librex 0.0.17 → 0.0.18

Sign up to get free protection for your applications and to get access to all the features.
Files changed (435) hide show
  1. data/README.markdown +1 -1
  2. metadata +3 -436
  3. data/lib/rex/LICENSE +0 -29
  4. data/lib/rex/arch.rb +0 -103
  5. data/lib/rex/arch/sparc.rb +0 -75
  6. data/lib/rex/arch/sparc.rb.ut.rb +0 -18
  7. data/lib/rex/arch/x86.rb +0 -513
  8. data/lib/rex/arch/x86.rb.ut.rb +0 -93
  9. data/lib/rex/assembly/nasm.rb +0 -104
  10. data/lib/rex/assembly/nasm.rb.ut.rb +0 -22
  11. data/lib/rex/codepage.map +0 -104
  12. data/lib/rex/compat.rb +0 -311
  13. data/lib/rex/constants.rb +0 -113
  14. data/lib/rex/elfparsey.rb +0 -11
  15. data/lib/rex/elfparsey/elf.rb +0 -123
  16. data/lib/rex/elfparsey/elfbase.rb +0 -258
  17. data/lib/rex/elfparsey/exceptions.rb +0 -27
  18. data/lib/rex/elfscan.rb +0 -12
  19. data/lib/rex/elfscan/scanner.rb +0 -207
  20. data/lib/rex/elfscan/search.rb +0 -46
  21. data/lib/rex/encoder/alpha2.rb +0 -31
  22. data/lib/rex/encoder/alpha2/alpha_mixed.rb +0 -68
  23. data/lib/rex/encoder/alpha2/alpha_upper.rb +0 -79
  24. data/lib/rex/encoder/alpha2/generic.rb +0 -114
  25. data/lib/rex/encoder/alpha2/unicode_mixed.rb +0 -117
  26. data/lib/rex/encoder/alpha2/unicode_upper.rb +0 -129
  27. data/lib/rex/encoder/ndr.rb +0 -89
  28. data/lib/rex/encoder/ndr.rb.ut.rb +0 -44
  29. data/lib/rex/encoder/nonalpha.rb +0 -61
  30. data/lib/rex/encoder/nonupper.rb +0 -64
  31. data/lib/rex/encoder/xdr.rb +0 -106
  32. data/lib/rex/encoder/xdr.rb.ut.rb +0 -29
  33. data/lib/rex/encoder/xor.rb +0 -69
  34. data/lib/rex/encoder/xor/dword.rb +0 -13
  35. data/lib/rex/encoder/xor/dword_additive.rb +0 -13
  36. data/lib/rex/encoders/xor_dword.rb +0 -35
  37. data/lib/rex/encoders/xor_dword_additive.rb +0 -53
  38. data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +0 -12
  39. data/lib/rex/encoding/xor.rb +0 -20
  40. data/lib/rex/encoding/xor.rb.ts.rb +0 -14
  41. data/lib/rex/encoding/xor/byte.rb +0 -15
  42. data/lib/rex/encoding/xor/byte.rb.ut.rb +0 -21
  43. data/lib/rex/encoding/xor/dword.rb +0 -21
  44. data/lib/rex/encoding/xor/dword.rb.ut.rb +0 -15
  45. data/lib/rex/encoding/xor/dword_additive.rb +0 -92
  46. data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +0 -15
  47. data/lib/rex/encoding/xor/exceptions.rb +0 -17
  48. data/lib/rex/encoding/xor/generic.rb +0 -146
  49. data/lib/rex/encoding/xor/generic.rb.ut.rb +0 -120
  50. data/lib/rex/encoding/xor/qword.rb +0 -15
  51. data/lib/rex/encoding/xor/word.rb +0 -21
  52. data/lib/rex/encoding/xor/word.rb.ut.rb +0 -13
  53. data/lib/rex/exceptions.rb +0 -275
  54. data/lib/rex/exceptions.rb.ut.rb +0 -44
  55. data/lib/rex/exploitation/cmdstager.rb +0 -9
  56. data/lib/rex/exploitation/cmdstager/base.rb +0 -175
  57. data/lib/rex/exploitation/cmdstager/debug_asm.rb +0 -142
  58. data/lib/rex/exploitation/cmdstager/debug_write.rb +0 -136
  59. data/lib/rex/exploitation/cmdstager/tftp.rb +0 -63
  60. data/lib/rex/exploitation/cmdstager/vbs.rb +0 -128
  61. data/lib/rex/exploitation/egghunter.rb +0 -277
  62. data/lib/rex/exploitation/egghunter.rb.ut.rb +0 -25
  63. data/lib/rex/exploitation/encryptjs.rb +0 -77
  64. data/lib/rex/exploitation/heaplib.js.b64 +0 -331
  65. data/lib/rex/exploitation/heaplib.rb +0 -94
  66. data/lib/rex/exploitation/javascriptosdetect.rb +0 -897
  67. data/lib/rex/exploitation/obfuscatejs.rb +0 -335
  68. data/lib/rex/exploitation/omelet.rb +0 -320
  69. data/lib/rex/exploitation/omelet.rb.ut.rb +0 -13
  70. data/lib/rex/exploitation/opcodedb.rb +0 -818
  71. data/lib/rex/exploitation/opcodedb.rb.ut.rb +0 -279
  72. data/lib/rex/exploitation/seh.rb +0 -92
  73. data/lib/rex/exploitation/seh.rb.ut.rb +0 -19
  74. data/lib/rex/file.rb +0 -112
  75. data/lib/rex/file.rb.ut.rb +0 -16
  76. data/lib/rex/image_source.rb +0 -12
  77. data/lib/rex/image_source/disk.rb +0 -60
  78. data/lib/rex/image_source/image_source.rb +0 -46
  79. data/lib/rex/image_source/memory.rb +0 -37
  80. data/lib/rex/io/bidirectional_pipe.rb +0 -157
  81. data/lib/rex/io/datagram_abstraction.rb +0 -35
  82. data/lib/rex/io/ring_buffer.rb +0 -364
  83. data/lib/rex/io/stream.rb +0 -319
  84. data/lib/rex/io/stream_abstraction.rb +0 -197
  85. data/lib/rex/io/stream_server.rb +0 -211
  86. data/lib/rex/job_container.rb +0 -187
  87. data/lib/rex/logging.rb +0 -4
  88. data/lib/rex/logging/log_dispatcher.rb +0 -179
  89. data/lib/rex/logging/log_sink.rb +0 -42
  90. data/lib/rex/logging/sinks/flatfile.rb +0 -55
  91. data/lib/rex/logging/sinks/stderr.rb +0 -43
  92. data/lib/rex/machparsey.rb +0 -9
  93. data/lib/rex/machparsey/exceptions.rb +0 -34
  94. data/lib/rex/machparsey/mach.rb +0 -209
  95. data/lib/rex/machparsey/machbase.rb +0 -408
  96. data/lib/rex/machscan.rb +0 -9
  97. data/lib/rex/machscan/scanner.rb +0 -217
  98. data/lib/rex/mime.rb +0 -9
  99. data/lib/rex/mime/header.rb +0 -77
  100. data/lib/rex/mime/message.rb +0 -144
  101. data/lib/rex/mime/part.rb +0 -20
  102. data/lib/rex/nop/opty2.rb +0 -108
  103. data/lib/rex/nop/opty2.rb.ut.rb +0 -23
  104. data/lib/rex/nop/opty2_tables.rb +0 -300
  105. data/lib/rex/ole.rb +0 -205
  106. data/lib/rex/ole/clsid.rb +0 -47
  107. data/lib/rex/ole/difat.rb +0 -141
  108. data/lib/rex/ole/directory.rb +0 -231
  109. data/lib/rex/ole/direntry.rb +0 -240
  110. data/lib/rex/ole/docs/dependencies.txt +0 -8
  111. data/lib/rex/ole/docs/references.txt +0 -1
  112. data/lib/rex/ole/fat.rb +0 -99
  113. data/lib/rex/ole/header.rb +0 -204
  114. data/lib/rex/ole/minifat.rb +0 -77
  115. data/lib/rex/ole/propset.rb +0 -144
  116. data/lib/rex/ole/samples/create_ole.rb +0 -27
  117. data/lib/rex/ole/samples/dir.rb +0 -35
  118. data/lib/rex/ole/samples/dump_stream.rb +0 -34
  119. data/lib/rex/ole/samples/ole_info.rb +0 -23
  120. data/lib/rex/ole/storage.rb +0 -395
  121. data/lib/rex/ole/stream.rb +0 -53
  122. data/lib/rex/ole/substorage.rb +0 -49
  123. data/lib/rex/ole/util.rb +0 -157
  124. data/lib/rex/parser/arguments.rb +0 -97
  125. data/lib/rex/parser/arguments.rb.ut.rb +0 -67
  126. data/lib/rex/parser/ini.rb +0 -185
  127. data/lib/rex/parser/ini.rb.ut.rb +0 -29
  128. data/lib/rex/parser/ip360_aspl_xml.rb +0 -102
  129. data/lib/rex/parser/ip360_xml.rb +0 -97
  130. data/lib/rex/parser/nessus_xml.rb +0 -118
  131. data/lib/rex/parser/netsparker_xml.rb +0 -94
  132. data/lib/rex/parser/nexpose_xml.rb +0 -136
  133. data/lib/rex/parser/nmap_xml.rb +0 -137
  134. data/lib/rex/parser/retina_xml.rb +0 -109
  135. data/lib/rex/payloads.rb +0 -1
  136. data/lib/rex/payloads/win32.rb +0 -2
  137. data/lib/rex/payloads/win32/common.rb +0 -26
  138. data/lib/rex/payloads/win32/kernel.rb +0 -53
  139. data/lib/rex/payloads/win32/kernel/common.rb +0 -54
  140. data/lib/rex/payloads/win32/kernel/migration.rb +0 -12
  141. data/lib/rex/payloads/win32/kernel/recovery.rb +0 -50
  142. data/lib/rex/payloads/win32/kernel/stager.rb +0 -194
  143. data/lib/rex/peparsey.rb +0 -12
  144. data/lib/rex/peparsey/exceptions.rb +0 -32
  145. data/lib/rex/peparsey/pe.rb +0 -212
  146. data/lib/rex/peparsey/pe_memdump.rb +0 -63
  147. data/lib/rex/peparsey/pebase.rb +0 -1680
  148. data/lib/rex/peparsey/section.rb +0 -136
  149. data/lib/rex/pescan.rb +0 -13
  150. data/lib/rex/pescan/analyze.rb +0 -309
  151. data/lib/rex/pescan/scanner.rb +0 -206
  152. data/lib/rex/pescan/search.rb +0 -56
  153. data/lib/rex/platforms.rb +0 -1
  154. data/lib/rex/platforms/windows.rb +0 -51
  155. data/lib/rex/poly.rb +0 -132
  156. data/lib/rex/poly/block.rb +0 -477
  157. data/lib/rex/poly/register.rb +0 -100
  158. data/lib/rex/poly/register/x86.rb +0 -40
  159. data/lib/rex/post.rb +0 -8
  160. data/lib/rex/post/dir.rb +0 -51
  161. data/lib/rex/post/file.rb +0 -172
  162. data/lib/rex/post/file_stat.rb +0 -220
  163. data/lib/rex/post/gen.pl +0 -13
  164. data/lib/rex/post/io.rb +0 -182
  165. data/lib/rex/post/meterpreter.rb +0 -4
  166. data/lib/rex/post/meterpreter/channel.rb +0 -445
  167. data/lib/rex/post/meterpreter/channel_container.rb +0 -54
  168. data/lib/rex/post/meterpreter/channels/pool.rb +0 -160
  169. data/lib/rex/post/meterpreter/channels/pools/file.rb +0 -62
  170. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +0 -103
  171. data/lib/rex/post/meterpreter/channels/stream.rb +0 -87
  172. data/lib/rex/post/meterpreter/client.rb +0 -364
  173. data/lib/rex/post/meterpreter/client_core.rb +0 -274
  174. data/lib/rex/post/meterpreter/dependencies.rb +0 -3
  175. data/lib/rex/post/meterpreter/extension.rb +0 -32
  176. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +0 -58
  177. data/lib/rex/post/meterpreter/extensions/espia/tlv.rb +0 -16
  178. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +0 -94
  179. data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb +0 -21
  180. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +0 -57
  181. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +0 -15
  182. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +0 -118
  183. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +0 -61
  184. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +0 -111
  185. data/lib/rex/post/meterpreter/extensions/priv/tlv.rb +0 -28
  186. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +0 -101
  187. data/lib/rex/post/meterpreter/extensions/sniffer/tlv.rb +0 -26
  188. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +0 -333
  189. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +0 -282
  190. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +0 -266
  191. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +0 -103
  192. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +0 -48
  193. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +0 -144
  194. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +0 -73
  195. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +0 -56
  196. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +0 -137
  197. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +0 -180
  198. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +0 -167
  199. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +0 -208
  200. data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +0 -6
  201. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +0 -38106
  202. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb +0 -31
  203. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +0 -47
  204. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +0 -36
  205. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +0 -1818
  206. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +0 -96
  207. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +0 -3848
  208. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +0 -26
  209. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +0 -153
  210. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +0 -21
  211. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +0 -3169
  212. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +0 -599
  213. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +0 -318
  214. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +0 -100
  215. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +0 -42
  216. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +0 -148
  217. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +0 -127
  218. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +0 -309
  219. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +0 -204
  220. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +0 -51
  221. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +0 -630
  222. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +0 -75
  223. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +0 -103
  224. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +0 -149
  225. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +0 -97
  226. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +0 -192
  227. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +0 -41
  228. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +0 -61
  229. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +0 -370
  230. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +0 -129
  231. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +0 -55
  232. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +0 -336
  233. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +0 -141
  234. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +0 -279
  235. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +0 -193
  236. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +0 -102
  237. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +0 -180
  238. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +0 -211
  239. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +0 -227
  240. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +0 -63
  241. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +0 -30
  242. data/lib/rex/post/meterpreter/object_aliases.rb +0 -83
  243. data/lib/rex/post/meterpreter/packet.rb +0 -688
  244. data/lib/rex/post/meterpreter/packet_dispatcher.rb +0 -431
  245. data/lib/rex/post/meterpreter/packet_parser.rb +0 -94
  246. data/lib/rex/post/meterpreter/packet_response_waiter.rb +0 -83
  247. data/lib/rex/post/meterpreter/ui/console.rb +0 -137
  248. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +0 -62
  249. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +0 -730
  250. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +0 -108
  251. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +0 -241
  252. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +0 -231
  253. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +0 -61
  254. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +0 -98
  255. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +0 -51
  256. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +0 -132
  257. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +0 -187
  258. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +0 -65
  259. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +0 -442
  260. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +0 -298
  261. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +0 -486
  262. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +0 -315
  263. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +0 -157
  264. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +0 -95
  265. data/lib/rex/post/permission.rb +0 -26
  266. data/lib/rex/post/process.rb +0 -57
  267. data/lib/rex/post/thread.rb +0 -57
  268. data/lib/rex/post/ui.rb +0 -52
  269. data/lib/rex/proto.rb +0 -13
  270. data/lib/rex/proto.rb.ts.rb +0 -8
  271. data/lib/rex/proto/dcerpc.rb +0 -6
  272. data/lib/rex/proto/dcerpc.rb.ts.rb +0 -9
  273. data/lib/rex/proto/dcerpc/client.rb +0 -361
  274. data/lib/rex/proto/dcerpc/client.rb.ut.rb +0 -491
  275. data/lib/rex/proto/dcerpc/exceptions.rb +0 -150
  276. data/lib/rex/proto/dcerpc/handle.rb +0 -47
  277. data/lib/rex/proto/dcerpc/handle.rb.ut.rb +0 -85
  278. data/lib/rex/proto/dcerpc/ndr.rb +0 -72
  279. data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +0 -41
  280. data/lib/rex/proto/dcerpc/packet.rb +0 -253
  281. data/lib/rex/proto/dcerpc/packet.rb.ut.rb +0 -56
  282. data/lib/rex/proto/dcerpc/response.rb +0 -187
  283. data/lib/rex/proto/dcerpc/response.rb.ut.rb +0 -15
  284. data/lib/rex/proto/dcerpc/uuid.rb +0 -84
  285. data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +0 -46
  286. data/lib/rex/proto/dhcp.rb +0 -7
  287. data/lib/rex/proto/dhcp/constants.rb +0 -33
  288. data/lib/rex/proto/dhcp/server.rb +0 -292
  289. data/lib/rex/proto/drda.rb +0 -5
  290. data/lib/rex/proto/drda.rb.ts.rb +0 -17
  291. data/lib/rex/proto/drda/constants.rb +0 -49
  292. data/lib/rex/proto/drda/constants.rb.ut.rb +0 -23
  293. data/lib/rex/proto/drda/packet.rb +0 -252
  294. data/lib/rex/proto/drda/packet.rb.ut.rb +0 -109
  295. data/lib/rex/proto/drda/utils.rb +0 -123
  296. data/lib/rex/proto/drda/utils.rb.ut.rb +0 -84
  297. data/lib/rex/proto/http.rb +0 -5
  298. data/lib/rex/proto/http.rb.ts.rb +0 -12
  299. data/lib/rex/proto/http/client.rb +0 -821
  300. data/lib/rex/proto/http/client.rb.ut.rb +0 -95
  301. data/lib/rex/proto/http/handler.rb +0 -46
  302. data/lib/rex/proto/http/handler/erb.rb +0 -128
  303. data/lib/rex/proto/http/handler/erb.rb.ut.rb +0 -21
  304. data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +0 -1
  305. data/lib/rex/proto/http/handler/proc.rb +0 -60
  306. data/lib/rex/proto/http/handler/proc.rb.ut.rb +0 -24
  307. data/lib/rex/proto/http/header.rb +0 -161
  308. data/lib/rex/proto/http/header.rb.ut.rb +0 -46
  309. data/lib/rex/proto/http/packet.rb +0 -407
  310. data/lib/rex/proto/http/packet.rb.ut.rb +0 -165
  311. data/lib/rex/proto/http/request.rb +0 -356
  312. data/lib/rex/proto/http/request.rb.ut.rb +0 -214
  313. data/lib/rex/proto/http/response.rb +0 -90
  314. data/lib/rex/proto/http/response.rb.ut.rb +0 -149
  315. data/lib/rex/proto/http/server.rb +0 -369
  316. data/lib/rex/proto/http/server.rb.ut.rb +0 -79
  317. data/lib/rex/proto/ntlm.rb +0 -7
  318. data/lib/rex/proto/ntlm.rb.ut.rb +0 -177
  319. data/lib/rex/proto/ntlm/base.rb +0 -326
  320. data/lib/rex/proto/ntlm/constants.rb +0 -74
  321. data/lib/rex/proto/ntlm/crypt.rb +0 -415
  322. data/lib/rex/proto/ntlm/exceptions.rb +0 -16
  323. data/lib/rex/proto/ntlm/message.rb +0 -536
  324. data/lib/rex/proto/ntlm/utils.rb +0 -764
  325. data/lib/rex/proto/proxy/socks4a.rb +0 -440
  326. data/lib/rex/proto/rfb.rb +0 -19
  327. data/lib/rex/proto/rfb.rb.ut.rb +0 -37
  328. data/lib/rex/proto/rfb/cipher.rb +0 -84
  329. data/lib/rex/proto/rfb/client.rb +0 -207
  330. data/lib/rex/proto/rfb/constants.rb +0 -52
  331. data/lib/rex/proto/smb.rb +0 -7
  332. data/lib/rex/proto/smb.rb.ts.rb +0 -8
  333. data/lib/rex/proto/smb/client.rb +0 -1952
  334. data/lib/rex/proto/smb/client.rb.ut.rb +0 -223
  335. data/lib/rex/proto/smb/constants.rb +0 -1047
  336. data/lib/rex/proto/smb/constants.rb.ut.rb +0 -18
  337. data/lib/rex/proto/smb/crypt.rb +0 -36
  338. data/lib/rex/proto/smb/evasions.rb +0 -66
  339. data/lib/rex/proto/smb/exceptions.rb +0 -858
  340. data/lib/rex/proto/smb/simpleclient.rb +0 -306
  341. data/lib/rex/proto/smb/simpleclient.rb.ut.rb +0 -128
  342. data/lib/rex/proto/smb/utils.rb +0 -103
  343. data/lib/rex/proto/smb/utils.rb.ut.rb +0 -20
  344. data/lib/rex/proto/sunrpc.rb +0 -1
  345. data/lib/rex/proto/sunrpc/client.rb +0 -195
  346. data/lib/rex/proto/tftp.rb +0 -12
  347. data/lib/rex/proto/tftp/constants.rb +0 -39
  348. data/lib/rex/proto/tftp/server.rb +0 -497
  349. data/lib/rex/proto/tftp/server.rb.ut.rb +0 -28
  350. data/lib/rex/script.rb +0 -42
  351. data/lib/rex/script/base.rb +0 -59
  352. data/lib/rex/script/meterpreter.rb +0 -15
  353. data/lib/rex/script/shell.rb +0 -9
  354. data/lib/rex/service.rb +0 -48
  355. data/lib/rex/service_manager.rb +0 -141
  356. data/lib/rex/service_manager.rb.ut.rb +0 -32
  357. data/lib/rex/services/local_relay.rb +0 -423
  358. data/lib/rex/socket.rb +0 -684
  359. data/lib/rex/socket.rb.ut.rb +0 -107
  360. data/lib/rex/socket/comm.rb +0 -119
  361. data/lib/rex/socket/comm/local.rb +0 -412
  362. data/lib/rex/socket/comm/local.rb.ut.rb +0 -75
  363. data/lib/rex/socket/ip.rb +0 -130
  364. data/lib/rex/socket/parameters.rb +0 -345
  365. data/lib/rex/socket/parameters.rb.ut.rb +0 -51
  366. data/lib/rex/socket/range_walker.rb +0 -346
  367. data/lib/rex/socket/range_walker.rb.ut.rb +0 -55
  368. data/lib/rex/socket/ssl_tcp.rb +0 -184
  369. data/lib/rex/socket/ssl_tcp.rb.ut.rb +0 -39
  370. data/lib/rex/socket/ssl_tcp_server.rb +0 -122
  371. data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +0 -61
  372. data/lib/rex/socket/subnet_walker.rb +0 -75
  373. data/lib/rex/socket/subnet_walker.rb.ut.rb +0 -28
  374. data/lib/rex/socket/switch_board.rb +0 -278
  375. data/lib/rex/socket/switch_board.rb.ut.rb +0 -52
  376. data/lib/rex/socket/tcp.rb +0 -76
  377. data/lib/rex/socket/tcp.rb.ut.rb +0 -64
  378. data/lib/rex/socket/tcp_server.rb +0 -66
  379. data/lib/rex/socket/tcp_server.rb.ut.rb +0 -44
  380. data/lib/rex/socket/udp.rb +0 -164
  381. data/lib/rex/socket/udp.rb.ut.rb +0 -44
  382. data/lib/rex/struct2.rb +0 -5
  383. data/lib/rex/struct2/c_struct.rb +0 -181
  384. data/lib/rex/struct2/c_struct_template.rb +0 -39
  385. data/lib/rex/struct2/constant.rb +0 -26
  386. data/lib/rex/struct2/element.rb +0 -44
  387. data/lib/rex/struct2/generic.rb +0 -73
  388. data/lib/rex/struct2/restraint.rb +0 -54
  389. data/lib/rex/struct2/s_string.rb +0 -72
  390. data/lib/rex/struct2/s_struct.rb +0 -111
  391. data/lib/rex/sync.rb +0 -6
  392. data/lib/rex/sync/event.rb +0 -94
  393. data/lib/rex/sync/read_write_lock.rb +0 -176
  394. data/lib/rex/sync/ref.rb +0 -57
  395. data/lib/rex/sync/thread_safe.rb +0 -82
  396. data/lib/rex/test.rb +0 -35
  397. data/lib/rex/text.rb +0 -1163
  398. data/lib/rex/text.rb.ut.rb +0 -190
  399. data/lib/rex/thread_factory.rb +0 -42
  400. data/lib/rex/time.rb +0 -65
  401. data/lib/rex/transformer.rb +0 -115
  402. data/lib/rex/transformer.rb.ut.rb +0 -38
  403. data/lib/rex/ui.rb +0 -21
  404. data/lib/rex/ui/interactive.rb +0 -298
  405. data/lib/rex/ui/output.rb +0 -78
  406. data/lib/rex/ui/output/none.rb +0 -18
  407. data/lib/rex/ui/progress_tracker.rb +0 -96
  408. data/lib/rex/ui/subscriber.rb +0 -149
  409. data/lib/rex/ui/text/color.rb +0 -97
  410. data/lib/rex/ui/text/color.rb.ut.rb +0 -18
  411. data/lib/rex/ui/text/dispatcher_shell.rb +0 -467
  412. data/lib/rex/ui/text/input.rb +0 -117
  413. data/lib/rex/ui/text/input/buffer.rb +0 -75
  414. data/lib/rex/ui/text/input/readline.rb +0 -129
  415. data/lib/rex/ui/text/input/socket.rb +0 -95
  416. data/lib/rex/ui/text/input/stdio.rb +0 -45
  417. data/lib/rex/ui/text/irb_shell.rb +0 -57
  418. data/lib/rex/ui/text/output.rb +0 -80
  419. data/lib/rex/ui/text/output/buffer.rb +0 -61
  420. data/lib/rex/ui/text/output/file.rb +0 -43
  421. data/lib/rex/ui/text/output/socket.rb +0 -43
  422. data/lib/rex/ui/text/output/stdio.rb +0 -40
  423. data/lib/rex/ui/text/progress_tracker.rb +0 -56
  424. data/lib/rex/ui/text/progress_tracker.rb.ut.rb +0 -34
  425. data/lib/rex/ui/text/shell.rb +0 -328
  426. data/lib/rex/ui/text/table.rb +0 -279
  427. data/lib/rex/ui/text/table.rb.ut.rb +0 -55
  428. data/lib/rex/zip.rb +0 -93
  429. data/lib/rex/zip/archive.rb +0 -184
  430. data/lib/rex/zip/blocks.rb +0 -182
  431. data/lib/rex/zip/entry.rb +0 -104
  432. data/lib/rex/zip/samples/comment.rb +0 -32
  433. data/lib/rex/zip/samples/mkwar.rb +0 -138
  434. data/lib/rex/zip/samples/mkzip.rb +0 -19
  435. data/lib/rex/zip/samples/recursive.rb +0 -58
@@ -1,148 +0,0 @@
1
- # Copyright (c) 2010, patrickHVE@googlemail.com
2
- # All rights reserved.
3
- #
4
- # Redistribution and use in source and binary forms, with or without
5
- # modification, are permitted provided that the following conditions are met:
6
- # * Redistributions of source code must retain the above copyright
7
- # notice, this list of conditions and the following disclaimer.
8
- # * Redistributions in binary form must reproduce the above copyright
9
- # notice, this list of conditions and the following disclaimer in the
10
- # documentation and/or other materials provided with the distribution.
11
- # * The names of the author may not be used to endorse or promote products
12
- # derived from this software without specific prior written permission.
13
- #
14
- # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
15
- # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16
- # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17
- # DISCLAIMED. IN NO EVENT SHALL patrickHVE@googlemail.com BE LIABLE FOR ANY
18
- # DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19
- # (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
20
- # LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
21
- # ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22
- # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
23
- # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24
-
25
- module Rex
26
- module Post
27
- module Meterpreter
28
- module Extensions
29
- module Stdapi
30
- module Railgun
31
-
32
- #
33
- # shared functions
34
- #
35
- #
36
- module DLLHelper
37
-
38
- # converts ruby string to zero-terminated ASCII string
39
- def str_to_ascii_z(str)
40
- return str+"\x00"
41
- end
42
-
43
- # converts 0-terminated ASCII string to ruby string
44
- def asciiz_to_str(asciiz)
45
- zero_byte_idx = asciiz.index("\x00")
46
- if zero_byte_idx != nil
47
- return asciiz[0, zero_byte_idx]
48
- else
49
- return asciiz
50
- end
51
- end
52
-
53
- # converts ruby string to zero-terminated WCHAR string
54
- def str_to_uni_z(str)
55
- enc = str.unpack("C*").pack("v*")
56
- enc += "\x00\x00"
57
- return enc
58
- end
59
-
60
- # converts 0-terminated UTF16 to ruby string
61
- def uniz_to_str(uniz)
62
- uniz.unpack("v*").pack("C*").unpack("A*")[0]
63
- end
64
-
65
- # parses a number param and returns the value
66
- # raises an exception if the param cannot be converted to a number
67
- # examples:
68
- # nil => 0
69
- # 3 => 3
70
- # "MB_OK" => 0
71
- # "SOME_CONSTANT | OTHER_CONSTANT" => 17
72
- # "tuna" => !!!!!!!!!!Exception
73
- #
74
- # Parameter "win_consts" is a WinConstantManager
75
- def param_to_number(v, win_consts = @win_consts)
76
- if v.class == NilClass then
77
- return 0
78
- elsif v.class == Fixnum then
79
- return v # ok, it's already a number
80
- elsif v.class == Bignum then
81
- return v # ok, it's already a number
82
- elsif v.class == String then
83
- dw = win_consts.parse(v) # might raise an exception
84
- if dw != nil
85
- return dw
86
- else
87
- raise ArgumentError, "Param #{v} (class #{v.class}) cannot be converted to a number. It's a string but matches no constants I know."
88
- end
89
- else
90
- raise "Param #{v} (class #{v.class}) should be a number but isn't"
91
- end
92
- end
93
-
94
- # assembles the buffers "in" and "inout"
95
- def assemble_buffer(direction, function, args)
96
- layout = {} # paramName => BufferItem
97
- blob = ""
98
- #puts " building buffer: #{direction}"
99
- function.params.each_with_index do |param_desc, param_idx|
100
- #puts " processing #{param_desc[0]} #{param_desc[1]} #{param_desc[2]}"
101
- # we care only about inout buffers
102
- if param_desc[2] == direction
103
- buffer = nil
104
- # Special case:
105
- # The user can choose to supply a Null pointer instead of a buffer
106
- # in this case we don't need space in any heap buffer
107
- if param_desc[0][0,1] == 'P' # type is a pointer
108
- if args[param_idx] == nil
109
- next
110
- end
111
- end
112
-
113
- case param_desc[0] # required argument type
114
- when "PDWORD"
115
- dw = param_to_number(args[param_idx])
116
- buffer = [dw].pack('V')
117
- when "PWCHAR"
118
- raise "param #{param_desc[1]}: string expected" unless args[param_idx].class == String
119
- buffer = str_to_uni_z(args[param_idx])
120
- when "PCHAR"
121
- raise "param #{param_desc[1]}: string expected" unless args[param_idx].class == String
122
- buffer = str_to_ascii_z(args[param_idx])
123
- when "PBLOB"
124
- raise "param #{param_desc[1]}: please supply your BLOB as string!" unless args[param_idx].class == String
125
- buffer = args[param_idx]
126
- # other types (non-pointers) don't reference buffers
127
- # and don't need any treatment here
128
- end
129
-
130
- if buffer != nil
131
- #puts " adding #{buffer.length} bytes to heap blob"
132
- layout[param_desc[1]] = BufferItem.new(param_idx, blob.length, buffer.length, param_desc[0])
133
- blob += buffer
134
- # sf: force 8 byte alignment to satisfy x64, wont matter on x86.
135
- while( blob.length % 8 != 0 )
136
- blob += "\x00"
137
- end
138
- #puts " heap blob size now #{blob.length}"
139
- end
140
- end
141
- end
142
- #puts " built buffer: #{direction}"
143
- return [layout, blob]
144
- end
145
-
146
- end
147
-
148
- end; end; end; end; end; end;
@@ -1,127 +0,0 @@
1
- #!/usr/bin/env ruby
2
-
3
- $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
4
-
5
- require 'rex/post/meterpreter/extensions/stdapi/railgun/dll_helper'
6
- require 'rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager'
7
- require 'rex/text'
8
- require 'test/unit'
9
-
10
- module Rex
11
- module Post
12
- module Meterpreter
13
- module Extensions
14
- module Stdapi
15
- module Railgun
16
- class DLLHelper::UnitTest < Test::Unit::TestCase
17
-
18
- ###
19
- # We will test against this instance of DLLHelper (a module)
20
- #
21
- # We freeze the instance and make the reference constant to ensure consistency
22
- ##
23
- TEST_DLL_HELPER = Object.new.extend(DLLHelper).freeze
24
-
25
- def test_str_to_ascii_z
26
- original_string = '23 Skidoo!'
27
-
28
- # converts ruby string to zero-terminated ASCII string
29
- zero_terminated_ascii_attempt = TEST_DLL_HELPER.str_to_ascii_z(original_string)
30
-
31
- assert(zero_terminated_ascii_attempt.end_with?("\x00"),
32
- "str_to_ascii_z should result in a 0 terminated string")
33
-
34
- assert(zero_terminated_ascii_attempt.start_with?(original_string),
35
- "str_to_ascii_z should still start with original string")
36
-
37
- assert_equal(original_string.length + 1, zero_terminated_ascii_attempt.length,
38
- "str_to_ascii_z should have length of original pluss room for a terminal 0")
39
- end
40
-
41
- def test_asciiz_to_str
42
- target_string = '23 Skidoo!'
43
- post_zero_noise = 'Loud noises!'
44
- zero_terminated_string = target_string + "\x00" + post_zero_noise
45
-
46
- actual_string = TEST_DLL_HELPER.asciiz_to_str(zero_terminated_string)
47
-
48
- assert(actual_string.start_with?(target_string),
49
- "asciiz_to_str should preserve string before zero")
50
-
51
- assert(!actual_string.end_with?(post_zero_noise),
52
- "asciiz_to_str should ignore characters after zero")
53
-
54
- assert_equal(target_string, actual_string,
55
- "asciiz_to_str should only return the contents of the string before (exclusive) the zero")
56
-
57
- assert_equal(target_string, TEST_DLL_HELPER.asciiz_to_str(target_string),
58
- "asciiz_to_str should return input verbatim should that input not be zero-terminated")
59
-
60
- end
61
-
62
- def test_str_to_uni_z
63
- ruby_string = "If I were a rich man..."
64
-
65
- target_zero_terminated_unicode = Rex::Text.to_unicode(ruby_string) + "\x00\x00"
66
- actual_zero_terminated_unicode = TEST_DLL_HELPER.str_to_uni_z(ruby_string)
67
-
68
- assert(actual_zero_terminated_unicode.end_with?("\x00\x00"),
69
- "str_to_uni_z should result in a double-zero terminated string")
70
-
71
- assert_equal(target_zero_terminated_unicode, actual_zero_terminated_unicode,
72
- "str_to_uni_z should convert ruby string to zero-terminated WCHAR string")
73
- end
74
-
75
- def test_uniz_to_str
76
- target_string = 'Foo bar baz'
77
-
78
- zero_terminated_unicode = Rex::Text.to_unicode(target_string) + "\x00\x00"
79
-
80
- assert_equal(target_string, TEST_DLL_HELPER.uniz_to_str(zero_terminated_unicode),
81
- 'uniz_to_str should convert 0-terminated UTF16 to ruby string')
82
-
83
- end
84
-
85
- def test_assemble_buffer
86
- # TODO: provide test coverage
87
- #skip("Currently DLLHelper.assemble_buffer does not have coverage")
88
- end
89
-
90
- def test_param_to_number
91
- consts_manager = WinConstManager.new
92
-
93
- x_key = 'X'
94
- x_value = 23
95
-
96
- y_key = 'Y'
97
- y_value = 5
98
-
99
- logical_or = x_key + '|' + y_key
100
- target_result_of_logical_or = x_value | y_value
101
-
102
- consts_manager.add_const(y_key, y_value)
103
- consts_manager.add_const(x_key, x_value)
104
-
105
- assert_equal(x_value, TEST_DLL_HELPER.param_to_number(x_key, consts_manager),
106
- "param_to_number should return the appropriate value for a given constant")
107
-
108
- assert_equal(y_value, TEST_DLL_HELPER.param_to_number(y_key, consts_manager),
109
- "param_to_number should return the appropriate value for a given constant")
110
-
111
- assert_equal(0, TEST_DLL_HELPER.param_to_number(nil, consts_manager),
112
- "param_to_number should return zero when given nil")
113
-
114
- assert_equal(target_result_of_logical_or, TEST_DLL_HELPER.param_to_number(logical_or, consts_manager),
115
- "param_to_number should perform an OR should the input be in the form '#{logical_or}'")
116
-
117
- assert_raise(ArgumentError, 'param_to_number should raise an error when a given key does not exist') do
118
- TEST_DLL_HELPER.param_to_number('DOESNT_EXIST', consts_manager)
119
- end
120
- end
121
- end
122
- end
123
- end
124
- end
125
- end
126
- end
127
- end
@@ -1,309 +0,0 @@
1
- # Copyright (c) 2010, patrickHVE@googlemail.com
2
- # All rights reserved.
3
- #
4
- # Redistribution and use in source and binary forms, with or without
5
- # modification, are permitted provided that the following conditions are met:
6
- # * Redistributions of source code must retain the above copyright
7
- # notice, this list of conditions and the following disclaimer.
8
- # * Redistributions in binary form must reproduce the above copyright
9
- # notice, this list of conditions and the following disclaimer in the
10
- # documentation and/or other materials provided with the distribution.
11
- # * The names of the author may not be used to endorse or promote products
12
- # derived from this software without specific prior written permission.
13
- #
14
- # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
15
- # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16
- # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17
- # DISCLAIMED. IN NO EVENT SHALL patrickHVE@googlemail.com BE LIABLE FOR ANY
18
- # DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19
- # (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
20
- # LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
21
- # ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22
- # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
23
- # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24
-
25
- require 'pp'
26
- require 'enumerator'
27
- require 'rex/post/meterpreter/extensions/stdapi/railgun/api_constants'
28
- require 'rex/post/meterpreter/extensions/stdapi/railgun/tlv'
29
- require 'rex/post/meterpreter/extensions/stdapi/railgun/dll_helper'
30
- require 'rex/post/meterpreter/extensions/stdapi/railgun/buffer_item'
31
-
32
- module Rex
33
- module Post
34
- module Meterpreter
35
- module Extensions
36
- module Stdapi
37
- module Railgun
38
-
39
- # A easier way to call multiple functions in a single request
40
- class MultiCaller
41
-
42
- include DLLHelper
43
-
44
- def initialize( client, parent, win_consts )
45
- @parent = parent
46
- @client = client
47
- @win_consts = win_consts
48
- if( @client.platform =~ /x64/i )
49
- @native = 'Q'
50
- else
51
- @native = 'V'
52
- end
53
- end
54
-
55
- def call(functions)
56
-
57
- request = Packet.create_request('stdapi_railgun_api_multi')
58
- function_results = []
59
- layouts = []
60
- functions.each do |f|
61
- dll_name,funcname,args = f
62
- dll_host = @parent.get_dll( dll_name )
63
-
64
- if not dll_host
65
- raise "DLL #{dll_name} has not been loaded"
66
- end
67
-
68
- function = dll_host.functions[funcname]
69
- if not function
70
- raise "DLL #{dll_name} function #{funcname} has not been defined"
71
- end
72
-
73
- raise "#{function.params.length} arguments expected. #{args.length} arguments provided." unless args.length == function.params.length
74
- #puts "process_function_call(function.windows_name,#{PP.pp(args, "")})"
75
-
76
- # We transmit the immediate stack and three heap-buffers:
77
- # in, inout and out. The reason behind the separation is bandwidth.
78
- # We don't want to transmit uninitialized data in or no-longer-needed data out.
79
-
80
- # out-only-buffers that are ONLY transmitted on the way BACK
81
- out_only_layout = {} # paramName => BufferItem
82
- out_only_size_bytes = 0
83
- #puts " assembling out-only buffer"
84
- function.params.each_with_index do |param_desc, param_idx|
85
- #puts " processing #{param_desc[1]}"
86
-
87
- # Special case:
88
- # The user can choose to supply a Null pointer instead of a buffer
89
- # in this case we don't need space in any heap buffer
90
- if param_desc[0][0,1] == 'P' # type is a pointer
91
- if args[param_idx] == nil
92
- next
93
- end
94
- end
95
-
96
- # we care only about out-only buffers
97
- if param_desc[2] == "out"
98
- raise "error in param #{param_desc[1]}: Out-only buffers must be described by a number indicating their size in bytes " unless args[param_idx].class == Fixnum
99
- buffer_size = args[param_idx]
100
- # bump up the size for an x64 pointer
101
- if( @native == 'Q' and buffer_size == 4 )
102
- args[param_idx] = 8
103
- buffer_size = args[param_idx]
104
- end
105
-
106
- if( @native == 'Q' )
107
- raise "Please pass 8 for 'out' PDWORDS, since they require a buffer of size 8" unless buffer_size == 8
108
- elsif( @native == 'V' )
109
- raise "Please pass 4 for 'out' PDWORDS, since they require a buffer of size 4" unless buffer_size == 4
110
- end
111
-
112
- out_only_layout[param_desc[1]] = BufferItem.new(param_idx, out_only_size_bytes, buffer_size, param_desc[0])
113
- out_only_size_bytes += buffer_size
114
- end
115
- end
116
-
117
- tmp = assemble_buffer("in", function, args)
118
- in_only_layout = tmp[0]
119
- in_only_buffer = tmp[1]
120
-
121
- tmp = assemble_buffer("inout", function, args)
122
- inout_layout = tmp[0]
123
- inout_buffer = tmp[1]
124
-
125
-
126
- # now we build the stack
127
- # every stack dword will be described by two dwords:
128
- # first dword describes second dword:
129
- # 0 - literal,
130
- # 1 = relative to in-only buffer
131
- # 2 = relative to out-only buffer
132
- # 3 = relative to inout buffer
133
-
134
- # (literal numbers and pointers to buffers we have created)
135
- literal_pairs_blob = ""
136
- #puts " assembling literal stack"
137
- function.params.each_with_index do |param_desc, param_idx|
138
- #puts " processing (#{param_desc[0]}, #{param_desc[1]}, #{param_desc[2]})"
139
- buffer = nil
140
- # is it a pointer to a buffer on our stack
141
- if ["PDWORD", "PWCHAR", "PCHAR", "PBLOB"].include? param_desc[0]
142
- #puts " pointer"
143
- if args[param_idx] == nil # null pointer?
144
- buffer = [0].pack(@native) # type: DWORD (so the dll does not rebase it)
145
- buffer += [0].pack(@native) # value: 0
146
- elsif param_desc[2] == "in"
147
- buffer = [1].pack(@native)
148
- buffer += [in_only_layout[param_desc[1]].addr].pack(@native)
149
- elsif param_desc[2] == "out"
150
- buffer = [2].pack(@native)
151
- buffer += [out_only_layout[param_desc[1]].addr].pack(@native)
152
- elsif param_desc[2] == "inout"
153
- buffer = [3].pack(@native)
154
- buffer += [inout_layout[param_desc[1]].addr].pack(@native)
155
- else
156
- raise "unexpected direction"
157
- end
158
- else
159
- #puts " not a pointer"
160
- # it's not a pointer
161
- buffer = [0].pack(@native)
162
- case param_desc[0]
163
- when "LPVOID", "HANDLE"
164
- num = param_to_number(args[param_idx])
165
- buffer += [num].pack(@native)
166
- when "DWORD"
167
- num = param_to_number(args[param_idx])
168
- buffer += [num % 4294967296].pack(@native)
169
- when "WORD"
170
- num = param_to_number(args[param_idx])
171
- buffer += [num % 65536].pack(@native)
172
- when "BYTE"
173
- num = param_to_number(args[param_idx])
174
- buffer += [num % 256].pack(@native)
175
- when "BOOL"
176
- case args[param_idx]
177
- when true
178
- buffer += [1].pack('V')
179
- when false
180
- buffer += [0].pack('V')
181
- else
182
- raise "param #{param_desc[1]}: true or false expected"
183
- end
184
- else
185
- raise "unexpected type for param #{param_desc[1]}"
186
- end
187
- end
188
-
189
- #puts " adding pair to blob"
190
- literal_pairs_blob += buffer
191
- #puts " buffer size %X" % buffer.length
192
- #puts " blob size so far: %X" % literal_pairs_blob.length
193
- end
194
-
195
- #puts "\n\nsending Stuff to meterpreter"
196
-
197
- group = Rex::Post::Meterpreter::GroupTlv.new(TLV_TYPE_RAILGUN_MULTI_GROUP)
198
- group.add_tlv(TLV_TYPE_RAILGUN_SIZE_OUT, out_only_size_bytes)
199
- group.add_tlv(TLV_TYPE_RAILGUN_STACKBLOB, literal_pairs_blob)
200
- group.add_tlv(TLV_TYPE_RAILGUN_BUFFERBLOB_IN, in_only_buffer)
201
- group.add_tlv(TLV_TYPE_RAILGUN_BUFFERBLOB_INOUT, inout_buffer)
202
- group.add_tlv(TLV_TYPE_RAILGUN_DLLNAME, dll_name )
203
- group.add_tlv(TLV_TYPE_RAILGUN_FUNCNAME, function.windows_name)
204
- request.tlvs << group
205
-
206
- layouts << [inout_layout, out_only_layout]
207
- end
208
-
209
- call_results = []
210
- res = @client.send_request(request)
211
- res.each(TLV_TYPE_RAILGUN_MULTI_GROUP) do |val|
212
- call_results << val
213
- end
214
-
215
- functions.each do |f|
216
- dll_name,funcname,args = f
217
- dll_host = @parent.get_dll( dll_name )
218
- function = dll_host.functions[funcname]
219
- response = call_results.shift
220
- inout_layout, out_only_layout = layouts.shift
221
-
222
- rec_inout_buffers = response.get_tlv_value(TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_INOUT)
223
- rec_out_only_buffers = response.get_tlv_value(TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_OUT)
224
- rec_return_value = response.get_tlv_value(TLV_TYPE_RAILGUN_BACK_RET)
225
- rec_last_error = response.get_tlv_value(TLV_TYPE_RAILGUN_BACK_ERR)
226
-
227
- # The hash the function returns
228
- return_hash={"GetLastError" => rec_last_error}
229
-
230
- #process return value
231
- case function.return_type
232
- when "LPVOID", "HANDLE"
233
- if( @native == 'Q' )
234
- return_hash["return"] = rec_return_value
235
- else
236
- return_hash["return"] = rec_return_value % 4294967296
237
- end
238
- when "DWORD"
239
- return_hash["return"] = rec_return_value % 4294967296
240
- when "WORD"
241
- return_hash["return"] = rec_return_value % 65536
242
- when "BYTE"
243
- return_hash["return"] = rec_return_value % 256
244
- when "BOOL"
245
- return_hash["return"] = (rec_return_value != 0)
246
- when "VOID"
247
- return_hash["return"] = nil
248
- else
249
- raise "unexpected return type: #{function.return_type}"
250
- end
251
- #puts return_hash
252
- #puts "out_only_layout:"
253
- #puts out_only_layout
254
-
255
-
256
- # process out-only buffers
257
- #puts "processing out-only buffers:"
258
- out_only_layout.each_pair do |param_name, buffer_item|
259
- #puts " #{param_name}"
260
- buffer = rec_out_only_buffers[buffer_item.addr, buffer_item.length_in_bytes]
261
- case buffer_item.datatype
262
- when "PDWORD"
263
- return_hash[param_name] = buffer.unpack('V')[0]
264
- when "PCHAR"
265
- return_hash[param_name] = asciiz_to_str(buffer)
266
- when "PWCHAR"
267
- return_hash[param_name] = uniz_to_str(buffer)
268
- when "PBLOB"
269
- return_hash[param_name] = buffer
270
- else
271
- raise "unexpected type in out-only buffer of #{param_name}: #{buffer_item.datatype}"
272
- end
273
- end
274
- #puts return_hash
275
-
276
- # process in-out buffers
277
- #puts "processing in-out buffers:"
278
- inout_layout.each_pair do |param_name, buffer_item|
279
- #puts " #{param_name}"
280
- buffer = rec_inout_buffers[buffer_item.addr, buffer_item.length_in_bytes]
281
- case buffer_item.datatype
282
- when "PDWORD"
283
- return_hash[param_name] = buffer.unpack('V')[0]
284
- when "PCHAR"
285
- return_hash[param_name] = asciiz_to_str(buffer)
286
- when "PWCHAR"
287
- return_hash[param_name] = uniz_to_str(buffer)
288
- when "PBLOB"
289
- return_hash[param_name] = buffer
290
- else
291
- raise "unexpected type in in-out-buffer of #{param_name}: #{buffer_item.datatype}"
292
- end
293
- end
294
- #puts return_hash
295
- #puts "finished"
296
-
297
- function_results << return_hash
298
- end
299
- function_results
300
- end
301
- # process_multi_function_call
302
-
303
- protected
304
-
305
- attr_accessor :win_consts
306
-
307
- end # MultiCall
308
-
309
- end; end; end; end; end; end