librex 0.0.17 → 0.0.18

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb

@@ -1,180 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'thread'
-require 'rex/post/meterpreter/channel'
-require 'rex/post/meterpreter/channels/stream'
-require 'rex/post/meterpreter/extensions/stdapi/tlv'
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Stdapi
-module Net
-module SocketSubsystem
-
-###
-#
-# This class represents a logical TCP client connection
-# that is established from the remote machine and tunnelled
-# through the established meterpreter connection, similar to an
-# SSH port forward.
-#
-###
-class TcpClientChannel < Rex::Post::Meterpreter::Stream
-
-	class << self
-		def cls
-			return CHANNEL_CLASS_STREAM
-		end
-	end
-
-	module SocketInterface
-		def type?
-			'tcp'
-		end
-
-		def getsockname
-			return super if not channel
-			# Find the first host in our chain (our address)
-			hops = 0
-			csock = channel.client.sock
-			while(csock.respond_to?('channel'))
-				csock = csock.channel.client.sock
-				hops += 1
-			end
-			tmp,caddr,cport = csock.getsockname
-			tmp,raddr,rport = csock.getpeername
-			maddr,mport = [ channel.params.localhost, channel.params.localport ]
-			[ tmp, "#{caddr}#{(hops > 0) ? "-_#{hops}_" : ""}-#{raddr}", "#{mport}" ]
-		end
-
-		def getpeername
-			return super if not channel
-			tmp,caddr,cport = channel.client.sock.getpeername
-			maddr,mport = [ channel.params.peerhost, channel.params.peerport ]
-			[ tmp, "#{maddr}", "#{mport}" ]
-		end
-
-		attr_accessor :channel
-	end
-
-	#
-	# Simple mixin for lsock in order to help avoid a ruby interpreter issue with ::Socket.pair
-	# Instead of writing to the lsock, reading from the rsock and then writing to the channel,
-	# we use this mixin to directly write to the channel.
-	#
-	# Note: This does not work with OpenSSL as OpenSSL is implemented natively and requires a real
-	# socket to write to and we cant intercept the sockets syswrite at a native level.
-	#
-	# Note: The deadlock only seems to effect the Ruby build for cygwin.
-	#
-	module DirectChannelWrite
-
-		def syswrite( buf )
-			channel._write( buf )
-		end
-
-		attr_accessor :channel
-	end
-
-	##
-	#
-	# Factory
-	#
-	##
-
-	#
-	# Opens a TCP client channel using the supplied parameters.
-	#
-	def TcpClientChannel.open(client, params)
-		c = Channel.create(client, 'stdapi_net_tcp_client', self, CHANNEL_FLAG_SYNCHRONOUS,
-			[
-				{
-					'type'  => TLV_TYPE_PEER_HOST,
-					'value' => params.peerhost
-				},
-				{
-					'type'  => TLV_TYPE_PEER_PORT,
-					'value' => params.peerport
-				},
-				{
-					'type'  => TLV_TYPE_LOCAL_HOST,
-					'value' => params.localhost
-				},
-				{
-					'type'  => TLV_TYPE_LOCAL_PORT,
-					'value' => params.localport
-				},
-				{
-					'type'  => TLV_TYPE_CONNECT_RETRIES,
-					'value' => params.retries
-				}
-			])
-		c.params = params
-		c
-	end
-
-	##
-	#
-	# Constructor
-	#
-	##
-
-	#
-	# Passes the channel initialization information up to the base class.
-	#
-	def initialize( client, cid, type, flags )
-		super( client, cid, type, flags )
-
-		lsock.extend( SocketInterface )
-		lsock.extend( DirectChannelWrite )
-		lsock.channel = self
-
-		rsock.extend( SocketInterface )
-		rsock.channel = self
-
-	end
-
-	#
-	# Closes the write half of the connection.
-	#
-	def close_write
-		return shutdown(1)
-	end
-
-	#
-	# Shutdown the connection
-	#
-	# 0 -> future reads
-	# 1 -> future sends
-	# 2 -> both
-	#
-	def shutdown(how = 1)
-		request = Packet.create_request('stdapi_net_socket_tcp_shutdown')
-
-		request.add_tlv(TLV_TYPE_SHUTDOWN_HOW, how)
-		request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)
-
-		response = client.send_request(request)
-
-		return true
-	end
-
-	#
-	# Wrap the _write() call in order to catch some common, but harmless Windows exceptions
-	#
-	def _write(*args)
-		begin
-			super(*args)
-		rescue ::Rex::Post::Meterpreter::RequestError => e
-			case e.code
-			when 10000 .. 10100
-				raise ::Rex::ConnectionError.new
-			end
-		end
-	end
-end
-
-end; end; end; end; end; end; end
-

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb

@@ -1,167 +0,0 @@
-require 'timeout'
-require 'thread'
-require 'rex/socket/parameters'
-require 'rex/post/meterpreter/channels/stream'
-require 'rex/post/meterpreter/extensions/stdapi/tlv'
-require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel'
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Stdapi
-module Net
-module SocketSubsystem
-
-class TcpServerChannel < Rex::Post::Meterpreter::Channel
-	
-	#
-	# This is a class variable to store all pending client tcp connections which have not been passed
-	# off via a call to the respective server tcp channels accept method. The dictionary key is the
-	# tcp server channel instance and the values held are an array of pending tcp client channels 
-	# connected to the tcp server channel.
-	#
-	@@server_channels = {}
-	
-	class << self
-		include Rex::Post::Meterpreter::InboundPacketHandler
-		
-		#
-		# This is the request handler which is registerd to the respective meterpreter instance via
-		# Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket. All incoming requests from the meterpreter
-		# for a 'tcp_channel_open' will be processed here. We create a new TcpClientChannel for each request 
-		# received and store it in the respective tcp server channels list of new pending client channels.
-		# These new tcp client channels are passed off via a call the the tcp server channels accept() method.
-		#
-		def request_handler( client, packet )
-			
-			if( packet.method == "tcp_channel_open" )
-				
-				cid       = packet.get_tlv_value( TLV_TYPE_CHANNEL_ID )
-				pid       = packet.get_tlv_value( TLV_TYPE_CHANNEL_PARENTID )
-				localhost = packet.get_tlv_value( TLV_TYPE_LOCAL_HOST )
-				localport = packet.get_tlv_value( TLV_TYPE_LOCAL_PORT )
-				peerhost  = packet.get_tlv_value( TLV_TYPE_PEER_HOST )
-				peerport  = packet.get_tlv_value( TLV_TYPE_PEER_PORT )
-			
-				if( cid == nil or pid == nil )
-					return false
-				end
-				
-				server_channel = client.find_channel( pid )
-				if( server_channel == nil )
-					return false
-				end
-				
-				params = Rex::Socket::Parameters.from_hash( 
-					{ 
-						'Proto'     => 'tcp',
-						'LocalHost' => localhost,
-						'LocalPort' => localport,
-						'PeerHost'  => peerhost,
-						'PeerPort'  => peerport,
-						'Comm'      => server_channel.client
-					} 
-				)
-				
-				client_channel = TcpClientChannel.new( client, cid, TcpClientChannel, CHANNEL_FLAG_SYNCHRONOUS )
-				
-				client_channel.params = params
-				
-				if( @@server_channels[server_channel] == nil )
-					@@server_channels[server_channel] = [] 
-				end
-				
-				@@server_channels[server_channel] << client_channel
-				
-				return true
-			end
-			
-			return false
-		end
-		
-		def cls
-			return CHANNEL_CLASS_STREAM
-		end
-		
-	end
-	
-	#
-	# Open a new tcp server channel on the remote end.
-	#
-	def TcpServerChannel.open(client, params)
-		c = Channel.create(client, 'stdapi_net_tcp_server', self, CHANNEL_FLAG_SYNCHRONOUS,
-			[
-				{
-				'type'  => TLV_TYPE_LOCAL_HOST,
-				'value' => params.localhost
-				},
-				{
-				'type'  => TLV_TYPE_LOCAL_PORT,
-				'value' => params.localport
-				}
-			] )
-		c.params = params
-		c
-	end
-	
-	#
-	# Simply initilize this instance.
-	#
-	def initialize(client, cid, type, flags)
-		super(client, cid, type, flags)
-		# add this instance to the class variables dictionary of tcp server channels
-		@@server_channels[self] = []
-	end
-	
-	#
-	# Accept a new tcp client connection form this tcp server channel. This method does not block
-	# and returns nil if no new client connection is available.
-	#
-	def accept_nonblock
-		result = nil
-		if( @@server_channels[self].length > 0 )
-			channel = @@server_channels[self].shift
-			result = channel.lsock
-		end
-		return result
-	end
-	
-	#
-	# Accept a new tcp client connection form this tcp server channel. This method will block indefinatly
-	# if no timeout is specified.
-	#
-	def accept( opts={} )
-		timeout = opts['Timeout'] || -1
-		if( timeout == -1 )
-			result = _accept
-		else
-			begin
-				::Timeout.timeout( timeout ) {
-					result = _accept
-				}
-			rescue Timeout::Error
-				result = nil
-			end
-		end
-		return result
-	end
-
-protected
-
-	def _accept
-		while( true )  
-			if( @@server_channels[self].empty? )
-				Rex::ThreadSafe.sleep( 0.2 )
-				next
-			end
-			result = accept_nonblock
-			break if result != nil
-		end
-		return result
-	end
-
-end
-
-end; end; end; end; end; end; end
-

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb

@@ -1,208 +0,0 @@
-require 'timeout'
-require 'rex/sync/thread_safe'
-require 'rex/socket/udp'
-require 'rex/socket/parameters'
-require 'rex/post/meterpreter/extensions/stdapi/tlv'
-require 'rex/post/meterpreter/channel'
-
-module Rex
-module Post
-module Meterpreter
-module Extensions
-module Stdapi
-module Net
-module SocketSubsystem
-
-class UdpChannel < Rex::Post::Meterpreter::Channel
-
-	#
-	# We inclue Rex::Socket::Udp as this channel is effectivly a UDP socket.
-	#
-	include Rex::Socket::Udp
-
-	#
-	# We are a datagram channel.
-	#
-	class << self
-		def cls
-			return CHANNEL_CLASS_DATAGRAM
-		end
-	end
-
-	#
-	# Open a new UDP channel on the remote end. The local host/port are optional, if none are specified
-	# the remote end will bind to INADDR_ANY with a random port number. The peer host/port are also
-	# optional, if specified all default send(), write() call will sendto the specified peer. If no peer
-	# host/port is specified you must use sendto() and specify the remote peer you wish to send to. This
-	# effectivly lets us create bound/unbound and connected/unconnected UDP sockets with ease.
-	#
-	def UdpChannel.open(client, params)
-		c = Channel.create(client, 'stdapi_net_udp_client', self, CHANNEL_FLAG_SYNCHRONOUS,
-		[
-			{
-				'type'  => TLV_TYPE_LOCAL_HOST,
-				'value' => params.localhost
-			},
-			{
-				'type'  => TLV_TYPE_LOCAL_PORT,
-				'value' => params.localport
-			},
-			{
-				'type'  => TLV_TYPE_PEER_HOST,
-				'value' => params.peerhost
-			},
-			{
-				'type'  => TLV_TYPE_PEER_PORT,
-				'value' => params.peerport
-			}
-		] )
-		c.params = params
-		c
-	end
-
-	#
-	# Simply initialize this instance.
-	#
-	def initialize(client, cid, type, flags)
-		super(client, cid, type, flags)
-		# the instance variable that holds all incoming datagrams.
-		@datagrams = []
-	end
-
-	#
-	# We overwrite Rex::Socket::Udp.timed_read in order to avoid the call to Kernel.select
-	# which wont be of use as we are not a natively backed ::Socket or ::IO instance.
-	#
-	def timed_read( length=65535, timeout=def_read_timeout )
-		result = ''
-
-		begin
-			Timeout.timeout( timeout ) {
-				while( true )
-					if( @datagrams.empty? )
-						Rex::ThreadSafe.sleep( 0.2 )
-						next
-					end
-					result = self.read( length )
-					break
-				end
-			}
-		rescue Timeout::Error
-			result = ''
-		end
-
-		return result
-	end
-
-	#
-	# We overwrite Rex::Socket::Udp.recvfrom in order to correctly hand out the
-	# datagrams which the remote end of this channel has received and are in the
-	# queue.
-	#
-	def recvfrom( length=65535, timeout=def_read_timeout )
-		result = nil
-		# force a timeout on the wait for an incoming datagram
-		begin
-			Timeout.timeout( timeout ) {
-				while( true )
-					# wait untill we have at least one datagram in the queue
-					if( @datagrams.empty? )
-						Rex::ThreadSafe.sleep( 0.2 )
-						next
-					end
-					# grab the oldest datagram we have received...
-					result = @datagrams.shift
-					# break as we have a result...
-					break
-				end
-			}
-		rescue Timeout::Error
-			result = nil
-		end
-		# if no result return nothing
-		if( result == nil )
-			return [ '', nil, nil ]
-		end
-		# get the data from this datagram
-		data = result[0]
-		# if its only a partial read of this datagram, slice it, loosing the remainder.
-		result[0] = data[0,length-1] if data.length > length
-		# return the result in the form [ data, host, port ]
-		return result
-	end
-
-	#
-	# Overwrite the low level sysread to read data off our datagram queue. Calls
-	# to read() will end up calling this.
-	#
-	def sysread( length )
-		result = self.recvfrom( length )
-		return result[0]
-	end
-
-	#
-	# Overwrite the low level syswrite to write data to the remote end of the channel.
-	# Calls to write() will end up calling this.
-	#
-	def syswrite( buf )
-		return _write( buf )
-	end
-
-	#
-	# This function is called by Rex::Socket::Udp.sendto and writes data to a specified
-	# remote peer host/port via the remote end of the channel.
-	#
-	def send( buf, flags, saddr )
-		af, peerhost, peerport = Rex::Socket.from_sockaddr( saddr )
-
-		addends = [
-			{
-				'type'  => TLV_TYPE_PEER_HOST,
-				'value' => peerhost
-			},
-			{
-				'type'  => TLV_TYPE_PEER_PORT,
-				'value' => peerport
-			}
-		]
-
-		return _write( buf, buf.length, addends )
-	end
-
-	#
-	# The channels direct io write handler for any incoming data from the remote end
-	# of the channel. We extract the data and peer host/port, and save this to a queue
-	# of incoming datagrams which are passed out via calls to self.recvfrom()
-	#
-	def dio_write_handler( packet, data )
-
-		peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST )
-		peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT )
-
-		if( peerhost and peerport )
-			@datagrams << [ data, peerhost, peerport ]
-			return true
-		end
-
-		return false
-	end
-
-	#
-	# Wrap the _write() call in order to catch some common, but harmless Windows exceptions
-	#
-	def _write(*args)
-		begin
-			super(*args)
-		rescue ::Rex::Post::Meterpreter::RequestError => e
-			case e.code
-			when 10000 .. 10100
-				raise ::Rex::ConnectionError.new
-			end
-		end
-	end
-
-
-end
-
-end; end; end; end; end; end; end
-