Class: Rex::Post::Meterpreter::Tlv

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/packet.rb

Overview

Base TLV (Type-Length-Value) class

Direct Known Subclasses

GroupTlv

Constant Summary collapse

HEADER_SIZE =
8

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(type, value = nil, compress = false) ⇒ Tlv

Returns an instance of a TLV.



300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
# File 'lib/rex/post/meterpreter/packet.rb', line 300

def initialize(type, value = nil, compress=false)
  @type     = type
  @compress = compress

  if (value != nil)
    if (type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
      if (value.kind_of?(Integer))
        @value = value.to_s
      else
        @value = value.dup
      end
    else
      @value = value
    end
  end
end

Instance Attribute Details

#compressObject

Returns the value of attribute compress.



287
288
289
# File 'lib/rex/post/meterpreter/packet.rb', line 287

def compress
  @compress
end

#typeObject

Returns the value of attribute type.



287
288
289
# File 'lib/rex/post/meterpreter/packet.rb', line 287

def type
  @type
end

#valueObject

Returns the value of attribute value.



287
288
289
# File 'lib/rex/post/meterpreter/packet.rb', line 287

def value
  @value
end

Instance Method Details

#_tlv_type_string(value) ⇒ Object



317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
# File 'lib/rex/post/meterpreter/packet.rb', line 317

def _tlv_type_string(value)
  tlv_names = ::Rex::Post::Meterpreter::CommandMapper.get_tlv_names(value).map { |name| name.to_s.gsub('TLV_TYPE_', '').gsub('PACKET_TYPE_', '') }

  case tlv_names.length
  when 0
    "unknown-#{value}"
  when 1
    tlv_names.first
  else
    # In the off-chance we have multiple TLV types which have the same value
    # https://github.com/rapid7/metasploit-framework/issues/16267
    # Sort it to ensure consistency across tests
    "oneOf(#{tlv_names.sort_by(&:to_s).join(',')})"
  end
end

#from_r(raw) ⇒ Object

Translates the raw format of the TLV into a sanitize version.



469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
# File 'lib/rex/post/meterpreter/packet.rb', line 469

def from_r(raw)
  self.value  = nil

  length, self.type = raw.unpack("NN");

  # check if the tlv value has been compressed...
  if( self.type & TLV_META_TYPE_COMPRESSED == TLV_META_TYPE_COMPRESSED )
    # set this TLV as using compression
    @compress = true
    # remove the TLV_META_TYPE_COMPRESSED flag from the tlv type to restore the
    # tlv type to its origional, allowing for transparent data compression.
    self.type = self.type ^ TLV_META_TYPE_COMPRESSED
    # decompress the compressed data (skipping the length and type DWORD's)
    raw_decompressed = Rex::Text.zlib_inflate( raw[HEADER_SIZE..length-1] )
    # update the length to reflect the decompressed data length (+HEADER_SIZE for the length and type DWORD's)
    length = raw_decompressed.length + HEADER_SIZE
    # update the raw buffer with the new length, decompressed data and updated type.
    raw = [length, self.type].pack("NN") + raw_decompressed
  end

  if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
    if (raw.length > 0)
      self.value = raw[HEADER_SIZE..length-2]
    else
      self.value = nil
    end
  elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
    self.value = raw.unpack("NNN")[2]
  elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
    self.value = raw.unpack("NNQ<")[2]
    self.value = self.ntohq( self.value )
  elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
    self.value = raw.unpack("NNc")[2]

    if (self.value == 1)
      self.value = true
    else
      self.value = false
    end
  else
    self.value = raw[HEADER_SIZE..length-1]
  end

  length
end

#htonq(value) ⇒ Object (protected)



517
518
519
520
521
522
523
# File 'lib/rex/post/meterpreter/packet.rb', line 517

def htonq(value)
  if [1].pack( 's' ) == [1].pack('n')
    return value
  else
    [value].pack('Q<').reverse.unpack('Q<').first
  end
end

#inspectObject



333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
# File 'lib/rex/post/meterpreter/packet.rb', line 333

def inspect
  utype = type ^ TLV_META_TYPE_COMPRESSED
  group = false
  meta = case (utype & TLV_META_MASK)
    when TLV_META_TYPE_STRING; "STRING"
    when TLV_META_TYPE_UINT; "INT"
    when TLV_META_TYPE_RAW; "RAW"
    when TLV_META_TYPE_BOOL; "BOOL"
    when TLV_META_TYPE_QWORD; "QWORD"
    when TLV_META_TYPE_GROUP; group=true; "GROUP"
    when TLV_META_TYPE_COMPLEX; "COMPLEX"
    else; 'unknown-meta-type'
    end

  stype = case type
    when PACKET_TYPE_REQUEST; 'Request'
    when PACKET_TYPE_RESPONSE; 'Response'
    else; _tlv_type_string(type)
    end

  val = value.inspect
  if val.length > 50
    val = val[0,50] + ' ..."'
  end
  group ||= (self.class.to_s =~ /Packet/)
  if group
    has_command_ids = type == PACKET_TYPE_RESPONSE && (self.method == COMMAND_ID_CORE_ENUMEXTCMD || self.method == COMMAND_ID_CORE_LOADLIB)
    if has_command_ids
      longest_command_id = self.get_tlvs(TLV_TYPE_UINT).map(&:value).max
      longest_command_id_length = longest_command_id.to_s.length
    end

    tlvs_inspect = "tlvs=[\n"
    @tlvs.each { |t|
      if t.type == TLV_TYPE_UINT && has_command_ids && longest_command_id_length
        command_name = ::Rex::Post::Meterpreter::CommandMapper.get_command_name(t.value)
        command_output = "command=#{command_name}>\n"
        this_value_length = t.value.to_s.length
        adjusted_command_name = command_output.rjust(command_output.length + longest_command_id_length - this_value_length)
        tlvs_inspect << "  #{t.inspect.gsub(/>$/, '')} " << adjusted_command_name
      else
        tlvs_inspect << "  #{t.inspect}\n"
      end
    }
    tlvs_inspect << "]"
  else
    tlvs_inspect = "meta=#{meta.ljust(10)} value=#{val}"
    if type == TLV_TYPE_COMMAND_ID
      begin
        command_name = ::Rex::Post::Meterpreter::CommandMapper.get_command_name(value)
      rescue
        command_name = nil
      end
      tlvs_inspect <<= " command=#{command_name || 'unknown'}"
    end
  end
  "#<#{self.class} type=#{stype.ljust(15)} #{tlvs_inspect}>"
end

#meta_type?(meta) ⇒ Boolean

Checks to see if a TLVs meta type is equivalent to the meta type passed.

Returns:

  • (Boolean)


401
402
403
# File 'lib/rex/post/meterpreter/packet.rb', line 401

def meta_type?(meta)
  return (self.type & meta == meta)
end

#ntohq(value) ⇒ Object (protected)



525
526
527
# File 'lib/rex/post/meterpreter/packet.rb', line 525

def ntohq(value)
  htonq(value)
end

#to_rObject

Converts the TLV to raw.



428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
# File 'lib/rex/post/meterpreter/packet.rb', line 428

def to_r
  # Forcibly convert to ASCII-8BIT encoding
  raw = value.to_s.unpack("C*").pack("C*")

  if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
    raw += "\x00"
  elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
    raw = [value].pack("N")
  elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
    raw = [ self.htonq( value.to_i ) ].pack("Q<")
  elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
    if (value == true)
      raw = [1].pack("c")
    else
      raw = [0].pack("c")
    end
  end

  # check if the tlv is to be compressed...
  if @compress
    raw_uncompressed = raw
    # compress the raw data
    raw_compressed = Rex::Text.zlib_deflate( raw_uncompressed )
    # check we have actually made the raw data smaller...
    # (small blobs often compress slightly larger then the origional)
    # if the compressed data is not smaller, we dont use the compressed data
    if( raw_compressed.length < raw_uncompressed.length )
      # if so, set the TLV's type to indicate compression is used
      self.type = self.type | TLV_META_TYPE_COMPRESSED
      # update the raw data with the uncompressed data length + compressed data
      # (we include the uncompressed data length as the C side will need to know this for decompression)
      raw = [ raw_uncompressed.length ].pack("N") + raw_compressed
    end
  end

  [raw.length + HEADER_SIZE, self.type].pack("NN") + raw
end

#type?(type) ⇒ Boolean

Checks to see if the TLVs type is equivalent to the type passed.

Returns:

  • (Boolean)


408
409
410
# File 'lib/rex/post/meterpreter/packet.rb', line 408

def type?(type)
  return self.type == type
end

#value?(value) ⇒ Boolean

Checks to see if the TLVs value is equivalent to the value passed.

Returns:

  • (Boolean)


415
416
417
# File 'lib/rex/post/meterpreter/packet.rb', line 415

def value?(value)
  return self.value == value
end