librex 0.0.68 → 0.0.70

data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 require 'rex/post/process'
@@ -26,344 +25,344 @@ module Sys
 ##
 class Process < Rex::Post::Process
 
-	include Rex::Post::Meterpreter::ObjectAliasesContainer
-
-	##
-	#
-	# Class methods
-	#
-	##
-
-	class << self
-		attr_accessor :client
-	end
-
-	#
-	# Returns the process identifier of the process supplied in key if it's
-	# valid.
-	#
-	def Process.[](key)
-		each_process { |p|
-			if (p['name'].downcase == key.downcase)
-				return p['pid']
-			end
-		}
-
-		return nil
-	end
-
-	#
-	# Attachs to the supplied process with a given set of permissions.
-	#
-	def Process.open(pid = nil, perms = nil)
-		real_perms = 0
-
-		if (perms == nil)
-			perms = PROCESS_ALL
-		end
-
-		if (perms & PROCESS_READ)
-			real_perms |= PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
-		end
-
-		if (perms & PROCESS_WRITE)
-			real_perms |= PROCESS_SET_SESSIONID | PROCESS_VM_WRITE | PROCESS_DUP_HANDLE | PROCESS_SET_QUOTA | PROCESS_SET_INFORMATION
-		end
-
-		if (perms & PROCESS_EXECUTE)
-			real_perms |= PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_CREATE_PROCESS | PROCESS_SUSPEND_RESUME
-		end
-
-		return _open(pid, real_perms)
-	end
-
-	#
-	# Low-level process open.
-	#
-	def Process._open(pid, perms, inherit = false)
-		request = Packet.create_request('stdapi_sys_process_attach')
-
-		if (pid == nil)
-			pid = 0
-		end
-
-		# Populate the request
-		request.add_tlv(TLV_TYPE_PID, pid)
-		request.add_tlv(TLV_TYPE_PROCESS_PERMS, perms)
-		request.add_tlv(TLV_TYPE_INHERIT, inherit)
-
-		# Transmit the request
-		response = self.client.send_request(request)
-		handle   = response.get_tlv_value(TLV_TYPE_HANDLE)
-
-		# If the handle is valid, allocate a process instance and return it
-		if (handle != nil)
-			return self.new(pid, handle)
-		end
-
-		return nil
-	end
-
-	#
-	# Executes an application using the arguments provided
-	#
-	# Hash arguments supported:
-	#
-	#   Hidden      => true/false
-	#   Channelized => true/false
-	#   Suspended   => true/false
-	#   InMemory    => true/false
-	#
-	def Process.execute(path, arguments = nil, opts = nil)
-		request = Packet.create_request('stdapi_sys_process_execute')
-		flags   = 0
-
-		# If we were supplied optional arguments...
-		if (opts != nil)
-			if (opts['Hidden'])
-				flags |= PROCESS_EXECUTE_FLAG_HIDDEN
-			end
-			if (opts['Channelized'])
-				flags |= PROCESS_EXECUTE_FLAG_CHANNELIZED
-			end
-			if (opts['Suspended'])
-				flags |= PROCESS_EXECUTE_FLAG_SUSPENDED
-			end
-			if (opts['UseThreadToken'])
-				flags |= PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN
-			end
-			if (opts['Desktop'])
-				flags |= PROCESS_EXECUTE_FLAG_DESKTOP
-			end
-			if (opts['Session'])
-				flags |= PROCESS_EXECUTE_FLAG_SESSION
-				request.add_tlv( TLV_TYPE_PROCESS_SESSION, opts['Session'] )
-			end
-			inmem = opts['InMemory']
-			if inmem
-
-				# add the file contents into the tlv
-				f = ::File.new(path, 'rb')
-				request.add_tlv(TLV_TYPE_VALUE_DATA, f.read(f.stat.size))
-				f.close
-
-				# replace the path with the "dummy"
-				path = inmem.kind_of?(String) ? inmem : 'cmd'
-			end
-		end
-
-		request.add_tlv(TLV_TYPE_PROCESS_PATH, client.unicode_filter_decode( path ));
-
-		# If process arguments were supplied
-		if (arguments != nil)
-			request.add_tlv(TLV_TYPE_PROCESS_ARGUMENTS, arguments);
-		end
-
-		request.add_tlv(TLV_TYPE_PROCESS_FLAGS, flags);
-
-		response = client.send_request(request)
-
-		# Get the response parameters
-		pid        = response.get_tlv_value(TLV_TYPE_PID)
-		handle     = response.get_tlv_value(TLV_TYPE_PROCESS_HANDLE)
-		channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
-		channel    = nil
-
-		# If we were creating a channel out of this
-		if (channel_id != nil)
-			channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(client,
-					channel_id, "stdapi_process", CHANNEL_FLAG_SYNCHRONOUS)
-		end
-
-		# Return a process instance
-		return self.new(pid, handle, channel)
-	end
-
-	#
-	# Kills one or more processes.
-	#
-	def Process.kill(*args)
-		request = Packet.create_request('stdapi_sys_process_kill')
-
-		args.each { |id|
-			request.add_tlv(TLV_TYPE_PID, id)
-		}
-
-		client.send_request(request)
-
-		return true
-	end
-
-	#
-	# Gets the process id that the remote side is executing under.
-	#
-	def Process.getpid
-		request = Packet.create_request('stdapi_sys_process_getpid')
-
-		response = client.send_request(request)
-
-		return response.get_tlv_value(TLV_TYPE_PID)
-	end
-
-	#
-	# Enumerates all of the elements in the array returned by get_processes.
-	#
-	def Process.each_process(&block)
-		self.get_processes.each(&block)
-	end
-
-	#
-	# Returns a ProcessList of processes as Hash objects with keys for 'pid',
-	# 'ppid', 'name', 'path', 'user', 'session' and 'arch'.
-	#
-	def Process.get_processes
-		request   = Packet.create_request('stdapi_sys_process_get_processes')
-		processes = ProcessList.new
-
-		response = client.send_request(request)
-
-		response.each(TLV_TYPE_PROCESS_GROUP) { |p|
-		arch = ""
-
-		pa = p.get_tlv_value( TLV_TYPE_PROCESS_ARCH )
-		if( pa != nil )
-			if pa == 1 # PROCESS_ARCH_X86
-				arch = ARCH_X86
-			elsif pa == 2 # PROCESS_ARCH_X64
-				arch = ARCH_X86_64
-			end
-		end
-
-		processes <<
-				{
-					'pid'      => p.get_tlv_value(TLV_TYPE_PID),
-					'ppid'     => p.get_tlv_value(TLV_TYPE_PARENT_PID),
-					'name'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_NAME) ),
-					'path'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_PATH) ),
-					'session'  => p.get_tlv_value(TLV_TYPE_PROCESS_SESSION),
-					'user'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_USER_NAME) ),
-					'arch'     => arch
-				}
-		}
-
-		return processes
-	end
-
-	#
-	# An alias for get_processes.
-	#
-	def Process.processes
-		self.get_processes
-	end
-
-	##
-	#
-	# Instance methods
-	#
-	##
-
-	#
-	# Initializes the process instance and its aliases.
-	#
-	def initialize(pid, handle, channel = nil)
-		self.client  = self.class.client
-		self.handle  = handle
-		self.channel = channel
-
-		# If the process identifier is zero, then we must lookup the current
-		# process identifier
-		if (pid == 0)
-			self.pid = client.sys.process.getpid
-		else
-			self.pid = pid
-		end
-
-		initialize_aliases(
-			{
-				'image'  => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Image.new(self),
-				'io'     => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::IO.new(self),
-				'memory' => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Memory.new(self),
-				'thread' => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Thread.new(self),
-			})
-
-		ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) )
-	end
-
-	def self.finalize(client,handle)
-		proc { self.close(client,handle) }
-	end
-
-	#
-	# Returns the executable name of the process.
-	#
-	def name
-		return get_info()['name']
-	end
-
-	#
-	# Returns the path to the process' executable.
-	#
-	def path
-		return get_info()['path']
-	end
-
-	#
-	# Closes the handle to the process that was opened.
-	#
-	def self.close(client, handle)
-		request = Packet.create_request('stdapi_sys_process_close')
-		request.add_tlv(TLV_TYPE_HANDLE, handle)
-		response = client.send_request(request, nil)
-		handle = nil;
-		return true
-	end
-
-	#
-	# Instance method
-	#
-	def close(handle=self.handle)
-		self.class.close(self.client, handle)
-	end
-
-	#
-	# Block until this process terminates on the remote side.
-	# By default we choose not to allow a packet responce timeout to
-	# occur as we may be waiting indefinatly for the process to terminate.
-	#
-	def wait( timeout = -1 )
-		request = Packet.create_request('stdapi_sys_process_wait')
-
-		request.add_tlv(TLV_TYPE_HANDLE, self.handle)
-
-		response = self.client.send_request(request, timeout)
-
-		self.handle = nil
-
-		return true
-	end
-
-	attr_reader   :client, :handle, :channel, :pid # :nodoc:
+  include Rex::Post::Meterpreter::ObjectAliasesContainer
+
+  ##
+  #
+  # Class methods
+  #
+  ##
+
+  class << self
+    attr_accessor :client
+  end
+
+  #
+  # Returns the process identifier of the process supplied in key if it's
+  # valid.
+  #
+  def Process.[](key)
+    each_process { |p|
+      if (p['name'].downcase == key.downcase)
+        return p['pid']
+      end
+    }
+
+    return nil
+  end
+
+  #
+  # Attachs to the supplied process with a given set of permissions.
+  #
+  def Process.open(pid = nil, perms = nil)
+    real_perms = 0
+
+    if (perms == nil)
+      perms = PROCESS_ALL
+    end
+
+    if (perms & PROCESS_READ)
+      real_perms |= PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
+    end
+
+    if (perms & PROCESS_WRITE)
+      real_perms |= PROCESS_SET_SESSIONID | PROCESS_VM_WRITE | PROCESS_DUP_HANDLE | PROCESS_SET_QUOTA | PROCESS_SET_INFORMATION
+    end
+
+    if (perms & PROCESS_EXECUTE)
+      real_perms |= PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_CREATE_PROCESS | PROCESS_SUSPEND_RESUME
+    end
+
+    return _open(pid, real_perms)
+  end
+
+  #
+  # Low-level process open.
+  #
+  def Process._open(pid, perms, inherit = false)
+    request = Packet.create_request('stdapi_sys_process_attach')
+
+    if (pid == nil)
+      pid = 0
+    end
+
+    # Populate the request
+    request.add_tlv(TLV_TYPE_PID, pid)
+    request.add_tlv(TLV_TYPE_PROCESS_PERMS, perms)
+    request.add_tlv(TLV_TYPE_INHERIT, inherit)
+
+    # Transmit the request
+    response = self.client.send_request(request)
+    handle   = response.get_tlv_value(TLV_TYPE_HANDLE)
+
+    # If the handle is valid, allocate a process instance and return it
+    if (handle != nil)
+      return self.new(pid, handle)
+    end
+
+    return nil
+  end
+
+  #
+  # Executes an application using the arguments provided
+  #
+  # Hash arguments supported:
+  #
+  #   Hidden      => true/false
+  #   Channelized => true/false
+  #   Suspended   => true/false
+  #   InMemory    => true/false
+  #
+  def Process.execute(path, arguments = nil, opts = nil)
+    request = Packet.create_request('stdapi_sys_process_execute')
+    flags   = 0
+
+    # If we were supplied optional arguments...
+    if (opts != nil)
+      if (opts['Hidden'])
+        flags |= PROCESS_EXECUTE_FLAG_HIDDEN
+      end
+      if (opts['Channelized'])
+        flags |= PROCESS_EXECUTE_FLAG_CHANNELIZED
+      end
+      if (opts['Suspended'])
+        flags |= PROCESS_EXECUTE_FLAG_SUSPENDED
+      end
+      if (opts['UseThreadToken'])
+        flags |= PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN
+      end
+      if (opts['Desktop'])
+        flags |= PROCESS_EXECUTE_FLAG_DESKTOP
+      end
+      if (opts['Session'])
+        flags |= PROCESS_EXECUTE_FLAG_SESSION
+        request.add_tlv( TLV_TYPE_PROCESS_SESSION, opts['Session'] )
+      end
+      inmem = opts['InMemory']
+      if inmem
+
+        # add the file contents into the tlv
+        f = ::File.new(path, 'rb')
+        request.add_tlv(TLV_TYPE_VALUE_DATA, f.read(f.stat.size))
+        f.close
+
+        # replace the path with the "dummy"
+        path = inmem.kind_of?(String) ? inmem : 'cmd'
+      end
+    end
+
+    request.add_tlv(TLV_TYPE_PROCESS_PATH, client.unicode_filter_decode( path ));
+
+    # If process arguments were supplied
+    if (arguments != nil)
+      request.add_tlv(TLV_TYPE_PROCESS_ARGUMENTS, arguments);
+    end
+
+    request.add_tlv(TLV_TYPE_PROCESS_FLAGS, flags);
+
+    response = client.send_request(request)
+
+    # Get the response parameters
+    pid        = response.get_tlv_value(TLV_TYPE_PID)
+    handle     = response.get_tlv_value(TLV_TYPE_PROCESS_HANDLE)
+    channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
+    channel    = nil
+
+    # If we were creating a channel out of this
+    if (channel_id != nil)
+      channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(client,
+          channel_id, "stdapi_process", CHANNEL_FLAG_SYNCHRONOUS)
+    end
+
+    # Return a process instance
+    return self.new(pid, handle, channel)
+  end
+
+  #
+  # Kills one or more processes.
+  #
+  def Process.kill(*args)
+    request = Packet.create_request('stdapi_sys_process_kill')
+
+    args.each { |id|
+      request.add_tlv(TLV_TYPE_PID, id)
+    }
+
+    client.send_request(request)
+
+    return true
+  end
+
+  #
+  # Gets the process id that the remote side is executing under.
+  #
+  def Process.getpid
+    request = Packet.create_request('stdapi_sys_process_getpid')
+
+    response = client.send_request(request)
+
+    return response.get_tlv_value(TLV_TYPE_PID)
+  end
+
+  #
+  # Enumerates all of the elements in the array returned by get_processes.
+  #
+  def Process.each_process(&block)
+    self.get_processes.each(&block)
+  end
+
+  #
+  # Returns a ProcessList of processes as Hash objects with keys for 'pid',
+  # 'ppid', 'name', 'path', 'user', 'session' and 'arch'.
+  #
+  def Process.get_processes
+    request   = Packet.create_request('stdapi_sys_process_get_processes')
+    processes = ProcessList.new
+
+    response = client.send_request(request)
+
+    response.each(TLV_TYPE_PROCESS_GROUP) { |p|
+    arch = ""
+
+    pa = p.get_tlv_value( TLV_TYPE_PROCESS_ARCH )
+    if( pa != nil )
+      if pa == 1 # PROCESS_ARCH_X86
+        arch = ARCH_X86
+      elsif pa == 2 # PROCESS_ARCH_X64
+        arch = ARCH_X86_64
+      end
+    end
+
+    processes <<
+        {
+          'pid'      => p.get_tlv_value(TLV_TYPE_PID),
+          'ppid'     => p.get_tlv_value(TLV_TYPE_PARENT_PID),
+          'name'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_NAME) ),
+          'path'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_PATH) ),
+          'session'  => p.get_tlv_value(TLV_TYPE_PROCESS_SESSION),
+          'user'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_USER_NAME) ),
+          'arch'     => arch
+        }
+    }
+
+    return processes
+  end
+
+  #
+  # An alias for get_processes.
+  #
+  def Process.processes
+    self.get_processes
+  end
+
+  ##
+  #
+  # Instance methods
+  #
+  ##
+
+  #
+  # Initializes the process instance and its aliases.
+  #
+  def initialize(pid, handle, channel = nil)
+    self.client  = self.class.client
+    self.handle  = handle
+    self.channel = channel
+
+    # If the process identifier is zero, then we must lookup the current
+    # process identifier
+    if (pid == 0)
+      self.pid = client.sys.process.getpid
+    else
+      self.pid = pid
+    end
+
+    initialize_aliases(
+      {
+        'image'  => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Image.new(self),
+        'io'     => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::IO.new(self),
+        'memory' => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Memory.new(self),
+        'thread' => Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Thread.new(self),
+      })
+
+    ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) )
+  end
+
+  def self.finalize(client,handle)
+    proc { self.close(client,handle) }
+  end
+
+  #
+  # Returns the executable name of the process.
+  #
+  def name
+    return get_info()['name']
+  end
+
+  #
+  # Returns the path to the process' executable.
+  #
+  def path
+    return get_info()['path']
+  end
+
+  #
+  # Closes the handle to the process that was opened.
+  #
+  def self.close(client, handle)
+    request = Packet.create_request('stdapi_sys_process_close')
+    request.add_tlv(TLV_TYPE_HANDLE, handle)
+    response = client.send_request(request, nil)
+    handle = nil;
+    return true
+  end
+
+  #
+  # Instance method
+  #
+  def close(handle=self.handle)
+    self.class.close(self.client, handle)
+  end
+
+  #
+  # Block until this process terminates on the remote side.
+  # By default we choose not to allow a packet responce timeout to
+  # occur as we may be waiting indefinatly for the process to terminate.
+  #
+  def wait( timeout = -1 )
+    request = Packet.create_request('stdapi_sys_process_wait')
+
+    request.add_tlv(TLV_TYPE_HANDLE, self.handle)
+
+    response = self.client.send_request(request, timeout)
+
+    self.handle = nil
+
+    return true
+  end
+
+  attr_reader   :client, :handle, :channel, :pid # :nodoc:
 protected
-	attr_writer   :client, :handle, :channel, :pid # :nodoc:
+  attr_writer   :client, :handle, :channel, :pid # :nodoc:
 
-	#
-	# Gathers information about the process and returns a hash.
-	#
-	def get_info
-		request = Packet.create_request('stdapi_sys_process_get_info')
-		info    = {}
+  #
+  # Gathers information about the process and returns a hash.
+  #
+  def get_info
+    request = Packet.create_request('stdapi_sys_process_get_info')
+    info    = {}
 
-		request.add_tlv(TLV_TYPE_HANDLE, handle)
+    request.add_tlv(TLV_TYPE_HANDLE, handle)
 
-		# Send the request
-		response = client.send_request(request)
+    # Send the request
+    response = client.send_request(request)
 
-		# Populate the hash
-		info['name'] = client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_PROCESS_NAME) )
-		info['path'] = client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_PROCESS_PATH) )
+    # Populate the hash
+    info['name'] = client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_PROCESS_NAME) )
+    info['path'] = client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_PROCESS_PATH) )
 
-		return info
-	end
+    return info
+  end
 
 end
 
@@ -372,37 +371,37 @@ end
 #
 class ProcessList < Array
 
-	#
-	# Create a Rex::Ui::Text::Table out of the processes stored in this list
-	#
-	# +opts+ is passed on to Rex::Ui::Text::Table.new, mostly unmolested
-	#
-	# Note that this output is affected by Rex::Post::Meterpreter::Client#unicode_filter_encode
-	#
-	def to_table(opts={})
-		if empty?
-			return Rex::Ui::Text::Table.new(opts)
-		end
-
-		cols = [ "PID", "PPID", "Name", "Arch", "Session", "User", "Path" ]
-		# Arch and Session are specific to native Windows, PHP and Java can't do
-		# ppid.  Cut columns from the list if they aren't there.  It is conceivable
-		# that processes might have different columns, but for now assume that the
-		# first one is representative.
-		cols.delete_if { |c| !( first.has_key?(c.downcase) ) or first[c.downcase].nil? }
-
-		opts = {
-			"Header"  => "Process List",
-			"Columns" => cols
-		}.merge(opts)
-
-		tbl = Rex::Ui::Text::Table.new(opts)
-		each { |process|
-			tbl << cols.map {|c| process[c.downcase] }.compact
-		}
-
-		tbl
-	end
+  #
+  # Create a Rex::Ui::Text::Table out of the processes stored in this list
+  #
+  # +opts+ is passed on to Rex::Ui::Text::Table.new, mostly unmolested
+  #
+  # Note that this output is affected by Rex::Post::Meterpreter::Client#unicode_filter_encode
+  #
+  def to_table(opts={})
+    if empty?
+      return Rex::Ui::Text::Table.new(opts)
+    end
+
+    cols = [ "PID", "PPID", "Name", "Arch", "Session", "User", "Path" ]
+    # Arch and Session are specific to native Windows, PHP and Java can't do
+    # ppid.  Cut columns from the list if they aren't there.  It is conceivable
+    # that processes might have different columns, but for now assume that the
+    # first one is representative.
+    cols.delete_if { |c| !( first.has_key?(c.downcase) ) or first[c.downcase].nil? }
+
+    opts = {
+      "Header"  => "Process List",
+      "Columns" => cols
+    }.merge(opts)
+
+    tbl = Rex::Ui::Text::Table.new(opts)
+    each { |process|
+      tbl << cols.map {|c| process[c.downcase] }.compact
+    }
+
+    tbl
+  end
 end
 
 end; end; end; end; end; end