Class: Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Stdapi::Sys
- Inherits:
-
Object
- Object
- Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Stdapi::Sys
- Defined in:
- lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb
Overview
The system level portion of the standard API extension.
Constant Summary collapse
- Klass =
Console::CommandDispatcher::Stdapi::Sys
- @@execute_opts =
Options used by the ‘execute’ command.
Rex::Parser::Arguments.new( "-a" => [ true, "The arguments to pass to the command." ], "-c" => [ false, "Channelized I/O (required for interaction)." ], # -i sets -c "-f" => [ true, "The executable command to run." ], "-h" => [ false, "Help menu." ], "-H" => [ false, "Create the process hidden from view." ], "-i" => [ false, "Interact with the process after creating it." ], "-m" => [ false, "Execute from memory." ], "-d" => [ true, "The 'dummy' executable to launch when using -m." ], "-t" => [ false, "Execute process with currently impersonated thread token"], "-k" => [ false, "Execute process on the meterpreters current desktop" ], "-z" => [ false, "Execute process in a subshell" ], "-p" => [ false, "Execute process in a pty (if available on target platform)" ], "-s" => [ true, "Execute process in a given session as the session user" ])
- @@execute_opts_with_raw_mode =
@@execute_opts.merge( { '-r' => [ false, 'Raw mode'] } )
- @@shell_opts =
Options used by the ‘shell’ command.
Rex::Parser::Arguments.new( "-h" => [ false, "Help menu." ], "-l" => [ false, "List available shells (/etc/shells)." ], "-t" => [ true, "Spawn a PTY shell (/bin/bash if no argument given)." ])
- @@shell_opts_with_fully_interactive_shell =
@@shell_opts.merge( { '-i' => [ false, 'Drop into a fully interactive shell. (Only used in conjunction with `-t`).'] } )
- @@reboot_opts =
Options used by the ‘reboot’ command.
Rex::Parser::Arguments.new( "-h" => [ false, "Help menu." ], "-f" => [ true, "Force a reboot, valid values [1|2]" ])
- @@shutdown_opts =
Options used by the ‘shutdown’ command.
Rex::Parser::Arguments.new( "-h" => [ false, "Help menu." ], "-f" => [ true, "Force a shutdown, valid values [1|2]" ])
- @@reg_opts =
Options used by the ‘reg’ command.
Rex::Parser::Arguments.new( "-d" => [ true, "The data to store in the registry value." ], "-h" => [ false, "Help menu." ], "-k" => [ true, "The registry key path (E.g. HKLM\\Software\\Foo)." ], "-t" => [ true, "The registry value type (E.g. REG_SZ)." ], "-v" => [ true, "The registry value name (E.g. Stuff)." ], "-r" => [ true, "The remote machine name to connect to (with current process credentials" ], "-w" => [ true, "Set KEY_WOW64 flag, valid values [32|64]." ])
- @@ps_opts =
Options for the ‘ps’ command.
Rex::Parser::Arguments.new( "-S" => [ true, "Filter on process name" ], "-U" => [ true, "Filter on user name" ], "-A" => [ true, "Filter on architecture" ], "-x" => [ false, "Filter for exact matches rather than regex" ], "-s" => [ false, "Filter only SYSTEM processes" ], "-c" => [ false, "Filter only child processes of the current shell" ], "-h" => [ false, "Help menu." ])
- @@pgrep_opts =
Options for the ‘pgrep’ command.
Rex::Parser::Arguments.new( "-S" => [ true, "Filter on process name" ], "-U" => [ true, "Filter on user name" ], "-A" => [ true, "Filter on architecture" ], "-x" => [ false, "Filter for exact matches rather than regex" ], "-s" => [ false, "Filter only SYSTEM processes" ], "-c" => [ false, "Filter only child processes of the current shell" ], "-l" => [ false, "Display process name with PID" ], "-f" => [ false, "Display process path and args with PID (combine with -l)" ], "-h" => [ false, "Help menu." ])
- @@suspend_opts =
Options for the ‘suspend’ command.
Rex::Parser::Arguments.new( "-h" => [ false, "Help menu." ], "-c" => [ false, "Continues suspending or resuming even if an error is encountered"], "-r" => [ false, "Resumes the target processes instead of suspending" ])
Constants included from Extensions::Stdapi
Extensions::Stdapi::COMMAND_ID_STDAPI_AUDIO_MIC_LIST, Extensions::Stdapi::COMMAND_ID_STDAPI_AUDIO_MIC_START, Extensions::Stdapi::COMMAND_ID_STDAPI_AUDIO_MIC_STOP, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_CHDIR, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_CHMOD, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_DELETE_DIR, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_DELETE_FILE, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_FILE_COPY, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_FILE_EXPAND_PATH, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_FILE_MOVE, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_GETWD, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_LS, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_MD5, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_MKDIR, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_MOUNT_SHOW, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_SEARCH, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_SEPARATOR, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_SHA1, Extensions::Stdapi::COMMAND_ID_STDAPI_FS_STAT, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_ADD_ROUTE, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_ARP_TABLE, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_INTERFACES, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_NETSTAT, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_PROXY, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_ROUTES, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_REMOVE_ROUTE, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_RESOLVE_HOST, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_RESOLVE_HOSTS, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_SOCKET_TCP_SHUTDOWN, Extensions::Stdapi::COMMAND_ID_STDAPI_NET_TCP_CHANNEL_OPEN, Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API, Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API_MULTI, Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_MEMREAD, Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_MEMWRITE, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_CHECK_KEY_EXISTS, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_CLOSE_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_CREATE_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_DELETE_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_DELETE_VALUE, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_ENUM_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_ENUM_KEY_DIRECT, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_ENUM_VALUE, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_ENUM_VALUE_DIRECT, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_LOAD_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_OPEN_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_OPEN_REMOTE_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_QUERY_CLASS, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_QUERY_VALUE, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_QUERY_VALUE_DIRECT, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_SET_VALUE, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_SET_VALUE_DIRECT, Extensions::Stdapi::COMMAND_ID_STDAPI_REGISTRY_UNLOAD_KEY, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_DRIVER_LIST, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_DROP_TOKEN, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_GETENV, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_GETPRIVS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_GETSID, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_GETUID, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_LOCALTIME, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_REV2SELF, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_STEAL_TOKEN, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_SYSINFO, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_EVENTLOG_CLEAR, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_EVENTLOG_CLOSE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_EVENTLOG_NUMRECORDS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_EVENTLOG_OLDEST, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_EVENTLOG_OPEN, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_EVENTLOG_READ, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_POWER_EXITWINDOWS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_ATTACH, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_CLOSE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_EXECUTE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_GETPID, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_GET_INFO, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_GET_PROCESSES, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_GET_IMAGES, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_GET_PROC_ADDRESS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_LOAD, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_IMAGE_UNLOAD, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_KILL, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_ALLOCATE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_FREE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_LOCK, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_PROTECT, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_QUERY, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_READ, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_SEARCH, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_UNLOCK, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_WRITE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_SET_TERM_SIZE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_CLOSE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_CREATE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_GET_THREADS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_OPEN, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_QUERY_REGS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_RESUME, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_SET_REGS, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_SUSPEND, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_THREAD_TERMINATE, Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_WAIT, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_DESKTOP_ENUM, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_DESKTOP_GET, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_DESKTOP_SCREENSHOT, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_DESKTOP_SET, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_ENABLE_KEYBOARD, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_ENABLE_MOUSE, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_GET_IDLE_TIME, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_GET_KEYS_UTF8, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_SEND_KEYEVENT, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_SEND_KEYS, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_SEND_MOUSE, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_START_KEYSCAN, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_STOP_KEYSCAN, Extensions::Stdapi::COMMAND_ID_STDAPI_UI_UNLOCK_DESKTOP, Extensions::Stdapi::COMMAND_ID_STDAPI_WEBCAM_AUDIO_RECORD, Extensions::Stdapi::COMMAND_ID_STDAPI_WEBCAM_GET_FRAME, Extensions::Stdapi::COMMAND_ID_STDAPI_WEBCAM_LIST, Extensions::Stdapi::COMMAND_ID_STDAPI_WEBCAM_START, Extensions::Stdapi::COMMAND_ID_STDAPI_WEBCAM_STOP, Extensions::Stdapi::DELETE_KEY_FLAG_RECURSIVE, Extensions::Stdapi::EXTENSION_ID_STDAPI, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_CHANNELIZED, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_DESKTOP, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_HIDDEN, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_PTY, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_SESSION, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_SUBSHELL, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_SUSPENDED, Extensions::Stdapi::PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN, Extensions::Stdapi::TLV_TYPE_ADDR_TYPE, Extensions::Stdapi::TLV_TYPE_ALLOCATION_TYPE, Extensions::Stdapi::TLV_TYPE_ALLOC_BASE_ADDRESS, Extensions::Stdapi::TLV_TYPE_ALLOC_PROTECTION, Extensions::Stdapi::TLV_TYPE_ARCHITECTURE, Extensions::Stdapi::TLV_TYPE_ARP_ENTRY, Extensions::Stdapi::TLV_TYPE_AUDIO_DATA, Extensions::Stdapi::TLV_TYPE_AUDIO_DURATION, Extensions::Stdapi::TLV_TYPE_AUDIO_INTERFACE_ID, Extensions::Stdapi::TLV_TYPE_AUDIO_INTERFACE_NAME, Extensions::Stdapi::TLV_TYPE_BASE_ADDRESS, Extensions::Stdapi::TLV_TYPE_BASE_KEY, Extensions::Stdapi::TLV_TYPE_BUILD_TUPLE, Extensions::Stdapi::TLV_TYPE_COMPUTER_NAME, Extensions::Stdapi::TLV_TYPE_CONNECT_RETRIES, Extensions::Stdapi::TLV_TYPE_CREATION_FLAGS, Extensions::Stdapi::TLV_TYPE_DESKTOP, Extensions::Stdapi::TLV_TYPE_DESKTOP_NAME, Extensions::Stdapi::TLV_TYPE_DESKTOP_SCREENSHOT, Extensions::Stdapi::TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_BUFFER, Extensions::Stdapi::TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER, Extensions::Stdapi::TLV_TYPE_DESKTOP_SCREENSHOT_QUALITY, Extensions::Stdapi::TLV_TYPE_DESKTOP_SESSION, Extensions::Stdapi::TLV_TYPE_DESKTOP_STATION, Extensions::Stdapi::TLV_TYPE_DESKTOP_SWITCH, Extensions::Stdapi::TLV_TYPE_DIRECTORY_PATH, Extensions::Stdapi::TLV_TYPE_DOMAIN, Extensions::Stdapi::TLV_TYPE_DRIVER_BASENAME, Extensions::Stdapi::TLV_TYPE_DRIVER_ENTRY, Extensions::Stdapi::TLV_TYPE_DRIVER_FILENAME, Extensions::Stdapi::TLV_TYPE_ENTRY_PARAMETER, Extensions::Stdapi::TLV_TYPE_ENTRY_POINT, Extensions::Stdapi::TLV_TYPE_ENV_GROUP, Extensions::Stdapi::TLV_TYPE_ENV_VALUE, Extensions::Stdapi::TLV_TYPE_ENV_VARIABLE, Extensions::Stdapi::TLV_TYPE_EVENT_CATEGORY, Extensions::Stdapi::TLV_TYPE_EVENT_DATA, Extensions::Stdapi::TLV_TYPE_EVENT_HANDLE, Extensions::Stdapi::TLV_TYPE_EVENT_ID, Extensions::Stdapi::TLV_TYPE_EVENT_NUMRECORDS, Extensions::Stdapi::TLV_TYPE_EVENT_READFLAGS, Extensions::Stdapi::TLV_TYPE_EVENT_RECORDNUMBER, Extensions::Stdapi::TLV_TYPE_EVENT_RECORDOFFSET, Extensions::Stdapi::TLV_TYPE_EVENT_SOURCENAME, Extensions::Stdapi::TLV_TYPE_EVENT_STRING, Extensions::Stdapi::TLV_TYPE_EVENT_TIMEGENERATED, Extensions::Stdapi::TLV_TYPE_EVENT_TIMEWRITTEN, Extensions::Stdapi::TLV_TYPE_EVENT_TYPE, Extensions::Stdapi::TLV_TYPE_EXIT_CODE, Extensions::Stdapi::TLV_TYPE_FILE_HASH, Extensions::Stdapi::TLV_TYPE_FILE_MODE, Extensions::Stdapi::TLV_TYPE_FILE_MODE_T, Extensions::Stdapi::TLV_TYPE_FILE_NAME, Extensions::Stdapi::TLV_TYPE_FILE_PATH, Extensions::Stdapi::TLV_TYPE_FILE_SHORT_NAME, Extensions::Stdapi::TLV_TYPE_FILE_SIZE, Extensions::Stdapi::TLV_TYPE_GATEWAY, Extensions::Stdapi::TLV_TYPE_GATEWAY_STRING, Extensions::Stdapi::TLV_TYPE_HANDLE, Extensions::Stdapi::TLV_TYPE_HKEY, Extensions::Stdapi::TLV_TYPE_HOST_NAME, Extensions::Stdapi::TLV_TYPE_IDLE_TIME, Extensions::Stdapi::TLV_TYPE_IMAGE_BASE, Extensions::Stdapi::TLV_TYPE_IMAGE_FILE, Extensions::Stdapi::TLV_TYPE_IMAGE_FILE_PATH, Extensions::Stdapi::TLV_TYPE_IMAGE_GROUP, Extensions::Stdapi::TLV_TYPE_IMAGE_NAME, Extensions::Stdapi::TLV_TYPE_INHERIT, Extensions::Stdapi::TLV_TYPE_INTERFACE_FLAGS, Extensions::Stdapi::TLV_TYPE_INTERFACE_INDEX, Extensions::Stdapi::TLV_TYPE_INTERFACE_MTU, Extensions::Stdapi::TLV_TYPE_IP, Extensions::Stdapi::TLV_TYPE_IP6_SCOPE, Extensions::Stdapi::TLV_TYPE_IP_PREFIX, Extensions::Stdapi::TLV_TYPE_KEYEVENT_SEND, Extensions::Stdapi::TLV_TYPE_KEYSCAN_TRACK_ACTIVE_WINDOW, Extensions::Stdapi::TLV_TYPE_KEYS_DUMP, Extensions::Stdapi::TLV_TYPE_KEYS_SEND, Extensions::Stdapi::TLV_TYPE_KEY_NAME, Extensions::Stdapi::TLV_TYPE_LANG_SYSTEM, Extensions::Stdapi::TLV_TYPE_LOCAL_DATETIME, Extensions::Stdapi::TLV_TYPE_LOCAL_HOST, Extensions::Stdapi::TLV_TYPE_LOCAL_HOST_RAW, Extensions::Stdapi::TLV_TYPE_LOCAL_PORT, Extensions::Stdapi::TLV_TYPE_LOGGED_ON_USER_COUNT, Extensions::Stdapi::TLV_TYPE_MAC_ADDRESS, Extensions::Stdapi::TLV_TYPE_MAC_NAME, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_MATCH_ADDR, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_MATCH_LEN, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_MATCH_STR, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_NEEDLE, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_RESULTS, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_SECT_LEN, Extensions::Stdapi::TLV_TYPE_MEMORY_SEARCH_START_ADDR, Extensions::Stdapi::TLV_TYPE_MEMORY_STATE, Extensions::Stdapi::TLV_TYPE_MEMORY_TYPE, Extensions::Stdapi::TLV_TYPE_MOUNT, Extensions::Stdapi::TLV_TYPE_MOUNT_NAME, Extensions::Stdapi::TLV_TYPE_MOUNT_SPACE_FREE, Extensions::Stdapi::TLV_TYPE_MOUNT_SPACE_TOTAL, Extensions::Stdapi::TLV_TYPE_MOUNT_SPACE_USER, Extensions::Stdapi::TLV_TYPE_MOUNT_TYPE, Extensions::Stdapi::TLV_TYPE_MOUNT_UNCPATH, Extensions::Stdapi::TLV_TYPE_MOUSE_ACTION, Extensions::Stdapi::TLV_TYPE_MOUSE_X, Extensions::Stdapi::TLV_TYPE_MOUSE_Y, Extensions::Stdapi::TLV_TYPE_NETMASK, Extensions::Stdapi::TLV_TYPE_NETMASK_STRING, Extensions::Stdapi::TLV_TYPE_NETSTAT_ENTRY, Extensions::Stdapi::TLV_TYPE_NETWORK_INTERFACE, Extensions::Stdapi::TLV_TYPE_NETWORK_ROUTE, Extensions::Stdapi::TLV_TYPE_OS_NAME, Extensions::Stdapi::TLV_TYPE_PARENT_PID, Extensions::Stdapi::TLV_TYPE_PEER_HOST, Extensions::Stdapi::TLV_TYPE_PEER_HOST_RAW, Extensions::Stdapi::TLV_TYPE_PEER_PORT, Extensions::Stdapi::TLV_TYPE_PERMISSION, Extensions::Stdapi::TLV_TYPE_PID, Extensions::Stdapi::TLV_TYPE_PORT, Extensions::Stdapi::TLV_TYPE_POWER_FLAGS, Extensions::Stdapi::TLV_TYPE_POWER_REASON, Extensions::Stdapi::TLV_TYPE_PRIVILEGE, Extensions::Stdapi::TLV_TYPE_PROCEDURE_ADDRESS, Extensions::Stdapi::TLV_TYPE_PROCEDURE_NAME, Extensions::Stdapi::TLV_TYPE_PROCESS_ARCH, Extensions::Stdapi::TLV_TYPE_PROCESS_ARCH_NAME, Extensions::Stdapi::TLV_TYPE_PROCESS_ARGUMENTS, Extensions::Stdapi::TLV_TYPE_PROCESS_FLAGS, Extensions::Stdapi::TLV_TYPE_PROCESS_GROUP, Extensions::Stdapi::TLV_TYPE_PROCESS_HANDLE, Extensions::Stdapi::TLV_TYPE_PROCESS_MEMORY, Extensions::Stdapi::TLV_TYPE_PROCESS_NAME, Extensions::Stdapi::TLV_TYPE_PROCESS_PATH, Extensions::Stdapi::TLV_TYPE_PROCESS_PERMS, Extensions::Stdapi::TLV_TYPE_PROCESS_SESSION, Extensions::Stdapi::TLV_TYPE_PROTECTION, Extensions::Stdapi::TLV_TYPE_PROXY_CFG_AUTOCONFIGURL, Extensions::Stdapi::TLV_TYPE_PROXY_CFG_AUTODETECT, Extensions::Stdapi::TLV_TYPE_PROXY_CFG_PROXY, Extensions::Stdapi::TLV_TYPE_PROXY_CFG_PROXYBYPASS, Extensions::Stdapi::TLV_TYPE_REGISTER, Extensions::Stdapi::TLV_TYPE_REGISTER_NAME, Extensions::Stdapi::TLV_TYPE_REGISTER_SIZE, Extensions::Stdapi::TLV_TYPE_REGISTER_VALUE_32, Extensions::Stdapi::TLV_TYPE_ROOT_KEY, Extensions::Stdapi::TLV_TYPE_ROUTE_METRIC, Extensions::Stdapi::TLV_TYPE_SEARCH_GLOB, Extensions::Stdapi::TLV_TYPE_SEARCH_MTIME, Extensions::Stdapi::TLV_TYPE_SEARCH_M_END_DATE, Extensions::Stdapi::TLV_TYPE_SEARCH_M_START_DATE, Extensions::Stdapi::TLV_TYPE_SEARCH_RECURSE, Extensions::Stdapi::TLV_TYPE_SEARCH_RESULTS, Extensions::Stdapi::TLV_TYPE_SEARCH_ROOT, Extensions::Stdapi::TLV_TYPE_SHUTDOWN_HOW, Extensions::Stdapi::TLV_TYPE_SID, Extensions::Stdapi::TLV_TYPE_STAT_BUF, Extensions::Stdapi::TLV_TYPE_STAT_BUF32, Extensions::Stdapi::TLV_TYPE_SUBNET, Extensions::Stdapi::TLV_TYPE_SUBNET_STRING, Extensions::Stdapi::TLV_TYPE_TARGET_HOST, Extensions::Stdapi::TLV_TYPE_TERMINAL_COLUMNS, Extensions::Stdapi::TLV_TYPE_TERMINAL_ROWS, Extensions::Stdapi::TLV_TYPE_THREAD_HANDLE, Extensions::Stdapi::TLV_TYPE_THREAD_ID, Extensions::Stdapi::TLV_TYPE_THREAD_PERMS, Extensions::Stdapi::TLV_TYPE_USER_NAME, Extensions::Stdapi::TLV_TYPE_VALUE_DATA, Extensions::Stdapi::TLV_TYPE_VALUE_NAME, Extensions::Stdapi::TLV_TYPE_VALUE_TYPE, Extensions::Stdapi::TLV_TYPE_WEBCAM_IMAGE, Extensions::Stdapi::TLV_TYPE_WEBCAM_INTERFACE_ID, Extensions::Stdapi::TLV_TYPE_WEBCAM_NAME, Extensions::Stdapi::TLV_TYPE_WEBCAM_QUALITY
Instance Attribute Summary
Attributes included from Ui::Text::DispatcherShell::CommandDispatcher
Instance Method Summary collapse
-
#cmd_clearev(*args) ⇒ Object
Clears the event log.
-
#cmd_drop_token(*args) ⇒ Object
Drops any assumed token.
-
#cmd_execute(*args) ⇒ Object
Executes a command with some options.
- #cmd_execute_help ⇒ Object
- #cmd_execute_tabs(str, words) ⇒ Object
-
#cmd_getenv(*args) ⇒ Object
Get the value of one or more environment variables from the target.
-
#cmd_getpid(*args) ⇒ Object
Gets the process identifier that meterpreter is running in on the remote machine.
-
#cmd_getprivs(*args) ⇒ Object
Obtains as many privileges as possible on the target machine.
- #cmd_getprivs_help ⇒ Object
-
#cmd_getsid(*args) ⇒ Object
Display the SID of the user that the server is running as.
-
#cmd_getuid(*args) ⇒ Object
Displays the user that the server is running as.
-
#cmd_kill(*args) ⇒ Object
Kills one or more processes.
-
#cmd_kill_help ⇒ Object
help for the kill command.
-
#cmd_localtime(*args) ⇒ Object
Displays the local date and time at the remote system location.
-
#cmd_pgrep(*args) ⇒ Object
Filters processes by name.
- #cmd_pgrep_help ⇒ Object
-
#cmd_pkill(*args) ⇒ Object
Kills one or more processes by name.
- #cmd_pkill_help ⇒ Object
-
#cmd_ps(*args) ⇒ Object
Lists running processes.
- #cmd_ps_help ⇒ Object
-
#cmd_ps_tabs(str, words) ⇒ Object
Tab completion for the ps command.
-
#cmd_reboot(*args) ⇒ Object
Reboots the remote computer.
-
#cmd_reg(*args) ⇒ Object
Modifies and otherwise interacts with the registry on the remote computer by allowing the client to enumerate, open, modify, and delete registry keys and values.
-
#cmd_reg_help ⇒ Object
help for the reg command.
-
#cmd_reg_tabs(str, words) ⇒ Object
Tab completion for the reg command.
-
#cmd_rev2self(*args) ⇒ Object
Calls RevertToSelf() on the remote machine.
-
#cmd_shell(*args) ⇒ Object
Drop into a system shell as specified by %COMSPEC% or as appropriate for the host.
- #cmd_shell_help ⇒ Object
- #cmd_shell_tabs(str, words) ⇒ Object
-
#cmd_shutdown(*args) ⇒ Object
Shuts down the remote computer.
- #cmd_shutdown_help ⇒ Object
- #cmd_shutdown_tabs(str, words) ⇒ Object
-
#cmd_steal_token(*args) ⇒ Object
Tries to steal the primary token from the target process.
-
#cmd_suspend(*args) ⇒ Boolean
Suspends or resumes a list of one or more pids.
-
#cmd_suspend_help ⇒ Object
help for the suspend command.
-
#cmd_suspend_tabs(str, words) ⇒ Object
Tab completion for the suspend command.
-
#cmd_sysinfo(*args) ⇒ Object
Displays information about the remote system.
-
#commands ⇒ Object
List of supported commands.
- #execute_opts ⇒ Object
- #match_processes(processes, args, quiet: false) ⇒ Object
-
#name ⇒ Object
Name for this dispatcher.
-
#pty_shell(sh_path, raw: false) ⇒ Object
Spawn a PTY shell.
- #shell_opts ⇒ Object
-
#validate_pids(pids, allow_pid_0 = false, allow_session_pid = false) ⇒ Array
validates an array of pids against the running processes on target host behavior can be controlled to allow/deny process 0 and the session’s process the pids: - are converted to integers - have had pid 0 removed unless allow_pid_0 - have had current session pid removed unless allow_session_pid (to protect the session) - have redundant entries removed.
Methods included from Rex::Post::Meterpreter::Ui::Console::CommandDispatcher
check_hash, #client, #docs_dir, #filter_commands, #initialize, #log_error, #msf_loaded?, #session, set_hash, #unknown_command
Methods included from Msf::Ui::Console::CommandDispatcher::Session
#cmd_background, #cmd_background_help, #cmd_exit, #cmd_irb, #cmd_irb_help, #cmd_irb_tabs, #cmd_pry, #cmd_pry_help, #cmd_resource, #cmd_resource_help, #cmd_resource_tabs, #cmd_sessions, #cmd_sessions_help
Methods included from Ui::Text::DispatcherShell::CommandDispatcher
#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #docs_dir, #help_to_s, included, #initialize, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_directory, #tab_complete_filenames, #tab_complete_generic, #tab_complete_source_address, #unknown_command, #update_prompt
Instance Method Details
#cmd_clearev(*args) ⇒ Object
Clears the event log
525 526 527 528 529 530 531 532 533 534 535 536 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 525 def cmd_clearev(*args) logs = ['Application', 'System', 'Security'] logs << args logs.flatten! logs.each do |name| log = client.sys.eventlog.open(name) print_status("Wiping #{log.length} records from #{name}...") log.clear end end |
#cmd_drop_token(*args) ⇒ Object
Drops any assumed token.
1218 1219 1220 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1218 def cmd_drop_token(*args) print_line("Relinquished token, now running as: " + client.sys.config.drop_token()) end |
#cmd_execute(*args) ⇒ Object
Executes a command with some options.
215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 215 def cmd_execute(*args) if (args.length == 0) args.unshift("-h") end session = nil interact = false desktop = false channelized = nil hidden = nil from_mem = false dummy_exec = "cmd" cmd_args = nil cmd_exec = nil use_thread_token = false raw = false subshell = false pty = false execute_opts.parse(args) { |opt, idx, val| case opt when "-a" cmd_args = val when "-c" channelized = true when "-f" cmd_exec = val when "-H" hidden = true when "-m" from_mem = true when "-d" dummy_exec = val when "-k" desktop = true when "-h" cmd_execute_help return true when "-i" channelized = true interact = true when "-t" use_thread_token = true when "-s" session = val.to_i when "-r" raw = true when "-z" subshell = true when "-p" pty = true end } # Did we at least get an executable? if (cmd_exec == nil) print_error("You must specify an executable file with -f") return true end # Execute it p = client.sys.process.execute(cmd_exec, cmd_args, 'Channelized' => channelized, 'Desktop' => desktop, 'Session' => session, 'Hidden' => hidden, 'InMemory' => (from_mem) ? dummy_exec : nil, 'Subshell' => subshell, 'Pty' => pty, 'UseThreadToken' => use_thread_token) print_line("Process #{p.pid} created.") print_line("Channel #{p.channel.cid} created.") if (p.channel) if (interact and p.channel) shell.interact_with_channel(p.channel, raw: raw) end end |
#cmd_execute_help ⇒ Object
294 295 296 297 298 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 294 def cmd_execute_help print_line("Usage: execute -f file [options]") print_line("Executes a command on the remote machine.") print execute_opts.usage end |
#cmd_execute_tabs(str, words) ⇒ Object
300 301 302 303 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 300 def cmd_execute_tabs(str, words) return execute_opts.option_keys if words.length == 1 [] end |
#cmd_getenv(*args) ⇒ Object
Get the value of one or more environment variables from the target.
498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 498 def cmd_getenv(*args) vars = client.sys.config.getenvs(*args) if vars.length == 0 print_error("None of the specified environment variables were found/set.") else table = Rex::Text::Table.new( 'Header' => 'Environment Variables', 'Indent' => 0, 'SortIndex' => 1, 'Columns' => [ 'Variable', 'Value' ] ) vars.each do |var, val| table << [ var, val ] end print_line print_line(table.to_s) end end |
#cmd_getpid(*args) ⇒ Object
Gets the process identifier that meterpreter is running in on the remote machine.
475 476 477 478 479 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 475 def cmd_getpid(*args) print_line("Current pid: #{client.sys.process.getpid}") return true end |
#cmd_getprivs(*args) ⇒ Object
Obtains as many privileges as possible on the target machine.
1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1183 def cmd_getprivs(*args) if args.include? "-h" cmd_getprivs_help end table = Rex::Text::Table.new( 'Header' => 'Enabled Process Privileges', 'Indent' => 0, 'SortIndex' => 1, 'Columns' => ['Name'] ) client.sys.config.getprivs.each do |priv| table << [priv] end print_line print_line(table.to_s) end |
#cmd_getprivs_help ⇒ Object
1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1169 def cmd_getprivs_help print_line "Usage: getprivs" print_line print_line "Attempt to enable all privileges, such as SeDebugPrivilege, available to the" print_line "current process. Note that this only enables existing privs and does not change" print_line "users or tokens." print_line print_line "See also: steal_token, getsystem" print_line end |
#cmd_getsid(*args) ⇒ Object
Display the SID of the user that the server is running as.
491 492 493 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 491 def cmd_getsid(*args) print_line("Server SID: #{client.sys.config.getsid}") end |
#cmd_getuid(*args) ⇒ Object
Displays the user that the server is running as.
484 485 486 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 484 def cmd_getuid(*args) print_line("Server username: #{client.sys.config.getuid}") end |
#cmd_kill(*args) ⇒ Object
Kills one or more processes.
541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 541 def cmd_kill(*args) # give'em help if they want it, or seem confused if ( args.length == 0 or (args.length == 1 and args[0].strip == "-h") ) cmd_kill_help return true end self_destruct = args.include?("-s") if self_destruct valid_pids = [client.sys.process.getpid.to_i] else valid_pids = validate_pids(args) # validate all the proposed pids first so we can bail if one is bogus args.uniq! diff = args - valid_pids.map {|e| e.to_s} if not diff.empty? # then we had an invalid pid print_error("The following pids are not valid: #{diff.join(", ").to_s}. Quitting") return false end end # kill kill kill print_line("Killing: #{valid_pids.join(", ").to_s}") client.sys.process.kill(*(valid_pids.map { |x| x })) return true end |
#cmd_kill_help ⇒ Object
help for the kill command
573 574 575 576 577 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 573 def cmd_kill_help print_line("Usage: kill [pid1 [pid2 [pid3 ...]]] [-s]") print_line("Terminate one or more processes.") print_line(" -s Kills the pid associated with the current session.") end |
#cmd_localtime(*args) ⇒ Object
Displays the local date and time at the remote system location.
1243 1244 1245 1246 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1243 def cmd_localtime(*args) print_line("Local Date/Time: " + client.sys.config.localtime); return true end |
#cmd_pgrep(*args) ⇒ Object
Filters processes by name
616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 616 def cmd_pgrep(*args) f_flag = false l_flag = false @@pgrep_opts.parse(args) do |opt, idx, val| case opt when '-h' cmd_pgrep_help return true when '-l' l_flag = true when '-f' f_flag = true end end all_processes = client.sys.process.get_processes processes = match_processes(all_processes, args, quiet: true) if processes.length == 0 || processes.length == all_processes.length return true end processes.each do |p| if l_flag if f_flag full_path = [p['path'], p['name']].join(client.fs.file.separator) print_line("#{p['pid']} #{full_path}") else print_line("#{p['pid']} #{p['name']}") end else print_line("#{p['pid']}") end end true end |
#cmd_pgrep_help ⇒ Object
655 656 657 658 659 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 655 def cmd_pgrep_help print_line("Usage: pgrep [ options ] pattern") print_line("Filter processes by name.") print_line @@pgrep_opts.usage end |
#cmd_pkill(*args) ⇒ Object
Kills one or more processes by name.
582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 582 def cmd_pkill(*args) if args.include?('-h') cmd_pkill_help return true end all_processes = client.sys.process.get_processes processes = match_processes(all_processes, args) if processes.length == 0 print_line("No matching processes were found.") return true end if processes.length == all_processes.length && !args.include?('-f') print_error("All processes will be killed, use '-f' to force.") return true end pids = processes.collect { |p| p['pid'] }.reverse print_line("Killing: #{pids.join(', ')}") client.sys.process.kill(*(pids.map { |x| x })) true end |
#cmd_pkill_help ⇒ Object
607 608 609 610 611 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 607 def cmd_pkill_help print_line("Usage: pkill [ options ] pattern") print_line("Terminate one or more processes by name.") print_line @@ps_opts.usage end |
#cmd_ps(*args) ⇒ Object
Lists running processes.
790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 790 def cmd_ps(*args) if args.include?('-h') cmd_ps_help return true end all_processes = client.sys.process.get_processes processes = match_processes(all_processes, args) if processes.length == 0 print_line("No matching processes were found.") return true end tbl = processes.to_table print_line print_line(tbl.to_s) true end |
#cmd_ps_help ⇒ Object
810 811 812 813 814 815 816 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 810 def cmd_ps_help print_line "Usage: ps [ options ] pattern" print_line print_line "Use the command with no arguments to see all running processes." print_line "The following options can be used to filter those results:" print_line @@ps_opts.usage end |
#cmd_ps_tabs(str, words) ⇒ Object
Tab completion for the ps command
821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 821 def cmd_ps_tabs(str, words) return @@ps_opts.option_keys if words.length == 1 case words[-1] when '-A' return %w[x86 x64] when '-S' process = [] client.sys.process.get_processes.each { |p| process << p['name'] } rescue nil return process.uniq! when '-U' user = [] client.sys.process.get_processes.each { |p| user << p['user'] } rescue nil return user.uniq! # buggy on windows end [] end |
#cmd_reboot(*args) ⇒ Object
Reboots the remote computer.
843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 843 def cmd_reboot(*args) force = 0 if args.length == 1 and args[0].strip == "-h" print( "Usage: reboot [options]\n\n" + "Reboot the remote machine.\n" + @@reboot_opts.usage) return true end @@reboot_opts.parse(args) { |opt, idx, val| case opt when "-f" force = val.to_i end } print_line("Rebooting...") client.sys.power.reboot(force, SHTDN_REASON_DEFAULT) end |
#cmd_reg(*args) ⇒ Object
Modifies and otherwise interacts with the registry on the remote computer by allowing the client to enumerate, open, modify, and delete registry keys and values.
870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 870 def cmd_reg(*args) # Extract the command, if any cmd = args.shift if (args.length == 0) args.unshift("-h") end # Initiailze vars key = nil value = nil data = nil type = nil wowflag = 0x0000 rem = nil @@reg_opts.parse(args) { |opt, idx, val| case opt when "-h" cmd_reg_help return false when "-k" key = val when "-v" value = val when "-t" type = val when "-d" data = val when "-r" rem = val when "-w" if val == '64' wowflag = KEY_WOW64_64KEY elsif val == '32' wowflag = KEY_WOW64_32KEY end end } # All commands require a key. if (key == nil) print_error("You must specify a key path (-k)") return false end # Split the key into its parts root_key, base_key = client.sys.registry.splitkey(key) begin # Rock it case cmd when "enumkey" open_key = nil if not rem open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.open_key(base_key, KEY_READ + wowflag) end end print_line( "Enumerating: #{key}\n") keys = open_key.enum_key vals = open_key.enum_value if (keys.length > 0) print_line(" Keys (#{keys.length}):\n") keys.each { |subkey| print_line("\t#{subkey}") } print_line end if (vals.length > 0) print_line(" Values (#{vals.length}):\n") vals.each { |val| print_line("\t#{val.name}") } print_line end if (vals.length == 0 and keys.length == 0) print_line("No children.") end when "createkey" open_key = nil if not rem open_key = client.sys.registry.create_key(root_key, base_key, KEY_WRITE + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.create_key(base_key, KEY_WRITE + wowflag) end end print_line("Successfully created key: #{key}") when "deletekey" open_key = nil if not rem open_key = client.sys.registry.open_key(root_key, nil, KEY_WRITE + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.open_key(nil, KEY_WRITE + wowflag) end end open_key.delete_key(base_key) print_line("Successfully deleted key: #{key}") when "setval" if (value == nil or data == nil) print_error("You must specify both a value name and data (-v, -d).") return false end type = "REG_SZ" if (type == nil) open_key = nil if not rem open_key = client.sys.registry.open_key(root_key, base_key, KEY_WRITE + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.open_key(base_key, KEY_WRITE + wowflag) end end if type == 'REG_BINARY' # Use the same format accepted by REG ADD: # REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead if (data.length.even? == false) print_error('Data length supplied to the -d argument was not appropriately padded to an even length string!') return false end data_str_length = data.length data = data.scan(/(?:[a-fA-F0-9]{2})/).map {|v| v.to_i(16)} if (data_str_length/2 != data.length) print_error('Invalid characters provided! Could not fully convert data provided to -d argument!') return false end data = data.pack("C*") elsif type == 'REG_DWORD' || type == 'REG_QWORD' if data =~ /^\d+$/ data = data.to_i elsif data =~ /^0x[a-fA-F0-9]+$/ data = data[2..].to_i(16) else print_error("Invalid data provided, #{type} must be numeric.") return false end elsif type == 'REG_MULTI_SZ' data = data.split('\0') end open_key.set_value(value, client.sys.registry.type2str(type), data) print_line("Successfully set #{value} of #{type}.") when "deleteval" if (value == nil) print_error("You must specify a value name (-v).") return false end open_key = nil if not rem open_key = client.sys.registry.open_key(root_key, base_key, KEY_WRITE + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.open_key(base_key, KEY_WRITE + wowflag) end end open_key.delete_value(value) print_line("Successfully deleted #{value}.") when "queryval" if (value == nil) print_error("You must specify a value name (-v).") return false end open_key = nil if not rem open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.open_key(base_key, KEY_READ + wowflag) end end v = open_key.query_value(value) data = v.data if v.type == REG_BINARY data = data.unpack('H*')[0] elsif v.type == REG_MULTI_SZ data = data.join('\0') end print( "Key: #{key}\n" + "Name: #{v.name}\n" + "Type: #{v.type_to_s}\n" + "Data: #{data}\n") when "queryclass" open_key = nil if not rem open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ + wowflag) else remote_key = client.sys.registry.open_remote_key(rem, root_key) if remote_key open_key = remote_key.open_key(base_key, KEY_READ + wowflag) end end data = open_key.query_class print("Data: #{data}\n") else print_error("Invalid command supplied: #{cmd}") end ensure open_key.close if (open_key) end end |
#cmd_reg_help ⇒ Object
help for the reg command
1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1115 def cmd_reg_help print_line("Usage: reg [command] [options]") print_line("Interact with the target machine's registry.") print @@reg_opts.usage print_line("COMMANDS:") print_line print_line(" enumkey Enumerate the supplied registry key [-k <key>]") print_line(" createkey Create the supplied registry key [-k <key>]") print_line(" deletekey Delete the supplied registry key [-k <key>]") print_line(" queryclass Queries the class of the supplied key [-k <key>]") print_line(" setval Set a registry value [-k <key> -v <val> -d <data>]. Use a binary blob to set binary data with REG_BINARY type (e.g. setval -d ef4ba278)") print_line(" deleteval Delete the supplied registry value [-k <key> -v <val>]") print_line(" queryval Queries the data contents of a value [-k <key> -v <val>]") print_line end |
#cmd_reg_tabs(str, words) ⇒ Object
Tab completion for the reg command
1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1134 def cmd_reg_tabs(str, words) if words.length == 1 return %w[enumkey createkey deletekey queryclass setval deleteval queryval] + @@reg_opts.option_keys end case words[-1] when '-k' reg_root_keys = %w[HKLM HKCC HKCR HKCU HKU] # Split the key into its parts root_key, base_key = client.sys.registry.splitkey(str) rescue nil return reg_root_keys unless root_key # Open the registry open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ + 0x0000) rescue (return []) return open_key.enum_key.map { |e| str.gsub(/[\\]*$/, '') + '\\\\' + e } when '-t' # Reference https://msdn.microsoft.com/en-us/library/windows/desktop/bb773476(v=vs.85).aspx return %w[REG_BINARY REG_DWORD REG_QWORD REG_DWORD_BIG_ENDIAN REG_EXPAND_SZ REG_LINK REG_MULTI_SZ REG_NONE REG_RESOURCE_LIST REG_SZ] when '-w' return %w[32 64] when 'enumkey', 'createkey', 'deletekey', 'queryclass', 'setval', 'deleteval', 'queryval' return @@reg_opts.option_keys end [] end |
#cmd_rev2self(*args) ⇒ Object
Calls RevertToSelf() on the remote machine.
1165 1166 1167 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1165 def cmd_rev2self(*args) client.sys.config.revert_to_self end |
#cmd_shell(*args) ⇒ Object
Drop into a system shell as specified by %COMSPEC% or as appropriate for the host.
321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 321 def cmd_shell(*args) use_pty = false raw = false sh_path = '/bin/bash' shell_opts.parse(args) do |opt, idx, val| case opt when '-h' cmd_shell_help return true when '-l' return false unless client.fs.file.exist?('/etc/shells') begin client.fs.file.open('/etc/shells') do |f| print(f.read) until f.eof end rescue return false end return true when '-i' raw = true when '-t' use_pty = true # XXX: No other options must follow sh_path = val if val end end case client.platform when 'windows' path = client.sys.config.getenv('COMSPEC') path = (path && !path.empty?) ? path : 'cmd.exe' # attempt the shell with thread impersonation begin cmd_execute('-f', path, '-c', '-i', '-H', '-t') rescue # if this fails, then we attempt without impersonation print_error('Failed to spawn shell with thread impersonation. Retrying without it.') cmd_execute('-f', path, '-c', '-i', '-H') end when 'android' cmd_execute('-f', '/system/bin/sh', '-c', '-i') when 'linux', 'osx' if raw && !use_pty print_warning('Note: To use the fully interactive shell you must use a pty, i.e. %grnshell -it%clr') return false elsif use_pty && pty_shell(sh_path, raw: raw) return true end if client.framework.features.enabled?(Msf::FeatureManager::FULLY_INTERACTIVE_SHELLS) && !raw && !use_pty print_line('This Meterpreter supports %grnshell -it%clr to start a fully interactive TTY.') print_line('This will increase network traffic.') end cmd_execute('-f', '/bin/sh', '-c', '-i') else # Then this is a multi-platform meterpreter (e.g., php or java), which # must special-case COMSPEC to return the system-specific shell. path = client.sys.config.getenv('COMSPEC') # If that failed for whatever reason, guess it's unix path = (path && !path.empty?) ? path : '/bin/sh' if use_pty && path == '/bin/sh' && pty_shell(sh_path, raw: raw) return true end cmd_execute('-f', path, '-c', '-i') end end |
#cmd_shell_help ⇒ Object
305 306 307 308 309 310 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 305 def cmd_shell_help print_line 'Usage: shell [options]' print_line print_line 'Opens an interactive native shell.' print_line shell_opts.usage end |
#cmd_shell_tabs(str, words) ⇒ Object
312 313 314 315 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 312 def cmd_shell_tabs(str, words) return shell_opts.option_keys if words.length == 1 [] end |
#cmd_shutdown(*args) ⇒ Object
Shuts down the remote computer.
1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1251 def cmd_shutdown(*args) force = 0 if args.length == 1 && args.first.strip == '-h' cmd_shutdown_help return true end @@shutdown_opts.parse(args) { |opt, idx, val| case opt when "-f" force = val.to_i end } print_line("Shutting down...") client.sys.power.shutdown(force, SHTDN_REASON_DEFAULT) end |
#cmd_shutdown_help ⇒ Object
1271 1272 1273 1274 1275 1276 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1271 def cmd_shutdown_help print_line('Usage: shutdown [options]') print_line print_line('Shutdown the remote machine.') print @@shutdown_opts.usage end |
#cmd_shutdown_tabs(str, words) ⇒ Object
1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1278 def cmd_shutdown_tabs(str, words) return @@shutdown_opts.option_keys if words.length == 1 case words[-1] when '-f' return %w[1 2] end [] end |
#cmd_steal_token(*args) ⇒ Object
Tries to steal the primary token from the target process.
1206 1207 1208 1209 1210 1211 1212 1213 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1206 def cmd_steal_token(*args) if args.empty? || args.include?('-h') print_line('Usage: steal_token [pid]') return true end print_line("Stolen token with username: " + client.sys.config.steal_token(args[0])) end |
#cmd_suspend(*args) ⇒ Boolean
Accept process names, much of that code is done (kernelsmith)
Suspends or resumes a list of one or more pids
args
can optionally be -c to continue on error or -r to resume instead of suspend, followed by a list of one or more valid pids
1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1302 def cmd_suspend(*args) # give'em help if they want it, or seem confused if args.length == 0 or (args.include? "-h") cmd_suspend_help return true end continue = args.delete("-c") || false resume = args.delete("-r") || false # validate all the proposed pids first so we can bail if one is bogus valid_pids = validate_pids(args) args.uniq! diff = args - valid_pids.map {|e| e.to_s} if not diff.empty? # then we had an invalid pid print_error("The following pids are not valid: #{diff.join(", ").to_s}.") if continue print_status("Continuing. Invalid args have been removed from the list.") else print_error("Quitting. Use -c to continue using only the valid pids.") return false end end targetprocess = nil if resume print_status("Resuming: #{valid_pids.join(", ").to_s}") else print_status("Suspending: #{valid_pids.join(", ").to_s}") end begin valid_pids.each do |pid| print_status("Targeting process with PID #{pid}...") targetprocess = client.sys.process.open(pid, PROCESS_ALL_ACCESS) targetprocess.thread.each_thread do |x| if resume targetprocess.thread.open(x).resume else targetprocess.thread.open(x).suspend end end end rescue ::Rex::Post::Meterpreter::RequestError => e print_error "Error acting on the process: #{e.to_s}." print_error "Try migrating to a process with the same owner as the target process." print_error "Also consider running the win_privs post module and confirm SeDebug priv." return false unless continue ensure targetprocess.close if targetprocess end return true end |
#cmd_suspend_help ⇒ Object
help for the suspend command
1358 1359 1360 1361 1362 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1358 def cmd_suspend_help print_line("Usage: suspend [options] pid1 pid2 pid3 ...") print_line("Suspend one or more processes.") print @@suspend_opts.usage end |
#cmd_suspend_tabs(str, words) ⇒ Object
Tab completion for the suspend command
1367 1368 1369 1370 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1367 def cmd_suspend_tabs(str, words) return @@suspend_opts.option_keys if words.length == 1 [] end |
#cmd_sysinfo(*args) ⇒ Object
Displays information about the remote system.
1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 1225 def cmd_sysinfo(*args) info = client.sys.config.sysinfo(refresh: true) client.update_session_info width = "Meterpreter".length info.keys.each { |k| width = k.length if k.length > width and info[k] } info.each_pair do |key, value| print_line("#{key.ljust(width+1)}: #{value}") if value end print_line("#{"Meterpreter".ljust(width+1)}: #{client.session_type}") return true end |
#commands ⇒ Object
List of supported commands.
135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 135 def commands all = { 'clearev' => 'Clear the event log', 'drop_token' => 'Relinquishes any active impersonation token.', 'execute' => 'Execute a command', 'getpid' => 'Get the current process identifier', 'getprivs' => 'Attempt to enable all privileges available to the current process', 'getuid' => 'Get the user that the server is running as', 'getsid' => 'Get the SID of the user that the server is running as', 'getenv' => 'Get one or more environment variable values', 'kill' => 'Terminate a process', 'pkill' => 'Terminate processes by name', 'pgrep' => 'Filter processes by name', 'ps' => 'List running processes', 'reboot' => 'Reboots the remote computer', 'reg' => 'Modify and interact with the remote registry', 'rev2self' => 'Calls RevertToSelf() on the remote machine', 'shell' => 'Drop into a system command shell', 'shutdown' => 'Shuts down the remote computer', 'steal_token' => 'Attempts to steal an impersonation token from the target process', 'suspend' => 'Suspends or resumes a list of processes', 'sysinfo' => 'Gets information about the remote system, such as OS', 'localtime' => 'Displays the target system local date and time', } reqs = { 'clearev' => [ COMMAND_ID_STDAPI_SYS_EVENTLOG_OPEN, COMMAND_ID_STDAPI_SYS_EVENTLOG_CLEAR ], 'drop_token' => [COMMAND_ID_STDAPI_SYS_CONFIG_DROP_TOKEN], 'execute' => [COMMAND_ID_STDAPI_SYS_PROCESS_EXECUTE], 'getpid' => [COMMAND_ID_STDAPI_SYS_PROCESS_GETPID], 'getprivs' => [COMMAND_ID_STDAPI_SYS_CONFIG_GETPRIVS], 'getuid' => [COMMAND_ID_STDAPI_SYS_CONFIG_GETUID], 'getsid' => [COMMAND_ID_STDAPI_SYS_CONFIG_GETSID], 'getenv' => [COMMAND_ID_STDAPI_SYS_CONFIG_GETENV], 'kill' => [COMMAND_ID_STDAPI_SYS_PROCESS_KILL], 'pkill' => [ COMMAND_ID_STDAPI_SYS_PROCESS_KILL, COMMAND_ID_STDAPI_SYS_PROCESS_GET_PROCESSES ], 'pgrep' => [COMMAND_ID_STDAPI_SYS_PROCESS_GET_PROCESSES], 'ps' => [COMMAND_ID_STDAPI_SYS_PROCESS_GET_PROCESSES], 'reboot' => [COMMAND_ID_STDAPI_SYS_POWER_EXITWINDOWS], 'reg' => [ COMMAND_ID_STDAPI_REGISTRY_LOAD_KEY, COMMAND_ID_STDAPI_REGISTRY_UNLOAD_KEY, COMMAND_ID_STDAPI_REGISTRY_OPEN_KEY, COMMAND_ID_STDAPI_REGISTRY_OPEN_REMOTE_KEY, COMMAND_ID_STDAPI_REGISTRY_CREATE_KEY, COMMAND_ID_STDAPI_REGISTRY_DELETE_KEY, COMMAND_ID_STDAPI_REGISTRY_CLOSE_KEY, COMMAND_ID_STDAPI_REGISTRY_ENUM_KEY, COMMAND_ID_STDAPI_REGISTRY_SET_VALUE, COMMAND_ID_STDAPI_REGISTRY_QUERY_VALUE, COMMAND_ID_STDAPI_REGISTRY_DELETE_VALUE, COMMAND_ID_STDAPI_REGISTRY_QUERY_CLASS, COMMAND_ID_STDAPI_REGISTRY_ENUM_VALUE, ], 'rev2self' => [COMMAND_ID_STDAPI_SYS_CONFIG_REV2SELF], 'shell' => [COMMAND_ID_STDAPI_SYS_PROCESS_EXECUTE], 'shutdown' => [COMMAND_ID_STDAPI_SYS_POWER_EXITWINDOWS], 'steal_token' => [COMMAND_ID_STDAPI_SYS_CONFIG_STEAL_TOKEN], 'suspend' => [COMMAND_ID_STDAPI_SYS_PROCESS_ATTACH], 'sysinfo' => [COMMAND_ID_STDAPI_SYS_CONFIG_SYSINFO], 'localtime' => [COMMAND_ID_STDAPI_SYS_CONFIG_LOCALTIME], } filter_commands(all, reqs) end |
#execute_opts ⇒ Object
125 126 127 128 129 130 131 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 125 def execute_opts if client.framework.features.enabled?(Msf::FeatureManager::FULLY_INTERACTIVE_SHELLS) return @@execute_opts_with_raw_mode end @@execute_opts end |
#match_processes(processes, args, quiet: false) ⇒ Object
707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 707 def match_processes(processes, args, quiet: false) search_proc = nil search_user = nil exact_match = false # Parse opts @@ps_opts.parse(args) do |opt, idx, val| case opt when '-S', nil if val.nil? || val.empty? print_error "Enter a process name" processes = [] else search_proc = val end when "-U" if val.nil? || val.empty? print_line "Enter a process user" processes = [] else search_user = val end when '-x' exact_match = true when "-A" if val.nil? || val.empty? print_error "Enter an architecture" processes = [] else print_line "Filtering on arch '#{val}" if !quiet processes = processes.select do |p| p['arch'] == val end end when "-s" print_line "Filtering on SYSTEM processes..." if !quiet processes = processes.select do |p| ["NT AUTHORITY\\SYSTEM", "root"].include? p['user'] end when "-c" print_line "Filtering on child processes of the current shell..." if !quiet current_shell_pid = client.sys.process.getpid processes = processes.select do |p| p['ppid'] == current_shell_pid end end end unless search_proc.nil? print_line "Filtering on '#{search_proc}'" if !quiet if exact_match processes = processes.select do |p| p['name'] == search_proc end else match = /#{search_proc}/ processes = processes.select do |p| p['name'] =~ match end end end unless search_user.nil? print_line "Filtering on user '#{search_user}'" if !quiet if exact_match processes = processes.select do |p| p['user'] == search_user end else match = /#{search_user}/ processes = processes.select do |p| p['user'] =~ match end end end Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new(processes) end |
#name ⇒ Object
Name for this dispatcher.
208 209 210 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 208 def name "Stdapi: System" end |
#pty_shell(sh_path, raw: false) ⇒ Object
Spawn a PTY shell
399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 399 def pty_shell(sh_path, raw: false) args = ['-p'] if raw args << '-r' if raw if client.commands.include?(Extensions::Stdapi::COMMAND_ID_STDAPI_SYS_PROCESS_SET_TERM_SIZE) print_line("Terminal size will be synced automatically.") else print_line("You may want to set the correct terminal size manually.") print_line("Example: `stty rows {rows} cols {columns}`") end end sh_path = client.fs.file.exist?(sh_path) ? sh_path : '/bin/sh' # Python Meterpreter calls pty.openpty() - No need for other methods if client.arch == 'python' cmd_execute('-f', sh_path, '-c', '-i', *args) return true end # Check for the following in /usr{,/local}/bin: # script # python{,2,3} # socat # expect paths = %w[ /usr/bin/script /usr/bin/python /usr/local/bin/python /usr/bin/python2 /usr/local/bin/python2 /usr/bin/python3 /usr/local/bin/python3 /usr/bin/socat /usr/local/bin/socat /usr/bin/expect /usr/local/bin/expect ] # Select method for spawning PTY Shell based on availability on the target. path = paths.find { |p| client.fs.file.exist?(p) } return false unless path # Commands for methods cmd = case path when /script/ if client.platform == 'linux' "#{path} -qc #{sh_path} /dev/null" else # script(1) invocation for BSD, OS X, etc. "#{path} -q /dev/null #{sh_path}" end when /python/ "#{path} -c 'import pty; pty.spawn(\"#{sh_path}\")'" when /socat/ # sigint isn't passed through yet "#{path} - exec:#{sh_path},pty,sane,setsid,sigint,stderr" when /expect/ "#{path} -c 'spawn #{sh_path}; interact'" end # "env TERM=xterm" provides colors, "clear" command, etc. as available on the target. cmd.prepend('env TERM=xterm HISTFILE= ') print_status(cmd) cmd_execute('-f', cmd, '-c', '-i', '-z', *args) true end |
#shell_opts ⇒ Object
117 118 119 120 121 122 123 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 117 def shell_opts if client.framework.features.enabled?(Msf::FeatureManager::FULLY_INTERACTIVE_SHELLS) return @@shell_opts_with_fully_interactive_shell end @@shell_opts end |
#validate_pids(pids, allow_pid_0 = false, allow_session_pid = false) ⇒ Array
validates an array of pids against the running processes on target host behavior can be controlled to allow/deny process 0 and the session’s process the pids:
-
are converted to integers
-
have had pid 0 removed unless allow_pid_0
-
have had current session pid removed unless allow_session_pid (to protect the session)
-
have redundant entries removed
675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 |
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb', line 675 def validate_pids(pids, allow_pid_0 = false, allow_session_pid = false) return [] if (pids.class != Array or pids.empty?) valid_pids = [] # to minimize network traffic, we only get host processes once host_processes = client.sys.process.get_processes if host_processes.length < 1 print_error "No running processes found on the target host." return [] end # get the current session pid so we don't suspend it later mypid = client.sys.process.getpid.to_i # remove nils & redundant pids, convert to int clean_pids = pids.compact.uniq.map{|x| x.to_i} # now we look up the pids & remove bad stuff if nec clean_pids.delete_if do |p| ( (p == 0 and not allow_pid_0) or (p == mypid and not allow_session_pid) ) end clean_pids.each do |pid| # find the process with this pid theprocess = host_processes.find {|x| x["pid"] == pid} if ( theprocess.nil? ) next else valid_pids << pid end end valid_pids end |