librex 0.0.65 → 0.0.66

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb.ut.rb

@@ -0,0 +1,128 @@
+#!/usr/bin/env ruby
+# -*- coding: binary -*-
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..','..','..','..','..', '..', '..', 'lib'))
+
+require 'rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util'
+require 'rex/post/meterpreter/extensions/stdapi/railgun/platform_util'
+require 'rex/post/meterpreter/extensions/stdapi/railgun/mock_magic'
+require 'test/unit'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Stdapi
+module Railgun
+module Type
+class PlatformUtil::UnitTest < Test::Unit::TestCase
+
+	include Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::MockMagic
+
+	# memread value of win x86 pointer mapped to target unpack value
+	X86_32_POINTERS = {
+		"8D\x15\x00"       => 1393720,
+		"\x1C\x84\x15\x00" => 1410076,
+		"\x0E\x84\x15\x00" => 1410062,
+		"\x02\x84\x15\x00" => 1410050,
+		"\xE6\x83\x15\x00" => 1410022,
+		"\xC4\x83\x15\x00" => 1409988,
+		"\x00\x00\x00\x00" => 0,
+	}
+	X86_64_POINTERS = {
+		"\x10^ \x00\x00\x00\x00\x00"       => 2121232,
+		"\xCA\x9D \x00\x00\x00\x00\x00"    => 2137546,
+		"\xC8\x9D \x00\x00\x00\x00\x00"    => 2137544,
+		"Z\x9D \x00\x00\x00\x00\x00"       => 2137434,
+		"X\x9D \x00\x00\x00\x00\x00"       => 2137432,
+		"\x00\x00\x00\x00\x00\x00\x00\x00" => 0,
+	}
+
+	X86_64_NULL_POINTER = "\x00\x00\x00\x00\x00\x00\x00\x00"
+	X86_32_NULL_POINTER = "\x00\x00\x00\x00"
+
+	X86_64 = PlatformUtil::X86_64
+	X86_32 = PlatformUtil::X86_32
+
+	def test_pack_pointer
+		X86_64_POINTERS.invert.each_pair do |unpacked, packed|
+			assert_equal(packed, PointerUtil.pack_pointer(unpacked.to_i, X86_64),
+				"pack_pointer should pack 64-bit numberic pointers")
+		end
+
+		X86_32_POINTERS.invert.each_pair do |unpacked, packed|
+			assert_equal(packed, PointerUtil.pack_pointer(unpacked.to_i, X86_32),
+				"pack_pointer should pack 32-bit numberic pointers")
+		end
+
+		assert_equal(X86_64_NULL_POINTER, PointerUtil.pack_pointer(nil, X86_64),
+			'pack_pointer should pack "nil" as a null pointer for x86_64')
+
+		assert_equal(X86_32_NULL_POINTER, PointerUtil.pack_pointer(nil, X86_32),
+			'pack_pointer should pack "nil" as a null pointer for x86_32')
+
+		assert_equal(X86_64_NULL_POINTER, PointerUtil.pack_pointer(0, X86_64),
+			'pack_pointer should pack numeric 0 as a null pointer for x86_64')
+
+		assert_equal(X86_32_NULL_POINTER, PointerUtil.pack_pointer(0, X86_32),
+			'pack_pointer should pack numeric 9 as a null pointer for x86_32')
+	end
+
+	def test_unpack_pointer
+		X86_64_POINTERS.each_pair do |packed, unpacked|
+			assert_equal(unpacked, PointerUtil.unpack_pointer(packed, X86_64),
+				"unpack_pointer should unpack 64-bit pointers")
+		end
+
+		X86_32_POINTERS.each_pair do |packed, unpacked|
+			assert_equal(unpacked, PointerUtil.unpack_pointer(packed, X86_32),
+				"unpack_pointer should unpack 32-bit pointers")
+		end
+
+
+	end
+
+	def test_is_null_pointer
+		[X86_32, X86_64].each do |platform|
+			assert(PointerUtil.is_null_pointer?(nil, platform), 'nil should be a null pointer')
+			assert(PointerUtil.is_null_pointer?(0, platform), 'numeric 0 should be a null pointer')
+		end
+
+		assert_equal(true, PointerUtil.is_null_pointer?(X86_32_NULL_POINTER, X86_32),
+			'is_null_pointer? should return true for packed 32-bit null pointers')
+
+		assert_equal(true, PointerUtil.is_null_pointer?(X86_64_NULL_POINTER, X86_64),
+			'is_null_pointer? should return true for packed 64-bit null pointers')
+
+	end
+
+	def test_pointer_size
+		assert_equal(8, PointerUtil.pointer_size(X86_64),
+			'pointer_size should report X86_64 arch as 8 (bytes)')
+
+		assert_equal(4, PointerUtil.pointer_size(X86_32),
+			'pointer_size should report X86_32 arch as 4 (bytes)')
+	end
+
+	def test_is_pointer_type
+		assert_equal(true, PointerUtil.is_pointer_type?(:pointer),
+			'pointer_type should return true for the symbol :pointer')
+
+		assert_equal(true, PointerUtil.is_pointer_type?('LPVOID'),
+			'pointer_type should return true if string begins with LP')
+
+		assert_equal(true, PointerUtil.is_pointer_type?('PDWORD'),
+			'pointer_type should return true if string begins with P')
+
+		assert_equal(false, PointerUtil.is_pointer_type?('LOLZ'),
+			'pointer_type should return false if not a pointer type')
+
+	end
+end
+end
+end
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/post/meterpreter/extensions/stdapi/railgun/dll_helper'
 
 module Rex

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 # Copyright (c) 2010, patrickHVE@googlemail.com
 # All rights reserved.
 #
@@ -33,6 +34,7 @@ module Railgun
 # Manages our library of windows constants
 #
 class WinConstManager
+	attr_reader :consts
 
 	def initialize(initial_consts = {})
 		@consts = {}
@@ -40,12 +42,10 @@ class WinConstManager
 		initial_consts.each_pair do |name, value|
 			add_const(name, value)
 		end
-
-		# Load utility
 	end
 
 	def add_const(name, value)
-		@consts[name] = value
+		consts[name] = value
 	end
 
 	# parses a string constaining constants and returns an integer
@@ -59,16 +59,37 @@ class WinConstManager
 		return_value = 0
 		for one_const in s.split('|')
 			one_const = one_const.strip()
-			if not @consts.has_key? one_const
+			if not consts.has_key? one_const
 				return nil # at least one "Constant" is unknown to us
 			end
-			return_value |= @consts[one_const]
+			return_value |= consts[one_const]
 		end
 		return return_value
 	end
 
 	def is_parseable(s)
-		return parse(s) != nil
+		return !parse(s).nil?
+	end
+
+	#
+	# Returns an array of constant names that have a value matching "winconst"
+	# and (optionally) a name that matches "filter_regex"
+	# 
+	def select_const_names(winconst, filter_regex=nil)
+		matches = []
+
+		consts.each_pair do |name, value|
+			matches << name if value == winconst
+		end
+		
+		# Filter matches by name if a filter has been provided
+		unless filter_regex.nil?
+			matches.reject! do |name|
+				name !~ filter_regex
+			end
+		end
+
+		return matches
 	end
 end
 

data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..','..','..','..','..', 'lib'))
 
@@ -12,6 +13,26 @@ module Extensions
 module Stdapi
 module Railgun
 class WinConstManager::UnitTest < Test::Unit::TestCase
+
+	def test_select_const_names
+		const_manager = WinConstManager.new
+
+		names = %w(W WW WWW)
+
+		names.each do |name|
+			const_manager.add_const(name, 23)
+		end
+
+		assert(const_manager.select_const_names(23).sort == names,
+			'select_const_names should return all names for given value')
+
+		const_manager.add_const('Skidoo!', 23)
+
+		assert(const_manager.select_const_names(23, /^\w{1,3}$/).sort == names,
+			'select_const_names should filter names with provided regex')
+		
+	end
+
 	def test_is_parseable
 		const_manager = WinConstManager.new
 

data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/object_aliases'
 require 'rex/post/meterpreter/extension'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/process'
 require 'rex/post/meterpreter/packet'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/process'
 require 'rex/post/meterpreter/packet'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post

data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/process'
 require 'rex/post/meterpreter/packet'
@@ -58,4 +59,4 @@ class Power
 
 end
 
-end end end end end end
+end end end end end end

data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/process'
 require 'rex/post/meterpreter/packet'
@@ -212,12 +213,12 @@ class Process < Rex::Post::Process
 	end
 
 	#
-	# Returns an array of processes with hash objects that have
-	# keys for 'pid', 'parentid', 'name', 'path', 'user' and 'arch'.
+	# Returns a ProcessList of processes as Hash objects with keys for 'pid',
+	# 'ppid', 'name', 'path', 'user', 'session' and 'arch'.
 	#
 	def Process.get_processes
 		request   = Packet.create_request('stdapi_sys_process_get_processes')
-		processes = []
+		processes = ProcessList.new
 
 		response = client.send_request(request)
 
@@ -236,7 +237,7 @@ class Process < Rex::Post::Process
 		processes <<
 				{
 					'pid'      => p.get_tlv_value(TLV_TYPE_PID),
-					'parentid' => p.get_tlv_value(TLV_TYPE_PARENT_PID),
+					'ppid'     => p.get_tlv_value(TLV_TYPE_PARENT_PID),
 					'name'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_NAME) ),
 					'path'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_PATH) ),
 					'session'  => p.get_tlv_value(TLV_TYPE_PROCESS_SESSION),
@@ -366,5 +367,43 @@ protected
 
 end
 
+#
+# Simple wrapper class for storing processes
+#
+class ProcessList < Array
+
+	#
+	# Create a Rex::Ui::Text::Table out of the processes stored in this list
+	#
+	# +opts+ is passed on to Rex::Ui::Text::Table.new, mostly unmolested
+	#
+	# Note that this output is affected by Rex::Post::Meterpreter::Client#unicode_filter_encode
+	#
+	def to_table(opts={})
+		if empty?
+			return Rex::Ui::Text::Table.new(opts)
+		end
+
+		cols = [ "PID", "PPID", "Name", "Arch", "Session", "User", "Path" ]
+		# Arch and Session are specific to native Windows, PHP and Java can't do
+		# ppid.  Cut columns from the list if they aren't there.  It is conceivable
+		# that processes might have different columns, but for now assume that the
+		# first one is representative.
+		cols.delete_if { |c| !( first.has_key?(c.downcase) ) or first[c.downcase].nil? }
+
+		opts = {
+			"Header"  => "Process List",
+			"Columns" => cols
+		}.merge(opts)
+
+		tbl = Rex::Ui::Text::Table.new(opts)
+		each { |process|
+			tbl << cols.map {|c| process[c.downcase] }.compact
+		}
+
+		tbl
+	end
+end
+
 end; end; end; end; end; end
 

data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/client'
 require 'rex/post/meterpreter/extensions/stdapi/constants'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/client'
 require 'rex/post/meterpreter/extensions/stdapi/constants'
@@ -52,4 +53,4 @@ protected
 
 end
 
-end; end; end; end; end; end; end
+end; end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/client'
 require 'rex/post/meterpreter/extensions/stdapi/constants'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/client'
 require 'rex/post/meterpreter/extensions/stdapi/constants'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/process'
 require 'rex/post/meterpreter/packet'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/stdapi/constants'
 require 'rex/post/meterpreter/extensions/stdapi/sys/registry'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/stdapi/constants'
 require 'rex/post/meterpreter/extensions/stdapi/sys/registry'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/stdapi/constants'
 require 'rex/post/meterpreter/extensions/stdapi/sys/registry'

data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/thread'
 require 'rex/post/meterpreter/client'

data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post
@@ -43,20 +44,26 @@ TLV_TYPE_SEARCH_RESULTS     = TLV_META_TYPE_GROUP   | 1233
 ##
 TLV_TYPE_HOST_NAME          = TLV_META_TYPE_STRING  | 1400
 TLV_TYPE_PORT               = TLV_META_TYPE_UINT    | 1401
+TLV_TYPE_INTERFACE_MTU      = TLV_META_TYPE_UINT    | 1402
+TLV_TYPE_INTERFACE_FLAGS    = TLV_META_TYPE_STRING  | 1403
+TLV_TYPE_INTERFACE_INDEX    = TLV_META_TYPE_UINT    | 1404
 
 TLV_TYPE_SUBNET             = TLV_META_TYPE_RAW     | 1420
 TLV_TYPE_NETMASK            = TLV_META_TYPE_RAW     | 1421
 TLV_TYPE_GATEWAY            = TLV_META_TYPE_RAW     | 1422
 TLV_TYPE_NETWORK_ROUTE      = TLV_META_TYPE_GROUP   | 1423
+TLV_TYPE_IP_PREFIX          = TLV_META_TYPE_UINT    | 1424
 
 TLV_TYPE_IP                 = TLV_META_TYPE_RAW     | 1430
 TLV_TYPE_MAC_ADDRESS        = TLV_META_TYPE_RAW     | 1431
 TLV_TYPE_MAC_NAME           = TLV_META_TYPE_STRING  | 1432
 TLV_TYPE_NETWORK_INTERFACE  = TLV_META_TYPE_GROUP   | 1433
+TLV_TYPE_IP6_SCOPE          = TLV_META_TYPE_RAW     | 1434
 
 TLV_TYPE_SUBNET_STRING      = TLV_META_TYPE_STRING  | 1440
 TLV_TYPE_NETMASK_STRING     = TLV_META_TYPE_STRING  | 1441
 TLV_TYPE_GATEWAY_STRING     = TLV_META_TYPE_STRING  | 1442
+TLV_TYPE_ROUTE_METRIC       = TLV_META_TYPE_UINT    | 1443
 
 # Socket
 TLV_TYPE_PEER_HOST          = TLV_META_TYPE_STRING  | 1500