librex 0.0.63 → 0.0.65
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/README.markdown +1 -1
- data/lib/rex/assembly/nasm.rb +4 -4
- data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +4 -4
- data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +27 -27
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +3 -3
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +19 -15
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +680 -680
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +12 -12
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +3 -3
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +6 -6
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +4 -4
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +7 -7
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb +1 -1
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +5 -5
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +6 -6
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +20 -20
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb +5 -5
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +15 -15
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +5 -5
- data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +3 -3
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +3 -3
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +6 -6
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +10 -10
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +3 -3
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +2 -2
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +3 -3
- data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +6 -6
- data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +10 -5
- data/lib/rex/proto/smb/constants.rb +1 -1
- data/lib/rex/socket.rb +24 -7
- data/lib/rex/text.rb +15 -1
- data/lib/rex/text.rb.ut.rb +2 -0
- data/lib/rex/ui/text/output/stdio.rb +5 -1
- metadata +5 -5
@@ -10,7 +10,7 @@ class Def_user32
|
|
10
10
|
|
11
11
|
def self.create_dll(dll_path = 'user32')
|
12
12
|
dll = DLL.new(dll_path, ApiConstants.manager)
|
13
|
-
|
13
|
+
|
14
14
|
dll.add_function('ActivateKeyboardLayout', 'DWORD',[
|
15
15
|
["DWORD","hkl","in"],
|
16
16
|
["DWORD","Flags","in"],
|
@@ -3163,7 +3163,7 @@ class Def_user32
|
|
3163
3163
|
|
3164
3164
|
return dll
|
3165
3165
|
end
|
3166
|
-
|
3166
|
+
|
3167
3167
|
end
|
3168
3168
|
|
3169
3169
|
end; end; end; end; end; end; end
|
@@ -11,18 +11,18 @@ class Def_wlanapi
|
|
11
11
|
def self.create_dll(dll_path = 'wlanapi')
|
12
12
|
dll = DLL.new(dll_path, ApiConstants.manager)
|
13
13
|
|
14
|
-
|
14
|
+
|
15
15
|
dll.add_function( 'WlanOpenHandle', 'DWORD',[
|
16
16
|
['DWORD', 'dwClientVersion', 'in'],
|
17
17
|
['LPVOID', 'pReserved', 'in'],
|
18
18
|
['PDWORD', 'pdwNegotiatedVersion', 'out'],
|
19
19
|
['PDWORD', 'phClientHandle', 'out']])
|
20
|
-
|
20
|
+
|
21
21
|
dll.add_function( 'WlanEnumInterfaces', 'DWORD',[
|
22
22
|
['DWORD', 'hClientHandle', 'in'],
|
23
23
|
['LPVOID', 'pReserved', 'in'],
|
24
24
|
['PDWORD', 'ppInterfaceList', 'out']])
|
25
|
-
|
25
|
+
|
26
26
|
dll.add_function( 'WlanGetProfileList', 'DWORD',[
|
27
27
|
['DWORD', 'hClientHandle', 'in'],
|
28
28
|
['PBLOB', 'pInterfaceGuid', 'in'],
|
@@ -37,14 +37,14 @@ class Def_wlanapi
|
|
37
37
|
['PDWORD', 'pstrProfileXML', 'out'],
|
38
38
|
['PDWORD', 'pdwFlags', 'inout'],
|
39
39
|
['PDWORD', 'pdwGrantedAccess', 'out']])
|
40
|
-
|
40
|
+
|
41
41
|
dll.add_function( 'WlanFreeMemory', 'DWORD',[
|
42
42
|
['LPVOID', 'pMemory', 'in']])
|
43
|
-
|
43
|
+
|
44
44
|
dll.add_function( 'WlanCloseHandle', 'DWORD',[
|
45
45
|
['DWORD', 'hClientHandle', 'in'],
|
46
46
|
['LPVOID', 'pReserved', 'in']])
|
47
|
-
|
47
|
+
|
48
48
|
dll.add_function( 'WlanQueryInterface', 'DWORD',[
|
49
49
|
['DWORD', 'hClientHandle', 'in'],
|
50
50
|
['PBLOB', 'pInterfaceGuid', 'in'],
|
@@ -53,14 +53,14 @@ class Def_wlanapi
|
|
53
53
|
['PDWORD', 'pdwDataSize', 'out'],
|
54
54
|
['PDWORD', 'ppData', 'out'],
|
55
55
|
['PDWORD', 'pWlanOpcodeValueType', 'out']])
|
56
|
-
|
56
|
+
|
57
57
|
dll.add_function( 'WlanScan', 'DWORD',[
|
58
58
|
['DWORD', 'hClientHandle', 'in'],
|
59
59
|
['PBLOB', 'pInterfaceGuid', 'in'],
|
60
60
|
['PBLOB', 'pDot11Ssid', 'in'],
|
61
61
|
['PBLOB', 'pIeData', 'in'],
|
62
62
|
['LPVOID', 'pReserved', 'in']])
|
63
|
-
|
63
|
+
|
64
64
|
dll.add_function( 'WlanGetNetworkBssList', 'DWORD',[
|
65
65
|
['DWORD', 'hClientHandle', 'in'],
|
66
66
|
['PBLOB', 'pInterfaceGuid', 'in'],
|
@@ -69,16 +69,16 @@ class Def_wlanapi
|
|
69
69
|
['BOOL', 'bSecurityEnabled', 'in'],
|
70
70
|
['LPVOID', 'pReserved', 'in'],
|
71
71
|
['PDWORD', 'ppWlanBssList', 'out']])
|
72
|
-
|
72
|
+
|
73
73
|
dll.add_function( 'WlanDisconnect', 'DWORD',[
|
74
74
|
['DWORD', 'hClientHandle', 'in'],
|
75
75
|
['PBLOB', 'pInterfaceGuid', 'in'],
|
76
76
|
['LPVOID', 'pReserved', 'in']])
|
77
|
-
|
78
|
-
|
77
|
+
|
78
|
+
|
79
79
|
return dll
|
80
80
|
end
|
81
|
-
|
81
|
+
|
82
82
|
end
|
83
83
|
|
84
84
|
end; end; end; end; end; end; end
|
@@ -54,10 +54,10 @@ class DLL
|
|
54
54
|
self.functions = {}
|
55
55
|
end
|
56
56
|
|
57
|
-
def known_function_names
|
57
|
+
def known_function_names
|
58
58
|
return functions.keys
|
59
59
|
end
|
60
|
-
|
60
|
+
|
61
61
|
def get_function(name)
|
62
62
|
return functions[name]
|
63
63
|
end
|
@@ -74,7 +74,7 @@ class DLL
|
|
74
74
|
def call_function(func_symbol, args, client)
|
75
75
|
func_name = func_symbol.to_s
|
76
76
|
|
77
|
-
unless known_function_names.include? func_name
|
77
|
+
unless known_function_names.include? func_name
|
78
78
|
raise "DLL-function #{func_name} not found. Known functions: #{PP.pp(known_function_names, '')}"
|
79
79
|
end
|
80
80
|
|
@@ -1,6 +1,6 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
2
|
|
3
|
-
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
|
3
|
+
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
|
4
4
|
|
5
5
|
require 'rex/post/meterpreter/extensions/stdapi/railgun/dll'
|
6
6
|
require 'rex/post/meterpreter/extensions/stdapi/railgun/mock_magic'
|
@@ -50,7 +50,7 @@ class DLLFunction
|
|
50
50
|
@@directions = ["in", "out", "inout", "return"].freeze
|
51
51
|
|
52
52
|
attr_reader :return_type, :params, :windows_name
|
53
|
-
|
53
|
+
|
54
54
|
def initialize(return_type, params, windows_name)
|
55
55
|
check_return_type(return_type) # we do error checking as early as possible so the library is easier to use
|
56
56
|
check_params(params)
|
@@ -58,9 +58,9 @@ class DLLFunction
|
|
58
58
|
@params = params
|
59
59
|
@windows_name = windows_name
|
60
60
|
end
|
61
|
-
|
61
|
+
|
62
62
|
private
|
63
|
-
|
63
|
+
|
64
64
|
def check_type_exists (type)
|
65
65
|
if not @@allowed_datatypes.has_key?(type)
|
66
66
|
raise ArgumentError, "Type unknown: #{type}. Allowed types: #{PP.pp(@@allowed_datatypes.keys, "")}"
|
@@ -85,16 +85,16 @@ class DLLFunction
|
|
85
85
|
|
86
86
|
# Only our set of predefined directions are valid
|
87
87
|
unless @@directions.include?(direction)
|
88
|
-
raise ArgumentError, "invalid direction: #{direction}"
|
88
|
+
raise ArgumentError, "invalid direction: #{direction}"
|
89
89
|
end
|
90
90
|
|
91
91
|
# 'return' is not a valid direction in this context
|
92
92
|
unless direction != "return"
|
93
|
-
raise "direction 'return' is only for the return value of the function."
|
93
|
+
raise "direction 'return' is only for the return value of the function."
|
94
94
|
end
|
95
95
|
end
|
96
96
|
end
|
97
|
-
|
97
|
+
|
98
98
|
end
|
99
99
|
|
100
100
|
end; end; end; end; end; end
|
@@ -1,6 +1,6 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
2
|
|
3
|
-
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
|
3
|
+
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
|
4
4
|
|
5
5
|
require 'rex/post/meterpreter/extensions/stdapi/railgun/dll_function'
|
6
6
|
require 'test/unit'
|
@@ -31,7 +31,7 @@ class DLLFunction::UnitTest < Test::Unit::TestCase
|
|
31
31
|
#
|
32
32
|
# assert_raised(ArgumentError, "check_type_exists should raise ArgumentError on unknown datatypes") do
|
33
33
|
# end
|
34
|
-
|
34
|
+
|
35
35
|
end
|
36
36
|
end
|
37
37
|
end
|
@@ -32,7 +32,7 @@ module Railgun
|
|
32
32
|
#
|
33
33
|
# shared functions
|
34
34
|
#
|
35
|
-
#
|
35
|
+
#
|
36
36
|
module DLLHelper
|
37
37
|
|
38
38
|
# converts ruby string to zero-terminated ASCII string
|
@@ -133,7 +133,7 @@ module DLLHelper
|
|
133
133
|
blob += buffer
|
134
134
|
# sf: force 8 byte alignment to satisfy x64, wont matter on x86.
|
135
135
|
while( blob.length % 8 != 0 )
|
136
|
-
blob += "\x00"
|
136
|
+
blob += "\x00"
|
137
137
|
end
|
138
138
|
#puts " heap blob size now #{blob.length}"
|
139
139
|
end
|
@@ -142,7 +142,7 @@ module DLLHelper
|
|
142
142
|
#puts " built buffer: #{direction}"
|
143
143
|
return [layout, blob]
|
144
144
|
end
|
145
|
-
|
145
|
+
|
146
146
|
end
|
147
147
|
|
148
|
-
end; end; end; end; end; end;
|
148
|
+
end; end; end; end; end; end;
|
@@ -16,8 +16,8 @@ module Railgun
|
|
16
16
|
class DLLHelper::UnitTest < Test::Unit::TestCase
|
17
17
|
|
18
18
|
###
|
19
|
-
# We will test against this instance of DLLHelper (a module)
|
20
|
-
#
|
19
|
+
# We will test against this instance of DLLHelper (a module)
|
20
|
+
#
|
21
21
|
# We freeze the instance and make the reference constant to ensure consistency
|
22
22
|
##
|
23
23
|
TEST_DLL_HELPER = Object.new.extend(DLLHelper).freeze
|
@@ -28,13 +28,13 @@ class DLLHelper::UnitTest < Test::Unit::TestCase
|
|
28
28
|
# converts ruby string to zero-terminated ASCII string
|
29
29
|
zero_terminated_ascii_attempt = TEST_DLL_HELPER.str_to_ascii_z(original_string)
|
30
30
|
|
31
|
-
assert(zero_terminated_ascii_attempt =~ /\x00$/,
|
31
|
+
assert(zero_terminated_ascii_attempt =~ /\x00$/,
|
32
32
|
"str_to_ascii_z should result in a 0 terminated string")
|
33
33
|
|
34
|
-
assert(zero_terminated_ascii_attempt =~ /^#{original_string}/,
|
34
|
+
assert(zero_terminated_ascii_attempt =~ /^#{original_string}/,
|
35
35
|
"str_to_ascii_z should still start with original string")
|
36
36
|
|
37
|
-
assert_equal(original_string.length + 1, zero_terminated_ascii_attempt.length,
|
37
|
+
assert_equal(original_string.length + 1, zero_terminated_ascii_attempt.length,
|
38
38
|
"str_to_ascii_z should have length of original pluss room for a terminal 0")
|
39
39
|
end
|
40
40
|
|
@@ -83,7 +83,7 @@ class DLLHelper::UnitTest < Test::Unit::TestCase
|
|
83
83
|
end
|
84
84
|
|
85
85
|
def test_assemble_buffer
|
86
|
-
# TODO: provide test coverage
|
86
|
+
# TODO: provide test coverage
|
87
87
|
#skip("Currently DLLHelper.assemble_buffer does not have coverage")
|
88
88
|
end
|
89
89
|
|
@@ -95,7 +95,7 @@ class DLLHelper::UnitTest < Test::Unit::TestCase
|
|
95
95
|
|
96
96
|
y_key = 'Y'
|
97
97
|
y_value = 5
|
98
|
-
|
98
|
+
|
99
99
|
logical_or = x_key + '|' + y_key
|
100
100
|
target_result_of_logical_or = x_value | y_value
|
101
101
|
|
@@ -6,7 +6,7 @@ module Stdapi
|
|
6
6
|
module Railgun
|
7
7
|
class DLLWrapper
|
8
8
|
attr_reader :_client, :_dll
|
9
|
-
|
9
|
+
|
10
10
|
def initialize(dll, client)
|
11
11
|
@_dll = dll
|
12
12
|
@_client = client
|
@@ -15,7 +15,7 @@ class DLLWrapper
|
|
15
15
|
# For backwards compatability. People check if functions are added this way
|
16
16
|
# XXX: Depricate this
|
17
17
|
def functions
|
18
|
-
# warn 'Depricated.'
|
18
|
+
# warn 'Depricated.'
|
19
19
|
_dll.functions
|
20
20
|
end
|
21
21
|
|
@@ -1,6 +1,6 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
2
|
|
3
|
-
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
|
3
|
+
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
|
4
4
|
|
5
5
|
require 'rex/post/meterpreter/extensions/stdapi/railgun/dll'
|
6
6
|
require 'rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper'
|
@@ -10,13 +10,13 @@ require 'rex/post/meterpreter/extensions/stdapi/railgun/tlv'
|
|
10
10
|
#
|
11
11
|
# This mixin serves as a means of providing common mock objects and utilities
|
12
12
|
# relevant to railgun until a better home is decided upon
|
13
|
-
#
|
13
|
+
#
|
14
14
|
module MockMagic
|
15
|
-
|
15
|
+
|
16
16
|
TLV_TYPE_NAMES = {
|
17
17
|
TLV_TYPE_RAILGUN_SIZE_OUT => "TLV_TYPE_RAILGUN_SIZE_OUT",
|
18
18
|
TLV_TYPE_RAILGUN_STACKBLOB => "TLV_TYPE_RAILGUN_STACKBLOB",
|
19
|
-
TLV_TYPE_RAILGUN_BUFFERBLOB_IN => "TLV_TYPE_RAILGUN_BUFFERBLOB_IN",
|
19
|
+
TLV_TYPE_RAILGUN_BUFFERBLOB_IN => "TLV_TYPE_RAILGUN_BUFFERBLOB_IN",
|
20
20
|
TLV_TYPE_RAILGUN_BUFFERBLOB_INOUT => "TLV_TYPE_RAILGUN_BUFFERBLOB_INOUT",
|
21
21
|
TLV_TYPE_RAILGUN_DLLNAME => "TLV_TYPE_RAILGUN_DLLNAME",
|
22
22
|
TLV_TYPE_RAILGUN_FUNCNAME => "TLV_TYPE_RAILGUN_FUNCNAME",
|
@@ -28,7 +28,7 @@ module MockMagic
|
|
28
28
|
def initialize(platform, response_tlvs, check_request)
|
29
29
|
@check_request = check_request
|
30
30
|
@response_tlvs = response_tlvs
|
31
|
-
@platform = platform
|
31
|
+
@platform = platform
|
32
32
|
end
|
33
33
|
|
34
34
|
def send_request(request)
|
@@ -511,4 +511,4 @@ module MockMagic
|
|
511
511
|
|
512
512
|
end
|
513
513
|
|
514
|
-
end; end; end; end; end; end;
|
514
|
+
end; end; end; end; end; end;
|
@@ -40,7 +40,7 @@ module Railgun
|
|
40
40
|
class MultiCaller
|
41
41
|
|
42
42
|
include DLLHelper
|
43
|
-
|
43
|
+
|
44
44
|
def initialize( client, parent )
|
45
45
|
@parent = parent
|
46
46
|
@client = client
|
@@ -102,7 +102,7 @@ class MultiCaller
|
|
102
102
|
args[param_idx] = 8
|
103
103
|
buffer_size = args[param_idx]
|
104
104
|
end
|
105
|
-
|
105
|
+
|
106
106
|
if( @native == 'Q' )
|
107
107
|
raise "Please pass 8 for 'out' PDWORDS, since they require a buffer of size 8" unless buffer_size == 8
|
108
108
|
elsif( @native == 'V' )
|
@@ -299,11 +299,11 @@ class MultiCaller
|
|
299
299
|
function_results
|
300
300
|
end
|
301
301
|
# process_multi_function_call
|
302
|
-
|
302
|
+
|
303
303
|
protected
|
304
|
-
|
304
|
+
|
305
305
|
attr_accessor :win_consts
|
306
|
-
|
306
|
+
|
307
307
|
end # MultiCall
|
308
|
-
|
308
|
+
|
309
309
|
end; end; end; end; end; end
|
@@ -81,7 +81,7 @@ class Railgun
|
|
81
81
|
##
|
82
82
|
# Returns a Hash containing DLLs added to this instance with #add_dll
|
83
83
|
# as well as references to any frozen cached dlls added directly in #get_dll
|
84
|
-
# and copies of any frozen dlls (added directly with #add_function)
|
84
|
+
# and copies of any frozen dlls (added directly with #add_function)
|
85
85
|
# that the user attempted to modify with #add_function.
|
86
86
|
#
|
87
87
|
# Keys are friendly DLL names and values are the corresponding DLL instance
|
@@ -98,7 +98,7 @@ class Railgun
|
|
98
98
|
|
99
99
|
# if you are going to touch @@cached_dlls, wear protection
|
100
100
|
@@cache_semaphore = Mutex.new
|
101
|
-
|
101
|
+
|
102
102
|
def initialize(client)
|
103
103
|
self.client = client
|
104
104
|
self.dlls = {}
|
@@ -129,11 +129,11 @@ class Railgun
|
|
129
129
|
# LPVOID parameters)
|
130
130
|
#
|
131
131
|
def memread(address, length)
|
132
|
-
|
132
|
+
|
133
133
|
raise "Invalid parameters." if(not address or not length)
|
134
|
-
|
134
|
+
|
135
135
|
request = Packet.create_request('stdapi_railgun_memread')
|
136
|
-
|
136
|
+
|
137
137
|
request.add_tlv(TLV_TYPE_RAILGUN_MEM_ADDRESS, address)
|
138
138
|
request.add_tlv(TLV_TYPE_RAILGUN_MEM_LENGTH, length)
|
139
139
|
|
@@ -141,20 +141,20 @@ class Railgun
|
|
141
141
|
if(response.result == 0)
|
142
142
|
return response.get_tlv_value(TLV_TYPE_RAILGUN_MEM_DATA)
|
143
143
|
end
|
144
|
-
|
144
|
+
|
145
145
|
return nil
|
146
146
|
end
|
147
|
-
|
147
|
+
|
148
148
|
#
|
149
149
|
# Write data to a memory address on the host (useful for working with
|
150
150
|
# LPVOID parameters)
|
151
151
|
#
|
152
152
|
def memwrite(address, data, length)
|
153
|
-
|
153
|
+
|
154
154
|
raise "Invalid parameters." if(not address or not data or not length)
|
155
|
-
|
155
|
+
|
156
156
|
request = Packet.create_request('stdapi_railgun_memwrite')
|
157
|
-
|
157
|
+
|
158
158
|
request.add_tlv(TLV_TYPE_RAILGUN_MEM_ADDRESS, address)
|
159
159
|
request.add_tlv(TLV_TYPE_RAILGUN_MEM_DATA, data)
|
160
160
|
request.add_tlv(TLV_TYPE_RAILGUN_MEM_LENGTH, length)
|
@@ -163,16 +163,16 @@ class Railgun
|
|
163
163
|
if(response.result == 0)
|
164
164
|
return true
|
165
165
|
end
|
166
|
-
|
166
|
+
|
167
167
|
return false
|
168
168
|
end
|
169
|
-
|
169
|
+
|
170
170
|
#
|
171
171
|
# Adds a function to an existing DLL definition.
|
172
172
|
#
|
173
173
|
# If the DLL definition is frozen (ideally this should be the case for all
|
174
174
|
# cached dlls) an unfrozen copy is created and used henceforth for this
|
175
|
-
# instance.
|
175
|
+
# instance.
|
176
176
|
#
|
177
177
|
def add_function(dll_name, function_name, return_type, params, windows_name=nil)
|
178
178
|
|
@@ -182,7 +182,7 @@ class Railgun
|
|
182
182
|
|
183
183
|
dll = get_dll(dll_name)
|
184
184
|
|
185
|
-
# For backwards compatibility, we ensure the dll is thawed
|
185
|
+
# For backwards compatibility, we ensure the dll is thawed
|
186
186
|
if dll.frozen?
|
187
187
|
# dup will copy values, but not the frozen status
|
188
188
|
dll = dll.dup
|
@@ -213,7 +213,7 @@ class Railgun
|
|
213
213
|
dlls[dll_name] = DLL.new(windows_name, constant_manager)
|
214
214
|
end
|
215
215
|
|
216
|
-
|
216
|
+
|
217
217
|
def known_dll_names
|
218
218
|
return BUILTIN_DLLS | dlls.keys
|
219
219
|
end
|
@@ -238,9 +238,9 @@ class Railgun
|
|
238
238
|
if dll_name !~ /^\w+$/
|
239
239
|
raise "DLL name #{dll_name} is bad. Correct Railgun::BUILTIN_DLLS"
|
240
240
|
end
|
241
|
-
|
242
|
-
require 'rex/post/meterpreter/extensions/stdapi/railgun/def/def_' << dll_name
|
243
|
-
|
241
|
+
|
242
|
+
require 'rex/post/meterpreter/extensions/stdapi/railgun/def/def_' << dll_name
|
243
|
+
dll = Def.const_get('Def_' << dll_name).create_dll.freeze
|
244
244
|
|
245
245
|
@@cached_dlls[dll_name] = dll
|
246
246
|
dlls[dll_name] = dll
|
@@ -251,7 +251,7 @@ class Railgun
|
|
251
251
|
|
252
252
|
return dlls[dll_name]
|
253
253
|
end
|
254
|
-
|
254
|
+
|
255
255
|
#
|
256
256
|
# Fake having members like user32 and kernel32.
|
257
257
|
# reason is that
|
@@ -265,7 +265,7 @@ class Railgun
|
|
265
265
|
unless known_dll_names.include? dll_name
|
266
266
|
raise "DLL #{dll_name} not found. Known DLLs: #{PP.pp(known_dll_names, '')}"
|
267
267
|
end
|
268
|
-
|
268
|
+
|
269
269
|
dll = get_dll(dll_name)
|
270
270
|
|
271
271
|
return DLLWrapper.new(dll, client)
|