Method: Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Process.get_processes

Defined in:
lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb

.get_processes ⇒ Object

Returns a ProcessList of processes as Hash objects with keys for ‘pid’, ‘ppid’, ‘name’, ‘path’, ‘user’, ‘session’ and ‘arch’.



218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
 
# File 'lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb', line 218

def Process.get_processes
  request   = Packet.create_request('stdapi_sys_process_get_processes')
  processes = ProcessList.new

  response = client.send_request(request)

  response.each(TLV_TYPE_PROCESS_GROUP) { |p|
  arch = ""

  pa = p.get_tlv_value( TLV_TYPE_PROCESS_ARCH )
  if( pa != nil )
    if pa == 1 # PROCESS_ARCH_X86
      arch = ARCH_X86
    elsif pa == 2 # PROCESS_ARCH_X64
      arch = ARCH_X86_64
    end
  end

  processes <<
      {
        'pid'      => p.get_tlv_value(TLV_TYPE_PID),
        'ppid'     => p.get_tlv_value(TLV_TYPE_PARENT_PID),
        'name'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_NAME) ),
        'path'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_PATH) ),
        'session'  => p.get_tlv_value(TLV_TYPE_PROCESS_SESSION),
        'user'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_USER_NAME) ),
        'arch'     => arch
      }
  }

  return processes
end