rex 2.0.4 → 2.0.5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (67) hide show
  1. checksums.yaml +4 -4
  2. data/lib/rex/arch/x86.rb +16 -0
  3. data/lib/rex/constants.rb +1 -0
  4. data/lib/rex/constants/windows.rb +147 -0
  5. data/lib/rex/encoder/xdr.rb +3 -2
  6. data/lib/rex/exceptions.rb +37 -5
  7. data/lib/rex/exploitation/cmdstager/bourne.rb +9 -1
  8. data/lib/rex/exploitation/cmdstager/tftp.rb +5 -5
  9. data/lib/rex/java.rb +3 -0
  10. data/lib/rex/java/serialization.rb +54 -0
  11. data/lib/rex/java/serialization/model.rb +20 -0
  12. data/lib/rex/java/serialization/model/annotation.rb +69 -0
  13. data/lib/rex/java/serialization/model/block_data.rb +70 -0
  14. data/lib/rex/java/serialization/model/block_data_long.rb +72 -0
  15. data/lib/rex/java/serialization/model/class_desc.rb +64 -0
  16. data/lib/rex/java/serialization/model/contents.rb +156 -0
  17. data/lib/rex/java/serialization/model/element.rb +44 -0
  18. data/lib/rex/java/serialization/model/end_block_data.rb +12 -0
  19. data/lib/rex/java/serialization/model/field.rb +172 -0
  20. data/lib/rex/java/serialization/model/long_utf.rb +48 -0
  21. data/lib/rex/java/serialization/model/new_array.rb +225 -0
  22. data/lib/rex/java/serialization/model/new_class_desc.rb +155 -0
  23. data/lib/rex/java/serialization/model/new_enum.rb +79 -0
  24. data/lib/rex/java/serialization/model/new_object.rb +223 -0
  25. data/lib/rex/java/serialization/model/null_reference.rb +12 -0
  26. data/lib/rex/java/serialization/model/reference.rb +61 -0
  27. data/lib/rex/java/serialization/model/reset.rb +12 -0
  28. data/lib/rex/java/serialization/model/stream.rb +123 -0
  29. data/lib/rex/java/serialization/model/utf.rb +69 -0
  30. data/lib/rex/mime/message.rb +9 -14
  31. data/lib/rex/payloads.rb +1 -0
  32. data/lib/rex/payloads/meterpreter.rb +2 -0
  33. data/lib/rex/payloads/meterpreter/patch.rb +136 -0
  34. data/lib/rex/payloads/win32/kernel/stager.rb +26 -25
  35. data/lib/rex/post/meterpreter/client.rb +50 -60
  36. data/lib/rex/post/meterpreter/client_core.rb +18 -25
  37. data/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb +102 -8
  38. data/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +24 -14
  39. data/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +18 -0
  40. data/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +1 -0
  41. data/lib/rex/post/meterpreter/packet_dispatcher.rb +1 -1
  42. data/lib/rex/post/meterpreter/ui/console.rb +1 -1
  43. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +43 -1
  44. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb +1 -1
  45. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +9 -0
  46. data/lib/rex/proto/dcerpc/svcctl.rb +2 -0
  47. data/lib/rex/proto/dcerpc/svcctl/packet.rb +304 -0
  48. data/lib/rex/proto/kademlia.rb +8 -0
  49. data/lib/rex/proto/kademlia/bootstrap_request.rb +19 -0
  50. data/lib/rex/proto/kademlia/bootstrap_response.rb +79 -0
  51. data/lib/rex/proto/kademlia/message.rb +72 -0
  52. data/lib/rex/proto/kademlia/ping.rb +19 -0
  53. data/lib/rex/proto/kademlia/pong.rb +41 -0
  54. data/lib/rex/proto/kademlia/util.rb +22 -0
  55. data/lib/rex/proto/natpmp/packet.rb +30 -2
  56. data/lib/rex/proto/quake.rb +3 -0
  57. data/lib/rex/proto/quake/message.rb +73 -0
  58. data/lib/rex/proto/smb/client.rb +1 -0
  59. data/lib/rex/proto/smb/simpleclient.rb +4 -0
  60. data/lib/rex/proto/sunrpc/client.rb +14 -3
  61. data/lib/rex/socket/comm/local.rb +10 -7
  62. data/lib/rex/socket/ssl_tcp_server.rb +79 -40
  63. data/lib/rex/ui/text/input/readline.rb +33 -6
  64. data/lib/rex/ui/text/output/file.rb +2 -2
  65. data/lib/rex/ui/text/output/stdio.rb +70 -14
  66. data/rex.gemspec +1 -1
  67. metadata +38 -3
@@ -0,0 +1,48 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Java
5
+ module Serialization
6
+ module Model
7
+ # This class provides a Long Utf string representation
8
+ class LongUtf < Utf
9
+
10
+ # Deserializes a Rex::Java::Serialization::Model::LongUtf
11
+ #
12
+ # @param io [IO] the io to read from
13
+ # @return [self] if deserialization succeeds
14
+ # @return [nil] if deserialization doesn't succeed
15
+ def decode(io)
16
+ raw_length = io.read(8)
17
+ if raw_length.nil? || raw_length.length != 8
18
+ raise ::RuntimeError, 'Failed to unserialize LongUtf'
19
+ end
20
+ self.length = raw_length.unpack('Q>')[0]
21
+
22
+ if length == 0
23
+ self.contents = ''
24
+ else
25
+ self.contents = io.read(length)
26
+ if contents.nil? || contents.length != length
27
+ raise ::RuntimeError, 'Failed to unserialize LongUtf'
28
+ end
29
+ end
30
+
31
+ self
32
+ end
33
+
34
+ # Serializes the Rex::Java::Serialization::Model::LongUtf
35
+ #
36
+ # @return [String]
37
+ def encode
38
+ encoded = [length].pack('Q>')
39
+ encoded << contents
40
+
41
+ encoded
42
+ end
43
+
44
+ end
45
+ end
46
+ end
47
+ end
48
+ end
@@ -0,0 +1,225 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Java
5
+ module Serialization
6
+ module Model
7
+ # This class provides a NewArray (Java Array) representation
8
+ class NewArray < Element
9
+
10
+ include Rex::Java::Serialization::Model::Contents
11
+
12
+ # @!attribute array_description
13
+ # @return [Java::Serialization::Model::ClassDesc] The description of the array
14
+ attr_accessor :array_description
15
+ # @!attribute type
16
+ # @return [String] The type of the array values
17
+ attr_accessor :type
18
+ # @!attribute values
19
+ # @return [Array] The contents of the java array
20
+ attr_accessor :values
21
+
22
+ # @param stream [Rex::Java::Serialization::Model::Stream] the stream where it belongs to
23
+ def initialize(stream = nil)
24
+ super(stream)
25
+ self.array_description = nil
26
+ self.type = ''
27
+ self.values = []
28
+ end
29
+
30
+ # Deserializes a Rex::Java::Serialization::Model::NewArray
31
+ #
32
+ # @param io [IO] the io to read from
33
+ # @return [self] if deserialization succeeds
34
+ # @raise [RuntimeError] if deserialization doesn't succeed
35
+ def decode(io)
36
+ self.array_description = ClassDesc.decode(io, stream)
37
+ stream.add_reference(self) unless stream.nil?
38
+ self.type = array_type
39
+
40
+ values_length = decode_values_length(io)
41
+
42
+ values_length.times do
43
+ value = decode_value(io)
44
+ self.values << value
45
+ end
46
+
47
+ self
48
+ end
49
+
50
+ # Serializes the Rex::Java::Serialization::Model::NewArray
51
+ #
52
+ # @return [String] if serialization succeeds
53
+ # @raise [RuntimeError] if serialization doesn't succeed
54
+ def encode
55
+ unless array_description.class == ClassDesc
56
+ raise ::RuntimeError, 'Failed to serialize NewArray'
57
+ end
58
+
59
+ encoded = ''
60
+ encoded << array_description.encode
61
+
62
+ encoded << [values.length].pack('N')
63
+
64
+ values.each do |value|
65
+ encoded << encode_value(value)
66
+ end
67
+
68
+ encoded
69
+ end
70
+
71
+ # Creates a print-friendly string representation
72
+ #
73
+ # @return [String]
74
+ def to_s
75
+ str = "#{type}, "
76
+ values_data = values.collect {|v| "#{v}"}
77
+ str << "#{values_data}"
78
+ end
79
+
80
+ private
81
+
82
+ # Deserializes the NewArray length
83
+ #
84
+ # @param io [IO] the io to read from
85
+ # @return [Integer] if deserialization succeeds
86
+ # @raise [RuntimeError] if deserialization doesn't succeed
87
+ def decode_values_length(io)
88
+ values_length = io.read(4)
89
+ if values_length.nil? || values_length.length != 4
90
+ raise ::RuntimeError, 'Failed to unserialize NewArray'
91
+ end
92
+
93
+ values_length.unpack('N')[0]
94
+ end
95
+
96
+ # Extracts the NewArray data type
97
+ #
98
+ # @return [String]
99
+ # @raise [RuntimeError] if the NewArray description isn't valid
100
+ # @raise [RuntimeError] if the NewArray type isn't supported
101
+ def array_type
102
+ if array_description.nil?
103
+ raise ::RuntimeError, 'Empty NewArray description'
104
+ end
105
+
106
+ unless array_description.class == ClassDesc
107
+ raise ::RuntimeError, 'Unsupported NewArray description class'
108
+ end
109
+
110
+ desc = array_description.description
111
+
112
+ unless desc.class_name.contents[0] == '[' # Array
113
+ raise ::RuntimeError, 'Unsupported NewArray description'
114
+ end
115
+
116
+ decoded_type = desc.class_name.contents[1]
117
+ if PRIMITIVE_TYPE_CODES.keys.include?(decoded_type)
118
+ return PRIMITIVE_TYPE_CODES[decoded_type]
119
+ elsif decoded_type == 'L' # L : Object
120
+ return desc.class_name.contents[2..desc.class_name.contents.index(';')] # Object class
121
+ else
122
+ raise ::RuntimeError, 'Unsupported NewArray Type'
123
+ end
124
+ end
125
+
126
+ # Deserializes a NewArray value
127
+ #
128
+ # @param io [IO] the io to read from
129
+ # @return [Fixnum, Float] if deserialization succeeds
130
+ # @raise [RuntimeError] if deserialization fails
131
+ def decode_value(io)
132
+ value = nil
133
+
134
+ case type
135
+ when 'byte'
136
+ value = io.read(1)
137
+ raise ::RuntimeError, 'Failed to deserialize NewArray value' if value.nil?
138
+ value = value.unpack('c')[0]
139
+ when 'char'
140
+ value = io.read(2)
141
+ unless value && value.length == 2
142
+ raise ::RuntimeError, 'Failed to deserialize NewArray value'
143
+ end
144
+ value = value.unpack('s>')[0]
145
+ when 'double'
146
+ value = io.read(8)
147
+ unless value && value.length == 8
148
+ raise ::RuntimeError, 'Failed to deserialize NewArray value'
149
+ end
150
+ value = value.unpack('G')[0]
151
+ when 'float'
152
+ value = io.read(4)
153
+ unless value && value.length == 4
154
+ raise ::RuntimeError, 'Failed to deserialize NewArray value'
155
+ end
156
+ value = value.unpack('g')[0]
157
+ when 'int'
158
+ value = io.read(4)
159
+ unless value && value.length == 4
160
+ raise ::RuntimeError, 'Failed to deserialize NewArray value'
161
+ end
162
+ value = value.unpack('l>')[0]
163
+ when 'long'
164
+ value = io.read(8)
165
+ unless value && value.length == 8
166
+ raise ::RuntimeError, 'Failed to deserialize NewArray value'
167
+ end
168
+ value = value.unpack('q>')[0]
169
+ when 'short'
170
+ value = io.read(2)
171
+ unless value && value.length == 2
172
+ raise ::RuntimeError, 'Failed to deserialize NewArray value'
173
+ end
174
+ value = value.unpack('s>')[0]
175
+ when 'boolean'
176
+ value = io.read(1)
177
+ raise ::RuntimeError, 'Failed to deserialize NewArray value' if value.nil?
178
+ value = value.unpack('c')[0]
179
+ else # object
180
+ value = decode_content(io, stream)
181
+ end
182
+
183
+ value
184
+ end
185
+
186
+ # Serializes an NewArray value
187
+ #
188
+ # @param value [Fixnum] the value to serialize
189
+ # @param value [Float] the value to serialize
190
+ # @return [String] the serialized value
191
+ # @raise [RuntimeError] if serialization fails
192
+ def encode_value(value)
193
+ res = ''
194
+
195
+ case type
196
+ when 'byte'
197
+ res = [value].pack('c')
198
+ when 'char'
199
+ res = [value].pack('s>')
200
+ when 'double'
201
+ res = [value].pack('G')
202
+ when 'float'
203
+ res = [value].pack('g')
204
+ when 'int'
205
+ res = [value].pack('l>')
206
+ when 'long'
207
+ res = [value].pack('q>')
208
+ when 'short'
209
+ res = [value].pack('s>')
210
+ when 'boolean'
211
+ res = [value].pack('c')
212
+ when Element
213
+ res = value.encode
214
+ else # object
215
+ res = encode_content(value)
216
+ end
217
+
218
+ res
219
+ end
220
+
221
+ end
222
+ end
223
+ end
224
+ end
225
+ end
@@ -0,0 +1,155 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Java
5
+ module Serialization
6
+ module Model
7
+ # This class provides a newClassDesc representation
8
+ class NewClassDesc < Element
9
+
10
+ include Rex::Java::Serialization
11
+
12
+ # @!attribute class_name
13
+ # @return [Rex::Java::Serialization::Model::Utf] The name of the class
14
+ attr_accessor :class_name
15
+ # @!attribute name
16
+ # @return [Integer] The java class serial version
17
+ attr_accessor :serial_version
18
+ # @!attribute flags
19
+ # @return [Integer] The java class flags
20
+ attr_accessor :flags
21
+ # @!attribute fields
22
+ # @return [Array] The java class fields
23
+ attr_accessor :fields
24
+ # @!attribute fields
25
+ # @return [Rex::Java::Serialization::Model::Annotation] The java class annotations
26
+ attr_accessor :class_annotation
27
+ # @!attribute super_class
28
+ # @return [Rex::Java::Serialization::Model::ClassDesc] The java class superclass description
29
+ attr_accessor :super_class
30
+
31
+ # @param stream [Rex::Java::Serialization::Model::Stream] the stream where it belongs to
32
+ def initialize(stream = nil)
33
+ super(stream)
34
+ self.class_name = nil
35
+ self.serial_version = 0
36
+ self.flags = 0
37
+ self.fields = []
38
+ self.class_annotation = nil
39
+ self.super_class = nil
40
+ end
41
+
42
+ # Deserializes a Rex::Java::Serialization::Model::ClassDescription
43
+ #
44
+ # @param io [IO] the io to read from
45
+ # @return [self] if deserialization succeeds
46
+ # @raise [RuntimeError] if deserialization doesn't succeed
47
+ def decode(io)
48
+ self.class_name = Utf.decode(io, stream)
49
+ self.serial_version = decode_serial_version(io)
50
+ stream.add_reference(self) unless stream.nil?
51
+ self.flags = decode_flags(io)
52
+ fields_length = decode_fields_length(io)
53
+ fields_length.times do
54
+ field = Field.decode(io, stream)
55
+ self.fields << field
56
+ end
57
+
58
+ self.class_annotation = Annotation.decode(io, stream)
59
+ self.super_class = ClassDesc.decode(io, stream)
60
+
61
+ self
62
+ end
63
+
64
+ # Serializes the Rex::Java::Serialization::Model::ClassDescription
65
+ #
66
+ # @return [String] if serialization succeeds
67
+ # @raise [RuntimeError] if serialization doesn't succeed
68
+ def encode
69
+ unless class_name.class == Rex::Java::Serialization::Model::Utf &&
70
+ class_annotation.class == Rex::Java::Serialization::Model::Annotation &&
71
+ super_class.class == Rex::Java::Serialization::Model::ClassDesc
72
+ raise ::RuntimeError, 'Filed to serialize NewClassDesc'
73
+ end
74
+ encoded = ''
75
+ encoded << class_name.encode
76
+ encoded << [serial_version].pack('Q>')
77
+ stream.add_reference(self) unless stream.nil?
78
+ encoded << [flags].pack('C')
79
+ encoded << [fields.length].pack('n')
80
+ fields.each do |field|
81
+ encoded << field.encode
82
+ end
83
+ encoded << class_annotation.encode
84
+ encoded << super_class.encode
85
+
86
+ encoded
87
+ end
88
+
89
+ # Creates a print-friendly string representation
90
+ #
91
+ # @return [String]
92
+ def to_s
93
+ str = "#{class_name}, [ "
94
+ fields_str = []
95
+ fields.each do |field|
96
+ fields_str << field.to_s
97
+ end
98
+ str << "#{fields_str.join(', ')} ]"
99
+
100
+ case super_class.description
101
+ when NewClassDesc
102
+ str << ", @super_class: #{super_class.description.class_name.to_s}"
103
+ when Reference
104
+ str << ", @super_class: #{super_class.description.to_s}"
105
+ end
106
+
107
+ str
108
+ end
109
+
110
+ private
111
+
112
+ # Deserializes a class serial version
113
+ #
114
+ # @param io [IO] the io to read from
115
+ # @return [Integer] if deserialization succeeds
116
+ # @raise [RuntimeError] if deserialization doesn't succeed
117
+ def decode_serial_version(io)
118
+ raw_serial = io.read(8)
119
+ if raw_serial.nil? || raw_serial.length != 8
120
+ raise ::RuntimeError, 'Failed to unserialize ClassDescription'
121
+ end
122
+
123
+ raw_serial.unpack('Q>')[0]
124
+ end
125
+
126
+ # Deserializes a class flags
127
+ #
128
+ # @param io [IO] the io to read from
129
+ # @return [Integer] if deserialization is possible
130
+ # @raise [RuntimeError] if deserialization doesn't succeed
131
+ def decode_flags(io)
132
+ raw_flags = io.read(1)
133
+ raise ::RuntimeError, 'Failed to unserialize ClassDescription' if raw_flags.nil?
134
+
135
+ raw_flags.unpack('C')[0]
136
+ end
137
+
138
+ # Deserializes a class fields length
139
+ #
140
+ # @param io [IO] the io to read from
141
+ # @return [Integer] if deserialization is possible
142
+ # @raise [RuntimeError] if deserialization doesn't succeed
143
+ def decode_fields_length(io)
144
+ fields_length = io.read(2)
145
+ if fields_length.nil? || fields_length.length != 2
146
+ raise ::RuntimeError, 'Failed to unserialize ClassDescription'
147
+ end
148
+
149
+ fields_length.unpack('n')[0]
150
+ end
151
+ end
152
+ end
153
+ end
154
+ end
155
+ end
@@ -0,0 +1,79 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Java
5
+ module Serialization
6
+ module Model
7
+ # This class provides a NewEnum (Java Enum) representation
8
+ class NewEnum < Element
9
+
10
+ include Rex::Java::Serialization::Model::Contents
11
+
12
+ # @!attribute enum_description
13
+ # @return [Rex::Java::Serialization::Model::ClassDescription] The description of the enum
14
+ attr_accessor :enum_description
15
+ # @!attribute constant_name
16
+ # @return [Rex::Java::Serialization::Model::Utf] The constant value in the Java Enum
17
+ attr_accessor :constant_name
18
+
19
+ # @param stream [Rex::Java::Serialization::Model::Stream] the stream where it belongs to
20
+ def initialize(stream = nil)
21
+ super(stream)
22
+ self.enum_description = nil
23
+ self.constant_name = nil
24
+ end
25
+
26
+ # Deserializes a Rex::Java::Serialization::Model::NewEnum
27
+ #
28
+ # @param io [IO] the io to read from
29
+ # @return [self] if deserialization succeeds
30
+ # @raise [RuntimeError] if deserialization doesn't succeed
31
+ def decode(io)
32
+ self.enum_description = ClassDesc.decode(io, stream)
33
+ stream.add_reference(self) unless stream.nil?
34
+ self.constant_name = decode_constant_name(io)
35
+
36
+ self
37
+ end
38
+
39
+ # Serializes the Rex::Java::Serialization::Model::NewEnum
40
+ #
41
+ # @return [String] if serialization succeeds
42
+ # @raise [RuntimeError] if serialization doesn't succeed
43
+ def encode
44
+ unless enum_description.class == ClassDesc &&
45
+ constant_name.class == Utf
46
+ raise ::RuntimeError, 'Failed to serialize EnumDescription'
47
+ end
48
+
49
+ encoded = ''
50
+ encoded << enum_description.encode
51
+ encoded << encode_content(constant_name)
52
+ encoded
53
+ end
54
+
55
+ # Creates a print-friendly string representation
56
+ #
57
+ # @return [String]
58
+ def to_s
59
+ constant_name.to_s
60
+ end
61
+
62
+ private
63
+
64
+ # Deserializes the NewEnum constant name
65
+ #
66
+ # @param io [IO] the io to read from
67
+ # @return [Rex::Java::Serialization::Model::Utf] if deserialization succeeds
68
+ # @raise [RuntimeError] if deserialization doesn't succed
69
+ def decode_constant_name(io)
70
+ content = decode_content(io, stream)
71
+ raise ::RuntimeError, 'Failed to unserialize NewEnum' unless content.class == Rex::Java::Serialization::Model::Utf
72
+
73
+ content
74
+ end
75
+ end
76
+ end
77
+ end
78
+ end
79
+ end