Class: Rex::Post::Meterpreter::Channel

Inherits:
Object
  • Object
show all
Extended by:
InboundPacketHandler
Defined in:
lib/rex/post/meterpreter/channel.rb

Overview

The channel class represents a logical data pipe that exists between the client and the server. The purpose and behavior of the channel depends on which type it is. The three basic types of channels are streams, datagrams, and pools. Streams are basically equivalent to a TCP connection. Bidirectional, connection-oriented streams. Datagrams are basically equivalent to a UDP session. Bidirectional, connectionless. Pools are basically equivalent to a uni-directional connection, like a file handle. Pools denote channels that only have requests flowing in one direction.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from InboundPacketHandler

request_handler, response_handler

Constructor Details

#initialize(client, cid, type, flags) ⇒ Channel

Initializes the instance’s attributes, such as client context, class identifier, type, and flags.



135
136
137
138
139
140
141
142
143
144
145
146
 
# File 'lib/rex/post/meterpreter/channel.rb', line 135

def initialize(client, cid, type, flags)
	self.client = client
	self.cid    = cid
	self.type   = type
	self.flags  = flags

	# Add this instance to the list
	if (cid and client)
		client.add_channel(self)
	end
	ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.cid) )
end

Instance Attribute Details

#cid ⇒ Object

The unique channel identifier.



412
413
414
 
# File 'lib/rex/post/meterpreter/channel.rb', line 412

def cid
  @cid
end

#client ⇒ Object

The associated meterpreter client instance



432
433
434
 
# File 'lib/rex/post/meterpreter/channel.rb', line 432

def client
  @client
end

#cls ⇒ Object

The class of channel (stream, datagram, pool).



420
421
422
 
# File 'lib/rex/post/meterpreter/channel.rb', line 420

def cls
  @cls
end

#flags ⇒ Object

Any channel-specific flag, like synchronous IO.



424
425
426
 
# File 'lib/rex/post/meterpreter/channel.rb', line 424

def flags
  @flags
end

#params ⇒ Object

Any channel-specific parameters.



428
429
430
 
# File 'lib/rex/post/meterpreter/channel.rb', line 428

def params
  @params
end

#type ⇒ Object

The type of channel.



416
417
418
 
# File 'lib/rex/post/meterpreter/channel.rb', line 416

def type
  @type
end

Class Method Details

._close(client, cid, addends = nil) ⇒ Object

Closes the channel.



272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
 
# File 'lib/rex/post/meterpreter/channel.rb', line 272

def self._close(client, cid, addends=nil)
	if (cid == nil)
		raise IOError, "Channel has been closed.", caller
	end

	request = Packet.create_request('core_channel_close')

	# Populate the request
	request.add_tlv(TLV_TYPE_CHANNEL_ID, cid)
	request.add_tlvs(addends)

	client.send_request(request, nil)

	# Disassociate this channel instance
	client.remove_channel(cid)

	return true
end

.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil) ⇒ Object

Creates a logical channel between the client and the server based on a given type.



97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/rex/post/meterpreter/channel.rb', line 97

def Channel.create(client, type = nil, klass = nil,
		flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil)
	request = Packet.create_request('core_channel_open')

	# Set the type of channel that we're allocating
	if (type != nil)
		request.add_tlv(TLV_TYPE_CHANNEL_TYPE, type)
	end

	# If no factory class was provided, use the default native class
	if (klass == nil)
		klass = self
	end

	request.add_tlv(TLV_TYPE_CHANNEL_CLASS, klass.cls)
	request.add_tlv(TLV_TYPE_FLAGS, flags)
	request.add_tlvs(addends);

	# Transmit the request and wait for the response
	response = client.send_request(request)
	cid      = response.get_tlv(TLV_TYPE_CHANNEL_ID).value

	# Create the channel instance
	channel  = klass.new(client, cid, type, flags)

	return channel
end

.finalize(client, cid) ⇒ Object 



148
149
150
 
# File 'lib/rex/post/meterpreter/channel.rb', line 148

def self.finalize(client,cid)
	proc { self._close(client,cid) }
end

.request_handler(client, packet) ⇒ Object

Class request handler for all channels that dispatches requests to the appropriate class instance’s DIO handler



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/rex/post/meterpreter/channel.rb', line 57

def request_handler(client, packet)
	cid = packet.get_tlv_value(TLV_TYPE_CHANNEL_ID)

	# No channel identifier, then drop it
	if (cid == nil)
		return false
	end

	channel = client.find_channel(cid)

	# No valid channel context? The channel may not be registered yet
	if (channel == nil)
		return false
	end


	dio = channel.dio_map(packet.method)

	# Supported DIO request? Dump it.
	if (dio == nil)
		return true
	end


	# Call the channel's dio handler and return success or fail
	# based on what happens
	channel.dio_handler(dio, packet)
end

Instance Method Details

#_close(addends = nil) ⇒ Object 



291
292
293
294
 
# File 'lib/rex/post/meterpreter/channel.rb', line 291

def _close(addends = nil)
	self.class._close(self.client, self.cid, addends)
	self.cid = nil
end

#_read(length = nil, addends = nil) ⇒ Object

Reads data from the remote half of the channel.



168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
 
# File 'lib/rex/post/meterpreter/channel.rb', line 168

def _read(length = nil, addends = nil)
	if (self.cid == nil)
		raise IOError, "Channel has been closed.", caller
	end

	request = Packet.create_request('core_channel_read')

	if (length == nil)
		# Default block size to a higher amount for passive dispatcher
		length = self.client.passive_service ? (1024*1024) : 65536
	end

	request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)
	request.add_tlv(TLV_TYPE_LENGTH, length)
	request.add_tlvs(addends)

	begin
		response = self.client.send_request(request)
	rescue
		return nil
	end

	# If the channel is in synchronous mode, the response should contain
	# data that was read from the remote side of the channel
	if (flag?(CHANNEL_FLAG_SYNCHRONOUS))
		data = response.get_tlv(TLV_TYPE_CHANNEL_DATA);

		if (data != nil)
			return data.value
		end
	else
		raise NotImplementedError, "Asynchronous channel mode is not implemented", caller
	end

	return nil
end

#_write(buf, length = nil, addends = nil) ⇒ Object

Writes data to the remote half of the channel.



215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
 
# File 'lib/rex/post/meterpreter/channel.rb', line 215

def _write(buf, length = nil, addends = nil)

	if (self.cid == nil)
		raise IOError, "Channel has been closed.", caller
	end

	request = Packet.create_request('core_channel_write')

	# Truncation and celebration
	if ((length != nil) &&
	    (buf.length >= length))
		buf = buf[0..length]
	else
		length = buf.length
	end

	# Populate the request
	request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)

	cdata = request.add_tlv(TLV_TYPE_CHANNEL_DATA, buf)
	if( ( self.flags & CHANNEL_FLAG_COMPRESS ) == CHANNEL_FLAG_COMPRESS )
		cdata.compress = true
	end

	request.add_tlv(TLV_TYPE_LENGTH, length)
	request.add_tlvs(addends)

	response = self.client.send_request(request)
	written  = response.get_tlv(TLV_TYPE_LENGTH)

	return (written == nil) ? 0 : written.value
end

#close(addends = nil) ⇒ Object

Wrapper around the low-level close.



251
252
253
 
# File 'lib/rex/post/meterpreter/channel.rb', line 251

def close(addends = nil)
	return _close(addends)
end

#close_read ⇒ Object

Close the channel for future reads.



265
266
267
 
# File 'lib/rex/post/meterpreter/channel.rb', line 265

def close_read
	return _close
end

#close_write ⇒ Object

Close the channel for future writes.



258
259
260
 
# File 'lib/rex/post/meterpreter/channel.rb', line 258

def close_write
	return _close
end

#dio_close_handler(packet) ⇒ Object

Stub close handler.



357
358
359
360
361
362
363
364
365
366
367
368
369
370
 
# File 'lib/rex/post/meterpreter/channel.rb', line 357

def dio_close_handler(packet)
	client.remove_channel(self.cid)

	# Trap IOErrors as parts of the channel may have already been closed
	begin
		self.cleanup
	rescue IOError
	end

	# No more channel action, foo.
	self.cid = nil

	return true
end

#dio_handler(dio, packet) ⇒ Object

Handles dispatching I/O requests based on the request packet. The default implementation does nothing with direct I/O requests.



325
326
327
328
329
330
331
332
333
334
335
336
337
338
 
# File 'lib/rex/post/meterpreter/channel.rb', line 325

def dio_handler(dio, packet)
	if (dio == CHANNEL_DIO_READ)
		length = packet.get_tlv_value(TLV_TYPE_LENGTH)

		return dio_read_handler(packet, length)
	elsif (dio == CHANNEL_DIO_WRITE)
		data = packet.get_tlv_value(TLV_TYPE_CHANNEL_DATA)

		return dio_write_handler(packet, data)
	elsif (dio == CHANNEL_DIO_CLOSE)
		return dio_close_handler(packet)
	end
	return false;
end

#dio_map(method) ⇒ Object

Maps packet request methods to DIO request identifiers on a per-instance basis as other instances may add custom dio handlers.



377
378
379
380
381
382
383
384
385
386
387
 
# File 'lib/rex/post/meterpreter/channel.rb', line 377

def dio_map(method)
	if (method == 'core_channel_read')
		return CHANNEL_DIO_READ
	elsif (method == 'core_channel_write')
		return CHANNEL_DIO_WRITE
	elsif (method == 'core_channel_close')
		return CHANNEL_DIO_CLOSE
	end

	return nil
end

#dio_read_handler(packet, length) ⇒ Object

Stub read handler.



343
344
345
 
# File 'lib/rex/post/meterpreter/channel.rb', line 343

def dio_read_handler(packet, length)
	return true
end

#dio_write_handler(packet, data) ⇒ Object

Stub write handler.



350
351
352
 
# File 'lib/rex/post/meterpreter/channel.rb', line 350

def dio_write_handler(packet, data)
	return true
end

#flag?(flag) ⇒ Boolean

Checks to see if a flag is set on the instance’s flags attribute.

Returns:

  • (Boolean) 


398
399
400
 
# File 'lib/rex/post/meterpreter/channel.rb', line 398

def flag?(flag)
	return ((self.flags & flag) == flag)
end

#interactive(tf = true, addends = nil) ⇒ Object

Enables or disables interactive mode.



298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
 
# File 'lib/rex/post/meterpreter/channel.rb', line 298

def interactive(tf = true, addends = nil)
	if (self.cid == nil)
		raise IOError, "Channel has been closed.", caller
	end

	request = Packet.create_request('core_channel_interact')

	# Populate the request
	request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)
	request.add_tlv(TLV_TYPE_BOOL, tf)
	request.add_tlvs(addends)

	self.client.send_request(request)

	return true
end

#read(length = nil, addends = nil) ⇒ Object

Wrapper around the low-level channel read operation.



161
162
163
 
# File 'lib/rex/post/meterpreter/channel.rb', line 161

def read(length = nil, addends = nil)
	return _read(length, addends)
end

#synchronous? ⇒ Boolean

Returns whether or not the channel is operating synchronously.

Returns:

  • (Boolean) 


405
406
407
 
# File 'lib/rex/post/meterpreter/channel.rb', line 405

def synchronous?
	return (self.flags & CHANNEL_FLAG_SYNCHRONOUS)
end

#write(buf, length = nil, addends = nil) ⇒ Object

Wrapper around the low-level write.



208
209
210
 
# File 'lib/rex/post/meterpreter/channel.rb', line 208

def write(buf, length = nil, addends = nil)
	return _write(buf, length, addends)
end