librex 0.0.65 → 0.0.66

data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'ipaddr'
 
@@ -25,17 +26,19 @@ class Route
 	#
 	# Initializes a route instance.
 	#
-	def initialize(subnet, netmask, gateway)
-		self.subnet  = IPAddr.ntop(subnet)
-		self.netmask = IPAddr.ntop(netmask)
-		self.gateway = IPAddr.ntop(gateway)
+	def initialize(subnet, netmask, gateway, interface='', metric=0)
+		self.subnet  = IPAddr.new_ntoh(subnet).to_s
+		self.netmask = IPAddr.new_ntoh(netmask).to_s
+		self.gateway = IPAddr.new_ntoh(gateway).to_s
+		self.interface = interface
+		self.metric = metric
 	end
 
 	#
 	# Provides a pretty version of the route.
 	#
 	def pretty
-		return sprintf("%16s %16s %16s", subnet, netmask, gateway)
+		return sprintf("%16s %16s %16s %d %16s", subnet, netmask, gateway, metric, interface)
 	end
 
 	#
@@ -50,7 +53,16 @@ class Route
 	# The gateway to take for the subnet route.
 	#
 	attr_accessor :gateway
+	#
+	# The interface to take for the subnet route.
+	#
+	attr_accessor :interface
+	#
+	# The metric of the route.
+	#
+	attr_accessor :metric
+
 
 end
 
-end; end; end; end; end; end
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'thread'
 require 'rex/socket'

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'thread'
 require 'rex/post/meterpreter/channel'

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'timeout'
 require 'thread'
 require 'rex/socket/parameters'

data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'timeout'
 require 'rex/sync/thread_safe'
 require 'rex/socket/udp'

data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb

@@ -1,10 +1,13 @@
+# -*- coding: binary -*-
 $:.unshift(File.join(File.dirname(__FILE__)))
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..','..','..','..','..', 'lib')) 
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..','..','..','..','..', 'lib'))
 
 require 'test/unit'
 require 'rex'
 
 require 'railgun/api_constants.rb.ut'
+require 'railgun/type/pointer_util.rb.ut'
+require 'railgun/platform_util.rb.ut'
 require 'railgun/buffer_item.rb.ut'
 require 'railgun/dll_function.rb.ut'
 require 'railgun/dll_helper.rb.ut'

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager'
 require 'thread'
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..'))
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter
@@ -21,6 +22,17 @@ class Def_netapi32
 			["PDWORD","lpNameBugger","out"],
 			["PDWORD","BufferType","out"]
 			])
+		dll.add_function('NetServerEnum', 'DWORD',[
+			["PWCHAR","servername","in"],
+			["DWORD","level","in"],
+			["PDWORD","bufptr","out"],
+			["DWORD","prefmaxlen","in"],
+			["PDWORD","entriesread","out"],
+			["PDWORD","totalentries","out"],
+			["DWORD","servertype","in"],
+			["PWCHAR","domain","in"],
+			["DWORD","resume_handle","inout"]
+		])
 
 		return dll
 	end

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter
@@ -18,6 +19,12 @@ class Def_ws2_32
 			["PDWORD","ppResult","out"]
 			])
 
+		dll.add_function('gethostbyaddr', 'DWORD', [
+			['PCHAR', 'addr', 'in'],
+			['DWORD','len','in'],
+			['DWORD','type','in']
+			])
+
 		dll.add_function('WSAAccept', 'DWORD',[
 			["DWORD","s","in"],
 			["PBLOB","addr","inout"],

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Post
 module Meterpreter

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb

@@ -0,0 +1,23 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Railgun
+module PlatformUtil
+
+	X86_64 = :x86_64
+	X86_32 = :x86_32
+
+	def self.parse_client_platform(meterp_client_platform)
+		meterp_client_platform =~ /win64/ ? X86_64 : X86_32
+	end
+
+end # PlatformUtil
+end # Railgun
+end # Stdapi
+end # Extensions
+end # Meterpreter
+end # Post
+end # Rex

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb.ut.rb

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+# -*- coding: binary -*-
+
+$:.unshift(File.join(File.dirname(__FILE__), '..','..','..','..','..', '..', '..', 'lib'))
+
+require 'rex/post/meterpreter/extensions/stdapi/railgun/platform_util'
+require 'rex/post/meterpreter/extensions/stdapi/railgun/mock_magic'
+require 'test/unit'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Railgun
+class PlatformUtil::UnitTest < Test::Unit::TestCase
+	def test_parse_client_platform
+		assert_equal(PlatformUtil.parse_client_platform('x86/win32'), PlatformUtil::X86_32,
+			'parse_client_platform should translate Win32 client platforms')
+		assert_equal(PlatformUtil.parse_client_platform('x86/win64'), PlatformUtil::X86_64,
+			'parse_client_platform should translate Win64 client platforms')
+	end
+end
+end
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #
@@ -61,9 +62,9 @@ class Railgun
 	# definition class 'rex/post/meterpreter/extensions/stdapi/railgun/def/'.
 	# Naming is important and should follow convention.  For example, if your
 	# dll's name was "my_dll"
-	# file name::   def_my_dll.rb
-	# class name::  Def_my_dll
-	# entry below:: 'my_dll'
+	# file name:    def_my_dll.rb
+	# class name:   Def_my_dll
+	# entry below: 'my_dll'
 	#
 	BUILTIN_DLLS = [
 		'kernel32',
@@ -104,6 +105,10 @@ class Railgun
 		self.dlls = {}
 	end
 
+	def self.builtin_dlls
+		BUILTIN_DLLS
+	end
+
 	#
 	# Return this Railgun's Util instance.
 	#
@@ -184,8 +189,8 @@ class Railgun
 
 		# For backwards compatibility, we ensure the dll is thawed
 		if dll.frozen?
-			# dup will copy values, but not the frozen status
-			dll = dll.dup
+			# Duplicate not only the dll, but its functions as well. Frozen status will be lost
+			dll = Marshal.load(Marshal.dump(dll))
 
 			# Update local dlls with the modifiable duplicate
 			dlls[dll_name] = dll

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 
@@ -120,6 +121,14 @@ class Railgun::UnitTest < Test::Unit::TestCase
 
 			assert(!unfrozen_dll.frozen?,
 				"add_function should create a local unfrozen instance that get_dll can then access")
+
+			railgun2 = Railgun.new(make_mock_client())
+
+			assert(!railgun2.get_dll(dll_name).functions.has_key?('__lolz'),
+				"functions added to one instance of railgun should not be accessible to others")
+
+			assert_not_same(!railgun2.get_dll(dll_name).functions, unfrozen_dll.functions,
+				"function hash should have been duplicated during unfreeze")
 		end
 	end
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb

@@ -0,0 +1,106 @@
+# -*- coding: binary -*-
+require 'rex/post/meterpreter/extensions/stdapi/railgun/platform_util'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Railgun
+module Type
+module PointerUtil
+
+	ARCH_POINTER_SIZE = {
+		PlatformUtil::X86_64 => 8,
+		PlatformUtil::X86_32 => 4
+	}.freeze
+
+	# Returns the pointer size for this architecture. Should accept client or platform or arch
+	def self.pointer_size(platform)
+		ARCH_POINTER_SIZE[platform]
+	end
+
+	def self.pack_pointer(pointer, platform)
+		if pointer.nil?
+			return pack_pointer(0, platform)
+		end
+
+		case platform
+		when PlatformUtil::X86_64
+			# XXX: Only works if attacker and victim are like-endianed
+			[pointer].pack('Q')
+		when PlatformUtil::X86_32
+			[pointer].pack('V')
+		else
+			raise "platform symbol #{platform.to_s} not supported"
+		end
+	end
+
+	# Given a packed pointer, unpack it according to architecture
+	def self.unpack_pointer(packed_pointer, platform)
+		case platform
+		when PlatformUtil::X86_64
+			# XXX: Only works if attacker and victim are like-endianed
+			packed_pointer.unpack('Q').first
+		when PlatformUtil::X86_32
+			packed_pointer.unpack('V').first
+		else
+			raise "platform symbol #{platform.to_s} not supported"
+		end
+	end
+
+	def self.null_pointer(pointer, platform)
+		pack_pointer(0, platform)
+	end
+
+	###
+	# Summary: Returns true if pointer will be considered a 'null' pointer
+	#
+	# If given nil, returns true
+	# If given 0, returns true
+	# If given a string, if 0 after unpacking, returns true
+	# false otherwise
+	##
+	def self.is_null_pointer?(pointer, platform)
+		if pointer.kind_of?(String)
+			pointer = unpack_pointer(pointer, platform)
+		end
+
+		return pointer.nil? || pointer == 0
+	end
+#
+#	def self.is_unpacked_pointer?(pointer, platform)
+#		# TODO also check that the integer size is appropriate for the platform
+#		unless pointer.kind_of?(Fixnum) and pointer > 0 # and pointer <
+#			return false
+#		end
+#
+#		packed_pointer = pack_pointer(pointer, platform)
+#		if !packed_pointer.nil? and packed_pointer.length == pointer_size(platform)
+#			return true
+#		end
+#
+#		return false
+#	end
+#
+	# Returns true if the data type is a pointer, false otherwise
+	def self.is_pointer_type?(type)
+		if type == :pointer
+			return true
+		end
+
+		if type.kind_of?(String) && type =~ /^L?P/
+			return true
+		end
+
+		return false
+	end
+
+end # PointerUtil
+end # Type
+end # Railgun
+end # Stdapi
+end # Extensions
+end # Meterpreter
+end # Post
+end # Rex