rex 1.0.2 → 2.0.2

data/lib/rex/post/meterpreter/extensions/android/tlv.rb

@@ -0,0 +1,40 @@
+#!/usr/bin/env ruby
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Android
+
+TLV_TYPE_SMS_ADDRESS      = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9001)
+TLV_TYPE_SMS_BODY         = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9002)
+TLV_TYPE_SMS_TYPE         = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9003)
+TLV_TYPE_SMS_GROUP        = TLV_META_TYPE_GROUP     | (TLV_EXTENSIONS + 9004)
+TLV_TYPE_SMS_STATUS       = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9005)
+TLV_TYPE_SMS_DATE         = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9006)
+
+TLV_TYPE_CONTACT_GROUP    = TLV_META_TYPE_GROUP     | (TLV_EXTENSIONS + 9007)
+TLV_TYPE_CONTACT_NUMBER   = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9008)
+TLV_TYPE_CONTACT_EMAIL    = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9009)
+TLV_TYPE_CONTACT_NAME     = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9010)
+
+TLV_TYPE_GEO_LAT          = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9011)
+TLV_TYPE_GEO_LONG         = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9012)
+
+TLV_TYPE_CALLLOG_NAME     = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9013)
+TLV_TYPE_CALLLOG_TYPE     = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9014)
+TLV_TYPE_CALLLOG_DATE     = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9015)
+TLV_TYPE_CALLLOG_DURATION = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9016)
+TLV_TYPE_CALLLOG_GROUP    = TLV_META_TYPE_GROUP     | (TLV_EXTENSIONS + 9017)
+TLV_TYPE_CALLLOG_NUMBER   = TLV_META_TYPE_STRING    | (TLV_EXTENSIONS + 9018)
+
+TLV_TYPE_CHECK_ROOT_BOOL  = TLV_META_TYPE_BOOL      | (TLV_EXTENSIONS + 9019)
+
+TLV_TYPE_SHUTDOWN_TIMER   = TLV_META_TYPE_UINT      | (TLV_EXTENSIONS + 9020)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/espia/espia.rb

@@ -0,0 +1,58 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/espia/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Espia
+
+###
+#
+# This meterpreter extensions interface that is capable
+# grab webcam frame and recor mic audio
+#
+###
+class Espia < Extension
+
+
+  def initialize(client)
+    super(client, 'espia')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'espia',
+          'ext'  => self
+        },
+      ])
+  end
+
+  def espia_video_get_dev_image()
+    request = Packet.create_request('espia_video_get_dev_image')
+    response = client.send_request(request)
+
+    return true
+  end
+
+  def espia_audio_get_dev_audio(rsecs)
+    request = Packet.create_request('espia_audio_get_dev_audio')
+    request.add_tlv(TLV_TYPE_DEV_RECTIME, rsecs)
+    response = client.send_request(request)
+
+    return true
+  end
+
+  def espia_image_get_dev_screen
+    request  = Packet.create_request( 'espia_image_get_dev_screen' )
+    response = client.send_request( request )
+    if( response.result == 0 )
+      return response.get_tlv_value( TLV_TYPE_DEV_SCREEN )
+    end
+    return nil
+  end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/espia/tlv.rb

@@ -0,0 +1,17 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Espia
+
+TLV_TYPE_DEV_IMAGE = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 911)
+TLV_TYPE_DEV_AUDIO = TLV_META_TYPE_STRING| (TLV_EXTENSIONS + 912)
+TLV_TYPE_DEV_SCREEN = TLV_META_TYPE_RAW| (TLV_EXTENSIONS + 913)
+TLV_TYPE_DEV_RECTIME = TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 914)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb

@@ -0,0 +1,71 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Adsi
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# querying and managing desktop windows.
+#
+###
+class Adsi
+
+  def initialize(client)
+    @client = client
+  end
+
+  #
+  # Perform a generic domain query against ADSI.
+  #
+  # @param domain_name [String] The FQDN of the target domain.
+  # @param filter [String] The filter to apply to the query in
+  #   LDAP format.
+  # @param max_results [Integer] The maximum number of results
+  #   to return.
+  # @param page_size [Integer] The size of the page of results
+  #   to return.
+  # @param fields [Array] Array of string fields to return for
+  #   each result found
+  #
+  # @return [Hash] Array of field names with associated results.
+  #
+  def domain_query(domain_name, filter, max_results, page_size, fields)
+    request = Packet.create_request('extapi_adsi_domain_query')
+
+    request.add_tlv(TLV_TYPE_EXT_ADSI_DOMAIN, domain_name)
+    request.add_tlv(TLV_TYPE_EXT_ADSI_FILTER, filter)
+    request.add_tlv(TLV_TYPE_EXT_ADSI_MAXRESULTS, max_results)
+    request.add_tlv(TLV_TYPE_EXT_ADSI_PAGESIZE, page_size)
+
+    fields.each do |f|
+      request.add_tlv(TLV_TYPE_EXT_ADSI_FIELD, f)
+    end
+
+    response = client.send_request(request)
+
+    results = []
+    response.each(TLV_TYPE_EXT_ADSI_RESULT) { |r|
+      result = []
+      r.each(TLV_TYPE_EXT_ADSI_VALUE) { |v|
+        result << v.value
+      }
+      results << result
+    }
+
+    return {
+      :fields  => fields,
+      :results => results
+    }
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end
+

data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb

@@ -0,0 +1,169 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Clipboard
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# querying and managing desktop windows.
+#
+###
+class Clipboard
+
+  def initialize(client)
+    @client = client
+  end
+
+  #
+  # Get the target clipboard data in whichever format we can
+  # (if it's supported).
+  #
+  def get_data(download = false)
+    request = Packet.create_request('extapi_clipboard_get_data')
+
+    if download
+      request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_DOWNLOAD, true)
+    end
+
+    response = client.send_request(request)
+
+    return parse_dump(response)
+  end
+
+  #
+  # Set the target clipboard data to a text value
+  #
+  def set_text(text)
+    request = Packet.create_request('extapi_clipboard_set_data')
+
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT, text)
+
+    response = client.send_request(request)
+
+    return true
+  end
+
+  #
+  # Start the clipboard monitor if it hasn't been started.
+  #
+  def monitor_start(opts)
+    request = Packet.create_request('extapi_clipboard_monitor_start')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_WIN_CLASS, opts[:wincls])
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, opts[:cap_img])
+    return client.send_request(request)
+  end
+
+  #
+  # Pause the clipboard monitor if it's running.
+  #
+  def monitor_pause
+    request = Packet.create_request('extapi_clipboard_monitor_pause')
+    return client.send_request(request)
+  end
+
+  #
+  # Dump the conents of the clipboard monitor to the local machine.
+  #
+  def monitor_dump(opts)
+    pull_img = opts[:include_images]
+    purge = opts[:purge]
+    purge = true if purge.nil?
+
+    request = Packet.create_request('extapi_clipboard_monitor_dump')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, pull_img)
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_PURGE, purge)
+
+    response = client.send_request(request)
+
+    return parse_dump(response)
+  end
+
+  #
+  # Resume the clipboard monitor if it has been paused.
+  #
+  def monitor_resume
+    request = Packet.create_request('extapi_clipboard_monitor_resume')
+    return client.send_request(request)
+  end
+
+  #
+  # Purge the contents of the clipboard capture without downloading.
+  #
+  def monitor_purge
+    request = Packet.create_request('extapi_clipboard_monitor_purge')
+    return client.send_request(request)
+  end
+
+  #
+  # Stop the clipboard monitor and dump optionally it's contents.
+  #
+  def monitor_stop(opts)
+    dump = opts[:dump]
+    pull_img = opts[:include_images]
+
+    request = Packet.create_request('extapi_clipboard_monitor_stop')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_DUMP, dump)
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, pull_img)
+
+    response = client.send_request(request)
+    unless dump
+      return response
+    end
+
+    return parse_dump(response)
+  end
+
+  attr_accessor :client
+
+private
+
+  def parse_dump(response)
+    result = {}
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT) do |t|
+      ts = t.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+      result[ts] ||= {}
+
+      # fat chance of someone adding two different bits of text to the
+      # clipboard at the same time
+      result[ts]['Text'] = t.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT_CONTENT)
+    end
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILES) do |fs|
+      ts = fs.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+      result[ts] ||= {}
+      result[ts]['Files'] ||= []
+      fs.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE) do |f|
+        result[ts]['Files'] << {
+          :name => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME),
+          :size => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE)
+        }
+      end
+    end
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG) do |jpg|
+      if jpg
+        ts = jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+        result[ts] ||= {}
+
+        # same story with images, there's no way more than one can come
+        # through on the same timestamp with differences
+        result[ts]['Image'] = {
+          :width  => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMX),
+          :height => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY),
+          :data   => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA)
+        }
+      end
+    end
+
+    return result
+  end
+
+end
+
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb

@@ -0,0 +1,45 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/extapi/tlv'
+require 'rex/post/meterpreter/extensions/extapi/window/window'
+require 'rex/post/meterpreter/extensions/extapi/service/service'
+require 'rex/post/meterpreter/extensions/extapi/clipboard/clipboard'
+require 'rex/post/meterpreter/extensions/extapi/adsi/adsi'
+require 'rex/post/meterpreter/extensions/extapi/wmi/wmi'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+
+###
+#
+# This meterpreter extension contains an extended API which will allow for more
+#  advanced enumeration of the victim.
+#
+###
+class Extapi < Extension
+
+  def initialize(client)
+    super(client, 'extapi')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'extapi',
+          'ext'  => ObjectAliases.new(
+            {
+              'window'    => Rex::Post::Meterpreter::Extensions::Extapi::Window::Window.new(client),
+              'service'   => Rex::Post::Meterpreter::Extensions::Extapi::Service::Service.new(client),
+              'clipboard' => Rex::Post::Meterpreter::Extensions::Extapi::Clipboard::Clipboard.new(client),
+              'adsi'      => Rex::Post::Meterpreter::Extensions::Extapi::Adsi::Adsi.new(client),
+              'wmi'       => Rex::Post::Meterpreter::Extensions::Extapi::Wmi::Wmi.new(client)
+            })
+        },
+      ])
+  end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb

@@ -0,0 +1,104 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Service
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# querying and managing Windows services.
+#
+###
+class Service
+
+  SERVICE_OP_START   = 1
+  SERVICE_OP_PAUSE   = 2
+  SERVICE_OP_RESUME  = 3
+  SERVICE_OP_STOP    = 4
+  SERVICE_OP_RESTART = 5
+
+  def initialize(client)
+    @client = client
+  end
+
+  #
+  # Enumerate all the services on the target.
+  #
+  def enumerate
+    request = Packet.create_request('extapi_service_enum')
+    response = client.send_request(request)
+
+    services = []
+
+    response.each(TLV_TYPE_EXT_SERVICE_ENUM_GROUP) do |s|
+      services << {
+        :name         => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_NAME),
+        :display      => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_DISPLAYNAME),
+        :pid          => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_PID),
+        :status       => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_STATUS),
+        :interactive  => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_INTERACTIVE)
+      }
+    end
+
+    services.sort_by { |s| s[:name].upcase }
+  end
+
+  #
+  # Query some detailed parameters about a particular service.
+  #
+  def query(service_name)
+    request = Packet.create_request('extapi_service_query')
+    request.add_tlv(TLV_TYPE_EXT_SERVICE_ENUM_NAME, service_name)
+
+    response = client.send_request(request)
+
+    {
+      :starttype   => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_STARTTYPE),
+      :display     => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_DISPLAYNAME),
+      :startname   => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_STARTNAME),
+      :path        => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_PATH),
+      :logroup     => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_LOADORDERGROUP),
+      :interactive => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_INTERACTIVE),
+      :dacl        => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_DACL),
+      :status      => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_STATUS)
+    }
+  end
+
+  #
+  # Control a single service
+  #
+  def control(service_name, op)
+    if op.is_a? String
+      case op.strip.downcase
+      when "start"
+        op = SERVICE_OP_START
+      when "pause"
+        op = SERVICE_OP_PAUSE
+      when "resume"
+        op = SERVICE_OP_RESUME
+      when "stop"
+        op = SERVICE_OP_STOP
+      when "restart"
+        op = SERVICE_OP_RESTART
+      end
+    end
+
+    unless (op.is_a? Integer) && op >= SERVICE_OP_START && op <= SERVICE_OP_RESTART
+      raise ArgumentError, "Invalid operation: #{op}"
+    end
+
+    request = Packet.create_request('extapi_service_control')
+    request.add_tlv(TLV_TYPE_EXT_SERVICE_CTRL_NAME, service_name)
+    request.add_tlv(TLV_TYPE_EXT_SERVICE_CTRL_OP, op)
+    client.send_request(request)
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end