Module: Msf::Post::Windows::Eventlog

Defined in:
lib/msf/core/post/windows/eventlog.rb

Instance Method Summary collapse

Instance Method Details

#eventlog_clear(evt = "") ⇒ Object

Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs that where cleared.


33
34
35
36
37
38
39
40
41
42
43
44
45
# File 'lib/msf/core/post/windows/eventlog.rb', line 33

def eventlog_clear(evt = "")
  evntlog = []
  if evt.empty?
    evntlog = eventloglist
  else
    evntlog << evt
  end
  evntlog.each do |e|
    log = session.sys.eventlog.open(e)
    log.clear
  end
  return evntlog
end

#eventlog_listObject

Enumerate eventlogs


18
19
20
21
22
23
24
25
26
27
# File 'lib/msf/core/post/windows/eventlog.rb', line 18

def eventlog_list
  key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\"
  if session.sys.config.sysinfo['OS'] =~ /Windows 2003|\.Net|XP|2000/
    key = "#{key}Eventlog"
  else
    key = "#{key}eventlog"
  end
  eventlogs = registry_enumkeys(key)
  return eventlogs
end

#initialize(info = {}) ⇒ Object


8
9
10
11
12
13
# File 'lib/msf/core/post/windows/eventlog.rb', line 8

def initialize(info = {})
  super(update_info(
    info,
    'Compat' => { 'Meterpreter' => { 'Commands' => %w{ stdapi_sys_config_sysinfo stdapi_sys_eventlog_* } } }
  ))
end