Class: Rex::Post::Meterpreter::Extensions::Stdapi::Sys::EventLog

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb

Overview

This class provides access to the Windows event log on the remote machine.

Class Attribute Summary collapse

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(hand) ⇒ EventLog

Initializes an instance of the eventlog manipulator.



60
61
62
63
64
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 60

def initialize(hand)
  self.client = self.class.client
  self.handle = hand
  ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) )
end

Class Attribute Details

.client ⇒ Object

Returns the value of attribute client.



26
27
28
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 26

def client
  @client
end

Instance Attribute Details

#client ⇒ Object

:nodoc:



53
54
55
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 53

def client
  @client
end

#handle ⇒ Object

Event Log Instance Stuffs!



52
53
54
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 52

def handle
  @handle
end

Class Method Details

.close(client, handle) ⇒ Object

Close the event log



179
180
181
182
183
184
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 179

def self.close(client, handle)
  request = Packet.create_request('stdapi_sys_eventlog_close')
  request.add_tlv(TLV_TYPE_EVENT_HANDLE, handle);
  response = client.send_request(request, nil)
  return nil
end

.finalize(client, handle) ⇒ Object 



66
67
68
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 66

def self.finalize(client,handle)
  proc { self.close(client,handle) }
end

.open(name) ⇒ Object

Opens the supplied event log.

– NOTE: should support UNCServerName sometime ++



36
37
38
39
40
41
42
43
44
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 36

def EventLog.open(name)
  request = Packet.create_request('stdapi_sys_eventlog_open')

  request.add_tlv(TLV_TYPE_EVENT_SOURCENAME, name);

  response = client.send_request(request)

  return self.new(response.get_tlv_value(TLV_TYPE_EVENT_HANDLE))
end

Instance Method Details

#_read(flags, offset = 0) ⇒ Object

the low level read function (takes flags, not hash, etc).



86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 86

def _read(flags, offset = 0)
  request = Packet.create_request('stdapi_sys_eventlog_read')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle)
  request.add_tlv(TLV_TYPE_EVENT_READFLAGS, flags)
  request.add_tlv(TLV_TYPE_EVENT_RECORDOFFSET, offset)

  response = client.send_request(request)

  EventLogSubsystem::EventRecord.new(
    response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER),
    response.get_tlv_value(TLV_TYPE_EVENT_TIMEGENERATED),
    response.get_tlv_value(TLV_TYPE_EVENT_TIMEWRITTEN),
    response.get_tlv_value(TLV_TYPE_EVENT_ID),
    response.get_tlv_value(TLV_TYPE_EVENT_TYPE),
    response.get_tlv_value(TLV_TYPE_EVENT_CATEGORY),
    response.get_tlv_values(TLV_TYPE_EVENT_STRING),
    response.get_tlv_value(TLV_TYPE_EVENT_DATA)
  )
end

#clear ⇒ Object

Clear the specified event log (and return nil).

– I should eventually support BackupFile ++



167
168
169
170
171
172
173
174
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 167

def clear
  request = Packet.create_request('stdapi_sys_eventlog_clear')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)
  return self
end

#close ⇒ Object

Instance method



187
188
189
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 187

def close
  self.class.close(self.client, self.handle)
end

#each_backwards ⇒ Object

Iterator for read_backwards.



138
139
140
141
142
143
144
145
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 138

def each_backwards
  begin
    loop do
      yield(read_backwards)
    end
  rescue ::Exception
  end
end

#each_forwards ⇒ Object

Iterator for read_forwards.



118
119
120
121
122
123
124
125
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 118

def each_forwards
  begin
    loop do
      yield(read_forwards)
    end
  rescue ::Exception
  end
end

#length ⇒ Object

Return the number of records in the event log.



73
74
75
76
77
78
79
80
81
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 73

def length
  request = Packet.create_request('stdapi_sys_eventlog_numrecords')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_EVENT_NUMRECORDS)
end

#oldest ⇒ Object

Return the record number of the oldest event (not necessarily 1).



150
151
152
153
154
155
156
157
158
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 150

def oldest
  request = Packet.create_request('stdapi_sys_eventlog_oldest')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER)
end

#read_backwards ⇒ Object

Read the eventlog backwards, meaning from newest to oldest. Returns a EventRecord, and throws an exception after no more records.



131
132
133
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 131

def read_backwards
  _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ)
end

#read_forwards ⇒ Object

Read the eventlog forwards, meaning from oldest to newest. Returns a EventRecord, and throws an exception after no more records.



111
112
113
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb', line 111

def read_forwards
  _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ)
end