rex 2.0.5 → 2.0.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (98) hide show
  1. checksums.yaml +4 -4
  2. data/lib/rex/exploitation/egghunter.rb +4 -6
  3. data/lib/rex/exploitation/powershell/psh_methods.rb +9 -0
  4. data/lib/rex/java/serialization.rb +2 -1
  5. data/lib/rex/java/serialization/builder.rb +94 -0
  6. data/lib/rex/java/serialization/model.rb +29 -18
  7. data/lib/rex/java/serialization/model/annotation.rb +2 -2
  8. data/lib/rex/java/serialization/model/field.rb +2 -2
  9. data/lib/rex/java/serialization/model/new_array.rb +8 -3
  10. data/lib/rex/java/serialization/model/new_class_desc.rb +3 -3
  11. data/lib/rex/java/serialization/model/new_enum.rb +4 -4
  12. data/lib/rex/java/serialization/model/new_object.rb +17 -10
  13. data/lib/rex/ole/direntry.rb +1 -1
  14. data/lib/rex/ole/samples/create_ole.rb +0 -0
  15. data/lib/rex/ole/samples/dir.rb +0 -0
  16. data/lib/rex/ole/samples/dump_stream.rb +0 -0
  17. data/lib/rex/ole/samples/ole_info.rb +0 -0
  18. data/lib/rex/parser/foundstone_nokogiri.rb +1 -1
  19. data/lib/rex/parser/fs/ntfs.rb +252 -0
  20. data/lib/rex/parser/openvas_nokogiri.rb +2 -0
  21. data/lib/rex/payloads/win32/kernel.rb +3 -3
  22. data/lib/rex/post/meterpreter/client_core.rb +172 -64
  23. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +3 -2
  24. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +12 -10
  25. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +64 -37
  26. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +8 -2
  27. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +15 -3
  28. data/lib/rex/post/meterpreter/packet.rb +41 -38
  29. data/lib/rex/post/meterpreter/packet_dispatcher.rb +7 -1
  30. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +17 -4
  31. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +11 -4
  32. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +1 -1
  33. data/lib/rex/proto.rb +2 -0
  34. data/lib/rex/proto/acpp.rb +17 -0
  35. data/lib/rex/proto/acpp/client.rb +29 -0
  36. data/lib/rex/proto/acpp/message.rb +183 -0
  37. data/lib/rex/proto/http/client.rb +1 -2
  38. data/lib/rex/proto/iax2/call.rb +22 -3
  39. data/lib/rex/proto/iax2/client.rb +1 -0
  40. data/lib/rex/proto/kerberos.rb +13 -0
  41. data/lib/rex/proto/kerberos/client.rb +213 -0
  42. data/lib/rex/proto/kerberos/credential_cache.rb +19 -0
  43. data/lib/rex/proto/kerberos/credential_cache/cache.rb +81 -0
  44. data/lib/rex/proto/kerberos/credential_cache/credential.rb +151 -0
  45. data/lib/rex/proto/kerberos/credential_cache/element.rb +49 -0
  46. data/lib/rex/proto/kerberos/credential_cache/key_block.rb +62 -0
  47. data/lib/rex/proto/kerberos/credential_cache/principal.rb +70 -0
  48. data/lib/rex/proto/kerberos/credential_cache/time.rb +69 -0
  49. data/lib/rex/proto/kerberos/crypto.rb +21 -0
  50. data/lib/rex/proto/kerberos/crypto/rc4_hmac.rb +65 -0
  51. data/lib/rex/proto/kerberos/crypto/rsa_md5.rb +15 -0
  52. data/lib/rex/proto/kerberos/model.rb +133 -0
  53. data/lib/rex/proto/kerberos/model/ap_req.rb +98 -0
  54. data/lib/rex/proto/kerberos/model/authenticator.rb +143 -0
  55. data/lib/rex/proto/kerberos/model/authorization_data.rb +85 -0
  56. data/lib/rex/proto/kerberos/model/checksum.rb +59 -0
  57. data/lib/rex/proto/kerberos/model/element.rb +67 -0
  58. data/lib/rex/proto/kerberos/model/enc_kdc_response.rb +215 -0
  59. data/lib/rex/proto/kerberos/model/encrypted_data.rb +171 -0
  60. data/lib/rex/proto/kerberos/model/encryption_key.rb +106 -0
  61. data/lib/rex/proto/kerberos/model/kdc_request.rb +166 -0
  62. data/lib/rex/proto/kerberos/model/kdc_request_body.rb +315 -0
  63. data/lib/rex/proto/kerberos/model/kdc_response.rb +141 -0
  64. data/lib/rex/proto/kerberos/model/krb_error.rb +219 -0
  65. data/lib/rex/proto/kerberos/model/last_request.rb +82 -0
  66. data/lib/rex/proto/kerberos/model/pre_auth_data.rb +104 -0
  67. data/lib/rex/proto/kerberos/model/pre_auth_enc_time_stamp.rb +126 -0
  68. data/lib/rex/proto/kerberos/model/pre_auth_pac_request.rb +81 -0
  69. data/lib/rex/proto/kerberos/model/principal_name.rb +116 -0
  70. data/lib/rex/proto/kerberos/model/ticket.rb +151 -0
  71. data/lib/rex/proto/kerberos/pac.rb +36 -0
  72. data/lib/rex/proto/kerberos/pac/client_info.rb +53 -0
  73. data/lib/rex/proto/kerberos/pac/element.rb +52 -0
  74. data/lib/rex/proto/kerberos/pac/logon_info.rb +566 -0
  75. data/lib/rex/proto/kerberos/pac/priv_svr_checksum.rb +29 -0
  76. data/lib/rex/proto/kerberos/pac/server_checksum.rb +30 -0
  77. data/lib/rex/proto/kerberos/pac/type.rb +121 -0
  78. data/lib/rex/proto/rmi.rb +7 -0
  79. data/lib/rex/proto/rmi/model.rb +31 -0
  80. data/lib/rex/proto/rmi/model/call.rb +60 -0
  81. data/lib/rex/proto/rmi/model/continuation.rb +76 -0
  82. data/lib/rex/proto/rmi/model/dgc_ack.rb +62 -0
  83. data/lib/rex/proto/rmi/model/element.rb +143 -0
  84. data/lib/rex/proto/rmi/model/output_header.rb +86 -0
  85. data/lib/rex/proto/rmi/model/ping.rb +41 -0
  86. data/lib/rex/proto/rmi/model/ping_ack.rb +41 -0
  87. data/lib/rex/proto/rmi/model/protocol_ack.rb +100 -0
  88. data/lib/rex/proto/rmi/model/return_data.rb +60 -0
  89. data/lib/rex/socket.rb +9 -1
  90. data/lib/rex/socket/tcp_server.rb +3 -0
  91. data/lib/rex/ui/text/dispatcher_shell.rb +4 -4
  92. data/lib/rex/ui/text/output/tee.rb +2 -0
  93. data/lib/rex/zip/samples/comment.rb +0 -0
  94. data/lib/rex/zip/samples/mkwar.rb +0 -0
  95. data/lib/rex/zip/samples/mkzip.rb +0 -0
  96. data/lib/rex/zip/samples/recursive.rb +0 -0
  97. data/rex.gemspec +1 -1
  98. metadata +56 -2
@@ -0,0 +1,19 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ VERSION = 0x0504
8
+ HEADER = "\x00\x08\xff\xff\xff\xff\x00\x00\x00\x00"
9
+ end
10
+ end
11
+ end
12
+ end
13
+
14
+ require 'rex/proto/kerberos/credential_cache/element'
15
+ require 'rex/proto/kerberos/credential_cache/key_block'
16
+ require 'rex/proto/kerberos/credential_cache/principal'
17
+ require 'rex/proto/kerberos/credential_cache/time'
18
+ require 'rex/proto/kerberos/credential_cache/credential'
19
+ require 'rex/proto/kerberos/credential_cache/cache'
@@ -0,0 +1,81 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of a Kerberos Credential Cache.
8
+ class Cache < Element
9
+
10
+ # @!attribute version
11
+ # @return [Fixnum] The file format version
12
+ attr_accessor :version
13
+ # @!attribute headers
14
+ # @return [Array<String>] The header tags
15
+ attr_accessor :headers
16
+ # @!attribute primary_principal
17
+ # @return [Rex::Proto::Kerberos::CredentialCache::Principal] The principal cache's owner
18
+ attr_accessor :primary_principal
19
+ # @!attribute credentials
20
+ # @return [Array<Rex::Proto::Kerberos::CredentialCache::Credential>] The primary principal credentials
21
+ attr_accessor :credentials
22
+
23
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Cache into an String
24
+ #
25
+ # @return [String] encoded cache
26
+ def encode
27
+ encoded = ''
28
+ encoded << encode_version
29
+ encoded << encode_headers
30
+ encoded << encode_primary_principal
31
+ encoded << encode_credentials
32
+ end
33
+
34
+ private
35
+
36
+ # Encodes the version field
37
+ #
38
+ # @return [String]
39
+ def encode_version
40
+ [version].pack('n')
41
+ end
42
+
43
+ # Encodes the headers field
44
+ #
45
+ # @return [String]
46
+ def encode_headers
47
+ headers_encoded = ''
48
+ headers_encoded << [headers.length].pack('n')
49
+ headers.each do |h|
50
+ headers_encoded << h
51
+ end
52
+
53
+ encoded = ''
54
+ encoded << [headers_encoded.length].pack('n')
55
+ encoded << headers_encoded
56
+
57
+ encoded
58
+ end
59
+
60
+ # Encodes the primary_principal field
61
+ #
62
+ # @return [String]
63
+ def encode_primary_principal
64
+ primary_principal.encode
65
+ end
66
+
67
+ # Encodes the credentials field
68
+ #
69
+ # @return [String]
70
+ def encode_credentials
71
+ encoded = ''
72
+ credentials.each do |cred|
73
+ encoded << cred.encode
74
+ end
75
+ encoded
76
+ end
77
+ end
78
+ end
79
+ end
80
+ end
81
+ end
@@ -0,0 +1,151 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of a Credential stored in the Kerberos Credential Cache.
8
+ class Credential < Element
9
+ # @!attribute client
10
+ # @return [Rex::Proto::Kerberos::CredentialCache::Principal]
11
+ attr_accessor :client
12
+ # @!attribute server
13
+ # @return [Rex::Proto::Kerberos::CredentialCache::Principal]
14
+ attr_accessor :server
15
+ # @!attribute key
16
+ # @return [Rex::Proto::Kerberos::CredentialCache::KeyBlock]
17
+ attr_accessor :key
18
+ # @!attribute time
19
+ # @return [Rex::Proto::Kerberos::CredentialCache::Time]
20
+ attr_accessor :time
21
+ # @!attribute is_skey
22
+ # @return [Fixnum]
23
+ attr_accessor :is_skey
24
+ # @!attribute tkt_flags
25
+ # @return [Fixnum]
26
+ attr_accessor :tkt_flags
27
+ # @!attribute addrs
28
+ # @return [Array]
29
+ attr_accessor :addrs
30
+ # @!attribute auth_data
31
+ # @return [Array]
32
+ attr_accessor :auth_data
33
+ # @!attribute ticket
34
+ # @return [String]
35
+ attr_accessor :ticket
36
+ # @!attribute second_ticket
37
+ # @return [String]
38
+ attr_accessor :second_ticket
39
+
40
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Credential into an String
41
+ #
42
+ # @return [String] encoded credential
43
+ def encode
44
+ encoded = ''
45
+ encoded << encode_client
46
+ encoded << encode_server
47
+ encoded << encode_key
48
+ encoded << encode_time
49
+ encoded << encode_is_skey
50
+ encoded << encode_tkt_flags
51
+ encoded << encode_addrs
52
+ encoded << encode_auth_data
53
+ encoded << encode_ticket
54
+ encoded << encode_second_ticket
55
+ end
56
+
57
+ private
58
+
59
+ # Encodes the client field
60
+ #
61
+ # @return [String]
62
+ def encode_client
63
+ client.encode
64
+ end
65
+
66
+ # Encodes the server field
67
+ #
68
+ # @return [String]
69
+ def encode_server
70
+ server.encode
71
+ end
72
+
73
+ # Encodes the key field
74
+ #
75
+ # @return [String]
76
+ def encode_key
77
+ key.encode
78
+ end
79
+
80
+ # Encodes the time field
81
+ #
82
+ # @return [String]
83
+ def encode_time
84
+ time.encode
85
+ end
86
+
87
+ # Encodes the is_skey field
88
+ #
89
+ # @return [String]
90
+ def encode_is_skey
91
+ [is_skey].pack('C')
92
+ end
93
+
94
+ # Encodes the tkt_flags field
95
+ #
96
+ # @return [String]
97
+ def encode_tkt_flags
98
+ [tkt_flags].pack('N')
99
+ end
100
+
101
+ # Encodes the addrs field
102
+ #
103
+ # @return [String]
104
+ # @raise [NotImplementedError] if there are addresses to encode
105
+ def encode_addrs
106
+ encoded = ''
107
+ if addrs.length > 0
108
+ raise ::NotImplementedError, 'CredentialCache: Credential addresses encoding not supported'
109
+ end
110
+ encoded << [addrs.length].pack('N')
111
+ encoded
112
+ end
113
+
114
+ # Encodes the auth_data field
115
+ #
116
+ # @return [String]
117
+ def encode_auth_data
118
+ encoded = ''
119
+ if auth_data.length > 0
120
+ raise ::RuntimeError, 'CredentialCache: Credential auth_data encoding not supported'
121
+ end
122
+ encoded << [auth_data.length].pack('N')
123
+ encoded
124
+ end
125
+
126
+ # Encodes the ticket field
127
+ #
128
+ # @return [String]
129
+ def encode_ticket
130
+ encoded = ''
131
+ encoded << [ticket.length].pack('N')
132
+ encoded << ticket
133
+
134
+ encoded
135
+ end
136
+
137
+ # Encodes the second_ticket field
138
+ #
139
+ # @return [String]
140
+ def encode_second_ticket
141
+ encoded = ''
142
+ encoded << [second_ticket.length].pack('N')
143
+ encoded << second_ticket
144
+
145
+ encoded
146
+ end
147
+ end
148
+ end
149
+ end
150
+ end
151
+ end
@@ -0,0 +1,49 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ class Element
8
+
9
+ def self.attr_accessor(*vars)
10
+ @attributes ||= []
11
+ @attributes.concat vars
12
+ super(*vars)
13
+ end
14
+
15
+ # Retrieves the element class fields
16
+ #
17
+ # @return [Array]
18
+ def self.attributes
19
+ @attributes
20
+ end
21
+
22
+ def initialize(options = {})
23
+ self.class.attributes.each do |attr|
24
+ if options.has_key?(attr)
25
+ m = (attr.to_s + '=').to_sym
26
+ self.send(m, options[attr])
27
+ end
28
+ end
29
+ end
30
+
31
+ # Retrieves the element instance fields
32
+ #
33
+ # @return [Array]
34
+ def attributes
35
+ self.class.attributes
36
+ end
37
+
38
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Element into an String. This
39
+ # method has been designed to be overridden by subclasses.
40
+ #
41
+ # @raise [NoMethodError]
42
+ def encode
43
+ raise ::NoMethodError, 'Method designed to be overridden'
44
+ end
45
+ end
46
+ end
47
+ end
48
+ end
49
+ end
@@ -0,0 +1,62 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+
8
+ # This class provides a representation of a credential keys stored in the Kerberos Credential Cache.
9
+ class KeyBlock < Element
10
+ # @!attribute key_type
11
+ # @return [Fixnum]
12
+ attr_accessor :key_type
13
+ # @!attribute e_type
14
+ # @return [Fixnum]
15
+ attr_accessor :e_type
16
+ # @!attribute key_value
17
+ # @return [String]
18
+ attr_accessor :key_value
19
+
20
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::KeyBlock into an String
21
+ #
22
+ # @return [String] encoded key
23
+ def encode
24
+ encoded = ''
25
+ encoded << encode_key_type
26
+ encoded << encode_e_type
27
+ encoded << encode_key_value
28
+
29
+ encoded
30
+ end
31
+
32
+ private
33
+
34
+ # Encodes the key_type field
35
+ #
36
+ # @return [String]
37
+ def encode_key_type
38
+ [key_type].pack('n')
39
+ end
40
+
41
+ # Encodes the e_type field
42
+ #
43
+ # @return [String]
44
+ def encode_e_type
45
+ [e_type].pack('n')
46
+ end
47
+
48
+ # Encodes the key_value field
49
+ #
50
+ # @return [String]
51
+ def encode_key_value
52
+ encoded = ''
53
+ encoded << [key_value.length].pack('n')
54
+ encoded << key_value
55
+
56
+ encoded
57
+ end
58
+ end
59
+ end
60
+ end
61
+ end
62
+ end
@@ -0,0 +1,70 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of a Principal stored in the Kerberos Credential Cache.
8
+ class Principal < Element
9
+ # @!attribute name_type
10
+ # @return [Fixnum]
11
+ attr_accessor :name_type
12
+ # @!attribute realm
13
+ # @return [String]
14
+ attr_accessor :realm
15
+ # @!attribute components
16
+ # @return [Array<String>]
17
+ attr_accessor :components
18
+
19
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Principal into an String
20
+ #
21
+ # @return [String] encoded principal
22
+ def encode
23
+ encoded = ''
24
+ encoded << encode_name_type
25
+ encoded << [components.length].pack('N')
26
+ encoded << encode_realm
27
+ encoded << encode_components
28
+
29
+ encoded
30
+ end
31
+
32
+ private
33
+
34
+ # Encodes the name_type field
35
+ #
36
+ # @return [String]
37
+ def encode_name_type
38
+ [name_type].pack('N')
39
+ end
40
+
41
+ # Encodes the realm field
42
+ #
43
+ # @return [String]
44
+ def encode_realm
45
+ encoded = ''
46
+ encoded << [realm.length].pack('N')
47
+ encoded << realm
48
+
49
+ encoded
50
+ end
51
+
52
+ # Encodes the components field
53
+ #
54
+ # @return [String]
55
+ def encode_components
56
+ encoded = ''
57
+
58
+ components.each do |c|
59
+ encoded << [c.length].pack('N')
60
+ encoded << c
61
+ end
62
+
63
+ encoded
64
+ end
65
+
66
+ end
67
+ end
68
+ end
69
+ end
70
+ end
@@ -0,0 +1,69 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of credential times stored in the Kerberos Credential Cache.
8
+ class Time < Element
9
+ # @!attribute auth_time
10
+ # @return [Fixnum]
11
+ attr_accessor :auth_time
12
+ # @!attribute start_time
13
+ # @return [Fixnum]
14
+ attr_accessor :start_time
15
+ # @!attribute end_time
16
+ # @return [Fixnum]
17
+ attr_accessor :end_time
18
+ # @!attribute renew_till
19
+ # @return [Fixnum]
20
+ attr_accessor :renew_till
21
+
22
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Time into an String
23
+ #
24
+ # @return [String] encoded time
25
+ def encode
26
+ encoded = ''
27
+ encoded << encode_auth_time
28
+ encoded << encode_start_time
29
+ encoded << encode_end_time
30
+ encoded << encode_renew_time
31
+
32
+ encoded
33
+ end
34
+
35
+ private
36
+
37
+ # Encodes the auth_time field
38
+ #
39
+ # @return [String]
40
+ def encode_auth_time
41
+ [auth_time].pack('N')
42
+ end
43
+
44
+ # Encodes the start_time field
45
+ #
46
+ # @return [String]
47
+ def encode_start_time
48
+ [start_time].pack('N')
49
+ end
50
+
51
+ # Encodes the end_time field
52
+ #
53
+ # @return [String]
54
+ def encode_end_time
55
+ [end_time].pack('N')
56
+ end
57
+
58
+ # Encodes the renew_time field
59
+ #
60
+ # @return [String]
61
+ def encode_renew_time
62
+ [renew_till].pack('N')
63
+ end
64
+
65
+ end
66
+ end
67
+ end
68
+ end
69
+ end