Class: Msf::Sessions::VncInject

Inherits:
Object
  • Object
show all
Includes:
Msf::Session, Msf::Session::Basic
Defined in:
lib/msf/base/sessions/vncinject.rb

Instance Attribute Summary collapse

Attributes included from Msf::Session::Interactive

#rstream

Attributes included from Rex::Ui::Interactive

#completed, #interacting, #next_session, #on_command_proc, #on_print_proc, #orig_suspend, #orig_usr1

Attributes included from Rex::Ui::Subscriber::Input

#user_input

Attributes included from Rex::Ui::Subscriber::Output

#user_output

Attributes included from Msf::Session

#alive, #db_record, #exploit, #exploit_datastore, #exploit_task, #exploit_uuid, #framework, #info, #machine_id, #payload_uuid, #routes, #sid, #sname, #target_host, #target_port, #username, #uuid, #via, #workspace

Attributes included from Framework::Offspring

#framework

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Msf::Session::Interactive

#_interact_complete, #_interrupt, #_suspend, #_usr1, #kill, #run_cmd, #tunnel_local, #tunnel_peer, #user_want_abort?

Methods included from Rex::Ui::Interactive

#_interact_complete, #_interrupt, #_local_fd, #_remote_fd, #_stream_read_local_write_remote, #_stream_read_remote_write_local, #_suspend, #detach, #handle_suspend, #handle_usr1, #interact, #interact_stream, #prompt, #prompt_yesno, #restore_suspend, #restore_usr1

Methods included from Rex::Ui::Subscriber

#copy_ui, #init_ui, #reset_ui

Methods included from Rex::Ui::Subscriber::Input

#gets

Methods included from Rex::Ui::Subscriber::Output

#flush, #print, #print_blank_line, #print_error, #print_good, #print_line, #print_status, #print_warning

Methods included from Msf::Session

#alive?, #dead?, #inspect, #kill, #log_file_name, #log_source, #name, #name=, #session_host, #session_host=, #session_port, #session_port=, #session_type, #set_from_exploit, #set_via, #tunnel_local, #tunnel_peer, #tunnel_to_s, #via_exploit, #via_payload

Constructor Details

#initialize(rstream, opts = {}) ⇒ VncInject

Initializes a vncinject session instance using the supplied rstream that is to be used as the client's connection to the server.


22
23
24
25
26
27
# File 'lib/msf/base/sessions/vncinject.rb', line 22

def initialize(rstream, opts={})
  super

  self.conn_eof = false
  self.got_conn = false
end

Instance Attribute Details

#conn_eofObject (protected)

:nodoc:


176
177
178
# File 'lib/msf/base/sessions/vncinject.rb', line 176

def conn_eof
  @conn_eof
end

#got_connObject (protected)

:nodoc:


177
178
179
# File 'lib/msf/base/sessions/vncinject.rb', line 177

def got_conn
  @got_conn
end

#viewObject (protected)

:nodoc:


178
179
180
# File 'lib/msf/base/sessions/vncinject.rb', line 178

def view
  @view
end

#vlhostObject (protected)

:nodoc:


174
175
176
# File 'lib/msf/base/sessions/vncinject.rb', line 174

def vlhost
  @vlhost
end

#vlportObject (protected)

:nodoc:


175
176
177
# File 'lib/msf/base/sessions/vncinject.rb', line 175

def vlport
  @vlport
end

Class Method Details

.typeObject

Returns the session type as being 'vncinject'.


57
58
59
# File 'lib/msf/base/sessions/vncinject.rb', line 57

def self.type
  "vncinject"
end

Instance Method Details

#_interactObject

:nodoc:

Raises:

  • (EOFError)

81
82
83
84
85
# File 'lib/msf/base/sessions/vncinject.rb', line 81

def _interact # :nodoc:
  raise EOFError if (self.conn_eof == true)

  sleep(1)
end

#autovnc(viewonly = true) ⇒ Object

Launches VNC viewer against the local relay for this VNC server session.

Returns true if we were able to find the executable and false otherwise. Note that this says nothing about whether it worked, only that we found the file.


153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
# File 'lib/msf/base/sessions/vncinject.rb', line 153

def autovnc(viewonly=true)
  vnc =
    Rex::FileUtils::find_full_path('vncviewer') ||
    Rex::FileUtils::find_full_path('vncviewer.exe')

  if (vnc)
    args = []
    args.push '-viewonly' if viewonly
    args.push "#{vlhost}::#{vlport}"

    self.view = framework.threads.spawn("VncViewerWrapper", false) {
      system(vnc, *args)
    }

    return true
  end
  false
end

#cleanupObject

Cleans up the local relay and closes the stream.


32
33
34
35
36
37
38
39
40
41
42
43
44
45
# File 'lib/msf/base/sessions/vncinject.rb', line 32

def cleanup
  # Stop the local TCP relay
  service = Rex::ServiceManager.start(Rex::Services::LocalRelay)

  if (service)
    begin
      service.stop_tcp_relay(vlport, vlhost) if (vlport)
    ensure
      service.deref
    end
  end

  super
end

#descObject

Returns the session description.


70
71
72
# File 'lib/msf/base/sessions/vncinject.rb', line 70

def desc
  "VNC Server"
end

#interactive?Boolean

Not interactive in the normal sense

Returns:

  • (Boolean)

90
91
92
# File 'lib/msf/base/sessions/vncinject.rb', line 90

def interactive?
  false
end

#register?Boolean

Skip session registration for VNC

Returns:

  • (Boolean)

50
51
52
# File 'lib/msf/base/sessions/vncinject.rb', line 50

def register?
  false
end

#setup_relay(port, host = '127.0.0.1') ⇒ Object

Sets up a local relay that is associated with the stream connection


103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# File 'lib/msf/base/sessions/vncinject.rb', line 103

def setup_relay(port, host = '127.0.0.1')
  if (port)
    self.vlhost = host
    self.vlport = port

    service = Rex::ServiceManager.start(Rex::Services::LocalRelay)

    if (service)
      begin
        service.start_tcp_relay(port,
          'LocalHost'         => host,
          'Stream'            => true,
          'OnLocalConnection' => Proc.new {

            if (self.got_conn == true)
              nil
            else
              self.got_conn = true

              rstream
            end
          },
          'OnConnectionClose' => Proc.new {

            if (self.conn_eof == false)
              print_status("VNC connection closed.")
              self.conn_eof = true

              # Closing time
              self.view.kill if self.view
              self.view = nil
              self.kill
            end

          },
          '__RelayType'       => 'vncinject')
      end
    else
      raise RuntimeError, "Relay failed to start."
    end
  end
end

#typeObject

Calls the class method.


77
78
79
# File 'lib/msf/base/sessions/vncinject.rb', line 77

def type
  self.class.type
end