librex 0.0.68 → 0.0.70

data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 module Rex
@@ -13,10 +12,10 @@ module Stdapi
 #
 ##
 
-TLV_TYPE_HANDLE             = TLV_META_TYPE_UINT    |  600
+TLV_TYPE_HANDLE             = TLV_META_TYPE_QWORD   |  600
 TLV_TYPE_INHERIT            = TLV_META_TYPE_BOOL    |  601
-TLV_TYPE_PROCESS_HANDLE     = TLV_META_TYPE_UINT    |  630
-TLV_TYPE_THREAD_HANDLE      = TLV_META_TYPE_UINT    |  631
+TLV_TYPE_PROCESS_HANDLE     = TLV_META_TYPE_QWORD   |  630
+TLV_TYPE_THREAD_HANDLE      = TLV_META_TYPE_QWORD   |  631
 TLV_TYPE_PRIVILEGE          = TLV_META_TYPE_STRING  |  632
 
 ##
@@ -53,6 +52,7 @@ TLV_TYPE_NETMASK            = TLV_META_TYPE_RAW     | 1421
 TLV_TYPE_GATEWAY            = TLV_META_TYPE_RAW     | 1422
 TLV_TYPE_NETWORK_ROUTE      = TLV_META_TYPE_GROUP   | 1423
 TLV_TYPE_IP_PREFIX          = TLV_META_TYPE_UINT    | 1424
+TLV_TYPE_ARP_ENTRY          = TLV_META_TYPE_GROUP   | 1425
 
 TLV_TYPE_IP                 = TLV_META_TYPE_RAW     | 1430
 TLV_TYPE_MAC_ADDRESS        = TLV_META_TYPE_RAW     | 1431
@@ -65,12 +65,24 @@ TLV_TYPE_NETMASK_STRING     = TLV_META_TYPE_STRING  | 1441
 TLV_TYPE_GATEWAY_STRING     = TLV_META_TYPE_STRING  | 1442
 TLV_TYPE_ROUTE_METRIC       = TLV_META_TYPE_UINT    | 1443
 
+# Resolve
+TLV_TYPE_ADDR_TYPE          = TLV_META_TYPE_UINT    | 1444
+
+# Proxy configuration
+TLV_TYPE_PROXY_CFG_AUTODETECT    = TLV_META_TYPE_BOOL    | 1445
+TLV_TYPE_PROXY_CFG_AUTOCONFIGURL = TLV_META_TYPE_STRING  | 1446
+TLV_TYPE_PROXY_CFG_PROXY         = TLV_META_TYPE_STRING  | 1447
+TLV_TYPE_PROXY_CFG_PROXYBYPASS   = TLV_META_TYPE_STRING  | 1448
+
 # Socket
 TLV_TYPE_PEER_HOST          = TLV_META_TYPE_STRING  | 1500
 TLV_TYPE_PEER_PORT          = TLV_META_TYPE_UINT    | 1501
 TLV_TYPE_LOCAL_HOST         = TLV_META_TYPE_STRING  | 1502
 TLV_TYPE_LOCAL_PORT         = TLV_META_TYPE_UINT    | 1503
 TLV_TYPE_CONNECT_RETRIES    = TLV_META_TYPE_UINT    | 1504
+TLV_TYPE_NETSTAT_ENTRY      = TLV_META_TYPE_GROUP   | 1505
+TLV_TYPE_PEER_HOST_RAW      = TLV_META_TYPE_RAW     | 1506
+TLV_TYPE_LOCAL_HOST_RAW     = TLV_META_TYPE_RAW     | 1507
 
 TLV_TYPE_SHUTDOWN_HOW       = TLV_META_TYPE_UINT    | 1530
 
@@ -88,7 +100,7 @@ PROCESS_EXECUTE_FLAG_DESKTOP          = (1 << 4)
 PROCESS_EXECUTE_FLAG_SESSION          = (1 << 5)
 
 # Registry
-TLV_TYPE_HKEY               = TLV_META_TYPE_UINT    | 1000
+TLV_TYPE_HKEY               = TLV_META_TYPE_QWORD   | 1000
 TLV_TYPE_ROOT_KEY           = TLV_TYPE_HKEY
 TLV_TYPE_BASE_KEY           = TLV_META_TYPE_STRING  | 1001
 TLV_TYPE_PERMISSION         = TLV_META_TYPE_UINT    | 1002
@@ -105,15 +117,20 @@ TLV_TYPE_USER_NAME          = TLV_META_TYPE_STRING  | 1042
 TLV_TYPE_ARCHITECTURE       = TLV_META_TYPE_STRING  | 1043
 TLV_TYPE_LANG_SYSTEM        = TLV_META_TYPE_STRING  | 1044
 
+# Environment
+TLV_TYPE_ENV_VARIABLE       = TLV_META_TYPE_STRING  | 1100
+TLV_TYPE_ENV_VALUE          = TLV_META_TYPE_STRING  | 1101
+TLV_TYPE_ENV_GROUP          = TLV_META_TYPE_GROUP   | 1102
+
 DELETE_KEY_FLAG_RECURSIVE   = (1 << 0)
 
 # Process
-TLV_TYPE_BASE_ADDRESS       = TLV_META_TYPE_UINT    | 2000
+TLV_TYPE_BASE_ADDRESS       = TLV_META_TYPE_QWORD   | 2000
 TLV_TYPE_ALLOCATION_TYPE    = TLV_META_TYPE_UINT    | 2001
 TLV_TYPE_PROTECTION         = TLV_META_TYPE_UINT    | 2002
 TLV_TYPE_PROCESS_PERMS      = TLV_META_TYPE_UINT    | 2003
 TLV_TYPE_PROCESS_MEMORY     = TLV_META_TYPE_RAW     | 2004
-TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_UINT    | 2005
+TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_QWORD   | 2005
 TLV_TYPE_MEMORY_STATE       = TLV_META_TYPE_UINT    | 2006
 TLV_TYPE_MEMORY_TYPE        = TLV_META_TYPE_UINT    | 2007
 TLV_TYPE_ALLOC_PROTECTION   = TLV_META_TYPE_UINT    | 2008
@@ -130,16 +147,16 @@ TLV_TYPE_PROCESS_SESSION    = TLV_META_TYPE_UINT    | 2308
 TLV_TYPE_IMAGE_FILE         = TLV_META_TYPE_STRING  | 2400
 TLV_TYPE_IMAGE_FILE_PATH    = TLV_META_TYPE_STRING  | 2401
 TLV_TYPE_PROCEDURE_NAME     = TLV_META_TYPE_STRING  | 2402
-TLV_TYPE_PROCEDURE_ADDRESS  = TLV_META_TYPE_UINT    | 2403
-TLV_TYPE_IMAGE_BASE         = TLV_META_TYPE_UINT    | 2404
+TLV_TYPE_PROCEDURE_ADDRESS  = TLV_META_TYPE_QWORD   | 2403
+TLV_TYPE_IMAGE_BASE         = TLV_META_TYPE_QWORD   | 2404
 TLV_TYPE_IMAGE_GROUP        = TLV_META_TYPE_GROUP   | 2405
 TLV_TYPE_IMAGE_NAME         = TLV_META_TYPE_STRING  | 2406
 
 TLV_TYPE_THREAD_ID          = TLV_META_TYPE_UINT    | 2500
 TLV_TYPE_THREAD_PERMS       = TLV_META_TYPE_UINT    | 2502
 TLV_TYPE_EXIT_CODE          = TLV_META_TYPE_UINT    | 2510
-TLV_TYPE_ENTRY_POINT        = TLV_META_TYPE_UINT    | 2511
-TLV_TYPE_ENTRY_PARAMETER    = TLV_META_TYPE_UINT    | 2512
+TLV_TYPE_ENTRY_POINT        = TLV_META_TYPE_QWORD   | 2511
+TLV_TYPE_ENTRY_PARAMETER    = TLV_META_TYPE_QWORD   | 2512
 TLV_TYPE_CREATION_FLAGS     = TLV_META_TYPE_UINT    | 2513
 
 TLV_TYPE_REGISTER_NAME      = TLV_META_TYPE_STRING  | 2540
@@ -172,7 +189,7 @@ TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER = TLV_META_TYPE_STRING | 3012
 #
 ##
 TLV_TYPE_EVENT_SOURCENAME   = TLV_META_TYPE_STRING  | 4000
-TLV_TYPE_EVENT_HANDLE       = TLV_META_TYPE_UINT    | 4001
+TLV_TYPE_EVENT_HANDLE       = TLV_META_TYPE_QWORD   | 4001
 TLV_TYPE_EVENT_NUMRECORDS   = TLV_META_TYPE_UINT    | 4002
 
 TLV_TYPE_EVENT_READFLAGS    = TLV_META_TYPE_UINT    | 4003

data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb

@@ -1,4 +1,3 @@
-#!/usr/bin/env ruby
 # -*- coding: binary -*-
 
 require 'rex/post/ui'
@@ -22,238 +21,238 @@ module Stdapi
 ###
 class UI < Rex::Post::UI
 
-	include Rex::Post::Meterpreter::ObjectAliasesContainer
-
-	##
-	#
-	# Constructor
-	#
-	##
-
-	#
-	# Initializes the post-exploitation user-interface manipulation subsystem.
-	#
-	def initialize(client)
-		self.client = client
-	end
-
-	##
-	#
-	# Device enabling/disabling
-	#
-	##
-
-	#
-	# Disable keyboard input on the remote machine.
-	#
-	def disable_keyboard
-		return enable_keyboard(false)
-	end
-
-	#
-	# Enable keyboard input on the remote machine.
-	#
-	def enable_keyboard(enable = true)
-		request = Packet.create_request('stdapi_ui_enable_keyboard')
-
-		request.add_tlv(TLV_TYPE_BOOL, enable)
-
-		response = client.send_request(request)
-
-		return true
-	end
-
-	#
-	# Disable mouse input on the remote machine.
-	#
-	def disable_mouse
-		return enable_mouse(false)
-	end
-
-	#
-	# Enable mouse input on the remote machine.
-	#
-	def enable_mouse(enable = true)
-		request = Packet.create_request('stdapi_ui_enable_mouse')
-
-		request.add_tlv(TLV_TYPE_BOOL, enable)
-
-		response = client.send_request(request)
-
-		return true
-	end
-
-	#
-	# Returns the number of seconds the remote machine has been idle
-	# from user input.
-	#
-	def idle_time
-		request = Packet.create_request('stdapi_ui_get_idle_time')
-
-		response = client.send_request(request)
-
-		return response.get_tlv_value(TLV_TYPE_IDLE_TIME);
-	end
-
-	#
-	# Enumerate desktops.
-	#
-	def enum_desktops
-		request  = Packet.create_request('stdapi_ui_desktop_enum')
-		response = client.send_request(request)
-		desktopz = []
-		if( response.result == 0 )
-			response.each( TLV_TYPE_DESKTOP ) { | desktop |
-			desktopz << {
-					'session' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
-					'station' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
-					'name'    => desktop.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
-				}
-			}
-		end
-		return desktopz
-	end
-
-	#
-	# Get the current desktop meterpreter is using.
-	#
-	def get_desktop
-		request  = Packet.create_request( 'stdapi_ui_desktop_get' )
-		response = client.send_request( request )
-		desktop  = {}
-		if( response.result == 0 )
-			desktop = {
-					'session' => response.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
-					'station' => response.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
-					'name'    => response.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
-				}
-		end
-		return desktop
-	end
-
-	#
-	# Change the meterpreters current desktop. The switch param sets this
-	# new desktop as the interactive one (The local users visible desktop
-	# with screen/keyboard/mouse control).
-	#
-	def set_desktop( session=-1, station='WinSta0', name='Default', switch=false )
-		request  = Packet.create_request( 'stdapi_ui_desktop_set' )
-		request.add_tlv( TLV_TYPE_DESKTOP_SESSION, session )
-		request.add_tlv( TLV_TYPE_DESKTOP_STATION, station )
-		request.add_tlv( TLV_TYPE_DESKTOP_NAME, name )
-		request.add_tlv( TLV_TYPE_DESKTOP_SWITCH, switch )
-		response = client.send_request( request )
-		if( response.result == 0 )
-			return true
-		end
-		return false
-	end
-
-	#
-	# Grab a screenshot of the interactive desktop
-	#
-	def screenshot( quality=50 )
-		request = Packet.create_request( 'stdapi_ui_desktop_screenshot' )
-		request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_QUALITY, quality )
-		# include the x64 screenshot dll if the host OS is x64
-		if( client.sys.config.sysinfo['Architecture'] =~ /^\S*x64\S*/ )
-			screenshot_path = ::File.join( Msf::Config.install_root, 'data', 'meterpreter', 'screenshot.x64.dll' )
-			screenshot_path = ::File.expand_path( screenshot_path )
-			screenshot_dll  = ''
-			::File.open( screenshot_path, 'rb' ) do |f|
-				screenshot_dll += f.read( f.stat.size )
-			end
-			request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER, screenshot_dll, false, true )
-			request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_LENGTH, screenshot_dll.length )
-		end
-		# but allways include the x86 screenshot dll as we can use it for wow64 processes if we are on x64
-		screenshot_path = ::File.join( Msf::Config.install_root, 'data', 'meterpreter', 'screenshot.dll' )
-		screenshot_path = ::File.expand_path( screenshot_path )
-		screenshot_dll  = ''
-		::File.open( screenshot_path, 'rb' ) do |f|
-			screenshot_dll += f.read( f.stat.size )
-		end
-		request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_BUFFER, screenshot_dll, false, true )
-		request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_LENGTH, screenshot_dll.length )
-		# send the request and return the jpeg image if successfull.
-		response = client.send_request( request )
-		if( response.result == 0 )
-			return response.get_tlv_value( TLV_TYPE_DESKTOP_SCREENSHOT )
-		end
-		return nil
-	end
-
-	#
-	# Unlock or lock the desktop
-	#
-	def unlock_desktop(unlock=true)
-		request  = Packet.create_request('stdapi_ui_unlock_desktop')
-		request.add_tlv(TLV_TYPE_BOOL, unlock)
-		response = client.send_request(request)
-		return true
-	end
-
-	#
-	# Start the keyboard sniffer
-	#
-	def keyscan_start
-		request  = Packet.create_request('stdapi_ui_start_keyscan')
-		response = client.send_request(request)
-		return true
-	end
-
-	#
-	# Stop the keyboard sniffer
-	#
-	def keyscan_stop
-		request  = Packet.create_request('stdapi_ui_stop_keyscan')
-		response = client.send_request(request)
-		return true
-	end
-
-	#
-	# Dump the keystroke buffer
-	#
-	def keyscan_dump
-		request  = Packet.create_request('stdapi_ui_get_keys')
-		response = client.send_request(request)
-		return response.get_tlv_value(TLV_TYPE_KEYS_DUMP);
-	end
-
-	#
-	# Extract the keystroke from the buffer data
-	#
-	def keyscan_extract(buffer_data)
-		outp = ""
-		buffer_data.unpack("n*").each do |inp|
-			fl = (inp & 0xff00) >> 8
-			vk = (inp & 0xff)
-			kc = VirtualKeyCodes[vk]
-
-			f_shift = fl & (1<<1)
-			f_ctrl  = fl & (1<<2)
-			f_alt   = fl & (1<<3)
-
-			if(kc)
-				name = ((f_shift != 0 and kc.length > 1) ? kc[1] : kc[0])
-				case name
-				when /^.$/
-					outp << name
-				when /shift|click/i
-				when 'Space'
-					outp << " "
-				else
-					outp << " <#{name}> "
-				end
-			else
-				outp << " <0x%.2x> " % vk
-			end
-		end
-		return outp
-	end
+  include Rex::Post::Meterpreter::ObjectAliasesContainer
+
+  ##
+  #
+  # Constructor
+  #
+  ##
+
+  #
+  # Initializes the post-exploitation user-interface manipulation subsystem.
+  #
+  def initialize(client)
+    self.client = client
+  end
+
+  ##
+  #
+  # Device enabling/disabling
+  #
+  ##
+
+  #
+  # Disable keyboard input on the remote machine.
+  #
+  def disable_keyboard
+    return enable_keyboard(false)
+  end
+
+  #
+  # Enable keyboard input on the remote machine.
+  #
+  def enable_keyboard(enable = true)
+    request = Packet.create_request('stdapi_ui_enable_keyboard')
+
+    request.add_tlv(TLV_TYPE_BOOL, enable)
+
+    response = client.send_request(request)
+
+    return true
+  end
+
+  #
+  # Disable mouse input on the remote machine.
+  #
+  def disable_mouse
+    return enable_mouse(false)
+  end
+
+  #
+  # Enable mouse input on the remote machine.
+  #
+  def enable_mouse(enable = true)
+    request = Packet.create_request('stdapi_ui_enable_mouse')
+
+    request.add_tlv(TLV_TYPE_BOOL, enable)
+
+    response = client.send_request(request)
+
+    return true
+  end
+
+  #
+  # Returns the number of seconds the remote machine has been idle
+  # from user input.
+  #
+  def idle_time
+    request = Packet.create_request('stdapi_ui_get_idle_time')
+
+    response = client.send_request(request)
+
+    return response.get_tlv_value(TLV_TYPE_IDLE_TIME);
+  end
+
+  #
+  # Enumerate desktops.
+  #
+  def enum_desktops
+    request  = Packet.create_request('stdapi_ui_desktop_enum')
+    response = client.send_request(request)
+    desktopz = []
+    if( response.result == 0 )
+      response.each( TLV_TYPE_DESKTOP ) { | desktop |
+      desktopz << {
+          'session' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
+          'station' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
+          'name'    => desktop.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
+        }
+      }
+    end
+    return desktopz
+  end
+
+  #
+  # Get the current desktop meterpreter is using.
+  #
+  def get_desktop
+    request  = Packet.create_request( 'stdapi_ui_desktop_get' )
+    response = client.send_request( request )
+    desktop  = {}
+    if( response.result == 0 )
+      desktop = {
+          'session' => response.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
+          'station' => response.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
+          'name'    => response.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
+        }
+    end
+    return desktop
+  end
+
+  #
+  # Change the meterpreters current desktop. The switch param sets this
+  # new desktop as the interactive one (The local users visible desktop
+  # with screen/keyboard/mouse control).
+  #
+  def set_desktop( session=-1, station='WinSta0', name='Default', switch=false )
+    request  = Packet.create_request( 'stdapi_ui_desktop_set' )
+    request.add_tlv( TLV_TYPE_DESKTOP_SESSION, session )
+    request.add_tlv( TLV_TYPE_DESKTOP_STATION, station )
+    request.add_tlv( TLV_TYPE_DESKTOP_NAME, name )
+    request.add_tlv( TLV_TYPE_DESKTOP_SWITCH, switch )
+    response = client.send_request( request )
+    if( response.result == 0 )
+      return true
+    end
+    return false
+  end
+
+  #
+  # Grab a screenshot of the interactive desktop
+  #
+  def screenshot( quality=50 )
+    request = Packet.create_request( 'stdapi_ui_desktop_screenshot' )
+    request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_QUALITY, quality )
+    # include the x64 screenshot dll if the host OS is x64
+    if( client.sys.config.sysinfo['Architecture'] =~ /^\S*x64\S*/ )
+      screenshot_path = MeterpreterBinaries.path('screenshot','x64.dll')
+      screenshot_path = ::File.expand_path( screenshot_path )
+      screenshot_dll  = ''
+      ::File.open( screenshot_path, 'rb' ) do |f|
+        screenshot_dll += f.read( f.stat.size )
+      end
+      request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER, screenshot_dll, false, true )
+      request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_LENGTH, screenshot_dll.length )
+    end
+    # but allways include the x86 screenshot dll as we can use it for wow64 processes if we are on x64
+    screenshot_path = MeterpreterBinaries.path('screenshot','x86.dll')
+    screenshot_path = ::File.expand_path( screenshot_path )
+    screenshot_dll  = ''
+    ::File.open( screenshot_path, 'rb' ) do |f|
+      screenshot_dll += f.read( f.stat.size )
+    end
+    request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_BUFFER, screenshot_dll, false, true )
+    request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_LENGTH, screenshot_dll.length )
+    # send the request and return the jpeg image if successfull.
+    response = client.send_request( request )
+    if( response.result == 0 )
+      return response.get_tlv_value( TLV_TYPE_DESKTOP_SCREENSHOT )
+    end
+    return nil
+  end
+
+  #
+  # Unlock or lock the desktop
+  #
+  def unlock_desktop(unlock=true)
+    request  = Packet.create_request('stdapi_ui_unlock_desktop')
+    request.add_tlv(TLV_TYPE_BOOL, unlock)
+    response = client.send_request(request)
+    return true
+  end
+
+  #
+  # Start the keyboard sniffer
+  #
+  def keyscan_start
+    request  = Packet.create_request('stdapi_ui_start_keyscan')
+    response = client.send_request(request)
+    return true
+  end
+
+  #
+  # Stop the keyboard sniffer
+  #
+  def keyscan_stop
+    request  = Packet.create_request('stdapi_ui_stop_keyscan')
+    response = client.send_request(request)
+    return true
+  end
+
+  #
+  # Dump the keystroke buffer
+  #
+  def keyscan_dump
+    request  = Packet.create_request('stdapi_ui_get_keys')
+    response = client.send_request(request)
+    return response.get_tlv_value(TLV_TYPE_KEYS_DUMP);
+  end
+
+  #
+  # Extract the keystroke from the buffer data
+  #
+  def keyscan_extract(buffer_data)
+    outp = ""
+    buffer_data.unpack("n*").each do |inp|
+      fl = (inp & 0xff00) >> 8
+      vk = (inp & 0xff)
+      kc = VirtualKeyCodes[vk]
+
+      f_shift = fl & (1<<1)
+      f_ctrl  = fl & (1<<2)
+      f_alt   = fl & (1<<3)
+
+      if(kc)
+        name = ((f_shift != 0 and kc.length > 1) ? kc[1] : kc[0])
+        case name
+        when /^.$/
+          outp << name
+        when /shift|click/i
+        when 'Space'
+          outp << " "
+        else
+          outp << " <#{name}> "
+        end
+      else
+        outp << " <0x%.2x> " % vk
+      end
+    end
+    return outp
+  end
 
 protected
-	attr_accessor :client # :nodoc:
+  attr_accessor :client # :nodoc:
 
 end