Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# -*- coding: binary -*-
2

3
module Rex
4
module Post
5
module Meterpreter
6
module Extensions
7
module Extapi
8
module Adsi
9

10
###
11
#
12
# This meterpreter extension contains extended API functions for
13
# querying and managing desktop windows.
14
#
15
###
16
class Adsi
17

18
  def initialize(client)
19
    @client = client
20
  end
21

22
  #
23
  # Perform a generic domain query against ADSI.
24
  #
25
  # @param domain_name [String] The FQDN of the target domain.
26
  # @param filter [String] The filter to apply to the query in
27
  #   LDAP format.
28
  # @param max_results [Integer] The maximum number of results
29
  #   to return.
30
  # @param page_size [Integer] The size of the page of results
31
  #   to return.
32
  # @param fields [Array] Array of string fields to return for
33
  #   each result found
34
  #
35
  # @return [Hash] Array of field names with associated results.
36
  #
37
  def domain_query(domain_name, filter, max_results, page_size, fields)
38
    request = Packet.create_request(COMMAND_ID_EXTAPI_ADSI_DOMAIN_QUERY)
39

40
    request.add_tlv(TLV_TYPE_EXT_ADSI_DOMAIN, domain_name)
41
    request.add_tlv(TLV_TYPE_EXT_ADSI_FILTER, filter)
42
    request.add_tlv(TLV_TYPE_EXT_ADSI_MAXRESULTS, max_results)
43
    request.add_tlv(TLV_TYPE_EXT_ADSI_PAGESIZE, page_size)
44

45
    fields.each do |f|
46
      request.add_tlv(TLV_TYPE_EXT_ADSI_FIELD, f)
47
    end
48

49
    response = client.send_request(request)
50

51
    results = extract_results(response)
52

53
    return {
54
      :fields  => fields,
55
      :results => results
56
    }
57
  end
58

59
  attr_accessor :client
60

61
protected
62

63
  #
64
  # Retrieve the results of the query from the response
65
  #   packet that was returned from Meterpreter.
66
  #
67
  # @param response [Packet] Reference to the received
68
  #   packet that was returned from Meterpreter.
69
  #
70
  # @return [Array[Array[[Hash]]] Collection of results from
71
  #   the ADSI query.
72
  #
73
  def extract_results(response)
74
    results = []
75

76
    response.each(TLV_TYPE_EXT_ADSI_RESULT) do |r|
77
      results << extract_values(r)
78
    end
79

80
    results
81
  end
82

83
  #
84
  # Extract a single row of results from a TLV group.
85
  #
86
  # @param tlv_container [Packet] Reference to the TLV
87
  #   group to pull the values from.
88
  #
89
  # @return [Array[Hash]] Collection of values from
90
  #   the single ADSI query result row.
91
  #
92
  def extract_values(tlv_container)
93
    values = []
94
    tlv_container.get_tlvs(TLV_TYPE_ANY).each do |v|
95
      values << extract_value(v)
96
    end
97
    values
98
  end
99

100
  #
101
  # Convert a single ADSI result value into a usable
102
  #   value that also describes its type.
103
  #
104
  # @param v [TLV] The TLV item that contains the value.
105
  #
106
  # @return [Hash] The type/value pair from the TLV.
107
  #
108
  def extract_value(v)
109
    value = {
110
      :type => :unknown
111
    }
112

113
    case v.type
114
    when TLV_TYPE_EXT_ADSI_STRING
115
      value = {
116
        :type  => :string,
117
        :value => v.value
118
      }
119
    when TLV_TYPE_EXT_ADSI_NUMBER, TLV_TYPE_EXT_ADSI_BIGNUMBER
120
      value = {
121
        :type  => :number,
122
        :value => v.value
123
      }
124
    when TLV_TYPE_EXT_ADSI_BOOL
125
      value = {
126
        :type  => :bool,
127
        :value => v.value
128
      }
129
    when TLV_TYPE_EXT_ADSI_RAW
130
      value = {
131
        :type  => :raw,
132
        :value => v.value
133
      }
134
    when TLV_TYPE_EXT_ADSI_ARRAY
135
      value = {
136
        :type  => :array,
137
        :value => extract_values(v.value)
138
      }
139
    when TLV_TYPE_EXT_ADSI_PATH
140
      value = {
141
        :type     => :path,
142
        :volume   => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_VOL),
143
        :path     => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_PATH),
144
        :vol_type => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_TYPE)
145
      }
146
    when TLV_TYPE_EXT_ADSI_DN
147
      values = v.get_tlvs(TLV_TYPE_ALL)
148
      value = {
149
        :type   => :dn,
150
        :label  => values[0].value
151
      }
152

153
      if values[1].type == TLV_TYPE_EXT_ADSI_STRING
154
        value[:string] = value[1].value
155
      else
156
        value[:raw] = value[1].value
157
      end
158
    end
159

160
    value
161
  end
162
end
163

164
end; end; end; end; end; end
165

166

167