Module: Msf::Post::Windows::Eventlog

Included in:
Scripts::Meterpreter::Common
Defined in:
lib/msf/core/post/windows/eventlog.rb

Instance Method Summary collapse

Instance Method Details

#eventlog_clear(evt = "") ⇒ Object

Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs that where cleared.


26
27
28
29
30
31
32
33
34
35
36
37
38
# File 'lib/msf/core/post/windows/eventlog.rb', line 26

def eventlog_clear(evt = "")
  evntlog = []
  if evt.empty?
    evntlog = eventloglist
  else
    evntlog << evt
  end
  evntlog.each do |e|
    log = session.sys.eventlog.open(e)
    log.clear
  end
  return evntlog
end

#eventlog_listObject

Enumerate eventlogs


11
12
13
14
15
16
17
18
19
20
# File 'lib/msf/core/post/windows/eventlog.rb', line 11

def eventlog_list
  key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\"
  if session.sys.config.sysinfo['OS'] =~ /Windows 2003|.Net|XP|2000/
    key = "#{key}Eventlog"
  else
    key = "#{key}eventlog"
  end
  eventlogs = registry_enumkeys(key)
  return eventlogs
end