Module: Msf::Post::Windows::FileInfo

Defined in:
lib/msf/core/post/windows/file_info.rb

Instance Method Summary collapse

Instance Method Details

#file_version(filepath) ⇒ String

Returns the file version information such as: major, minor, build, revision, branch.

Parameters:

  • filepath (String)

    The path of the file you are targeting.

Returns:

  • (String)

    Returns the file version information of the file.


21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# File 'lib/msf/core/post/windows/file_info.rb', line 21

def file_version(filepath)
  file_version_info_size = client.railgun.version.GetFileVersionInfoSizeA(
    filepath,
    nil
  )['return']

  buffer = session.railgun.kernel32.VirtualAlloc(
    nil,
    file_version_info_size,
    MEM_COMMIT|MEM_RESERVE,
    PAGE_READWRITE
  )['return']

  client.railgun.version.GetFileVersionInfoA(
    filepath,
    0,
    file_version_info_size,
    buffer
  )

  result = client.railgun.version.VerQueryValueA(buffer, "\\", 4, 4)
  ffi = client.railgun.memread(result['lplpBuffer'], result['puLen'])

  vs_fixed_file_info = ffi.unpack('V13')

  unless vs_fixed_file_info and (vs_fixed_file_info.length == 13)	and
(vs_fixed_file_info[0] = 0xfeef04bd)
    return nil
  end

  major = hiword(vs_fixed_file_info[2])
  minor = loword(vs_fixed_file_info[2])
  build = hiword(vs_fixed_file_info[3])
  revision = loword(vs_fixed_file_info[3])
  branch = revision.to_s[0..1].to_i

  return major, minor, build, revision, branch
end

#hiword(num) ⇒ Object


8
9
10
# File 'lib/msf/core/post/windows/file_info.rb', line 8

def hiword(num)
  (num >> 16) & 0xffff
end

#loword(num) ⇒ Object


12
13
14
# File 'lib/msf/core/post/windows/file_info.rb', line 12

def loword(num)
  num & 0xffff
end