Class: Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Config

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb

Overview

This class provides access to remote system configuration and information.

Instance Method Summary collapse

Constructor Details

#initialize(client) ⇒ Config

Returns a new instance of Config.



24
25
26
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 24

def initialize(client)
	self.client = client
end

Instance Method Details

#drop_token ⇒ Object

Drops any assumed token



72
73
74
75
76
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 72

def drop_token
	req = Packet.create_request('stdapi_sys_config_drop_token')
	res = client.send_request(req)
	return client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
end

#getprivs ⇒ Object

Enables all possible privileges



81
82
83
84
85
86
87
88
89
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 81

def getprivs
	req = Packet.create_request('stdapi_sys_config_getprivs')
	ret = []
	res = client.send_request(req)
	res.each(TLV_TYPE_PRIVILEGE) do |p|
		ret << p.value
	end
	return ret
end

#getuid ⇒ Object

Returns the username that the remote side is running as.



31
32
33
34
35
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 31

def getuid
	request  = Packet.create_request('stdapi_sys_config_getuid')
	response = client.send_request(request)
	return client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_USER_NAME) )
end

#revert_to_self ⇒ Object

Calls RevertToSelf on the remote machine.



55
56
57
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 55

def revert_to_self
	client.send_request(Packet.create_request('stdapi_sys_config_rev2self'))
end

#steal_token(pid) ⇒ Object

Steals the primary token from a target process



62
63
64
65
66
67
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 62

def steal_token(pid)
	req = Packet.create_request('stdapi_sys_config_steal_token')
	req.add_tlv(TLV_TYPE_PID, pid.to_i)
	res = client.send_request(req)
	return client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
end

#sysinfo ⇒ Object

Returns a hash of information about the remote computer.



40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb', line 40

def sysinfo
	request  = Packet.create_request('stdapi_sys_config_sysinfo')
	response = client.send_request(request)

	{
		'Computer'        => response.get_tlv_value(TLV_TYPE_COMPUTER_NAME),
		'OS'              => response.get_tlv_value(TLV_TYPE_OS_NAME),
		'Architecture'    => response.get_tlv_value(TLV_TYPE_ARCHITECTURE),
		'System Language' => response.get_tlv_value(TLV_TYPE_LANG_SYSTEM),
	}
end