Class: Rex::Post::Meterpreter::Client
- Inherits:
-
Object
- Object
- Rex::Post::Meterpreter::Client
- Includes:
- ChannelContainer, PacketDispatcher
- Defined in:
- lib/rex/post/meterpreter/client.rb
Overview
This class represents a logical meterpreter client class. This class provides an interface that is compatible with the Rex post-exploitation interface in terms of the feature set that it attempts to expose. This class is meant to drive a single meterpreter client session.
Constant Summary collapse
- @@ext_hash =
Extension name to class hash.
{}
- @@ssl_ctx =
Cached SSL certificate (required to scale)
nil
- @@ssl_mutex =
Mutex to synchronize class-wide operations
::Mutex.new
Constants included from PacketDispatcher
PacketDispatcher::PacketTimeout
Instance Attribute Summary collapse
-
#alive ⇒ Object
Whether this session is alive.
-
#capabilities ⇒ Object
The libraries available to this meterpreter server.
-
#comm_timeout ⇒ Object
The Communication Timeout.
-
#commands ⇒ Object
readonly
A list of the commands.
-
#conn_id ⇒ Object
The Connection ID.
-
#encode_unicode ⇒ Object
Flag indicating whether to hex-encode UTF-8 file names and other strings.
-
#expiration ⇒ Object
The Session Expiration Timeout.
-
#ext ⇒ Object
readonly
The extension alias under which all extensions can be accessed by name.
-
#passive_dispatcher ⇒ Object
The Passive Dispatcher.
-
#response_timeout ⇒ Object
The timeout value to use when waiting for responses.
-
#send_keepalives ⇒ Object
Whether to send pings every so often to determine liveness.
-
#sock ⇒ Object
readonly
The socket the client is communicating over.
-
#ssl ⇒ Object
Use SSL (HTTPS).
-
#target_id ⇒ Object
The unique target identifier for this payload.
-
#url ⇒ Object
The Connect URL.
Attributes included from ChannelContainer
Attributes included from PacketDispatcher
#comm_mutex, #passive_service, #recv_queue, #send_queue
Class Method Summary collapse
-
.check_ext_hash(name) ⇒ Object
Checks the extension hash to see if a class has already been associated with the supplied extension name.
-
.default_timeout ⇒ Object
Returns the default timeout that request packets will use when waiting for a response.
-
.lookup_error(code) ⇒ Object
Lookup the error that occurred.
-
.set_ext_hash(name, klass) ⇒ Object
Stores the name to class association for the supplied extension name.
Instance Method Summary collapse
-
#add_extension(name, commands = []) ⇒ Object
Loads the client half of the supplied extension and initializes it as a registered extension that can be reached through client.ext..
-
#cleanup_meterpreter ⇒ Object
Cleans up the meterpreter instance, terminating the dispatcher thread.
-
#deregister_extension(name) ⇒ Object
Deregisters an extension alias of the supplied name.
-
#deregister_extension_alias(name) ⇒ Object
Deregisters a previously registered extension alias.
-
#dump_extension_tree ⇒ Object
Dumps the extension tree.
-
#each_extension(&block) ⇒ Object
Enumerates all of the loaded extensions.
- #generate_ssl_context ⇒ Object
-
#init_meterpreter(sock, opts = {}) ⇒ Object
Initializes the meterpreter client instance.
-
#initialize(sock, opts = {}) ⇒ Client
constructor
Initializes the client context with the supplied socket through which communication with the server will be performed.
-
#method_missing(symbol, *args) ⇒ Object
Translates unhandled methods into registered extension aliases if a matching extension alias exists for the supplied symbol.
-
#register_extension_alias(name, ext) ⇒ Object
Registers an aliased extension that can be referenced through client.name.
-
#register_extension_aliases(aliases) ⇒ Object
Registers zero or more aliases that are provided in an array.
- #swap_sock_plain_to_ssl ⇒ Object
- #swap_sock_ssl_to_plain ⇒ Object
-
#unicode_filter_decode(str) ⇒ Object
Decodes (or not) a UTF-8 string.
-
#unicode_filter_encode(str) ⇒ Object
Encodes (or not) a UTF-8 string.
Methods included from ChannelContainer
#add_channel, #find_channel, #initialize_channels, #remove_channel
Methods included from PacketDispatcher
#add_response_waiter, #deregister_inbound_handler, #dispatch_inbound_packet, #initialize_inbound_handlers, #initialize_passive_dispatcher, #monitor_socket, #monitor_stop, #notify_response_waiter, #on_passive_request, #receive_packet, #register_inbound_handler, #remove_response_waiter, #send_packet, #send_packet_wait_response, #send_request, #shutdown_passive_dispatcher
Constructor Details
#initialize(sock, opts = {}) ⇒ Client
Initializes the client context with the supplied socket through which communication with the server will be performed.
81 82 83 |
# File 'lib/rex/post/meterpreter/client.rb', line 81 def initialize(sock,opts={}) init_meterpreter(sock, opts) end |
Dynamic Method Handling
This class handles dynamic methods through the method_missing method
#method_missing(symbol, *args) ⇒ Object
Translates unhandled methods into registered extension aliases if a matching extension alias exists for the supplied symbol.
285 286 287 288 |
# File 'lib/rex/post/meterpreter/client.rb', line 285 def method_missing(symbol, *args) #$stdout.puts("method_missing: #{symbol}") self.ext_aliases.aliases[symbol.to_s] end |
Instance Attribute Details
#alive ⇒ Object
Whether this session is alive. If the socket is disconnected or broken, this will be false
428 429 430 |
# File 'lib/rex/post/meterpreter/client.rb', line 428 def alive @alive end |
#capabilities ⇒ Object
The libraries available to this meterpreter server
436 437 438 |
# File 'lib/rex/post/meterpreter/client.rb', line 436 def capabilities @capabilities end |
#comm_timeout ⇒ Object
The Communication Timeout
456 457 458 |
# File 'lib/rex/post/meterpreter/client.rb', line 456 def comm_timeout @comm_timeout end |
#commands ⇒ Object
A list of the commands
468 469 470 |
# File 'lib/rex/post/meterpreter/client.rb', line 468 def commands @commands end |
#conn_id ⇒ Object
The Connection ID
440 441 442 |
# File 'lib/rex/post/meterpreter/client.rb', line 440 def conn_id @conn_id end |
#encode_unicode ⇒ Object
Flag indicating whether to hex-encode UTF-8 file names and other strings
464 465 466 |
# File 'lib/rex/post/meterpreter/client.rb', line 464 def encode_unicode @encode_unicode end |
#expiration ⇒ Object
The Session Expiration Timeout
452 453 454 |
# File 'lib/rex/post/meterpreter/client.rb', line 452 def expiration @expiration end |
#ext ⇒ Object
The extension alias under which all extensions can be accessed by name. For example:
client.ext.stdapi
411 412 413 |
# File 'lib/rex/post/meterpreter/client.rb', line 411 def ext @ext end |
#passive_dispatcher ⇒ Object
The Passive Dispatcher
460 461 462 |
# File 'lib/rex/post/meterpreter/client.rb', line 460 def passive_dispatcher @passive_dispatcher end |
#response_timeout ⇒ Object
The timeout value to use when waiting for responses.
419 420 421 |
# File 'lib/rex/post/meterpreter/client.rb', line 419 def response_timeout @response_timeout end |
#send_keepalives ⇒ Object
Whether to send pings every so often to determine liveness.
423 424 425 |
# File 'lib/rex/post/meterpreter/client.rb', line 423 def send_keepalives @send_keepalives end |
#sock ⇒ Object
The socket the client is communicating over.
415 416 417 |
# File 'lib/rex/post/meterpreter/client.rb', line 415 def sock @sock end |
#ssl ⇒ Object
Use SSL (HTTPS)
448 449 450 |
# File 'lib/rex/post/meterpreter/client.rb', line 448 def ssl @ssl end |
#target_id ⇒ Object
The unique target identifier for this payload
432 433 434 |
# File 'lib/rex/post/meterpreter/client.rb', line 432 def target_id @target_id end |
#url ⇒ Object
The Connect URL
444 445 446 |
# File 'lib/rex/post/meterpreter/client.rb', line 444 def url @url end |
Class Method Details
.check_ext_hash(name) ⇒ Object
Checks the extension hash to see if a class has already been associated with the supplied extension name.
66 67 68 |
# File 'lib/rex/post/meterpreter/client.rb', line 66 def self.check_ext_hash(name) @@ext_hash[name] end |
.default_timeout ⇒ Object
Returns the default timeout that request packets will use when waiting for a response.
271 272 273 |
# File 'lib/rex/post/meterpreter/client.rb', line 271 def Client.default_timeout return 300 end |
.lookup_error(code) ⇒ Object
Lookup the error that occurred
58 59 60 |
# File 'lib/rex/post/meterpreter/client.rb', line 58 def self.lookup_error(code) code end |
.set_ext_hash(name, klass) ⇒ Object
Stores the name to class association for the supplied extension name.
73 74 75 |
# File 'lib/rex/post/meterpreter/client.rb', line 73 def self.set_ext_hash(name, klass) @@ext_hash[name] = klass end |
Instance Method Details
#add_extension(name, commands = []) ⇒ Object
Loads the client half of the supplied extension and initializes it as a registered extension that can be reached through client.ext..
300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 |
# File 'lib/rex/post/meterpreter/client.rb', line 300 def add_extension(name, commands=[]) self.commands |= commands # Check to see if this extension has already been loaded. if ((klass = self.class.check_ext_hash(name.downcase)) == nil) old = Rex::Post::Meterpreter::Extensions.constants require("rex/post/meterpreter/extensions/#{name.downcase}/#{name.downcase}") new = Rex::Post::Meterpreter::Extensions.constants # No new constants added? if ((diff = new - old).empty?) diff = [ name.capitalize ] end klass = Rex::Post::Meterpreter::Extensions.const_get(diff[0]).const_get(diff[0]) # Save the module name to class association now that the code is # loaded. self.class.set_ext_hash(name.downcase, klass) end # Create a new instance of the extension inst = klass.new(self) self.ext.aliases[inst.name] = inst return true end |
#cleanup_meterpreter ⇒ Object
Cleans up the meterpreter instance, terminating the dispatcher thread.
88 89 90 91 92 93 94 95 |
# File 'lib/rex/post/meterpreter/client.rb', line 88 def cleanup_meterpreter ext.aliases.each_value do | extension | extension.cleanup if extension.respond_to?( 'cleanup' ) end dispatcher_thread.kill if dispatcher_thread core.shutdown rescue nil shutdown_passive_dispatcher end |
#deregister_extension(name) ⇒ Object
Deregisters an extension alias of the supplied name.
332 333 334 |
# File 'lib/rex/post/meterpreter/client.rb', line 332 def deregister_extension(name) self.ext.aliases.delete(name) end |
#deregister_extension_alias(name) ⇒ Object
Deregisters a previously registered extension alias.
375 376 377 |
# File 'lib/rex/post/meterpreter/client.rb', line 375 def deregister_extension_alias(name) self.ext_aliases.aliases.delete(name) end |
#dump_extension_tree ⇒ Object
Dumps the extension tree.
382 383 384 385 386 387 388 |
# File 'lib/rex/post/meterpreter/client.rb', line 382 def dump_extension_tree() items = [] items.concat(self.ext.dump_alias_tree('client.ext')) items.concat(self.ext_aliases.dump_alias_tree('client')) return items.sort end |
#each_extension(&block) ⇒ Object
Enumerates all of the loaded extensions.
339 340 341 |
# File 'lib/rex/post/meterpreter/client.rb', line 339 def each_extension(&block) self.ext.aliases.each(block) end |
#generate_ssl_context ⇒ Object
203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 |
# File 'lib/rex/post/meterpreter/client.rb', line 203 def generate_ssl_context @@ssl_mutex.synchronize do if not @@ssl_ctx wlog("Generating SSL certificate for Meterpreter sessions") key = OpenSSL::PKey::RSA.new(1024){ } cert = OpenSSL::X509::Certificate.new cert.version = 2 cert.serial = rand(0xFFFFFFFF) subject = OpenSSL::X509::Name.new([ ["C","US"], ['ST', Rex::Text.rand_state()], ["L", Rex::Text.rand_text_alpha(rand(20) + 10)], ["O", Rex::Text.rand_text_alpha(rand(20) + 10)], ["CN", self.sock.getsockname[1] || Rex::Text.rand_hostname], ]) issuer = OpenSSL::X509::Name.new([ ["C","US"], ['ST', Rex::Text.rand_state()], ["L", Rex::Text.rand_text_alpha(rand(20) + 10)], ["O", Rex::Text.rand_text_alpha(rand(20) + 10)], ["CN", Rex::Text.rand_text_alpha(rand(20) + 10)], ]) cert.subject = subject cert.issuer = issuer cert.not_before = Time.now - (3600 * 365) + rand(3600 * 14) cert.not_after = Time.now + (3600 * 365) + rand(3600 * 14) cert.public_key = key.public_key ef = OpenSSL::X509::ExtensionFactory.new(nil,cert) cert.extensions = [ ef.create_extension("basicConstraints","CA:FALSE"), ef.create_extension("subjectKeyIdentifier","hash"), ef.create_extension("extendedKeyUsage","serverAuth"), ef.create_extension("keyUsage","keyEncipherment,dataEncipherment,digitalSignature") ] ef.issuer_certificate = cert cert.add_extension ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") cert.sign(key, OpenSSL::Digest::SHA1.new) ctx = OpenSSL::SSL::SSLContext.new(:SSLv3) ctx.key = key ctx.cert = cert ctx.session_id_context = Rex::Text.rand_text(16) wlog("Generated SSL certificate for Meterpreter sessions") @@ssl_ctx = ctx end # End of if not @ssl_ctx end # End of mutex.synchronize @@ssl_ctx end |
#init_meterpreter(sock, opts = {}) ⇒ Object
Initializes the meterpreter client instance
100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 |
# File 'lib/rex/post/meterpreter/client.rb', line 100 def init_meterpreter(sock,opts={}) self.sock = sock self.parser = PacketParser.new self.ext = ObjectAliases.new self.ext_aliases = ObjectAliases.new self.alive = true self.target_id = opts[:target_id] self.capabilities = opts[:capabilities] || {} self.commands = [] self.conn_id = opts[:conn_id] self.url = opts[:url] self.ssl = opts[:ssl] self.expiration = opts[:expiration] self.comm_timeout = opts[:comm_timeout] self.passive_dispatcher = opts[:passive_dispatcher] self.response_timeout = opts[:timeout] || self.class.default_timeout self.send_keepalives = true # self.encode_unicode = opts.has_key?(:encode_unicode) ? opts[:encode_unicode] : true self.encode_unicode = false if opts[:passive_dispatcher] initialize_passive_dispatcher register_extension_alias('core', ClientCore.new(self)) initialize_inbound_handlers initialize_channels # Register the channel inbound packet handler register_inbound_handler(Rex::Post::Meterpreter::Channel) else # Switch the socket to SSL mode and receive the hello if needed if capabilities[:ssl] and not opts[:skip_ssl] swap_sock_plain_to_ssl() end register_extension_alias('core', ClientCore.new(self)) initialize_inbound_handlers initialize_channels # Register the channel inbound packet handler register_inbound_handler(Rex::Post::Meterpreter::Channel) monitor_socket end end |
#register_extension_alias(name, ext) ⇒ Object
Registers an aliased extension that can be referenced through client.name.
347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 |
# File 'lib/rex/post/meterpreter/client.rb', line 347 def register_extension_alias(name, ext) self.ext_aliases.aliases[name] = ext # Whee! Syntactic sugar, where art thou? # # Create an instance method on this object called +name+ that returns # +ext+. We have to do it this way instead of simply # self.class.class_eval so that other meterpreter sessions don't get # extension methods when this one does (class << self; self; end).class_eval do define_method(name.to_sym) do ext end end ext end |
#register_extension_aliases(aliases) ⇒ Object
Registers zero or more aliases that are provided in an array.
366 367 368 369 370 |
# File 'lib/rex/post/meterpreter/client.rb', line 366 def register_extension_aliases(aliases) aliases.each { |a| register_extension_alias(a['name'], a['ext']) } end |
#swap_sock_plain_to_ssl ⇒ Object
151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 |
# File 'lib/rex/post/meterpreter/client.rb', line 151 def swap_sock_plain_to_ssl # Create a new SSL session on the existing socket ctx = generate_ssl_context() ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx) # Use non-blocking OpenSSL operations on Windows if not ( ssl.respond_to?(:accept_nonblock) and Rex::Compat.is_windows ) ssl.accept else begin ssl.accept_nonblock # Ruby 1.8.7 and 1.9.0/1.9.1 uses a standard Errno rescue ::Errno::EAGAIN, ::Errno::EWOULDBLOCK IO::select(nil, nil, nil, 0.10) retry # Ruby 1.9.2+ uses IO::WaitReadable/IO::WaitWritable rescue ::Exception => e if ::IO.const_defined?('WaitReadable') and e.kind_of?(::IO::WaitReadable) IO::select( [ ssl ], nil, nil, 0.10 ) retry end if ::IO.const_defined?('WaitWritable') and e.kind_of?(::IO::WaitWritable) IO::select( nil, [ ssl ], nil, 0.10 ) retry end raise e end end self.sock.extend(Rex::Socket::SslTcp) self.sock.sslsock = ssl self.sock.sslctx = ctx tag = self.sock.get_once(-1, 30) if(not tag or tag !~ /^GET \//) raise RuntimeError, "Could not read the HTTP hello token" end end |
#swap_sock_ssl_to_plain ⇒ Object
194 195 196 197 198 199 200 201 |
# File 'lib/rex/post/meterpreter/client.rb', line 194 def swap_sock_ssl_to_plain # Remove references to the SSLSocket and Context self.sock.sslsock.close self.sock.sslsock = nil self.sock.sslctx = nil self.sock = self.sock.fd self.sock.extend(::Rex::Socket::Tcp) end |
#unicode_filter_decode(str) ⇒ Object
Decodes (or not) a UTF-8 string
400 401 402 |
# File 'lib/rex/post/meterpreter/client.rb', line 400 def unicode_filter_decode(str) self.encode_unicode ? Rex::Text.unicode_filter_decode(str) : str end |
#unicode_filter_encode(str) ⇒ Object
Encodes (or not) a UTF-8 string
393 394 395 |
# File 'lib/rex/post/meterpreter/client.rb', line 393 def unicode_filter_encode(str) self.encode_unicode ? Rex::Text.unicode_filter_encode(str) : str end |