Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# -*- coding: binary -*-
2

3
require 'thread'
4
require 'rex/socket'
5
require 'rex/post/meterpreter/extensions/stdapi/tlv'
6
require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel'
7
require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel'
8
require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel'
9

10
module Rex
11
module Post
12
module Meterpreter
13
module Extensions
14
module Stdapi
15
module Net
16

17
###
18
#
19
# This class provides an interface to interacting with sockets
20
# on the remote machine.  It allows callers to open TCP, UDP,
21
# and other arbitrary socket-based connections as channels that
22
# can then be interacted with through the established
23
# meterpreter connection.
24
#
25
###
26
class Socket
27
  TLV_PARAM_MAP = {
28
    TLV_TYPE_CONNECT_RETRIES => 'Retries',
29
    TLV_TYPE_LOCAL_HOST      => 'LocalHost',
30
    TLV_TYPE_LOCAL_PORT      => 'LocalPort',
31
    TLV_TYPE_PEER_HOST       => 'PeerHost',
32
    TLV_TYPE_PEER_PORT       => 'PeerPort'
33
  }
34

35
  ##
36
  #
37
  # Constructor
38
  #
39
  ##
40

41
  #
42
  # Initialize the socket subsystem and start monitoring sockets as they come
43
  # in.
44
  #
45
  def initialize(client)
46
    self.client = client
47

48
    # register the inbound handler for the tcp server channel (allowing us to
49
    # receive new client connections to a tcp server channel)
50
    client.register_inbound_handler(Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel)
51

52
  end
53

54
  #
55
  # Deregister the inbound handler for the tcp server channel
56
  #
57
  def shutdown
58
    client.deregister_inbound_handler(Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel)
59
  end
60

61
  #
62
  # Process a response packet and extract TLVs that are relevant for updating
63
  # socket parameters.
64
  #
65
  def self.parameters_from_response(response)
66
    params = {}
67
    TLV_PARAM_MAP.each do |tlv_type, param_key|
68
      value = response.get_tlv_value(tlv_type)
69
      next if value.nil?
70
      params[param_key] = value
71
    end
72
    Rex::Socket::Parameters.from_hash(params)
73
  end
74

75
  ##
76
  #
77
  # Factory
78
  #
79
  ##
80

81
  #
82
  # Creates an arbitrary client socket channel using the information supplied
83
  # in the socket parameters instance.  The +params+ argument is expected to be
84
  # of type Rex::Socket::Parameters.
85
  #
86
  def create(params)
87
    res = nil
88

89
    if params.tcp?
90
      if params.server?
91
        res = create_tcp_server_channel(params)
92
      else
93
        res = create_tcp_client_channel(params)
94
      end
95
    elsif params.udp?
96
      res = create_udp_channel(params)
97
    end
98

99
    return res
100
  end
101

102
  #
103
  # Create a TCP server channel.
104
  #
105
  def create_tcp_server_channel(params)
106
    begin
107
      return SocketSubsystem::TcpServerChannel.open(client, params)
108
    rescue ::Rex::Post::Meterpreter::RequestError => e
109
      case e.code
110
      when 10048
111
        raise ::Rex::AddressInUse.new(params.localhost, params.localport)
112
      when 10000 .. 10100
113
        raise ::Rex::ConnectionError.new
114
      end
115
      raise e
116
    end
117
  end
118

119
  #
120
  # Creates a TCP client channel.
121
  #
122
  def create_tcp_client_channel(params)
123
    begin
124
      channel = SocketSubsystem::TcpClientChannel.open(client, params)
125
      if channel != nil
126
        return channel.lsock
127
      end
128
      return nil
129
    rescue ::Rex::Post::Meterpreter::RequestError => e
130
      case e.code
131
      when 10000 .. 10100
132
        raise ::Rex::ConnectionError.new
133
      end
134
      raise e
135
    end
136
  end
137

138
  #
139
  # Creates a UDP channel.
140
  #
141
  def create_udp_channel(params)
142
    begin
143
      channel = SocketSubsystem::UdpChannel.open(client, params)
144
      if channel != nil
145
        return channel.lsock
146
      end
147
      return nil
148
    rescue ::Rex::Post::Meterpreter::RequestError => e
149
      case e.code
150
      when 10048
151
        raise ::Rex::AddressInUse.new(params.localhost, params.localport)
152
      when 10000 .. 10100
153
        raise ::Rex::ConnectionError.new
154
      end
155
      raise e
156
    end
157
  end
158

159

160
protected
161

162
  attr_accessor :client # :nodoc:
163

164
end
165

166
end; end; end; end; end; end
167

168

169