librex 0.0.68 → 0.0.70

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (528) hide show
  1. checksums.yaml +15 -0
  2. data/README.markdown +1 -1
  3. data/Rakefile +18 -16
  4. data/lib/rex.rb +14 -10
  5. data/lib/rex/LICENSE +2 -2
  6. data/lib/rex/arch.rb +76 -76
  7. data/lib/rex/arch/sparc.rb +57 -58
  8. data/lib/rex/arch/x86.rb +506 -496
  9. data/lib/rex/assembly/nasm.rb +83 -84
  10. data/lib/rex/compat.rb +228 -173
  11. data/lib/rex/constants.rb +47 -37
  12. data/lib/rex/elfparsey.rb +0 -3
  13. data/lib/rex/elfparsey/elf.rb +107 -110
  14. data/lib/rex/elfparsey/elfbase.rb +244 -247
  15. data/lib/rex/elfparsey/exceptions.rb +0 -3
  16. data/lib/rex/elfscan.rb +0 -3
  17. data/lib/rex/elfscan/scanner.rb +184 -166
  18. data/lib/rex/elfscan/search.rb +35 -38
  19. data/lib/rex/encoder/alpha2.rb +1 -2
  20. data/lib/rex/encoder/alpha2/alpha_mixed.rb +52 -53
  21. data/lib/rex/encoder/alpha2/alpha_upper.rb +62 -63
  22. data/lib/rex/encoder/alpha2/generic.rb +77 -78
  23. data/lib/rex/encoder/alpha2/unicode_mixed.rb +101 -97
  24. data/lib/rex/encoder/alpha2/unicode_upper.rb +106 -107
  25. data/lib/rex/encoder/bloxor/bloxor.rb +326 -0
  26. data/lib/rex/encoder/ndr.rb +68 -68
  27. data/lib/rex/encoder/nonalpha.rb +50 -51
  28. data/lib/rex/encoder/nonupper.rb +50 -51
  29. data/lib/rex/encoder/xdr.rb +78 -78
  30. data/lib/rex/encoder/xor.rb +52 -53
  31. data/lib/rex/encoder/xor/dword.rb +1 -2
  32. data/lib/rex/encoder/xor/dword_additive.rb +1 -2
  33. data/lib/rex/encoders/xor_dword.rb +17 -18
  34. data/lib/rex/encoders/xor_dword_additive.rb +35 -36
  35. data/lib/rex/encoding/xor.rb +0 -1
  36. data/lib/rex/encoding/xor/byte.rb +3 -4
  37. data/lib/rex/encoding/xor/dword.rb +3 -4
  38. data/lib/rex/encoding/xor/dword_additive.rb +72 -73
  39. data/lib/rex/encoding/xor/exceptions.rb +2 -3
  40. data/lib/rex/encoding/xor/generic.rb +129 -130
  41. data/lib/rex/encoding/xor/qword.rb +3 -4
  42. data/lib/rex/encoding/xor/word.rb +3 -4
  43. data/lib/rex/exceptions.rb +100 -101
  44. data/lib/rex/exploitation/cmdstager.rb +3 -3
  45. data/lib/rex/exploitation/cmdstager/base.rb +170 -156
  46. data/lib/rex/exploitation/cmdstager/bourne.rb +105 -0
  47. data/lib/rex/exploitation/cmdstager/debug_asm.rb +110 -113
  48. data/lib/rex/exploitation/cmdstager/debug_write.rb +106 -109
  49. data/lib/rex/exploitation/cmdstager/echo.rb +164 -0
  50. data/lib/rex/exploitation/cmdstager/printf.rb +122 -0
  51. data/lib/rex/exploitation/cmdstager/tftp.rb +34 -27
  52. data/lib/rex/exploitation/cmdstager/vbs.rb +95 -98
  53. data/lib/rex/exploitation/egghunter.rb +359 -346
  54. data/lib/rex/exploitation/encryptjs.rb +60 -60
  55. data/lib/rex/exploitation/heaplib.rb +76 -76
  56. data/lib/rex/exploitation/js.rb +6 -0
  57. data/lib/rex/exploitation/js/detect.rb +69 -0
  58. data/lib/rex/exploitation/js/memory.rb +81 -0
  59. data/lib/rex/exploitation/js/network.rb +84 -0
  60. data/lib/rex/exploitation/js/utils.rb +33 -0
  61. data/lib/rex/exploitation/jsobfu.rb +448 -424
  62. data/lib/rex/exploitation/obfuscatejs.rb +301 -301
  63. data/lib/rex/exploitation/omelet.rb +257 -257
  64. data/lib/rex/exploitation/opcodedb.rb +699 -699
  65. data/lib/rex/exploitation/ropdb.rb +189 -0
  66. data/lib/rex/exploitation/seh.rb +68 -68
  67. data/lib/rex/file.rb +96 -49
  68. data/lib/rex/image_source.rb +0 -3
  69. data/lib/rex/image_source/disk.rb +45 -48
  70. data/lib/rex/image_source/image_source.rb +33 -36
  71. data/lib/rex/image_source/memory.rb +17 -20
  72. data/lib/rex/io/bidirectional_pipe.rb +118 -115
  73. data/lib/rex/io/datagram_abstraction.rb +13 -14
  74. data/lib/rex/io/ring_buffer.rb +273 -273
  75. data/lib/rex/io/stream.rb +284 -284
  76. data/lib/rex/io/stream_abstraction.rb +183 -181
  77. data/lib/rex/io/stream_server.rb +193 -193
  78. data/lib/rex/job_container.rb +167 -167
  79. data/lib/rex/logging.rb +0 -1
  80. data/lib/rex/logging/log_dispatcher.rb +113 -113
  81. data/lib/rex/logging/log_sink.rb +17 -17
  82. data/lib/rex/logging/sinks/flatfile.rb +36 -36
  83. data/lib/rex/logging/sinks/stderr.rb +27 -27
  84. data/lib/rex/mac_oui.rb +16572 -16571
  85. data/lib/rex/machparsey.rb +0 -1
  86. data/lib/rex/machparsey/exceptions.rb +0 -1
  87. data/lib/rex/machparsey/mach.rb +160 -161
  88. data/lib/rex/machparsey/machbase.rb +367 -368
  89. data/lib/rex/machscan.rb +0 -1
  90. data/lib/rex/machscan/scanner.rb +175 -176
  91. data/lib/rex/mime/encoding.rb +17 -0
  92. data/lib/rex/mime/header.rb +58 -58
  93. data/lib/rex/mime/message.rb +140 -137
  94. data/lib/rex/mime/part.rb +41 -12
  95. data/lib/rex/nop/opty2.rb +90 -90
  96. data/lib/rex/nop/opty2_tables.rb +273 -273
  97. data/lib/rex/ole.rb +0 -4
  98. data/lib/rex/ole/clsid.rb +26 -30
  99. data/lib/rex/ole/difat.rb +121 -125
  100. data/lib/rex/ole/directory.rb +205 -209
  101. data/lib/rex/ole/direntry.rb +217 -221
  102. data/lib/rex/ole/fat.rb +79 -83
  103. data/lib/rex/ole/header.rb +178 -182
  104. data/lib/rex/ole/minifat.rb +49 -53
  105. data/lib/rex/ole/propset.rb +113 -117
  106. data/lib/rex/ole/samples/create_ole.rb +8 -9
  107. data/lib/rex/ole/samples/dir.rb +10 -11
  108. data/lib/rex/ole/samples/dump_stream.rb +14 -15
  109. data/lib/rex/ole/samples/ole_info.rb +5 -6
  110. data/lib/rex/ole/storage.rb +372 -376
  111. data/lib/rex/ole/stream.rb +33 -37
  112. data/lib/rex/ole/substorage.rb +20 -24
  113. data/lib/rex/ole/util.rb +137 -141
  114. data/lib/rex/parser/acunetix_nokogiri.rb +398 -398
  115. data/lib/rex/parser/apple_backup_manifestdb.rb +116 -116
  116. data/lib/rex/parser/appscan_nokogiri.rb +359 -359
  117. data/lib/rex/parser/arguments.rb +88 -88
  118. data/lib/rex/parser/burp_session_nokogiri.rb +258 -258
  119. data/lib/rex/parser/ci_nokogiri.rb +184 -184
  120. data/lib/rex/parser/foundstone_nokogiri.rb +334 -333
  121. data/lib/rex/parser/fusionvm_nokogiri.rb +94 -94
  122. data/lib/rex/parser/ini.rb +167 -167
  123. data/lib/rex/parser/ip360_aspl_xml.rb +84 -84
  124. data/lib/rex/parser/ip360_xml.rb +77 -77
  125. data/lib/rex/parser/mbsa_nokogiri.rb +224 -224
  126. data/lib/rex/parser/nessus_xml.rb +100 -100
  127. data/lib/rex/parser/netsparker_xml.rb +89 -75
  128. data/lib/rex/parser/nexpose_raw_nokogiri.rb +677 -677
  129. data/lib/rex/parser/nexpose_simple_nokogiri.rb +322 -322
  130. data/lib/rex/parser/nexpose_xml.rb +105 -105
  131. data/lib/rex/parser/nmap_nokogiri.rb +386 -386
  132. data/lib/rex/parser/nmap_xml.rb +116 -116
  133. data/lib/rex/parser/nokogiri_doc_mixin.rb +223 -221
  134. data/lib/rex/parser/openvas_nokogiri.rb +162 -162
  135. data/lib/rex/parser/outpost24_nokogiri.rb +239 -0
  136. data/lib/rex/parser/retina_xml.rb +90 -90
  137. data/lib/rex/parser/unattend.rb +171 -0
  138. data/lib/rex/parser/wapiti_nokogiri.rb +89 -89
  139. data/lib/rex/payloads/win32/common.rb +14 -14
  140. data/lib/rex/payloads/win32/kernel.rb +36 -36
  141. data/lib/rex/payloads/win32/kernel/common.rb +32 -32
  142. data/lib/rex/payloads/win32/kernel/recovery.rb +27 -27
  143. data/lib/rex/payloads/win32/kernel/stager.rb +170 -170
  144. data/lib/rex/peparsey.rb +0 -3
  145. data/lib/rex/peparsey/exceptions.rb +0 -3
  146. data/lib/rex/peparsey/pe.rb +196 -199
  147. data/lib/rex/peparsey/pe_memdump.rb +35 -38
  148. data/lib/rex/peparsey/pebase.rb +1633 -1652
  149. data/lib/rex/peparsey/section.rb +115 -124
  150. data/lib/rex/pescan.rb +0 -3
  151. data/lib/rex/pescan/analyze.rb +351 -351
  152. data/lib/rex/pescan/scanner.rb +182 -182
  153. data/lib/rex/pescan/search.rb +59 -59
  154. data/lib/rex/platforms/windows.rb +37 -37
  155. data/lib/rex/poly.rb +111 -110
  156. data/lib/rex/poly/block.rb +419 -417
  157. data/lib/rex/poly/machine.rb +12 -0
  158. data/lib/rex/poly/machine/machine.rb +829 -0
  159. data/lib/rex/poly/machine/x86.rb +508 -0
  160. data/lib/rex/poly/register.rb +70 -70
  161. data/lib/rex/poly/register/x86.rb +22 -22
  162. data/lib/rex/post.rb +0 -1
  163. data/lib/rex/post/dir.rb +35 -36
  164. data/lib/rex/post/file.rb +140 -141
  165. data/lib/rex/post/file_stat.rb +198 -199
  166. data/lib/rex/post/io.rb +167 -168
  167. data/lib/rex/post/meterpreter.rb +1 -1
  168. data/lib/rex/post/meterpreter/channel.rb +389 -390
  169. data/lib/rex/post/meterpreter/channel_container.rb +33 -34
  170. data/lib/rex/post/meterpreter/channels/pool.rb +129 -130
  171. data/lib/rex/post/meterpreter/channels/pools/file.rb +35 -36
  172. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +72 -73
  173. data/lib/rex/post/meterpreter/channels/stream.rb +62 -63
  174. data/lib/rex/post/meterpreter/client.rb +442 -436
  175. data/lib/rex/post/meterpreter/client_core.rb +326 -310
  176. data/lib/rex/post/meterpreter/dependencies.rb +0 -1
  177. data/lib/rex/post/meterpreter/extension.rb +12 -13
  178. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +35 -36
  179. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +71 -0
  180. data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb +169 -0
  181. data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +45 -0
  182. data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb +104 -0
  183. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +77 -0
  184. data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb +56 -0
  185. data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +75 -0
  186. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +70 -71
  187. data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb +361 -0
  188. data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb +76 -0
  189. data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb +78 -0
  190. data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb +22 -78
  191. data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb +49 -0
  192. data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb +4 -4
  193. data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb +128 -0
  194. data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb +16 -0
  195. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +38 -39
  196. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +1 -1
  197. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +95 -96
  198. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +39 -40
  199. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +80 -85
  200. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +94 -95
  201. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +207 -147
  202. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +258 -259
  203. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +366 -301
  204. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +72 -73
  205. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +24 -25
  206. data/lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb +59 -0
  207. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +227 -149
  208. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +107 -108
  209. data/lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb +97 -0
  210. data/lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb +106 -0
  211. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +41 -42
  212. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +102 -101
  213. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +151 -152
  214. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +142 -142
  215. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +185 -185
  216. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +38118 -38117
  217. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +7 -7
  218. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +2086 -2084
  219. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +15 -15
  220. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +80 -80
  221. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +3835 -3833
  222. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +84 -28
  223. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +151 -137
  224. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +15 -6
  225. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +3155 -3155
  226. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_version.rb +41 -0
  227. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +70 -70
  228. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb +128 -0
  229. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +596 -596
  230. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +310 -301
  231. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +71 -61
  232. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +100 -100
  233. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +14 -14
  234. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +488 -488
  235. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +273 -264
  236. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb +5 -5
  237. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +240 -238
  238. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +17 -15
  239. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb +61 -61
  240. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +654 -635
  241. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +49 -49
  242. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +103 -102
  243. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +98 -68
  244. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +165 -166
  245. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +16 -17
  246. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +34 -36
  247. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +363 -364
  248. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +102 -103
  249. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +28 -29
  250. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +303 -304
  251. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +113 -114
  252. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +260 -261
  253. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +165 -166
  254. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +69 -70
  255. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +160 -161
  256. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +143 -144
  257. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +29 -12
  258. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +230 -231
  259. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +181 -44
  260. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +12 -13
  261. data/lib/rex/post/meterpreter/object_aliases.rb +56 -57
  262. data/lib/rex/post/meterpreter/packet.rb +591 -592
  263. data/lib/rex/post/meterpreter/packet_dispatcher.rb +506 -496
  264. data/lib/rex/post/meterpreter/packet_parser.rb +72 -73
  265. data/lib/rex/post/meterpreter/packet_response_waiter.rb +56 -57
  266. data/lib/rex/post/meterpreter/ui/console.rb +112 -112
  267. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +53 -53
  268. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +911 -854
  269. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +86 -86
  270. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb +65 -0
  271. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +198 -0
  272. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb +444 -0
  273. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb +199 -0
  274. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb +118 -0
  275. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb +108 -0
  276. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +220 -220
  277. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb +509 -0
  278. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb +60 -0
  279. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +254 -0
  280. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb +159 -0
  281. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb +182 -0
  282. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +173 -173
  283. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +40 -40
  284. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +75 -77
  285. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +30 -30
  286. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +105 -105
  287. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +182 -182
  288. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +37 -37
  289. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +504 -482
  290. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +401 -330
  291. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +883 -581
  292. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +296 -299
  293. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +320 -153
  294. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +78 -78
  295. data/lib/rex/post/permission.rb +0 -1
  296. data/lib/rex/post/process.rb +39 -40
  297. data/lib/rex/post/thread.rb +41 -42
  298. data/lib/rex/post/ui.rb +35 -36
  299. data/lib/rex/proto/addp.rb +218 -0
  300. data/lib/rex/proto/dcerpc/client.rb +344 -344
  301. data/lib/rex/proto/dcerpc/exceptions.rb +128 -128
  302. data/lib/rex/proto/dcerpc/handle.rb +32 -32
  303. data/lib/rex/proto/dcerpc/ndr.rb +56 -56
  304. data/lib/rex/proto/dcerpc/packet.rb +249 -245
  305. data/lib/rex/proto/dcerpc/response.rb +170 -170
  306. data/lib/rex/proto/dcerpc/uuid.rb +65 -65
  307. data/lib/rex/proto/dcerpc/wdscp.rb +3 -0
  308. data/lib/rex/proto/dcerpc/wdscp/constants.rb +89 -0
  309. data/lib/rex/proto/dcerpc/wdscp/packet.rb +94 -0
  310. data/lib/rex/proto/dhcp.rb +0 -1
  311. data/lib/rex/proto/dhcp/constants.rb +0 -1
  312. data/lib/rex/proto/dhcp/server.rb +303 -304
  313. data/lib/rex/proto/drda/constants.rb +1 -1
  314. data/lib/rex/proto/drda/packet.rb +186 -186
  315. data/lib/rex/proto/drda/utils.rb +104 -104
  316. data/lib/rex/proto/http.rb +1 -0
  317. data/lib/rex/proto/http/client.rb +692 -820
  318. data/lib/rex/proto/http/client_request.rb +472 -0
  319. data/lib/rex/proto/http/handler.rb +25 -25
  320. data/lib/rex/proto/http/handler/erb.rb +104 -104
  321. data/lib/rex/proto/http/handler/proc.rb +37 -37
  322. data/lib/rex/proto/http/header.rb +149 -149
  323. data/lib/rex/proto/http/packet.rb +388 -382
  324. data/lib/rex/proto/http/request.rb +332 -335
  325. data/lib/rex/proto/http/response.rb +132 -72
  326. data/lib/rex/proto/http/server.rb +348 -338
  327. data/lib/rex/proto/iax2/call.rb +310 -310
  328. data/lib/rex/proto/iax2/client.rb +197 -197
  329. data/lib/rex/proto/iax2/codecs/alaw.rb +4 -4
  330. data/lib/rex/proto/iax2/codecs/mulaw.rb +4 -4
  331. data/lib/rex/proto/ipmi.rb +57 -0
  332. data/lib/rex/proto/ipmi/channel_auth_reply.rb +88 -0
  333. data/lib/rex/proto/ipmi/open_session_reply.rb +35 -0
  334. data/lib/rex/proto/ipmi/rakp2.rb +35 -0
  335. data/lib/rex/proto/ipmi/utils.rb +125 -0
  336. data/lib/rex/proto/natpmp.rb +1 -5
  337. data/lib/rex/proto/natpmp/constants.rb +4 -4
  338. data/lib/rex/proto/natpmp/packet.rb +25 -25
  339. data/lib/rex/proto/ntlm/base.rb +271 -271
  340. data/lib/rex/proto/ntlm/constants.rb +61 -61
  341. data/lib/rex/proto/ntlm/crypt.rb +348 -352
  342. data/lib/rex/proto/ntlm/exceptions.rb +3 -3
  343. data/lib/rex/proto/ntlm/message.rb +468 -471
  344. data/lib/rex/proto/ntlm/utils.rb +746 -746
  345. data/lib/rex/proto/pjl.rb +30 -0
  346. data/lib/rex/proto/pjl/client.rb +162 -0
  347. data/lib/rex/proto/proxy/socks4a.rb +440 -440
  348. data/lib/rex/proto/rfb.rb +1 -8
  349. data/lib/rex/proto/rfb/cipher.rb +46 -49
  350. data/lib/rex/proto/rfb/client.rb +179 -182
  351. data/lib/rex/proto/rfb/constants.rb +18 -21
  352. data/lib/rex/proto/smb/client.rb +1954 -1843
  353. data/lib/rex/proto/smb/constants.rb +533 -516
  354. data/lib/rex/proto/smb/crypt.rb +21 -21
  355. data/lib/rex/proto/smb/evasions.rb +43 -43
  356. data/lib/rex/proto/smb/exceptions.rb +791 -791
  357. data/lib/rex/proto/smb/simpleclient.rb +142 -286
  358. data/lib/rex/proto/smb/simpleclient/open_file.rb +106 -0
  359. data/lib/rex/proto/smb/simpleclient/open_pipe.rb +57 -0
  360. data/lib/rex/proto/smb/utils.rb +81 -81
  361. data/lib/rex/proto/sunrpc/client.rb +158 -158
  362. data/lib/rex/proto/tftp.rb +0 -1
  363. data/lib/rex/proto/tftp/client.rb +289 -289
  364. data/lib/rex/proto/tftp/constants.rb +9 -10
  365. data/lib/rex/proto/tftp/server.rb +466 -467
  366. data/lib/rex/random_identifier_generator.rb +176 -0
  367. data/lib/rex/registry.rb +1 -1
  368. data/lib/rex/registry/hive.rb +88 -88
  369. data/lib/rex/registry/lfkey.rb +25 -25
  370. data/lib/rex/registry/nodekey.rb +30 -30
  371. data/lib/rex/registry/regf.rb +10 -10
  372. data/lib/rex/registry/valuekey.rb +43 -43
  373. data/lib/rex/registry/valuelist.rb +13 -13
  374. data/lib/rex/ropbuilder/rop.rb +254 -253
  375. data/lib/rex/script.rb +21 -22
  376. data/lib/rex/script/base.rb +51 -50
  377. data/lib/rex/script/meterpreter.rb +2 -2
  378. data/lib/rex/service.rb +24 -24
  379. data/lib/rex/service_manager.rb +132 -132
  380. data/lib/rex/services/local_relay.rb +398 -398
  381. data/lib/rex/socket.rb +758 -763
  382. data/lib/rex/socket/comm.rb +95 -95
  383. data/lib/rex/socket/comm/local.rb +507 -440
  384. data/lib/rex/socket/ip.rb +118 -118
  385. data/lib/rex/socket/parameters.rb +351 -350
  386. data/lib/rex/socket/range_walker.rb +445 -368
  387. data/lib/rex/socket/ssl_tcp.rb +323 -317
  388. data/lib/rex/socket/ssl_tcp_server.rb +173 -158
  389. data/lib/rex/socket/subnet_walker.rb +48 -48
  390. data/lib/rex/socket/switch_board.rb +259 -259
  391. data/lib/rex/socket/tcp.rb +58 -56
  392. data/lib/rex/socket/tcp_server.rb +42 -42
  393. data/lib/rex/socket/udp.rb +152 -152
  394. data/lib/rex/sslscan/result.rb +200 -0
  395. data/lib/rex/sslscan/scanner.rb +205 -0
  396. data/lib/rex/struct2.rb +0 -1
  397. data/lib/rex/struct2/c_struct.rb +162 -163
  398. data/lib/rex/struct2/c_struct_template.rb +21 -22
  399. data/lib/rex/struct2/constant.rb +6 -7
  400. data/lib/rex/struct2/element.rb +30 -31
  401. data/lib/rex/struct2/generic.rb +60 -61
  402. data/lib/rex/struct2/restraint.rb +40 -41
  403. data/lib/rex/struct2/s_string.rb +60 -61
  404. data/lib/rex/struct2/s_struct.rb +97 -98
  405. data/lib/rex/sync.rb +0 -1
  406. data/lib/rex/sync/event.rb +62 -72
  407. data/lib/rex/sync/read_write_lock.rb +149 -149
  408. data/lib/rex/sync/ref.rb +42 -42
  409. data/lib/rex/sync/thread_safe.rb +59 -59
  410. data/lib/rex/text.rb +1803 -1315
  411. data/lib/rex/thread_factory.rb +25 -25
  412. data/lib/rex/time.rb +44 -44
  413. data/lib/rex/transformer.rb +91 -91
  414. data/lib/rex/ui/interactive.rb +265 -265
  415. data/lib/rex/ui/output.rb +66 -60
  416. data/lib/rex/ui/progress_tracker.rb +79 -79
  417. data/lib/rex/ui/subscriber.rb +144 -134
  418. data/lib/rex/ui/text/color.rb +76 -76
  419. data/lib/rex/ui/text/dispatcher_shell.rb +512 -505
  420. data/lib/rex/ui/text/input.rb +96 -96
  421. data/lib/rex/ui/text/input/buffer.rb +58 -58
  422. data/lib/rex/ui/text/input/readline.rb +114 -114
  423. data/lib/rex/ui/text/input/socket.rb +77 -77
  424. data/lib/rex/ui/text/input/stdio.rb +24 -24
  425. data/lib/rex/ui/text/irb_shell.rb +45 -41
  426. data/lib/rex/ui/text/output.rb +64 -60
  427. data/lib/rex/ui/text/output/buffer.rb +42 -42
  428. data/lib/rex/ui/text/output/buffer/stdout.rb +25 -0
  429. data/lib/rex/ui/text/output/file.rb +24 -24
  430. data/lib/rex/ui/text/output/socket.rb +24 -24
  431. data/lib/rex/ui/text/output/stdio.rb +29 -29
  432. data/lib/rex/ui/text/output/tee.rb +36 -36
  433. data/lib/rex/ui/text/progress_tracker.rb +37 -37
  434. data/lib/rex/ui/text/shell.rb +371 -361
  435. data/lib/rex/ui/text/table.rb +320 -284
  436. data/lib/rex/zip.rb +0 -1
  437. data/lib/rex/zip/archive.rb +115 -94
  438. data/lib/rex/zip/blocks.rb +101 -100
  439. data/lib/rex/zip/entry.rb +108 -99
  440. data/lib/rex/zip/jar.rb +261 -206
  441. data/lib/rex/zip/samples/comment.rb +1 -2
  442. data/lib/rex/zip/samples/mkwar.rb +12 -13
  443. data/lib/rex/zip/samples/mkzip.rb +1 -2
  444. data/lib/rex/zip/samples/recursive.rb +29 -30
  445. metadata +424 -446
  446. data/lib/rex/arch/sparc.rb.ut.rb +0 -19
  447. data/lib/rex/arch/x86.rb.ut.rb +0 -94
  448. data/lib/rex/assembly/nasm.rb.ut.rb +0 -23
  449. data/lib/rex/encoder/ndr.rb.ut.rb +0 -45
  450. data/lib/rex/encoder/xdr.rb.ut.rb +0 -30
  451. data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +0 -13
  452. data/lib/rex/encoding/xor.rb.ts.rb +0 -15
  453. data/lib/rex/encoding/xor/byte.rb.ut.rb +0 -22
  454. data/lib/rex/encoding/xor/dword.rb.ut.rb +0 -16
  455. data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +0 -16
  456. data/lib/rex/encoding/xor/generic.rb.ut.rb +0 -121
  457. data/lib/rex/encoding/xor/word.rb.ut.rb +0 -14
  458. data/lib/rex/exceptions.rb.ut.rb +0 -45
  459. data/lib/rex/exploitation/egghunter.rb.ut.rb +0 -28
  460. data/lib/rex/exploitation/javascriptosdetect.js +0 -1014
  461. data/lib/rex/exploitation/javascriptosdetect.rb +0 -43
  462. data/lib/rex/exploitation/omelet.rb.ut.rb +0 -27
  463. data/lib/rex/exploitation/opcodedb.rb.ut.rb +0 -280
  464. data/lib/rex/exploitation/seh.rb.ut.rb +0 -20
  465. data/lib/rex/file.rb.ut.rb +0 -17
  466. data/lib/rex/io/ring_buffer.rb.ut.rb +0 -135
  467. data/lib/rex/nop/opty2.rb.ut.rb +0 -24
  468. data/lib/rex/parser/arguments.rb.ut.rb +0 -68
  469. data/lib/rex/parser/ini.rb.ut.rb +0 -30
  470. data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +0 -18
  471. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb +0 -39
  472. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +0 -37
  473. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb +0 -52
  474. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +0 -43
  475. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +0 -128
  476. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb +0 -64
  477. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb.ut.rb +0 -29
  478. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb +0 -155
  479. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb.ut.rb +0 -128
  480. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +0 -124
  481. data/lib/rex/proto.rb.ts.rb +0 -9
  482. data/lib/rex/proto/dcerpc.rb.ts.rb +0 -10
  483. data/lib/rex/proto/dcerpc/client.rb.ut.rb +0 -492
  484. data/lib/rex/proto/dcerpc/handle.rb.ut.rb +0 -86
  485. data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +0 -42
  486. data/lib/rex/proto/dcerpc/packet.rb.ut.rb +0 -57
  487. data/lib/rex/proto/dcerpc/response.rb.ut.rb +0 -16
  488. data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +0 -47
  489. data/lib/rex/proto/drda.rb.ts.rb +0 -18
  490. data/lib/rex/proto/drda/constants.rb.ut.rb +0 -24
  491. data/lib/rex/proto/drda/packet.rb.ut.rb +0 -110
  492. data/lib/rex/proto/drda/utils.rb.ut.rb +0 -85
  493. data/lib/rex/proto/http.rb.ts.rb +0 -13
  494. data/lib/rex/proto/http/client.rb.ut.rb +0 -96
  495. data/lib/rex/proto/http/handler/erb.rb.ut.rb +0 -22
  496. data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +0 -1
  497. data/lib/rex/proto/http/handler/proc.rb.ut.rb +0 -25
  498. data/lib/rex/proto/http/header.rb.ut.rb +0 -47
  499. data/lib/rex/proto/http/packet.rb.ut.rb +0 -166
  500. data/lib/rex/proto/http/request.rb.ut.rb +0 -215
  501. data/lib/rex/proto/http/response.rb.ut.rb +0 -150
  502. data/lib/rex/proto/http/server.rb.ut.rb +0 -80
  503. data/lib/rex/proto/ntlm.rb.ut.rb +0 -181
  504. data/lib/rex/proto/rfb.rb.ut.rb +0 -40
  505. data/lib/rex/proto/smb.rb.ts.rb +0 -9
  506. data/lib/rex/proto/smb/client.rb.ut.rb +0 -224
  507. data/lib/rex/proto/smb/constants.rb.ut.rb +0 -19
  508. data/lib/rex/proto/smb/simpleclient.rb.ut.rb +0 -129
  509. data/lib/rex/proto/smb/utils.rb.ut.rb +0 -21
  510. data/lib/rex/proto/tftp/server.rb.ut.rb +0 -29
  511. data/lib/rex/service_manager.rb.ut.rb +0 -33
  512. data/lib/rex/socket.rb.ut.rb +0 -108
  513. data/lib/rex/socket/comm/local.rb.ut.rb +0 -76
  514. data/lib/rex/socket/parameters.rb.ut.rb +0 -52
  515. data/lib/rex/socket/range_walker.rb.ut.rb +0 -56
  516. data/lib/rex/socket/ssl_tcp.rb.ut.rb +0 -40
  517. data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +0 -62
  518. data/lib/rex/socket/subnet_walker.rb.ut.rb +0 -29
  519. data/lib/rex/socket/switch_board.rb.ut.rb +0 -53
  520. data/lib/rex/socket/tcp.rb.ut.rb +0 -65
  521. data/lib/rex/socket/tcp_server.rb.ut.rb +0 -45
  522. data/lib/rex/socket/udp.rb.ut.rb +0 -45
  523. data/lib/rex/test.rb +0 -36
  524. data/lib/rex/text.rb.ut.rb +0 -193
  525. data/lib/rex/transformer.rb.ut.rb +0 -39
  526. data/lib/rex/ui/text/color.rb.ut.rb +0 -19
  527. data/lib/rex/ui/text/progress_tracker.rb.ut.rb +0 -35
  528. data/lib/rex/ui/text/table.rb.ut.rb +0 -56
@@ -1,4 +1,3 @@
1
- #!/usr/bin/env ruby
2
1
  # -*- coding: binary -*-
3
2
 
4
3
  require 'rex/post/meterpreter/client'
@@ -20,110 +19,110 @@ module ProcessSubsystem
20
19
  ###
21
20
  class Image
22
21
 
23
- ##
24
- #
25
- # Constructor
26
- #
27
- ##
28
-
29
- #
30
- # Initializes the image instance.
31
- #
32
- def initialize(process)
33
- self.process = process
34
- end
35
-
36
- #
37
- # Returns the image base address associated with the supplied image name.
38
- #
39
- def [](key)
40
- each_image { |i|
41
- if (i['name'].downcase == key.downcase)
42
- return i['base']
43
- end
44
- }
45
-
46
- return nil
47
- end
48
-
49
- #
50
- # Loads an image file into the context of the process.
51
- #
52
- def load(image_path)
53
- request = Packet.create_request('stdapi_sys_process_image_load')
54
-
55
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
56
- request.add_tlv(TLV_TYPE_IMAGE_FILE_PATH, image_path)
57
-
58
- response = process.client.send_request(request)
59
-
60
- return response.get_tlv_value(TLV_TYPE_IMAGE_BASE)
61
- end
62
-
63
- #
64
- # Returns the address of the procedure that is found in the supplied
65
- # library.
66
- #
67
- def get_procedure_address(image_file, procedure)
68
- request = Packet.create_request('stdapi_sys_process_image_get_proc_address')
69
-
70
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
71
- request.add_tlv(TLV_TYPE_IMAGE_FILE, image_file)
72
- request.add_tlv(TLV_TYPE_PROCEDURE_NAME, procedure)
73
-
74
- response = process.client.send_request(request)
75
-
76
- return response.get_tlv_value(TLV_TYPE_PROCEDURE_ADDRESS)
77
- end
78
-
79
- #
80
- # Unloads an image file that is loaded into the address space of the
81
- # process by its base address.
82
- #
83
- def unload(base)
84
- request = Packet.create_request('stdapi_sys_process_image_unload')
85
-
86
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
87
- request.add_tlv(TLV_TYPE_IMAGE_BASE, base)
88
-
89
- response = process.client.send_request(request)
90
-
91
- return true
92
- end
93
-
94
- #
95
- # Enumerates through each image in the process.
96
- #
97
- def each_image(&block)
98
- get_images.each(&block)
99
- end
100
-
101
- #
102
- # Returns an array of images in the process with hash objects that
103
- # have keys for 'name', 'path', and 'base'.
104
- #
105
- def get_images
106
- request = Packet.create_request('stdapi_sys_process_image_get_images')
107
- images = []
108
-
109
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
110
-
111
- response = process.client.send_request(request)
112
-
113
- response.each(TLV_TYPE_IMAGE_GROUP) { |i|
114
- images <<
115
- {
116
- 'name' => i.get_tlv_value(TLV_TYPE_IMAGE_NAME),
117
- 'base' => i.get_tlv_value(TLV_TYPE_IMAGE_BASE),
118
- 'path' => i.get_tlv_value(TLV_TYPE_IMAGE_FILE_PATH)
119
- }
120
- }
121
-
122
- return images
123
- end
22
+ ##
23
+ #
24
+ # Constructor
25
+ #
26
+ ##
27
+
28
+ #
29
+ # Initializes the image instance.
30
+ #
31
+ def initialize(process)
32
+ self.process = process
33
+ end
34
+
35
+ #
36
+ # Returns the image base address associated with the supplied image name.
37
+ #
38
+ def [](key)
39
+ each_image { |i|
40
+ if (i['name'].downcase == key.downcase)
41
+ return i['base']
42
+ end
43
+ }
44
+
45
+ return nil
46
+ end
47
+
48
+ #
49
+ # Loads an image file into the context of the process.
50
+ #
51
+ def load(image_path)
52
+ request = Packet.create_request('stdapi_sys_process_image_load')
53
+
54
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
55
+ request.add_tlv(TLV_TYPE_IMAGE_FILE_PATH, image_path)
56
+
57
+ response = process.client.send_request(request)
58
+
59
+ return response.get_tlv_value(TLV_TYPE_IMAGE_BASE)
60
+ end
61
+
62
+ #
63
+ # Returns the address of the procedure that is found in the supplied
64
+ # library.
65
+ #
66
+ def get_procedure_address(image_file, procedure)
67
+ request = Packet.create_request('stdapi_sys_process_image_get_proc_address')
68
+
69
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
70
+ request.add_tlv(TLV_TYPE_IMAGE_FILE, image_file)
71
+ request.add_tlv(TLV_TYPE_PROCEDURE_NAME, procedure)
72
+
73
+ response = process.client.send_request(request)
74
+
75
+ return response.get_tlv_value(TLV_TYPE_PROCEDURE_ADDRESS)
76
+ end
77
+
78
+ #
79
+ # Unloads an image file that is loaded into the address space of the
80
+ # process by its base address.
81
+ #
82
+ def unload(base)
83
+ request = Packet.create_request('stdapi_sys_process_image_unload')
84
+
85
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
86
+ request.add_tlv(TLV_TYPE_IMAGE_BASE, base)
87
+
88
+ response = process.client.send_request(request)
89
+
90
+ return true
91
+ end
92
+
93
+ #
94
+ # Enumerates through each image in the process.
95
+ #
96
+ def each_image(&block)
97
+ get_images.each(&block)
98
+ end
99
+
100
+ #
101
+ # Returns an array of images in the process with hash objects that
102
+ # have keys for 'name', 'path', and 'base'.
103
+ #
104
+ def get_images
105
+ request = Packet.create_request('stdapi_sys_process_image_get_images')
106
+ images = []
107
+
108
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
109
+
110
+ response = process.client.send_request(request)
111
+
112
+ response.each(TLV_TYPE_IMAGE_GROUP) { |i|
113
+ images <<
114
+ {
115
+ 'name' => i.get_tlv_value(TLV_TYPE_IMAGE_NAME),
116
+ 'base' => i.get_tlv_value(TLV_TYPE_IMAGE_BASE),
117
+ 'path' => i.get_tlv_value(TLV_TYPE_IMAGE_FILE_PATH)
118
+ }
119
+ }
120
+
121
+ return images
122
+ end
124
123
 
125
124
  protected
126
- attr_accessor :process # :nodoc:
125
+ attr_accessor :process # :nodoc:
127
126
 
128
127
  end
129
128
 
@@ -1,4 +1,3 @@
1
- #!/usr/bin/env ruby
2
1
  # -*- coding: binary -*-
3
2
 
4
3
  require 'rex/post/meterpreter/client'
@@ -20,36 +19,36 @@ module ProcessSubsystem
20
19
  ###
21
20
  class IO
22
21
 
23
- ##
24
- #
25
- # Constructor
26
- #
27
- ##
28
-
29
- #
30
- # Initializes the IO instance.
31
- #
32
- def initialize(process)
33
- self.process = process
34
- end
35
-
36
- #
37
- # Writes the supplied buffer to the standard input handle of the
38
- # executed process.
39
- #
40
- def write(buf)
41
- return process.channel.write(buf)
42
- end
43
-
44
- #
45
- # Reads data from the standard output handle of the executed process.
46
- #
47
- def read(length = nil)
48
- return process.channel.read(length)
49
- end
22
+ ##
23
+ #
24
+ # Constructor
25
+ #
26
+ ##
27
+
28
+ #
29
+ # Initializes the IO instance.
30
+ #
31
+ def initialize(process)
32
+ self.process = process
33
+ end
34
+
35
+ #
36
+ # Writes the supplied buffer to the standard input handle of the
37
+ # executed process.
38
+ #
39
+ def write(buf)
40
+ return process.channel.write(buf)
41
+ end
42
+
43
+ #
44
+ # Reads data from the standard output handle of the executed process.
45
+ #
46
+ def read(length = nil)
47
+ return process.channel.read(length)
48
+ end
50
49
 
51
50
  protected
52
- attr_accessor :process # :nodoc:
51
+ attr_accessor :process # :nodoc:
53
52
 
54
53
  end
55
54
 
@@ -1,4 +1,3 @@
1
- #!/usr/bin/env ruby
2
1
  # -*- coding: binary -*-
3
2
 
4
3
  require 'rex/post/meterpreter/client'
@@ -21,317 +20,317 @@ module ProcessSubsystem
21
20
  ###
22
21
  class Memory
23
22
 
24
- # Page protection translation hash
25
- @@page_protection_map =
26
- {
27
- PROT_NONE => PAGE_NOACCESS,
28
- PROT_EXEC => PAGE_EXECUTE,
29
- PROT_EXEC | PROT_READ => PAGE_EXECUTE_READ,
30
- PROT_EXEC | PROT_READ |
31
- PROT_WRITE => PAGE_EXECUTE_READWRITE,
32
- PROT_EXEC | PROT_READ |
33
- PROT_WRITE | PROT_COW => PAGE_EXECUTE_WRITECOPY,
34
- PROT_READ => PAGE_READONLY,
35
- PROT_READ | PROT_WRITE => PAGE_READWRITE,
36
- PROT_READ | PROT_WRITE |
37
- PROT_COW => PAGE_WRITECOPY,
38
- PROT_WRITE => PAGE_READWRITE
39
- }
40
-
41
- ##
42
- #
43
- # Constructor
44
- #
45
- ##
46
-
47
- #
48
- # Initializes a memory modification instance with the supplied process
49
- # instance.
50
- #
51
- def initialize(process)
52
- self.process = process
53
- end
54
-
55
- #
56
- # Allocate storage of the supplied length and returns the
57
- # address at which the memory was allocated.
58
- #
59
- def allocate(length, protection = nil, base = nil)
60
- allocation_type = MEM_COMMIT
61
-
62
- # If no protection was supplied, default to the most flexible
63
- if (protection == nil)
64
- protection = PAGE_EXECUTE_READWRITE
65
- else
66
- protection = gen_prot_to_specific(protection)
67
- end
68
-
69
- # If the preferred base is non-nil, set the reserve flag
70
- if (base != nil)
71
- allocation_type |= MEM_RESERVE
72
- end
73
-
74
- return _allocate(base, length, allocation_type, protection)
75
- end
76
-
77
- #
78
- # Low-level memory allocation.
79
- #
80
- def _allocate(base, length, allocation_type, protection)
81
- request = Packet.create_request('stdapi_sys_process_memory_allocate')
82
-
83
- # Populate the request
84
- if (base != nil)
85
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
86
- end
87
-
88
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
89
- request.add_tlv(TLV_TYPE_LENGTH, length)
90
- request.add_tlv(TLV_TYPE_ALLOCATION_TYPE, allocation_type)
91
- request.add_tlv(TLV_TYPE_PROTECTION, protection)
92
-
93
- # Transmit the request
94
- response = process.client.send_request(request);
95
-
96
- return response.get_tlv_value(TLV_TYPE_BASE_ADDRESS)
97
- end
98
-
99
- #
100
- # Deallocate a region of memory in the context of a process.
101
- #
102
- def free(base, length = 0)
103
- return _free(base, length)
104
- end
105
-
106
- #
107
- # Low-level memory deallocation.
108
- #
109
- def _free(base, length)
110
- request = Packet.create_request('stdapi_sys_process_memory_free')
111
-
112
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
113
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
114
- request.add_tlv(TLV_TYPE_LENGTH, length)
115
-
116
- response = process.client.send_request(request)
117
-
118
- return true
119
- end
120
-
121
- #
122
- # Read memory from the context of a process and return the buffer.
123
- #
124
- def read(base, length)
125
- request = Packet.create_request('stdapi_sys_process_memory_read')
126
-
127
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
128
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
129
- request.add_tlv(TLV_TYPE_LENGTH, length)
130
-
131
- response = process.client.send_request(request)
132
-
133
- return response.get_tlv_value(TLV_TYPE_PROCESS_MEMORY)
134
- end
135
-
136
- #
137
- # Write memory to the context of a process and return the number of bytes
138
- # actually written.
139
- #
140
- def write(base, data)
141
- request = Packet.create_request('stdapi_sys_process_memory_write')
142
-
143
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
144
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
145
- request.add_tlv(TLV_TYPE_PROCESS_MEMORY, data)
146
-
147
- response = process.client.send_request(request)
148
-
149
- return response.get_tlv_value(TLV_TYPE_LENGTH)
150
- end
151
-
152
- #
153
- # Queries an address for information about its state.
154
- #
155
- def query(base)
156
- request = Packet.create_request('stdapi_sys_process_memory_query')
157
-
158
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
159
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
160
-
161
- response = process.client.send_request(request)
162
-
163
- # Build out the hash from the response information
164
- info = {}
165
-
166
- info['BaseAddress'] = response.get_tlv_value(TLV_TYPE_BASE_ADDRESS)
167
- info['AllocationBase'] = response.get_tlv_value(TLV_TYPE_ALLOC_BASE_ADDRESS)
168
- info['AllocationProtect'] = specific_prot_to_gen(response.get_tlv_value(TLV_TYPE_ALLOC_PROTECTION))
169
- info['RegionSize'] = response.get_tlv_value(TLV_TYPE_LENGTH)
170
-
171
- # Translate the memory state
172
- state = response.get_tlv_value(TLV_TYPE_MEMORY_STATE)
173
-
174
- if (state == MEM_FREE)
175
- info['Available'] = true
176
- elsif (state == MEM_COMMIT)
177
- info['Available'] = false
178
- elsif (state == MEM_RESERVE)
179
- info['Reserved'] = true
180
- end
181
-
182
- # Translate the region protections
183
- info['Protect'] = specific_prot_to_gen(response.get_tlv_value(TLV_TYPE_PROTECTION))
184
-
185
- # Translate the memory type
186
- type = response.get_tlv_value(TLV_TYPE_MEMORY_TYPE)
187
-
188
- if (type == MEM_IMAGE)
189
- info['ImageMapping'] = true
190
- elsif (type == MEM_MAPPED)
191
- info['MemoryMapping'] = true
192
- elsif (type == MEM_PRIVATE)
193
- info['PrivateMapping'] = true
194
- end
195
-
196
- return info
197
- end
198
-
199
- #
200
- # Change the protection masks on the region supplied in base.
201
- #
202
- def protect(base, length = nil, protection = nil)
203
- request = Packet.create_request('stdapi_sys_process_memory_protect')
204
-
205
- if (length == nil)
206
- length = 4096
207
- end
208
-
209
- # If no protection was supplied, default to the most flexible
210
- if (protection == nil)
211
- protection = PAGE_EXECUTE_READWRITE
212
- else
213
- protection = gen_prot_to_specific(protection)
214
- end
215
-
216
- request.add_tlv(TLV_TYPE_HANDLE, process.handle)
217
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
218
- request.add_tlv(TLV_TYPE_LENGTH, length)
219
- request.add_tlv(TLV_TYPE_PROTECTION, protection)
220
-
221
- # Send the request
222
- response = process.client.send_request(request)
223
-
224
- # Return the old protection to the caller
225
- return specific_prot_to_gen(response.get_tlv_value(TLV_TYPE_PROTECTION))
226
- end
227
-
228
- #
229
- # Lock a region of memory into physical memory so that it can't be
230
- # swapped to disk. This can only be done in the context of the
231
- # process that is running the meterpreter server. The instance's
232
- # handle is ignored.
233
- #
234
- def lock(base, length)
235
- request = Packet.create_request('stdapi_sys_process_memory_lock')
236
-
237
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
238
- request.add_tlv(TLV_TYPE_LENGTH, length)
239
-
240
- response = process.client.send_request(request)
241
-
242
- return true
243
- end
244
-
245
- #
246
- # Unloock a region of memory into physical memory so that it can be
247
- # swapped to disk. This can only be done in the context of the
248
- # process that is running the meterpreter server. The instance's
249
- # handle is ignored.
250
- #
251
- def unlock(base, length)
252
- request = Packet.create_request('stdapi_sys_process_memory_unlock')
253
-
254
- request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
255
- request.add_tlv(TLV_TYPE_LENGTH, length)
256
-
257
- response = process.client.send_request(request)
258
-
259
- return true
260
- end
261
-
262
-
263
- ##
264
- #
265
- # Conditionals
266
- #
267
- ##
268
-
269
- #
270
- # Check to see if an address is readable.
271
- #
272
- def readable?(base)
273
- info = nil
274
-
275
- begin
276
- info = query(base)
277
- rescue
278
- end
279
-
280
- if ((info != nil) &&
281
- (info['Available'] == false) &&
282
- (info['Protect'] & PROT_READ == PROT_READ))
283
- return true
284
- end
285
-
286
- return false
287
- end
288
-
289
- #
290
- # Check to see if an address is writable.
291
- #
292
- def writable?(base)
293
- info = nil
294
-
295
- begin
296
- info = query(base)
297
- rescue
298
- end
299
-
300
- if ((info != nil) &&
301
- (info['Available'] == false) &&
302
- (info['Protect'] & PROT_WRITE == PROT_WRITE))
303
- return true
304
- end
305
-
306
- return false
307
- end
23
+ # Page protection translation hash
24
+ @@page_protection_map =
25
+ {
26
+ PROT_NONE => PAGE_NOACCESS,
27
+ PROT_EXEC => PAGE_EXECUTE,
28
+ PROT_EXEC | PROT_READ => PAGE_EXECUTE_READ,
29
+ PROT_EXEC | PROT_READ |
30
+ PROT_WRITE => PAGE_EXECUTE_READWRITE,
31
+ PROT_EXEC | PROT_READ |
32
+ PROT_WRITE | PROT_COW => PAGE_EXECUTE_WRITECOPY,
33
+ PROT_READ => PAGE_READONLY,
34
+ PROT_READ | PROT_WRITE => PAGE_READWRITE,
35
+ PROT_READ | PROT_WRITE |
36
+ PROT_COW => PAGE_WRITECOPY,
37
+ PROT_WRITE => PAGE_READWRITE
38
+ }
39
+
40
+ ##
41
+ #
42
+ # Constructor
43
+ #
44
+ ##
45
+
46
+ #
47
+ # Initializes a memory modification instance with the supplied process
48
+ # instance.
49
+ #
50
+ def initialize(process)
51
+ self.process = process
52
+ end
53
+
54
+ #
55
+ # Allocate storage of the supplied length and returns the
56
+ # address at which the memory was allocated.
57
+ #
58
+ def allocate(length, protection = nil, base = nil)
59
+ allocation_type = MEM_COMMIT
60
+
61
+ # If no protection was supplied, default to the most flexible
62
+ if (protection == nil)
63
+ protection = PAGE_EXECUTE_READWRITE
64
+ else
65
+ protection = gen_prot_to_specific(protection)
66
+ end
67
+
68
+ # If the preferred base is non-nil, set the reserve flag
69
+ if (base != nil)
70
+ allocation_type |= MEM_RESERVE
71
+ end
72
+
73
+ return _allocate(base, length, allocation_type, protection)
74
+ end
75
+
76
+ #
77
+ # Low-level memory allocation.
78
+ #
79
+ def _allocate(base, length, allocation_type, protection)
80
+ request = Packet.create_request('stdapi_sys_process_memory_allocate')
81
+
82
+ # Populate the request
83
+ if (base != nil)
84
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
85
+ end
86
+
87
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
88
+ request.add_tlv(TLV_TYPE_LENGTH, length)
89
+ request.add_tlv(TLV_TYPE_ALLOCATION_TYPE, allocation_type)
90
+ request.add_tlv(TLV_TYPE_PROTECTION, protection)
91
+
92
+ # Transmit the request
93
+ response = process.client.send_request(request);
94
+
95
+ return response.get_tlv_value(TLV_TYPE_BASE_ADDRESS)
96
+ end
97
+
98
+ #
99
+ # Deallocate a region of memory in the context of a process.
100
+ #
101
+ def free(base, length = 0)
102
+ return _free(base, length)
103
+ end
104
+
105
+ #
106
+ # Low-level memory deallocation.
107
+ #
108
+ def _free(base, length)
109
+ request = Packet.create_request('stdapi_sys_process_memory_free')
110
+
111
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
112
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
113
+ request.add_tlv(TLV_TYPE_LENGTH, length)
114
+
115
+ response = process.client.send_request(request)
116
+
117
+ return true
118
+ end
119
+
120
+ #
121
+ # Read memory from the context of a process and return the buffer.
122
+ #
123
+ def read(base, length)
124
+ request = Packet.create_request('stdapi_sys_process_memory_read')
125
+
126
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
127
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
128
+ request.add_tlv(TLV_TYPE_LENGTH, length)
129
+
130
+ response = process.client.send_request(request)
131
+
132
+ return response.get_tlv_value(TLV_TYPE_PROCESS_MEMORY)
133
+ end
134
+
135
+ #
136
+ # Write memory to the context of a process and return the number of bytes
137
+ # actually written.
138
+ #
139
+ def write(base, data)
140
+ request = Packet.create_request('stdapi_sys_process_memory_write')
141
+
142
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
143
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
144
+ request.add_tlv(TLV_TYPE_PROCESS_MEMORY, data)
145
+
146
+ response = process.client.send_request(request)
147
+
148
+ return response.get_tlv_value(TLV_TYPE_LENGTH)
149
+ end
150
+
151
+ #
152
+ # Queries an address for information about its state.
153
+ #
154
+ def query(base)
155
+ request = Packet.create_request('stdapi_sys_process_memory_query')
156
+
157
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
158
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
159
+
160
+ response = process.client.send_request(request)
161
+
162
+ # Build out the hash from the response information
163
+ info = {}
164
+
165
+ info['BaseAddress'] = response.get_tlv_value(TLV_TYPE_BASE_ADDRESS)
166
+ info['AllocationBase'] = response.get_tlv_value(TLV_TYPE_ALLOC_BASE_ADDRESS)
167
+ info['AllocationProtect'] = specific_prot_to_gen(response.get_tlv_value(TLV_TYPE_ALLOC_PROTECTION))
168
+ info['RegionSize'] = response.get_tlv_value(TLV_TYPE_LENGTH)
169
+
170
+ # Translate the memory state
171
+ state = response.get_tlv_value(TLV_TYPE_MEMORY_STATE)
172
+
173
+ if (state == MEM_FREE)
174
+ info['Available'] = true
175
+ elsif (state == MEM_COMMIT)
176
+ info['Available'] = false
177
+ elsif (state == MEM_RESERVE)
178
+ info['Reserved'] = true
179
+ end
180
+
181
+ # Translate the region protections
182
+ info['Protect'] = specific_prot_to_gen(response.get_tlv_value(TLV_TYPE_PROTECTION))
183
+
184
+ # Translate the memory type
185
+ type = response.get_tlv_value(TLV_TYPE_MEMORY_TYPE)
186
+
187
+ if (type == MEM_IMAGE)
188
+ info['ImageMapping'] = true
189
+ elsif (type == MEM_MAPPED)
190
+ info['MemoryMapping'] = true
191
+ elsif (type == MEM_PRIVATE)
192
+ info['PrivateMapping'] = true
193
+ end
194
+
195
+ return info
196
+ end
197
+
198
+ #
199
+ # Change the protection masks on the region supplied in base.
200
+ #
201
+ def protect(base, length = nil, protection = nil)
202
+ request = Packet.create_request('stdapi_sys_process_memory_protect')
203
+
204
+ if (length == nil)
205
+ length = 4096
206
+ end
207
+
208
+ # If no protection was supplied, default to the most flexible
209
+ if (protection == nil)
210
+ protection = PAGE_EXECUTE_READWRITE
211
+ else
212
+ protection = gen_prot_to_specific(protection)
213
+ end
214
+
215
+ request.add_tlv(TLV_TYPE_HANDLE, process.handle)
216
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
217
+ request.add_tlv(TLV_TYPE_LENGTH, length)
218
+ request.add_tlv(TLV_TYPE_PROTECTION, protection)
219
+
220
+ # Send the request
221
+ response = process.client.send_request(request)
222
+
223
+ # Return the old protection to the caller
224
+ return specific_prot_to_gen(response.get_tlv_value(TLV_TYPE_PROTECTION))
225
+ end
226
+
227
+ #
228
+ # Lock a region of memory into physical memory so that it can't be
229
+ # swapped to disk. This can only be done in the context of the
230
+ # process that is running the meterpreter server. The instance's
231
+ # handle is ignored.
232
+ #
233
+ def lock(base, length)
234
+ request = Packet.create_request('stdapi_sys_process_memory_lock')
235
+
236
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
237
+ request.add_tlv(TLV_TYPE_LENGTH, length)
238
+
239
+ response = process.client.send_request(request)
240
+
241
+ return true
242
+ end
243
+
244
+ #
245
+ # Unloock a region of memory into physical memory so that it can be
246
+ # swapped to disk. This can only be done in the context of the
247
+ # process that is running the meterpreter server. The instance's
248
+ # handle is ignored.
249
+ #
250
+ def unlock(base, length)
251
+ request = Packet.create_request('stdapi_sys_process_memory_unlock')
252
+
253
+ request.add_tlv(TLV_TYPE_BASE_ADDRESS, base)
254
+ request.add_tlv(TLV_TYPE_LENGTH, length)
255
+
256
+ response = process.client.send_request(request)
257
+
258
+ return true
259
+ end
260
+
261
+
262
+ ##
263
+ #
264
+ # Conditionals
265
+ #
266
+ ##
267
+
268
+ #
269
+ # Check to see if an address is readable.
270
+ #
271
+ def readable?(base)
272
+ info = nil
273
+
274
+ begin
275
+ info = query(base)
276
+ rescue
277
+ end
278
+
279
+ if ((info != nil) &&
280
+ (info['Available'] == false) &&
281
+ (info['Protect'] & PROT_READ == PROT_READ))
282
+ return true
283
+ end
284
+
285
+ return false
286
+ end
287
+
288
+ #
289
+ # Check to see if an address is writable.
290
+ #
291
+ def writable?(base)
292
+ info = nil
293
+
294
+ begin
295
+ info = query(base)
296
+ rescue
297
+ end
298
+
299
+ if ((info != nil) &&
300
+ (info['Available'] == false) &&
301
+ (info['Protect'] & PROT_WRITE == PROT_WRITE))
302
+ return true
303
+ end
304
+
305
+ return false
306
+ end
308
307
 
309
308
  protected
310
309
 
311
- #
312
- # Translates general protection flags to specific protection flags.
313
- #
314
- def gen_prot_to_specific(prot)
315
- if (prot == nil)
316
- return PAGE_READ
317
- end
310
+ #
311
+ # Translates general protection flags to specific protection flags.
312
+ #
313
+ def gen_prot_to_specific(prot)
314
+ if (prot == nil)
315
+ return PAGE_READ
316
+ end
318
317
 
319
- return @@page_protection_map[prot]
320
- end
318
+ return @@page_protection_map[prot]
319
+ end
321
320
 
322
- #
323
- # Translates specific protection flags to general protection flags.
324
- #
325
- def specific_prot_to_gen(prot)
321
+ #
322
+ # Translates specific protection flags to general protection flags.
323
+ #
324
+ def specific_prot_to_gen(prot)
326
325
 
327
- if (prot == nil)
328
- return PAGE_READONLY
329
- end
326
+ if (prot == nil)
327
+ return PAGE_READONLY
328
+ end
330
329
 
331
- return @@page_protection_map.invert[prot]
332
- end
330
+ return @@page_protection_map.invert[prot]
331
+ end
333
332
 
334
- attr_accessor :process # :nodoc:
333
+ attr_accessor :process # :nodoc:
335
334
  end
336
335
 
337
336
  end; end; end; end; end; end; end