@@ -21,61 +21,61 @@ class Console::CommandDispatcher::Stdapi::Sys
21
21
# Options used by the 'execute' command.
22
22
#
23
23
@@execute_opts = Rex ::Parser ::Arguments . new (
24
- "-a" => [ true , "The arguments to pass to the command." ] ,
25
- "-c" => [ false , "Channelized I/O (required for interaction)." ] ,
26
- "-f" => [ true , "The executable command to run." ] ,
27
- "-h" => [ false , "Help menu." ] ,
28
- "-H" => [ false , "Create the process hidden from view." ] ,
29
- "-i" => [ false , "Interact with the process after creating it." ] ,
30
- "-m" => [ false , "Execute from memory." ] ,
31
- "-d" => [ true , "The 'dummy' executable to launch when using -m." ] ,
24
+ "-a" => [ true , "The arguments to pass to the command." ] ,
25
+ "-c" => [ false , "Channelized I/O (required for interaction)." ] ,
26
+ "-f" => [ true , "The executable command to run." ] ,
27
+ "-h" => [ false , "Help menu." ] ,
28
+ "-H" => [ false , "Create the process hidden from view." ] ,
29
+ "-i" => [ false , "Interact with the process after creating it." ] ,
30
+ "-m" => [ false , "Execute from memory." ] ,
31
+ "-d" => [ true , "The 'dummy' executable to launch when using -m." ] ,
32
32
"-t" => [ false , "Execute process with currently impersonated thread token" ] ,
33
- "-k" => [ false , "Execute process on the meterpreters current desktop" ] ,
33
+ "-k" => [ false , "Execute process on the meterpreters current desktop" ] ,
34
34
"-s" => [ true , "Execute process in a given session as the session user" ] )
35
35
36
36
#
37
37
# Options used by the 'reboot' command.
38
38
#
39
39
@@reboot_opts = Rex ::Parser ::Arguments . new (
40
- "-h" => [ false , "Help menu." ] ,
41
- "-f" => [ true , "Force a reboot, valid values [1|2]" ] )
40
+ "-h" => [ false , "Help menu." ] ,
41
+ "-f" => [ true , "Force a reboot, valid values [1|2]" ] )
42
42
43
43
#
44
44
# Options used by the 'shutdown' command.
45
45
#
46
46
@@shutdown_opts = Rex ::Parser ::Arguments . new (
47
- "-h" => [ false , "Help menu." ] ,
48
- "-f" => [ true , "Force a shutdown, valid values [1|2]" ] )
47
+ "-h" => [ false , "Help menu." ] ,
48
+ "-f" => [ true , "Force a shutdown, valid values [1|2]" ] )
49
49
50
50
#
51
51
# Options used by the 'reg' command.
52
52
#
53
53
@@reg_opts = Rex ::Parser ::Arguments . new (
54
- "-d" => [ true , "The data to store in the registry value." ] ,
55
- "-h" => [ false , "Help menu." ] ,
56
- "-k" => [ true , "The registry key path (E.g. HKLM\\ Software\\ Foo)." ] ,
57
- "-t" => [ true , "The registry value type (E.g. REG_SZ)." ] ,
58
- "-v" => [ true , "The registry value name (E.g. Stuff)." ] ,
54
+ "-d" => [ true , "The data to store in the registry value." ] ,
55
+ "-h" => [ false , "Help menu." ] ,
56
+ "-k" => [ true , "The registry key path (E.g. HKLM\\ Software\\ Foo)." ] ,
57
+ "-t" => [ true , "The registry value type (E.g. REG_SZ)." ] ,
58
+ "-v" => [ true , "The registry value name (E.g. Stuff)." ] ,
59
59
"-r" => [ true , "The remote machine name to connect to (with current process credentials" ] ,
60
- "-w" => [ false , "Set KEY_WOW64 flag, valid values [32|64]." ] )
60
+ "-w" => [ false , "Set KEY_WOW64 flag, valid values [32|64]." ] )
61
61
62
62
#
63
63
# Options for the 'ps' command.
64
64
#
65
65
@@ps_opts = Rex ::Parser ::Arguments . new (
66
66
"-S" => [ true , "String to search for (converts to regex)" ] ,
67
67
"-h" => [ false , "Help menu." ] ,
68
- "-A" => [ true , "Filters processes on architecture (x86 or x86_64)" ] ,
69
- "-s" => [ false , "Show only SYSTEM processes" ] ,
68
+ "-A" => [ true , "Filters processes on architecture (x86 or x86_64)" ] ,
69
+ "-s" => [ false , "Show only SYSTEM processes" ] ,
70
70
"-U" => [ true , "Filters processes on the user using the supplied RegEx" ] )
71
71
72
72
#
73
73
# Options for the 'suspend' command.
74
74
#
75
75
@@suspend_opts = Rex ::Parser ::Arguments . new (
76
- "-h" => [ false , "Help menu." ] ,
76
+ "-h" => [ false , "Help menu." ] ,
77
77
"-c" => [ false , "Continues suspending or resuming even if an error is encountered" ] ,
78
- "-r" => [ false , "Resumes the target processes instead of suspending" ] )
78
+ "-r" => [ false , "Resumes the target processes instead of suspending" ] )
79
79
80
80
#
81
81
# List of supported commands.
@@ -93,7 +93,7 @@ def commands
93
93
"kill" => "Terminate a process" ,
94
94
"ps" => "List running processes" ,
95
95
"reboot" => "Reboots the remote computer" ,
96
- "reg" => "Modify and interact with the remote registry" ,
96
+ "reg" => "Modify and interact with the remote registry" ,
97
97
"rev2self" => "Calls RevertToSelf() on the remote machine" ,
98
98
"shell" => "Drop into a system command shell" ,
99
99
"shutdown" => "Shuts down the remote computer" ,
@@ -105,15 +105,15 @@ def commands
105
105
"clearev" => [ "stdapi_sys_eventlog_open" , "stdapi_sys_eventlog_clear" ] ,
106
106
"drop_token" => [ "stdapi_sys_config_drop_token" ] ,
107
107
"execute" => [ "stdapi_sys_process_execute" ] ,
108
- "getpid" => [ "stdapi_sys_process_getpid" ] ,
108
+ "getpid" => [ "stdapi_sys_process_getpid" ] ,
109
109
"getprivs" => [ "stdapi_sys_config_getprivs" ] ,
110
110
"getuid" => [ "stdapi_sys_config_getuid" ] ,
111
111
"getsid" => [ "stdapi_sys_config_getsid" ] ,
112
112
"getenv" => [ "stdapi_sys_config_getenv" ] ,
113
113
"kill" => [ "stdapi_sys_process_kill" ] ,
114
114
"ps" => [ "stdapi_sys_process_get_processes" ] ,
115
115
"reboot" => [ "stdapi_sys_power_exitwindows" ] ,
116
- "reg" => [
116
+ "reg" => [
117
117
"stdapi_registry_load_key" ,
118
118
"stdapi_registry_unload_key" ,
119
119
"stdapi_registry_open_key" ,
@@ -169,7 +169,7 @@ def cmd_execute(*args)
169
169
interact = false
170
170
desktop = false
171
171
channelized = nil
172
- hidden = nil
172
+ hidden = nil
173
173
from_mem = false
174
174
dummy_exec = "cmd"
175
175
cmd_args = nil
@@ -433,7 +433,7 @@ def cmd_ps(*args)
433
433
search_term = val
434
434
if search_term . nil?
435
435
print_error ( "Enter a search term" )
436
- return true
436
+ return true
437
437
end
438
438
when '-h'
439
439
print_line "Usage: ps [ options ]"
@@ -452,14 +452,14 @@ def cmd_ps(*args)
452
452
print_line "You must select either x86 or x86_64"
453
453
return false
454
454
end
455
- searched_procs << proc if proc [ "arch" ] == val
455
+ searched_procs << proc if proc [ "arch" ] == val
456
456
end
457
457
processes = searched_procs
458
458
when "-s"
459
459
print_line "Filtering on SYSTEM processes..."
460
460
searched_procs = Rex ::Post ::Meterpreter ::Extensions ::Stdapi ::Sys ::ProcessList . new
461
461
processes . each do |proc |
462
- searched_procs << proc if proc [ "user" ] == "NT AUTHORITY\\ SYSTEM"
462
+ searched_procs << proc if proc [ "user" ] == "NT AUTHORITY\\ SYSTEM"
463
463
end
464
464
processes = searched_procs
465
465
when "-U"
@@ -470,7 +470,7 @@ def cmd_ps(*args)
470
470
print_line "You must supply a search term!"
471
471
return false
472
472
end
473
- searched_procs << proc if proc [ "user" ] . match ( /#{ val } / )
473
+ searched_procs << proc if proc [ "user" ] . match ( /#{ val } / )
474
474
end
475
475
processes = searched_procs
476
476
end
@@ -498,7 +498,7 @@ def cmd_ps(*args)
498
498
# for display and consistency with payload naming we switch the internal 'x86_64' value to display 'x64'
499
499
if ( arch == ARCH_X86_64 )
500
500
arch = "x64"
501
- end
501
+ end
502
502
503
503
row = [ ent [ 'pid' ] . to_s , ent [ 'name' ] , arch , session , ent [ 'user' ] , ent [ 'path' ] ]
504
504
@@ -565,12 +565,12 @@ def cmd_reg(*args)
565
565
end
566
566
567
567
# Initiailze vars
568
- key = nil
569
- value = nil
570
- data = nil
571
- type = nil
568
+ key = nil
569
+ value = nil
570
+ data = nil
571
+ type = nil
572
572
wowflag = 0x0000
573
- rem = nil
573
+ rem = nil
574
574
575
575
@@reg_opts . parse ( args ) { |opt , idx , val |
576
576
case opt
@@ -580,13 +580,13 @@ def cmd_reg(*args)
580
580
"Interact with the target machine's registry.\n " +
581
581
@@reg_opts . usage +
582
582
"COMMANDS:\n \n " +
583
- " enumkey Enumerate the supplied registry key [-k <key>]\n " +
584
- " createkey Create the supplied registry key [-k <key>]\n " +
585
- " deletekey Delete the supplied registry key [-k <key>]\n " +
583
+ " enumkey Enumerate the supplied registry key [-k <key>]\n " +
584
+ " createkey Create the supplied registry key [-k <key>]\n " +
585
+ " deletekey Delete the supplied registry key [-k <key>]\n " +
586
586
" queryclass Queries the class of the supplied key [-k <key>]\n " +
587
- " setval Set a registry value [-k <key> -v <val> -d <data>]\n " +
588
- " deleteval Delete the supplied registry value [-k <key> -v <val>]\n " +
589
- " queryval Queries the data contents of a value [-k <key> -v <val>]\n \n " )
587
+ " setval Set a registry value [-k <key> -v <val> -d <data>]\n " +
588
+ " deleteval Delete the supplied registry value [-k <key> -v <val>]\n " +
589
+ " queryval Queries the data contents of a value [-k <key> -v <val>]\n \n " )
590
590
return false
591
591
when "-k"
592
592
key = val
@@ -895,11 +895,11 @@ def cmd_suspend(*args)
895
895
args . uniq!
896
896
diff = args - valid_pids . map { |e | e . to_s }
897
897
if not diff . empty? # then we had an invalid pid
898
- print_error ( "The following pids are not valid: #{ diff . join ( ", " ) . to_s } ." )
898
+ print_error ( "The following pids are not valid: #{ diff . join ( ", " ) . to_s } ." )
899
899
if continue
900
900
print_status ( "Continuing. Invalid args have been removed from the list." )
901
901
else
902
- print_error ( "Quitting. Use -c to continue using only the valid pids." )
902
+ print_error ( "Quitting. Use -c to continue using only the valid pids." )
903
903
return false
904
904
end
905
905
end
0 commit comments