rex 2.0.5 → 2.0.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (98) hide show
  1. checksums.yaml +4 -4
  2. data/lib/rex/exploitation/egghunter.rb +4 -6
  3. data/lib/rex/exploitation/powershell/psh_methods.rb +9 -0
  4. data/lib/rex/java/serialization.rb +2 -1
  5. data/lib/rex/java/serialization/builder.rb +94 -0
  6. data/lib/rex/java/serialization/model.rb +29 -18
  7. data/lib/rex/java/serialization/model/annotation.rb +2 -2
  8. data/lib/rex/java/serialization/model/field.rb +2 -2
  9. data/lib/rex/java/serialization/model/new_array.rb +8 -3
  10. data/lib/rex/java/serialization/model/new_class_desc.rb +3 -3
  11. data/lib/rex/java/serialization/model/new_enum.rb +4 -4
  12. data/lib/rex/java/serialization/model/new_object.rb +17 -10
  13. data/lib/rex/ole/direntry.rb +1 -1
  14. data/lib/rex/ole/samples/create_ole.rb +0 -0
  15. data/lib/rex/ole/samples/dir.rb +0 -0
  16. data/lib/rex/ole/samples/dump_stream.rb +0 -0
  17. data/lib/rex/ole/samples/ole_info.rb +0 -0
  18. data/lib/rex/parser/foundstone_nokogiri.rb +1 -1
  19. data/lib/rex/parser/fs/ntfs.rb +252 -0
  20. data/lib/rex/parser/openvas_nokogiri.rb +2 -0
  21. data/lib/rex/payloads/win32/kernel.rb +3 -3
  22. data/lib/rex/post/meterpreter/client_core.rb +172 -64
  23. data/lib/rex/post/meterpreter/extensions/priv/priv.rb +3 -2
  24. data/lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb +12 -10
  25. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb +64 -37
  26. data/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb +8 -2
  27. data/lib/rex/post/meterpreter/extensions/stdapi/ui.rb +15 -3
  28. data/lib/rex/post/meterpreter/packet.rb +41 -38
  29. data/lib/rex/post/meterpreter/packet_dispatcher.rb +7 -1
  30. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +17 -4
  31. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +11 -4
  32. data/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb +1 -1
  33. data/lib/rex/proto.rb +2 -0
  34. data/lib/rex/proto/acpp.rb +17 -0
  35. data/lib/rex/proto/acpp/client.rb +29 -0
  36. data/lib/rex/proto/acpp/message.rb +183 -0
  37. data/lib/rex/proto/http/client.rb +1 -2
  38. data/lib/rex/proto/iax2/call.rb +22 -3
  39. data/lib/rex/proto/iax2/client.rb +1 -0
  40. data/lib/rex/proto/kerberos.rb +13 -0
  41. data/lib/rex/proto/kerberos/client.rb +213 -0
  42. data/lib/rex/proto/kerberos/credential_cache.rb +19 -0
  43. data/lib/rex/proto/kerberos/credential_cache/cache.rb +81 -0
  44. data/lib/rex/proto/kerberos/credential_cache/credential.rb +151 -0
  45. data/lib/rex/proto/kerberos/credential_cache/element.rb +49 -0
  46. data/lib/rex/proto/kerberos/credential_cache/key_block.rb +62 -0
  47. data/lib/rex/proto/kerberos/credential_cache/principal.rb +70 -0
  48. data/lib/rex/proto/kerberos/credential_cache/time.rb +69 -0
  49. data/lib/rex/proto/kerberos/crypto.rb +21 -0
  50. data/lib/rex/proto/kerberos/crypto/rc4_hmac.rb +65 -0
  51. data/lib/rex/proto/kerberos/crypto/rsa_md5.rb +15 -0
  52. data/lib/rex/proto/kerberos/model.rb +133 -0
  53. data/lib/rex/proto/kerberos/model/ap_req.rb +98 -0
  54. data/lib/rex/proto/kerberos/model/authenticator.rb +143 -0
  55. data/lib/rex/proto/kerberos/model/authorization_data.rb +85 -0
  56. data/lib/rex/proto/kerberos/model/checksum.rb +59 -0
  57. data/lib/rex/proto/kerberos/model/element.rb +67 -0
  58. data/lib/rex/proto/kerberos/model/enc_kdc_response.rb +215 -0
  59. data/lib/rex/proto/kerberos/model/encrypted_data.rb +171 -0
  60. data/lib/rex/proto/kerberos/model/encryption_key.rb +106 -0
  61. data/lib/rex/proto/kerberos/model/kdc_request.rb +166 -0
  62. data/lib/rex/proto/kerberos/model/kdc_request_body.rb +315 -0
  63. data/lib/rex/proto/kerberos/model/kdc_response.rb +141 -0
  64. data/lib/rex/proto/kerberos/model/krb_error.rb +219 -0
  65. data/lib/rex/proto/kerberos/model/last_request.rb +82 -0
  66. data/lib/rex/proto/kerberos/model/pre_auth_data.rb +104 -0
  67. data/lib/rex/proto/kerberos/model/pre_auth_enc_time_stamp.rb +126 -0
  68. data/lib/rex/proto/kerberos/model/pre_auth_pac_request.rb +81 -0
  69. data/lib/rex/proto/kerberos/model/principal_name.rb +116 -0
  70. data/lib/rex/proto/kerberos/model/ticket.rb +151 -0
  71. data/lib/rex/proto/kerberos/pac.rb +36 -0
  72. data/lib/rex/proto/kerberos/pac/client_info.rb +53 -0
  73. data/lib/rex/proto/kerberos/pac/element.rb +52 -0
  74. data/lib/rex/proto/kerberos/pac/logon_info.rb +566 -0
  75. data/lib/rex/proto/kerberos/pac/priv_svr_checksum.rb +29 -0
  76. data/lib/rex/proto/kerberos/pac/server_checksum.rb +30 -0
  77. data/lib/rex/proto/kerberos/pac/type.rb +121 -0
  78. data/lib/rex/proto/rmi.rb +7 -0
  79. data/lib/rex/proto/rmi/model.rb +31 -0
  80. data/lib/rex/proto/rmi/model/call.rb +60 -0
  81. data/lib/rex/proto/rmi/model/continuation.rb +76 -0
  82. data/lib/rex/proto/rmi/model/dgc_ack.rb +62 -0
  83. data/lib/rex/proto/rmi/model/element.rb +143 -0
  84. data/lib/rex/proto/rmi/model/output_header.rb +86 -0
  85. data/lib/rex/proto/rmi/model/ping.rb +41 -0
  86. data/lib/rex/proto/rmi/model/ping_ack.rb +41 -0
  87. data/lib/rex/proto/rmi/model/protocol_ack.rb +100 -0
  88. data/lib/rex/proto/rmi/model/return_data.rb +60 -0
  89. data/lib/rex/socket.rb +9 -1
  90. data/lib/rex/socket/tcp_server.rb +3 -0
  91. data/lib/rex/ui/text/dispatcher_shell.rb +4 -4
  92. data/lib/rex/ui/text/output/tee.rb +2 -0
  93. data/lib/rex/zip/samples/comment.rb +0 -0
  94. data/lib/rex/zip/samples/mkwar.rb +0 -0
  95. data/lib/rex/zip/samples/mkzip.rb +0 -0
  96. data/lib/rex/zip/samples/recursive.rb +0 -0
  97. data/rex.gemspec +1 -1
  98. metadata +56 -2
@@ -0,0 +1,19 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ VERSION = 0x0504
8
+ HEADER = "\x00\x08\xff\xff\xff\xff\x00\x00\x00\x00"
9
+ end
10
+ end
11
+ end
12
+ end
13
+
14
+ require 'rex/proto/kerberos/credential_cache/element'
15
+ require 'rex/proto/kerberos/credential_cache/key_block'
16
+ require 'rex/proto/kerberos/credential_cache/principal'
17
+ require 'rex/proto/kerberos/credential_cache/time'
18
+ require 'rex/proto/kerberos/credential_cache/credential'
19
+ require 'rex/proto/kerberos/credential_cache/cache'
@@ -0,0 +1,81 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of a Kerberos Credential Cache.
8
+ class Cache < Element
9
+
10
+ # @!attribute version
11
+ # @return [Fixnum] The file format version
12
+ attr_accessor :version
13
+ # @!attribute headers
14
+ # @return [Array<String>] The header tags
15
+ attr_accessor :headers
16
+ # @!attribute primary_principal
17
+ # @return [Rex::Proto::Kerberos::CredentialCache::Principal] The principal cache's owner
18
+ attr_accessor :primary_principal
19
+ # @!attribute credentials
20
+ # @return [Array<Rex::Proto::Kerberos::CredentialCache::Credential>] The primary principal credentials
21
+ attr_accessor :credentials
22
+
23
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Cache into an String
24
+ #
25
+ # @return [String] encoded cache
26
+ def encode
27
+ encoded = ''
28
+ encoded << encode_version
29
+ encoded << encode_headers
30
+ encoded << encode_primary_principal
31
+ encoded << encode_credentials
32
+ end
33
+
34
+ private
35
+
36
+ # Encodes the version field
37
+ #
38
+ # @return [String]
39
+ def encode_version
40
+ [version].pack('n')
41
+ end
42
+
43
+ # Encodes the headers field
44
+ #
45
+ # @return [String]
46
+ def encode_headers
47
+ headers_encoded = ''
48
+ headers_encoded << [headers.length].pack('n')
49
+ headers.each do |h|
50
+ headers_encoded << h
51
+ end
52
+
53
+ encoded = ''
54
+ encoded << [headers_encoded.length].pack('n')
55
+ encoded << headers_encoded
56
+
57
+ encoded
58
+ end
59
+
60
+ # Encodes the primary_principal field
61
+ #
62
+ # @return [String]
63
+ def encode_primary_principal
64
+ primary_principal.encode
65
+ end
66
+
67
+ # Encodes the credentials field
68
+ #
69
+ # @return [String]
70
+ def encode_credentials
71
+ encoded = ''
72
+ credentials.each do |cred|
73
+ encoded << cred.encode
74
+ end
75
+ encoded
76
+ end
77
+ end
78
+ end
79
+ end
80
+ end
81
+ end
@@ -0,0 +1,151 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of a Credential stored in the Kerberos Credential Cache.
8
+ class Credential < Element
9
+ # @!attribute client
10
+ # @return [Rex::Proto::Kerberos::CredentialCache::Principal]
11
+ attr_accessor :client
12
+ # @!attribute server
13
+ # @return [Rex::Proto::Kerberos::CredentialCache::Principal]
14
+ attr_accessor :server
15
+ # @!attribute key
16
+ # @return [Rex::Proto::Kerberos::CredentialCache::KeyBlock]
17
+ attr_accessor :key
18
+ # @!attribute time
19
+ # @return [Rex::Proto::Kerberos::CredentialCache::Time]
20
+ attr_accessor :time
21
+ # @!attribute is_skey
22
+ # @return [Fixnum]
23
+ attr_accessor :is_skey
24
+ # @!attribute tkt_flags
25
+ # @return [Fixnum]
26
+ attr_accessor :tkt_flags
27
+ # @!attribute addrs
28
+ # @return [Array]
29
+ attr_accessor :addrs
30
+ # @!attribute auth_data
31
+ # @return [Array]
32
+ attr_accessor :auth_data
33
+ # @!attribute ticket
34
+ # @return [String]
35
+ attr_accessor :ticket
36
+ # @!attribute second_ticket
37
+ # @return [String]
38
+ attr_accessor :second_ticket
39
+
40
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Credential into an String
41
+ #
42
+ # @return [String] encoded credential
43
+ def encode
44
+ encoded = ''
45
+ encoded << encode_client
46
+ encoded << encode_server
47
+ encoded << encode_key
48
+ encoded << encode_time
49
+ encoded << encode_is_skey
50
+ encoded << encode_tkt_flags
51
+ encoded << encode_addrs
52
+ encoded << encode_auth_data
53
+ encoded << encode_ticket
54
+ encoded << encode_second_ticket
55
+ end
56
+
57
+ private
58
+
59
+ # Encodes the client field
60
+ #
61
+ # @return [String]
62
+ def encode_client
63
+ client.encode
64
+ end
65
+
66
+ # Encodes the server field
67
+ #
68
+ # @return [String]
69
+ def encode_server
70
+ server.encode
71
+ end
72
+
73
+ # Encodes the key field
74
+ #
75
+ # @return [String]
76
+ def encode_key
77
+ key.encode
78
+ end
79
+
80
+ # Encodes the time field
81
+ #
82
+ # @return [String]
83
+ def encode_time
84
+ time.encode
85
+ end
86
+
87
+ # Encodes the is_skey field
88
+ #
89
+ # @return [String]
90
+ def encode_is_skey
91
+ [is_skey].pack('C')
92
+ end
93
+
94
+ # Encodes the tkt_flags field
95
+ #
96
+ # @return [String]
97
+ def encode_tkt_flags
98
+ [tkt_flags].pack('N')
99
+ end
100
+
101
+ # Encodes the addrs field
102
+ #
103
+ # @return [String]
104
+ # @raise [NotImplementedError] if there are addresses to encode
105
+ def encode_addrs
106
+ encoded = ''
107
+ if addrs.length > 0
108
+ raise ::NotImplementedError, 'CredentialCache: Credential addresses encoding not supported'
109
+ end
110
+ encoded << [addrs.length].pack('N')
111
+ encoded
112
+ end
113
+
114
+ # Encodes the auth_data field
115
+ #
116
+ # @return [String]
117
+ def encode_auth_data
118
+ encoded = ''
119
+ if auth_data.length > 0
120
+ raise ::RuntimeError, 'CredentialCache: Credential auth_data encoding not supported'
121
+ end
122
+ encoded << [auth_data.length].pack('N')
123
+ encoded
124
+ end
125
+
126
+ # Encodes the ticket field
127
+ #
128
+ # @return [String]
129
+ def encode_ticket
130
+ encoded = ''
131
+ encoded << [ticket.length].pack('N')
132
+ encoded << ticket
133
+
134
+ encoded
135
+ end
136
+
137
+ # Encodes the second_ticket field
138
+ #
139
+ # @return [String]
140
+ def encode_second_ticket
141
+ encoded = ''
142
+ encoded << [second_ticket.length].pack('N')
143
+ encoded << second_ticket
144
+
145
+ encoded
146
+ end
147
+ end
148
+ end
149
+ end
150
+ end
151
+ end
@@ -0,0 +1,49 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ class Element
8
+
9
+ def self.attr_accessor(*vars)
10
+ @attributes ||= []
11
+ @attributes.concat vars
12
+ super(*vars)
13
+ end
14
+
15
+ # Retrieves the element class fields
16
+ #
17
+ # @return [Array]
18
+ def self.attributes
19
+ @attributes
20
+ end
21
+
22
+ def initialize(options = {})
23
+ self.class.attributes.each do |attr|
24
+ if options.has_key?(attr)
25
+ m = (attr.to_s + '=').to_sym
26
+ self.send(m, options[attr])
27
+ end
28
+ end
29
+ end
30
+
31
+ # Retrieves the element instance fields
32
+ #
33
+ # @return [Array]
34
+ def attributes
35
+ self.class.attributes
36
+ end
37
+
38
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Element into an String. This
39
+ # method has been designed to be overridden by subclasses.
40
+ #
41
+ # @raise [NoMethodError]
42
+ def encode
43
+ raise ::NoMethodError, 'Method designed to be overridden'
44
+ end
45
+ end
46
+ end
47
+ end
48
+ end
49
+ end
@@ -0,0 +1,62 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+
8
+ # This class provides a representation of a credential keys stored in the Kerberos Credential Cache.
9
+ class KeyBlock < Element
10
+ # @!attribute key_type
11
+ # @return [Fixnum]
12
+ attr_accessor :key_type
13
+ # @!attribute e_type
14
+ # @return [Fixnum]
15
+ attr_accessor :e_type
16
+ # @!attribute key_value
17
+ # @return [String]
18
+ attr_accessor :key_value
19
+
20
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::KeyBlock into an String
21
+ #
22
+ # @return [String] encoded key
23
+ def encode
24
+ encoded = ''
25
+ encoded << encode_key_type
26
+ encoded << encode_e_type
27
+ encoded << encode_key_value
28
+
29
+ encoded
30
+ end
31
+
32
+ private
33
+
34
+ # Encodes the key_type field
35
+ #
36
+ # @return [String]
37
+ def encode_key_type
38
+ [key_type].pack('n')
39
+ end
40
+
41
+ # Encodes the e_type field
42
+ #
43
+ # @return [String]
44
+ def encode_e_type
45
+ [e_type].pack('n')
46
+ end
47
+
48
+ # Encodes the key_value field
49
+ #
50
+ # @return [String]
51
+ def encode_key_value
52
+ encoded = ''
53
+ encoded << [key_value.length].pack('n')
54
+ encoded << key_value
55
+
56
+ encoded
57
+ end
58
+ end
59
+ end
60
+ end
61
+ end
62
+ end
@@ -0,0 +1,70 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of a Principal stored in the Kerberos Credential Cache.
8
+ class Principal < Element
9
+ # @!attribute name_type
10
+ # @return [Fixnum]
11
+ attr_accessor :name_type
12
+ # @!attribute realm
13
+ # @return [String]
14
+ attr_accessor :realm
15
+ # @!attribute components
16
+ # @return [Array<String>]
17
+ attr_accessor :components
18
+
19
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Principal into an String
20
+ #
21
+ # @return [String] encoded principal
22
+ def encode
23
+ encoded = ''
24
+ encoded << encode_name_type
25
+ encoded << [components.length].pack('N')
26
+ encoded << encode_realm
27
+ encoded << encode_components
28
+
29
+ encoded
30
+ end
31
+
32
+ private
33
+
34
+ # Encodes the name_type field
35
+ #
36
+ # @return [String]
37
+ def encode_name_type
38
+ [name_type].pack('N')
39
+ end
40
+
41
+ # Encodes the realm field
42
+ #
43
+ # @return [String]
44
+ def encode_realm
45
+ encoded = ''
46
+ encoded << [realm.length].pack('N')
47
+ encoded << realm
48
+
49
+ encoded
50
+ end
51
+
52
+ # Encodes the components field
53
+ #
54
+ # @return [String]
55
+ def encode_components
56
+ encoded = ''
57
+
58
+ components.each do |c|
59
+ encoded << [c.length].pack('N')
60
+ encoded << c
61
+ end
62
+
63
+ encoded
64
+ end
65
+
66
+ end
67
+ end
68
+ end
69
+ end
70
+ end
@@ -0,0 +1,69 @@
1
+ # -*- coding: binary -*-
2
+
3
+ module Rex
4
+ module Proto
5
+ module Kerberos
6
+ module CredentialCache
7
+ # This class provides a representation of credential times stored in the Kerberos Credential Cache.
8
+ class Time < Element
9
+ # @!attribute auth_time
10
+ # @return [Fixnum]
11
+ attr_accessor :auth_time
12
+ # @!attribute start_time
13
+ # @return [Fixnum]
14
+ attr_accessor :start_time
15
+ # @!attribute end_time
16
+ # @return [Fixnum]
17
+ attr_accessor :end_time
18
+ # @!attribute renew_till
19
+ # @return [Fixnum]
20
+ attr_accessor :renew_till
21
+
22
+ # Encodes the Rex::Proto::Kerberos::CredentialCache::Time into an String
23
+ #
24
+ # @return [String] encoded time
25
+ def encode
26
+ encoded = ''
27
+ encoded << encode_auth_time
28
+ encoded << encode_start_time
29
+ encoded << encode_end_time
30
+ encoded << encode_renew_time
31
+
32
+ encoded
33
+ end
34
+
35
+ private
36
+
37
+ # Encodes the auth_time field
38
+ #
39
+ # @return [String]
40
+ def encode_auth_time
41
+ [auth_time].pack('N')
42
+ end
43
+
44
+ # Encodes the start_time field
45
+ #
46
+ # @return [String]
47
+ def encode_start_time
48
+ [start_time].pack('N')
49
+ end
50
+
51
+ # Encodes the end_time field
52
+ #
53
+ # @return [String]
54
+ def encode_end_time
55
+ [end_time].pack('N')
56
+ end
57
+
58
+ # Encodes the renew_time field
59
+ #
60
+ # @return [String]
61
+ def encode_renew_time
62
+ [renew_till].pack('N')
63
+ end
64
+
65
+ end
66
+ end
67
+ end
68
+ end
69
+ end