Skip to content

Commit 14c94e4

Browse files
David MaloneyDavid Maloney
authored andcommitted
rolled changes into existing ps command
Some users requested this be added to the ps command via a -S opt instead of creating a new command. This limits the search to only one search parameter at a time but with the ability to pass RegEx I think that's fine
1 parent 4dbe776 commit 14c94e4

File tree

1 file changed

+30
-36
lines changed
  • lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi

1 file changed

+30
-36
lines changed

lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb

Lines changed: 30 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ class Console::CommandDispatcher::Stdapi::Sys
4545
"-r" => [ true, "The remote machine name to connect to (with current process credentials" ],
4646
"-w" => [ false, "Set KEY_WOW64 flag, valid values [32|64]." ])
4747

48+
@@ps_opts = Rex::Parser::Arguments.new(
49+
"-h" => [false, "Help menu."],
50+
"-S" => [true, "RegEx term(s) to filter results with "])
51+
4852
#
4953
# List of supported commands.
5054
#
@@ -58,7 +62,6 @@ def commands
5862
"getuid" => "Get the user that the server is running as",
5963
"kill" => "Terminate a process",
6064
"ps" => "List running processes",
61-
"findpids" => "Find Processes by name",
6265
"reboot" => "Reboots the remote computer",
6366
"reg" => "Modify and interact with the remote registry",
6467
"rev2self" => "Calls RevertToSelf() on the remote machine",
@@ -76,7 +79,6 @@ def commands
7679
"getuid" => [ "stdapi_sys_config_getuid" ],
7780
"kill" => [ "stdapi_sys_process_kill" ],
7881
"ps" => [ "stdapi_sys_process_get_processes" ],
79-
"findpids" => [ "stdapi_sys_process_get_processes" ],
8082
"reboot" => [ "stdapi_sys_power_exitwindows" ],
8183
"reg" => [
8284
"stdapi_registry_load_key",
@@ -276,6 +278,24 @@ def cmd_kill(*args)
276278
#
277279
def cmd_ps(*args)
278280
processes = client.sys.process.get_processes
281+
@@ps_opts.parse(args) do |opt, idx, val|
282+
case opt
283+
when "-h"
284+
cmd_ps_help
285+
return true
286+
when "-S"
287+
print_line "Performing Search..."
288+
searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new
289+
processes.each do |proc|
290+
if val.nil? or val.empty?
291+
print_line "You must supply a search term!"
292+
return false
293+
end
294+
searched_procs << proc if proc["name"].match(/#{val}/)
295+
end
296+
processes = searched_procs
297+
end
298+
end
279299
if (processes.length == 0)
280300
print_line("No running processes were found.")
281301
else
@@ -286,40 +306,14 @@ def cmd_ps(*args)
286306
return true
287307
end
288308

289-
def cmd_findpids(*args)
290-
if args.empty? or args.include? "-h"
291-
cmd_findpids_help
292-
return true
293-
end
294-
processes = client.sys.process.get_processes
295-
if (processes.length == 0)
296-
print_line("No running processes were found.")
297-
else
298-
searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new
299-
processes.each do |proc|
300-
args.each do |arg|
301-
if proc["name"].match(/#{arg}/)
302-
searched_procs << proc
303-
break
304-
end
305-
end
306-
end
307-
searched_procs.compact!
308-
if searched_procs.length == 0
309-
print_line("No running processes were found matching the supplied names.")
310-
else
311-
print_line
312-
print_line(searched_procs.to_table("Indent" => 1).to_s)
313-
print_line
314-
end
315-
end
316-
return true
317-
end
318-
319-
def cmd_findpids_help
320-
print_line "You must supply one or more process name to search for"
321-
print_line "e.g. findpids explorer.exe notepad.exe"
322-
print_line "You may also pass Regular Expressions: findpids *.svc.* *.dll.*"
309+
def cmd_ps_help
310+
print_line "Use the command with no arguments to see all running processes."
311+
print_line "You may supply a search term to filter the results:"
312+
print_line "\t ps -S explorer.exe"
313+
print_line "\t Would return any processes named explorer.exe"
314+
print_line "You may also pass Regular Expressions:"
315+
print_line "\tps -S *.svc.* "
316+
print_line "Would return any processes with 'svc' in the name"
323317
end
324318

325319
#

0 commit comments

Comments
 (0)