Skip to content

Commit b20c1c5

Browse files
RageLtManBrent Cook
authored andcommitted
Import -S option for netstat
Allow searching through netstat output tables for specific strings. Example: ``` meterpreter > netstat -S 192 Connection list =============== Proto Local address Remote address State User Inode PID/Program name ----- ------------- -------------- ----- ---- ----- ---------------- tcp 10.1.1.20:3389 192.168.100.186:38470 ESTABLISHED 0 0 3076/svchost.exe tcp 10.1.1.20:63826 192.168.100.186:31158 ESTABLISHED 0 0 4568/powershell.exe tcp 10.1.1.20:64887 192.168.100.186:31158 ESTABLISHED 0 0 - ```
1 parent e4165d3 commit b20c1c5

File tree

1 file changed

+26
-1
lines changed
  • lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi

1 file changed

+26
-1
lines changed

lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,13 @@ def cleanup
5151
"-p" => [ true, "The remote port to connect to." ],
5252
"-L" => [ true, "The local host to listen on (optional)." ])
5353

54+
#
55+
# Options for the netstat command.
56+
#
57+
@@netstat_opts = Rex::Parser::Arguments.new(
58+
"-h" => [ false, "Help banner." ],
59+
"-S" => [ true, "Search string." ])
60+
5461
#
5562
# List of supported commands.
5663
#
@@ -107,6 +114,23 @@ def name
107114
#
108115
def cmd_netstat(*args)
109116
connection_table = client.net.config.netstat
117+
search_term = nil
118+
@@netstat_opts.parse(args) { |opt, idx, val|
119+
case opt
120+
when '-S'
121+
search_term = val
122+
if search_term.nil?
123+
print_error("Enter a search term")
124+
return true
125+
else
126+
search_term = /#{search_term}/nmi
127+
end
128+
when "-h"
129+
cmd_netstat_help
130+
return 0
131+
132+
end
133+
}
110134
tbl = Rex::Ui::Text::Table.new(
111135
'Header' => "Connection list",
112136
'Indent' => 4,
@@ -119,7 +143,8 @@ def cmd_netstat(*args)
119143
"User",
120144
"Inode",
121145
"PID/Program name"
122-
])
146+
],
147+
'SearchTerm' => search_term)
123148

124149
connection_table.each { |connection|
125150
tbl << [ connection.protocol, connection.local_addr_str, connection.remote_addr_str,

0 commit comments

Comments
 (0)