Module: Rex::Post::Meterpreter

Defined in:
lib/rex/post/meterpreter/pivot.rb,
lib/rex/post/meterpreter/client.rb,
lib/rex/post/meterpreter/packet.rb,
lib/rex/post/meterpreter/channel.rb,
lib/rex/post/meterpreter/core_ids.rb,
lib/rex/post/meterpreter/extension.rb,
lib/rex/post/meterpreter/ui/console.rb,
lib/rex/post/meterpreter/client_core.rb,
lib/rex/post/meterpreter/channels/pool.rb,
lib/rex/post/meterpreter/packet_parser.rb,
lib/rex/post/meterpreter/command_mapper.rb,
lib/rex/post/meterpreter/object_aliases.rb,
lib/rex/post/meterpreter/channels/stream.rb,
lib/rex/post/meterpreter/pivot_container.rb,
lib/rex/post/meterpreter/extension_mapper.rb,
lib/rex/post/meterpreter/channels/datagram.rb,
lib/rex/post/meterpreter/packet_dispatcher.rb,
lib/rex/post/meterpreter/extensions/priv/fs.rb,
lib/rex/post/meterpreter/channels/pools/file.rb,
lib/rex/post/meterpreter/extensions/kiwi/tlv.rb,
lib/rex/post/meterpreter/extensions/priv/tlv.rb,
lib/rex/post/meterpreter/extensions/espia/tlv.rb,
lib/rex/post/meterpreter/extensions/kiwi/kiwi.rb,
lib/rex/post/meterpreter/extensions/priv/priv.rb,
lib/rex/post/meterpreter/extensions/stdapi/ui.rb,
lib/rex/post/meterpreter/extensions/appapi/tlv.rb,
lib/rex/post/meterpreter/extensions/extapi/tlv.rb,
lib/rex/post/meterpreter/extensions/python/tlv.rb,
lib/rex/post/meterpreter/extensions/stdapi/tlv.rb,
lib/rex/post/meterpreter/extensions/unhook/tlv.rb,
lib/rex/post/meterpreter/extensions/android/tlv.rb,
lib/rex/post/meterpreter/extensions/espia/espia.rb,
lib/rex/post/meterpreter/extensions/priv/passwd.rb,
lib/rex/post/meterpreter/extensions/sniffer/tlv.rb,
lib/rex/post/meterpreter/extensions/winpmem/tlv.rb,
lib/rex/post/meterpreter/inbound_packet_handler.rb,
lib/rex/post/meterpreter/packet_response_waiter.rb,
lib/rex/post/meterpreter/extensions/stdapi/fs/io.rb,
lib/rex/post/meterpreter/extensions/appapi/appapi.rb,
lib/rex/post/meterpreter/extensions/bofloader/tlv.rb,
lib/rex/post/meterpreter/extensions/extapi/extapi.rb,
lib/rex/post/meterpreter/extensions/incognito/tlv.rb,
lib/rex/post/meterpreter/extensions/python/python.rb,
lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb,
lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb,
lib/rex/post/meterpreter/extensions/unhook/unhook.rb,
lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb,
lib/rex/post/meterpreter/extensions/lanattacks/tlv.rb,
lib/rex/post/meterpreter/extensions/peinjector/tlv.rb,
lib/rex/post/meterpreter/extensions/powershell/tlv.rb,
lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb,
lib/rex/post/meterpreter/extensions/stdapi/mic/mic.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/arp.rb,
lib/rex/post/meterpreter/channels/pools/stream_pool.rb,
lib/rex/post/meterpreter/extensions/android/android.rb,
lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb,
lib/rex/post/meterpreter/extensions/stdapi/fs/mount.rb,
lib/rex/post/meterpreter/extensions/winpmem/winpmem.rb,
lib/rex/post/meterpreter/channels/socket_abstraction.rb,
lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb,
lib/rex/post/meterpreter/extensions/extapi/ntds/ntds.rb,
lib/rex/post/meterpreter/extensions/kiwi/command_ids.rb,
lib/rex/post/meterpreter/extensions/priv/command_ids.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/route.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/power.rb,
lib/rex/post/meterpreter/extensions/espia/command_ids.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/config.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/socket.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb,
lib/rex/post/meterpreter/extensions/appapi/command_ids.rb,
lib/rex/post/meterpreter/extensions/extapi/command_ids.rb,
lib/rex/post/meterpreter/extensions/python/command_ids.rb,
lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/netstat.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/resolve.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/tlv.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb,
lib/rex/post/meterpreter/extensions/unhook/command_ids.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher.rb,
lib/rex/post/meterpreter/extensions/android/command_ids.rb,
lib/rex/post/meterpreter/extensions/bofloader/bofloader.rb,
lib/rex/post/meterpreter/extensions/incognito/incognito.rb,
lib/rex/post/meterpreter/extensions/sniffer/command_ids.rb,
lib/rex/post/meterpreter/extensions/stdapi/fs/file_stat.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb,
lib/rex/post/meterpreter/extensions/stdapi_fs/stdapi_fs.rb,
lib/rex/post/meterpreter/extensions/stdapi_ui/stdapi_ui.rb,
lib/rex/post/meterpreter/extensions/winpmem/command_ids.rb,
lib/rex/post/meterpreter/ui/console/interactive_channel.rb,
lib/rex/post/meterpreter/extensions/extapi/window/window.rb,
lib/rex/post/meterpreter/extensions/lanattacks/dhcp/dhcp.rb,
lib/rex/post/meterpreter/extensions/lanattacks/tftp/tftp.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/interface.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb,
lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb,
lib/rex/post/meterpreter/extensions/bofloader/command_ids.rb,
lib/rex/post/meterpreter/extensions/incognito/command_ids.rb,
lib/rex/post/meterpreter/extensions/lanattacks/lanattacks.rb,
lib/rex/post/meterpreter/extensions/peinjector/peinjector.rb,
lib/rex/post/meterpreter/extensions/powershell/powershell.rb,
lib/rex/post/meterpreter/extensions/stdapi_net/stdapi_net.rb,
lib/rex/post/meterpreter/extensions/stdapi_sys/stdapi_sys.rb,
lib/rex/post/meterpreter/extensions/extapi/pageant/pageant.rb,
lib/rex/post/meterpreter/extensions/extapi/service/service.rb,
lib/rex/post/meterpreter/extensions/lanattacks/command_ids.rb,
lib/rex/post/meterpreter/extensions/peinjector/command_ids.rb,
lib/rex/post/meterpreter/extensions/powershell/command_ids.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/library.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/railgun.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/multicall.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb,
lib/rex/post/meterpreter/extensions/stdapi_audio/stdapi_audio.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/appapi.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/unhook.rb,
lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/buffer_item.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/winpmem.rb,
lib/rex/post/meterpreter/extensions/stdapi_webcam/stdapi_webcam.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/const_manager.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/platform_util.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/bofloader.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/ui.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_fs.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_ui.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/library_helper.rb,
lib/rex/post/meterpreter/extensions/stdapi_railgun/stdapi_railgun.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/peinjector.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/powershell.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/mic.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_net.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_sys.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/library_wrapper.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/osx/def_libc.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/library_function.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/io.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_audio.rb,
lib/rex/post/meterpreter/extensions/stdapi/audio_output/audio_output.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/type/pointer_util.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/window.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/stream.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_webcam.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/def_libc.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi_railgun.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/osx/def_libobjc.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/tftp.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/osx/api_constants.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_psapi.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_user32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ws2_32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/api_constants.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_crypt32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_dbghelp.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_secur32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_shell32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_spoolss.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_version.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_wlanapi.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_wldap32.rb,
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/audio_output.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_advapi32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_iphlpapi.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_kernel32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_netapi32.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_winspool.rb,
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/api_constants.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/event_log_subsystem/event_record.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel.rb,
lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb,
lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb

Defined Under Namespace

Modules: Channels, Extensions, HttpPacketDispatcher, InboundPacketHandler, ObjectAliasesContainer, PacketDispatcher, PivotContainer, SocketAbstraction, Ui Classes: Channel, Client, ClientCore, CommandMapper, Datagram, Extension, ExtensionLoadError, ExtensionMapper, GroupTlv, ObjectAliases, Packet, PacketParser, PacketResponseWaiter, Pivot, PivotListener, RequestError, Stream, Tlv

Constant Summary collapse

PACKET_TYPE_REQUEST =

Constants

0
PACKET_TYPE_RESPONSE = 
1
PACKET_TYPE_CONFIG = 
2
PACKET_TYPE_PLAIN_REQUEST = 
10
PACKET_TYPE_PLAIN_RESPONSE = 
11
TLV_META_TYPE_NONE =

TLV Meta Types

0
TLV_META_TYPE_STRING = 
(1 << 16)
TLV_META_TYPE_UINT = 
(1 << 17)
TLV_META_TYPE_RAW = 
(1 << 18)
TLV_META_TYPE_BOOL = 
(1 << 19)
TLV_META_TYPE_QWORD = 
(1 << 20)
TLV_META_TYPE_COMPRESSED = 
(1 << 29)
TLV_META_TYPE_GROUP = 
(1 << 30)
TLV_META_TYPE_COMPLEX = 
(1 << 31)
TLV_META_MASK =

Exclude compressed from the mask since other meta types (e.g. RAW) can also be compressed

(
  TLV_META_TYPE_STRING |
  TLV_META_TYPE_UINT |
  TLV_META_TYPE_RAW |
  TLV_META_TYPE_BOOL |
  TLV_META_TYPE_QWORD |
  TLV_META_TYPE_GROUP |
  TLV_META_TYPE_COMPLEX
)
TLV_RESERVED =

TLV base starting points

0
TLV_EXTENSIONS = 
20000
TLV_USER = 
40000
TLV_TEMP = 
60000
TLV_TYPE_ANY =

TLV Specific Types

TLV_META_TYPE_NONE   |   0
TLV_TYPE_COMMAND_ID = 
TLV_META_TYPE_UINT   |   1
TLV_TYPE_REQUEST_ID = 
TLV_META_TYPE_STRING |   2
TLV_TYPE_EXCEPTION = 
TLV_META_TYPE_GROUP  |   3
TLV_TYPE_RESULT = 
TLV_META_TYPE_UINT   |   4
TLV_TYPE_STRING = 
TLV_META_TYPE_STRING |  10
TLV_TYPE_UINT = 
TLV_META_TYPE_UINT   |  11
TLV_TYPE_BOOL = 
TLV_META_TYPE_BOOL   |  12
TLV_TYPE_LENGTH = 
TLV_META_TYPE_UINT   |  25
TLV_TYPE_DATA = 
TLV_META_TYPE_RAW    |  26
TLV_TYPE_FLAGS = 
TLV_META_TYPE_UINT   |  27
TLV_TYPE_CHANNEL_ID = 
TLV_META_TYPE_UINT   |  50
TLV_TYPE_CHANNEL_TYPE = 
TLV_META_TYPE_STRING |  51
TLV_TYPE_CHANNEL_DATA = 
TLV_META_TYPE_RAW    |  52
TLV_TYPE_CHANNEL_DATA_GROUP = 
TLV_META_TYPE_GROUP  |  53
TLV_TYPE_CHANNEL_CLASS = 
TLV_META_TYPE_UINT   |  54
TLV_TYPE_CHANNEL_PARENTID = 
TLV_META_TYPE_UINT   |  55
TLV_TYPE_SEEK_WHENCE = 
TLV_META_TYPE_UINT   |  70
TLV_TYPE_SEEK_OFFSET = 
TLV_META_TYPE_UINT   |  71
TLV_TYPE_SEEK_POS = 
TLV_META_TYPE_UINT   |  72
TLV_TYPE_EXCEPTION_CODE = 
TLV_META_TYPE_UINT   | 300
TLV_TYPE_EXCEPTION_STRING = 
TLV_META_TYPE_STRING | 301
TLV_TYPE_LIBRARY_PATH = 
TLV_META_TYPE_STRING | 400
TLV_TYPE_TARGET_PATH = 
TLV_META_TYPE_STRING | 401
TLV_TYPE_MIGRATE_PID = 
TLV_META_TYPE_UINT   | 402
TLV_TYPE_MIGRATE_PAYLOAD = 
TLV_META_TYPE_RAW    | 404
TLV_TYPE_MIGRATE_ARCH = 
TLV_META_TYPE_UINT   | 405
TLV_TYPE_MIGRATE_BASE_ADDR = 
TLV_META_TYPE_UINT   | 407
TLV_TYPE_MIGRATE_ENTRY_POINT = 
TLV_META_TYPE_UINT   | 408
TLV_TYPE_MIGRATE_SOCKET_PATH = 
TLV_META_TYPE_STRING | 409
TLV_TYPE_MIGRATE_STUB = 
TLV_META_TYPE_RAW    | 411
TLV_TYPE_LIB_LOADER_NAME = 
TLV_META_TYPE_STRING | 412
TLV_TYPE_LIB_LOADER_ORDINAL = 
TLV_META_TYPE_UINT   | 413
TLV_TYPE_MACHINE_ID = 
TLV_META_TYPE_STRING | 460
TLV_TYPE_UUID = 
TLV_META_TYPE_RAW    | 461
TLV_TYPE_SESSION_GUID = 
TLV_META_TYPE_RAW    | 462
TLV_TYPE_RSA_PUB_KEY = 
TLV_META_TYPE_RAW    | 550
TLV_TYPE_SYM_KEY_TYPE = 
TLV_META_TYPE_UINT   | 551
TLV_TYPE_SYM_KEY = 
TLV_META_TYPE_RAW    | 552
TLV_TYPE_ENC_SYM_KEY = 
TLV_META_TYPE_RAW    | 553
TLV_TYPE_PIVOT_ID =

Pivots

TLV_META_TYPE_RAW    |  650
TLV_TYPE_PIVOT_STAGE_DATA = 
TLV_META_TYPE_RAW    |  651
TLV_TYPE_PIVOT_NAMED_PIPE_NAME = 
TLV_META_TYPE_STRING |  653
TLV_TYPE_SESSION_EXPIRY =

Configuration & C2 options

TLV_META_TYPE_UINT   | 700
TLV_TYPE_EXITFUNC =

Session expiration time

TLV_META_TYPE_UINT   | 701
TLV_TYPE_DEBUG_LOG =

identifier of the exit function to use

TLV_META_TYPE_STRING | 702
TLV_TYPE_EXTENSION =

path to write debug log

TLV_META_TYPE_GROUP  | 703
TLV_TYPE_C2 =

Group containing extension info

TLV_META_TYPE_GROUP  | 704
TLV_TYPE_C2_COMM_TIMEOUT =

a C2/transport grouping

TLV_META_TYPE_UINT   | 705
TLV_TYPE_C2_RETRY_TOTAL =

the timeout for this C2 group

TLV_META_TYPE_UINT   | 706
TLV_TYPE_C2_RETRY_WAIT =

number of times to retry this C2

TLV_META_TYPE_UINT   | 707
TLV_TYPE_C2_URL =

how long to wait between reconnect attempts

TLV_META_TYPE_STRING | 708
TLV_TYPE_C2_URI =

base URL of this C2 (scheme://host:port/uri)

TLV_META_TYPE_STRING | 709
TLV_TYPE_C2_PROXY_URL =

URI to append to base URL (for HTTP(s)), if any

TLV_META_TYPE_STRING | 710
TLV_TYPE_C2_PROXY_USER =

Proxy URL

TLV_META_TYPE_STRING | 711
TLV_TYPE_C2_PROXY_PASS =

Proxy user name

TLV_META_TYPE_STRING | 712
TLV_TYPE_C2_GET =

Proxy password

TLV_META_TYPE_GROUP  | 713
TLV_TYPE_C2_POST =

A grouping of params associated with GET requests

TLV_META_TYPE_GROUP  | 714
TLV_TYPE_C2_HEADERS =

A grouping of params associated with POST requests

TLV_META_TYPE_STRING | 715
TLV_TYPE_C2_UA =

Custom headers

TLV_META_TYPE_STRING | 716
TLV_TYPE_C2_CERT_HASH =

User agent

TLV_META_TYPE_RAW    | 717
TLV_TYPE_C2_PREFIX =

Expected SSL certificate hash

TLV_META_TYPE_RAW    | 718
TLV_TYPE_C2_SUFFIX =

Data to prepend to the outgoing payload

TLV_META_TYPE_RAW    | 719
TLV_TYPE_C2_ENC_INBOUND =

Data to append to the outgoing payload

TLV_META_TYPE_UINT   | 720
TLV_TYPE_C2_PREFIX_SKIP =

Server-inbound (client->server) body/metadata encoding

TLV_META_TYPE_UINT   | 721
TLV_TYPE_C2_SUFFIX_SKIP =

Size of prefix to skip (in bytes)

TLV_META_TYPE_UINT   | 722
TLV_META_TYPE_STRING | 723
TLV_TYPE_C2_UUID_GET =

Name of the cookie to put the UUID in

TLV_META_TYPE_STRING | 724
TLV_TYPE_C2_UUID_HEADER =

Name of the GET parameter to put the UUID in

TLV_META_TYPE_STRING | 725
TLV_TYPE_C2_UUID =

Name of the header to put the UUID in

TLV_META_TYPE_STRING | 726
TLV_TYPE_SESSION_FLAGS =

string representation of the UUID for C2s

TLV_META_TYPE_UINT   | 727
TLV_TYPE_C2_ENC_OUTBOUND =

session-level config flags (e.g. FLAG_STAGELESS, FLAG_DEBUG)

TLV_META_TYPE_UINT   | 728
TLV_TYPE_C2_ENC_UUID =

Client->server (request) body encoding (POST only)

TLV_META_TYPE_UINT   | 729
TLV_TYPE_C2_UUID_PREFIX =

Encoding applied to the UUID before placement (URL/header/cookie)

TLV_META_TYPE_STRING | 730
TLV_TYPE_C2_UUID_SUFFIX =

String to prepend to the encoded UUID

TLV_META_TYPE_STRING | 731
C2_ENCODING_NONE =

C2 Encoding flags

0
C2_ENCODING_B64 =

No encoding at all

1
C2_ENCODING_B64URL =

Base64 encoding

2
C2_ENCODING_URL =

Base64 encoding with URI-safe characters

3
LOAD_LIBRARY_FLAG_ON_DISK =

Core flags

(1 << 0)
LOAD_LIBRARY_FLAG_EXTENSION = 
(1 << 1)
LOAD_LIBRARY_FLAG_LOCAL = 
(1 << 2)
GUID_SIZE =

Sane defaults

16
NULL_GUID = 
"\x00" * GUID_SIZE
CHANNEL_CLASS_STREAM =

The various types of channels

1
CHANNEL_CLASS_DATAGRAM = 
2
CHANNEL_CLASS_POOL = 
3
CHANNEL_FLAG_SYNCHRONOUS =

The various flags that can affect how the channel operates

CHANNEL_FLAG_SYNCHRONOUS
   Specifies that I/O requests on the channel are blocking.

CHANNEL_FLAG_COMPRESS
   Specifies that I/O requests on the channel have their data zlib compressed.

(1 << 0)
CHANNEL_FLAG_COMPRESS = 
(1 << 1)
CHANNEL_DIO_READ =

The core types of direct I/O requests

'read'
CHANNEL_DIO_WRITE = 
'write'
CHANNEL_DIO_CLOSE = 
'close'
COMMAND_ID_RANGE =

Effectively maps to the number of commands an extension can have. Each extension ID starts at a range boundary and is used to identify extensions.

1000
EXTENSION_ID_CORE =

ID for the extension (needs to be a multiple of 1000)

0
COMMAND_ID_CORE_CHANNEL_CLOSE = 
EXTENSION_ID_CORE + 1
COMMAND_ID_CORE_CHANNEL_EOF = 
EXTENSION_ID_CORE + 2
COMMAND_ID_CORE_CHANNEL_INTERACT = 
EXTENSION_ID_CORE + 3
COMMAND_ID_CORE_CHANNEL_OPEN = 
EXTENSION_ID_CORE + 4
COMMAND_ID_CORE_CHANNEL_READ = 
EXTENSION_ID_CORE + 5
COMMAND_ID_CORE_CHANNEL_SEEK = 
EXTENSION_ID_CORE + 6
COMMAND_ID_CORE_CHANNEL_TELL = 
EXTENSION_ID_CORE + 7
COMMAND_ID_CORE_CHANNEL_WRITE = 
EXTENSION_ID_CORE + 8
COMMAND_ID_CORE_CONSOLE_WRITE = 
EXTENSION_ID_CORE + 9
COMMAND_ID_CORE_ENUMEXTCMD = 
EXTENSION_ID_CORE + 10
COMMAND_ID_CORE_GET_SESSION_GUID = 
EXTENSION_ID_CORE + 11
COMMAND_ID_CORE_LOADLIB = 
EXTENSION_ID_CORE + 12
COMMAND_ID_CORE_MACHINE_ID = 
EXTENSION_ID_CORE + 13
COMMAND_ID_CORE_MIGRATE = 
EXTENSION_ID_CORE + 14
COMMAND_ID_CORE_NATIVE_ARCH = 
EXTENSION_ID_CORE + 15
COMMAND_ID_CORE_NEGOTIATE_TLV_ENCRYPTION = 
EXTENSION_ID_CORE + 16
COMMAND_ID_CORE_PATCH_UUID = 
EXTENSION_ID_CORE + 17
COMMAND_ID_CORE_PIVOT_ADD = 
EXTENSION_ID_CORE + 18
COMMAND_ID_CORE_PIVOT_REMOVE = 
EXTENSION_ID_CORE + 19
COMMAND_ID_CORE_PIVOT_SESSION_DIED = 
EXTENSION_ID_CORE + 20
COMMAND_ID_CORE_SET_SESSION_GUID = 
EXTENSION_ID_CORE + 21
COMMAND_ID_CORE_SET_UUID = 
EXTENSION_ID_CORE + 22
COMMAND_ID_CORE_SHUTDOWN = 
EXTENSION_ID_CORE + 23
COMMAND_ID_CORE_TRANSPORT_ADD = 
EXTENSION_ID_CORE + 24
COMMAND_ID_CORE_TRANSPORT_CHANGE = 
EXTENSION_ID_CORE + 25
COMMAND_ID_CORE_TRANSPORT_GETCERTHASH = 
EXTENSION_ID_CORE + 26
COMMAND_ID_CORE_TRANSPORT_LIST = 
EXTENSION_ID_CORE + 27
COMMAND_ID_CORE_TRANSPORT_NEXT = 
EXTENSION_ID_CORE + 28
COMMAND_ID_CORE_TRANSPORT_PREV = 
EXTENSION_ID_CORE + 29
COMMAND_ID_CORE_TRANSPORT_REMOVE = 
EXTENSION_ID_CORE + 30
COMMAND_ID_CORE_TRANSPORT_SETCERTHASH = 
EXTENSION_ID_CORE + 31
COMMAND_ID_CORE_TRANSPORT_SET_TIMEOUTS = 
EXTENSION_ID_CORE + 32
COMMAND_ID_CORE_TRANSPORT_SLEEP = 
EXTENSION_ID_CORE + 33
COMMAND_ID_CORE_PIVOT_SESSION_NEW = 
EXTENSION_ID_CORE + 34

Class Method Summary collapse

Class Method Details

.generate_command_id_map_c ⇒ Object 



168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
 
# File 'lib/rex/post/meterpreter/packet.rb', line 168

def self.generate_command_id_map_c
  id_map = CommandMapper.get_commands(*%w{
    core
    stdapi
    priv
    extapi
    sniffer
    winpmem
    kiwi
    unhook
    espia
    incognito
    python
    powershell
    lanattacks
    peinjector
  })

  command_ids = id_map.map {|k, v| "#define COMMAND_ID_#{k.upcase} #{v}"}
  %Q^
/*!
 * @file common_command_ids.h
 * @brief Declarations of command ID values
 * @description This file was generated #{::Time.now.utc}. Do not modify directly.
 */
#ifndef _METERPRETER_SOURCE_COMMON_COMMAND_IDS_H
#define _METERPRETER_SOURCE_COMMON_COMMAND_IDS_H

#{command_ids.join("\n")}

#endif
  ^
end

.generate_command_id_map_csharp ⇒ Object 



279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
 
# File 'lib/rex/post/meterpreter/packet.rb', line 279

def self.generate_command_id_map_csharp
  id_map = CommandMapper.get_commands(*%w{
    core
    stdapi
    priv
    extapi
    sniffer
    winpmem
    kiwi
    unhook
    espia
    incognito
    python
    powershell
    lanattacks
    peinjector
  })
  command_ids = id_map.map {|k, v| "#{k.split('_').map(&:capitalize).join} = #{v},"}
  %Q^
/// <summary>
// This content was generated by a tool @ #{::Time.now.utc}
/// </summary>
namespace MSF.Powershell.Meterpreter
{
    public enum CommandId
    {
        #{command_ids.join("\n        ")}
    }
}
  ^
end

.generate_command_id_map_java ⇒ Object 



202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
 
# File 'lib/rex/post/meterpreter/packet.rb', line 202

def self.generate_command_id_map_java
  id_map = CommandMapper.get_commands(*%w{ core stdapi })
  command_ids = id_map.map {|k, v| "    public static final int #{k.upcase} = #{v};"}
  %Q^
package com.metasploit.meterpreter.command;

/**
 * All supported Command Identifiers
 *
 * @author Generated by a tool @ #{::Time.now.utc}
 */
public interface CommandId {
#{command_ids.join("\n")}
}
  ^
end

.generate_command_id_map_php ⇒ Object 



230
231
232
233
234
235
236
 
# File 'lib/rex/post/meterpreter/packet.rb', line 230

def self.generate_command_id_map_php
  %Q^
#{self.generate_command_id_map_php_lib('metsrv', CommandMapper.get_commands('core'))}

#{self.generate_command_id_map_php_lib('stdapi', CommandMapper.get_commands('stdapi'))}
  ^
end

.generate_command_id_map_php_lib(lib, id_map) ⇒ Object 



219
220
221
222
223
224
225
226
227
228
 
# File 'lib/rex/post/meterpreter/packet.rb', line 219

def self.generate_command_id_map_php_lib(lib, id_map)
  command_ids = id_map.map {|k, v| "define('COMMAND_ID_#{k.upcase}', #{v});"}
  %Q^
# ---------------------------------------------------------------
# --- THIS CONTENT WAS GENERATED BY A TOOL @ #{::Time.now.utc}
# IDs for #{lib}
#{command_ids.join("\n")}
# ---------------------------------------------------------------
  ^
end

.generate_command_id_map_python ⇒ Object 



238
239
240
241
242
243
244
245
246
247
248
249
 
# File 'lib/rex/post/meterpreter/packet.rb', line 238

def self.generate_command_id_map_python
  id_map = CommandMapper.get_commands(*%w{ core stdapi })
  command_ids = id_map.map {|k, v| "    (#{v}, '#{k.downcase}'),"}
  %Q^
# ---------------------------------------------------------------
# --- THIS CONTENT WAS GENERATED BY A TOOL @ #{::Time.now.utc}
COMMAND_IDS = (
#{command_ids.join("\n")}
)
# ---------------------------------------------------------------
  ^
end

.generate_command_id_map_python_extension ⇒ Object 



251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
 
# File 'lib/rex/post/meterpreter/packet.rb', line 251

def self.generate_command_id_map_python_extension
  id_map = CommandMapper.get_commands(*%w{
    core
    stdapi
    priv
    extapi
    sniffer
    winpmem
    kiwi
    unhook
    espia
    incognito
    python
    powershell
    lanattacks
    peinjector
  })
  command_ids = id_map.map {|k, v| "COMMAND_ID_#{k.upcase} = #{v}"}
  %Q^
# ---------------------------------------------------------------
# --- THIS CONTENT WAS GENERATED BY A TOOL @ #{::Time.now.utc}

#{command_ids.join("\n")}

# ---------------------------------------------------------------
  ^
end