librex 0.0.68 → 0.0.70

data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 require 'rex/post/meterpreter/extensions/sniffer/tlv'
@@ -18,100 +17,100 @@ module Sniffer
 class Sniffer < Extension
 
 
-	def initialize(client)
-		super(client, 'sniffer')
-
-		client.register_extension_aliases(
-			[
-				{
-					'name' => 'sniffer',
-					'ext'  => self
-				},
-			])
-	end
-
-
-	# Enumerate the remote sniffable interfaces
-	def interfaces()
-		ifaces = []
-		ifacei = 0
-		request = Packet.create_request('sniffer_interfaces')
-		response = client.send_request(request)
-		response.each(TLV_TYPE_SNIFFER_INTERFACES) { |p|
-			vals  = p.tlvs.map{|x| x.value }
-			iface = { }
-			ikeys = %W{idx name description type mtu wireless usable dhcp}
-			ikeys.each_index { |i| iface[ikeys[i]] = vals[i] }
-			ifaces << iface
-		}
-		return ifaces
-	end
-
-	# Start a packet capture on an opened interface
-	def capture_start(intf,maxp=200000,filter="")
-		request = Packet.create_request('sniffer_capture_start')
-		request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
-		request.add_tlv(TLV_TYPE_SNIFFER_PACKET_COUNT, maxp.to_i)
-		request.add_tlv(TLV_TYPE_SNIFFER_ADDITIONAL_FILTER, filter) if filter.length > 0
-		response = client.send_request(request)
-	end
-
-	# Stop an active packet capture
-	def capture_stop(intf)
-		request = Packet.create_request('sniffer_capture_stop')
-		request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
-		response = client.send_request(request)
-		{
-			:packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
-			:bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
-		}
-	end
-
-	# Retrieve stats about a current capture
-	def capture_stats(intf)
-		request = Packet.create_request('sniffer_capture_stats')
-		request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
-		response = client.send_request(request)
-		{
-			:packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
-			:bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
-		}
-	end
-
-	# Release packets from a current capture
-	def capture_release(intf)
-		request = Packet.create_request('sniffer_capture_release')
-		request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
-		response = client.send_request(request)
-		{
-			:packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
-			:bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
-		}
-	end
-
-	# Buffer the current capture to a readable buffer
-	def capture_dump(intf)
-		request = Packet.create_request('sniffer_capture_dump')
-		request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
-		response = client.send_request(request, 3600)
-		{
-			:packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
-			:bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
-			:linktype => response.get_tlv_value(TLV_TYPE_SNIFFER_INTERFACE_ID) || 1,
-		}
-	end
-
-	# Retrieve the packet data for the specified capture
-	def capture_dump_read(intf, len=16384)
-		request = Packet.create_request('sniffer_capture_dump_read')
-		request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
-		request.add_tlv(TLV_TYPE_SNIFFER_BYTE_COUNT, len.to_i)
-		response = client.send_request(request, 3600)
-		{
-			:bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
-			:data    => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET)
-		}
-	end
+  def initialize(client)
+    super(client, 'sniffer')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'sniffer',
+          'ext'  => self
+        },
+      ])
+  end
+
+
+  # Enumerate the remote sniffable interfaces
+  def interfaces()
+    ifaces = []
+    ifacei = 0
+    request = Packet.create_request('sniffer_interfaces')
+    response = client.send_request(request)
+    response.each(TLV_TYPE_SNIFFER_INTERFACES) { |p|
+      vals  = p.tlvs.map{|x| x.value }
+      iface = { }
+      ikeys = %W{idx name description type mtu wireless usable dhcp}
+      ikeys.each_index { |i| iface[ikeys[i]] = vals[i] }
+      ifaces << iface
+    }
+    return ifaces
+  end
+
+  # Start a packet capture on an opened interface
+  def capture_start(intf,maxp=200000,filter="")
+    request = Packet.create_request('sniffer_capture_start')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    request.add_tlv(TLV_TYPE_SNIFFER_PACKET_COUNT, maxp.to_i)
+    request.add_tlv(TLV_TYPE_SNIFFER_ADDITIONAL_FILTER, filter) if filter.length > 0
+    response = client.send_request(request)
+  end
+
+  # Stop an active packet capture
+  def capture_stop(intf)
+    request = Packet.create_request('sniffer_capture_stop')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+    }
+  end
+
+  # Retrieve stats about a current capture
+  def capture_stats(intf)
+    request = Packet.create_request('sniffer_capture_stats')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+    }
+  end
+
+  # Release packets from a current capture
+  def capture_release(intf)
+    request = Packet.create_request('sniffer_capture_release')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+    }
+  end
+
+  # Buffer the current capture to a readable buffer
+  def capture_dump(intf)
+    request = Packet.create_request('sniffer_capture_dump')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    response = client.send_request(request, 3600)
+    {
+      :packets => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET_COUNT),
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+      :linktype => response.get_tlv_value(TLV_TYPE_SNIFFER_INTERFACE_ID) || 1,
+    }
+  end
+
+  # Retrieve the packet data for the specified capture
+  def capture_dump_read(intf, len=16384)
+    request = Packet.create_request('sniffer_capture_dump_read')
+    request.add_tlv(TLV_TYPE_SNIFFER_INTERFACE_ID, intf.to_i)
+    request.add_tlv(TLV_TYPE_SNIFFER_BYTE_COUNT, len.to_i)
+    response = client.send_request(request, 3600)
+    {
+      :bytes   => response.get_tlv_value(TLV_TYPE_SNIFFER_BYTE_COUNT),
+      :data    => response.get_tlv_value(TLV_TYPE_SNIFFER_PACKET)
+    }
+  end
 
 end
 

data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 ###
@@ -11,6 +10,14 @@
 #
 ###
 
+##
+#
+# Net
+#
+##
+AF_INET = 2
+AF_INET6 = 23
+
 ##
 #
 # Permissions
@@ -83,14 +90,14 @@ KEY_CREATE_LINK          = 0x00000020
 KEY_WOW64_64KEY          = 0x00000100
 KEY_WOW64_32KEY          = 0x00000200
 KEY_READ                 = (STANDARD_RIGHTS_READ | KEY_QUERY_VALUE |
-                            KEY_ENUMERATE_SUB_KEYS | KEY_NOTIFY) & ~SYNCHRONIZE
+              KEY_ENUMERATE_SUB_KEYS | KEY_NOTIFY) & ~SYNCHRONIZE
 KEY_WRITE                = (STANDARD_RIGHTS_WRITE | KEY_SET_VALUE |
-                            KEY_CREATE_SUB_KEY) & ~SYNCHRONIZE
+              KEY_CREATE_SUB_KEY) & ~SYNCHRONIZE
 KEY_EXECUTE              = KEY_READ
 KEY_ALL_ACCESS           = (STANDARD_RIGHTS_ALL | KEY_QUERY_VALUE |
-                            KEY_SET_VALUE | KEY_CREATE_SUB_KEY |
-                            KEY_ENUMERATE_SUB_KEYS | KEY_NOTIFY |
-                            KEY_CREATE_LINK) & ~SYNCHRONIZE
+              KEY_SET_VALUE | KEY_CREATE_SUB_KEY |
+              KEY_ENUMERATE_SUB_KEYS | KEY_NOTIFY |
+              KEY_CREATE_LINK) & ~SYNCHRONIZE
 
 ##
 #
@@ -180,6 +187,59 @@ EWX_FORCE                   = 0x00000004
 EWX_POWEROFF                = 0x00000008
 EWX_FORCEIFHUNG             = 0x00000010
 
+##
+#
+# Shutdown Reason Codes
+#
+##
+SHTDN_REASON_MINOR_DC_PROMOTION             = 0x00000021
+SHTDN_REASON_MAJOR_APPLICATION              = 0x00040000
+SHTDN_REASON_MAJOR_HARDWARE                 = 0x00010000
+SHTDN_REASON_FLAG_COMMENT_REQUIRED          = 0x01000000
+SHTDN_REASON_FLAG_DIRTY_UI                  = 0x08000000
+SHTDN_REASON_MINOR_UNSTABLE                 = 0x00000006
+SHTDN_REASON_MINOR_SECURITYFIX_UNINSTALL    = 0x00000018
+SHTDN_REASON_MINOR_ENVIRONMENT              = 0x00000000
+SHTDN_REASON_MAJOR_LEGACY_API               = 0x00070000
+SHTDN_REASON_MINOR_DC_DEMOTION              = 0x00000022
+SHTDN_REASON_MINOR_SECURITYFIX              = 0x00000012
+SHTDN_REASON_FLAG_CLEAN_UI                  = 0x04000000
+SHTDN_REASON_MINOR_HOTFIX                   = 0x00000011
+SHTDN_REASON_MINOR_CORDUNPLUGGED            = 0x00000000
+SHTDN_REASON_MINOR_HOTFIX_UNINSTALL         = 0x00000017
+SHTDN_REASON_FLAG_USER_DEFINED              = 0x40000000
+SHTDN_REASON_MINOR_SYSTEMRESTORE            = 0x00000001
+SHTDN_REASON_MINOR_OTHERDRIVER              = 0x00000000
+SHTDN_REASON_MINOR_WMI                      = 0x00000015
+SHTDN_REASON_MINOR_INSTALLATION             = 0x00000002
+SHTDN_REASON_MINOR_BLUESCREEN               = 0x0000000F
+SHTDN_REASON_MAJOR_SOFTWARE                 = 0x00030000
+SHTDN_REASON_MINOR_NETWORKCARD              = 0x00000009
+SHTDN_REASON_MINOR_SERVICEPACK_UNINSTALL    = 0x00000016
+SHTDN_REASON_MINOR_SERVICEPACK              = 0x00000010
+SHTDN_REASON_MINOR_UPGRADE                  = 0x00000003
+SHTDN_REASON_FLAG_PLANNED                   = 0x80000000
+SHTDN_REASON_MINOR_MMC                      = 0x00000019
+SHTDN_REASON_MINOR_POWER_SUPPLY             = 0x00000000
+SHTDN_REASON_MINOR_MAINTENANCE              = 0x00000001
+SHTDN_REASON_VALID_BIT_MASK                 = 0x00000000
+SHTDN_REASON_MAJOR_NONE                     = 0x00000000
+SHTDN_REASON_MAJOR_POWER                    = 0x00060000
+SHTDN_REASON_FLAG_DIRTY_PROBLEM_ID_REQUIRED = 0x02000000
+SHTDN_REASON_MINOR_OTHER                    = 0x00000000
+SHTDN_REASON_MINOR_PROCESSOR                = 0x00000008
+SHTDN_REASON_MAJOR_OTHER                    = 0x00000000
+SHTDN_REASON_MINOR_DISK                     = 0x00000007
+SHTDN_REASON_MINOR_NETWORK_CONNECTIVITY     = 0x00000014
+SHTDN_REASON_MAJOR_OPERATINGSYSTEM          = 0x00020000
+SHTDN_REASON_MINOR_HUNG                     = 0x00000005
+SHTDN_REASON_MINOR_TERMSRV                  = 0x00000020
+SHTDN_REASON_MINOR_NONE                     = 0x00000000
+SHTDN_REASON_MINOR_RECONFIG                 = 0x00000004
+SHTDN_REASON_MAJOR_SYSTEM                   = 0x00050000
+SHTDN_REASON_MINOR_HARDWARE_DRIVER          = 0x00000000
+SHTDN_REASON_MINOR_SECURITY                 = 0x00000013
+SHTDN_REASON_DEFAULT                        = SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_OTHER
 
 ##
 #
@@ -188,149 +248,149 @@ EWX_FORCEIFHUNG             = 0x00000010
 ##
 
 VirtualKeyCodes = {
-	1 => %W{ LClick },
-	2 => %W{ RClick },
-	3 => %W{ Cancel },
-	4 => %W{ MClick },
-	8 => %W{ Back  },
-	9 => %W{ Tab  },
-	10 => %W{ Newline },
-	12 => %W{ Clear },
-	13 => %W{ Return },
+  1 => %W{ LClick },
+  2 => %W{ RClick },
+  3 => %W{ Cancel },
+  4 => %W{ MClick },
+  8 => %W{ Back  },
+  9 => %W{ Tab  },
+  10 => %W{ Newline },
+  12 => %W{ Clear },
+  13 => %W{ Return },
 
-	16 => %W{ Shift },
-	17 => %W{ Ctrl },
-	18 => %W{ Alt },
-	19 => %W{ Pause },
-	20 => %W{ CapsLock },
+  16 => %W{ Shift },
+  17 => %W{ Ctrl },
+  18 => %W{ Alt },
+  19 => %W{ Pause },
+  20 => %W{ CapsLock },
 
-	27 => %W{ Esc },
+  27 => %W{ Esc },
 
-	32 => %W{ Space },
-	33 => %W{ Prior },
-	34 => %W{ Next },
-	35 => %W{ End },
-	36 => %W{ Home },
-	37 => %W{ Left },
-	38 => %W{ Up },
-	39 => %W{ Right },
-	40 => %W{ Down  },
-	41 => %W{ Select },
-	42 => %W{ Print },
-	43 => %W{ Execute },
-	44 => %W{ Snapshot },
-	45 => %W{ Insert },
-	46 => %W{ Delete },
-	47 => %W{ Help },
-	48 => %W{ 0  )},
-	49 => %W{ 1  !},
-	50 => %W{ 2  @},
-	51 => %W{ 3  #},
-	52 => %W{ 4  $},
-	53 => %W{ 5  %},
-	54 => %W{ 6  ^},
-	55 => %W{ 7  &},
-	56 => %W{ 8  *},
-	57 => %W{ 9  (},
-	65 => %W{ a  A},
-	66 => %W{ b  B},
-	67 => %W{ c  C},
-	68 => %W{ d  D},
-	69 => %W{ e  E},
-	70 => %W{ f  F},
-	71 => %W{ g  G},
-	72 => %W{ h  H},
-	73 => %W{ i  I},
-	74 => %W{ j  J},
-	75 => %W{ k  K},
-	76 => %W{ l  L},
-	77 => %W{ m  M},
-	78 => %W{ n  N},
-	79 => %W{ o  O},
-	80 => %W{ p  P},
-	81 => %W{ q  Q},
-	82 => %W{ r  R},
-	83 => %W{ s  S},
-	84 => %W{ t  T},
-	85 => %W{ u  U},
-	86 => %W{ v  V},
-	87 => %W{ w  W},
-	88 => %W{ x  X},
-	89 => %W{ y  Y},
-	90 => %W{ z  Z},
-	91 => %W{ LWin },
-	92 => %W{ RWin },
-	93 => %W{ Apps },
+  32 => %W{ Space },
+  33 => %W{ Prior },
+  34 => %W{ Next },
+  35 => %W{ End },
+  36 => %W{ Home },
+  37 => %W{ Left },
+  38 => %W{ Up },
+  39 => %W{ Right },
+  40 => %W{ Down  },
+  41 => %W{ Select },
+  42 => %W{ Print },
+  43 => %W{ Execute },
+  44 => %W{ Snapshot },
+  45 => %W{ Insert },
+  46 => %W{ Delete },
+  47 => %W{ Help },
+  48 => %W{ 0  )},
+  49 => %W{ 1  !},
+  50 => %W{ 2  @},
+  51 => %W{ 3  #},
+  52 => %W{ 4  $},
+  53 => %W{ 5  %},
+  54 => %W{ 6  ^},
+  55 => %W{ 7  &},
+  56 => %W{ 8  *},
+  57 => %W{ 9  (},
+  65 => %W{ a  A},
+  66 => %W{ b  B},
+  67 => %W{ c  C},
+  68 => %W{ d  D},
+  69 => %W{ e  E},
+  70 => %W{ f  F},
+  71 => %W{ g  G},
+  72 => %W{ h  H},
+  73 => %W{ i  I},
+  74 => %W{ j  J},
+  75 => %W{ k  K},
+  76 => %W{ l  L},
+  77 => %W{ m  M},
+  78 => %W{ n  N},
+  79 => %W{ o  O},
+  80 => %W{ p  P},
+  81 => %W{ q  Q},
+  82 => %W{ r  R},
+  83 => %W{ s  S},
+  84 => %W{ t  T},
+  85 => %W{ u  U},
+  86 => %W{ v  V},
+  87 => %W{ w  W},
+  88 => %W{ x  X},
+  89 => %W{ y  Y},
+  90 => %W{ z  Z},
+  91 => %W{ LWin },
+  92 => %W{ RWin },
+  93 => %W{ Apps },
 
-	95 => %W{ Sleep },
-	96 => %W{ N0 },
-	97 => %W{ N1 },
-	98 => %W{ N2 },
-	99 => %W{ N3 },
-	100 => %W{ N4 },
-	101 => %W{ N5 },
-	102 => %W{ N6 },
-	103 => %W{ N7 },
-	104 => %W{ N8 },
-	105 => %W{ N9 },
-	106 => %W{ Multiply },
-	107 => %W{ Add },
-	108 => %W{ Separator },
-	109 => %W{ Subtract },
-	110 => %W{ Decimal },
-	111 => %W{ Divide },
-	112 => %W{ F1 },
-	113 => %W{ F2 },
-	114 => %W{ F3 },
-	115 => %W{ F4 },
-	116 => %W{ F5 },
-	117 => %W{ F6 },
-	118 => %W{ F7 },
-	119 => %W{ F8 },
-	120 => %W{ F9 },
-	121 => %W{ F10 },
-	122 => %W{ F11 },
-	123 => %W{ F12 },
-	124 => %W{ F13 },
-	125 => %W{ F14 },
-	126 => %W{ F15 },
-	127 => %W{ F16 },
-	128 => %W{ F17 },
-	129 => %W{ F18 },
-	130 => %W{ F19 },
-	131 => %W{ F20 },
-	132 => %W{ F21 },
-	133 => %W{ F22 },
-	134 => %W{ F23 },
-	135 => %W{ F24 },
-	144 => %W{ NumLock },
-	145 => %W{ Scroll },
-	160 => %W{ LShift },
-	161 => %W{ RShift },
-	162 => %W{ LCtrl },
-	163 => %W{ RCtrl },
-	164 => %W{ LMenu },
-	165 => %W{ RMenu },
-	166 => %W{ Back },
-	167 => %W{ Forward },
-	168 => %W{ Refresh },
-	169 => %W{ Stop },
-	170 => %W{ Search },
-	171 => %W{ Favorites },
-	172 => %W{ Home },
-	176 => %W{ Forward },
-	177 => %W{ Reverse },
-	178 => %W{ Stop },
-	179 => %W{ Play },
-	186 => %W{ ;  :},
-	187 => %W{ =  +},
-	188 => %W{ ,  <},
-	189 => %W{ -  _},
-	190 => %W{ .  >},
-	191 => %W{ /  ?},
-	192 => %W{ '  ~},
-	219 => %W| [  {|,
-	220 => %W{ \  |},
-	221 => %W| ]  }|,
-	222 => %W{ '  Quotes},
+  95 => %W{ Sleep },
+  96 => %W{ N0 },
+  97 => %W{ N1 },
+  98 => %W{ N2 },
+  99 => %W{ N3 },
+  100 => %W{ N4 },
+  101 => %W{ N5 },
+  102 => %W{ N6 },
+  103 => %W{ N7 },
+  104 => %W{ N8 },
+  105 => %W{ N9 },
+  106 => %W{ Multiply },
+  107 => %W{ Add },
+  108 => %W{ Separator },
+  109 => %W{ Subtract },
+  110 => %W{ Decimal },
+  111 => %W{ Divide },
+  112 => %W{ F1 },
+  113 => %W{ F2 },
+  114 => %W{ F3 },
+  115 => %W{ F4 },
+  116 => %W{ F5 },
+  117 => %W{ F6 },
+  118 => %W{ F7 },
+  119 => %W{ F8 },
+  120 => %W{ F9 },
+  121 => %W{ F10 },
+  122 => %W{ F11 },
+  123 => %W{ F12 },
+  124 => %W{ F13 },
+  125 => %W{ F14 },
+  126 => %W{ F15 },
+  127 => %W{ F16 },
+  128 => %W{ F17 },
+  129 => %W{ F18 },
+  130 => %W{ F19 },
+  131 => %W{ F20 },
+  132 => %W{ F21 },
+  133 => %W{ F22 },
+  134 => %W{ F23 },
+  135 => %W{ F24 },
+  144 => %W{ NumLock },
+  145 => %W{ Scroll },
+  160 => %W{ LShift },
+  161 => %W{ RShift },
+  162 => %W{ LCtrl },
+  163 => %W{ RCtrl },
+  164 => %W{ LMenu },
+  165 => %W{ RMenu },
+  166 => %W{ Back },
+  167 => %W{ Forward },
+  168 => %W{ Refresh },
+  169 => %W{ Stop },
+  170 => %W{ Search },
+  171 => %W{ Favorites },
+  172 => %W{ Home },
+  176 => %W{ Forward },
+  177 => %W{ Reverse },
+  178 => %W{ Stop },
+  179 => %W{ Play },
+  186 => %W{ ;  :},
+  187 => %W{ =  +},
+  188 => %W{ ,  <},
+  189 => %W{ -  _},
+  190 => %W{ .  >},
+  191 => %W{ /  ?},
+  192 => %W{ '  ~},
+  219 => %W| [  {|,
+  220 => %W{ \  |},
+  221 => %W| ]  }|,
+  222 => %W{ '  Quotes},
 }