Class: Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Stdapi::Fs

Inherits:
Object
  • Object
show all
Includes:
Rex::Post::Meterpreter::Ui::Console::CommandDispatcher
Defined in:
lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb

Overview

The file system portion of the standard API extension.

Constant Summary collapse

Klass = 
Console::CommandDispatcher::Stdapi::Fs
@@download_opts =

Options for the download command.

Rex::Parser::Arguments.new(
"-h" => [ false, "Help banner." ],
"-r" => [ false, "Download recursively." ])
@@upload_opts =

Options for the upload command.

Rex::Parser::Arguments.new(
"-h" => [ false, "Help banner." ],
"-r" => [ false, "Upload recursively." ])
@@ls_opts =

Options for the ls command

Rex::Parser::Arguments.new(
"-h" => [ false, "Help banner." ],
"-S" => [ true, "Search string." ],
"-t" => [ false, "Sort by time" ],
"-s" => [ false, "Sort by size" ],
"-r" => [ false, "Reverse sort order" ],
"-x" => [ false, "Show short file names" ],
"-l" => [ false, "List in long format (default)" ],
"-R" => [ false, "Recursively list subdirectories encountered" ])

Instance Attribute Summary

Attributes included from Ui::Text::DispatcherShell::CommandDispatcher

#shell, #tab_complete_items

Instance Method Summary collapse

Methods included from Rex::Post::Meterpreter::Ui::Console::CommandDispatcher

check_hash, #client, #initialize, #log_error, #msf_loaded?, set_hash

Methods included from Ui::Text::DispatcherShell::CommandDispatcher

#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #help_to_s, #initialize, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_filenames, #update_prompt

Instance Method Details

#cmd_cat(*args) ⇒ Object

Reads the contents of a file and prints them to the screen.



215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 215

def cmd_cat(*args)
  if (args.length == 0)
    print_line("Usage: cat file")
    return true
  end

  if (client.fs.file.stat(args[0]).directory?)
    print_error("#{args[0]} is a directory")
  else
    fd = client.fs.file.new(args[0], "rb")
    begin
      until fd.eof?
        print(fd.read)
      end
    # EOFError is raised if file is empty, do nothing, just catch
    rescue EOFError
    end
    fd.close
  end

  true
end

#cmd_cd(*args) ⇒ Object

Change the working directory.



241
242
243
244
245
246
247
248
249
250
251
252
253
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 241

def cmd_cd(*args)
  if (args.length == 0)
    print_line("Usage: cd directory")
    return true
  end
  if args[0] =~ /\%(\w*)\%/
    client.fs.dir.chdir(client.fs.file.expand_path(args[0].upcase))
  else
    client.fs.dir.chdir(args[0])
  end

  return true
end

#cmd_cp(*args) ⇒ Object Also known as: cmd_copy

Move source to destination



303
304
305
306
307
308
309
310
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 303

def cmd_cp(*args)
  if (args.length < 2)
    print_line("Usage: cp oldfile newfile")
    return true
  end
  client.fs.file.cp(args[0],args[1])
  return true
end

#cmd_download(*args) ⇒ Object

Downloads a file or directory from the remote machine to the local machine.



326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 326

def cmd_download(*args)
  if (args.empty? or args.include? "-h")
    cmd_download_help
    return true
  end

  recursive = false
  src_items = []
  last      = nil
  dest      = nil

  @@download_opts.parse(args) { |opt, idx, val|
    case opt
    when "-r"
      recursive = true
    when nil
      src_items << last if (last)
      last = val
    end
  }

  # No files given, nothing to do
  if not last
    cmd_download_help
    return true
  end

  # Source and destination will be the same
  if src_items.empty?
    src_items << last
    # Use the basename of the remote filename so we don't end up with
    # a file named c:\\boot.ini in linux
    dest = ::Rex::Post::Meterpreter::Extensions::Stdapi::Fs::File.basename(last)
  else
    dest = last
  end

  # Download to a directory, not a pattern
  if client.fs.file.is_glob?(dest)
    dest = ::File.dirname(dest)
  end

  # Go through each source item and download them
  src_items.each { |src|
    glob = nil
    if client.fs.file.is_glob?(src)
      glob = ::File.basename(src)
      src = ::File.dirname(src)
    end

    # Use search if possible for recursive pattern matching. It will work
    # more intuitively since it will not try to match on intermediate
    # directories, only file names.
    if glob && recursive && client.commands.include?('stdapi_fs_search')

      files = client.fs.file.search(src, glob, recursive)
      if !files.empty?
        print_line("Downloading #{files.length} file#{files.length > 1 ? 's' : ''}...")

        files.each do |file|
          src_separator = client.fs.file.separator
          src_path = file['path'] + client.fs.file.separator + file['name']
          dest_path = src_path.tr(src_separator, ::File::SEPARATOR)

          client.fs.file.download(dest_path, src_path) do |step, src, dst|
            puts step
            print_status("#{step.ljust(11)}: #{src} -> #{dst}")
            client.framework.events.on_session_download(client, src, dest) if msf_loaded?
          end
        end

      else
        print_status("No matching files found for download")
      end

    else
      # Perform direct matching
      stat = client.fs.file.stat(src)
      if (stat.directory?)
        client.fs.dir.download(dest, src, recursive, true, glob) do |step, src, dst|
          print_status("#{step.ljust(11)}: #{src} -> #{dst}")
          client.framework.events.on_session_download(client, src, dest) if msf_loaded?
        end
      elsif (stat.file?)
        client.fs.file.download(dest, src) do |step, src, dst|
          print_status("#{step.ljust(11)}: #{src} -> #{dst}")
          client.framework.events.on_session_download(client, src, dest) if msf_loaded?
        end
      end
    end
  }

  true
end

#cmd_download_help ⇒ Object 



315
316
317
318
319
320
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 315

def cmd_download_help
  print_line("Usage: download [options] src1 src2 src3 ... destination")
  print_line
  print_line("Downloads remote files and directories to the local machine.")
  print_line(@@download_opts.usage)
end

#cmd_edit(*args) ⇒ Object

Downloads a file to a temporary file, spawns and editor, and then uploads the contents to the remote machine after completion.



425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 425

def cmd_edit(*args)
  if (args.length == 0)
    print_line("Usage: edit file")
    return true
  end

  # Get a temporary file path
  meterp_temp = Tempfile.new('meterp')
  meterp_temp.binmode
  temp_path = meterp_temp.path

  # Try to download the file, but don't worry if it doesn't exist
  client.fs.file.download_file(temp_path, args[0]) rescue nil

  # Spawn the editor (default to vi)
  editor = Rex::Compat.getenv('EDITOR') || 'vi'

  # If it succeeds, upload it to the remote side.
  if (system("#{editor} #{temp_path}") == true)
    client.fs.file.upload_file(args[0], temp_path)
  end

  # Get rid of that pesky temporary file
  ::File.delete(temp_path) rescue nil
end

#cmd_lcd(*args) ⇒ Object

Change the local working directory.



258
259
260
261
262
263
264
265
266
267
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 258

def cmd_lcd(*args)
  if (args.length == 0)
    print_line("Usage: lcd directory")
    return true
  end

  ::Dir.chdir(args[0])

  return true
end

#cmd_lpwd(*args) ⇒ Object Also known as: cmd_getlwd

Display the local working directory.



454
455
456
457
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 454

def cmd_lpwd(*args)
  print_line(::Dir.pwd)
  return true
end

#cmd_ls(*args) ⇒ Object

Lists files



532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 532

def cmd_ls(*args)
  # Set defaults
  path = client.fs.dir.getwd
  search_term = nil
  sort = 'Name'
  short = nil
  order = :forward
  recursive = nil

  # Parse the args
  @@ls_opts.parse(args) { |opt, idx, val|
    case opt
    # Sort options
    when '-s'
      sort = 'Size'
    when '-t'
      sort = 'Last modified'
    # Output options
    when '-x'
      short = true
    when '-l'
      short = nil
    when '-r'
      order = :reverse
    when '-R'
      recursive = true
    # Search
    when '-S'
      search_term = val
      if search_term.nil?
        print_error("Enter a search term")
        return true
      else
        search_term = /#{search_term}/nmi
      end
    # Help and path
    when "-h"
      cmd_ls_help
      return 0
    when nil
      path = val
    end
  }

  columns = [ 'Mode', 'Size', 'Type', 'Last modified', 'Name' ]
  columns.insert(4, 'Short Name') if short

  stat_path = path

  # Check session capabilities
  is_glob = client.fs.file.is_glob?(path)
  if is_glob
    if !client.commands.include?('stdapi_fs_search')
      print_line('File globbing not supported with this session')
      return
    end
    stat_path = ::File.dirname(path)
  end

  stat = client.fs.file.stat(stat_path)
  if stat.directory?
    list_path(path, columns, sort, order, short, recursive, 0, search_term)
  else
    print_line("#{stat.prettymode}  #{stat.size}  #{stat.ftype[0,3]}  #{stat.mtime}  #{path}")
  end

  return true
end

#cmd_ls_help ⇒ Object 



462
463
464
465
466
467
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 462

def cmd_ls_help
  print_line "Usage: ls [options]"
  print_line
  print_line "Lists contents of directory or file info, searchable"
  print_line @@ls_opts.usage
end

#cmd_mkdir(*args) ⇒ Object

Make one or more directory.



604
605
606
607
608
609
610
611
612
613
614
615
616
617
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 604

def cmd_mkdir(*args)
  if (args.length == 0)
    print_line("Usage: mkdir dir1 dir2 dir3 ...")
    return true
  end

  args.each { |dir|
    print_line("Creating directory: #{dir}")

    client.fs.dir.mkdir(dir)
  }

  return true
end

#cmd_mv(*args) ⇒ Object Also known as: cmd_move, cmd_rename

Move source to destination



288
289
290
291
292
293
294
295
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 288

def cmd_mv(*args)
  if (args.length < 2)
    print_line("Usage: mv oldfile newfile")
    return true
  end
  client.fs.file.mv(args[0],args[1])
  return true
end

#cmd_pwd(*args) ⇒ Object Also known as: cmd_getwd

Display the working directory.



622
623
624
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 622

def cmd_pwd(*args)
  print_line(client.fs.dir.getwd)
end

#cmd_rm(*args) ⇒ Object Also known as: cmd_del

Delete the specified file.



272
273
274
275
276
277
278
279
280
281
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 272

def cmd_rm(*args)
  if (args.length == 0)
    print_line("Usage: rm file")
    return true
  end

  client.fs.file.rm(args[0])

  return true
end

#cmd_rmdir(*args) ⇒ Object

Removes one or more directory if it’s empty.



631
632
633
634
635
636
637
638
639
640
641
642
643
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 631

def cmd_rmdir(*args)
  if (args.length == 0 or args.include?("-h"))
    print_line("Usage: rmdir dir1 dir2 dir3 ...")
    return true
  end

  args.each { |dir|
    print_line("Removing directory: #{dir}")
    client.fs.dir.rmdir(dir)
  }

  return true
end

#cmd_search(*args) ⇒ Object

Search for files.



117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 117

def cmd_search(*args)

  root    = nil
  recurse = true
  globs   = []
  files   = []

  opts = Rex::Parser::Arguments.new(
    "-h" => [ false, "Help Banner." ],
    "-d" => [ true,  "The directory/drive to begin searching from. Leave empty to search all drives. (Default: #{root})" ],
    "-f" => [ true,  "A file pattern glob to search for. (e.g. *secret*.doc?)" ],
    "-r" => [ true,  "Recursivly search sub directories. (Default: #{recurse})" ]
  )

  opts.parse(args) { | opt, idx, val |
    case opt
      when "-h"
        print_line("Usage: search [-d dir] [-r recurse] -f pattern [-f pattern]...")
        print_line("Search for files.")
        print_line(opts.usage)
        return
      when "-d"
        root = val
      when "-f"
        globs << val
      when "-r"
        recurse = false if val =~ /^(f|n|0)/i
    end
  }

  if globs.empty?
    print_error("You must specify a valid file glob to search for, e.g. >search -f *.doc")
    return
  end

  globs.uniq.each do |glob|
    files += client.fs.file.search(root, glob, recurse)
  end

  if files.empty?
    print_line("No files matching your search were found.")
    return
  end

  print_line("Found #{files.length} result#{ files.length > 1 ? 's' : '' }...")
  files.each do | file |
    if file['size'] > 0
      print("    #{file['path']}#{ file['path'].empty? ? '' : '\\' }#{file['name']} (#{file['size']} bytes)\n")
    else
      print("    #{file['path']}#{ file['path'].empty? ? '' : '\\' }#{file['name']}\n")
    end
  end

end

#cmd_show_mount(*args) ⇒ Object

Show all the mount points/logical drives (currently geared towards the Windows Meterpreter).



176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 176

def cmd_show_mount(*args)
  if args.include?('-h')
    print_line('Usage: show_mount')
    return true
  end

  mounts = client.fs.mount.show_mount

  table = Rex::Ui::Text::Table.new(
    'Header'    => 'Mounts / Drives',
    'Indent'    => 0,
    'SortIndex' => 0,
    'Columns'   => [
      'Name', 'Type', 'Size (Total)', 'Size (Free)', 'Mapped to'
    ]
  )

  mounts.each do |d|
    ts = ::Filesize.from("#{d[:total_space]} B").pretty.split(' ')
    fs = ::Filesize.from("#{d[:free_space]} B").pretty.split(' ')
    table << [
      d[:name],
      d[:type],
      "#{ts[0].rjust(6)} #{ts[1].ljust(3)}",
      "#{fs[0].rjust(6)} #{fs[1].ljust(3)}",
      d[:unc]
    ]
  end

  print_line
  print_line(table.to_s)
  print_line
  print_line("Total mounts/drives: #{mounts.length}")
  print_line
end

#cmd_upload(*args) ⇒ Object

Uploads a file or directory to the remote machine from the local machine.



656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 656

def cmd_upload(*args)
  if (args.empty? or args.include?("-h"))
    cmd_upload_help
    return true
  end

  recursive = false
  src_items = []
  last      = nil
  dest      = nil

  @@upload_opts.parse(args) { |opt, idx, val|
    case opt
      when "-r"
        recursive = true
      when nil
        if (last)
          src_items << last
        end

        last = val
    end
  }

  return true if not last

  # Source and destination will be the same
  src_items << last if src_items.empty?

  dest = last

  # Go through each source item and upload them
  src_items.each { |src|
    stat = ::File.stat(src)

    if (stat.directory?)
      client.fs.dir.upload(dest, src, recursive) { |step, src, dst|
        print_status("#{step.ljust(11)}: #{src} -> #{dst}")
        client.framework.events.on_session_upload(client, src, dest) if msf_loaded?
      }
    elsif (stat.file?)
      if client.fs.file.exists?(dest) and client.fs.file.stat(dest).directory?
        client.fs.file.upload(dest, src) { |step, src, dst|
          print_status("#{step.ljust(11)}: #{src} -> #{dst}")
          client.framework.events.on_session_upload(client, src, dest) if msf_loaded?
        }
      else
        client.fs.file.upload_file(dest, src) { |step, src, dst|
          print_status("#{step.ljust(11)}: #{src} -> #{dst}")
          client.framework.events.on_session_upload(client, src, dest) if msf_loaded?
        }
      end
    end
  }

  return true
end

#cmd_upload_help ⇒ Object 



645
646
647
648
649
650
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 645

def cmd_upload_help
  print_line("Usage: upload [options] src1 src2 src3 ... destination")
  print_line
  print_line("Uploads local files and directories to the remote machine.")
  print_line(@@upload_opts.usage)
end

#cmd_upload_tabs(str, words) ⇒ Object 



714
715
716
717
718
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 714

def cmd_upload_tabs(str, words)
  return [] if words.length > 1

  tab_complete_filenames(str, words)
end

#commands ⇒ Object

List of supported commands.



50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 50

def commands
  all = {
    'cat'        => 'Read the contents of a file to the screen',
    'cd'         => 'Change directory',
    'del'        => 'Delete the specified file',
    'download'   => 'Download a file or directory',
    'edit'       => 'Edit a file',
    'getlwd'     => 'Print local working directory',
    'getwd'      => 'Print working directory',
    'lcd'        => 'Change local working directory',
    'lpwd'       => 'Print local working directory',
    'ls'         => 'List files',
    'mkdir'      => 'Make directory',
    'pwd'        => 'Print working directory',
    'rm'         => 'Delete the specified file',
    'mv'	       => 'Move source to destination',
    'rmdir'      => 'Remove directory',
    'search'     => 'Search for files',
    'upload'     => 'Upload a file or directory',
    'show_mount' => 'List all mount points/logical drives',
  }

  reqs = {
    'cat'        => [],
    'cd'         => ['stdapi_fs_chdir'],
    'del'        => ['stdapi_fs_rm'],
    'download'   => [],
    'edit'       => [],
    'getlwd'     => [],
    'getwd'      => ['stdapi_fs_getwd'],
    'lcd'        => [],
    'lpwd'       => [],
    'ls'         => ['stdapi_fs_stat', 'stdapi_fs_ls'],
    'mkdir'      => ['stdapi_fs_mkdir'],
    'pwd'        => ['stdapi_fs_getwd'],
    'rmdir'      => ['stdapi_fs_delete_dir'],
    'rm'         => ['stdapi_fs_delete_file'],
    'mv'         => ['stdapi_fs_file_move'],
    'search'     => ['stdapi_fs_search'],
    'upload'     => [],
    'show_mount' => ['stdapi_fs_mount_show'],
  }

  all.delete_if do |cmd, desc|
    del = false
    reqs[cmd].each do |req|
      next if client.commands.include? req
      del = true
      break
    end

    del
  end

  all
end

#list_path(path, columns, sort, order, short, recursive = false, depth = 0, search_term = nil) ⇒ Object 



469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 469

def list_path(path, columns, sort, order, short, recursive = false, depth = 0, search_term = nil)

  # avoid infinite recursion
  if depth > 100
    return
  end

  tbl = Rex::Ui::Text::Table.new(
    'Header'  => "Listing: #{path}",
    'SortIndex' => columns.index(sort),
    'SortOrder' => order,
    'Columns' => columns,
    'SearchTerm' => search_term)

  items = 0

  # Enumerate each item...
  # No need to sort as Table will do it for us
  client.fs.dir.entries_with_info(path).each do |p|

    ffstat = p['StatBuf']
    fname = p['FileName'] || 'unknown'

    row = [
        ffstat ? ffstat.prettymode : '',
        ffstat ? ffstat.size       : '',
        ffstat ? ffstat.ftype[0,3] : '',
        ffstat ? ffstat.mtime      : '',
        fname
      ]
    row.insert(4, p['FileShortName'] || '') if short

    if fname != '.' && fname != '..'
      if row.join(' ') =~ /#{search_term}/
        tbl << row
        items += 1
      end

      if recursive && ffstat && ffstat.directory?
        if client.fs.file.is_glob?(path)
          child_path = ::File.dirname(path) + ::File::SEPARATOR + fname
          child_path += ::File::SEPARATOR + ::File.basename(path)
        else
          child_path = path + ::File::SEPARATOR + fname
        end
        begin
          list_path(child_path, columns, sort, order, short, recursive, depth + 1, search_term)
        rescue RequestError
        end
      end
    end
  end

  if items > 0
    print_line(tbl.to_s)
  else
    print_line("No entries exist in #{path}")
  end
end

#name ⇒ Object

Name for this dispatcher.



110
111
112
 
# File 'lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb', line 110

def name
  "Stdapi: File system"
end