Class: Rex::Post::Meterpreter::Channel

Inherits:
Object
  • Object
show all
Extended by:
InboundPacketHandler
Defined in:
lib/rex/post/meterpreter/channel.rb

Overview

The channel class represents a logical data pipe that exists between the client and the server. The purpose and behavior of the channel depends on which type it is. The three basic types of channels are streams, datagrams, and pools. Streams are basically equivalent to a TCP connection. Bidirectional, connection-oriented streams. Datagrams are basically equivalent to a UDP session. Bidirectional, connectionless. Pools are basically equivalent to a uni-directional connection, like a file handle. Pools denote channels that only have requests flowing in one direction.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from InboundPacketHandler

request_handler, response_handler

Constructor Details

#initialize(client, cid, type, flags, packet, **_) ⇒ Channel

Initializes the instance’s attributes, such as client context, class identifier, type, and flags.



137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
 
# File 'lib/rex/post/meterpreter/channel.rb', line 137

def initialize(client, cid, type, flags, packet, **_)
  self.client = client
  self.cid    = cid
  self.type   = type
  self.flags  = flags
  @mutex  = Mutex.new

  # Add this instance to the list
  if (cid and client)
    client.add_channel(self)
  end

  # Ensure the remote object is closed when all references are removed
  ObjectSpace.define_finalizer(self, self.class.finalize(client, cid))
end

Instance Attribute Details

#cid ⇒ Object

The unique channel identifier.



445
446
447
 
# File 'lib/rex/post/meterpreter/channel.rb', line 445

def cid
  @cid
end

#client ⇒ Object

The associated meterpreter client instance



465
466
467
 
# File 'lib/rex/post/meterpreter/channel.rb', line 465

def client
  @client
end

#cls ⇒ Object

The class of channel (stream, datagram, pool).



453
454
455
 
# File 'lib/rex/post/meterpreter/channel.rb', line 453

def cls
  @cls
end

#flags ⇒ Object

Any channel-specific flag, like synchronous IO.



457
458
459
 
# File 'lib/rex/post/meterpreter/channel.rb', line 457

def flags
  @flags
end

#params ⇒ Object

Any channel-specific parameters.



461
462
463
 
# File 'lib/rex/post/meterpreter/channel.rb', line 461

def params
  @params
end

#type ⇒ Object

The type of channel.



449
450
451
 
# File 'lib/rex/post/meterpreter/channel.rb', line 449

def type
  @type
end

Class Method Details

._close(client, cid, addends = nil) ⇒ Object

Closes the channel.



297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
 
# File 'lib/rex/post/meterpreter/channel.rb', line 297

def self._close(client, cid, addends=nil)
  if cid.nil?
    raise IOError, "Channel has been closed.", caller
  end

  request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_CLOSE)

  # Populate the request
  request.add_tlv(TLV_TYPE_CHANNEL_ID, cid)
  request.add_tlvs(addends)

  client.send_request(request, nil)

  # Disassociate this channel instance
  client.remove_channel(cid)

  return true
end

.create(client, type = nil, klass = nil, flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil, **klass_kwargs) ⇒ Object

Creates a logical channel between the client and the server based on a given type.



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
 
# File 'lib/rex/post/meterpreter/channel.rb', line 95

def Channel.create(client, type = nil, klass = nil,
    flags = CHANNEL_FLAG_SYNCHRONOUS, addends = nil, **klass_kwargs)
  request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_OPEN)

  # Set the type of channel that we're allocating
  if !type.nil?
    request.add_tlv(TLV_TYPE_CHANNEL_TYPE, type)
  end

  # If no factory class was provided, use the default native class
  if klass.nil?
    klass = self
  end

  request.add_tlv(TLV_TYPE_CHANNEL_CLASS, klass.cls)
  request.add_tlv(TLV_TYPE_FLAGS, flags)
  request.add_tlvs(addends)

  # Transmit the request and wait for the response
  cid = nil
  begin
    response = client.send_request(request)
    cid = response.get_tlv_value(TLV_TYPE_CHANNEL_ID)
    if cid.nil?
      raise Rex::Post::Meterpreter::RequestError
    end
  end

  # Create the channel instance
  klass.new(client, cid, type, flags, response, **klass_kwargs)
end

.finalize(client, cid) ⇒ Object 



153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
 
# File 'lib/rex/post/meterpreter/channel.rb', line 153

def self.finalize(client, cid)
  proc {
    unless cid.nil?
      deferred_close_proc = proc do
        begin
          self._close(client, cid)
        rescue => e
          elog("finalize method for Channel failed", error: e)
        end
      end

      # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes
      client.framework.sessions.schedule(deferred_close_proc)
    end
  }
end

.request_handler(client, packet) ⇒ Object

Class request handler for all channels that dispatches requests to the appropriate class instance’s DIO handler



55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/rex/post/meterpreter/channel.rb', line 55

def request_handler(client, packet)
  cid = packet.get_tlv_value(TLV_TYPE_CHANNEL_ID)

  # No channel identifier, then drop it
  if cid.nil?
    return false
  end

  channel = client.find_channel(cid)

  # No valid channel context? The channel may not be registered yet
  if channel.nil?
    return false
  end


  dio = channel.dio_map(packet.method)

  # Supported DIO request? Dump it.
  if dio.nil?
    return true
  end


  # Call the channel's dio handler and return success or fail
  # based on what happens
  channel.dio_handler(dio, packet)
end

Instance Method Details

#_close(addends = nil) ⇒ Object 



316
317
318
319
320
321
322
323
324
325
 
# File 'lib/rex/post/meterpreter/channel.rb', line 316

def _close(addends = nil)
  # let the finalizer do the work behind the scenes
  @mutex.synchronize {
    unless self.cid.nil?
      ObjectSpace.undefine_finalizer(self)
      self.class._close(self.client, self.cid, addends)
      self.cid = nil
    end
  }
end

#_read(length = nil, addends = nil) ⇒ Object

Reads data from the remote half of the channel.



187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
 
# File 'lib/rex/post/meterpreter/channel.rb', line 187

def _read(length = nil, addends = nil)
  if self.cid.nil?
    raise IOError, "Channel has been closed.", caller
  end

  request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_READ)

  if length.nil?
    # Default block size to a higher amount for passive dispatcher
    length = self.client.passive_service ? (1024*1024) : 65536
  end

  request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)
  request.add_tlv(TLV_TYPE_LENGTH, length)
  request.add_tlvs(addends)

  begin
    response = self.client.send_request(request)
  rescue
    return nil
  end

  # If the channel is in synchronous mode, the response should contain
  # data that was read from the remote side of the channel
  if (flag?(CHANNEL_FLAG_SYNCHRONOUS))
    data = response.get_tlv(TLV_TYPE_CHANNEL_DATA);

    if (data != nil)
      return data.value
    end
  else
    raise NotImplementedError, "Asynchronous channel mode is not implemented", caller
  end

  return nil
end

#_write(buf, length = nil, addends = nil) ⇒ Object

Writes data to the remote half of the channel.



234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
 
# File 'lib/rex/post/meterpreter/channel.rb', line 234

def _write(buf, length = nil, addends = nil)
  if self.cid.nil?
    raise IOError, "Channel has been closed.", caller
  end

  request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_WRITE)

  # Truncation and celebration
  if ((length != nil) &&
      (buf.length >= length))
    buf = buf[0..length]
  else
    length = buf.length
  end

  # Populate the request
  request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)

  cdata = request.add_tlv(TLV_TYPE_CHANNEL_DATA, buf)
  if( ( self.flags & CHANNEL_FLAG_COMPRESS ) == CHANNEL_FLAG_COMPRESS )
    cdata.compress = true
  end

  request.add_tlv(TLV_TYPE_LENGTH, length)
  request.add_tlvs(addends)

  response = self.client.send_request(request)
  written  = response.get_tlv(TLV_TYPE_LENGTH)

  written.nil? ? 0 : written.value
end

#cleanup ⇒ Object (protected)

Cleans up any lingering resources



474
475
 
# File 'lib/rex/post/meterpreter/channel.rb', line 474

def cleanup
end

#close(addends = nil) ⇒ Object

Wrapper around the low-level close.



276
277
278
 
# File 'lib/rex/post/meterpreter/channel.rb', line 276

def close(addends = nil)
  return _close(addends)
end

#close_read ⇒ Object

Close the channel for future reads.



290
291
292
 
# File 'lib/rex/post/meterpreter/channel.rb', line 290

def close_read
  return _close
end

#close_write ⇒ Object

Close the channel for future writes.



283
284
285
 
# File 'lib/rex/post/meterpreter/channel.rb', line 283

def close_write
  return _close
end

#closed? ⇒ Boolean

Wrapper around check for self.cid

Returns:

  • (Boolean) 


269
270
271
 
# File 'lib/rex/post/meterpreter/channel.rb', line 269

def closed?
  self.cid.nil?
end

#dio_close_handler(packet) ⇒ Object

Stub close handler.



388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
 
# File 'lib/rex/post/meterpreter/channel.rb', line 388

def dio_close_handler(packet)
  temp_cid = nil
  @mutex.synchronize {
    temp_cid = self.cid
    self.cid = nil
  }
  client.remove_channel(temp_cid)

  # Trap IOErrors as parts of the channel may have already been closed
  begin
    self.cleanup
  rescue IOError
  end

  return true
end

#dio_handler(dio, packet) ⇒ Object

Handles dispatching I/O requests based on the request packet. The default implementation does nothing with direct I/O requests.



356
357
358
359
360
361
362
363
364
365
366
367
368
369
 
# File 'lib/rex/post/meterpreter/channel.rb', line 356

def dio_handler(dio, packet)
  if (dio == CHANNEL_DIO_READ)
    length = packet.get_tlv_value(TLV_TYPE_LENGTH)

    return dio_read_handler(packet, length)
  elsif (dio == CHANNEL_DIO_WRITE)
    data = packet.get_tlv_value(TLV_TYPE_CHANNEL_DATA)

    return dio_write_handler(packet, data)
  elsif (dio == CHANNEL_DIO_CLOSE)
    return dio_close_handler(packet)
  end
  return false;
end

#dio_map(command_id) ⇒ Object

Maps packet request methods to DIO request identifiers on a per-instance basis as other instances may add custom dio handlers.



410
411
412
413
414
415
416
417
418
419
420
 
# File 'lib/rex/post/meterpreter/channel.rb', line 410

def dio_map(command_id)
  if command_id == COMMAND_ID_CORE_CHANNEL_READ
    return CHANNEL_DIO_READ
  elsif command_id == COMMAND_ID_CORE_CHANNEL_WRITE
    return CHANNEL_DIO_WRITE
  elsif command_id == COMMAND_ID_CORE_CHANNEL_CLOSE
    return CHANNEL_DIO_CLOSE
  end

  return nil
end

#dio_read_handler(packet, length) ⇒ Object

Stub read handler.



374
375
376
 
# File 'lib/rex/post/meterpreter/channel.rb', line 374

def dio_read_handler(packet, length)
  return true
end

#dio_write_handler(packet, data) ⇒ Object

Stub write handler.



381
382
383
 
# File 'lib/rex/post/meterpreter/channel.rb', line 381

def dio_write_handler(packet, data)
  return true
end

#flag?(flag) ⇒ Boolean

Checks to see if a flag is set on the instance’s flags attribute.

Returns:

  • (Boolean) 


431
432
433
 
# File 'lib/rex/post/meterpreter/channel.rb', line 431

def flag?(flag)
  return ((self.flags & flag) == flag)
end

#interactive(tf = true, addends = nil) ⇒ Object

Enables or disables interactive mode.



329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
 
# File 'lib/rex/post/meterpreter/channel.rb', line 329

def interactive(tf = true, addends = nil)
  if self.cid.nil?
    raise IOError, "Channel has been closed.", caller
  end

  request = Packet.create_request(COMMAND_ID_CORE_CHANNEL_INTERACT)

  # Populate the request
  request.add_tlv(TLV_TYPE_CHANNEL_ID, self.cid)
  request.add_tlv(TLV_TYPE_BOOL, tf)
  request.add_tlvs(addends)

  self.client.send_request(request)

  return true
end

#read(length = nil, addends = nil) ⇒ Object

Wrapper around the low-level channel read operation.



180
181
182
 
# File 'lib/rex/post/meterpreter/channel.rb', line 180

def read(length = nil, addends = nil)
  return _read(length, addends)
end

#synchronous? ⇒ Boolean

Returns whether or not the channel is operating synchronously.

Returns:

  • (Boolean) 


438
439
440
 
# File 'lib/rex/post/meterpreter/channel.rb', line 438

def synchronous?
  return (self.flags & CHANNEL_FLAG_SYNCHRONOUS)
end

#write(buf, length = nil, addends = nil) ⇒ Object

Wrapper around the low-level write.



227
228
229
 
# File 'lib/rex/post/meterpreter/channel.rb', line 227

def write(buf, length = nil, addends = nil)
  return _write(buf, length, addends)
end