Class: Rex::Post::Meterpreter::Channel
- Inherits:
-
Object
- Object
- Rex::Post::Meterpreter::Channel
- Extended by:
- InboundPacketHandler
- Defined in:
- lib/rex/post/meterpreter/channel.rb
Overview
The channel class represents a logical data pipe that exists between the client and the server. The purpose and behavior of the channel depends on which type it is. The three basic types of channels are streams, datagrams, and pools. Streams are basically equivalent to a TCP connection. Bidirectional, connection-oriented streams. Datagrams are basically equivalent to a UDP session. Bidirectional, connectionless. Pools are basically equivalent to a uni-directional connection, like a file handle. Pools denote channels that only have requests flowing in one direction.
Direct Known Subclasses
Rex::Post::Meterpreter::Channels::Pool, Datagram, Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel, Stream
Instance Attribute Summary collapse
-
#cid ⇒ Object
The unique channel identifier.
-
#client ⇒ Object
The associated meterpreter client instance.
-
#cls ⇒ Object
The class of channel (stream, datagram, pool).
-
#flags ⇒ Object
Any channel-specific flag, like synchronous IO.
-
#params ⇒ Object
Any channel-specific parameters.
-
#type ⇒ Object
The type of channel.
Class Method Summary collapse
-
._close(client, cid, addends = nil) ⇒ Object
Closes the channel.
-
.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil, **klass_kwargs) ⇒ Object
Creates a logical channel between the client and the server based on a given type.
- .finalize(client, cid) ⇒ Object
-
.request_handler(client, packet) ⇒ Object
Class request handler for all channels that dispatches requests to the appropriate class instance's DIO handler.
Instance Method Summary collapse
- #_close(addends = nil) ⇒ Object
-
#_read(length = nil, addends = nil) ⇒ Object
Reads data from the remote half of the channel.
-
#_write(buf, length = nil, addends = nil) ⇒ Object
Writes data to the remote half of the channel.
-
#cleanup ⇒ Object
protected
Cleans up any lingering resources.
-
#close(addends = nil) ⇒ Object
Wrapper around the low-level close.
-
#close_read ⇒ Object
Close the channel for future reads.
-
#close_write ⇒ Object
Close the channel for future writes.
-
#closed? ⇒ Boolean
Wrapper around check for self.cid.
-
#dio_close_handler(packet) ⇒ Object
Stub close handler.
-
#dio_handler(dio, packet) ⇒ Object
Handles dispatching I/O requests based on the request packet.
-
#dio_map(command_id) ⇒ Object
Maps packet request methods to DIO request identifiers on a per-instance basis as other instances may add custom dio handlers.
-
#dio_read_handler(packet, length) ⇒ Object
Stub read handler.
-
#dio_write_handler(packet, data) ⇒ Object
Stub write handler.
-
#flag?(flag) ⇒ Boolean
Checks to see if a flag is set on the instance's flags attribute.
-
#initialize(client, cid, type, flags, packet, **_) ⇒ Channel
constructor
Initializes the instance's attributes, such as client context, class identifier, type, and flags.
-
#interactive(tf = true, addends = nil) ⇒ Object
Enables or disables interactive mode.
-
#read(length = nil, addends = nil) ⇒ Object
Wrapper around the low-level channel read operation.
-
#synchronous? ⇒ Boolean
Returns whether or not the channel is operating synchronously.
-
#write(buf, length = nil, addends = nil) ⇒ Object
Wrapper around the low-level write.
Methods included from InboundPacketHandler
request_handler, response_handler
Constructor Details
#initialize(client, cid, type, flags, packet, **_) ⇒ Channel
Initializes the instance's attributes, such as client context, class identifier, type, and flags.
137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 |
# File 'lib/rex/post/meterpreter/channel.rb', line 137 def initialize(client, cid, type, flags, packet, **_) self.client = client self.cid = cid self.type = type self.flags = flags @mutex = Mutex.new # Add this instance to the list if (cid and client) client.add_channel(self) end # Ensure the remote object is closed when all references are removed ObjectSpace.define_finalizer(self, self.class.finalize(client, cid)) end |
Instance Attribute Details
#cid ⇒ Object
The unique channel identifier.
436 437 438 |
# File 'lib/rex/post/meterpreter/channel.rb', line 436 def cid @cid end |
#client ⇒ Object
The associated meterpreter client instance
456 457 458 |
# File 'lib/rex/post/meterpreter/channel.rb', line 456 def client @client end |
#cls ⇒ Object
The class of channel (stream, datagram, pool).
444 445 446 |
# File 'lib/rex/post/meterpreter/channel.rb', line 444 def cls @cls end |
#flags ⇒ Object
Any channel-specific flag, like synchronous IO.
448 449 450 |
# File 'lib/rex/post/meterpreter/channel.rb', line 448 def flags @flags end |
#params ⇒ Object
Any channel-specific parameters.
452 453 454 |
# File 'lib/rex/post/meterpreter/channel.rb', line 452 def params @params end |
#type ⇒ Object
The type of channel.
440 441 442 |
# File 'lib/rex/post/meterpreter/channel.rb', line 440 def type @type end |
Class Method Details
._close(client, cid, addends = nil) ⇒ Object
Closes the channel.
288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 |
# File 'lib/rex/post/meterpreter/channel.rb', line 288 def self._close(client, cid, addends=nil) if cid.nil? raise IOError, "Channel has been closed.", caller end request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_CLOSE) # Populate the request request.add_tlv(TLV_TYPE_CHANNEL_ID, cid) request.add_tlvs(addends) client.send_request(request, nil) # Disassociate this channel instance client.remove_channel(cid) return true end |
.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil, **klass_kwargs) ⇒ Object
Creates a logical channel between the client and the server based on a given type.
95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 |
# File 'lib/rex/post/meterpreter/channel.rb', line 95 def Channel.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil, **klass_kwargs) request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_OPEN) # Set the type of channel that we're allocating if !type.nil? request.add_tlv(TLV_TYPE_CHANNEL_TYPE, type) end # If no factory class was provided, use the default native class if klass.nil? klass = self end request.add_tlv(TLV_TYPE_CHANNEL_CLASS, klass.cls) request.add_tlv(TLV_TYPE_FLAGS, flags) request.add_tlvs(addends) # Transmit the request and wait for the response cid = nil begin response = client.send_request(request) cid = response.get_tlv_value(TLV_TYPE_CHANNEL_ID) if cid.nil? raise Rex::Post::Meterpreter::RequestError end end # Create the channel instance klass.new(client, cid, type, flags, response, **klass_kwargs) end |
.finalize(client, cid) ⇒ Object
153 154 155 156 157 158 159 |
# File 'lib/rex/post/meterpreter/channel.rb', line 153 def self.finalize(client, cid) proc { unless cid.nil? self._close(client, cid) end } end |
.request_handler(client, packet) ⇒ Object
Class request handler for all channels that dispatches requests to the appropriate class instance's DIO handler
55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 |
# File 'lib/rex/post/meterpreter/channel.rb', line 55 def request_handler(client, packet) cid = packet.get_tlv_value(TLV_TYPE_CHANNEL_ID) # No channel identifier, then drop it if cid.nil? return false end channel = client.find_channel(cid) # No valid channel context? The channel may not be registered yet if channel.nil? return false end dio = channel.dio_map(packet.method) # Supported DIO request? Dump it. if dio.nil? return true end # Call the channel's dio handler and return success or fail # based on what happens channel.dio_handler(dio, packet) end |
Instance Method Details
#_close(addends = nil) ⇒ Object
307 308 309 310 311 312 313 314 315 316 |
# File 'lib/rex/post/meterpreter/channel.rb', line 307 def _close(addends = nil) # let the finalizer do the work behind the scenes @mutex.synchronize { unless self.cid.nil? ObjectSpace.undefine_finalizer(self) self.class._close(self.client, self.cid, addends) self.cid = nil end } end |
#_read(length = nil, addends = nil) ⇒ Object
Reads data from the remote half of the channel.
178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 |
# File 'lib/rex/post/meterpreter/channel.rb', line 178 def _read(length = nil, addends = nil) if self.cid.nil? raise IOError, "Channel has been closed.", caller end request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_READ) if length.nil? # Default block size to a higher amount for passive dispatcher length = self.client.passive_service ? (1024*1024) : 65536 end request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid) request.add_tlv(TLV_TYPE_LENGTH, length) request.add_tlvs(addends) begin response = self.client.send_request(request) rescue return nil end # If the channel is in synchronous mode, the response should contain # data that was read from the remote side of the channel if (flag?(CHANNEL_FLAG_SYNCHRONOUS)) data = response.get_tlv(TLV_TYPE_CHANNEL_DATA); if (data != nil) return data.value end else raise NotImplementedError, "Asynchronous channel mode is not implemented", caller end return nil end |
#_write(buf, length = nil, addends = nil) ⇒ Object
Writes data to the remote half of the channel.
225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 |
# File 'lib/rex/post/meterpreter/channel.rb', line 225 def _write(buf, length = nil, addends = nil) if self.cid.nil? raise IOError, "Channel has been closed.", caller end request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_WRITE) # Truncation and celebration if ((length != nil) && (buf.length >= length)) buf = buf[0..length] else length = buf.length end # Populate the request request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid) cdata = request.add_tlv(TLV_TYPE_CHANNEL_DATA, buf) if( ( self.flags & CHANNEL_FLAG_COMPRESS ) == CHANNEL_FLAG_COMPRESS ) cdata.compress = true end request.add_tlv(TLV_TYPE_LENGTH, length) request.add_tlvs(addends) response = self.client.send_request(request) written = response.get_tlv(TLV_TYPE_LENGTH) written.nil? ? 0 : written.value end |
#cleanup ⇒ Object (protected)
Cleans up any lingering resources
465 466 |
# File 'lib/rex/post/meterpreter/channel.rb', line 465 def cleanup end |
#close(addends = nil) ⇒ Object
Wrapper around the low-level close.
267 268 269 |
# File 'lib/rex/post/meterpreter/channel.rb', line 267 def close(addends = nil) return _close(addends) end |
#close_read ⇒ Object
Close the channel for future reads.
281 282 283 |
# File 'lib/rex/post/meterpreter/channel.rb', line 281 def close_read return _close end |
#close_write ⇒ Object
Close the channel for future writes.
274 275 276 |
# File 'lib/rex/post/meterpreter/channel.rb', line 274 def close_write return _close end |
#closed? ⇒ Boolean
Wrapper around check for self.cid
260 261 262 |
# File 'lib/rex/post/meterpreter/channel.rb', line 260 def closed? self.cid.nil? end |
#dio_close_handler(packet) ⇒ Object
Stub close handler.
379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 |
# File 'lib/rex/post/meterpreter/channel.rb', line 379 def dio_close_handler(packet) temp_cid = nil @mutex.synchronize { temp_cid = self.cid self.cid = nil } client.remove_channel(temp_cid) # Trap IOErrors as parts of the channel may have already been closed begin self.cleanup rescue IOError end return true end |
#dio_handler(dio, packet) ⇒ Object
Handles dispatching I/O requests based on the request packet. The default implementation does nothing with direct I/O requests.
347 348 349 350 351 352 353 354 355 356 357 358 359 360 |
# File 'lib/rex/post/meterpreter/channel.rb', line 347 def dio_handler(dio, packet) if (dio == CHANNEL_DIO_READ) length = packet.get_tlv_value(TLV_TYPE_LENGTH) return dio_read_handler(packet, length) elsif (dio == CHANNEL_DIO_WRITE) data = packet.get_tlv_value(TLV_TYPE_CHANNEL_DATA) return dio_write_handler(packet, data) elsif (dio == CHANNEL_DIO_CLOSE) return dio_close_handler(packet) end return false; end |
#dio_map(command_id) ⇒ Object
Maps packet request methods to DIO request identifiers on a per-instance basis as other instances may add custom dio handlers.
401 402 403 404 405 406 407 408 409 410 411 |
# File 'lib/rex/post/meterpreter/channel.rb', line 401 def dio_map(command_id) if command_id == COMMAND_ID_CORE_CHANNEL_READ return CHANNEL_DIO_READ elsif command_id == COMMAND_ID_CORE_CHANNEL_WRITE return CHANNEL_DIO_WRITE elsif command_id == COMMAND_ID_CORE_CHANNEL_CLOSE return CHANNEL_DIO_CLOSE end return nil end |
#dio_read_handler(packet, length) ⇒ Object
Stub read handler.
365 366 367 |
# File 'lib/rex/post/meterpreter/channel.rb', line 365 def dio_read_handler(packet, length) return true end |
#dio_write_handler(packet, data) ⇒ Object
Stub write handler.
372 373 374 |
# File 'lib/rex/post/meterpreter/channel.rb', line 372 def dio_write_handler(packet, data) return true end |
#flag?(flag) ⇒ Boolean
Checks to see if a flag is set on the instance's flags attribute.
422 423 424 |
# File 'lib/rex/post/meterpreter/channel.rb', line 422 def flag?(flag) return ((self.flags & flag) == flag) end |
#interactive(tf = true, addends = nil) ⇒ Object
Enables or disables interactive mode.
320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 |
# File 'lib/rex/post/meterpreter/channel.rb', line 320 def interactive(tf = true, addends = nil) if self.cid.nil? raise IOError, "Channel has been closed.", caller end request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_INTERACT) # Populate the request request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid) request.add_tlv(TLV_TYPE_BOOL, tf) request.add_tlvs(addends) self.client.send_request(request) return true end |
#read(length = nil, addends = nil) ⇒ Object
Wrapper around the low-level channel read operation.
171 172 173 |
# File 'lib/rex/post/meterpreter/channel.rb', line 171 def read(length = nil, addends = nil) return _read(length, addends) end |
#synchronous? ⇒ Boolean
Returns whether or not the channel is operating synchronously.
429 430 431 |
# File 'lib/rex/post/meterpreter/channel.rb', line 429 def synchronous? return (self.flags & CHANNEL_FLAG_SYNCHRONOUS) end |
#write(buf, length = nil, addends = nil) ⇒ Object
Wrapper around the low-level write.
218 219 220 |
# File 'lib/rex/post/meterpreter/channel.rb', line 218 def write(buf, length = nil, addends = nil) return _write(buf, length, addends) end |