Method: Rex::Post::Meterpreter::Extensions::Priv::Fs#get_file_mace

Defined in:
lib/rex/post/meterpreter/extensions/priv/fs.rb

#get_file_mace(file_path) ⇒ Object

Returns a hash of the Modified, Accessed, Created, and Entry Modified values for the specified file path.



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/rex/post/meterpreter/extensions/priv/fs.rb', line 29

def get_file_mace(file_path)
  request = Packet.create_request(COMMAND_ID_PRIV_FS_GET_FILE_MACE)

  request.add_tlv(TLV_TYPE_FS_FILE_PATH, file_path)

  response = client.send_request(request)

  # Return the hash of times associated with the MACE values
  begin
    return {
      'Modified'       => ::Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_MODIFIED)),
      'Accessed'       => ::Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_ACCESSED)),
      'Created'        => ::Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_CREATED)),
      'Entry Modified' => ::Time.at(response.get_tlv_value(TLV_TYPE_FS_FILE_EMODIFIED))
    }
  rescue RangeError
    raise RangeError, 'Invalid MACE values'
  end
end