librex 0.0.4 → 0.0.5

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb

@@ -58,13 +58,14 @@ class Console::CommandDispatcher::Sniffer
 	def cmd_sniffer_start(*args)
 		intf = args[0].to_i
 		if (intf == 0)
-			print_error("Usage: sniffer_start [interface-id] [packet-buffer (1-200000)]")
+			print_error("Usage: sniffer_start [interface-id] [packet-buffer (1-200000)] [bpf filter (posix meterpreter only)]")
 			return
 		end
 		maxp = args[1].to_i
 		maxp = 50000 if maxp == 0
-		 
-		client.sniffer.capture_start(intf, maxp)
+		filter = args[2..-1].join(" ")
+		
+		client.sniffer.capture_start(intf, maxp, filter)
 		print_status("Capture started on interface #{intf} (#{maxp} packet buffer)")
 		return true
 	end

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb

@@ -47,7 +47,8 @@ class Console::CommandDispatcher::Stdapi::Fs
 			"getlwd"   => "Print local working directory",
 			"lpwd"     => "Print local working directory",
 			"rm"       => "Delete the specified file",
-			"del"       => "Delete the specified file"
+			"del"      => "Delete the specified file",
+			"search"   => "Search for files"
 		}
 	end
 
@@ -58,6 +59,60 @@ class Console::CommandDispatcher::Stdapi::Fs
 		"Stdapi: File system"
 	end
 
+	#
+	# Search for files.
+	#
+	def cmd_search( *args )
+	
+		root    = nil
+		glob    = nil
+		recurse = true
+		
+		opts = Rex::Parser::Arguments.new(
+			"-h" => [ false, "Help Banner." ],
+			"-d" => [ true,  "The directory/drive to begin searching from. Leave empty to search all drives. (Default: #{root})" ],
+			"-f" => [ true,  "The file pattern glob to search for. (e.g. *secret*.doc?)" ],
+			"-r" => [ true,  "Recursivly search sub directories. (Default: #{recurse})" ]
+		)
+		
+		opts.parse(args) { | opt, idx, val |
+			case opt
+				when "-h"
+					print_line( "Usage: search [-d dir] [-r recurse] -f pattern" )
+					print_line( "Search for files." )
+					print_line( opts.usage )
+					return
+				when "-d"
+					root = val
+				when "-f"
+					glob = val
+				when "-r"
+					recurse = false if( val =~ /^(f|n|0)/i )
+			end
+		}
+		
+		if( not glob )
+			print_error( "You must specify a valid file glob to search for, e.g. >search -f *.doc" )
+			return
+		end
+		
+		files = client.fs.file.search( root, glob, recurse )
+		
+		if( not files.empty? )
+			print_line( "Found #{files.length} result#{ files.length > 1 ? 's' : '' }..." )
+			files.each do | file |
+				if( file['size'] > 0 )
+					print( "    #{file['path']}#{ file['path'].empty? ? '' : '\\' }#{file['name']} (#{file['size']} bytes)\n" )
+				else
+					print( "    #{file['path']}#{ file['path'].empty? ? '' : '\\' }#{file['name']}\n" )
+				end
+			end
+		else
+			print_line( "No files matching your search were found." )
+		end
+		
+	end
+	
 	#
 	# Reads the contents of a file and prints them to the screen.
 	#

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb

@@ -134,10 +134,32 @@ class Console::CommandDispatcher::Stdapi::Net
 					print("\n" + tbl.to_s + "\n")
 				end
 			when "add"
+                        	# Satisfy check to see that formatting is correct
+                                unless Rex::Socket::RangeWalker.new(args[0]).length == 1
+                                        print_error "Invalid IP Address"
+                                        return false
+                                end
+
+                                unless Rex::Socket::RangeWalker.new(args[1]).length == 1
+                                        print_error "Invalid Subnet mask"
+                                        return false
+                                end
+			
 				print_line("Creating route #{args[0]}/#{args[1]} -> #{args[2]}")
 
 				client.net.config.add_route(*args)
 			when "delete"
+			        # Satisfy check to see that formatting is correct
+                                unless Rex::Socket::RangeWalker.new(args[0]).length == 1
+                                        print_error "Invalid IP Address"
+                                        return false
+                                end
+
+                                unless Rex::Socket::RangeWalker.new(args[1]).length == 1
+                                        print_error "Invalid Subnet mask"
+                                        return false
+                                end
+			
 				print_line("Deleting route #{args[0]}/#{args[1]} -> #{args[2]}")
 
 				client.net.config.remove_route(*args)

data/lib/rex/proto/dcerpc/client.rb

@@ -272,7 +272,7 @@ require 'rex/proto/smb/exceptions'
 	end
 
 	# Perform a DCE/RPC Function Call
-	def call(function, data)
+	def call(function, data, do_recv = true)
 
 		frag_size = data.length
 		if options['frag_size']
@@ -291,6 +291,8 @@ require 'rex/proto/smb/exceptions'
 			self.write(packet)
 		}
 
+		return true if not do_recv
+
 		raw_response = ''
 
 		begin

data/lib/rex/proto/dhcp.rb

@@ -0,0 +1,7 @@
+# $Id: dhcp.rb 9970 2010-08-07 06:45:02Z jduck $
+#
+# DHCP Server support written by scriptjunkie
+#
+
+require 'rex/proto/dhcp/constants'
+require 'rex/proto/dhcp/server'

data/lib/rex/proto/dhcp/constants.rb

@@ -0,0 +1,33 @@
+# $Id: constants.rb 9990 2010-08-13 03:11:30Z jduck $
+require 'rex/proto/dhcp'
+
+module Rex
+module Proto
+module DHCP
+
+Request = 1
+Response = 2
+
+DHCPDiscover = 1
+DHCPOffer = 2
+DHCPRequest = 3
+DHCPAck = 5
+
+DHCPMagic = "\x63\x82\x53\x63"
+
+OpDHCPServer = 0x36
+OpLeaseTime = 0x33
+OpSubnetMask = 1
+OpRouter = 3
+OpDns = 6
+OpEnd = 0xff
+
+PXEMagic = "\xF1\x00\x74\x7E"
+OpPXEMagic = 0xD0
+OpPXEConfigFile = 0xD1
+OpPXEPathPrefix = 0xD2
+OpPXERebootTime = 0xD3
+
+end
+end
+end

data/lib/rex/proto/dhcp/server.rb

@@ -0,0 +1,285 @@
+# $Id: server.rb 10261 2010-09-08 17:06:31Z jduck $
+
+require 'rex/socket'
+require 'rex/proto/dhcp'
+
+module Rex
+module Proto
+module DHCP
+
+##
+#
+# DHCP Server class
+# not completely configurable - written specifically for a PXE server
+# - scriptjunkie
+##
+
+class Server
+
+	include Rex::Socket
+
+	def initialize(hash, context = {})
+		self.listen_host = '0.0.0.0' # clients don't already have addresses. Needs to be 0.0.0.0
+		self.listen_port = 67 # mandatory (bootps)
+		self.context = context
+		self.sock = nil
+
+		@shutting_down = false
+
+		self.myfilename = hash['FILENAME'] || ""
+		self.myfilename << ("\x00" * (128 - self.myfilename.length))
+
+		source = hash['SRVHOST'] || Rex::Socket.source_address
+		self.ipstring = Rex::Socket.addr_aton(source)
+
+		ipstart = hash['DHCPIPSTART']
+		if ipstart
+			self.start_ip = Rex::Socket.addr_atoi(ipstart)
+		else
+			self.start_ip = "#{self.ipstring[0..2]}\x20" #default range x.x.x.32-254
+		end
+		self.current_ip = start_ip
+
+		ipend = hash['DHCPIPEND']
+		if ipend
+			self.end_ip = Rex::Socket.addr_atoi(ipend)
+		else
+			self.end_ip = "#{self.ipstring[0..2]}\xfe"
+		end
+
+		# netmask
+		netmask = hash['NETMASK'] || "255.255.255.0"
+		self.netmaskn = Rex::Socket.addr_aton(netmask)
+
+		# router
+		router = hash['ROUTER'] || source
+		self.router = Rex::Socket.addr_aton(router)
+
+		# dns
+		dnsserv = hash['DNSSERVER'] || source
+		self.dnsserv = Rex::Socket.addr_aton(dnsserv)
+
+		# broadcast
+		if hash['BROADCAST']
+			self.broadcasta = Rex::Socket.addr_aton(hash['BROADCAST'])
+		else
+			self.broadcasta = Rex::Socket.addr_itoa( self.start_ip | (Rex::Socket.addr_ntoi(self.netmaskn) ^ 0xffffffff) )
+		end
+
+		self.served = {}
+		if (hash['SERVEONCE'])
+			self.serveOnce = true
+		else
+			self.serveOnce = false
+		end
+		
+		if (hash['PXE'])
+			self.servePXE = true
+		else
+			self.servePXE = false
+		end
+		
+		self.leasetime = 600
+		self.relayip = "\x00\x00\x00\x00" # relay ip - not currently suported
+		self.pxeconfigfile = "update2"
+		self.pxepathprefix = ""
+		self.pxereboottime = 2000
+	end
+
+
+	# Start the DHCP server
+	def start
+		self.sock = Rex::Socket::Udp.create(
+			'LocalHost' => listen_host,
+			'LocalPort' => listen_port,
+			'Context'   => context
+		)
+
+		self.thread = Thread.new {
+			monitor_socket
+		}
+	end
+
+	# Stop the DHCP server
+	def stop
+		@shutting_down = true
+		self.thread.kill
+		self.sock.close rescue nil
+	end
+
+
+	# Set an option
+	def set_option(opts)
+		allowed_options = [
+			:serveOnce, :servePXE, :relayip, :leasetime, :dnsserv,
+			:pxeconfigfile, :pxepathprefix, :pxereboottime, :router
+		]
+
+		opts.each_pair { |k,v|
+			next if not v
+			if allowed_options.include?(k)
+				self.instance_variable_set("@#{k}", v)
+			end
+		}
+	end
+
+
+	# Send a single packet to the specified host
+	def send_packet(ip, pkt)
+		port = 68 # bootpc
+		if ip
+			self.sock.sendto( pkt, ip, port )
+		else
+			if not self.sock.sendto( pkt, '255.255.255.255', port )
+				self.sock.sendto( pkt, self.broadcasta, port )
+			end
+		end
+	end
+
+	attr_accessor :listen_host, :listen_port, :context, :leasetime, :relayip, :router, :dnsserv
+	attr_accessor :sock, :thread, :myfilename, :ipstring, :served, :serveOnce
+	attr_accessor :current_ip, :start_ip, :end_ip, :broadcasta, :netmaskn
+	attr_accessor :servePXE, :pxeconfigfile, :pxepathprefix, :pxereboottime
+
+protected
+
+
+	# See if there is anything to do.. If so, dispatch it.
+	def monitor_socket
+		while true
+			rds = [@sock]
+			wds = []
+			eds = [@sock]
+
+			r,w,e = ::IO.select(rds,wds,eds,1)
+
+			if (r != nil and r[0] == self.sock)
+				buf,host,port = self.sock.recvfrom(65535)
+				# Lame compatabilitiy :-/
+				from = [host, port]
+				dispatch_request(from, buf)
+			end
+
+		end
+	end
+
+	def dhcpoption(type, val = nil)
+		ret = ''
+		ret << [type].pack('C')
+
+		if val
+			ret << [val.length].pack('C') + val
+		end
+
+		ret
+	end
+
+	# Dispatch a packet that we received
+	def dispatch_request(from, buf)
+		type = buf.unpack('C').first
+		if (type != Request)
+			#dlog("Unknown DHCP request type: #{type}")
+			return
+		end
+
+		# parse out the members
+		hwtype = buf[1,1]
+		hwlen = buf[2,1].unpack("C").first
+		hops = buf[3,1]
+		txid = buf[4..7]
+		elapsed = buf[8..9]
+		flags = buf[10..11]
+		clientip = buf[12..15]
+		givenip = buf[16..19]
+		nextip = buf[20..23]
+		relayip = buf[24..27]
+		clienthwaddr = buf[28..(27+hwlen)]
+		servhostname = buf[44..107]
+		filename = buf[108..235]
+		magic = buf[236..239]
+
+		if (magic != DHCPMagic)
+			#dlog("Invalid DHCP request - bad magic.")
+			return
+		end
+
+		messageType = 0
+		pxeclient = false
+
+		# options parsing loop
+		spot = 240
+		while (spot < buf.length - 3 && buf[spot] != 0xff)
+			optionType = buf[spot,1].unpack("C").first
+			optionLen = buf[spot + 1,1].unpack("C").first
+			optionValue = buf[(spot + 2)..(spot + optionLen + 1)]
+			spot = spot + optionLen + 2
+			if optionType == 53
+				messageType = optionValue.unpack("C").first
+			elsif optionType == 150
+				pxeclient = true
+			end
+		end
+
+		if pxeclient == false && self.servePXE == true
+			#dlog ("No tftp server request; ignoring (probably not PXE client)")
+			return
+		end
+
+		# prepare response
+		pkt = [Response].pack('C')
+		pkt << buf[1..7] #hwtype, hwlen, hops, txid
+		pkt << "\x00\x00\x00\x00"  #elapsed, flags
+		pkt << clientip
+
+		# give next ip address (not super reliable high volume but it should work for a basic server)
+		self.current_ip += 1
+		if self.current_ip > self.end_ip
+			self.current_ip = self.start_ip
+		end
+		pkt << Rex::Socket.addr_iton(self.current_ip)
+		pkt << self.ipstring #next server ip
+		pkt << self.relayip
+		pkt << buf[28..43] #client hw address
+		pkt << servhostname
+		pkt << self.myfilename
+		pkt << magic
+		pkt << "\x35\x01" #Option
+
+		if messageType == DHCPDiscover  #DHCP Discover - send DHCP Offer
+			pkt << [DHCPOffer].pack('C')
+			# check if already served based on hw addr (MAC address)
+			if self.serveOnce == true && self.served.has_key?(buf[28..43])
+				#dlog ("Already served; allowing normal boot")
+				return
+			end
+		elsif messageType == DHCPRequest #DHCP Request - send DHCP ACK
+			pkt << [DHCPAck].pack('C')
+			# now we ignore their discovers (but we'll respond to requests in case a packet was lost)
+			self.served.merge!( buf[28..43] => true ) 
+		else
+			#dlog("ignoring unknown DHCP request - type #{messageType}")
+			return
+		end
+
+		# Options!
+		pkt << dhcpoption(OpDHCPServer, self.ipstring)
+		pkt << dhcpoption(OpLeaseTime, [self.leasetime].pack('N'))
+		pkt << dhcpoption(OpSubnetMask, self.netmaskn)
+		pkt << dhcpoption(OpRouter, self.router)
+		pkt << dhcpoption(OpDns, self.dnsserv)
+		pkt << dhcpoption(OpPXEMagic, PXEMagic)
+		pkt << dhcpoption(OpPXEConfigFile, self.pxeconfigfile)
+		pkt << dhcpoption(OpPXEPathPrefix, self.pxepathprefix)
+		pkt << dhcpoption(OpPXERebootTime, [self.pxereboottime].pack('N'))
+		pkt << dhcpoption(OpEnd)
+
+		pkt << ("\x00" * 32) #padding
+
+		send_packet(nil, pkt)
+	end
+
+end
+
+end
+end
+end