rex 1.0.2 → 2.0.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (528) hide show
  1. checksums.yaml +15 -0
  2. data/README.markdown +22 -0
  3. data/examples/smb_example.rb +35 -0
  4. data/lib/rex.rb +108 -3
  5. data/lib/rex/LICENSE +29 -0
  6. data/lib/rex/arch.rb +104 -0
  7. data/lib/rex/arch/sparc.rb +75 -0
  8. data/lib/rex/arch/x86.rb +524 -0
  9. data/lib/rex/assembly/nasm.rb +104 -0
  10. data/lib/rex/codepage.map +104 -0
  11. data/lib/rex/compat.rb +389 -0
  12. data/lib/rex/constants.rb +124 -0
  13. data/lib/rex/elfparsey.rb +9 -0
  14. data/lib/rex/elfparsey/elf.rb +121 -0
  15. data/lib/rex/elfparsey/elfbase.rb +256 -0
  16. data/lib/rex/elfparsey/exceptions.rb +25 -0
  17. data/lib/rex/elfscan.rb +10 -0
  18. data/lib/rex/elfscan/scanner.rb +226 -0
  19. data/lib/rex/elfscan/search.rb +44 -0
  20. data/lib/rex/encoder/alpha2.rb +31 -0
  21. data/lib/rex/encoder/alpha2/alpha_mixed.rb +68 -0
  22. data/lib/rex/encoder/alpha2/alpha_upper.rb +79 -0
  23. data/lib/rex/encoder/alpha2/generic.rb +90 -0
  24. data/lib/rex/encoder/alpha2/unicode_mixed.rb +116 -0
  25. data/lib/rex/encoder/alpha2/unicode_upper.rb +123 -0
  26. data/lib/rex/encoder/bloxor/bloxor.rb +327 -0
  27. data/lib/rex/encoder/ndr.rb +90 -0
  28. data/lib/rex/encoder/nonalpha.rb +61 -0
  29. data/lib/rex/encoder/nonupper.rb +64 -0
  30. data/lib/rex/encoder/xdr.rb +107 -0
  31. data/lib/rex/encoder/xor.rb +69 -0
  32. data/lib/rex/encoder/xor/dword.rb +13 -0
  33. data/lib/rex/encoder/xor/dword_additive.rb +13 -0
  34. data/lib/rex/encoders/xor_dword.rb +35 -0
  35. data/lib/rex/encoders/xor_dword_additive.rb +53 -0
  36. data/lib/rex/encoding/xor.rb +20 -0
  37. data/lib/rex/encoding/xor/byte.rb +15 -0
  38. data/lib/rex/encoding/xor/dword.rb +21 -0
  39. data/lib/rex/encoding/xor/dword_additive.rb +92 -0
  40. data/lib/rex/encoding/xor/exceptions.rb +17 -0
  41. data/lib/rex/encoding/xor/generic.rb +146 -0
  42. data/lib/rex/encoding/xor/qword.rb +15 -0
  43. data/lib/rex/encoding/xor/word.rb +21 -0
  44. data/lib/rex/exceptions.rb +275 -0
  45. data/lib/rex/exploitation/cmdstager.rb +10 -0
  46. data/lib/rex/exploitation/cmdstager/base.rb +190 -0
  47. data/lib/rex/exploitation/cmdstager/bourne.rb +105 -0
  48. data/lib/rex/exploitation/cmdstager/debug_asm.rb +140 -0
  49. data/lib/rex/exploitation/cmdstager/debug_write.rb +134 -0
  50. data/lib/rex/exploitation/cmdstager/echo.rb +164 -0
  51. data/lib/rex/exploitation/cmdstager/printf.rb +122 -0
  52. data/lib/rex/exploitation/cmdstager/tftp.rb +71 -0
  53. data/lib/rex/exploitation/cmdstager/vbs.rb +126 -0
  54. data/lib/rex/exploitation/egghunter.rb +425 -0
  55. data/lib/rex/exploitation/encryptjs.rb +78 -0
  56. data/lib/rex/exploitation/heaplib.js.b64 +331 -0
  57. data/lib/rex/exploitation/heaplib.rb +107 -0
  58. data/lib/rex/exploitation/js.rb +6 -0
  59. data/lib/rex/exploitation/js/detect.rb +69 -0
  60. data/lib/rex/exploitation/js/memory.rb +81 -0
  61. data/lib/rex/exploitation/js/network.rb +84 -0
  62. data/lib/rex/exploitation/js/utils.rb +33 -0
  63. data/lib/rex/exploitation/jsobfu.rb +513 -0
  64. data/lib/rex/exploitation/obfuscatejs.rb +336 -0
  65. data/lib/rex/exploitation/omelet.rb +321 -0
  66. data/lib/rex/exploitation/opcodedb.rb +819 -0
  67. data/lib/rex/exploitation/powershell.rb +62 -0
  68. data/lib/rex/exploitation/powershell/function.rb +63 -0
  69. data/lib/rex/exploitation/powershell/obfu.rb +98 -0
  70. data/lib/rex/exploitation/powershell/output.rb +151 -0
  71. data/lib/rex/exploitation/powershell/param.rb +23 -0
  72. data/lib/rex/exploitation/powershell/parser.rb +183 -0
  73. data/lib/rex/exploitation/powershell/psh_methods.rb +70 -0
  74. data/lib/rex/exploitation/powershell/script.rb +99 -0
  75. data/lib/rex/exploitation/ropdb.rb +190 -0
  76. data/lib/rex/exploitation/seh.rb +93 -0
  77. data/lib/rex/file.rb +160 -0
  78. data/lib/rex/image_source.rb +10 -0
  79. data/lib/rex/image_source/disk.rb +58 -0
  80. data/lib/rex/image_source/image_source.rb +44 -0
  81. data/lib/rex/image_source/memory.rb +35 -0
  82. data/lib/rex/io/bidirectional_pipe.rb +161 -0
  83. data/lib/rex/io/datagram_abstraction.rb +35 -0
  84. data/lib/rex/io/ring_buffer.rb +369 -0
  85. data/lib/rex/io/stream.rb +312 -0
  86. data/lib/rex/io/stream_abstraction.rb +209 -0
  87. data/lib/rex/io/stream_server.rb +221 -0
  88. data/lib/rex/job_container.rb +200 -0
  89. data/lib/rex/logging.rb +4 -0
  90. data/lib/rex/logging/log_dispatcher.rb +180 -0
  91. data/lib/rex/logging/log_sink.rb +43 -0
  92. data/lib/rex/logging/sinks/flatfile.rb +56 -0
  93. data/lib/rex/logging/sinks/stderr.rb +44 -0
  94. data/lib/rex/mac_oui.rb +16581 -0
  95. data/lib/rex/machparsey.rb +9 -0
  96. data/lib/rex/machparsey/exceptions.rb +34 -0
  97. data/lib/rex/machparsey/mach.rb +209 -0
  98. data/lib/rex/machparsey/machbase.rb +408 -0
  99. data/lib/rex/machscan.rb +9 -0
  100. data/lib/rex/machscan/scanner.rb +217 -0
  101. data/lib/rex/mime.rb +10 -0
  102. data/lib/rex/mime/encoding.rb +17 -0
  103. data/lib/rex/mime/header.rb +78 -0
  104. data/lib/rex/mime/message.rb +150 -0
  105. data/lib/rex/mime/part.rb +50 -0
  106. data/lib/rex/nop/opty2.rb +109 -0
  107. data/lib/rex/nop/opty2_tables.rb +301 -0
  108. data/lib/rex/ole.rb +202 -0
  109. data/lib/rex/ole/clsid.rb +44 -0
  110. data/lib/rex/ole/difat.rb +138 -0
  111. data/lib/rex/ole/directory.rb +228 -0
  112. data/lib/rex/ole/direntry.rb +237 -0
  113. data/lib/rex/ole/docs/dependencies.txt +8 -0
  114. data/lib/rex/ole/docs/references.txt +1 -0
  115. data/lib/rex/ole/fat.rb +96 -0
  116. data/lib/rex/ole/header.rb +201 -0
  117. data/lib/rex/ole/minifat.rb +74 -0
  118. data/lib/rex/ole/propset.rb +141 -0
  119. data/lib/rex/ole/samples/create_ole.rb +27 -0
  120. data/lib/rex/ole/samples/dir.rb +35 -0
  121. data/lib/rex/ole/samples/dump_stream.rb +34 -0
  122. data/lib/rex/ole/samples/ole_info.rb +23 -0
  123. data/lib/rex/ole/storage.rb +392 -0
  124. data/lib/rex/ole/stream.rb +50 -0
  125. data/lib/rex/ole/substorage.rb +46 -0
  126. data/lib/rex/ole/util.rb +154 -0
  127. data/lib/rex/parser/acunetix_nokogiri.rb +406 -0
  128. data/lib/rex/parser/apple_backup_manifestdb.rb +132 -0
  129. data/lib/rex/parser/appscan_nokogiri.rb +367 -0
  130. data/lib/rex/parser/arguments.rb +108 -0
  131. data/lib/rex/parser/burp_session_nokogiri.rb +291 -0
  132. data/lib/rex/parser/ci_nokogiri.rb +193 -0
  133. data/lib/rex/parser/foundstone_nokogiri.rb +342 -0
  134. data/lib/rex/parser/fusionvm_nokogiri.rb +109 -0
  135. data/lib/rex/parser/group_policy_preferences.rb +185 -0
  136. data/lib/rex/parser/ini.rb +186 -0
  137. data/lib/rex/parser/ip360_aspl_xml.rb +103 -0
  138. data/lib/rex/parser/ip360_xml.rb +98 -0
  139. data/lib/rex/parser/mbsa_nokogiri.rb +256 -0
  140. data/lib/rex/parser/nessus_xml.rb +121 -0
  141. data/lib/rex/parser/netsparker_xml.rb +109 -0
  142. data/lib/rex/parser/nexpose_raw_nokogiri.rb +686 -0
  143. data/lib/rex/parser/nexpose_simple_nokogiri.rb +330 -0
  144. data/lib/rex/parser/nexpose_xml.rb +172 -0
  145. data/lib/rex/parser/nmap_nokogiri.rb +394 -0
  146. data/lib/rex/parser/nmap_xml.rb +166 -0
  147. data/lib/rex/parser/nokogiri_doc_mixin.rb +233 -0
  148. data/lib/rex/parser/openvas_nokogiri.rb +172 -0
  149. data/lib/rex/parser/outpost24_nokogiri.rb +240 -0
  150. data/lib/rex/parser/retina_xml.rb +110 -0
  151. data/lib/rex/parser/unattend.rb +171 -0
  152. data/lib/rex/parser/wapiti_nokogiri.rb +105 -0
  153. data/lib/rex/payloads.rb +2 -0
  154. data/lib/rex/payloads/win32.rb +3 -0
  155. data/lib/rex/payloads/win32/common.rb +27 -0
  156. data/lib/rex/payloads/win32/kernel.rb +54 -0
  157. data/lib/rex/payloads/win32/kernel/common.rb +55 -0
  158. data/lib/rex/payloads/win32/kernel/migration.rb +13 -0
  159. data/lib/rex/payloads/win32/kernel/recovery.rb +51 -0
  160. data/lib/rex/payloads/win32/kernel/stager.rb +195 -0
  161. data/lib/rex/peparsey.rb +10 -0
  162. data/lib/rex/peparsey/exceptions.rb +30 -0
  163. data/lib/rex/peparsey/pe.rb +210 -0
  164. data/lib/rex/peparsey/pe_memdump.rb +61 -0
  165. data/lib/rex/peparsey/pebase.rb +1662 -0
  166. data/lib/rex/peparsey/section.rb +128 -0
  167. data/lib/rex/pescan.rb +11 -0
  168. data/lib/rex/pescan/analyze.rb +366 -0
  169. data/lib/rex/pescan/scanner.rb +230 -0
  170. data/lib/rex/pescan/search.rb +68 -0
  171. data/lib/rex/platforms.rb +2 -0
  172. data/lib/rex/platforms/windows.rb +52 -0
  173. data/lib/rex/poly.rb +134 -0
  174. data/lib/rex/poly/block.rb +480 -0
  175. data/lib/rex/poly/machine.rb +13 -0
  176. data/lib/rex/poly/machine/machine.rb +830 -0
  177. data/lib/rex/poly/machine/x86.rb +509 -0
  178. data/lib/rex/poly/register.rb +101 -0
  179. data/lib/rex/poly/register/x86.rb +41 -0
  180. data/lib/rex/post.rb +7 -0
  181. data/lib/rex/post/dir.rb +51 -0
  182. data/lib/rex/post/file.rb +172 -0
  183. data/lib/rex/post/file_stat.rb +220 -0
  184. data/lib/rex/post/gen.pl +13 -0
  185. data/lib/rex/post/io.rb +182 -0
  186. data/lib/rex/post/meterpreter.rb +5 -0
  187. data/lib/rex/post/meterpreter/channel.rb +446 -0
  188. data/lib/rex/post/meterpreter/channel_container.rb +54 -0
  189. data/lib/rex/post/meterpreter/channels/pool.rb +160 -0
  190. data/lib/rex/post/meterpreter/channels/pools/file.rb +62 -0
  191. data/lib/rex/post/meterpreter/channels/pools/stream_pool.rb +103 -0
  192. data/lib/rex/post/meterpreter/channels/stream.rb +87 -0
  193. data/lib/rex/post/meterpreter/client.rb +483 -0
  194. data/lib/rex/post/meterpreter/client_core.rb +352 -0
  195. data/lib/rex/post/meterpreter/dependencies.rb +3 -0
  196. data/lib/rex/post/meterpreter/extension.rb +32 -0
  197. data/lib/rex/post/meterpreter/extensions/android/android.rb +128 -0
  198. data/lib/rex/post/meterpreter/extensions/android/tlv.rb +40 -0
  199. data/lib/rex/post/meterpreter/extensions/espia/espia.rb +58 -0
  200. data/lib/rex/post/meterpreter/extensions/espia/tlv.rb +17 -0
  201. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +71 -0
  202. data/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb +169 -0
  203. data/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +45 -0
  204. data/lib/rex/post/meterpreter/extensions/extapi/service/service.rb +104 -0
  205. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +77 -0
  206. data/lib/rex/post/meterpreter/extensions/extapi/window/window.rb +56 -0
  207. data/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +75 -0
  208. data/lib/rex/post/meterpreter/extensions/incognito/incognito.rb +94 -0
  209. data/lib/rex/post/meterpreter/extensions/incognito/tlv.rb +22 -0
  210. data/lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb +361 -0
  211. data/lib/rex/post/meterpreter/extensions/kiwi/tlv.rb +76 -0
  212. data/lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb +78 -0
  213. data/lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb +43 -0
  214. data/lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb +49 -0
  215. data/lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb +17 -0
  216. data/lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb +128 -0
  217. data/lib/rex/post/meterpreter/extensions/mimikatz/tlv.rb +16 -0
  218. data/lib/rex/post/meterpreter/extensions/networkpug/networkpug.rb +57 -0
  219. data/lib/rex/post/meterpreter/extensions/networkpug/tlv.rb +16 -0
  220. data/lib/rex/post/meterpreter/extensions/priv/fs.rb +118 -0
  221. data/lib/rex/post/meterpreter/extensions/priv/passwd.rb +61 -0
  222. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +109 -0
  223. data/lib/rex/post/meterpreter/extensions/priv/tlv.rb +29 -0
  224. data/lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb +117 -0
  225. data/lib/rex/post/meterpreter/extensions/sniffer/tlv.rb +27 -0
  226. data/lib/rex/post/meterpreter/extensions/stdapi/constants.rb +396 -0
  227. data/lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb +284 -0
  228. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +399 -0
  229. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb +104 -0
  230. data/lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb +48 -0
  231. data/lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb +59 -0
  232. data/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb +256 -0
  233. data/lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb +129 -0
  234. data/lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb +97 -0
  235. data/lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb +106 -0
  236. data/lib/rex/post/meterpreter/extensions/stdapi/net/route.rb +67 -0
  237. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb +139 -0
  238. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb +180 -0
  239. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +168 -0
  240. data/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +209 -0
  241. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +38146 -0
  242. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb +48 -0
  243. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb +2102 -0
  244. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_crypt32.rb +32 -0
  245. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_iphlpapi.rb +97 -0
  246. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb +3852 -0
  247. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb +100 -0
  248. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb +168 -0
  249. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_psapi.rb +32 -0
  250. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_shell32.rb +32 -0
  251. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_user32.rb +3170 -0
  252. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_version.rb +41 -0
  253. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wlanapi.rb +87 -0
  254. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb +128 -0
  255. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ws2_32.rb +613 -0
  256. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +388 -0
  257. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_function.rb +111 -0
  258. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb +149 -0
  259. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb +27 -0
  260. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/mock_magic.rb +515 -0
  261. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb +319 -0
  262. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb +23 -0
  263. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb +301 -0
  264. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb +56 -0
  265. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb +106 -0
  266. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb +676 -0
  267. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb +96 -0
  268. data/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +151 -0
  269. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +128 -0
  270. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +192 -0
  271. data/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb +41 -0
  272. data/lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb +60 -0
  273. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +408 -0
  274. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb +129 -0
  275. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb +55 -0
  276. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +336 -0
  277. data/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb +141 -0
  278. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +328 -0
  279. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +193 -0
  280. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb +102 -0
  281. data/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +188 -0
  282. data/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +180 -0
  283. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +236 -0
  284. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +259 -0
  285. data/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +201 -0
  286. data/lib/rex/post/meterpreter/inbound_packet_handler.rb +30 -0
  287. data/lib/rex/post/meterpreter/object_aliases.rb +83 -0
  288. data/lib/rex/post/meterpreter/packet.rb +709 -0
  289. data/lib/rex/post/meterpreter/packet_dispatcher.rb +543 -0
  290. data/lib/rex/post/meterpreter/packet_parser.rb +94 -0
  291. data/lib/rex/post/meterpreter/packet_response_waiter.rb +83 -0
  292. data/lib/rex/post/meterpreter/ui/console.rb +142 -0
  293. data/lib/rex/post/meterpreter/ui/console/command_dispatcher.rb +86 -0
  294. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +383 -0
  295. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +939 -0
  296. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb +109 -0
  297. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb +65 -0
  298. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +198 -0
  299. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb +444 -0
  300. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb +199 -0
  301. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb +118 -0
  302. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb +108 -0
  303. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +242 -0
  304. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb +509 -0
  305. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb +60 -0
  306. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +254 -0
  307. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb +159 -0
  308. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb +182 -0
  309. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/networkpug.rb +232 -0
  310. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb +62 -0
  311. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +97 -0
  312. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb +52 -0
  313. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb +133 -0
  314. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb +204 -0
  315. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb +66 -0
  316. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +527 -0
  317. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb +448 -0
  318. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +906 -0
  319. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +318 -0
  320. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +343 -0
  321. data/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +99 -0
  322. data/lib/rex/post/permission.rb +26 -0
  323. data/lib/rex/post/process.rb +57 -0
  324. data/lib/rex/post/thread.rb +57 -0
  325. data/lib/rex/post/ui.rb +52 -0
  326. data/lib/rex/proto.rb +15 -0
  327. data/lib/rex/proto/addp.rb +218 -0
  328. data/lib/rex/proto/dcerpc.rb +7 -0
  329. data/lib/rex/proto/dcerpc/client.rb +362 -0
  330. data/lib/rex/proto/dcerpc/exceptions.rb +151 -0
  331. data/lib/rex/proto/dcerpc/handle.rb +48 -0
  332. data/lib/rex/proto/dcerpc/ndr.rb +73 -0
  333. data/lib/rex/proto/dcerpc/packet.rb +264 -0
  334. data/lib/rex/proto/dcerpc/response.rb +188 -0
  335. data/lib/rex/proto/dcerpc/uuid.rb +85 -0
  336. data/lib/rex/proto/dcerpc/wdscp.rb +3 -0
  337. data/lib/rex/proto/dcerpc/wdscp/constants.rb +89 -0
  338. data/lib/rex/proto/dcerpc/wdscp/packet.rb +94 -0
  339. data/lib/rex/proto/dhcp.rb +7 -0
  340. data/lib/rex/proto/dhcp/constants.rb +34 -0
  341. data/lib/rex/proto/dhcp/server.rb +334 -0
  342. data/lib/rex/proto/drda.rb +6 -0
  343. data/lib/rex/proto/drda/constants.rb +50 -0
  344. data/lib/rex/proto/drda/packet.rb +253 -0
  345. data/lib/rex/proto/drda/utils.rb +124 -0
  346. data/lib/rex/proto/http.rb +7 -0
  347. data/lib/rex/proto/http/client.rb +722 -0
  348. data/lib/rex/proto/http/client_request.rb +472 -0
  349. data/lib/rex/proto/http/handler.rb +47 -0
  350. data/lib/rex/proto/http/handler/erb.rb +129 -0
  351. data/lib/rex/proto/http/handler/proc.rb +61 -0
  352. data/lib/rex/proto/http/header.rb +173 -0
  353. data/lib/rex/proto/http/packet.rb +414 -0
  354. data/lib/rex/proto/http/request.rb +354 -0
  355. data/lib/rex/proto/http/response.rb +151 -0
  356. data/lib/rex/proto/http/server.rb +385 -0
  357. data/lib/rex/proto/iax2.rb +2 -0
  358. data/lib/rex/proto/iax2/call.rb +321 -0
  359. data/lib/rex/proto/iax2/client.rb +218 -0
  360. data/lib/rex/proto/iax2/codecs.rb +5 -0
  361. data/lib/rex/proto/iax2/codecs/alaw.rb +16 -0
  362. data/lib/rex/proto/iax2/codecs/g711.rb +2176 -0
  363. data/lib/rex/proto/iax2/codecs/mulaw.rb +17 -0
  364. data/lib/rex/proto/iax2/constants.rb +262 -0
  365. data/lib/rex/proto/ipmi.rb +57 -0
  366. data/lib/rex/proto/ipmi/channel_auth_reply.rb +89 -0
  367. data/lib/rex/proto/ipmi/open_session_reply.rb +36 -0
  368. data/lib/rex/proto/ipmi/rakp2.rb +36 -0
  369. data/lib/rex/proto/ipmi/utils.rb +125 -0
  370. data/lib/rex/proto/natpmp.rb +7 -0
  371. data/lib/rex/proto/natpmp/constants.rb +19 -0
  372. data/lib/rex/proto/natpmp/packet.rb +45 -0
  373. data/lib/rex/proto/ntlm.rb +8 -0
  374. data/lib/rex/proto/ntlm/base.rb +327 -0
  375. data/lib/rex/proto/ntlm/constants.rb +75 -0
  376. data/lib/rex/proto/ntlm/crypt.rb +412 -0
  377. data/lib/rex/proto/ntlm/exceptions.rb +17 -0
  378. data/lib/rex/proto/ntlm/message.rb +534 -0
  379. data/lib/rex/proto/ntlm/utils.rb +765 -0
  380. data/lib/rex/proto/ntp.rb +3 -0
  381. data/lib/rex/proto/ntp/constants.rb +12 -0
  382. data/lib/rex/proto/ntp/modes.rb +130 -0
  383. data/lib/rex/proto/pjl.rb +31 -0
  384. data/lib/rex/proto/pjl/client.rb +163 -0
  385. data/lib/rex/proto/proxy/socks4a.rb +441 -0
  386. data/lib/rex/proto/rfb.rb +13 -0
  387. data/lib/rex/proto/rfb/cipher.rb +82 -0
  388. data/lib/rex/proto/rfb/client.rb +205 -0
  389. data/lib/rex/proto/rfb/constants.rb +50 -0
  390. data/lib/rex/proto/sip.rb +4 -0
  391. data/lib/rex/proto/sip/response.rb +61 -0
  392. data/lib/rex/proto/smb.rb +8 -0
  393. data/lib/rex/proto/smb/client.rb +2064 -0
  394. data/lib/rex/proto/smb/constants.rb +1064 -0
  395. data/lib/rex/proto/smb/crypt.rb +37 -0
  396. data/lib/rex/proto/smb/evasions.rb +67 -0
  397. data/lib/rex/proto/smb/exceptions.rb +867 -0
  398. data/lib/rex/proto/smb/simpleclient.rb +173 -0
  399. data/lib/rex/proto/smb/simpleclient/open_file.rb +106 -0
  400. data/lib/rex/proto/smb/simpleclient/open_pipe.rb +57 -0
  401. data/lib/rex/proto/smb/utils.rb +104 -0
  402. data/lib/rex/proto/sunrpc.rb +2 -0
  403. data/lib/rex/proto/sunrpc/client.rb +196 -0
  404. data/lib/rex/proto/tftp.rb +13 -0
  405. data/lib/rex/proto/tftp/client.rb +344 -0
  406. data/lib/rex/proto/tftp/constants.rb +39 -0
  407. data/lib/rex/proto/tftp/server.rb +497 -0
  408. data/lib/rex/random_identifier_generator.rb +177 -0
  409. data/lib/rex/registry.rb +14 -0
  410. data/lib/rex/registry/hive.rb +132 -0
  411. data/lib/rex/registry/lfkey.rb +51 -0
  412. data/lib/rex/registry/nodekey.rb +54 -0
  413. data/lib/rex/registry/regf.rb +25 -0
  414. data/lib/rex/registry/valuekey.rb +67 -0
  415. data/lib/rex/registry/valuelist.rb +29 -0
  416. data/lib/rex/ropbuilder.rb +8 -0
  417. data/lib/rex/ropbuilder/rop.rb +271 -0
  418. data/lib/rex/script.rb +42 -0
  419. data/lib/rex/script/base.rb +61 -0
  420. data/lib/rex/script/meterpreter.rb +16 -0
  421. data/lib/rex/script/shell.rb +10 -0
  422. data/lib/rex/service.rb +49 -0
  423. data/lib/rex/service_manager.rb +154 -0
  424. data/lib/rex/services/local_relay.rb +424 -0
  425. data/lib/rex/socket.rb +788 -0
  426. data/lib/rex/socket/comm.rb +120 -0
  427. data/lib/rex/socket/comm/local.rb +526 -0
  428. data/lib/rex/socket/ip.rb +132 -0
  429. data/lib/rex/socket/parameters.rb +363 -0
  430. data/lib/rex/socket/range_walker.rb +470 -0
  431. data/lib/rex/socket/ssl_tcp.rb +345 -0
  432. data/lib/rex/socket/ssl_tcp_server.rb +188 -0
  433. data/lib/rex/socket/subnet_walker.rb +76 -0
  434. data/lib/rex/socket/switch_board.rb +289 -0
  435. data/lib/rex/socket/tcp.rb +79 -0
  436. data/lib/rex/socket/tcp_server.rb +67 -0
  437. data/lib/rex/socket/udp.rb +165 -0
  438. data/lib/rex/sslscan/result.rb +201 -0
  439. data/lib/rex/sslscan/scanner.rb +206 -0
  440. data/lib/rex/struct2.rb +5 -0
  441. data/lib/rex/struct2/c_struct.rb +181 -0
  442. data/lib/rex/struct2/c_struct_template.rb +39 -0
  443. data/lib/rex/struct2/constant.rb +26 -0
  444. data/lib/rex/struct2/element.rb +44 -0
  445. data/lib/rex/struct2/generic.rb +73 -0
  446. data/lib/rex/struct2/restraint.rb +54 -0
  447. data/lib/rex/struct2/s_string.rb +72 -0
  448. data/lib/rex/struct2/s_struct.rb +111 -0
  449. data/lib/rex/sync.rb +6 -0
  450. data/lib/rex/sync/event.rb +85 -0
  451. data/lib/rex/sync/read_write_lock.rb +177 -0
  452. data/lib/rex/sync/ref.rb +58 -0
  453. data/lib/rex/sync/thread_safe.rb +83 -0
  454. data/lib/rex/text.rb +1813 -0
  455. data/lib/rex/thread_factory.rb +43 -0
  456. data/lib/rex/time.rb +66 -0
  457. data/lib/rex/transformer.rb +116 -0
  458. data/lib/rex/ui.rb +22 -0
  459. data/lib/rex/ui/interactive.rb +304 -0
  460. data/lib/rex/ui/output.rb +85 -0
  461. data/lib/rex/ui/output/none.rb +19 -0
  462. data/lib/rex/ui/progress_tracker.rb +97 -0
  463. data/lib/rex/ui/subscriber.rb +160 -0
  464. data/lib/rex/ui/text/color.rb +98 -0
  465. data/lib/rex/ui/text/dispatcher_shell.rb +538 -0
  466. data/lib/rex/ui/text/input.rb +119 -0
  467. data/lib/rex/ui/text/input/buffer.rb +79 -0
  468. data/lib/rex/ui/text/input/readline.rb +129 -0
  469. data/lib/rex/ui/text/input/socket.rb +96 -0
  470. data/lib/rex/ui/text/input/stdio.rb +46 -0
  471. data/lib/rex/ui/text/irb_shell.rb +62 -0
  472. data/lib/rex/ui/text/output.rb +86 -0
  473. data/lib/rex/ui/text/output/buffer.rb +62 -0
  474. data/lib/rex/ui/text/output/buffer/stdout.rb +26 -0
  475. data/lib/rex/ui/text/output/file.rb +44 -0
  476. data/lib/rex/ui/text/output/socket.rb +44 -0
  477. data/lib/rex/ui/text/output/stdio.rb +53 -0
  478. data/lib/rex/ui/text/output/tee.rb +56 -0
  479. data/lib/rex/ui/text/progress_tracker.rb +57 -0
  480. data/lib/rex/ui/text/shell.rb +403 -0
  481. data/lib/rex/ui/text/table.rb +346 -0
  482. data/lib/rex/zip.rb +96 -0
  483. data/lib/rex/zip/archive.rb +130 -0
  484. data/lib/rex/zip/blocks.rb +184 -0
  485. data/lib/rex/zip/entry.rb +122 -0
  486. data/lib/rex/zip/jar.rb +283 -0
  487. data/lib/rex/zip/samples/comment.rb +32 -0
  488. data/lib/rex/zip/samples/mkwar.rb +138 -0
  489. data/lib/rex/zip/samples/mkzip.rb +19 -0
  490. data/lib/rex/zip/samples/recursive.rb +58 -0
  491. data/rex.gemspec +20 -0
  492. metadata +528 -98
  493. data/CHANGELOG.rdoc +0 -7
  494. data/DOCUMENTATION.en.rdoc +0 -215
  495. data/DOCUMENTATION.ja.rdoc +0 -205
  496. data/Manifest.txt +0 -37
  497. data/README.ja +0 -73
  498. data/README.rdoc +0 -53
  499. data/Rakefile +0 -28
  500. data/bin/rex +0 -18
  501. data/lib/rex/generator.rb +0 -523
  502. data/lib/rex/info.rb +0 -16
  503. data/lib/rex/rexcmd.rb +0 -136
  504. data/sample/a.cmd +0 -1
  505. data/sample/b.cmd +0 -1
  506. data/sample/c.cmd +0 -4
  507. data/sample/calc3.racc +0 -47
  508. data/sample/calc3.rex +0 -15
  509. data/sample/calc3.rex.rb +0 -94
  510. data/sample/calc3.tab.rb +0 -188
  511. data/sample/error1.rex +0 -15
  512. data/sample/error2.rex +0 -15
  513. data/sample/sample.html +0 -32
  514. data/sample/sample.rex +0 -15
  515. data/sample/sample.rex.rb +0 -100
  516. data/sample/sample.xhtml +0 -32
  517. data/sample/sample1.c +0 -9
  518. data/sample/sample1.rex +0 -43
  519. data/sample/sample2.bas +0 -4
  520. data/sample/sample2.rex +0 -33
  521. data/sample/simple.html +0 -7
  522. data/sample/simple.xhtml +0 -10
  523. data/sample/xhtmlparser.racc +0 -66
  524. data/sample/xhtmlparser.rex +0 -72
  525. data/test/assets/test.rex +0 -12
  526. data/test/rex-20060125.rb +0 -152
  527. data/test/rex-20060511.rb +0 -143
  528. data/test/test_generator.rb +0 -184
@@ -0,0 +1,939 @@
1
+ # -*- coding: binary -*-
2
+ require 'set'
3
+ require 'rex/post/meterpreter'
4
+ require 'rex/parser/arguments'
5
+
6
+ module Rex
7
+ module Post
8
+ module Meterpreter
9
+ module Ui
10
+
11
+ ###
12
+ #
13
+ # Core meterpreter client commands that provide only the required set of
14
+ # commands for having a functional meterpreter client<->server instance.
15
+ #
16
+ ###
17
+ class Console::CommandDispatcher::Core
18
+
19
+ include Console::CommandDispatcher
20
+
21
+ #
22
+ # Initializes an instance of the core command set using the supplied shell
23
+ # for interactivity.
24
+ #
25
+ def initialize(shell)
26
+ super
27
+
28
+ self.extensions = []
29
+ self.bgjobs = []
30
+ self.bgjob_id = 0
31
+
32
+ end
33
+
34
+ @@load_opts = Rex::Parser::Arguments.new(
35
+ "-l" => [ false, "List all available extensions" ],
36
+ "-h" => [ false, "Help menu." ])
37
+
38
+ #
39
+ # List of supported commands.
40
+ #
41
+ def commands
42
+ c = {
43
+ "?" => "Help menu",
44
+ "background" => "Backgrounds the current session",
45
+ "close" => "Closes a channel",
46
+ "channel" => "Displays information about active channels",
47
+ "exit" => "Terminate the meterpreter session",
48
+ "help" => "Help menu",
49
+ "interact" => "Interacts with a channel",
50
+ "irb" => "Drop into irb scripting mode",
51
+ "use" => "Deprecated alias for 'load'",
52
+ "load" => "Load one or more meterpreter extensions",
53
+ "quit" => "Terminate the meterpreter session",
54
+ "resource" => "Run the commands stored in a file",
55
+ "read" => "Reads data from a channel",
56
+ "run" => "Executes a meterpreter script or Post module",
57
+ "bgrun" => "Executes a meterpreter script as a background thread",
58
+ "bgkill" => "Kills a background meterpreter script",
59
+ "bglist" => "Lists running background scripts",
60
+ "write" => "Writes data to a channel",
61
+ "enable_unicode_encoding" => "Enables encoding of unicode strings",
62
+ "disable_unicode_encoding" => "Disables encoding of unicode strings"
63
+ }
64
+
65
+ if client.passive_service
66
+ c["detach"] = "Detach the meterpreter session (for http/https)"
67
+ end
68
+ # The only meterp that implements this right now is native Windows and for
69
+ # whatever reason it is not adding core_migrate to its list of commands.
70
+ # Use a dumb platform til it gets sorted.
71
+ #if client.commands.include? "core_migrate"
72
+ if client.platform =~ /win/
73
+ c["migrate"] = "Migrate the server to another process"
74
+ end
75
+
76
+ if (msf_loaded?)
77
+ c["info"] = "Displays information about a Post module"
78
+ end
79
+
80
+ c
81
+ end
82
+
83
+ #
84
+ # Core baby.
85
+ #
86
+ def name
87
+ "Core"
88
+ end
89
+
90
+ def cmd_background_help
91
+ print_line "Usage: background"
92
+ print_line
93
+ print_line "Stop interacting with this session and return to the parent prompt"
94
+ print_line
95
+ end
96
+
97
+ def cmd_background
98
+ print_status "Backgrounding session #{client.name}..."
99
+ client.interacting = false
100
+ end
101
+
102
+ #
103
+ # Displays information about active channels
104
+ #
105
+ @@channel_opts = Rex::Parser::Arguments.new(
106
+ "-c" => [ true, "Close the given channel." ],
107
+ "-k" => [ true, "Close the given channel." ],
108
+ "-i" => [ true, "Interact with the given channel." ],
109
+ "-l" => [ false, "List active channels." ],
110
+ "-r" => [ true, "Read from the given channel." ],
111
+ "-w" => [ true, "Write to the given channel." ],
112
+ "-h" => [ false, "Help menu." ])
113
+
114
+ def cmd_channel_help
115
+ print_line "Usage: channel [options]"
116
+ print_line
117
+ print_line "Displays information about active channels."
118
+ print_line @@channel_opts.usage
119
+ end
120
+
121
+ #
122
+ # Performs operations on the supplied channel.
123
+ #
124
+ def cmd_channel(*args)
125
+ if args.empty? or args.include?("-h") or args.include?("--help")
126
+ cmd_channel_help
127
+ return
128
+ end
129
+
130
+ mode = nil
131
+ chan = nil
132
+
133
+ # Parse options
134
+ @@channel_opts.parse(args) { |opt, idx, val|
135
+ case opt
136
+ when "-l"
137
+ mode = :list
138
+ when "-c", "-k"
139
+ mode = :close
140
+ chan = val
141
+ when "-i"
142
+ mode = :interact
143
+ chan = val
144
+ when "-r"
145
+ mode = :read
146
+ chan = val
147
+ when "-w"
148
+ mode = :write
149
+ chan = val
150
+ end
151
+ if @@channel_opts.arg_required?(opt)
152
+ unless chan
153
+ print_error("Channel ID required")
154
+ return
155
+ end
156
+ end
157
+ }
158
+
159
+ case mode
160
+ when :list
161
+ tbl = Rex::Ui::Text::Table.new(
162
+ 'Indent' => 4,
163
+ 'Columns' =>
164
+ [
165
+ 'Id',
166
+ 'Class',
167
+ 'Type'
168
+ ])
169
+ items = 0
170
+
171
+ client.channels.each_pair { |cid, channel|
172
+ tbl << [ cid, channel.class.cls, channel.type ]
173
+ items += 1
174
+ }
175
+
176
+ if (items == 0)
177
+ print_line("No active channels.")
178
+ else
179
+ print("\n" + tbl.to_s + "\n")
180
+ end
181
+ when :close
182
+ cmd_close(chan)
183
+ when :interact
184
+ cmd_interact(chan)
185
+ when :read
186
+ cmd_read(chan)
187
+ when :write
188
+ cmd_write(chan)
189
+ else
190
+ # No mode, no service.
191
+ return true
192
+ end
193
+ end
194
+
195
+ def cmd_channel_tabs(str, words)
196
+ case words.length
197
+ when 1
198
+ @@channel_opts.fmt.keys
199
+ when 2
200
+ case words[1]
201
+ when "-k", "-c", "-i", "-r", "-w"
202
+ tab_complete_channels
203
+ else
204
+ []
205
+ end
206
+ else
207
+ []
208
+ end
209
+ end
210
+
211
+ def cmd_close_help
212
+ print_line "Usage: close <channel_id>"
213
+ print_line
214
+ print_line "Closes the supplied channel."
215
+ print_line
216
+ end
217
+
218
+ #
219
+ # Closes a supplied channel.
220
+ #
221
+ def cmd_close(*args)
222
+ if (args.length == 0)
223
+ cmd_close_help
224
+ return true
225
+ end
226
+
227
+ cid = args[0].to_i
228
+ channel = client.find_channel(cid)
229
+
230
+ if (!channel)
231
+ print_error("Invalid channel identifier specified.")
232
+ return true
233
+ else
234
+ channel._close # Issue #410
235
+
236
+ print_status("Closed channel #{cid}.")
237
+ end
238
+ end
239
+
240
+ def cmd_close_tabs(str, words)
241
+ return [] if words.length > 1
242
+
243
+ return tab_complete_channels
244
+ end
245
+
246
+ #
247
+ # Terminates the meterpreter session.
248
+ #
249
+ def cmd_exit(*args)
250
+ print_status("Shutting down Meterpreter...")
251
+ client.core.shutdown rescue nil
252
+ client.shutdown_passive_dispatcher
253
+ shell.stop
254
+ end
255
+
256
+ alias cmd_quit cmd_exit
257
+
258
+ def cmd_detach_help
259
+ print_line "Detach from the victim. Only possible for non-stream sessions (http/https)"
260
+ print_line
261
+ print_line "The victim will continue to attempt to call back to the handler until it"
262
+ print_line "successfully connects (which may happen immediately if you have a handler"
263
+ print_line "running in the background), or reaches its expiration."
264
+ print_line
265
+ print_line "This session may #{client.passive_service ? "" : "NOT"} be detached."
266
+ print_line
267
+ end
268
+
269
+ #
270
+ # Disconnects the session
271
+ #
272
+ def cmd_detach(*args)
273
+ if not client.passive_service
274
+ print_error("Detach is only possible for non-stream sessions (http/https)")
275
+ return
276
+ end
277
+ client.shutdown_passive_dispatcher
278
+ shell.stop
279
+ end
280
+
281
+ def cmd_interact_help
282
+ print_line "Usage: interact <channel_id>"
283
+ print_line
284
+ print_line "Interacts with the supplied channel."
285
+ print_line
286
+ end
287
+
288
+ #
289
+ # Interacts with a channel.
290
+ #
291
+ def cmd_interact(*args)
292
+ if (args.length == 0)
293
+ cmd_info_help
294
+ return true
295
+ end
296
+
297
+ cid = args[0].to_i
298
+ channel = client.find_channel(cid)
299
+
300
+ if (channel)
301
+ print_line("Interacting with channel #{cid}...\n")
302
+
303
+ shell.interact_with_channel(channel)
304
+ else
305
+ print_error("Invalid channel identifier specified.")
306
+ end
307
+ end
308
+
309
+ alias cmd_interact_tabs cmd_close_tabs
310
+
311
+ #
312
+ # Runs the IRB scripting shell
313
+ #
314
+ def cmd_irb(*args)
315
+ print_status("Starting IRB shell")
316
+ print_status("The 'client' variable holds the meterpreter client\n")
317
+
318
+ session = client
319
+ framework = client.framework
320
+ Rex::Ui::Text::IrbShell.new(binding).run
321
+ end
322
+
323
+ def cmd_migrate_help
324
+ print_line "Usage: migrate <pid>"
325
+ print_line
326
+ print_line "Migrates the server instance to another process."
327
+ print_line "NOTE: Any open channels or other dynamic state will be lost."
328
+ print_line
329
+ end
330
+
331
+ #
332
+ # Migrates the server to the supplied process identifier.
333
+ #
334
+ # @param args [Array<String>] Commandline arguments, only -h or a pid
335
+ # @return [void]
336
+ def cmd_migrate(*args)
337
+ if ( args.length == 0 or args.include?("-h") )
338
+ cmd_migrate_help
339
+ return true
340
+ end
341
+
342
+ pid = args[0].to_i
343
+ if(pid == 0)
344
+ print_error("A process ID must be specified, not a process name")
345
+ return
346
+ end
347
+
348
+ begin
349
+ server = client.sys.process.open
350
+ rescue TimeoutError => e
351
+ elog(e.to_s)
352
+ rescue RequestError => e
353
+ elog(e.to_s)
354
+ end
355
+
356
+ service = client.pfservice
357
+
358
+ # If we have any open port forwards, we need to close them down
359
+ # otherwise we'll end up with local listeners which aren't connected
360
+ # to valid channels in the migrated meterpreter instance.
361
+ existing_relays = []
362
+
363
+ if service
364
+ service.each_tcp_relay do |lhost, lport, rhost, rport, opts|
365
+ next unless opts['MeterpreterRelay']
366
+ if existing_relays.empty?
367
+ print_status("Removing existing TCP relays...")
368
+ end
369
+ if (service.stop_tcp_relay(lport, lhost))
370
+ print_status("Successfully stopped TCP relay on #{lhost || '0.0.0.0'}:#{lport}")
371
+ existing_relays << {
372
+ :lport => lport,
373
+ :opts => opts
374
+ }
375
+ else
376
+ print_error("Failed to stop TCP relay on #{lhost || '0.0.0.0'}:#{lport}")
377
+ next
378
+ end
379
+ end
380
+ unless existing_relays.empty?
381
+ print_status("#{existing_relays.length} TCP relay(s) removed.")
382
+ end
383
+ end
384
+
385
+ server ? print_status("Migrating from #{server.pid} to #{pid}...") : print_status("Migrating to #{pid}")
386
+
387
+ # Do this thang.
388
+ client.core.migrate(pid)
389
+
390
+ print_status("Migration completed successfully.")
391
+
392
+ unless existing_relays.empty?
393
+ print_status("Recreating TCP relay(s)...")
394
+ existing_relays.each do |r|
395
+ client.pfservice.start_tcp_relay(r[:lport], r[:opts])
396
+ print_status("Local TCP relay recreated: #{r[:opts]['LocalHost'] || '0.0.0.0'}:#{r[:lport]} <-> #{r[:opts]['PeerHost']}:#{r[:opts]['PeerPort']}")
397
+ end
398
+ end
399
+
400
+ end
401
+
402
+ def cmd_load_help
403
+ print_line("Usage: load ext1 ext2 ext3 ...")
404
+ print_line
405
+ print_line "Loads a meterpreter extension module or modules."
406
+ print_line @@load_opts.usage
407
+ end
408
+
409
+ #
410
+ # Loads one or more meterpreter extensions.
411
+ #
412
+ def cmd_load(*args)
413
+ if (args.length == 0)
414
+ args.unshift("-h")
415
+ end
416
+
417
+ @@load_opts.parse(args) { |opt, idx, val|
418
+ case opt
419
+ when "-l"
420
+ exts = SortedSet.new
421
+ msf_path = MeterpreterBinaries.metasploit_data_dir
422
+ gem_path = MeterpreterBinaries.local_dir
423
+ [msf_path, gem_path].each do |path|
424
+ ::Dir.entries(path).each { |f|
425
+ if (::File.file?(::File.join(path, f)) && f =~ /ext_server_(.*)\.#{client.binary_suffix}/ )
426
+ exts.add($1)
427
+ end
428
+ }
429
+ end
430
+ print(exts.to_a.join("\n") + "\n")
431
+
432
+ return true
433
+ when "-h"
434
+ cmd_load_help
435
+ return true
436
+ end
437
+ }
438
+
439
+ # Load each of the modules
440
+ args.each { |m|
441
+ md = m.downcase
442
+
443
+ if (extensions.include?(md))
444
+ print_error("The '#{md}' extension has already been loaded.")
445
+ next
446
+ end
447
+
448
+ print("Loading extension #{md}...")
449
+
450
+ begin
451
+ # Use the remote side, then load the client-side
452
+ if (client.core.use(md) == true)
453
+ add_extension_client(md)
454
+ end
455
+ rescue
456
+ print_line
457
+ log_error("Failed to load extension: #{$!}")
458
+ next
459
+ end
460
+
461
+ print_line("success.")
462
+ }
463
+
464
+ return true
465
+ end
466
+
467
+ def cmd_load_tabs(str, words)
468
+ tabs = SortedSet.new
469
+ msf_path = MeterpreterBinaries.metasploit_data_dir
470
+ gem_path = MeterpreterBinaries.local_dir
471
+ [msf_path, gem_path].each do |path|
472
+ ::Dir.entries(path).each { |f|
473
+ if (::File.file?(::File.join(path, f)) && f =~ /ext_server_(.*)\.#{client.binary_suffix}/ )
474
+ if (not extensions.include?($1))
475
+ tabs.add($1)
476
+ end
477
+ end
478
+ }
479
+ end
480
+ return tabs.to_a
481
+ end
482
+
483
+ def cmd_use(*args)
484
+ #print_error("Warning: The 'use' command is deprecated in favor of 'load'")
485
+ cmd_load(*args)
486
+ end
487
+ alias cmd_use_help cmd_load_help
488
+ alias cmd_use_tabs cmd_load_tabs
489
+
490
+ def cmd_read_help
491
+ print_line "Usage: read <channel_id> [length]"
492
+ print_line
493
+ print_line "Reads data from the supplied channel."
494
+ print_line
495
+ end
496
+
497
+ #
498
+ # Reads data from a channel.
499
+ #
500
+ def cmd_read(*args)
501
+ if (args.length == 0)
502
+ cmd_read_help
503
+ return true
504
+ end
505
+
506
+ cid = args[0].to_i
507
+ length = (args.length >= 2) ? args[1].to_i : 16384
508
+ channel = client.find_channel(cid)
509
+
510
+ if (!channel)
511
+ print_error("Channel #{cid} is not valid.")
512
+ return true
513
+ end
514
+
515
+ data = channel.read(length)
516
+
517
+ if (data and data.length)
518
+ print("Read #{data.length} bytes from #{cid}:\n\n#{data}\n")
519
+ else
520
+ print_error("No data was returned.")
521
+ end
522
+
523
+ return true
524
+ end
525
+
526
+ alias cmd_read_tabs cmd_close_tabs
527
+
528
+ def cmd_run_help
529
+ print_line "Usage: run <script> [arguments]"
530
+ print_line
531
+ print_line "Executes a ruby script or Metasploit Post module in the context of the"
532
+ print_line "meterpreter session. Post modules can take arguments in var=val format."
533
+ print_line "Example: run post/foo/bar BAZ=abcd"
534
+ print_line
535
+ end
536
+
537
+ #
538
+ # Executes a script in the context of the meterpreter session.
539
+ #
540
+ def cmd_run(*args)
541
+ if args.length == 0
542
+ cmd_run_help
543
+ return true
544
+ end
545
+
546
+ # Get the script name
547
+ begin
548
+ script_name = args.shift
549
+ # First try it as a Post module if we have access to the Metasploit
550
+ # Framework instance. If we don't, or if no such module exists,
551
+ # fall back to using the scripting interface.
552
+ if (msf_loaded? and mod = client.framework.modules.create(script_name))
553
+ original_mod = mod
554
+ reloaded_mod = client.framework.modules.reload_module(original_mod)
555
+
556
+ unless reloaded_mod
557
+ error = client.framework.modules.module_load_error_by_path[original_mod.file_path]
558
+ print_error("Failed to reload module: #{error}")
559
+
560
+ return
561
+ end
562
+
563
+ opts = (args + [ "SESSION=#{client.sid}" ]).join(',')
564
+ reloaded_mod.run_simple(
565
+ #'RunAsJob' => true,
566
+ 'LocalInput' => shell.input,
567
+ 'LocalOutput' => shell.output,
568
+ 'OptionStr' => opts
569
+ )
570
+ else
571
+ # the rest of the arguments get passed in through the binding
572
+ client.execute_script(script_name, args)
573
+ end
574
+ rescue
575
+ print_error("Error in script: #{$!.class} #{$!}")
576
+ elog("Error in script: #{$!.class} #{$!}")
577
+ dlog("Callstack: #{$@.join("\n")}")
578
+ end
579
+ end
580
+
581
+ def cmd_run_tabs(str, words)
582
+ tabs = []
583
+ if(not words[1] or not words[1].match(/^\//))
584
+ begin
585
+ if (msf_loaded?)
586
+ tabs += tab_complete_postmods
587
+ end
588
+ [
589
+ ::Msf::Sessions::Meterpreter.script_base,
590
+ ::Msf::Sessions::Meterpreter.user_script_base
591
+ ].each do |dir|
592
+ next if not ::File.exist? dir
593
+ tabs += ::Dir.new(dir).find_all { |e|
594
+ path = dir + ::File::SEPARATOR + e
595
+ ::File.file?(path) and ::File.readable?(path)
596
+ }
597
+ end
598
+ rescue Exception
599
+ end
600
+ end
601
+ return tabs.map { |e| e.sub(/\.rb$/, '') }
602
+ end
603
+
604
+
605
+ #
606
+ # Executes a script in the context of the meterpreter session in the background
607
+ #
608
+ def cmd_bgrun(*args)
609
+ if args.length == 0
610
+ print_line(
611
+ "Usage: bgrun <script> [arguments]\n\n" +
612
+ "Executes a ruby script in the context of the meterpreter session.")
613
+ return true
614
+ end
615
+
616
+ jid = self.bgjob_id
617
+ self.bgjob_id += 1
618
+
619
+ # Get the script name
620
+ self.bgjobs[jid] = Rex::ThreadFactory.spawn("MeterpreterBGRun(#{args[0]})-#{jid}", false, jid, args) do |myjid,xargs|
621
+ ::Thread.current[:args] = xargs.dup
622
+ begin
623
+ # the rest of the arguments get passed in through the binding
624
+ client.execute_script(args.shift, args)
625
+ rescue ::Exception
626
+ print_error("Error in script: #{$!.class} #{$!}")
627
+ elog("Error in script: #{$!.class} #{$!}")
628
+ dlog("Callstack: #{$@.join("\n")}")
629
+ end
630
+ self.bgjobs[myjid] = nil
631
+ print_status("Background script with Job ID #{myjid} has completed (#{::Thread.current[:args].inspect})")
632
+ end
633
+
634
+ print_status("Executed Meterpreter with Job ID #{jid}")
635
+ end
636
+
637
+ #
638
+ # Map this to the normal run command tab completion
639
+ #
640
+ def cmd_bgrun_tabs(*args)
641
+ cmd_run_tabs(*args)
642
+ end
643
+
644
+ #
645
+ # Kill a background job
646
+ #
647
+ def cmd_bgkill(*args)
648
+ if args.length == 0
649
+ print_line("Usage: bgkill [id]")
650
+ return
651
+ end
652
+
653
+ args.each do |jid|
654
+ jid = jid.to_i
655
+ if self.bgjobs[jid]
656
+ print_status("Killing background job #{jid}...")
657
+ self.bgjobs[jid].kill
658
+ self.bgjobs[jid] = nil
659
+ else
660
+ print_error("Job #{jid} was not running")
661
+ end
662
+ end
663
+ end
664
+
665
+ #
666
+ # List background jobs
667
+ #
668
+ def cmd_bglist(*args)
669
+ self.bgjobs.each_index do |jid|
670
+ if self.bgjobs[jid]
671
+ print_status("Job #{jid}: #{self.bgjobs[jid][:args].inspect}")
672
+ end
673
+ end
674
+ end
675
+
676
+ def cmd_info_help
677
+ print_line 'Usage: info <module>'
678
+ print_line
679
+ print_line 'Prints information about a post-exploitation module'
680
+ print_line
681
+ end
682
+
683
+ #
684
+ # Show info for a given Post module.
685
+ #
686
+ # See also +cmd_info+ in lib/msf/ui/console/command_dispatcher/core.rb
687
+ #
688
+ def cmd_info(*args)
689
+ return unless msf_loaded?
690
+
691
+ if args.length != 1 or args.include?("-h")
692
+ cmd_info_help
693
+ return
694
+ end
695
+
696
+ module_name = args.shift
697
+ mod = client.framework.modules.create(module_name);
698
+
699
+ if mod.nil?
700
+ print_error 'Invalid module: ' << module_name
701
+ end
702
+
703
+ if (mod)
704
+ print_line(::Msf::Serializer::ReadableText.dump_module(mod))
705
+ mod_opt = ::Msf::Serializer::ReadableText.dump_options(mod, ' ')
706
+ print_line("\nModule options (#{mod.fullname}):\n\n#{mod_opt}") if (mod_opt and mod_opt.length > 0)
707
+ end
708
+ end
709
+
710
+ def cmd_info_tabs(*args)
711
+ return unless msf_loaded?
712
+ tab_complete_postmods
713
+ end
714
+
715
+ #
716
+ # Writes data to a channel.
717
+ #
718
+ @@write_opts = Rex::Parser::Arguments.new(
719
+ "-f" => [ true, "Write the contents of a file on disk" ],
720
+ "-h" => [ false, "Help menu." ])
721
+
722
+ def cmd_write_help
723
+ print_line "Usage: write [options] channel_id"
724
+ print_line
725
+ print_line "Writes data to the supplied channel."
726
+ print_line @@write_opts.usage
727
+ end
728
+
729
+ def cmd_write(*args)
730
+ if (args.length == 0 or args.include?("-h"))
731
+ cmd_write_help
732
+ return
733
+ end
734
+
735
+ src_file = nil
736
+ cid = nil
737
+
738
+ @@write_opts.parse(args) { |opt, idx, val|
739
+ case opt
740
+ when "-f"
741
+ src_file = val
742
+ else
743
+ cid = val.to_i
744
+ end
745
+ }
746
+
747
+ # Find the channel associated with this cid, assuming the cid is valid.
748
+ if ((!cid) or (!(channel = client.find_channel(cid))))
749
+ print_error("Invalid channel identifier specified.")
750
+ return true
751
+ end
752
+
753
+ # If they supplied a source file, read in its contents and write it to
754
+ # the channel
755
+ if (src_file)
756
+ begin
757
+ data = ''
758
+
759
+ ::File.open(src_file, 'rb') { |f|
760
+ data = f.read(f.stat.size)
761
+ }
762
+
763
+ rescue Errno::ENOENT
764
+ print_error("Invalid source file specified: #{src_file}")
765
+ return true
766
+ end
767
+
768
+ if (data and data.length > 0)
769
+ channel.write(data)
770
+ print_status("Wrote #{data.length} bytes to channel #{cid}.")
771
+ else
772
+ print_error("No data to send from file #{src_file}")
773
+ return true
774
+ end
775
+ # Otherwise, read from the input descriptor until we're good to go.
776
+ else
777
+ print("Enter data followed by a '.' on an empty line:\n\n")
778
+
779
+ data = ''
780
+
781
+ # Keep truckin'
782
+ while (s = shell.input.gets)
783
+ break if (s =~ /^\.\r?\n?$/)
784
+ data += s
785
+ end
786
+
787
+ if (!data or data.length == 0)
788
+ print_error("No data to send.")
789
+ else
790
+ channel.write(data)
791
+ print_status("Wrote #{data.length} bytes to channel #{cid}.")
792
+ end
793
+ end
794
+
795
+ return true
796
+ end
797
+
798
+ def cmd_resource_help
799
+ print_line "Usage: resource <path1> [path2 ...]"
800
+ print_line
801
+ print_line "Run the commands stored in the supplied files."
802
+ print_line
803
+ end
804
+
805
+ def cmd_resource(*args)
806
+ if args.empty?
807
+ return false
808
+ end
809
+ args.each do |glob|
810
+ files = ::Dir.glob(::File.expand_path(glob))
811
+ if files.empty?
812
+ print_error("No such file #{glob}")
813
+ next
814
+ end
815
+ files.each do |filename|
816
+ print_status("Reading #{filename}")
817
+ if (not ::File.readable?(filename))
818
+ print_error("Could not read file #{filename}")
819
+ next
820
+ else
821
+ ::File.open(filename, "r").each_line do |line|
822
+ next if line.strip.length < 1
823
+ next if line[0,1] == "#"
824
+ begin
825
+ print_status("Running #{line}")
826
+ client.console.run_single(line)
827
+ rescue ::Exception => e
828
+ print_error("Error Running Command #{line}: #{e.class} #{e}")
829
+ end
830
+
831
+ end
832
+ end
833
+ end
834
+ end
835
+ end
836
+
837
+ def cmd_resource_tabs(str, words)
838
+ return [] if words.length > 1
839
+
840
+ tab_complete_filenames(str, words)
841
+ end
842
+
843
+ def cmd_enable_unicode_encoding
844
+ client.encode_unicode = true
845
+ print_status("Unicode encoding is enabled")
846
+ end
847
+
848
+ def cmd_disable_unicode_encoding
849
+ client.encode_unicode = false
850
+ print_status("Unicode encoding is disabled")
851
+ end
852
+
853
+ @@client_extension_search_paths = [ ::File.join(Rex::Root, "post", "meterpreter", "ui", "console", "command_dispatcher") ]
854
+
855
+ def self.add_client_extension_search_path(path)
856
+ @@client_extension_search_paths << path unless @@client_extension_search_paths.include?(path)
857
+ end
858
+ def self.client_extension_search_paths
859
+ @@client_extension_search_paths
860
+ end
861
+
862
+ protected
863
+
864
+ attr_accessor :extensions # :nodoc:
865
+ attr_accessor :bgjobs, :bgjob_id # :nodoc:
866
+
867
+ CommDispatcher = Console::CommandDispatcher
868
+
869
+ #
870
+ # Loads the client extension specified in mod
871
+ #
872
+ def add_extension_client(mod)
873
+ loaded = false
874
+ klass = nil
875
+ self.class.client_extension_search_paths.each do |path|
876
+ path = ::File.join(path, "#{mod}.rb")
877
+ klass = CommDispatcher.check_hash(path)
878
+ if (klass == nil)
879
+ old = CommDispatcher.constants
880
+ next unless ::File.exist? path
881
+
882
+ if (require(path))
883
+ new = CommDispatcher.constants
884
+ diff = new - old
885
+
886
+ next if (diff.empty?)
887
+
888
+ klass = CommDispatcher.const_get(diff[0])
889
+
890
+ CommDispatcher.set_hash(path, klass)
891
+ loaded = true
892
+ break
893
+ else
894
+ print_error("Failed to load client script file: #{path}")
895
+ return false
896
+ end
897
+ else
898
+ # the klass is already loaded, from a previous invocation
899
+ loaded = true
900
+ break
901
+ end
902
+ end
903
+ unless loaded
904
+ print_error("Failed to load client portion of #{mod}.")
905
+ return false
906
+ end
907
+
908
+ # Enstack the dispatcher
909
+ self.shell.enstack_dispatcher(klass)
910
+
911
+ # Insert the module into the list of extensions
912
+ self.extensions << mod
913
+ end
914
+
915
+ def tab_complete_postmods
916
+ tabs = client.framework.modules.post.map { |name,klass|
917
+ mod = client.framework.modules.post.create(name)
918
+ if mod and mod.session_compatible?(client)
919
+ mod.fullname.dup
920
+ else
921
+ nil
922
+ end
923
+ }
924
+
925
+ # nils confuse readline
926
+ tabs.compact
927
+ end
928
+
929
+ def tab_complete_channels
930
+ client.channels.keys.map { |k| k.to_s }
931
+ end
932
+
933
+ end
934
+
935
+ end
936
+ end
937
+ end
938
+ end
939
+