Skip to content

Commit 3347af2

Browse files
zeroSteinerzeroSteiner
committed
Add some basic libc definitions for railgun
1 parent 9c60c3e commit 3347af2

File tree

3 files changed

+278
-59
lines changed

3 files changed

+278
-59
lines changed

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/api_constants.rb

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# -*- coding: binary -*-
2+
require 'rex/post/meterpreter/extensions/stdapi/railgun/const_manager'
3+
4+
module Rex
5+
module Post
6+
module Meterpreter
7+
module Extensions
8+
module Stdapi
9+
module Railgun
10+
module Def
11+
12+
#
13+
# A container holding useful Linux API Constants.
14+
#
15+
class DefApiConstants_linux < ApiConstants
16+
17+
#
18+
# Slurp in a giant list of known constants.
19+
#
20+
def self.add_constants(const_mgr)
21+
const_mgr.add_const('MAP_FILE', 0x00)
22+
const_mgr.add_const('MAP_SHARED', 0x01)
23+
const_mgr.add_const('MAP_PRIVATE', 0x02)
24+
const_mgr.add_const('MAP_FIXED', 0x10)
25+
const_mgr.add_const('MAP_ANON', 0x20)
26+
const_mgr.add_const('MAP_ANONYMOUS', 0x20)
27+
const_mgr.add_const('PROT_NONE', 0x00)
28+
const_mgr.add_const('PROT_READ', 0x01)
29+
const_mgr.add_const('PROT_WRITE', 0x02)
30+
const_mgr.add_const('PROT_EXEC', 0x04)
31+
const_mgr.add_const('PROT_GROWSDOWN', 0x01000000)
32+
const_mgr.add_const('PROT_GROWSUP', 0x02000000)
33+
34+
const_mgr.add_const("PF_UNSPEC", 0x00000000)
35+
const_mgr.add_const("PF_LOCAL", 0x00000001)
36+
const_mgr.add_const("PF_UNIX", 0x00000000)
37+
const_mgr.add_const("PF_FILE", 0x00000000)
38+
const_mgr.add_const("PF_INET", 0x00000002)
39+
const_mgr.add_const("PF_AX25", 0x00000003)
40+
const_mgr.add_const("PF_IPX", 0x00000004)
41+
const_mgr.add_const("PF_APPLETALK", 0x00000005)
42+
const_mgr.add_const("PF_NETROM", 0x00000006)
43+
const_mgr.add_const("PF_BRIDGE", 0x00000007)
44+
const_mgr.add_const("PF_ATMPVC", 0x00000008)
45+
const_mgr.add_const("PF_X25", 0x00000009)
46+
const_mgr.add_const("PF_INET6", 0x0000000a)
47+
const_mgr.add_const("PF_ROSE", 0x0000000b)
48+
const_mgr.add_const("PF_DECnet", 0x0000000c)
49+
const_mgr.add_const("PF_NETBEUI", 0x0000000d)
50+
const_mgr.add_const("PF_SECURITY", 0x0000000e)
51+
const_mgr.add_const("PF_KEY", 0x0000000f)
52+
const_mgr.add_const("PF_NETLINK", 0x00000010)
53+
const_mgr.add_const("PF_ROUTE", 0x00000000)
54+
const_mgr.add_const("PF_PACKET", 0x00000011)
55+
const_mgr.add_const("PF_ASH", 0x00000012)
56+
const_mgr.add_const("PF_ECONET", 0x00000013)
57+
const_mgr.add_const("PF_ATMSVC", 0x00000014)
58+
const_mgr.add_const("PF_RDS", 0x00000015)
59+
const_mgr.add_const("PF_SNA", 0x00000016)
60+
const_mgr.add_const("PF_IRDA", 0x00000017)
61+
const_mgr.add_const("PF_PPPOX", 0x00000018)
62+
const_mgr.add_const("PF_WANPIPE", 0x00000019)
63+
const_mgr.add_const("PF_LLC", 0x0000001a)
64+
const_mgr.add_const("PF_IB", 0x0000001b)
65+
const_mgr.add_const("PF_MPLS", 0x0000001c)
66+
const_mgr.add_const("PF_CAN", 0x0000001d)
67+
const_mgr.add_const("PF_TIPC", 0x0000001e)
68+
const_mgr.add_const("PF_BLUETOOTH", 0x0000001f)
69+
const_mgr.add_const("PF_IUCV", 0x00000020)
70+
const_mgr.add_const("PF_RXRPC", 0x00000021)
71+
const_mgr.add_const("PF_ISDN", 0x00000022)
72+
const_mgr.add_const("PF_PHONET", 0x00000023)
73+
const_mgr.add_const("PF_IEEE802154", 0x00000024)
74+
const_mgr.add_const("PF_CAIF", 0x00000025)
75+
const_mgr.add_const("PF_ALG", 0x00000026)
76+
const_mgr.add_const("PF_NFC", 0x00000027)
77+
const_mgr.add_const("PF_VSOCK", 0x00000028)
78+
const_mgr.add_const("PF_KCM", 0x00000029)
79+
const_mgr.add_const("PF_MAX", 0x0000002a)
80+
81+
const_mgr.add_const("AF_UNSPEC", 0x00000000)
82+
const_mgr.add_const("AF_LOCAL", 0x00000001)
83+
const_mgr.add_const("AF_UNIX", 0x00000000)
84+
const_mgr.add_const("AF_FILE", 0x00000000)
85+
const_mgr.add_const("AF_INET", 0x00000002)
86+
const_mgr.add_const("AF_AX25", 0x00000003)
87+
const_mgr.add_const("AF_IPX", 0x00000004)
88+
const_mgr.add_const("AF_APPLETALK", 0x00000005)
89+
const_mgr.add_const("AF_NETROM", 0x00000006)
90+
const_mgr.add_const("AF_BRIDGE", 0x00000007)
91+
const_mgr.add_const("AF_ATMPVC", 0x00000008)
92+
const_mgr.add_const("AF_X25", 0x00000009)
93+
const_mgr.add_const("AF_INET6", 0x0000000a)
94+
const_mgr.add_const("AF_ROSE", 0x0000000b)
95+
const_mgr.add_const("AF_DECnet", 0x0000000c)
96+
const_mgr.add_const("AF_NETBEUI", 0x0000000d)
97+
const_mgr.add_const("AF_SECURITY", 0x0000000e)
98+
const_mgr.add_const("AF_KEY", 0x0000000f)
99+
const_mgr.add_const("AF_NETLINK", 0x00000010)
100+
const_mgr.add_const("AF_ROUTE", 0x00000000)
101+
const_mgr.add_const("AF_PACKET", 0x00000011)
102+
const_mgr.add_const("AF_ASH", 0x00000012)
103+
const_mgr.add_const("AF_ECONET", 0x00000013)
104+
const_mgr.add_const("AF_ATMSVC", 0x00000014)
105+
const_mgr.add_const("AF_RDS", 0x00000015)
106+
const_mgr.add_const("AF_SNA", 0x00000016)
107+
const_mgr.add_const("AF_IRDA", 0x00000017)
108+
const_mgr.add_const("AF_PPPOX", 0x00000018)
109+
const_mgr.add_const("AF_WANPIPE", 0x00000019)
110+
const_mgr.add_const("AF_LLC", 0x0000001a)
111+
const_mgr.add_const("AF_IB", 0x0000001b)
112+
const_mgr.add_const("AF_MPLS", 0x0000001c)
113+
const_mgr.add_const("AF_CAN", 0x0000001d)
114+
const_mgr.add_const("AF_TIPC", 0x0000001e)
115+
const_mgr.add_const("AF_BLUETOOTH", 0x0000001f)
116+
const_mgr.add_const("AF_IUCV", 0x00000020)
117+
const_mgr.add_const("AF_RXRPC", 0x00000021)
118+
const_mgr.add_const("AF_ISDN", 0x00000022)
119+
const_mgr.add_const("AF_PHONET", 0x00000023)
120+
const_mgr.add_const("AF_IEEE802154", 0x00000024)
121+
const_mgr.add_const("AF_CAIF", 0x00000025)
122+
const_mgr.add_const("AF_ALG", 0x00000026)
123+
const_mgr.add_const("AF_NFC", 0x00000027)
124+
const_mgr.add_const("AF_VSOCK", 0x00000028)
125+
const_mgr.add_const("AF_KCM", 0x00000029)
126+
const_mgr.add_const("AF_MAX", 0x0000002a)
127+
128+
const_mgr.add_const("SOL_RAW", 0x000000ff)
129+
const_mgr.add_const("SOL_DECNET", 0x00000105)
130+
const_mgr.add_const("SOL_X25", 0x00000106)
131+
const_mgr.add_const("SOL_PACKET", 0x00000107)
132+
const_mgr.add_const("SOL_ATM", 0x00000108)
133+
const_mgr.add_const("SOL_AAL", 0x00000109)
134+
const_mgr.add_const("SOL_IRDA", 0x0000010a)
135+
const_mgr.add_const("SOL_NETBEUI", 0x0000010b)
136+
const_mgr.add_const("SOL_LLC", 0x0000010c)
137+
const_mgr.add_const("SOL_DCCP", 0x0000010d)
138+
const_mgr.add_const("SOL_NETLINK", 0x0000010e)
139+
const_mgr.add_const("SOL_TIPC", 0x0000010f)
140+
const_mgr.add_const("SOL_RXRPC", 0x00000110)
141+
const_mgr.add_const("SOL_PPPOL2TP", 0x00000111)
142+
const_mgr.add_const("SOL_BLUETOOTH", 0x00000112)
143+
const_mgr.add_const("SOL_PNPIPE", 0x00000113)
144+
const_mgr.add_const("SOL_RDS", 0x00000114)
145+
const_mgr.add_const("SOL_IUCV", 0x00000115)
146+
const_mgr.add_const("SOL_CAIF", 0x00000116)
147+
const_mgr.add_const("SOL_ALG", 0x00000117)
148+
const_mgr.add_const("SOL_NFC", 0x00000118)
149+
const_mgr.add_const("SOL_KCM", 0x00000119)
150+
end
151+
end
152+
153+
end; end; end; end; end; end; end

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/def_libc.rb

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# -*- coding: binary -*-
2+
module Rex
3+
module Post
4+
module Meterpreter
5+
module Extensions
6+
module Stdapi
7+
module Railgun
8+
module Def
9+
10+
class Def_libc
11+
12+
def self.create_dll(constant_manager, dll_path = 'libc.so.6')
13+
dll = DLL.new(dll_path, constant_manager)
14+
15+
dll.add_function(
16+
'calloc',
17+
'LPVOID',
18+
[
19+
['SIZE_T', 'nmemb', 'in'],
20+
['SIZE_T', 'size', 'in']
21+
],
22+
nil,
23+
'cdecl'
24+
)
25+
dll.add_function(
26+
'free',
27+
'VOID',
28+
[
29+
['LPVOID', 'ptr', 'in']
30+
],
31+
nil,
32+
'cdecl',
33+
)
34+
dll.add_function(
35+
'getpid',
36+
'DWORD',
37+
[],
38+
nil,
39+
'cdecl'
40+
)
41+
dll.add_function(
42+
'inet_ntop',
43+
'LPVOID',
44+
[
45+
['DWORD', 'af', 'in'],
46+
['PBLOB', 'src', 'in'],
47+
['PBLOB', 'dst', 'out'],
48+
['DWORD', 'size', 'in']
49+
],
50+
nil,
51+
'cdecl'
52+
)
53+
dll.add_function(
54+
'inet_pton',
55+
'DWORD',
56+
[
57+
['DWORD', 'af', 'in'],
58+
['PBLOB', 'src', 'in'],
59+
['PBLOB', 'dst', 'out']
60+
],
61+
nil,
62+
'cdecl'
63+
)
64+
dll.add_function(
65+
'malloc',
66+
'LPVOID',
67+
[['SIZE_T', 'size', 'in']],
68+
nil,
69+
'cdecl'
70+
)
71+
dll.add_function(
72+
'memfrob',
73+
'LPVOID',
74+
[
75+
['PBLOB', 'mem', 'inout'],
76+
['SIZE_T', 'length', 'in']
77+
],
78+
nil,
79+
'cdecl'
80+
)
81+
dll.add_function(
82+
'mmap',
83+
'LPVOID',
84+
[
85+
['LPVOID', 'addr', 'in'],
86+
['SIZE_T', 'length', 'in'],
87+
['DWORD', 'prot', 'in'],
88+
['DWORD', 'flags', 'in'],
89+
['DWORD', 'fd', 'in'],
90+
['SIZE_T', 'offset', 'in']
91+
],
92+
nil,
93+
'cdecl'
94+
)
95+
dll.add_function(
96+
'mprotect',
97+
'DWORD',
98+
[
99+
['LPVOID', 'addr', 'in'],
100+
['SIZE_T', 'length', 'in'],
101+
['DWORD', 'prot', 'in']
102+
],
103+
nil,
104+
'cdecl'
105+
)
106+
dll.add_function(
107+
'munmap',
108+
'DWORD',
109+
[
110+
['LPVOID', 'addr', 'in'],
111+
['SIZE_T', 'length', 'in']
112+
],
113+
nil,
114+
'cdecl'
115+
)
116+
return dll
117+
end
118+
119+
end
120+
121+
end; end; end; end; end; end; end

‎test/modules/post/test/railgun.rb

Lines changed: 4 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -19,66 +19,9 @@ def initialize(info={})
1919
))
2020
end
2121

22-
def init_railgun_defs
23-
unless session.railgun.dlls.has_key?('libc')
24-
session.railgun.add_dll('libc', 'libc.so.6')
25-
end
26-
session.railgun.add_function(
27-
'libc',
28-
'calloc',
29-
'LPVOID',
30-
[
31-
['SIZE_T', 'nmemb', 'in'],
32-
['SIZE_T', 'size', 'in']
33-
],
34-
nil,
35-
'cdecl'
36-
)
37-
session.railgun.add_function(
38-
'libc',
39-
'getpid',
40-
'DWORD',
41-
[],
42-
nil,
43-
'cdecl'
44-
)
45-
session.railgun.add_function(
46-
'libc',
47-
'inet_ntop',
48-
'LPVOID',
49-
[
50-
['DWORD', 'af', 'in'],
51-
['PBLOB', 'src', 'in'],
52-
['PBLOB', 'dst', 'out'],
53-
['DWORD', 'size', 'in']
54-
],
55-
nil,
56-
'cdecl'
57-
)
58-
session.railgun.add_function(
59-
'libc',
60-
'malloc',
61-
'LPVOID',
62-
[['SIZE_T', 'size', 'in']],
63-
nil,
64-
'cdecl'
65-
)
66-
session.railgun.add_function(
67-
'libc',
68-
'memfrob',
69-
'LPVOID',
70-
[
71-
['PBLOB', 'mem', 'inout'],
72-
['SIZE_T', 'length', 'in']
73-
],
74-
nil,
75-
'cdecl'
76-
)
77-
end
78-
7922
def test_api_function_calls_linux
8023
return unless session.platform == 'linux'
81-
init_railgun_defs
24+
8225
buffer = nil
8326
buffer_size = 128
8427
buffer_value = nil
@@ -107,7 +50,7 @@ def test_api_function_calls_linux
10750
it "Should support functions with in/out/inout parameter types" do
10851
ret = true
10952
# first test in/out parameter types
110-
result = session.railgun.libc.inet_ntop(2, "\x0a\x00\x00\x01", 128, 128)
53+
result = session.railgun.libc.inet_ntop('AF_INET', "\x0a\x00\x00\x01", 128, 128)
11154
ret &&= result['GetLastError'] == 0
11255
ret &&= result['return'] != 0
11356
ret &&= result['dst'][0...8] == '10.0.0.1'
@@ -140,6 +83,8 @@ def test_api_function_calls_linux
14083
ret = true
14184
ret &&= session.railgun.memread(buffer, buffer_size) == buffer_value
14285
end
86+
87+
session.railgun.libc.free(buffer)
14388
end
14489

14590
def test_api_function_calls_windows

0 commit comments

Comments
 (0)