Skip to content

Commit 123462b

Browse files
author
Brent Cook
committed
Land rapid7#8293, add initial multi-platform railgun support
2 parents af4505a + a3bcd20 commit 123462b

File tree

25 files changed

+539
-173
lines changed

25 files changed

+539
-173
lines changed

‎lib/msf/core/post/windows/railgun.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ module Windows
77
module Railgun
88

99
# Go through each dll and add a corresponding convenience method of the same name
10-
Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::Railgun::BUILTIN_DLLS.each do |api|
10+
Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::Railgun::BUILTIN_DLLS['windows'].each do |api|
1111
# We will be interpolating within an eval. We exercise due paranoia.
1212
unless api.to_s =~ /^\w+$/
1313
print_error 'Something is seriously wrong with Railgun.BUILTIN_DLLS list'

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb renamed to ‎lib/rex/post/meterpreter/extensions/stdapi/railgun/const_manager.rb

Lines changed: 51 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
2424
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2525

26+
require 'thread'
27+
2628
module Rex
2729
module Post
2830
module Meterpreter
@@ -31,9 +33,53 @@ module Stdapi
3133
module Railgun
3234

3335
#
34-
# Manages our library of windows constants
36+
# A container holding useful API Constants.
37+
#
38+
class ApiConstants
39+
40+
# This will be lazily loaded in self.manager
41+
@manager = nil
42+
43+
# Mutex to ensure we don't add constants more than once via thread races.
44+
@manager_semaphore = Mutex.new
45+
46+
class << self
47+
attr_accessor :manager_semaphore
48+
end
49+
50+
def self.inherited(child_class)
51+
child_class.manager_semaphore = Mutex.new
52+
end
53+
54+
#
55+
# Provides a frozen constant manager for the constants defined in
56+
# self.add_constants
57+
#
58+
def self.manager
59+
60+
# The first check for nil is to potentially skip the need to synchronize
61+
if @manager.nil?
62+
# Looks like we MAY need to load manager
63+
@manager_semaphore.synchronize do
64+
# We check once more. Now our options are synchronized
65+
if @manager.nil?
66+
@manager = ConstManager.new
67+
68+
self.add_constants(@manager)
69+
70+
@manager.freeze
71+
end
72+
end
73+
end
74+
75+
return @manager
76+
end
77+
end
78+
79+
#
80+
# Manages our library of constants
3581
#
36-
class WinConstManager
82+
class ConstManager
3783
attr_reader :consts
3884

3985
def initialize(initial_consts = {})
@@ -72,14 +118,14 @@ def is_parseable(s)
72118
end
73119

74120
#
75-
# Returns an array of constant names that have a value matching "winconst"
121+
# Returns an array of constant names that have a value matching "const"
76122
# and (optionally) a name that matches "filter_regex"
77123
#
78-
def select_const_names(winconst, filter_regex=nil)
124+
def select_const_names(const, filter_regex=nil)
79125
matches = []
80126

81127
consts.each_pair do |name, value|
82-
matches << name if value == winconst
128+
matches << name if value == const
83129
end
84130

85131
# Filter matches by name if a filter has been provided

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/api_constants.rb

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# -*- coding: binary -*-
2+
require 'rex/post/meterpreter/extensions/stdapi/railgun/const_manager'
3+
4+
module Rex
5+
module Post
6+
module Meterpreter
7+
module Extensions
8+
module Stdapi
9+
module Railgun
10+
module Def
11+
12+
#
13+
# A container holding useful Linux API Constants.
14+
#
15+
class DefApiConstants_linux < ApiConstants
16+
17+
#
18+
# Slurp in a giant list of known constants.
19+
#
20+
def self.add_constants(const_mgr)
21+
const_mgr.add_const('MAP_FILE', 0x00)
22+
const_mgr.add_const('MAP_SHARED', 0x01)
23+
const_mgr.add_const('MAP_PRIVATE', 0x02)
24+
const_mgr.add_const('MAP_FIXED', 0x10)
25+
const_mgr.add_const('MAP_ANON', 0x20)
26+
const_mgr.add_const('MAP_ANONYMOUS', 0x20)
27+
const_mgr.add_const('PROT_NONE', 0x00)
28+
const_mgr.add_const('PROT_READ', 0x01)
29+
const_mgr.add_const('PROT_WRITE', 0x02)
30+
const_mgr.add_const('PROT_EXEC', 0x04)
31+
const_mgr.add_const('PROT_GROWSDOWN', 0x01000000)
32+
const_mgr.add_const('PROT_GROWSUP', 0x02000000)
33+
34+
const_mgr.add_const("PF_UNSPEC", 0x00000000)
35+
const_mgr.add_const("PF_LOCAL", 0x00000001)
36+
const_mgr.add_const("PF_UNIX", 0x00000000)
37+
const_mgr.add_const("PF_FILE", 0x00000000)
38+
const_mgr.add_const("PF_INET", 0x00000002)
39+
const_mgr.add_const("PF_AX25", 0x00000003)
40+
const_mgr.add_const("PF_IPX", 0x00000004)
41+
const_mgr.add_const("PF_APPLETALK", 0x00000005)
42+
const_mgr.add_const("PF_NETROM", 0x00000006)
43+
const_mgr.add_const("PF_BRIDGE", 0x00000007)
44+
const_mgr.add_const("PF_ATMPVC", 0x00000008)
45+
const_mgr.add_const("PF_X25", 0x00000009)
46+
const_mgr.add_const("PF_INET6", 0x0000000a)
47+
const_mgr.add_const("PF_ROSE", 0x0000000b)
48+
const_mgr.add_const("PF_DECnet", 0x0000000c)
49+
const_mgr.add_const("PF_NETBEUI", 0x0000000d)
50+
const_mgr.add_const("PF_SECURITY", 0x0000000e)
51+
const_mgr.add_const("PF_KEY", 0x0000000f)
52+
const_mgr.add_const("PF_NETLINK", 0x00000010)
53+
const_mgr.add_const("PF_ROUTE", 0x00000000)
54+
const_mgr.add_const("PF_PACKET", 0x00000011)
55+
const_mgr.add_const("PF_ASH", 0x00000012)
56+
const_mgr.add_const("PF_ECONET", 0x00000013)
57+
const_mgr.add_const("PF_ATMSVC", 0x00000014)
58+
const_mgr.add_const("PF_RDS", 0x00000015)
59+
const_mgr.add_const("PF_SNA", 0x00000016)
60+
const_mgr.add_const("PF_IRDA", 0x00000017)
61+
const_mgr.add_const("PF_PPPOX", 0x00000018)
62+
const_mgr.add_const("PF_WANPIPE", 0x00000019)
63+
const_mgr.add_const("PF_LLC", 0x0000001a)
64+
const_mgr.add_const("PF_IB", 0x0000001b)
65+
const_mgr.add_const("PF_MPLS", 0x0000001c)
66+
const_mgr.add_const("PF_CAN", 0x0000001d)
67+
const_mgr.add_const("PF_TIPC", 0x0000001e)
68+
const_mgr.add_const("PF_BLUETOOTH", 0x0000001f)
69+
const_mgr.add_const("PF_IUCV", 0x00000020)
70+
const_mgr.add_const("PF_RXRPC", 0x00000021)
71+
const_mgr.add_const("PF_ISDN", 0x00000022)
72+
const_mgr.add_const("PF_PHONET", 0x00000023)
73+
const_mgr.add_const("PF_IEEE802154", 0x00000024)
74+
const_mgr.add_const("PF_CAIF", 0x00000025)
75+
const_mgr.add_const("PF_ALG", 0x00000026)
76+
const_mgr.add_const("PF_NFC", 0x00000027)
77+
const_mgr.add_const("PF_VSOCK", 0x00000028)
78+
const_mgr.add_const("PF_KCM", 0x00000029)
79+
const_mgr.add_const("PF_MAX", 0x0000002a)
80+
81+
const_mgr.add_const("AF_UNSPEC", 0x00000000)
82+
const_mgr.add_const("AF_LOCAL", 0x00000001)
83+
const_mgr.add_const("AF_UNIX", 0x00000000)
84+
const_mgr.add_const("AF_FILE", 0x00000000)
85+
const_mgr.add_const("AF_INET", 0x00000002)
86+
const_mgr.add_const("AF_AX25", 0x00000003)
87+
const_mgr.add_const("AF_IPX", 0x00000004)
88+
const_mgr.add_const("AF_APPLETALK", 0x00000005)
89+
const_mgr.add_const("AF_NETROM", 0x00000006)
90+
const_mgr.add_const("AF_BRIDGE", 0x00000007)
91+
const_mgr.add_const("AF_ATMPVC", 0x00000008)
92+
const_mgr.add_const("AF_X25", 0x00000009)
93+
const_mgr.add_const("AF_INET6", 0x0000000a)
94+
const_mgr.add_const("AF_ROSE", 0x0000000b)
95+
const_mgr.add_const("AF_DECnet", 0x0000000c)
96+
const_mgr.add_const("AF_NETBEUI", 0x0000000d)
97+
const_mgr.add_const("AF_SECURITY", 0x0000000e)
98+
const_mgr.add_const("AF_KEY", 0x0000000f)
99+
const_mgr.add_const("AF_NETLINK", 0x00000010)
100+
const_mgr.add_const("AF_ROUTE", 0x00000000)
101+
const_mgr.add_const("AF_PACKET", 0x00000011)
102+
const_mgr.add_const("AF_ASH", 0x00000012)
103+
const_mgr.add_const("AF_ECONET", 0x00000013)
104+
const_mgr.add_const("AF_ATMSVC", 0x00000014)
105+
const_mgr.add_const("AF_RDS", 0x00000015)
106+
const_mgr.add_const("AF_SNA", 0x00000016)
107+
const_mgr.add_const("AF_IRDA", 0x00000017)
108+
const_mgr.add_const("AF_PPPOX", 0x00000018)
109+
const_mgr.add_const("AF_WANPIPE", 0x00000019)
110+
const_mgr.add_const("AF_LLC", 0x0000001a)
111+
const_mgr.add_const("AF_IB", 0x0000001b)
112+
const_mgr.add_const("AF_MPLS", 0x0000001c)
113+
const_mgr.add_const("AF_CAN", 0x0000001d)
114+
const_mgr.add_const("AF_TIPC", 0x0000001e)
115+
const_mgr.add_const("AF_BLUETOOTH", 0x0000001f)
116+
const_mgr.add_const("AF_IUCV", 0x00000020)
117+
const_mgr.add_const("AF_RXRPC", 0x00000021)
118+
const_mgr.add_const("AF_ISDN", 0x00000022)
119+
const_mgr.add_const("AF_PHONET", 0x00000023)
120+
const_mgr.add_const("AF_IEEE802154", 0x00000024)
121+
const_mgr.add_const("AF_CAIF", 0x00000025)
122+
const_mgr.add_const("AF_ALG", 0x00000026)
123+
const_mgr.add_const("AF_NFC", 0x00000027)
124+
const_mgr.add_const("AF_VSOCK", 0x00000028)
125+
const_mgr.add_const("AF_KCM", 0x00000029)
126+
const_mgr.add_const("AF_MAX", 0x0000002a)
127+
128+
const_mgr.add_const("SOL_RAW", 0x000000ff)
129+
const_mgr.add_const("SOL_DECNET", 0x00000105)
130+
const_mgr.add_const("SOL_X25", 0x00000106)
131+
const_mgr.add_const("SOL_PACKET", 0x00000107)
132+
const_mgr.add_const("SOL_ATM", 0x00000108)
133+
const_mgr.add_const("SOL_AAL", 0x00000109)
134+
const_mgr.add_const("SOL_IRDA", 0x0000010a)
135+
const_mgr.add_const("SOL_NETBEUI", 0x0000010b)
136+
const_mgr.add_const("SOL_LLC", 0x0000010c)
137+
const_mgr.add_const("SOL_DCCP", 0x0000010d)
138+
const_mgr.add_const("SOL_NETLINK", 0x0000010e)
139+
const_mgr.add_const("SOL_TIPC", 0x0000010f)
140+
const_mgr.add_const("SOL_RXRPC", 0x00000110)
141+
const_mgr.add_const("SOL_PPPOL2TP", 0x00000111)
142+
const_mgr.add_const("SOL_BLUETOOTH", 0x00000112)
143+
const_mgr.add_const("SOL_PNPIPE", 0x00000113)
144+
const_mgr.add_const("SOL_RDS", 0x00000114)
145+
const_mgr.add_const("SOL_IUCV", 0x00000115)
146+
const_mgr.add_const("SOL_CAIF", 0x00000116)
147+
const_mgr.add_const("SOL_ALG", 0x00000117)
148+
const_mgr.add_const("SOL_NFC", 0x00000118)
149+
const_mgr.add_const("SOL_KCM", 0x00000119)
150+
end
151+
end
152+
153+
end; end; end; end; end; end; end

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/def_libc.rb

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# -*- coding: binary -*-
2+
module Rex
3+
module Post
4+
module Meterpreter
5+
module Extensions
6+
module Stdapi
7+
module Railgun
8+
module Def
9+
10+
class Def_libc
11+
12+
def self.create_dll(constant_manager, dll_path = 'libc.so.6')
13+
dll = DLL.new(dll_path, constant_manager)
14+
15+
dll.add_function(
16+
'calloc',
17+
'LPVOID',
18+
[
19+
['SIZE_T', 'nmemb', 'in'],
20+
['SIZE_T', 'size', 'in']
21+
],
22+
nil,
23+
'cdecl'
24+
)
25+
dll.add_function(
26+
'free',
27+
'VOID',
28+
[
29+
['LPVOID', 'ptr', 'in']
30+
],
31+
nil,
32+
'cdecl',
33+
)
34+
dll.add_function(
35+
'getpid',
36+
'DWORD',
37+
[],
38+
nil,
39+
'cdecl'
40+
)
41+
dll.add_function(
42+
'inet_ntop',
43+
'LPVOID',
44+
[
45+
['DWORD', 'af', 'in'],
46+
['PBLOB', 'src', 'in'],
47+
['PBLOB', 'dst', 'out'],
48+
['DWORD', 'size', 'in']
49+
],
50+
nil,
51+
'cdecl'
52+
)
53+
dll.add_function(
54+
'inet_pton',
55+
'DWORD',
56+
[
57+
['DWORD', 'af', 'in'],
58+
['PBLOB', 'src', 'in'],
59+
['PBLOB', 'dst', 'out']
60+
],
61+
nil,
62+
'cdecl'
63+
)
64+
dll.add_function(
65+
'malloc',
66+
'LPVOID',
67+
[['SIZE_T', 'size', 'in']],
68+
nil,
69+
'cdecl'
70+
)
71+
dll.add_function(
72+
'memfrob',
73+
'LPVOID',
74+
[
75+
['PBLOB', 'mem', 'inout'],
76+
['SIZE_T', 'length', 'in']
77+
],
78+
nil,
79+
'cdecl'
80+
)
81+
dll.add_function(
82+
'mmap',
83+
'LPVOID',
84+
[
85+
['LPVOID', 'addr', 'in'],
86+
['SIZE_T', 'length', 'in'],
87+
['DWORD', 'prot', 'in'],
88+
['DWORD', 'flags', 'in'],
89+
['DWORD', 'fd', 'in'],
90+
['SIZE_T', 'offset', 'in']
91+
],
92+
nil,
93+
'cdecl'
94+
)
95+
dll.add_function(
96+
'mprotect',
97+
'DWORD',
98+
[
99+
['LPVOID', 'addr', 'in'],
100+
['SIZE_T', 'length', 'in'],
101+
['DWORD', 'prot', 'in']
102+
],
103+
nil,
104+
'cdecl'
105+
)
106+
dll.add_function(
107+
'munmap',
108+
'DWORD',
109+
[
110+
['LPVOID', 'addr', 'in'],
111+
['SIZE_T', 'length', 'in']
112+
],
113+
nil,
114+
'cdecl'
115+
)
116+
return dll
117+
end
118+
119+
end
120+
121+
end; end; end; end; end; end; end

0 commit comments

Comments
 (0)