Skip to content

Commit 685d959

Browse files
OJOJ
committed
Support refactors of TLVs and adsi nested group changes
1 parent 0c3a535 commit 685d959

File tree

3 files changed

+133
-23
lines changed
  • lib/rex/post/meterpreter

3 files changed

+133
-23
lines changed

‎lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb

Lines changed: 74 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,7 @@ def domain_query(domain_name, filter, max_results, page_size, fields)
4848

4949
response = client.send_request(request)
5050

51-
results = []
52-
response.each(TLV_TYPE_EXT_ADSI_RESULT) { |r|
53-
result = []
54-
r.each(TLV_TYPE_EXT_ADSI_VALUE) { |v|
55-
result << v.value
56-
}
57-
results << result
58-
}
51+
results = extract_results(response)
5952

6053
return {
6154
:fields => fields,
@@ -65,6 +58,79 @@ def domain_query(domain_name, filter, max_results, page_size, fields)
6558

6659
attr_accessor :client
6760

61+
protected
62+
63+
def extract_results(response)
64+
results = []
65+
66+
response.each(TLV_TYPE_EXT_ADSI_RESULT) do |r|
67+
results << extract_values(r)
68+
end
69+
70+
results
71+
end
72+
73+
def extract_values(tlv_container)
74+
values = []
75+
tlv_container.get_tlvs(TLV_TYPE_ANY).each do |v|
76+
values << extract_value(v)
77+
end
78+
values
79+
end
80+
81+
def extract_value(v)
82+
value = {
83+
:type => :unknown
84+
}
85+
86+
case v.type
87+
when TLV_TYPE_EXT_ADSI_STRING
88+
value = {
89+
:type => :string,
90+
:value => v.value
91+
}
92+
when TLV_TYPE_EXT_ADSI_NUMBER, TLV_TYPE_EXT_ADSI_BIGNUMBER
93+
value = {
94+
:type => :number,
95+
:value => v.value
96+
}
97+
when TLV_TYPE_EXT_ADSI_BOOL
98+
value = {
99+
:type => :bool,
100+
:value => v.value
101+
}
102+
when TLV_TYPE_EXT_ADSI_RAW
103+
value = {
104+
:type => :raw,
105+
:value => v.value
106+
}
107+
when TLV_TYPE_EXT_ADSI_ARRAY
108+
value = {
109+
:type => :array,
110+
:value => extract_values(v.value)
111+
}
112+
when TLV_TYPE_EXT_ADSI_PATH
113+
value = {
114+
:type => :path,
115+
:volume => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_VOL),
116+
:path => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_PATH),
117+
:vol_type => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_TYPE)
118+
}
119+
when TLV_TYPE_EXT_ADSI_DN
120+
values = v.get_tlvs(TLV_TYPE_ALL)
121+
value = {
122+
:type => :dn,
123+
:label => values[0].value
124+
}
125+
126+
if values[1].type == TLV_TYPE_EXT_ADSI_STRING
127+
value[:string] = value[1].value
128+
else
129+
value[:raw] = value[1].value
130+
end
131+
132+
value
133+
end
68134
end
69135

70136
end; end; end; end; end; end

‎lib/rex/post/meterpreter/extensions/extapi/tlv.rb

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,21 +54,31 @@ module Extapi
5454
TLV_TYPE_EXT_CLIPBOARD_MON_DUMP = TLV_META_TYPE_BOOL | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 52)
5555
TLV_TYPE_EXT_CLIPBOARD_MON_PURGE = TLV_META_TYPE_BOOL | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 53)
5656

57-
TLV_TYPE_EXT_ADSI_DOMAIN = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 55)
58-
TLV_TYPE_EXT_ADSI_FILTER = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 56)
59-
TLV_TYPE_EXT_ADSI_FIELD = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 57)
60-
TLV_TYPE_EXT_ADSI_VALUE = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 58)
61-
TLV_TYPE_EXT_ADSI_RESULT = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 59)
62-
TLV_TYPE_EXT_ADSI_MAXRESULTS = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 60)
63-
TLV_TYPE_EXT_ADSI_PAGESIZE = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 61)
57+
TLV_TYPE_EXT_ADSI_DOMAIN = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 54)
58+
TLV_TYPE_EXT_ADSI_FILTER = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 55)
59+
TLV_TYPE_EXT_ADSI_FIELD = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 56)
60+
TLV_TYPE_EXT_ADSI_RESULT = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 57)
61+
TLV_TYPE_EXT_ADSI_MAXRESULTS = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 58)
62+
TLV_TYPE_EXT_ADSI_PAGESIZE = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 59)
63+
TLV_TYPE_EXT_ADSI_ARRAY = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 60)
64+
TLV_TYPE_EXT_ADSI_STRING = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 61)
65+
TLV_TYPE_EXT_ADSI_NUMBER = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 62)
66+
TLV_TYPE_EXT_ADSI_BIGNUMBER = TLV_META_TYPE_QWORD | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 63)
67+
TLV_TYPE_EXT_ADSI_BOOL = TLV_META_TYPE_BOOL | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 64)
68+
TLV_TYPE_EXT_ADSI_RAW = TLV_META_TYPE_RAW | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 65)
69+
TLV_TYPE_EXT_ADSI_PATH = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 66)
70+
TLV_TYPE_EXT_ADSI_PATH_VOL = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 67)
71+
TLV_TYPE_EXT_ADSI_PATH_PATH = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 68)
72+
TLV_TYPE_EXT_ADSI_PATH_TYPE = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 69)
73+
TLV_TYPE_EXT_ADSI_DN = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 70)
6474

65-
TLV_TYPE_EXT_WMI_DOMAIN = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 65)
66-
TLV_TYPE_EXT_WMI_QUERY = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 66)
67-
TLV_TYPE_EXT_WMI_FIELD = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 67)
68-
TLV_TYPE_EXT_WMI_VALUE = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 68)
69-
TLV_TYPE_EXT_WMI_FIELDS = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 69)
70-
TLV_TYPE_EXT_WMI_VALUES = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 70)
71-
TLV_TYPE_EXT_WMI_ERROR = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 71)
75+
TLV_TYPE_EXT_WMI_DOMAIN = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 90)
76+
TLV_TYPE_EXT_WMI_QUERY = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 91)
77+
TLV_TYPE_EXT_WMI_FIELD = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 92)
78+
TLV_TYPE_EXT_WMI_VALUE = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 93)
79+
TLV_TYPE_EXT_WMI_FIELDS = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 94)
80+
TLV_TYPE_EXT_WMI_VALUES = TLV_META_TYPE_GROUP | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 95)
81+
TLV_TYPE_EXT_WMI_ERROR = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 96)
7282

7383
end
7484
end

‎lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ def cmd_adsi_domain_query(*args)
176176
)
177177

178178
objects[:results].each do |c|
179-
table << c
179+
table << to_table_row(c)
180180
end
181181

182182
print_line
@@ -189,6 +189,40 @@ def cmd_adsi_domain_query(*args)
189189
return true
190190
end
191191

192+
protected
193+
194+
def to_table_row(result)
195+
values = []
196+
197+
result.each do |v|
198+
case v[:type]
199+
when :string, :number, :bool
200+
values << v[:value].to_s
201+
when :raw
202+
# for UI level stuff, rendering raw as hex is really the only option
203+
values << Rex::Text.to_hex(v[:value], '')
204+
when :array
205+
val = "#{to_table_row(v[:value]).join(", ")}"
206+
207+
# we'll truncate the output of the array because it could be excessive if we
208+
# don't. Users who want the detail of this stuff should probably script it.
209+
if val.length > 50
210+
val = val[0,50] + ' ..."'
211+
end
212+
213+
values << "[#{val}]"
214+
when :dn
215+
values << "#{value[:string] || Rex::Text.to_hex(value[:raw], '')}"
216+
when :path
217+
values << "Vol: #{v[:volume]}, Path: #{v[:path]}, Type: #{v[:vol_type]}"
218+
when :unknown
219+
values << "(unknown)"
220+
end
221+
end
222+
223+
values
224+
end
225+
192226
end
193227

194228
end

0 commit comments

Comments
 (0)