librex 0.0.3 → 0.0.4

data/lib/rex/post/meterpreter/extensions/railgun/tlv.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2010, patrickHVE@googlemail.com
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above copyright
+#       notice, this list of conditions and the following disclaimer in the
+#       documentation and/or other materials provided with the distribution.
+#     * The names of the author may not be used to endorse or promote products
+#       derived from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL patrickHVE@googlemail.com BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Railgun
+
+TLV_TYPE_EXTENSION_RAILGUN = 0
+TLV_TYPE_RAILGUN_SIZE_OUT = 			TLV_META_TYPE_UINT | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 1)
+TLV_TYPE_RAILGUN_STACKBLOB = 			TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 2)
+TLV_TYPE_RAILGUN_BUFFERBLOB_IN = 		TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 3)
+TLV_TYPE_RAILGUN_BUFFERBLOB_INOUT = 	TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 4)
+
+TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_OUT = 		TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 5)
+TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_INOUT = 	TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 6)
+TLV_TYPE_RAILGUN_BACK_RET = 			    TLV_META_TYPE_UINT | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 7)
+TLV_TYPE_RAILGUN_BACK_ERR = 			    TLV_META_TYPE_UINT | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 8)
+
+TLV_TYPE_RAILGUN_DLLNAME = 			    TLV_META_TYPE_STRING | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 9)
+TLV_TYPE_RAILGUN_FUNCNAME = 			TLV_META_TYPE_STRING | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 10)
+TLV_TYPE_RAILGUN_MULTI_GROUP = 			TLV_META_TYPE_GROUP | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 11)
+
+
+
+
+end
+end
+end
+end
+end
+

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb

@@ -37,14 +37,14 @@ class Socket
 	#
 	def initialize(client)
 		self.client = client
-		
+
 		# register the inbound handler for the tcp server channel (allowing us to receive new client connections to a tcp server channel)
 		client.register_inbound_handler( Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel )
 
 	end
 
 	#
-	# Deregister the inbound handler for the tcp server channel 
+	# Deregister the inbound handler for the tcp server channel
 	#
 	def shutdown
 		client.deregister_inbound_handler(  Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel )
@@ -63,7 +63,7 @@ class Socket
 	#
 	def create( params )
 		res = nil
-		
+
 		if( params.tcp? )
 			if( params.server? )
 				res = create_tcp_server_channel( params )
@@ -73,7 +73,7 @@ class Socket
 		elsif( params.udp? )
 		  res = create_udp_channel( params )
 		end
-		
+
 		return res
 	end
 
@@ -89,7 +89,7 @@ class Socket
 				raise ::Rex::ConnectionError.new
 			end
 			raise e
-		end 
+		end
 	end
 
 	#
@@ -100,7 +100,7 @@ class Socket
 			channel = SocketSubsystem::TcpClientChannel.open(client, params)
 			if( channel != nil )
 				return channel.lsock
-			end 
+			end
 			return nil
 		rescue ::Rex::Post::Meterpreter::RequestError => e
 			case e.result
@@ -123,7 +123,7 @@ class Socket
 				raise ::Rex::ConnectionError.new
 			end
 			raise e
-		end 
+		end
 	end
 
 

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb

@@ -22,13 +22,13 @@ module SocketSubsystem
 #
 ###
 class TcpClientChannel < Rex::Post::Meterpreter::Stream
-	
+
 	class << self
 		def cls
 			return CHANNEL_CLASS_STREAM
 		end
 	end
-	
+
 	module SocketInterface
 		def type?
 			'tcp'
@@ -58,26 +58,26 @@ class TcpClientChannel < Rex::Post::Meterpreter::Stream
 
 		attr_accessor :channel
 	end
-	
+
 	#
 	# Simple mixin for lsock in order to help avoid a ruby interpreter issue with ::Socket.pair
 	# Instead of writing to the lsock, reading from the rsock and then writing to the channel,
 	# we use this mixin to directly write to the channel.
 	#
-	# Note: This does not work with OpenSSL as OpenSSL is implemented nativly and requires a real
+	# Note: This does not work with OpenSSL as OpenSSL is implemented natively and requires a real
 	# socket to write to and we cant intercept the sockets syswrite at a native level.
 	#
 	# Note: The deadlock only seems to effect the Ruby build for cygwin.
 	#
 	module DirectChannelWrite
-		
+
 		def syswrite( buf )
 			channel._write( buf )
 		end
-		
+
 		attr_accessor :channel
 	end
-	
+
 	##
 	#
 	# Factory
@@ -133,7 +133,7 @@ class TcpClientChannel < Rex::Post::Meterpreter::Stream
 
 		rsock.extend( SocketInterface )
 		rsock.channel = self
-    
+
 	end
 
 	#
@@ -161,6 +161,19 @@ class TcpClientChannel < Rex::Post::Meterpreter::Stream
 		return true
 	end
 
+	#
+	# Wrap the _write() call in order to catch some common, but harmless Windows exceptions
+	#
+	def _write(*args)
+		begin
+			super(*args)
+		rescue ::Rex::Post::Meterpreter::RequestError => e
+			case e.result
+			when 10000 .. 10100
+				raise ::Rex::ConnectionError.new
+			end
+		end
+	end
 end
 
 end; end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb

@@ -19,7 +19,7 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 	# We inclue Rex::Socket::Udp as this channel is effectivly a UDP socket.
 	#
 	include Rex::Socket::Udp
-	
+
 	#
 	# We are a datagram channel.
 	#
@@ -28,7 +28,7 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 			return CHANNEL_CLASS_DATAGRAM
 		end
 	end
-	
+
 	#
 	# Open a new UDP channel on the remote end. The local host/port are optional, if none are specified
 	# the remote end will bind to INADDR_ANY with a random port number. The peer host/port are also
@@ -59,9 +59,9 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 		c.params = params
 		c
 	end
-	
+
 	#
-	# Simply initilize this instance.
+	# Simply initialize this instance.
 	#
 	def initialize(client, cid, type, flags)
 		super(client, cid, type, flags)
@@ -75,7 +75,7 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 	#
 	def timed_read( length=65535, timeout=def_read_timeout )
 		result = ''
-		
+
 		begin
 			Timeout.timeout( timeout ) {
 				while( true )
@@ -90,12 +90,12 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 		rescue Timeout::Error
 			result = ''
 		end
-		
+
 		return result
 	end
-	
+
 	#
-	# We overwrite Rex::Socket::Udp.recvfrom in order to correctly hand out the 
+	# We overwrite Rex::Socket::Udp.recvfrom in order to correctly hand out the
 	# datagrams which the remote end of this channel has received and are in the
 	# queue.
 	#
@@ -130,7 +130,7 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 		# return the result in the form [ data, host, port ]
 		return result
 	end
-	
+
 	#
 	# Overwrite the low level sysread to read data off our datagram queue. Calls
 	# to read() will end up calling this.
@@ -139,9 +139,9 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 		result = self.recvfrom( length )
 		return result[0]
 	end
-	
+
 	#
-	# Overwrite the low level syswrite to write data to the remote end of the channel. 
+	# Overwrite the low level syswrite to write data to the remote end of the channel.
 	# Calls to write() will end up calling this.
 	#
 	def syswrite( buf )
@@ -149,12 +149,12 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 	end
 
 	#
-	# This function is called by Rex::Socket::Udp.sendto and writes data to a specified 
+	# This function is called by Rex::Socket::Udp.sendto and writes data to a specified
 	# remote peer host/port via the remote end of the channel.
 	#
 	def send( buf, flags, saddr )
 		af, peerhost, peerport = Rex::Socket.from_sockaddr( saddr )
-		
+
 		addends = [
 			{
 				'type'  => TLV_TYPE_PEER_HOST,
@@ -165,12 +165,12 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 				'value' => peerport
 			}
 		]
-		
+
 		return _write( buf, buf.length, addends )
 	end
 
 	#
-	# The channels direct io write handler for any incoming data from the remote end 
+	# The channels direct io write handler for any incoming data from the remote end
 	# of the channel. We extract the data and peer host/port, and save this to a queue
 	# of incoming datagrams which are passed out via calls to self.recvfrom()
 	#
@@ -178,15 +178,31 @@ class UdpChannel < Rex::Post::Meterpreter::Channel
 
 		peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST )
 		peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT )
-		
+
 		if( peerhost and peerport )
 			@datagrams << [ data, peerhost, peerport ]
 			return true
 		end
-		
+
 		return false
 	end
 
+	#
+	# Wrap the _write() call in order to catch some common, but harmless Windows exceptions
+	#
+	def _write(*args)
+		begin
+			super(*args)
+		rescue ::Rex::Post::Meterpreter::RequestError => e
+			case e.result
+			when 10000 .. 10100
+				raise ::Rex::ConnectionError.new
+			end
+		end
+	end
+
+
 end
 
 end; end; end; end; end; end; end
+

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/railgun.rb

@@ -0,0 +1,57 @@
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Packet sniffer extension user interface.
+#
+###
+class Console::CommandDispatcher::Railgun
+
+	Klass = Console::CommandDispatcher::Railgun
+
+	include Console::CommandDispatcher
+
+	#
+	# Initializes an instance of the railgun command interaction.
+	#
+	def initialize(shell)
+		super
+	end
+
+	#
+	# List of supported commands.
+	#
+	def commands
+		{
+		#	"railgun_test" => "Run a simple railgun_test"
+		}
+	end
+
+=begin
+	def cmd_railgun_test(*args)
+		begin
+		r = client.railgun.multi([
+			["kernel32", "GetLogicalDrives", []]
+		])
+		rescue ::Exception => e
+			p "Error: #{e} #{e.backtrace}"
+		end
+	end
+=end
+
+	def name
+		"Railgun"
+	end
+
+end
+
+end
+end
+end
+end
+