Skip to content

Commit 9c60c3e

Browse files
zeroSteinerzeroSteiner
committed
Support platform specific railgun constants
1 parent daf8833 commit 9c60c3e

19 files changed

+125
-99
lines changed

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager.rb renamed to ‎lib/rex/post/meterpreter/extensions/stdapi/railgun/const_manager.rb

Lines changed: 51 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
2424
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2525

26+
require 'thread'
27+
2628
module Rex
2729
module Post
2830
module Meterpreter
@@ -31,9 +33,53 @@ module Stdapi
3133
module Railgun
3234

3335
#
34-
# Manages our library of windows constants
36+
# A container holding useful API Constants.
37+
#
38+
class ApiConstants
39+
40+
# This will be lazily loaded in self.manager
41+
@manager = nil
42+
43+
# Mutex to ensure we don't add constants more than once via thread races.
44+
@manager_semaphore = Mutex.new
45+
46+
class << self
47+
attr_accessor :manager_semaphore
48+
end
49+
50+
def self.inherited(child_class)
51+
child_class.manager_semaphore = Mutex.new
52+
end
53+
54+
#
55+
# Provides a frozen constant manager for the constants defined in
56+
# self.add_constants
57+
#
58+
def self.manager
59+
60+
# The first check for nil is to potentially skip the need to synchronize
61+
if @manager.nil?
62+
# Looks like we MAY need to load manager
63+
@manager_semaphore.synchronize do
64+
# We check once more. Now our options are synchronized
65+
if @manager.nil?
66+
@manager = ConstManager.new
67+
68+
self.add_constants(@manager)
69+
70+
@manager.freeze
71+
end
72+
end
73+
end
74+
75+
return @manager
76+
end
77+
end
78+
79+
#
80+
# Manages our library of constants
3581
#
36-
class WinConstManager
82+
class ConstManager
3783
attr_reader :consts
3884

3985
def initialize(initial_consts = {})
@@ -72,14 +118,14 @@ def is_parseable(s)
72118
end
73119

74120
#
75-
# Returns an array of constant names that have a value matching "winconst"
121+
# Returns an array of constant names that have a value matching "const"
76122
# and (optionally) a name that matches "filter_regex"
77123
#
78-
def select_const_names(winconst, filter_regex=nil)
124+
def select_const_names(const, filter_regex=nil)
79125
matches = []
80126

81127
consts.each_pair do |name, value|
82-
matches << name if value == winconst
128+
matches << name if value == const
83129
end
84130

85131
# Filter matches by name if a filter has been provided

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/api_constants.rb renamed to ‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/api_constants.rb

Lines changed: 14 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,18 @@
11
# -*- coding: binary -*-
2-
require 'rex/post/meterpreter/extensions/stdapi/railgun/win_const_manager'
3-
require 'thread'
2+
require 'rex/post/meterpreter/extensions/stdapi/railgun/const_manager'
43

54
module Rex
65
module Post
76
module Meterpreter
87
module Extensions
98
module Stdapi
109
module Railgun
10+
module Def
1111

1212
#
1313
# A container holding useful Windows API Constants.
1414
#
15-
class ApiConstants
16-
17-
# This will be lazily loaded in self.manager
18-
@@manager = nil
19-
20-
# Mutex to ensure we don't add constants more than once via thread races.
21-
@@manager_semaphore = Mutex.new
22-
23-
#
24-
# Provides a frozen constant manager for the constants defined in
25-
# self.add_constants
26-
#
27-
def self.manager
28-
29-
# The first check for nil is to potentially skip the need to synchronize
30-
if @@manager.nil?
31-
# Looks like we MAY need to load manager
32-
@@manager_semaphore.synchronize do
33-
# We check once more. Now our options are synchronized
34-
if @@manager.nil?
35-
@@manager = WinConstManager.new
36-
37-
self.add_constants(@@manager)
38-
39-
@@manager.freeze
40-
end
41-
end
42-
end
43-
44-
return @@manager
45-
end
15+
class DefApiConstants_windows < ApiConstants
4616

4717
#
4818
# Slurp in a giant list of known constants.
@@ -2356,31 +2326,31 @@ def self.add_constants(win_const_mgr)
23562326
win_const_mgr.add_const('RTM_VIEW_MASK_UCAST',0x00000001)
23572327
win_const_mgr.add_const('CERT_ALT_NAME_VALUE_ERR_INDEX_MASK',0x0000FFFF)
23582328
win_const_mgr.add_const('ERROR_NO_SUCH_GROUP',0x00000527)
2359-
2329+
23602330
# Generic Access Rights
23612331
win_const_mgr.add_const('GENERIC_ALL',0x10000000)
23622332
win_const_mgr.add_const('GENERIC_EXECUTE',0x20000000)
23632333
win_const_mgr.add_const('GENERIC_WRITE',0x40000000)
23642334
win_const_mgr.add_const('GENERIC_READ',0x80000000)
2365-
2366-
2335+
2336+
23672337
# Standard Access Rights
23682338
win_const_mgr.add_const('DELETE',0x00010000)
23692339
win_const_mgr.add_const('READ_CONTROL',0x00020000)
23702340
win_const_mgr.add_const('WRITE_DAC',0x00040000)
23712341
win_const_mgr.add_const('WRITE_OWNER',0x00080000)
23722342
win_const_mgr.add_const('ACCESS_SYSTEM_SECURITY',0x01000000)
2373-
2343+
23742344
# Services
23752345
win_const_mgr.add_const('SERVICE_NO_CHANGE',0xFFFFFFFF)
2376-
2346+
23772347
# Service Start Types
23782348
win_const_mgr.add_const('START_TYPE_BOOT',0x00000000)
23792349
win_const_mgr.add_const('START_TYPE_SYSTEM',0x00000001)
23802350
win_const_mgr.add_const('START_TYPE_AUTO',0x00000002)
23812351
win_const_mgr.add_const('START_TYPE_MANUAL',0x00000003)
23822352
win_const_mgr.add_const('START_TYPE_DISABLED',0x00000004)
2383-
2353+
23842354
# Service States
23852355
win_const_mgr.add_const('SERVICE_STOPPED',0x00000001)
23862356
win_const_mgr.add_const('SERVICE_START_PENDING',0x00000002)
@@ -2389,15 +2359,15 @@ def self.add_constants(win_const_mgr)
23892359
win_const_mgr.add_const('SERVICE_CONTINUE_PENDING',0x00000005)
23902360
win_const_mgr.add_const('SERVICE_PAUSE_PENDING',0x00000006)
23912361
win_const_mgr.add_const('SERVICE_PAUSED',0x00000007)
2392-
2362+
23932363
# Service Types
23942364
win_const_mgr.add_const('SERVICE_KERNEL_DRIVER',0x00000001)
23952365
win_const_mgr.add_const('SERVICE_FILE_SYSTEM_DRIVER',0x00000002)
23962366
win_const_mgr.add_const('SERVICE_ADAPTER',0x00000004)
23972367
win_const_mgr.add_const('SERVICE_RECOGNIZER_DRIVER',0x00000008)
23982368
win_const_mgr.add_const('SERVICE_WIN32_OWN_PROCESS',0x00000010)
23992369
win_const_mgr.add_const('SERVICE_WIN32_SHARE_PROCESS',0x00000020)
2400-
2370+
24012371
# Service Manager Permissions
24022372
win_const_mgr.add_const('SC_MANAGER_CONNECT',0x00000001)
24032373
win_const_mgr.add_const('SC_MANAGER_CREATE_SERVICE',0x00000002)
@@ -2407,7 +2377,7 @@ def self.add_constants(win_const_mgr)
24072377
win_const_mgr.add_const('SC_MANAGER_MODIFY_BOOT_CONFIG',0x00000020)
24082378
win_const_mgr.add_const('SC_MANAGER_USER_DEFINED_CONTROL',0x00000100)
24092379
win_const_mgr.add_const('SC_MANAGER_ALL_ACCESS',0x000F003F)
2410-
2380+
24112381
# Service Permissions
24122382
win_const_mgr.add_const('SERVICE_QUERY_CONFIG',0x00000001)
24132383
win_const_mgr.add_const('SERVICE_CHANGE_CONFIG',0x00000002)
@@ -2419,7 +2389,7 @@ def self.add_constants(win_const_mgr)
24192389
win_const_mgr.add_const('SERVICE_INTERROGATE',0x00000080)
24202390
win_const_mgr.add_const('SERVICE_USER_DEFINED_CONTROL',0x00000100)
24212391
win_const_mgr.add_const('SERVICE_ALL_ACCESS',0x000F01FF)
2422-
2392+
24232393
win_const_mgr.add_const('LINEINITIALIZEEXOPTION_USECOMPLETIONPORT',0x00000003)
24242394
win_const_mgr.add_const('AVIIF_TWOCC',0x00000002)
24252395
win_const_mgr.add_const('TBTS_LEFT',0x00000001)
@@ -38170,4 +38140,4 @@ def self.add_constants(win_const_mgr)
3817038140

3817138141
end
3817238142

38173-
end; end; end; end; end; end
38143+
end; end; end; end; end; end; end

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_advapi32.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ class Def_advapi32
2424
[:UserName, :LPTSTR]
2525
]
2626

27-
def self.create_dll(dll_path = 'advapi32')
28-
dll = DLL.new(dll_path, ApiConstants.manager)
27+
def self.create_dll(constant_manager, dll_path = 'advapi32')
28+
dll = DLL.new(dll_path, constant_manager)
2929

3030
dll.add_function('QueryServiceStatus', 'DWORD', [
3131
['LPVOID', 'hService', 'in'],

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_crypt32.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_crypt32
1111

12-
def self.create_dll(dll_path = 'crypt32')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'crypt32')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function('CryptUnprotectData', 'BOOL', [
1616
['PBLOB','pDataIn', 'in'],

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_iphlpapi.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_iphlpapi
1111

12-
def self.create_dll(dll_path = 'iphlpapi')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'iphlpapi')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function('CancelIPChangeNotify', 'BOOL',[
1616
["PBLOB","notifyOverlapped","in"],

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_kernel32.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_kernel32
1111

12-
def self.create_dll(dll_path = 'kernel32')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'kernel32')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function( 'GetConsoleWindow', 'LPVOID',[])
1616

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_netapi32.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_netapi32
1111

12-
def self.create_dll(dll_path = 'netapi32')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'netapi32')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function('NetApiBufferFree','DWORD',[
1616
["LPVOID","Buffer","in"]

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_ntdll
1111

12-
def self.create_dll(dll_path = 'ntdll')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'ntdll')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function('NtAllocateVirtualMemory', 'DWORD',[
1616
["DWORD","ProcessHandle","in"],

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_psapi.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_psapi
1111

12-
def self.create_dll(dll_path = 'psapi')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'psapi')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function('EnumDeviceDrivers', 'BOOL',[
1616
%w(PBLOB lpImageBase out),

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_shell32.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module Def
99

1010
class Def_shell32
1111

12-
def self.create_dll(dll_path = 'shell32')
13-
dll = DLL.new(dll_path, ApiConstants.manager)
12+
def self.create_dll(constant_manager, dll_path = 'shell32')
13+
dll = DLL.new(dll_path, constant_manager)
1414

1515
dll.add_function('IsUserAnAdmin', 'BOOL', [
1616
])

0 commit comments

Comments
 (0)