Class: Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Thread

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb

Overview

Interfaces with a process’ executing threads by enumerating, opening, and creating threads.

Instance Method Summary collapse

Constructor Details

#initialize(process) ⇒ Thread

Initializes a thread instance that operates in the context of the supplied process instance.



33
34
35
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb', line 33

def initialize(process)
	self.process = process
end

Instance Method Details

#create(entry, parameter = nil, suspended = false) ⇒ Object

Creates a new thread in the context of the process and returns a Sys::Thread instance.



80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb', line 80

def create(entry, parameter = nil, suspended = false)
	request = Packet.create_request('stdapi_sys_process_thread_create')
	creation_flags = 0

	request.add_tlv(TLV_TYPE_PROCESS_HANDLE, process.handle)
	request.add_tlv(TLV_TYPE_ENTRY_POINT, entry)

	# Are we passing a parameter to the entry point of the thread?
	if (parameter != nil)
		request.add_tlv(TLV_TYPE_ENTRY_PARAMETER, parameter)
	end

	# Should we create the thread suspended?
	if (suspended)
		creation_flags |= CREATE_SUSPENDED
	end

	request.add_tlv(TLV_TYPE_CREATION_FLAGS, creation_flags)

	# Transmit the request
	response = process.client.send_request(request)	


	thread_id     = response.get_tlv_value(TLV_TYPE_THREAD_ID)
	thread_handle = response.get_tlv_value(TLV_TYPE_THREAD_HANDLE)

	# Create a thread class instance
	return Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Thread.new(
			process, thread_handle, thread_id)
end

#each_thread(&block) ⇒ Object

Enumerate through each thread identifier.



114
115
116
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb', line 114

def each_thread(&block)
	get_threads.each(&block)
end

#get_threads ⇒ Object

Returns an array of thread identifiers.



121
122
123
124
125
126
127
128
129
130
131
132
133
134
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb', line 121

def get_threads
	request = Packet.create_request('stdapi_sys_process_thread_get_threads')
	threads = []

	request.add_tlv(TLV_TYPE_PID, process.pid)

	response = process.client.send_request(request)

	response.each(TLV_TYPE_THREAD_ID) { |thr|
		threads << thr.value
	}

	return threads
end

#open(tid, access = THREAD_ALL) ⇒ Object

Opens an existing thread that is running within the context of the process and returns a Sys::Thread instance.



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/thread.rb', line 47

def open(tid, access = THREAD_ALL)
	request = Packet.create_request('stdapi_sys_process_thread_open')
	real    = 0

	# Translate access
	if (access & THREAD_READ)
		real |= THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE
	end

	if (access & THREAD_WRITE)
		real |= THREAD_SET_CONTEXT | THREAD_SET_INFORMATION | THREAD_SET_THREAD_TOKEN | THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION
	end

	if (access & THREAD_EXECUTE)
		real |= THREAD_TERMINATE | THREAD_SUSPEND_RESUME | SYNCHRONIZE
	end

	# Add the thread identifier and permissions
	request.add_tlv(TLV_TYPE_THREAD_ID, tid)
	request.add_tlv(TLV_TYPE_THREAD_PERMS, real)

	# Transmit the request
	response = process.client.send_request(request)

	# Create a thread class instance
	return Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Thread.new(
			process, response.get_tlv_value(TLV_TYPE_THREAD_HANDLE), tid)
end