Module: Rex::Post::Meterpreter::PacketDispatcher

Included in:
Client
Defined in:
lib/rex/post/meterpreter/packet_dispatcher.rb

Overview

Handles packet transmission, reception, and correlation, and processing

Constant Summary collapse

PacketTimeout = 
600

Instance Method Summary collapse

Instance Method Details

#add_response_waiter(request, completion_routine = nil, completion_param = nil) ⇒ Object

Adds a waiter association with the supplied request packet.



315
316
317
318
319
320
321
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 315

def add_response_waiter(request, completion_routine = nil, completion_param = nil)
	waiter = PacketResponseWaiter.new(request.rid, completion_routine, completion_param)

	self.waiters << waiter

	return waiter
end

#deregister_inbound_handler(handler) ⇒ Object

Deregisters a previously registered inbound packet handler.



419
420
421
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 419

def deregister_inbound_handler(handler)
	@inbound_handlers.delete(handler)
end

#dispatch_inbound_packet(packet, client = nil) ⇒ Object

Dispatches and processes an inbound packet. If the packet is a response that has an associated waiter, the waiter is notified. Otherwise, the packet is passed onto any registered dispatch handlers until one returns success.



365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 365

def dispatch_inbound_packet(packet, client = nil)
	handled = false

	# If no client context was provided, return self as PacketDispatcher
	# is a mixin for the Client instance
	if (client == nil)
		client = self
	end

	# If the packet is a response, try to notify any potential
	# waiters
	if ((resp = packet.response?))
		if (notify_response_waiter(packet))
			return true
		end
	end


	# Enumerate all of the inbound packet handlers until one handles
	# the packet
	@inbound_handlers.each { |handler|

		handled = nil
		begin

		if ! resp
			handled = handler.request_handler(client, packet)
		else
			handled = handler.response_handler(client, packet)
		end

		rescue ::Exception => e
			dlog("Exception caught in dispatch_inbound_packet: handler=#{handler} #{e.class} #{e} #{e.backtrace}", 'meterpreter', LEV_1)
			return true
		end

		if (handled)
			break
		end
	}
	return handled
end

#initialize_inbound_handlers ⇒ Object

Initializes the inbound handlers.



355
356
357
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 355

def initialize_inbound_handlers
	@inbound_handlers = []
end

#monitor_socket ⇒ Object

Reception

Monitors the PacketDispatcher’s sock for data in its own thread context and parsers all inbound packets.



142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 142

def monitor_socket
	self.waiters = []

	@pqueue = []
	@finish = false
	@last_recvd = Time.now
	@ping_sent = false

	self.alive = true

	# Spawn a thread for receiving packets
	self.receiver_thread = Rex::ThreadFactory.spawn("MeterpreterReceiver", false) do
		while (self.alive)
			begin
				rv = Rex::ThreadSafe.select([ self.sock.fd ], nil, nil, 0.25)
				ping_time = 60
				# If there's nothing to read, and it's been awhile since we
				# saw a packet, we need to send a ping.  We wait
				# ping_time*2 seconds before deciding a session is dead.
				if (not rv and self.send_keepalives and Time.now - @last_recvd > ping_time)
					# If the queue is empty and we've already sent a
					# keepalive without getting a reply, then this
					# session is hosed, and we should give up on it.
					if @ping_sent and @pqueue.empty? and (Time.now - @last_recvd > ping_time * 2)
						dlog("No response to ping, session #{self.sid} is dead", LEV_3)
						self.alive = false
						@finish = true
						break
					end
					# Let the packet queue processor finish up before
					# we send a ping.
					if not @ping_sent and @pqueue.empty?
						# Our 'ping' is actually just a check for eof on
						# channel id 0.  This method has no side effects
						# and always returns an answer (regardless of the
						# existence of chan 0), which is all that's
						# needed for a liveness check.  The answer itself
						# is unimportant and is ignored.
						pkt = Packet.create_request('core_channel_eof')
						pkt.add_tlv(TLV_TYPE_CHANNEL_ID, 0)
						waiter = Proc.new { |response, param|
								@ping_sent = false
								@last_recvd = Time.now
							}
						send_packet(pkt, waiter)
						@ping_sent = true
					end
					next
				end
				next if not rv
				packet = receive_packet
				@pqueue << packet if packet
				@last_recvd = Time.now
			rescue ::Exception
				dlog("Exception caught in monitor_socket: #{$!}", 'meterpreter', LEV_1)
				@finish = true
				self.alive = false
				break
			end
		end
	end

	# Spawn a new thread that monitors the socket
	self.dispatcher_thread = Rex::ThreadFactory.spawn("MeterpreterDispatcher", false) do
		begin
		# Whether we're finished or not is determined by the receiver
		# thread above.
		while(not @finish)
			if(@pqueue.empty?)
				::IO.select(nil, nil, nil, 0.10)
				next
			end

			incomplete = []
			backlog    = []

			while(@pqueue.length > 0)
				backlog << @pqueue.shift
			end

			#
			# Prioritize message processing here
			# 1. Close should always be processed at the end
			# 2. Command responses always before channel data
			#

			tmp_command = []
			tmp_channel = []
			tmp_close   = []
			backlog.each do |pkt|
				if(pkt.response?)
					tmp_command << pkt
					next
				end
				if(pkt.method == "core_channel_close")
					tmp_close << pkt
					next
				end
				tmp_channel << pkt
			end

			backlog = []
			backlog.push(*tmp_command)
			backlog.push(*tmp_channel)
			backlog.push(*tmp_close)


			#
			# Process the message queue
			#

			backlog.each do |pkt|

				begin
				if ! dispatch_inbound_packet(pkt)
					# Only requeue packets newer than the timeout
					if (::Time.now.to_i - pkt.created_at.to_i < PacketTimeout)
						incomplete << pkt
					end
				end

				rescue ::Exception => e
					dlog("Dispatching exception with packet #{pkt}: #{e} #{e.backtrace}", 'meterpreter', LEV_1)
				end
			end

			@pqueue.unshift(*incomplete)

			if(@pqueue.length > 100)
				dlog("Backlog has grown to over 100 in monitor_socket, dropping older packets: #{@pqueue[0 .. 25].map{|x| x.inspect}.join(" - ")}", 'meterpreter', LEV_1)
				@pqueue = @pqueue[25 .. 100]
			end
		end
		rescue ::Exception => e
			dlog("Exception caught in monitor_socket dispatcher: #{e.class} #{e} #{e.backtrace}", 'meterpreter', LEV_1)
		ensure
			self.receiver_thread.kill if self.receiver_thread
		end
	end
end

#monitor_stop ⇒ Object

Stop the monitor



295
296
297
298
299
300
301
302
303
304
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 295

def monitor_stop
	if(self.receiver_thread)
		self.receiver_thread.kill
		self.receiver_thread = nil
	end
	if(self.dispatcher_thread)
		self.dispatcher_thread.kill
		self.dispatcher_thread = nil
	end
end

#notify_response_waiter(response) ⇒ Object

Notifies a whomever is waiting for a the supplied response, if anyone.



327
328
329
330
331
332
333
334
335
336
337
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 327

def notify_response_waiter(response)
	self.waiters.each() { |waiter|
		if (waiter.waiting_for?(response))
			waiter.notify(response)

			remove_response_waiter(waiter)

			break
		end
	}
end

#receive_packet ⇒ Object

Parses data from the dispatcher’s sock and returns a Packet context once a full packet has been received.



288
289
290
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 288

def receive_packet
	return parser.recv(self.sock)
end

#register_inbound_handler(handler) ⇒ Object

Registers an inbound packet handler that implements the InboundPacketHandler interface.



412
413
414
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 412

def register_inbound_handler(handler)
	@inbound_handlers << handler
end

#remove_response_waiter(waiter) ⇒ Object

Removes a waiter from the list of waiters.



342
343
344
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 342

def remove_response_waiter(waiter)
	self.waiters.delete(waiter)
end

#send_packet(packet, completion_routine = nil, completion_param = nil) ⇒ Object

Sends a packet without waiting for a response.



56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 56

def send_packet(packet, completion_routine = nil, completion_param = nil)
	if (completion_routine)
		add_response_waiter(packet, completion_routine, completion_param)
	end

	bytes = 0
	raw   = packet.to_r

	if (raw)
		begin
			bytes = self.sock.write(raw)
		rescue ::Exception => e
			# Mark the session itself as dead
			self.alive = false
			
			# Indicate that the dispatcher should shut down too
			@finish = true
			
			# Reraise the error to the top-level caller
			raise e		
		end
	end

	return bytes
end

#send_packet_wait_response(packet, t) ⇒ Object

Transmits a packet and waits for a response.



111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 111

def send_packet_wait_response(packet, t)
	# First, add the waiter association for the supplied packet
	waiter = add_response_waiter(packet)

	# Transmit the packet
	if (send_packet(packet) <= 0)
		# Remove the waiter if we failed to send the packet.
		remove_response_waiter(waiter)
		return nil
	end

	# Wait for the supplied time interval
	waiter.wait(t)

	# Remove the waiter from the list of waiters in case it wasn't
	# removed
	remove_response_waiter(waiter)

	# Return the response packet, if any
	return waiter.response
end

#send_request(packet, t = self.response_timeout) ⇒ Object

Sends a packet and waits for a timeout for the given time interval.



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/rex/post/meterpreter/packet_dispatcher.rb', line 85

def send_request(packet, t = self.response_timeout)
	
	if not t
		send_packet(packet)
		return nil
	end

	response = send_packet_wait_response(packet, t)

	if (response == nil)
		raise TimeoutError.new("Send timed out")
	elsif (response.result != 0)
		einfo = lookup_error(response.result)
		e = RequestError.new(packet.method, einfo, response.result)

		e.set_backtrace(caller)

		raise e
	end

	return response
end