Skip to content

Commit bdf27b1

Browse files
OJHD Moore
OJ
authored and
HD Moore
committed
Fix up the TLVs that are now QWORD values in MSF
Various values were adjusted to become QWORD values in MSF an windows meterpreter, but the changes were not ported over to python, php and java. This commit fixes this inconsistency.
1 parent 8f39590 commit bdf27b1

File tree

5 files changed

+39
-23
lines changed

5 files changed

+39
-23
lines changed

‎data/meterpreter/ext_server_stdapi.php

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
##
77
# General
88
##
9-
define("TLV_TYPE_HANDLE", TLV_META_TYPE_UINT | 600);
9+
define("TLV_TYPE_HANDLE", TLV_META_TYPE_QWORD | 600);
1010
define("TLV_TYPE_INHERIT", TLV_META_TYPE_BOOL | 601);
11-
define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_UINT | 630);
12-
define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_UINT | 631);
11+
define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_QWORD | 630);
12+
define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_QWORD | 631);
1313

1414
##
1515
# Fs
@@ -65,7 +65,7 @@
6565
define("PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN", (1 << 3));
6666

6767
# Registry
68-
define("TLV_TYPE_HKEY", TLV_META_TYPE_UINT | 1000);
68+
define("TLV_TYPE_HKEY", TLV_META_TYPE_QWORD | 1000);
6969
define("TLV_TYPE_ROOT_KEY", TLV_TYPE_HKEY);
7070
define("TLV_TYPE_BASE_KEY", TLV_META_TYPE_STRING | 1001);
7171
define("TLV_TYPE_PERMISSION", TLV_META_TYPE_UINT | 1002);
@@ -90,12 +90,12 @@
9090
define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
9191

9292
# Process
93-
define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_UINT | 2000);
93+
define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2000);
9494
define("TLV_TYPE_ALLOCATION_TYPE", TLV_META_TYPE_UINT | 2001);
9595
define("TLV_TYPE_PROTECTION", TLV_META_TYPE_UINT | 2002);
9696
define("TLV_TYPE_PROCESS_PERMS", TLV_META_TYPE_UINT | 2003);
9797
define("TLV_TYPE_PROCESS_MEMORY", TLV_META_TYPE_RAW | 2004);
98-
define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_UINT | 2005);
98+
define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2005);
9999
define("TLV_TYPE_MEMORY_STATE", TLV_META_TYPE_UINT | 2006);
100100
define("TLV_TYPE_MEMORY_TYPE", TLV_META_TYPE_UINT | 2007);
101101
define("TLV_TYPE_ALLOC_PROTECTION", TLV_META_TYPE_UINT | 2008);
@@ -109,16 +109,16 @@
109109
define("TLV_TYPE_IMAGE_FILE", TLV_META_TYPE_STRING | 2400);
110110
define("TLV_TYPE_IMAGE_FILE_PATH", TLV_META_TYPE_STRING | 2401);
111111
define("TLV_TYPE_PROCEDURE_NAME", TLV_META_TYPE_STRING | 2402);
112-
define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_UINT | 2403);
113-
define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_UINT | 2404);
112+
define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_QWORD | 2403);
113+
define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_QWORD | 2404);
114114
define("TLV_TYPE_IMAGE_GROUP", TLV_META_TYPE_GROUP | 2405);
115115
define("TLV_TYPE_IMAGE_NAME", TLV_META_TYPE_STRING | 2406);
116116

117117
define("TLV_TYPE_THREAD_ID", TLV_META_TYPE_UINT | 2500);
118118
define("TLV_TYPE_THREAD_PERMS", TLV_META_TYPE_UINT | 2502);
119119
define("TLV_TYPE_EXIT_CODE", TLV_META_TYPE_UINT | 2510);
120-
define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_UINT | 2511);
121-
define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_UINT | 2512);
120+
define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_QWORD | 2511);
121+
define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_QWORD | 2512);
122122
define("TLV_TYPE_CREATION_FLAGS", TLV_META_TYPE_UINT | 2513);
123123

124124
define("TLV_TYPE_REGISTER_NAME", TLV_META_TYPE_STRING | 2540);
@@ -137,7 +137,7 @@
137137
# Event Log
138138
##
139139
define("TLV_TYPE_EVENT_SOURCENAME", TLV_META_TYPE_STRING | 4000);
140-
define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_UINT | 4001);
140+
define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_QWORD | 4001);
141141
define("TLV_TYPE_EVENT_NUMRECORDS", TLV_META_TYPE_UINT | 4002);
142142

143143
define("TLV_TYPE_EVENT_READFLAGS", TLV_META_TYPE_UINT | 4003);

‎data/meterpreter/ext_server_stdapi.py

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,7 @@ class RTATTR(ctypes.Structure):
252252
TLV_META_TYPE_UINT = (1 << 17)
253253
TLV_META_TYPE_RAW = (1 << 18)
254254
TLV_META_TYPE_BOOL = (1 << 19)
255+
TLV_META_TYPE_QWORD = (1 << 20)
255256
TLV_META_TYPE_COMPRESSED = (1 << 29)
256257
TLV_META_TYPE_GROUP = (1 << 30)
257258
TLV_META_TYPE_COMPLEX = (1 << 31)
@@ -284,10 +285,10 @@ class RTATTR(ctypes.Structure):
284285
##
285286
# General
286287
##
287-
TLV_TYPE_HANDLE = TLV_META_TYPE_UINT | 600
288+
TLV_TYPE_HANDLE = TLV_META_TYPE_QWORD | 600
288289
TLV_TYPE_INHERIT = TLV_META_TYPE_BOOL | 601
289-
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_UINT | 630
290-
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_UINT | 631
290+
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_QWORD | 630
291+
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_QWORD | 631
291292

292293
##
293294
# Fs
@@ -346,7 +347,7 @@ class RTATTR(ctypes.Structure):
346347
##
347348
# Registry
348349
##
349-
TLV_TYPE_HKEY = TLV_META_TYPE_UINT | 1000
350+
TLV_TYPE_HKEY = TLV_META_TYPE_QWORD | 1000
350351
TLV_TYPE_ROOT_KEY = TLV_TYPE_HKEY
351352
TLV_TYPE_BASE_KEY = TLV_META_TYPE_STRING | 1001
352353
TLV_TYPE_PERMISSION = TLV_META_TYPE_UINT | 1002
@@ -376,12 +377,12 @@ class RTATTR(ctypes.Structure):
376377
##
377378
# Process
378379
##
379-
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_UINT | 2000
380+
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2000
380381
TLV_TYPE_ALLOCATION_TYPE = TLV_META_TYPE_UINT | 2001
381382
TLV_TYPE_PROTECTION = TLV_META_TYPE_UINT | 2002
382383
TLV_TYPE_PROCESS_PERMS = TLV_META_TYPE_UINT | 2003
383384
TLV_TYPE_PROCESS_MEMORY = TLV_META_TYPE_RAW | 2004
384-
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_UINT | 2005
385+
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2005
385386
TLV_TYPE_MEMORY_STATE = TLV_META_TYPE_UINT | 2006
386387
TLV_TYPE_MEMORY_TYPE = TLV_META_TYPE_UINT | 2007
387388
TLV_TYPE_ALLOC_PROTECTION = TLV_META_TYPE_UINT | 2008
@@ -397,16 +398,16 @@ class RTATTR(ctypes.Structure):
397398
TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400
398399
TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401
399400
TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402
400-
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_UINT | 2403
401-
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_UINT | 2404
401+
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_QWORD | 2403
402+
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_QWORD | 2404
402403
TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405
403404
TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406
404405

405406
TLV_TYPE_THREAD_ID = TLV_META_TYPE_UINT | 2500
406407
TLV_TYPE_THREAD_PERMS = TLV_META_TYPE_UINT | 2502
407408
TLV_TYPE_EXIT_CODE = TLV_META_TYPE_UINT | 2510
408-
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_UINT | 2511
409-
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_UINT | 2512
409+
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_QWORD | 2511
410+
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_QWORD | 2512
410411
TLV_TYPE_CREATION_FLAGS = TLV_META_TYPE_UINT | 2513
411412

412413
TLV_TYPE_REGISTER_NAME = TLV_META_TYPE_STRING | 2540
@@ -425,7 +426,7 @@ class RTATTR(ctypes.Structure):
425426
# Event Log
426427
##
427428
TLV_TYPE_EVENT_SOURCENAME = TLV_META_TYPE_STRING | 4000
428-
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_UINT | 4001
429+
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_QWORD | 4001
429430
TLV_TYPE_EVENT_NUMRECORDS = TLV_META_TYPE_UINT | 4002
430431

431432
TLV_TYPE_EVENT_READFLAGS = TLV_META_TYPE_UINT | 4003

‎data/meterpreter/meterpreter.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ function socket_set_option($sock, $type, $opt, $value) {
125125
define("TLV_META_TYPE_UINT", (1 << 17));
126126
define("TLV_META_TYPE_RAW", (1 << 18));
127127
define("TLV_META_TYPE_BOOL", (1 << 19));
128+
define("TLV_META_TYPE_QWORD", (1 << 20));
128129
define("TLV_META_TYPE_COMPRESSED", (1 << 29));
129130
define("TLV_META_TYPE_GROUP", (1 << 30));
130131
define("TLV_META_TYPE_COMPLEX", (1 << 31));
@@ -655,6 +656,11 @@ function tlv_pack($tlv) {
655656
if (($tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
656657
$ret = pack("NNa*", 8 + strlen($tlv['value'])+1, $tlv['type'], $tlv['value'] . "\0");
657658
}
659+
elseif (($tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) {
660+
$hi = ($tlv['value'] >> 32) & 0xFFFFFFFF;
661+
$lo = $tlv['value'] & 0xFFFFFFFF;
662+
$ret = pack("NNNN", 8 + 8, $tlv['type'], $hi, $lo);
663+
}
658664
elseif (($tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
659665
$ret = pack("NNN", 8 + 4, $tlv['type'], $tlv['value']);
660666
}
@@ -693,6 +699,10 @@ function tlv_unpack($raw_tlv) {
693699
elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
694700
$tlv = unpack("Nlen/Ntype/Nvalue", substr($raw_tlv, 0, $tlv['len']));
695701
}
702+
elseif (($type & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) {
703+
$tlv = unpack("Nlen/Ntype/Nhi/Nlo", substr($raw_tlv, 0, $tlv['len']));
704+
$tlv['value'] = $tlv['hi'] << 32 | $tlv['lo'];
705+
}
696706
elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
697707
$tlv = unpack("Nlen/Ntype/cvalue", substr($raw_tlv, 0, $tlv['len']));
698708
}

‎data/meterpreter/meterpreter.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
TLV_META_TYPE_UINT = (1 << 17)
5555
TLV_META_TYPE_RAW = (1 << 18)
5656
TLV_META_TYPE_BOOL = (1 << 19)
57+
TLV_META_TYPE_QWORD = (1 << 20)
5758
TLV_META_TYPE_COMPRESSED = (1 << 29)
5859
TLV_META_TYPE_GROUP = (1 << 30)
5960
TLV_META_TYPE_COMPLEX = (1 << 31)
@@ -150,6 +151,8 @@ def packet_enum_tlvs(pkt, tlv_type = None):
150151
val = str(val.split(NULL_BYTE, 1)[0])
151152
elif (tlv[1] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
152153
val = struct.unpack('>I', val)[0]
154+
elif (tlv[1] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD:
155+
val = struct.unpack('>Q', val)[0]
153156
elif (tlv[1] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
154157
val = bool(struct.unpack('b', val)[0])
155158
elif (tlv[1] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW:
@@ -175,6 +178,8 @@ def tlv_pack(*args):
175178
data = ""
176179
if (tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
177180
data = struct.pack('>III', 12, tlv['type'], tlv['value'])
181+
elif (tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD:
182+
data = struct.pack('>IIQ', 16, tlv['type'], tlv['value'])
178183
elif (tlv['type'] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
179184
data = struct.pack('>II', 9, tlv['type']) + bytes(chr(int(bool(tlv['value']))), 'UTF-8')
180185
else:

‎lib/rex/post/meterpreter/extensions/stdapi/tlv.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ module Stdapi
148148
TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401
149149
TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402
150150
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_QWORD | 2403
151-
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_UINT | 2404
151+
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_QWORD | 2404
152152
TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405
153153
TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406
154154

0 commit comments

Comments
 (0)