librex 0.0.65 → 0.0.66

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/post/meterpreter'
 require 'rex/service_manager'
 
@@ -54,11 +55,39 @@ class Console::CommandDispatcher::Stdapi::Net
 	# List of supported commands.
 	#
 	def commands
-		{
+		all = {
 			"ipconfig" => "Display interfaces",
+			"ifconfig" => "Display interfaces",
 			"route"    => "View and modify the routing table",
 			"portfwd"  => "Forward a local port to a remote service",
 		}
+		reqs = {
+			"ipconfig" => [ "stdapi_net_config_get_interfaces" ],
+			"ifconfig" => [ "stdapi_net_config_get_interfaces" ],
+			"route"    => [
+				# Also uses these, but we don't want to be unable to list them
+				# just because we can't alter them.
+				#"stdapi_net_config_add_route",
+				#"stdapi_net_config_remove_route",
+				"stdapi_net_config_get_routes"
+			],
+			# Only creates tcp channels, which is something whose availability
+			# we can't check directly at the moment.
+			"portfwd"  => [ ],
+		}
+
+		all.delete_if do |cmd, desc|
+			del = false
+			reqs[cmd].each do |req|
+				next if client.commands.include? req
+				del = true
+				break
+			end
+
+			del
+		end
+
+		all
 	end
 
 	#
@@ -77,12 +106,14 @@ class Console::CommandDispatcher::Stdapi::Net
 		if (ifaces.length == 0)
 			print_line("No interfaces were found.")
 		else
-			client.net.config.each_interface { |iface|
+			ifaces.sort{|a,b| a.index <=> b.index}.each do |iface|
 				print("\n" + iface.pretty + "\n")
-			}
+			end
 		end
 	end
 
+	alias :cmd_ifconfig :cmd_ipconfig
+
 	#
 	# Displays or modifies the routing table on the remote machine.
 	#
@@ -114,25 +145,56 @@ class Console::CommandDispatcher::Stdapi::Net
 			when "list"
 				routes = client.net.config.routes
 
-				if (routes.length == 0)
-					print_line("No routes were found.")
+				# IPv4
+				tbl = Rex::Ui::Text::Table.new(
+					'Header'  => "IPv4 network routes",
+					'Indent'  => 4,
+					'Columns' =>
+						[
+							"Subnet",
+							"Netmask",
+							"Gateway",
+							"Metric",
+							"Interface"
+						])
+
+				routes.select {|route|
+					Rex::Socket.is_ipv4?(route.netmask)
+				}.each { |route|
+					tbl << [ route.subnet, route.netmask, route.gateway, route.metric, route.interface ]
+				}
+
+				if tbl.rows.length > 0
+					print("\n" + tbl.to_s + "\n")
 				else
-					tbl = Rex::Ui::Text::Table.new(
-						'Header'  => "Network routes",
-						'Indent'  => 4,
-						'Columns' =>
-							[
-								"Subnet",
-								"Netmask",
-								"Gateway"
-							])
-
-					routes.each { |route|
-						tbl << [ route.subnet, route.netmask, route.gateway ]
-					}
+					print_line("No IPv4 routes were found.")
+				end
 
+				# IPv6
+				tbl = Rex::Ui::Text::Table.new(
+					'Header'  => "IPv6 network routes",
+					'Indent'  => 4,
+					'Columns' =>
+						[
+							"Subnet",
+							"Netmask",
+							"Gateway",
+							"Metric",
+							"Interface"
+						])
+
+				routes.select {|route|
+					Rex::Socket.is_ipv6?(route.netmask)
+				}.each { |route|
+					tbl << [ route.subnet, route.netmask, route.gateway, route.metric, route.interface ]
+				}
+
+				if tbl.rows.length > 0
 					print("\n" + tbl.to_s + "\n")
+				else
+					print_line("No IPv6 routes were found.")
 				end
+
 			when "add"
                         	# Satisfy check to see that formatting is correct
                                 unless Rex::Socket::RangeWalker.new(args[0]).length == 1

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/post/meterpreter'
 
 module Rex
@@ -48,23 +49,67 @@ class Console::CommandDispatcher::Stdapi::Sys
 	# List of supported commands.
 	#
 	def commands
-		{
-			"clearev"  => "Clear the event log",
-			"execute"  => "Execute a command",
-			"getpid"   => "Get the current process identifier",
-			"getuid"   => "Get the user that the server is running as",
-			"getprivs" => "Attempt to enable all privileges available to the current process",
-			"kill"     => "Terminate a process",
-			"ps"       => "List running processes",
-			"reboot"   => "Reboots the remote computer",
-			"reg"      => "Modify and interact with the remote registry",
-			"rev2self" => "Calls RevertToSelf() on the remote machine",
-			"sysinfo"  => "Gets information about the remote system, such as OS",
-			"shell"    => "Drop into a system command shell",
-			"shutdown" => "Shuts down the remote computer",
-			"steal_token" => "Attempts to steal an impersonation token from the target process",
+		all = {
+			"clearev"     => "Clear the event log",
 			"drop_token"  => "Relinquishes any active impersonation token.",
+			"execute"     => "Execute a command",
+			"getpid"      => "Get the current process identifier",
+			"getprivs"    => "Attempt to enable all privileges available to the current process",
+			"getuid"      => "Get the user that the server is running as",
+			"kill"        => "Terminate a process",
+			"ps"          => "List running processes",
+			"reboot"      => "Reboots the remote computer",
+			"reg"         => "Modify and interact with the remote registry",
+			"rev2self"    => "Calls RevertToSelf() on the remote machine",
+			"shell"       => "Drop into a system command shell",
+			"shutdown"    => "Shuts down the remote computer",
+			"steal_token" => "Attempts to steal an impersonation token from the target process",
+			"sysinfo"     => "Gets information about the remote system, such as OS",
+		}
+		reqs = {
+			"clearev"     => [ "stdapi_sys_eventlog_open", "stdapi_sys_eventlog_clear" ],
+			"drop_token"  => [ "stdapi_sys_config_drop_token" ],
+			"execute"     => [ "stdapi_sys_process_execute" ],
+			"getpid"      => [ "stdapi_sys_process_getpid"  ],
+			"getprivs"    => [ "stdapi_sys_config_getprivs" ],
+			"getuid"      => [ "stdapi_sys_config_getuid" ],
+			"kill"        => [ "stdapi_sys_process_kill" ],
+			"ps"          => [ "stdapi_sys_process_get_processes" ],
+			"reboot"      => [ "stdapi_sys_power_exitwindows" ],
+			"reg"         => [
+				"stdapi_registry_load_key",
+				"stdapi_registry_unload_key",
+				"stdapi_registry_open_key",
+				"stdapi_registry_open_remote_key",
+				"stdapi_registry_create_key",
+				"stdapi_registry_delete_key",
+				"stdapi_registry_close_key",
+				"stdapi_registry_enum_key",
+				"stdapi_registry_set_value",
+				"stdapi_registry_query_value",
+				"stdapi_registry_delete_value",
+				"stdapi_registry_query_class",
+				"stdapi_registry_enum_value",
+			],
+			"rev2self"    => [ "stdapi_sys_config_rev2self" ],
+			"shell"       => [ "stdapi_sys_process_execute" ],
+			"shutdown"    => [ "stdapi_sys_power_exitwindows" ],
+			"steal_token" => [ "stdapi_sys_config_steal_token" ],
+			"sysinfo"     => [ "stdapi_sys_config_sysinfo" ],
 		}
+
+		all.delete_if do |cmd, desc|
+			del = false
+			reqs[cmd].each do |req|
+				next if client.commands.include? req
+				del = true
+				break
+			end
+
+			del
+		end
+
+		all
 	end
 
 	#
@@ -153,12 +198,21 @@ class Console::CommandDispatcher::Stdapi::Sys
 	# Drop into a system shell as specified by %COMSPEC% or
 	# as appropriate for the host.
 	def cmd_shell(*args)
-		if client.platform =~/win/
+		case client.platform
+		when /win/
 			path = client.fs.file.expand_path("%COMSPEC%")
 			path = (path and not path.empty?) ? path : "cmd.exe"
 			cmd_execute("-f", path, "-c", "-H", "-i", "-t")
+		when /linux/
+			# Don't expand_path() this because it's literal anyway
+			path = "/bin/sh"
+			cmd_execute("-f", path, "-c", "-i")
 		else
-			path = client.fs.file.expand_path("/bin/bash")
+			# Then this is a multi-platform meterpreter (php or java), which
+			# must special-case COMSPEC to return the system-specific shell.
+			path = client.fs.file.expand_path("%COMSPEC%")
+			# If that failed for whatever reason, guess it's unix
+			path = (path and not path.empty?) ? path : "/bin/sh"
 			cmd_execute("-f", path, "-c", "-i")
 		end
 	end
@@ -220,38 +274,13 @@ class Console::CommandDispatcher::Stdapi::Sys
 	#
 	def cmd_ps(*args)
 		processes = client.sys.process.get_processes
-		tbl = Rex::Ui::Text::Table.new(
-			'Header'  => "Process list",
-			'Indent'  => 1,
-			'Columns' =>
-				[
-					"PID",
-					"Name",
-					"Arch",
-					"Session",
-					"User",
-					"Path"
-				])
-
-		processes.each { |ent|
-
-			session = ent['session'] == 0xFFFFFFFF ? '' : ent['session'].to_s
-			arch    = ent['arch']
-
-			# for display and consistency with payload naming we switch the internal 'x86_64' value to display 'x64'
-			if( arch == ARCH_X86_64 )
-				arch = "x64"
-			end
-
-			tbl << [ ent['pid'].to_s, ent['name'], arch, session, ent['user'], ent['path'] ]
-		}
-
 		if (processes.length == 0)
 			print_line("No running processes were found.")
 		else
-			print("\n" + tbl.to_s + "\n")
+			print_line
+			print_line(processes.to_table("Indent" => 1).to_s)
+			print_line
 		end
-
 		return true
 	end
 
@@ -299,7 +328,7 @@ class Console::CommandDispatcher::Stdapi::Sys
 						"    queryclass Queries the class of the supplied key [-k <key>]\n" +
 						"    setval     Set a registry value [-k <key> -v <val> -d <data>]\n" +
 						"    deleteval  Delete the supplied registry value [-k <key> -v <val>]\n" +
-						"    queryval   Queries the data contents of a value [-k <key> -v <val>]\n\n") 
+						"    queryval   Queries the data contents of a value [-k <key> -v <val>]\n\n")
 					return false
 				when "-k"
 					key   = val
@@ -333,7 +362,7 @@ class Console::CommandDispatcher::Stdapi::Sys
 			# Rock it
 			case cmd
 				when "enumkey"
-				
+
 					open_key = nil
 					if not rem
 						open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ + wowflag)
@@ -383,7 +412,7 @@ class Console::CommandDispatcher::Stdapi::Sys
 						if remote_key
 							open_key = remote_key.create_key(base_key, KEY_WRITE + wowflag)
 						end
-					end				
+					end
 
 					print_line("Successfully created key: #{key}")
 

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'rex/post/meterpreter'
 
 module Rex
@@ -20,20 +21,50 @@ class Console::CommandDispatcher::Stdapi::Ui
 	# List of supported commands.
 	#
 	def commands
-		{
-			"idletime"      => "Returns the number of seconds the remote user has been idle",
-			"uictl"         => "Control some of the user interface components",
+		all = {
 			"enumdesktops"  => "List all accessible desktops and window stations",
 			"getdesktop"    => "Get the current meterpreter desktop",
-			"setdesktop"    => "Change the meterpreters current desktop",
+			"idletime"      => "Returns the number of seconds the remote user has been idle",
+			"keyscan_dump"  => "Dump the keystroke buffer",
 			"keyscan_start" => "Start capturing keystrokes",
 			"keyscan_stop"  => "Stop capturing keystrokes",
-			"keyscan_dump"  => "Dump the keystroke buffer",
 			"screenshot"    => "Grab a screenshot of the interactive desktop",
+			"setdesktop"    => "Change the meterpreters current desktop",
+			"uictl"         => "Control some of the user interface components",
 
 			#  not working yet
 			# "unlockdesktop" => "Unlock or lock the workstation (must be inside winlogon.exe)",
 		}
+
+		reqs = {
+			"enumdesktops"  => [ "stdapi_ui_desktop_enum" ],
+			"getdesktop"    => [ "stdapi_ui_desktop_get" ],
+			"idletime"      => [ "stdapi_ui_get_idle_time" ],
+			"keyscan_dump"  => [ "stdapi_ui_get_keys" ],
+			"keyscan_start" => [ "stdapi_ui_start_keyscan" ],
+			"keyscan_stop"  => [ "stdapi_ui_stop_keyscan" ],
+			"screenshot"    => [ "stdapi_ui_desktop_screenshot" ],
+			"setdesktop"    => [ "stdapi_ui_desktop_set" ],
+			"uictl"         => [
+				"stdapi_ui_enable_mouse",
+				"stdapi_ui_disable_mouse",
+				"stdapi_ui_enable_keyboard",
+				"stdapi_ui_disable_keyboard",
+			],
+		}
+
+		all.delete_if do |cmd, desc|
+			del = false
+			reqs[cmd].each do |req|
+				next if client.commands.include? req
+				del = true
+				break
+			end
+
+			del
+		end
+
+		all
 	end
 
 	#
@@ -51,7 +82,7 @@ class Console::CommandDispatcher::Stdapi::Ui
 
 		print_line(
 			"User has been idle for: #{Rex::ExtTime.sec_to_s(seconds)}")
-		
+
 		return true
 	end
 
@@ -94,7 +125,7 @@ class Console::CommandDispatcher::Stdapi::Ui
 
 		return true
 	end
-	
+
 	#
 	# Grab a screenshot of the current interactive desktop.
 	#
@@ -102,14 +133,14 @@ class Console::CommandDispatcher::Stdapi::Ui
 		path    = Rex::Text.rand_text_alpha(8) + ".jpeg"
 		quality = 50
 		view    = true
-		
+
 		screenshot_opts = Rex::Parser::Arguments.new(
 			"-h" => [ false, "Help Banner." ],
 			"-q" => [ true, "The JPEG image quality (Default: '#{quality}')" ],
 			"-p" => [ true, "The JPEG image path (Default: '#{path}')" ],
 			"-v" => [ true, "Automatically view the JPEG image (Default: '#{view}')" ]
 		)
-		
+
 		screenshot_opts.parse( args ) { | opt, idx, val |
 			case opt
 				when "-h"
@@ -125,32 +156,32 @@ class Console::CommandDispatcher::Stdapi::Ui
 					view = false if ( val =~ /^(f|n|0)/i )
 			end
 		}
-		
+
 		data = client.ui.screenshot( quality )
-		
+
 		if( data )
 			::File.open( path, 'wb' ) do |fd|
 				fd.write( data )
 			end
-		
+
 			path = ::File.expand_path( path )
-			
+
 			print_line( "Screenshot saved to: #{path}" )
-			
+
 			Rex::Compat.open_file( path ) if view
 		end
-		
+
 		return true
 	end
-	
+
 	#
 	# Enumerate desktops
 	#
 	def cmd_enumdesktops(*args)
 		print_line( "Enumerating all accessible desktops" )
-		
+
 		desktops = client.ui.enum_desktops
-		
+
 		desktopstable = Rex::Ui::Text::Table.new(
 			'Header'  => "Desktops",
 			'Indent'  => 4,
@@ -159,18 +190,18 @@ class Console::CommandDispatcher::Stdapi::Ui
 							"Name"
 						]
 		)
-		
+
 		desktops.each { | desktop |
 			session = desktop['session'] == 0xFFFFFFFF ? '' : desktop['session'].to_s
 			desktopstable << [ session, desktop['station'], desktop['name'] ]
 		}
-		
+
 		if( desktops.length == 0 )
 			print_line( "No accessible desktops were found." )
 		else
 			print( "\n" + desktopstable.to_s + "\n" )
 		end
-		
+
 		return true
 	end
 
@@ -178,26 +209,26 @@ class Console::CommandDispatcher::Stdapi::Ui
 	# Get the current meterpreter desktop.
 	#
 	def cmd_getdesktop(*args)
-		
+
 		desktop = client.ui.get_desktop
-		
+
 		session = desktop['session'] == 0xFFFFFFFF ? '' : "Session #{desktop['session'].to_s}\\"
-		
+
 		print_line( "#{session}#{desktop['station']}\\#{desktop['name']}" )
-		
+
 		return true
 	end
-	
+
 	#
 	# Change the meterpreters current desktop.
 	#
 	def cmd_setdesktop( *args )
-		
+
 		switch   = false
 		dsession = -1
 		dstation = 'WinSta0'
 		dname    = 'Default'
-		
+
 		setdesktop_opts = Rex::Parser::Arguments.new(
 			"-h" => [ false, "Help Banner." ],
 			#"-s" => [ true, "The session (Default: '#{dsession}')" ],
@@ -205,7 +236,7 @@ class Console::CommandDispatcher::Stdapi::Ui
 			"-n" => [ true, "The desktop name (Default: '#{dname}')" ],
 			"-i" => [ true, "Set this desktop as the interactive desktop (Default: '#{switch}')" ]
 		)
-		
+
 		setdesktop_opts.parse( args ) { | opt, idx, val |
 			case opt
 				when "-h"
@@ -223,15 +254,15 @@ class Console::CommandDispatcher::Stdapi::Ui
 					switch = true if ( val =~ /^(t|y|1)/i )
 			end
 		}
-		
+
 		if( client.ui.set_desktop( dsession, dstation, dname, switch ) )
 			print_line( "#{ switch ? 'Switched' : 'Changed' } to desktop #{dstation}\\#{dname}" )
 		else
 			print_line( "Failed to #{ switch ? 'switch' : 'change' } to desktop #{dstation}\\#{dname}" )
 		end
-		
+
 		return true
-	end	
+	end
 
 	#
 	# Unlock or lock the desktop
@@ -241,18 +272,18 @@ class Console::CommandDispatcher::Stdapi::Ui
 		if(args.length > 0)
 			mode = args[0].to_i
 		end
-		
+
 		if(mode == 0)
 			print_line("Unlocking the workstation...")
 			client.ui.unlock_desktop(true)
 		else
 			print_line("Locking the workstation...")
-			client.ui.unlock_desktop(false)	
+			client.ui.unlock_desktop(false)
 		end
 
 		return true
-	end	
-			
+	end
+
 	#
 	# Start the keyboard sniffer
 	#
@@ -260,8 +291,8 @@ class Console::CommandDispatcher::Stdapi::Ui
 		print_line("Starting the keystroke sniffer...")
 		client.ui.keyscan_start
 		return true
-	end	
-	
+	end
+
 	#
 	# Stop the keyboard sniffer
 	#
@@ -269,7 +300,7 @@ class Console::CommandDispatcher::Stdapi::Ui
 		print_line("Stopping the keystroke sniffer...")
 		client.ui.keyscan_stop
 		return true
-	end	
+	end
 
 	#
 	# Dump captured keystrokes
@@ -278,9 +309,9 @@ class Console::CommandDispatcher::Stdapi::Ui
 		print_line("Dumping captured keystrokes...")
 		data = client.ui.keyscan_dump
 		print_line(client.ui.keyscan_extract(data))
-		
+
 		return true
-	end	
+	end
 
 end