Class: Rex::Post::Meterpreter::Tlv

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/packet.rb

Overview

Base TLV (Type-Length-Value) class

Direct Known Subclasses

GroupTlv

Constant Summary collapse

HEADER_SIZE = 
8

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(type, value = nil, compress = false) ⇒ Tlv

Returns an instance of a TLV.



330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
 
# File 'lib/rex/post/meterpreter/packet.rb', line 330

def initialize(type, value = nil, compress=false)
  @type     = type
  @compress = compress

  if (value != nil)
    if (type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
      if (value.kind_of?(Integer))
        @value = value.to_s
      else
        @value = value.dup
      end
    else
      @value = value
    end
  end
end

Instance Attribute Details

#compress ⇒ Object

Returns the value of attribute compress.



317
318
319
 
# File 'lib/rex/post/meterpreter/packet.rb', line 317

def compress
  @compress
end

#type ⇒ Object

Returns the value of attribute type.



317
318
319
 
# File 'lib/rex/post/meterpreter/packet.rb', line 317

def type
  @type
end

#value ⇒ Object

Returns the value of attribute value.



317
318
319
 
# File 'lib/rex/post/meterpreter/packet.rb', line 317

def value
  @value
end

Instance Method Details

#_tlv_type_string(value) ⇒ Object 



347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
 
# File 'lib/rex/post/meterpreter/packet.rb', line 347

def _tlv_type_string(value)
  tlv_names = ::Rex::Post::Meterpreter::CommandMapper.get_tlv_names(value).map { |name| name.to_s.gsub('TLV_TYPE_', '').gsub('PACKET_TYPE_', '') }

  case tlv_names.length
  when 0
    "unknown-#{value}"
  when 1
    tlv_names.first
  else
    # In the off-chance we have multiple TLV types which have the same value
    # https://github.com/rapid7/metasploit-framework/issues/16267
    # Sort it to ensure consistency across tests
    "oneOf(#{tlv_names.sort_by(&:to_s).join(',')})"
  end
end

#from_r(raw) ⇒ Object

Translates the raw format of the TLV into a sanitize version.



509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
 
# File 'lib/rex/post/meterpreter/packet.rb', line 509

def from_r(raw)
  self.value  = nil

  length, self.type = raw.unpack("NN");

  # check if the tlv value has been compressed...
  if( self.type & TLV_META_TYPE_COMPRESSED == TLV_META_TYPE_COMPRESSED )
    # set this TLV as using compression
    @compress = true
    # remove the TLV_META_TYPE_COMPRESSED flag from the tlv type to restore the
    # tlv type to its original, allowing for transparent data compression.
    self.type = self.type ^ TLV_META_TYPE_COMPRESSED
    # decompress the compressed data (skipping the length and type DWORD's)
    raw_decompressed = Rex::Text.zlib_inflate( raw[HEADER_SIZE..length-1] )
    # update the length to reflect the decompressed data length (+HEADER_SIZE for the length and type DWORD's)
    length = raw_decompressed.length + HEADER_SIZE
    # update the raw buffer with the new length, decompressed data and updated type.
    raw = [length, self.type].pack("NN") + raw_decompressed
  end

  if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
    if (raw.length > 0)
      self.value = raw[HEADER_SIZE..length-2]
    else
      self.value = nil
    end
  elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
    self.value = raw.unpack("NNN")[2]
  elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
    self.value = raw.unpack("NNQ<")[2]
    self.value = self.ntohq( self.value )
  elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
    self.value = raw.unpack("NNc")[2]

    if (self.value == 1)
      self.value = true
    else
      self.value = false
    end
  else
    self.value = raw[HEADER_SIZE..length-1]
  end

  length
end

#htonq(value) ⇒ Object (protected) 



557
558
559
560
561
562
563
 
# File 'lib/rex/post/meterpreter/packet.rb', line 557

def htonq(value)
  if [1].pack( 's' ) == [1].pack('n')
    return value
  else
    [value].pack('Q<').reverse.unpack('Q<').first
  end
end

#inspect ⇒ Object 



363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
 
# File 'lib/rex/post/meterpreter/packet.rb', line 363

def inspect
  utype = type ^ TLV_META_TYPE_COMPRESSED
  group = false
  meta = case (utype & TLV_META_MASK)
    when TLV_META_TYPE_STRING; "STRING"
    when TLV_META_TYPE_UINT; "INT"
    when TLV_META_TYPE_RAW; "RAW"
    when TLV_META_TYPE_BOOL; "BOOL"
    when TLV_META_TYPE_QWORD; "QWORD"
    when TLV_META_TYPE_GROUP; group=true; "GROUP"
    when TLV_META_TYPE_COMPLEX; "COMPLEX"
    else; 'unknown-meta-type'
    end

  stype = case type
    when PACKET_TYPE_REQUEST; 'Request'
    when PACKET_TYPE_RESPONSE; 'Response'
    else; _tlv_type_string(type)
    end

  group ||= (self.class.to_s =~ /Packet/)
  if group
    has_command_ids = type == PACKET_TYPE_RESPONSE && (self.method == COMMAND_ID_CORE_ENUMEXTCMD || self.method == COMMAND_ID_CORE_LOADLIB)
    if has_command_ids
      longest_command_id = self.get_tlvs(TLV_TYPE_UINT).map(&:value).max
      longest_command_id_length = longest_command_id.to_s.length
    end

    tlvs_inspect = "tlvs=[\n"
    @tlvs.each { |t|
      if t.type == TLV_TYPE_UINT && has_command_ids && longest_command_id_length
        command_name = ::Rex::Post::Meterpreter::CommandMapper.get_command_name(t.value)
        command_output = "command=#{command_name}>\n"
        this_value_length = t.value.to_s.length
        adjusted_command_name = command_output.rjust(command_output.length + longest_command_id_length - this_value_length)
        tlvs_inspect << "  #{t.inspect.gsub(/>$/, '')} " << adjusted_command_name
      else
        tlvs_inspect << "  #{t.inspect}\n"
      end
    }
    tlvs_inspect << "]"
  else
    val = value.inspect
    # Known list of datatypes that shouldn't be truncated, as their values are useful when debugging
    is_val_truncation_allowed = ![
      Rex::Post::Meterpreter::TLV_TYPE_UUID,
      Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_FILE_PATH,
      Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_SRC_FILE_PATH,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_FILE_PATH,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_DIRECTORY_PATH,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_STAT_BUF,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_PROCESS_PATH,
    ].include?(type)
    if is_val_truncation_allowed && val.length > 50
      val = val[0,50] + ' ..."'
    end
    tlvs_inspect = "meta=#{meta.ljust(10)} value=#{val}"
    if type == TLV_TYPE_COMMAND_ID
      begin
        command_name = ::Rex::Post::Meterpreter::CommandMapper.get_command_name(value)
      rescue
        command_name = nil
      end
      tlvs_inspect <<= " command=#{command_name || 'unknown'}"
    end
  end
  "#<#{self.class} type=#{stype.ljust(15)} #{tlvs_inspect}>"
end

#meta_type?(meta) ⇒ Boolean

Checks to see if a TLVs meta type is equivalent to the meta type passed.

Returns:

  • (Boolean) 


441
442
443
 
# File 'lib/rex/post/meterpreter/packet.rb', line 441

def meta_type?(meta)
  return (self.type & meta == meta)
end

#ntohq(value) ⇒ Object (protected) 



565
566
567
 
# File 'lib/rex/post/meterpreter/packet.rb', line 565

def ntohq(value)
  htonq(value)
end

#to_r ⇒ Object

Converts the TLV to raw.



468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
 
# File 'lib/rex/post/meterpreter/packet.rb', line 468

def to_r
  # Forcibly convert to ASCII-8BIT encoding
  raw = value.to_s.unpack("C*").pack("C*")

  if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
    raw += "\x00"
  elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
    raw = [value].pack("N")
  elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
    raw = [ self.htonq( value.to_i ) ].pack("Q<")
  elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
    if (value == true)
      raw = [1].pack("c")
    else
      raw = [0].pack("c")
    end
  end

  # check if the tlv is to be compressed...
  if @compress
    raw_uncompressed = raw
    # compress the raw data
    raw_compressed = Rex::Text.zlib_deflate( raw_uncompressed )
    # check we have actually made the raw data smaller...
    # (small blobs often compress slightly larger then the original)
    # if the compressed data is not smaller, we dont use the compressed data
    if( raw_compressed.length < raw_uncompressed.length )
      # if so, set the TLV's type to indicate compression is used
      self.type = self.type | TLV_META_TYPE_COMPRESSED
      # update the raw data with the uncompressed data length + compressed data
      # (we include the uncompressed data length as the C side will need to know this for decompression)
      raw = [ raw_uncompressed.length ].pack("N") + raw_compressed
    end
  end

  [raw.length + HEADER_SIZE, self.type].pack("NN") + raw
end

#type?(type) ⇒ Boolean

Checks to see if the TLVs type is equivalent to the type passed.

Returns:

  • (Boolean) 


448
449
450
 
# File 'lib/rex/post/meterpreter/packet.rb', line 448

def type?(type)
  return self.type == type
end

#value?(value) ⇒ Boolean

Checks to see if the TLVs value is equivalent to the value passed.

Returns:

  • (Boolean) 


455
456
457
 
# File 'lib/rex/post/meterpreter/packet.rb', line 455

def value?(value)
  return self.value == value
end