Skip to content

Commit caddf54

Browse files
committed
Make getsystem more verbose
Resolves rapid7#4401
1 parent 32d5e7f commit caddf54

File tree

1 file changed

+50
-15
lines changed
  • lib/rex/post/meterpreter/ui/console/command_dispatcher/priv

1 file changed

+50
-15
lines changed

lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb

Lines changed: 50 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,20 @@ class Console::CommandDispatcher::Priv::Elevate
1717

1818
include Console::CommandDispatcher
1919

20-
ELEVATE_TECHNIQUE_NONE = -1
21-
ELEVATE_TECHNIQUE_ANY = 0
22-
ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE = 1
23-
ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2 = 2
24-
ELEVATE_TECHNIQUE_SERVICE_TOKENDUP = 3
25-
26-
ELEVATE_TECHNIQUE_DESCRIPTION = [ "All techniques available",
27-
"Service - Named Pipe Impersonation (In Memory/Admin)",
28-
"Service - Named Pipe Impersonation (Dropper/Admin)",
29-
"Service - Token Duplication (In Memory/Admin)"
30-
]
20+
ELEVATE_TECHNIQUE_NONE = -1
21+
ELEVATE_TECHNIQUE_ANY = 0
22+
ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE = 1
23+
ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2 = 2
24+
ELEVATE_TECHNIQUE_SERVICE_TOKENDUP = 3
25+
26+
ELEVATE_TECHNIQUE_DESCRIPTION =
27+
[
28+
"All techniques available",
29+
"Service - Named Pipe Impersonation (In Memory/Admin)",
30+
"Service - Named Pipe Impersonation (Dropper/Admin)",
31+
"Service - Token Duplication (In Memory/Admin)"
32+
]
33+
3134
#
3235
# List of supported commands.
3336
#
@@ -45,6 +48,26 @@ def name
4548
end
4649

4750

51+
#
52+
# Returns the description of the technique(s)
53+
#
54+
def translate_technique_index(index)
55+
translation = ''
56+
desc = ELEVATE_TECHNIQUE_DESCRIPTION.dup
57+
desc.each {|e| e.gsub!(/^Service - /, '')}
58+
59+
case index
60+
when 0
61+
desc.shift
62+
translation = desc
63+
else
64+
translation = [ ELEVATE_TECHNIQUE_DESCRIPTION[index] ]
65+
end
66+
67+
translation
68+
end
69+
70+
4871
#
4972
# Attempt to elevate the meterpreter to that of local system.
5073
#
@@ -73,17 +96,29 @@ def cmd_getsystem( *args )
7396
}
7497

7598
if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length )
76-
print_error( "Technique '#{technique}' is out of range." );
99+
print_error( "Technique '#{technique}' is out of range." )
77100
return false;
78101
end
79102

80-
result = client.priv.getsystem( technique )
103+
begin
104+
result = client.priv.getsystem( technique )
105+
rescue Rex::Post::Meterpreter::RequestError => e
106+
print_error("#{e.message} The following was attempted:")
107+
translate_technique_index(technique).each do |desc|
108+
print_error(desc)
109+
end
110+
elog("#{e.class} #{e.message} (Technique: #{technique})\n#{e.backtrace * "\n"}")
111+
return
112+
end
81113

82114
# got system?
83115
if result[0]
84-
print_line( "...got system (via technique #{result[1]})." );
116+
print_line( "...got system via technique #{result[1]} (#{translate_technique_index(result[1]).first})." )
85117
else
86-
print_line( "...failed to get system." );
118+
print_line( "...failed to get system while attempting the following:" )
119+
translate_technique_index(technique).each do |desc|
120+
print_error(desc)
121+
end
87122
end
88123

89124
return result

0 commit comments

Comments
 (0)