@@ -17,17 +17,20 @@ class Console::CommandDispatcher::Priv::Elevate
17
17
18
18
include Console ::CommandDispatcher
19
19
20
- ELEVATE_TECHNIQUE_NONE = -1
21
- ELEVATE_TECHNIQUE_ANY = 0
22
- ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE = 1
23
- ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2 = 2
24
- ELEVATE_TECHNIQUE_SERVICE_TOKENDUP = 3
25
-
26
- ELEVATE_TECHNIQUE_DESCRIPTION = [ "All techniques available" ,
27
- "Service - Named Pipe Impersonation (In Memory/Admin)" ,
28
- "Service - Named Pipe Impersonation (Dropper/Admin)" ,
29
- "Service - Token Duplication (In Memory/Admin)"
30
- ]
20
+ ELEVATE_TECHNIQUE_NONE = -1
21
+ ELEVATE_TECHNIQUE_ANY = 0
22
+ ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE = 1
23
+ ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2 = 2
24
+ ELEVATE_TECHNIQUE_SERVICE_TOKENDUP = 3
25
+
26
+ ELEVATE_TECHNIQUE_DESCRIPTION =
27
+ [
28
+ "All techniques available" ,
29
+ "Service - Named Pipe Impersonation (In Memory/Admin)" ,
30
+ "Service - Named Pipe Impersonation (Dropper/Admin)" ,
31
+ "Service - Token Duplication (In Memory/Admin)"
32
+ ]
33
+
31
34
#
32
35
# List of supported commands.
33
36
#
@@ -45,6 +48,26 @@ def name
45
48
end
46
49
47
50
51
+ #
52
+ # Returns the description of the technique(s)
53
+ #
54
+ def translate_technique_index ( index )
55
+ translation = ''
56
+ desc = ELEVATE_TECHNIQUE_DESCRIPTION . dup
57
+ desc . each { |e | e . gsub! ( /^Service - / , '' ) }
58
+
59
+ case index
60
+ when 0
61
+ desc . shift
62
+ translation = desc
63
+ else
64
+ translation = [ ELEVATE_TECHNIQUE_DESCRIPTION [ index ] ]
65
+ end
66
+
67
+ translation
68
+ end
69
+
70
+
48
71
#
49
72
# Attempt to elevate the meterpreter to that of local system.
50
73
#
@@ -73,17 +96,29 @@ def cmd_getsystem( *args )
73
96
}
74
97
75
98
if ( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION . length )
76
- print_error ( "Technique '#{ technique } ' is out of range." ) ;
99
+ print_error ( "Technique '#{ technique } ' is out of range." )
77
100
return false ;
78
101
end
79
102
80
- result = client . priv . getsystem ( technique )
103
+ begin
104
+ result = client . priv . getsystem ( technique )
105
+ rescue Rex ::Post ::Meterpreter ::RequestError => e
106
+ print_error ( "#{ e . message } The following was attempted:" )
107
+ translate_technique_index ( technique ) . each do |desc |
108
+ print_error ( desc )
109
+ end
110
+ elog ( "#{ e . class } #{ e . message } (Technique: #{ technique } )\n #{ e . backtrace * "\n " } " )
111
+ return
112
+ end
81
113
82
114
# got system?
83
115
if result [ 0 ]
84
- print_line ( "...got system ( via technique #{ result [ 1 ] } ). " ) ;
116
+ print_line ( "...got system via technique #{ result [ 1 ] } ( #{ translate_technique_index ( result [ 1 ] ) . first } ). " )
85
117
else
86
- print_line ( "...failed to get system." ) ;
118
+ print_line ( "...failed to get system while attempting the following:" )
119
+ translate_technique_index ( technique ) . each do |desc |
120
+ print_error ( desc )
121
+ end
87
122
end
88
123
89
124
return result
0 commit comments