Class: Rex::Post::Meterpreter::Channel
- Inherits:
-
Object
- Object
- Rex::Post::Meterpreter::Channel
- Extended by:
- InboundPacketHandler
- Defined in:
- lib/rex/post/meterpreter/channel.rb
Overview
The channel class represents a logical data pipe that exists between the client and the server. The purpose and behavior of the channel depends on which type it is. The three basic types of channels are streams, datagrams, and pools. Streams are basically equivalent to a TCP connection. Bidirectional, connection-oriented streams. Datagrams are basically equivalent to a UDP session. Bidirectional, connectionless. Pools are basically equivalent to a uni-directional connection, like a file handle. Pools denote channels that only have requests flowing in one direction.
Direct Known Subclasses
Rex::Post::Meterpreter::Channels::Pool, Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel, Extensions::Stdapi::Net::SocketSubsystem::UdpChannel, Stream
Instance Attribute Summary collapse
-
#cid ⇒ Object
readonly
The unique channel identifier.
-
#client ⇒ Object
The associated meterpreter client instance.
-
#cls ⇒ Object
readonly
The class of channel (stream, datagram, pool).
-
#flags ⇒ Object
readonly
Any channel-specific flag, like synchronous IO.
-
#params ⇒ Object
Any channel-specific parameters.
-
#type ⇒ Object
readonly
The type of channel.
Class Method Summary collapse
-
._close(client, cid, addends = nil) ⇒ Object
Closes the channel.
-
.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil) ⇒ Object
Creates a logical channel between the client and the server based on a given type.
- .finalize(client, cid) ⇒ Object
-
.request_handler(client, packet) ⇒ Object
Class request handler for all channels that dispatches requests to the appropriate class instance’s DIO handler.
Instance Method Summary collapse
- #_close(addends = nil) ⇒ Object
-
#_read(length = nil, addends = nil) ⇒ Object
Reads data from the remote half of the channel.
-
#_write(buf, length = nil, addends = nil) ⇒ Object
Writes data to the remote half of the channel.
-
#close(addends = nil) ⇒ Object
Wrapper around the low-level close.
-
#close_read ⇒ Object
Close the channel for future reads.
-
#close_write ⇒ Object
Close the channel for future writes.
-
#dio_close_handler(packet) ⇒ Object
Stub close handler.
-
#dio_handler(dio, packet) ⇒ Object
Handles dispatching I/O requests based on the request packet.
-
#dio_map(method) ⇒ Object
Maps packet request methods to DIO request identifiers on a per-instance basis as other instances may add custom dio handlers.
-
#dio_read_handler(packet, length) ⇒ Object
Stub read handler.
-
#dio_write_handler(packet, data) ⇒ Object
Stub write handler.
-
#flag?(flag) ⇒ Boolean
Checks to see if a flag is set on the instance’s flags attribute.
-
#initialize(client, cid, type, flags) ⇒ Channel
constructor
Initializes the instance’s attributes, such as client context, class identifier, type, and flags.
-
#interactive(tf = true, addends = nil) ⇒ Object
Enables or disables interactive mode.
-
#read(length = nil, addends = nil) ⇒ Object
Wrapper around the low-level channel read operation.
-
#synchronous? ⇒ Boolean
Returns whether or not the channel is operating synchronously.
-
#write(buf, length = nil, addends = nil) ⇒ Object
Wrapper around the low-level write.
Methods included from InboundPacketHandler
request_handler, response_handler
Constructor Details
#initialize(client, cid, type, flags) ⇒ Channel
Initializes the instance’s attributes, such as client context, class identifier, type, and flags.
134 135 136 137 138 139 140 141 142 143 144 145 146 147 |
# File 'lib/rex/post/meterpreter/channel.rb', line 134 def initialize(client, cid, type, flags) self.client = client self.cid = cid self.type = type self.flags = flags # Add this instance to the list if (cid and client) client.add_channel(self) end # Ensure the remote object is closed when all references are removed ObjectSpace.define_finalizer(self, self.class.finalize(client, cid)) end |
Instance Attribute Details
#cid ⇒ Object
The unique channel identifier.
416 417 418 |
# File 'lib/rex/post/meterpreter/channel.rb', line 416 def cid @cid end |
#client ⇒ Object
The associated meterpreter client instance
436 437 438 |
# File 'lib/rex/post/meterpreter/channel.rb', line 436 def client @client end |
#cls ⇒ Object
The class of channel (stream, datagram, pool).
424 425 426 |
# File 'lib/rex/post/meterpreter/channel.rb', line 424 def cls @cls end |
#flags ⇒ Object
Any channel-specific flag, like synchronous IO.
428 429 430 |
# File 'lib/rex/post/meterpreter/channel.rb', line 428 def flags @flags end |
#params ⇒ Object
Any channel-specific parameters.
432 433 434 |
# File 'lib/rex/post/meterpreter/channel.rb', line 432 def params @params end |
#type ⇒ Object
The type of channel.
420 421 422 |
# File 'lib/rex/post/meterpreter/channel.rb', line 420 def type @type end |
Class Method Details
._close(client, cid, addends = nil) ⇒ Object
Closes the channel.
273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 |
# File 'lib/rex/post/meterpreter/channel.rb', line 273 def self._close(client, cid, addends=nil) if (cid == nil) raise IOError, "Channel has been closed.", caller end request = Packet.create_request('core_channel_close') # Populate the request request.add_tlv(TLV_TYPE_CHANNEL_ID, cid) request.add_tlvs(addends) client.send_request(request, nil) # Disassociate this channel instance client.remove_channel(cid) return true end |
.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil) ⇒ Object
Creates a logical channel between the client and the server based on a given type.
96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 |
# File 'lib/rex/post/meterpreter/channel.rb', line 96 def Channel.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil) request = Packet.create_request('core_channel_open') # Set the type of channel that we're allocating if (type != nil) request.add_tlv(TLV_TYPE_CHANNEL_TYPE, type) end # If no factory class was provided, use the default native class if (klass == nil) klass = self end request.add_tlv(TLV_TYPE_CHANNEL_CLASS, klass.cls) request.add_tlv(TLV_TYPE_FLAGS, flags) request.add_tlvs(addends); # Transmit the request and wait for the response response = client.send_request(request) cid = response.get_tlv(TLV_TYPE_CHANNEL_ID).value # Create the channel instance channel = klass.new(client, cid, type, flags) return channel end |
.finalize(client, cid) ⇒ Object
149 150 151 |
# File 'lib/rex/post/meterpreter/channel.rb', line 149 def self.finalize(client,cid) proc { self._close(client,cid) } end |
.request_handler(client, packet) ⇒ Object
Class request handler for all channels that dispatches requests to the appropriate class instance’s DIO handler
56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 |
# File 'lib/rex/post/meterpreter/channel.rb', line 56 def request_handler(client, packet) cid = packet.get_tlv_value(TLV_TYPE_CHANNEL_ID) # No channel identifier, then drop it if (cid == nil) return false end channel = client.find_channel(cid) # No valid channel context? The channel may not be registered yet if (channel == nil) return false end dio = channel.dio_map(packet.method) # Supported DIO request? Dump it. if (dio == nil) return true end # Call the channel's dio handler and return success or fail # based on what happens channel.dio_handler(dio, packet) end |
Instance Method Details
#_close(addends = nil) ⇒ Object
292 293 294 295 296 297 298 |
# File 'lib/rex/post/meterpreter/channel.rb', line 292 def _close(addends = nil) unless self.cid.nil? ObjectSpace.undefine_finalizer(self) self.class._close(self.client, self.cid, addends) self.cid = nil end end |
#_read(length = nil, addends = nil) ⇒ Object
Reads data from the remote half of the channel.
169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 |
# File 'lib/rex/post/meterpreter/channel.rb', line 169 def _read(length = nil, addends = nil) if (self.cid == nil) raise IOError, "Channel has been closed.", caller end request = Packet.create_request('core_channel_read') if (length == nil) # Default block size to a higher amount for passive dispatcher length = self.client.passive_service ? (1024*1024) : 65536 end request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid) request.add_tlv(TLV_TYPE_LENGTH, length) request.add_tlvs(addends) begin response = self.client.send_request(request) rescue return nil end # If the channel is in synchronous mode, the response should contain # data that was read from the remote side of the channel if (flag?(CHANNEL_FLAG_SYNCHRONOUS)) data = response.get_tlv(TLV_TYPE_CHANNEL_DATA); if (data != nil) return data.value end else raise NotImplementedError, "Asynchronous channel mode is not implemented", caller end return nil end |
#_write(buf, length = nil, addends = nil) ⇒ Object
Writes data to the remote half of the channel.
216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 |
# File 'lib/rex/post/meterpreter/channel.rb', line 216 def _write(buf, length = nil, addends = nil) if (self.cid == nil) raise IOError, "Channel has been closed.", caller end request = Packet.create_request('core_channel_write') # Truncation and celebration if ((length != nil) && (buf.length >= length)) buf = buf[0..length] else length = buf.length end # Populate the request request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid) cdata = request.add_tlv(TLV_TYPE_CHANNEL_DATA, buf) if( ( self.flags & CHANNEL_FLAG_COMPRESS ) == CHANNEL_FLAG_COMPRESS ) cdata.compress = true end request.add_tlv(TLV_TYPE_LENGTH, length) request.add_tlvs(addends) response = self.client.send_request(request) written = response.get_tlv(TLV_TYPE_LENGTH) return (written == nil) ? 0 : written.value end |
#close(addends = nil) ⇒ Object
Wrapper around the low-level close.
252 253 254 |
# File 'lib/rex/post/meterpreter/channel.rb', line 252 def close(addends = nil) return _close(addends) end |
#close_read ⇒ Object
Close the channel for future reads.
266 267 268 |
# File 'lib/rex/post/meterpreter/channel.rb', line 266 def close_read return _close end |
#close_write ⇒ Object
Close the channel for future writes.
259 260 261 |
# File 'lib/rex/post/meterpreter/channel.rb', line 259 def close_write return _close end |
#dio_close_handler(packet) ⇒ Object
Stub close handler.
361 362 363 364 365 366 367 368 369 370 371 372 373 374 |
# File 'lib/rex/post/meterpreter/channel.rb', line 361 def dio_close_handler(packet) client.remove_channel(self.cid) # Trap IOErrors as parts of the channel may have already been closed begin self.cleanup rescue IOError end # No more channel action, foo. self.cid = nil return true end |
#dio_handler(dio, packet) ⇒ Object
Handles dispatching I/O requests based on the request packet. The default implementation does nothing with direct I/O requests.
329 330 331 332 333 334 335 336 337 338 339 340 341 342 |
# File 'lib/rex/post/meterpreter/channel.rb', line 329 def dio_handler(dio, packet) if (dio == CHANNEL_DIO_READ) length = packet.get_tlv_value(TLV_TYPE_LENGTH) return dio_read_handler(packet, length) elsif (dio == CHANNEL_DIO_WRITE) data = packet.get_tlv_value(TLV_TYPE_CHANNEL_DATA) return dio_write_handler(packet, data) elsif (dio == CHANNEL_DIO_CLOSE) return dio_close_handler(packet) end return false; end |
#dio_map(method) ⇒ Object
Maps packet request methods to DIO request identifiers on a per-instance basis as other instances may add custom dio handlers.
381 382 383 384 385 386 387 388 389 390 391 |
# File 'lib/rex/post/meterpreter/channel.rb', line 381 def dio_map(method) if (method == 'core_channel_read') return CHANNEL_DIO_READ elsif (method == 'core_channel_write') return CHANNEL_DIO_WRITE elsif (method == 'core_channel_close') return CHANNEL_DIO_CLOSE end return nil end |
#dio_read_handler(packet, length) ⇒ Object
Stub read handler.
347 348 349 |
# File 'lib/rex/post/meterpreter/channel.rb', line 347 def dio_read_handler(packet, length) return true end |
#dio_write_handler(packet, data) ⇒ Object
Stub write handler.
354 355 356 |
# File 'lib/rex/post/meterpreter/channel.rb', line 354 def dio_write_handler(packet, data) return true end |
#flag?(flag) ⇒ Boolean
Checks to see if a flag is set on the instance’s flags attribute.
402 403 404 |
# File 'lib/rex/post/meterpreter/channel.rb', line 402 def flag?(flag) return ((self.flags & flag) == flag) end |
#interactive(tf = true, addends = nil) ⇒ Object
Enables or disables interactive mode.
302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 |
# File 'lib/rex/post/meterpreter/channel.rb', line 302 def interactive(tf = true, addends = nil) if (self.cid == nil) raise IOError, "Channel has been closed.", caller end request = Packet.create_request('core_channel_interact') # Populate the request request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid) request.add_tlv(TLV_TYPE_BOOL, tf) request.add_tlvs(addends) self.client.send_request(request) return true end |
#read(length = nil, addends = nil) ⇒ Object
Wrapper around the low-level channel read operation.
162 163 164 |
# File 'lib/rex/post/meterpreter/channel.rb', line 162 def read(length = nil, addends = nil) return _read(length, addends) end |
#synchronous? ⇒ Boolean
Returns whether or not the channel is operating synchronously.
409 410 411 |
# File 'lib/rex/post/meterpreter/channel.rb', line 409 def synchronous? return (self.flags & CHANNEL_FLAG_SYNCHRONOUS) end |
#write(buf, length = nil, addends = nil) ⇒ Object
Wrapper around the low-level write.
209 210 211 |
# File 'lib/rex/post/meterpreter/channel.rb', line 209 def write(buf, length = nil, addends = nil) return _write(buf, length, addends) end |