librex 0.0.4 → 0.0.5

data/lib/rex/post/meterpreter/extensions/{railgun → stdapi/railgun}/tlv.rb

@@ -26,6 +26,7 @@ module Rex
 module Post
 module Meterpreter
 module Extensions
+module Stdapi
 module Railgun
 
 TLV_TYPE_EXTENSION_RAILGUN = 0
@@ -36,19 +37,15 @@ TLV_TYPE_RAILGUN_BUFFERBLOB_INOUT = 	TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_R
 
 TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_OUT = 		TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 5)
 TLV_TYPE_RAILGUN_BACK_BUFFERBLOB_INOUT = 	TLV_META_TYPE_RAW | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 6)
-TLV_TYPE_RAILGUN_BACK_RET = 			    TLV_META_TYPE_UINT | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 7)
+TLV_TYPE_RAILGUN_BACK_RET = 			    TLV_META_TYPE_QWORD | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 7)
 TLV_TYPE_RAILGUN_BACK_ERR = 			    TLV_META_TYPE_UINT | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 8)
 
 TLV_TYPE_RAILGUN_DLLNAME = 			    TLV_META_TYPE_STRING | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 9)
 TLV_TYPE_RAILGUN_FUNCNAME = 			TLV_META_TYPE_STRING | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 10)
 TLV_TYPE_RAILGUN_MULTI_GROUP = 			TLV_META_TYPE_GROUP | 		(TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 11)
 
+TLV_TYPE_RAILGUN_MEM_ADDRESS =          TLV_META_TYPE_QWORD | (TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 12 )
+TLV_TYPE_RAILGUN_MEM_DATA    =          TLV_META_TYPE_RAW   | (TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 13 )
+TLV_TYPE_RAILGUN_MEM_LENGTH  =          TLV_META_TYPE_UINT  | (TLV_TYPE_EXTENSION_RAILGUN + TLV_EXTENSIONS + 14 )
 
-
-
-end
-end
-end
-end
-end
-
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb

@@ -14,6 +14,7 @@ require 'rex/post/meterpreter/extensions/stdapi/sys/process'
 require 'rex/post/meterpreter/extensions/stdapi/sys/registry'
 require 'rex/post/meterpreter/extensions/stdapi/sys/event_log'
 require 'rex/post/meterpreter/extensions/stdapi/sys/power'
+require 'rex/post/meterpreter/extensions/stdapi/railgun/railgun'
 require 'rex/post/meterpreter/extensions/stdapi/ui'
 
 module Rex
@@ -69,6 +70,10 @@ class Stdapi < Extension
 							'socket'   => Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket.new(client)
 						})
 				},	
+				{
+					'name' => 'railgun',
+					'ext'  => Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::Railgun.new(client)
+				},
 				{
 					'name' => 'ui',
 					'ext'  => UI.new(client)

data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb

@@ -28,8 +28,14 @@ TLV_TYPE_DIRECTORY_PATH     = TLV_META_TYPE_STRING  | 1200
 TLV_TYPE_FILE_NAME          = TLV_META_TYPE_STRING  | 1201
 TLV_TYPE_FILE_PATH          = TLV_META_TYPE_STRING  | 1202
 TLV_TYPE_FILE_MODE          = TLV_META_TYPE_STRING  | 1203
+TLV_TYPE_FILE_SIZE          = TLV_META_TYPE_UINT    | 1204
+
 TLV_TYPE_STAT_BUF           = TLV_META_TYPE_COMPLEX | 1220
 
+TLV_TYPE_SEARCH_RECURSE     = TLV_META_TYPE_BOOL    | 1230
+TLV_TYPE_SEARCH_GLOB        = TLV_META_TYPE_STRING  | 1231
+TLV_TYPE_SEARCH_ROOT        = TLV_META_TYPE_STRING  | 1232
+TLV_TYPE_SEARCH_RESULTS     = TLV_META_TYPE_GROUP   | 1233
 ##
 #
 # Net

data/lib/rex/post/meterpreter/packet.rb

@@ -20,6 +20,7 @@ TLV_META_TYPE_STRING        = (1 << 16)
 TLV_META_TYPE_UINT          = (1 << 17)
 TLV_META_TYPE_RAW           = (1 << 18)
 TLV_META_TYPE_BOOL          = (1 << 19)
+TLV_META_TYPE_QWORD         = (1 << 20)
 TLV_META_TYPE_COMPRESSED    = (1 << 29)
 TLV_META_TYPE_GROUP         = (1 << 30)
 TLV_META_TYPE_COMPLEX       = (1 << 31)
@@ -31,6 +32,7 @@ TLV_META_MASK = (
 	TLV_META_TYPE_UINT |
 	TLV_META_TYPE_RAW |
 	TLV_META_TYPE_BOOL |
+	TLV_META_TYPE_QWORD |
 	TLV_META_TYPE_GROUP |
 	TLV_META_TYPE_COMPLEX
 )
@@ -132,6 +134,7 @@ class Tlv
 			when TLV_META_TYPE_UINT; "INT"
 			when TLV_META_TYPE_RAW; "RAW"
 			when TLV_META_TYPE_BOOL; "BOOL"
+			when TLV_META_TYPE_QWORD; "QWORD"
 			when TLV_META_TYPE_GROUP; "GROUP"
 			when TLV_META_TYPE_COMPLEX; "COMPLEX"
 			else; 'unknown-meta-type'
@@ -214,7 +217,7 @@ class Tlv
 	# Serializers
 	#
 	##
-
+	
 	#
 	# Converts the TLV to raw.
 	#
@@ -225,6 +228,8 @@ class Tlv
 			raw += "\x00"
 		elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
 			raw = [value].pack("N")
+		elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
+			raw = [ self.htonq( value.to_i ) ].pack("Q")
 		elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
 			if (value == true)
 				raw = [1].pack("c")
@@ -284,6 +289,9 @@ class Tlv
 			end
 		elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
 			self.value = raw.unpack("NNN")[2]
+		elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
+			self.value = raw.unpack("NNQ")[2] 		
+			self.value = self.ntohq( self.value )
 		elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
 			self.value = raw.unpack("NNc")[2]
 
@@ -298,6 +306,20 @@ class Tlv
 
 		return length;
 	end
+	
+	protected
+	
+	def htonq( value )
+		if( [1].pack( 's' ) == [1].pack( 'n' ) )
+			return value
+		end
+		return [ value ].pack( 'Q' ).reverse.unpack( 'Q' ).first
+	end
+
+	def ntohq( value )
+		return htonq( value )
+	end
+	
 end
 
 ###

data/lib/rex/post/meterpreter/packet_dispatcher.rb

@@ -58,7 +58,18 @@ module PacketDispatcher
 		raw   = packet.to_r
 
 		if (raw)
-			bytes = self.sock.write(raw)
+			begin
+				bytes = self.sock.write(raw)
+			rescue ::Exception => e
+				# Mark the session itself as dead
+				self.alive = false
+				
+				# Indicate that the dispatcher should shut down too
+				@finish = true
+				
+				# Reraise the error to the top-level caller
+				raise e		
+			end
 		end
 
 		return bytes
@@ -129,7 +140,7 @@ module PacketDispatcher
 
 		# Spawn a thread for receiving packets
 		self.receiver_thread = ::Thread.new do
-			while (true)
+			while (self.alive)
 				begin
 					rv = Rex::ThreadSafe.select([ self.sock.fd ], nil, nil, 0.25)
 					ping_time = 60

data/lib/rex/post/meterpreter/packet_response_waiter.rb

@@ -27,7 +27,19 @@ class PacketResponseWaiter
 			self.completion_routine = completion_routine
 			self.completion_param   = completion_param
 		else
-			self.done  = false
+			self.done    = false
+			self.wthread = initialize_waiter_thread
+		end
+	end
+
+	#
+	# Create an idle thread we can wait on
+	#
+	def initialize_waiter_thread
+		::Thread.new do
+			while (! self.done)
+				::IO.select(nil,nil,nil,5.0)
+			end
 		end
 	end
 
@@ -49,6 +61,7 @@ class PacketResponseWaiter
 			self.completion_routine.call(response, self.completion_param)
 		else
 			self.done = true
+			self.wthread.kill
 		end
 	end
 
@@ -58,16 +71,10 @@ class PacketResponseWaiter
 	#
 	def wait(interval)
 		if( interval and interval == -1 )
-			while(not self.done)
-				::IO.select(nil, nil, nil, 0.1)
-			end
+			self.wthread.join
 		else
 			begin
-				Timeout.timeout(interval) {
-					while(not self.done)
-						::IO.select(nil, nil, nil, 0.1)
-					end
-				}
+				Timeout.timeout(interval) { self.wthread.join }
 			rescue Timeout::Error
 				self.response = nil
 			end
@@ -75,7 +82,7 @@ class PacketResponseWaiter
 		return self.response
 	end
 
-	attr_accessor :rid, :done, :response # :nodoc:
+	attr_accessor :rid, :done, :response, :wthread # :nodoc:
 	attr_accessor :completion_routine, :completion_param # :nodoc:
 end
 

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb

@@ -354,18 +354,23 @@ class Console::CommandDispatcher::Core
 	end
 
 	def cmd_run_tabs(str, words)
+		tabs = []
 		if(not words[1] or not words[1].match(/^\//))
 			begin
-				my_directory = Msf::Config.script_directory + ::File::SEPARATOR + "meterpreter"
-				return ::Dir.new(my_directory).find_all { |e|
-					path = my_directory + ::File::SEPARATOR + e
-					::File.file?(path) and ::File.readable?(path)
-				}.map { |e|
-					e.sub!(/\.rb$/, '')
-				}
+				[
+					::Msf::Sessions::Meterpreter::ScriptBase,
+					::Msf::Sessions::Meterpreter::UserScriptBase 
+				].each do |dir|
+					next if not ::File.exist? dir
+					tabs += ::Dir.new(dir).find_all { |e|
+						path = dir + ::File::SEPARATOR + e
+						::File.file?(path) and ::File.readable?(path)
+					}
+				end
 			rescue Exception
 			end
 		end
+		return tabs.map { |e| e.sub!(/\.rb$/, '') }
 	end
 
 

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb

@@ -0,0 +1,221 @@
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+# Rex::Ui::Text::IrbShell.new(binding).run
+
+class Console::CommandDispatcher::NetworkPug
+
+	Klass = Console::CommandDispatcher::NetworkPug
+
+	include Console::CommandDispatcher
+
+	@@options = Rex::Parser::Arguments.new(
+		"-i" => [ true, "Interface on remote machine to listen on" ],
+		"-f" => [ true, "Additional pcap filtering mechanism" ],
+		"-v" => [ false, "Virtual NIC (packets only for your TAP dev locally)" ]
+	)
+
+	def initialize(shell)
+		@thread_stuff = nil
+		@tapdev = nil
+		@channel = nil
+
+		super
+	end
+
+	attr_accessor :thread_stuff
+	attr_accessor :tapdev
+	attr_accessor :channel
+
+
+	#
+	# List of supported commands.
+	#
+	def commands
+		{
+			"networkpug_start" => "Start slinging packets between hosts",
+			"networkpug_stop"  => "Stop slinging packets between hosts",
+		}
+	end
+
+	def setup_tapdev
+		# XXX, look at how to use windows equivilient and include
+
+		tapdev = ::File.open("/dev/net/tun", "wb+")
+
+		0.upto(16) { |idx|
+			name = "npug#{idx}"
+
+			ifreq = [ name, 0x1000 | 0x02, "" ].pack("a16va14")
+
+			begin
+				tapdev.ioctl(0x400454ca, ifreq)		# is there a better way than hex constant
+			rescue Errno::EBUSY
+				next
+			end
+			
+			ifreq = [ name ].pack("a32")
+
+			tapdev.ioctl(0x8927, ifreq)
+
+			# print_line(Rex::Text.hexify(ifreq))
+
+			mac = sprintf("%02x:%02x:%02x:%02x:%02x:%02x", ifreq[18], ifreq[19], ifreq[20], ifreq[21], ifreq[22], ifreq[23])
+
+			return tapdev, name, mac
+		}
+		
+		tapdev.close()
+		return nil, nil, nil
+	end
+
+	def proxy_packets()
+		while 1
+			# Ghetto :\
+
+			sd = Rex::ThreadSafe.select([ @channel.lsock, @tapdev ], nil, nil)
+
+			sd[0].each { |s|
+				if(s == @channel.lsock)	# Packet from remote host to local TAP dev
+					len = @channel.lsock.read(2)
+					len = len.unpack('n')[0]
+
+					#print_line("Got #{len} bytes from remote host's network")
+					
+					if(len > 1514 or len == 0)
+						@tapdev.close()
+						print_line("length is invalid .. #{len} ?, de-synchronized ? ")
+					end
+
+					packet = @channel.lsock.read(len)
+
+					print_line("packet from remote host:\n" + Rex::Text.hexify(packet))
+
+					@tapdev.syswrite(packet)
+
+				elsif(s == @tapdev)
+					# Packet from tapdev to remote host network
+
+					packet = @tapdev.sysread(1514)
+
+					print_line("packet to remote host:\n" + Rex::Text.hexify(packet))
+
+					@channel.write(packet)
+				end
+			} if(sd)
+
+			if(not sd)
+				print_line("hmmm. ")
+			end
+		end
+	end
+
+	def cmd_networkpug_start(*args)
+		# PKS - I suck at ruby ;\
+
+		virtual_nic = false
+		filter = nil
+		interface = nil
+
+		if(args.length == 0)
+			args.unshift("-h")
+		end
+
+		@@options.parse(args) { |opt, idx, val|
+			# print_line("before: #{opt} #{idx} #{val} || virtual nic: #{virtual_nic}, filter: #{filter}, interface: #{interface}")
+			case opt
+				when "-v"
+					virtual_nic = true
+
+				when "-f"
+					filter = val
+
+				when "-i"
+					interface = val
+
+				when "-h"
+					print_error("Usage: networkpug_start -i interface [options]")
+					print_error("")
+					print_error(@@options.usage)
+			end
+			# print_line("after: #{opt} #{idx} #{val} || virtual nic: #{virtual_nic}, filter: #{filter}, interface: #{interface}")
+
+		}
+
+		if (interface == nil)
+			print_error("Usage: networkpug_start -i interface [options]")
+			print_error("")
+			print_error(@@options.usage)
+			return
+		end
+
+		@tapdev, tapname, mac = setup_tapdev
+
+		if(@tapdev == nil)
+			print_status("Failed to create tapdev")
+			return
+		end
+
+		# PKS, we should implement multiple filter strings and let the
+		# remote host build it properly.
+		# not (our conn) and (virtual nic filter) and (custom filter)
+		# print_line("before virtual, filter is #{filter}")
+
+		if(filter == nil and virtual_nic == true)
+			filter = "ether host #{mac}"
+		elsif(filter != nil and virtual_nic == true)
+			filter += " and ether host #{mac}"
+			#print_line("Adjusted filter is #{filter}")
+		end
+
+		print_line("#{tapname} created with a hwaddr of #{mac}, ctrl-c when done")
+
+		response, @channel = client.networkpug.networkpug_start(interface, filter)
+
+		if(@channel)
+			@thread_stuff = ::Thread.new {
+				proxy_packets()
+			}
+
+			print_line("Packet slinger for #{interface} has a thread structure of #{@thread_stuff}")
+		end
+
+		return true
+	end
+	
+	def cmd_networkpug_stop(*args)
+		interface = args[0]
+		if (interface == nil)
+			print_error("Usage: networkpug_stop [interface]")
+			return
+		end		
+
+		if(@thread_stuff)
+			::Thread.kill(@thread_stuff)
+			::Thread.join(@thread_stuff)
+
+			@thread_stuff = nil
+
+			@channel.close
+			@tapdev.close
+		end
+
+		client.networkpug.networkpug_stop(interface)
+		print_status("Packet slinging stopped on #{interface}")
+		return true
+	end
+	
+	def name
+		"NetworkPug"
+	end
+
+end
+
+end
+end
+end
+end