Class: Rex::Post::Meterpreter::Tlv
- Inherits:
-
Object
- Object
- Rex::Post::Meterpreter::Tlv
- Defined in:
- lib/rex/post/meterpreter/packet.rb
Overview
Base TLV (Type-Length-Value) class
Direct Known Subclasses
Instance Attribute Summary collapse
-
#compress ⇒ Object
Returns the value of attribute compress.
-
#type ⇒ Object
Returns the value of attribute type.
-
#value ⇒ Object
Returns the value of attribute value.
Instance Method Summary collapse
-
#from_r(raw) ⇒ Object
Translates the raw format of the TLV into a sanitize version.
-
#initialize(type, value = nil, compress = false) ⇒ Tlv
constructor
Returns an instance of a TLV.
- #inspect ⇒ Object
-
#meta_type?(meta) ⇒ Boolean
Checks to see if a TLVs meta type is equivalent to the meta type passed.
-
#to_r ⇒ Object
Converts the TLV to raw.
-
#type?(type) ⇒ Boolean
Checks to see if the TLVs type is equivalent to the type passed.
-
#value?(value) ⇒ Boolean
Checks to see if the TLVs value is equivalent to the value passed.
Constructor Details
#initialize(type, value = nil, compress = false) ⇒ Tlv
Returns an instance of a TLV.
113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 |
# File 'lib/rex/post/meterpreter/packet.rb', line 113 def initialize(type, value = nil, compress=false) @type = type @compress = compress if (value != nil) if (type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING) if (value.kind_of?(Fixnum)) @value = value.to_s else @value = value.dup end else @value = value end end end |
Instance Attribute Details
#compress ⇒ Object
Returns the value of attribute compress.
102 103 104 |
# File 'lib/rex/post/meterpreter/packet.rb', line 102 def compress @compress end |
#type ⇒ Object
Returns the value of attribute type.
102 103 104 |
# File 'lib/rex/post/meterpreter/packet.rb', line 102 def type @type end |
#value ⇒ Object
Returns the value of attribute value.
102 103 104 |
# File 'lib/rex/post/meterpreter/packet.rb', line 102 def value @value end |
Instance Method Details
#from_r(raw) ⇒ Object
Translates the raw format of the TLV into a sanitize version.
266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 |
# File 'lib/rex/post/meterpreter/packet.rb', line 266 def from_r(raw) self.value = nil length, self.type = raw.unpack("NN"); # check if the tlv value has been compressed... if( self.type & TLV_META_TYPE_COMPRESSED == TLV_META_TYPE_COMPRESSED ) # set this TLV as using compression @compress = true # remove the TLV_META_TYPE_COMPRESSED flag from the tlv type to restore the # tlv type to its origional, allowing for transparent data compression. self.type = self.type ^ TLV_META_TYPE_COMPRESSED # decompress the compressed data (skipping the length and type DWORD's) raw_decompressed = Rex::Text.zlib_inflate( raw[8..length-1] ) # update the length to reflect the decompressed data length (+8 for the length and type DWORD's) length = raw_decompressed.length + 8 # update the raw buffer with the new length, decompressed data and updated type. raw = [length, self.type].pack("NN") + raw_decompressed end if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING) if (raw.length > 0) self.value = raw[8..length-2] else self.value = nil end elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT) self.value = raw.unpack("NNN")[2] elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD) self.value = raw.unpack("NNQ")[2] self.value = self.ntohq( self.value ) elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL) self.value = raw.unpack("NNc")[2] if (self.value == 1) self.value = true else self.value = false end else self.value = raw[8..length-1] end return length; end |
#inspect ⇒ Object
130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 |
# File 'lib/rex/post/meterpreter/packet.rb', line 130 def inspect utype = type ^ TLV_META_TYPE_COMPRESSED = case (utype & TLV_META_MASK) when TLV_META_TYPE_STRING; "STRING" when TLV_META_TYPE_UINT; "INT" when TLV_META_TYPE_RAW; "RAW" when TLV_META_TYPE_BOOL; "BOOL" when TLV_META_TYPE_QWORD; "QWORD" when TLV_META_TYPE_GROUP; "GROUP" when TLV_META_TYPE_COMPLEX; "COMPLEX" else; 'unknown-meta-type' end stype = case type when PACKET_TYPE_REQUEST; "Request" when PACKET_TYPE_RESPONSE; "Response" when TLV_TYPE_REQUEST_ID; "REQUEST-ID" when TLV_TYPE_METHOD; "METHOD" when TLV_TYPE_RESULT; "RESULT" when TLV_TYPE_EXCEPTION; "EXCEPTION" when TLV_TYPE_STRING; "STRING" when TLV_TYPE_UINT; "UINT" when TLV_TYPE_BOOL; "BOOL" when TLV_TYPE_LENGTH; "LENGTH" when TLV_TYPE_DATA; "DATA" when TLV_TYPE_FLAGS; "FLAGS" when TLV_TYPE_CHANNEL_ID; "CHANNEL-ID" when TLV_TYPE_CHANNEL_TYPE; "CHANNEL-TYPE" when TLV_TYPE_CHANNEL_DATA; "CHANNEL-DATA" when TLV_TYPE_CHANNEL_DATA_GROUP; "CHANNEL-DATA-GROUP" when TLV_TYPE_CHANNEL_CLASS; "CHANNEL-CLASS" when TLV_TYPE_CHANNEL_PARENTID; "CHANNEL-PARENTID" when TLV_TYPE_SEEK_WHENCE; "SEEK-WHENCE" when TLV_TYPE_SEEK_OFFSET; "SEEK-OFFSET" when TLV_TYPE_SEEK_POS; "SEEK-POS" when TLV_TYPE_EXCEPTION_CODE; "EXCEPTION-CODE" when TLV_TYPE_EXCEPTION_STRING; "EXCEPTION-STRING" when TLV_TYPE_LIBRARY_PATH; "LIBRARY-PATH" when TLV_TYPE_TARGET_PATH; "TARGET-PATH" when TLV_TYPE_MIGRATE_PID; "MIGRATE-PID" when TLV_TYPE_MIGRATE_LEN; "MIGRATE-LEN" when TLV_TYPE_MIGRATE_PAYLOAD; "MIGRATE-PAYLOAD" when TLV_TYPE_MIGRATE_ARCH; "MIGRATE-ARCH" # Extension classes don't exist yet, so can't use their constants # here. #when Extensions::Stdapi::TLV_TYPE_IP; 'ip-address' else; "unknown-#{type}" end val = value.inspect if val.length > 50 val = val[0,50] + ' ..."' end "#<#{self.class} type=#{stype} #{self.class.to_s =~ /Packet/ ? "tlvs=#{@tlvs.inspect}" : "meta=#{} value=#{val}"} >" end |
#meta_type?(meta) ⇒ Boolean
Checks to see if a TLVs meta type is equivalent to the meta type passed.
199 200 201 |
# File 'lib/rex/post/meterpreter/packet.rb', line 199 def () return (self.type & == ) end |
#to_r ⇒ Object
Converts the TLV to raw.
226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 |
# File 'lib/rex/post/meterpreter/packet.rb', line 226 def to_r raw = value.to_s; if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING) raw += "\x00" elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT) raw = [value].pack("N") elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD) raw = [ self.htonq( value.to_i ) ].pack("Q") elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL) if (value == true) raw = [1].pack("c") else raw = [0].pack("c") end end # check if the tlv is to be compressed... if( @compress ) raw_uncompressed = raw # compress the raw data raw_compressed = Rex::Text.zlib_deflate( raw_uncompressed ) # check we have actually made the raw data smaller... # (small blobs often compress slightly larger then the origional) # if the compressed data is not smaller, we dont use the compressed data if( raw_compressed.length < raw_uncompressed.length ) # if so, set the TLV's type to indicate compression is used self.type = self.type | TLV_META_TYPE_COMPRESSED # update the raw data with the uncompressed data length + compressed data # (we include the uncompressed data length as the C side will need to know this for decompression) raw = [ raw_uncompressed.length ].pack("N") + raw_compressed end end return [raw.length + 8, self.type].pack("NN") + raw end |
#type?(type) ⇒ Boolean
Checks to see if the TLVs type is equivalent to the type passed.
206 207 208 |
# File 'lib/rex/post/meterpreter/packet.rb', line 206 def type?(type) return self.type == type end |
#value?(value) ⇒ Boolean
Checks to see if the TLVs value is equivalent to the value passed.
213 214 215 |
# File 'lib/rex/post/meterpreter/packet.rb', line 213 def value?(value) return self.value == value end |