhost, peerport = Rex::Socket.from_sockaddr( saddr )
+
+		addends = [
+			{
+				'type'  => TLV_TYPE_PEER_HOST,
+				'value' => peerhost
+			},
+			{
+				'type'  => TLV_TYPE_PEER_PORT,
+				'value' => peerport
+			}
+		]
+
+		return _write( buf, buf.length, addends )
+	end
+
+	#
+	# The channels direct io write handler for any incoming data from the remote end
+	# of the channel. We extract the data and peer host/port, and save this to a queue
+	# of incoming datagrams which are passed out via calls to self.recvfrom()
+	#
+	def dio_write_handler( packet, data )
+
+		peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST )
+		peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT )
+
+		if( peerhost and peerport )
+			@datagrams << [ data, peerhost, peerport ]
+			return true
+		end
+
+		return false
+	end
+
+	#
+	# Wrap the _write() call in order to catch some common, but harmless Windows exceptions
+	#
+	def _write(*args)
+		begin
+			super(*args)
+		rescue ::Rex::Post::Meterpreter::RequestError => e
+			case e.code
+			when 10000 .. 10100
+				raise ::Rex::ConnectionError.new
+			end
+		end
+	end
+
+
+end
+
+end; end; end; end; end; end; end
+