librex 0.0.65 → 0.0.66

data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/ui'
 
@@ -10,7 +11,7 @@ module Stdapi
 
 ###
 #
-# Allows for interacting with the user interface on the remote machine, 
+# Allows for interacting with the user interface on the remote machine,
 # such as by disabling the keyboard and mouse.
 #
 # WARNING:
@@ -46,7 +47,7 @@ class UI < Rex::Post::UI
 	# Disable keyboard input on the remote machine.
 	#
 	def disable_keyboard
-		return enable_keyboard(false)	
+		return enable_keyboard(false)
 	end
 
 	#
@@ -112,7 +113,7 @@ class UI < Rex::Post::UI
 		end
 		return desktopz
 	end
-	
+
 	#
 	# Get the current desktop meterpreter is using.
 	#
@@ -129,10 +130,10 @@ class UI < Rex::Post::UI
 		end
 		return desktop
 	end
-	
+
 	#
-	# Change the meterpreters current desktop. The switch param sets this 
-	# new desktop as the interactive one (The local users visible desktop 
+	# Change the meterpreters current desktop. The switch param sets this
+	# new desktop as the interactive one (The local users visible desktop
 	# with screen/keyboard/mouse control).
 	#
 	def set_desktop( session=-1, station='WinSta0', name='Default', switch=false )
@@ -147,12 +148,12 @@ class UI < Rex::Post::UI
 		end
 		return false
 	end
-	
+
 	#
 	# Grab a screenshot of the interactive desktop
 	#
 	def screenshot( quality=50 )
-		request = Packet.create_request( 'stdapi_ui_desktop_screenshot' ) 
+		request = Packet.create_request( 'stdapi_ui_desktop_screenshot' )
 		request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_QUALITY, quality )
 		# include the x64 screenshot dll if the host OS is x64
 		if( client.sys.config.sysinfo['Architecture'] =~ /^\S*x64\S*/ )
@@ -191,7 +192,7 @@ class UI < Rex::Post::UI
 		response = client.send_request(request)
 		return true
 	end
-			
+
 	#
 	# Start the keyboard sniffer
 	#
@@ -218,7 +219,7 @@ class UI < Rex::Post::UI
 		response = client.send_request(request)
 		return response.get_tlv_value(TLV_TYPE_KEYS_DUMP);
 	end
-	
+
 	#
 	# Extract the keystroke from the buffer data
 	#
@@ -228,11 +229,11 @@ class UI < Rex::Post::UI
 			fl = (inp & 0xff00) >> 8
 			vk = (inp & 0xff)
 			kc = VirtualKeyCodes[vk]
-			
+
 			f_shift = fl & (1<<1)
 			f_ctrl  = fl & (1<<2)
 			f_alt   = fl & (1<<3)
-	
+
 			if(kc)
 				name = ((f_shift != 0 and kc.length > 1) ? kc[1] : kc[0])
 				case name
@@ -250,7 +251,7 @@ class UI < Rex::Post::UI
 		end
 		return outp
 	end
-	
+
 protected
 	attr_accessor :client # :nodoc:
 

data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post

data/lib/rex/post/meterpreter/inbound_packet_handler.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post
@@ -27,4 +28,4 @@ module InboundPacketHandler
 
 end
 
-end; end; end
+end; end; end

data/lib/rex/post/meterpreter/object_aliases.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post
@@ -44,7 +45,7 @@ module ObjectAliasesContainer
 
 				items << current_path
 
-				items.concat(dump_alias_tree(current_path, 
+				items.concat(dump_alias_tree(current_path,
 					current.aliases[x]))
 			}
 		end
@@ -60,19 +61,19 @@ end
 
 ###
 #
-# Generic object aliases from a class instance referenced symbol to an 
+# Generic object aliases from a class instance referenced symbol to an
 # associated object of an arbitrary type
 #
 ###
 class ObjectAliases
 	include Rex::Post::Meterpreter::ObjectAliasesContainer
-	
+
 	##
 	#
 	# Constructor
 	#
 	##
-	
+
 	# An instance
 	def initialize(aliases = {})
 		initialize_aliases(aliases)
@@ -80,4 +81,4 @@ class ObjectAliases
 end
 
 
-end; end; end
+end; end; end

data/lib/rex/post/meterpreter/packet.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post
@@ -54,6 +55,7 @@ TLV_TYPE_REQUEST_ID         = TLV_META_TYPE_STRING |   2
 TLV_TYPE_EXCEPTION          = TLV_META_TYPE_GROUP  |   3
 TLV_TYPE_RESULT             = TLV_META_TYPE_UINT   |   4
 
+
 TLV_TYPE_STRING             = TLV_META_TYPE_STRING |  10
 TLV_TYPE_UINT               = TLV_META_TYPE_UINT   |  11
 TLV_TYPE_BOOL               = TLV_META_TYPE_BOOL   |  12
@@ -129,13 +131,14 @@ class Tlv
 
 	def inspect
 		utype = type ^ TLV_META_TYPE_COMPRESSED
+		group = false
 		meta = case (utype & TLV_META_MASK)
 			when TLV_META_TYPE_STRING; "STRING"
 			when TLV_META_TYPE_UINT; "INT"
 			when TLV_META_TYPE_RAW; "RAW"
 			when TLV_META_TYPE_BOOL; "BOOL"
 			when TLV_META_TYPE_QWORD; "QWORD"
-			when TLV_META_TYPE_GROUP; "GROUP"
+			when TLV_META_TYPE_GROUP; group=true; "GROUP"
 			when TLV_META_TYPE_COMPLEX; "COMPLEX"
 			else; 'unknown-meta-type'
 			end
@@ -175,16 +178,33 @@ class Tlv
 			when TLV_TYPE_MIGRATE_PAYLOAD; "MIGRATE-PAYLOAD"
 			when TLV_TYPE_MIGRATE_ARCH; "MIGRATE-ARCH"
 
-			# Extension classes don't exist yet, so can't use their constants
-			# here.
-			#when Extensions::Stdapi::TLV_TYPE_IP;           'ip-address'
+			#when Extensions::Stdapi::TLV_TYPE_NETWORK_INTERFACE; 'network-interface'
+			#when Extensions::Stdapi::TLV_TYPE_IP; 'ip-address'
+			#when Extensions::Stdapi::TLV_TYPE_NETMASK; 'netmask'
+			#when Extensions::Stdapi::TLV_TYPE_MAC_ADDRESS; 'mac-address'
+			#when Extensions::Stdapi::TLV_TYPE_MAC_NAME; 'interface-name'
+			#when Extensions::Stdapi::TLV_TYPE_IP6_SCOPE; 'address-scope'
+			#when Extensions::Stdapi::TLV_TYPE_INTERFACE_MTU; 'interface-mtu'
+			#when Extensions::Stdapi::TLV_TYPE_INTERFACE_FLAGS; 'interface-flags'
+			#when Extensions::Stdapi::TLV_TYPE_INTERFACE_INDEX; 'interface-index'
+
 			else; "unknown-#{type}"
 			end
 		val = value.inspect
 		if val.length > 50
 			val = val[0,50] + ' ..."'
 		end
-		"#<#{self.class} type=#{stype} #{self.class.to_s =~ /Packet/ ? "tlvs=#{@tlvs.inspect}" : "meta=#{meta} value=#{val}"} >"
+		group ||= (self.class.to_s =~ /Packet/)
+		if group
+			tlvs_inspect = "tlvs=[\n"
+			@tlvs.each { |t|
+				tlvs_inspect << "  #{t.inspect}\n"
+			}
+			tlvs_inspect << "]"
+		else
+			tlvs_inspect = "meta=#{meta.ljust 10} value=#{val}"
+		end
+		"#<#{self.class} type=#{stype.ljust 15} #{tlvs_inspect}>"
 	end
 
 	##
@@ -366,7 +386,7 @@ class GroupTlv < Tlv
 	# Synonym for each.
 	#
 	def each_tlv(type = TLV_TYPE_ANY, &block)
-		each(type, block)
+		each(type, &block)
 	end
 
 	#

data/lib/rex/post/meterpreter/packet_dispatcher.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'rex/post/meterpreter/packet_response_waiter'
 require 'rex/logging'

data/lib/rex/post/meterpreter/packet_parser.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 module Rex
 module Post

data/lib/rex/post/meterpreter/packet_response_waiter.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
 require 'timeout'
 require 'thread'

data/lib/rex/post/meterpreter/ui/console.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/ui'
 require 'rex/post/meterpreter'
 require 'rex/logging'

data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/logging'
 
 module Rex

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/post/meterpreter'
 require 'rex/parser/arguments'
 
@@ -43,11 +44,9 @@ class Console::CommandDispatcher::Core
 			"close"      => "Closes a channel",
 			"channel"    => "Displays information about active channels",
 			"exit"       => "Terminate the meterpreter session",
-			"detach"     => "Detach the meterpreter session (for http/https)",
 			"help"       => "Help menu",
 			"interact"   => "Interacts with a channel",
 			"irb"        => "Drop into irb scripting mode",
-			"migrate"    => "Migrate the server to another process",
 			"use"        => "Deprecated alias for 'load'",
 			"load"       => "Load one or more meterpreter extensions",
 			"quit"       => "Terminate the meterpreter session",
@@ -61,6 +60,18 @@ class Console::CommandDispatcher::Core
 			"enable_unicode_encoding"  => "Enables encoding of unicode strings",
 			"disable_unicode_encoding" => "Disables encoding of unicode strings"
 		}
+
+		if client.passive_service
+			c["detach"] = "Detach the meterpreter session (for http/https)"
+		end
+		# The only meterp that implements this right now is native Windows and for
+		# whatever reason it is not adding core_migrate to its list of commands.
+		# Use a dumb platform til it gets sorted.
+		#if client.commands.include? "core_migrate"
+		if client.platform =~ /win/
+			c["migrate"] = "Migrate the server to another process"
+		end
+
 		if (msf_loaded?)
 			c["info"] = "Displays information about a Post module"
 		end
@@ -83,6 +94,7 @@ class Console::CommandDispatcher::Core
 	end
 
 	def cmd_background
+		print_status "Backgrounding session #{client.name}..."
 		client.interacting = false
 	end
 
@@ -91,6 +103,7 @@ class Console::CommandDispatcher::Core
 	#
 	@@channel_opts = Rex::Parser::Arguments.new(
 		"-c" => [ true,  "Close the given channel." ],
+		"-k" => [ true,  "Close the given channel." ],
 		"-i" => [ true,  "Interact with the given channel." ],
 		"-l" => [ false, "List active channels." ],
 		"-r" => [ true,  "Read from the given channel." ],
@@ -108,7 +121,7 @@ class Console::CommandDispatcher::Core
 	# Performs operations on the supplied channel.
 	#
 	def cmd_channel(*args)
-		if args.include?("-h") or args.include?("--help")
+		if args.empty? or args.include?("-h") or args.include?("--help")
 			cmd_channel_help
 			return
 		end
@@ -122,7 +135,7 @@ class Console::CommandDispatcher::Core
 			case opt
 			when "-l"
 				mode = :list
-			when "-c"
+			when "-c", "-k"
 				mode = :close
 				chan = val
 			when "-i"
@@ -179,14 +192,35 @@ class Console::CommandDispatcher::Core
 		end
 	end
 
+	def cmd_channel_tabs(str, words)
+		case words.length
+		when 1
+			@@channel_opts.fmt.keys
+		when 2
+			case words[1]
+			when "-k", "-c", "-i", "-r", "-w"
+				tab_complete_channels
+			else
+				[]
+			end
+		else
+			[]
+		end
+	end
+
+	def cmd_close_help
+		print_line "Usage: close <channel_id>"
+		print_line
+		print_line "Closes the supplied channel."
+		print_line
+	end
+
 	#
 	# Closes a supplied channel.
 	#
 	def cmd_close(*args)
 		if (args.length == 0)
-			print_line(
-				"Usage: close channel_id\n\n" +
-				"Closes the supplied channel.")
+			cmd_close_help
 			return true
 		end
 
@@ -203,6 +237,12 @@ class Console::CommandDispatcher::Core
 		end
 	end
 
+	def cmd_close_tabs(str, words)
+		return [] if words.length > 1
+
+		return tab_complete_channels
+	end
+
 	#
 	# Terminates the meterpreter session.
 	#
@@ -215,6 +255,17 @@ class Console::CommandDispatcher::Core
 
 	alias cmd_quit cmd_exit
 
+	def cmd_detach_help
+		print_line "Detach from the victim. Only possible for non-stream sessions (http/https)"
+		print_line
+		print_line "The victim will continue to attempt to call back to the handler until it"
+		print_line "successfully connects (which may happen immediately if you have a handler"
+		print_line "running in the background), or reaches its expiration."
+		print_line
+		print_line "This session may #{client.passive_service ? "" : "NOT"} be detached."
+		print_line
+	end
+
 	#
 	# Disconnects the session
 	#
@@ -227,14 +278,19 @@ class Console::CommandDispatcher::Core
 		shell.stop
 	end
 
+	def cmd_interact_help
+		print_line "Usage: interact <channel_id>"
+		print_line
+		print_line "Interacts with the supplied channel."
+		print_line
+	end
+
 	#
 	# Interacts with a channel.
 	#
 	def cmd_interact(*args)
 		if (args.length == 0)
-			print_line(
-				"Usage: interact channel_id\n\n" +
-				"Interacts with the supplied channel.")
+			cmd_info_help
 			return true
 		end
 
@@ -250,6 +306,8 @@ class Console::CommandDispatcher::Core
 		end
 	end
 
+	alias cmd_interact_tabs cmd_close_tabs
+
 	#
 	# Runs the IRB scripting shell
 	#
@@ -260,15 +318,20 @@ class Console::CommandDispatcher::Core
 		Rex::Ui::Text::IrbShell.new(binding).run
 	end
 
+	def cmd_migrate_help
+		print_line "Usage: migrate <pid>"
+		print_line
+		print_line "Migrates the server instance to another process."
+		print_line "NOTE: Any open channels or other dynamic state will be lost."
+		print_line
+	end
+
 	#
 	# Migrates the server to the supplied process identifier.
 	#
 	def cmd_migrate(*args)
 		if (args.length == 0)
-			print_line(
-				"Usage: migrate pid\n\n" +
-				"Migrates the server instance to another process.\n" +
-				"Note: Any open channels or other dynamic state will be lost.")
+			cmd_migrate_help
 			return true
 		end
 
@@ -370,14 +433,19 @@ class Console::CommandDispatcher::Core
 	alias cmd_use_help cmd_load_help
 	alias cmd_use_tabs cmd_load_tabs
 
+	def cmd_read_help
+		print_line "Usage: read <channel_id> [length]"
+		print_line
+		print_line "Reads data from the supplied channel."
+		print_line
+	end
+
 	#
 	# Reads data from a channel.
 	#
 	def cmd_read(*args)
 		if (args.length == 0)
-			print_line(
-				"Usage: read channel_id [length]\n\n" +
-				"Reads data from the supplied channel.")
+			cmd_read_help
 			return true
 		end
 
@@ -401,6 +469,8 @@ class Console::CommandDispatcher::Core
 		return true
 	end
 
+	alias cmd_read_tabs cmd_close_tabs
+
 	def cmd_run_help
 		print_line "Usage: run <script> [arguments]"
 		print_line
@@ -668,17 +738,15 @@ class Console::CommandDispatcher::Core
 		return true
 	end
 
-	def cmd_resource_tabs(str, words)
-		return [] if words.length > 1
-
-		tab_complete_filenames(str, words)
+	def cmd_resource_help
+		print_line "Usage: resource <path1> [path2 ...]"
+		print_line
+		print_line "Run the commands stored in the supplied files."
+		print_line
 	end
 
 	def cmd_resource(*args)
 		if args.empty?
-			print(
-				"Usage: resource path1 path2" +
-				  "Run the commands stored in the supplied files.\n")
 			return false
 		end
 		args.each do |glob|
@@ -709,6 +777,12 @@ class Console::CommandDispatcher::Core
 		end
 	end
 
+	def cmd_resource_tabs(str, words)
+		return [] if words.length > 1
+
+		tab_complete_filenames(str, words)
+	end
+
 	def cmd_enable_unicode_encoding
 		client.encode_unicode = true
 		print_status("Unicode encoding is enabled")
@@ -782,12 +856,9 @@ protected
 	end
 
 	def tab_complete_postmods
-		# XXX This might get slow with a large number of post
-		# modules.  The proper solution is probably to implement a
-		# Module::Post#session_compatible?(session_object_or_int) method
 		tabs = client.framework.modules.post.map { |name,klass|
 			mod = klass.new
-			if mod.compatible_sessions.include?(client.sid)
+			if mod.session_compatible?(client)
 				mod.fullname.dup
 			else
 				nil
@@ -798,6 +869,10 @@ protected
 		tabs.compact
 	end
 
+	def tab_complete_channels
+		client.channels.keys.map { |k| k.to_s }
+	end
+
 end
 
 end