Class: Rex::Post::Meterpreter::Tlv

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/post/meterpreter/packet.rb

Overview

Base TLV (Type-Length-Value) class

Direct Known Subclasses

GroupTlv

Constant Summary collapse

HEADER_SIZE = 
8

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(type, value = nil, compress = false) ⇒ Tlv

Returns an instance of a TLV.



300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
 
# File 'lib/rex/post/meterpreter/packet.rb', line 300

def initialize(type, value = nil, compress=false)
  @type     = type
  @compress = compress

  if (value != nil)
    if (type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
      if (value.kind_of?(Integer))
        @value = value.to_s
      else
        @value = value.dup
      end
    else
      @value = value
    end
  end
end

Instance Attribute Details

#compress ⇒ Object

Returns the value of attribute compress.



287
288
289
 
# File 'lib/rex/post/meterpreter/packet.rb', line 287

def compress
  @compress
end

#type ⇒ Object

Returns the value of attribute type.



287
288
289
 
# File 'lib/rex/post/meterpreter/packet.rb', line 287

def type
  @type
end

#value ⇒ Object

Returns the value of attribute value.



287
288
289
 
# File 'lib/rex/post/meterpreter/packet.rb', line 287

def value
  @value
end

Instance Method Details

#_tlv_type_string(value) ⇒ Object 



317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
 
# File 'lib/rex/post/meterpreter/packet.rb', line 317

def _tlv_type_string(value)
  tlv_names = ::Rex::Post::Meterpreter::CommandMapper.get_tlv_names(value).map { |name| name.to_s.gsub('TLV_TYPE_', '').gsub('PACKET_TYPE_', '') }

  case tlv_names.length
  when 0
    "unknown-#{value}"
  when 1
    tlv_names.first
  else
    # In the off-chance we have multiple TLV types which have the same value
    # https://github.com/rapid7/metasploit-framework/issues/16267
    # Sort it to ensure consistency across tests
    "oneOf(#{tlv_names.sort_by(&:to_s).join(',')})"
  end
end

#from_r(raw) ⇒ Object

Translates the raw format of the TLV into a sanitize version.



479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
 
# File 'lib/rex/post/meterpreter/packet.rb', line 479

def from_r(raw)
  self.value  = nil

  length, self.type = raw.unpack("NN");

  # check if the tlv value has been compressed...
  if( self.type & TLV_META_TYPE_COMPRESSED == TLV_META_TYPE_COMPRESSED )
    # set this TLV as using compression
    @compress = true
    # remove the TLV_META_TYPE_COMPRESSED flag from the tlv type to restore the
    # tlv type to its original, allowing for transparent data compression.
    self.type = self.type ^ TLV_META_TYPE_COMPRESSED
    # decompress the compressed data (skipping the length and type DWORD's)
    raw_decompressed = Rex::Text.zlib_inflate( raw[HEADER_SIZE..length-1] )
    # update the length to reflect the decompressed data length (+HEADER_SIZE for the length and type DWORD's)
    length = raw_decompressed.length + HEADER_SIZE
    # update the raw buffer with the new length, decompressed data and updated type.
    raw = [length, self.type].pack("NN") + raw_decompressed
  end

  if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
    if (raw.length > 0)
      self.value = raw[HEADER_SIZE..length-2]
    else
      self.value = nil
    end
  elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
    self.value = raw.unpack("NNN")[2]
  elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
    self.value = raw.unpack("NNQ<")[2]
    self.value = self.ntohq( self.value )
  elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
    self.value = raw.unpack("NNc")[2]

    if (self.value == 1)
      self.value = true
    else
      self.value = false
    end
  else
    self.value = raw[HEADER_SIZE..length-1]
  end

  length
end

#htonq(value) ⇒ Object (protected) 



527
528
529
530
531
532
533
 
# File 'lib/rex/post/meterpreter/packet.rb', line 527

def htonq(value)
  if [1].pack( 's' ) == [1].pack('n')
    return value
  else
    [value].pack('Q<').reverse.unpack('Q<').first
  end
end

#inspect ⇒ Object 



333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
 
# File 'lib/rex/post/meterpreter/packet.rb', line 333

def inspect
  utype = type ^ TLV_META_TYPE_COMPRESSED
  group = false
  meta = case (utype & TLV_META_MASK)
    when TLV_META_TYPE_STRING; "STRING"
    when TLV_META_TYPE_UINT; "INT"
    when TLV_META_TYPE_RAW; "RAW"
    when TLV_META_TYPE_BOOL; "BOOL"
    when TLV_META_TYPE_QWORD; "QWORD"
    when TLV_META_TYPE_GROUP; group=true; "GROUP"
    when TLV_META_TYPE_COMPLEX; "COMPLEX"
    else; 'unknown-meta-type'
    end

  stype = case type
    when PACKET_TYPE_REQUEST; 'Request'
    when PACKET_TYPE_RESPONSE; 'Response'
    else; _tlv_type_string(type)
    end

  group ||= (self.class.to_s =~ /Packet/)
  if group
    has_command_ids = type == PACKET_TYPE_RESPONSE && (self.method == COMMAND_ID_CORE_ENUMEXTCMD || self.method == COMMAND_ID_CORE_LOADLIB)
    if has_command_ids
      longest_command_id = self.get_tlvs(TLV_TYPE_UINT).map(&:value).max
      longest_command_id_length = longest_command_id.to_s.length
    end

    tlvs_inspect = "tlvs=[\n"
    @tlvs.each { |t|
      if t.type == TLV_TYPE_UINT && has_command_ids && longest_command_id_length
        command_name = ::Rex::Post::Meterpreter::CommandMapper.get_command_name(t.value)
        command_output = "command=#{command_name}>\n"
        this_value_length = t.value.to_s.length
        adjusted_command_name = command_output.rjust(command_output.length + longest_command_id_length - this_value_length)
        tlvs_inspect << "  #{t.inspect.gsub(/>$/, '')} " << adjusted_command_name
      else
        tlvs_inspect << "  #{t.inspect}\n"
      end
    }
    tlvs_inspect << "]"
  else
    val = value.inspect
    # Known list of datatypes that shouldn't be truncated, as their values are useful when debugging
    is_val_truncation_allowed = ![
      Rex::Post::Meterpreter::TLV_TYPE_UUID,
      Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_FILE_PATH,
      Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_SRC_FILE_PATH,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_FILE_PATH,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_DIRECTORY_PATH,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_STAT_BUF,
      Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_PROCESS_PATH,
    ].include?(type)
    if is_val_truncation_allowed && val.length > 50
      val = val[0,50] + ' ..."'
    end
    tlvs_inspect = "meta=#{meta.ljust(10)} value=#{val}"
    if type == TLV_TYPE_COMMAND_ID
      begin
        command_name = ::Rex::Post::Meterpreter::CommandMapper.get_command_name(value)
      rescue
        command_name = nil
      end
      tlvs_inspect <<= " command=#{command_name || 'unknown'}"
    end
  end
  "#<#{self.class} type=#{stype.ljust(15)} #{tlvs_inspect}>"
end

#meta_type?(meta) ⇒ Boolean

Checks to see if a TLVs meta type is equivalent to the meta type passed.

Returns:

  • (Boolean) 


411
412
413
 
# File 'lib/rex/post/meterpreter/packet.rb', line 411

def meta_type?(meta)
  return (self.type & meta == meta)
end

#ntohq(value) ⇒ Object (protected) 



535
536
537
 
# File 'lib/rex/post/meterpreter/packet.rb', line 535

def ntohq(value)
  htonq(value)
end

#to_r ⇒ Object

Converts the TLV to raw.



438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
 
# File 'lib/rex/post/meterpreter/packet.rb', line 438

def to_r
  # Forcibly convert to ASCII-8BIT encoding
  raw = value.to_s.unpack("C*").pack("C*")

  if (self.type & TLV_META_TYPE_STRING == TLV_META_TYPE_STRING)
    raw += "\x00"
  elsif (self.type & TLV_META_TYPE_UINT == TLV_META_TYPE_UINT)
    raw = [value].pack("N")
  elsif (self.type & TLV_META_TYPE_QWORD == TLV_META_TYPE_QWORD)
    raw = [ self.htonq( value.to_i ) ].pack("Q<")
  elsif (self.type & TLV_META_TYPE_BOOL == TLV_META_TYPE_BOOL)
    if (value == true)
      raw = [1].pack("c")
    else
      raw = [0].pack("c")
    end
  end

  # check if the tlv is to be compressed...
  if @compress
    raw_uncompressed = raw
    # compress the raw data
    raw_compressed = Rex::Text.zlib_deflate( raw_uncompressed )
    # check we have actually made the raw data smaller...
    # (small blobs often compress slightly larger then the original)
    # if the compressed data is not smaller, we dont use the compressed data
    if( raw_compressed.length < raw_uncompressed.length )
      # if so, set the TLV's type to indicate compression is used
      self.type = self.type | TLV_META_TYPE_COMPRESSED
      # update the raw data with the uncompressed data length + compressed data
      # (we include the uncompressed data length as the C side will need to know this for decompression)
      raw = [ raw_uncompressed.length ].pack("N") + raw_compressed
    end
  end

  [raw.length + HEADER_SIZE, self.type].pack("NN") + raw
end

#type?(type) ⇒ Boolean

Checks to see if the TLVs type is equivalent to the type passed.

Returns:

  • (Boolean) 


418
419
420
 
# File 'lib/rex/post/meterpreter/packet.rb', line 418

def type?(type)
  return self.type == type
end

#value?(value) ⇒ Boolean

Checks to see if the TLVs value is equivalent to the value passed.

Returns:

  • (Boolean) 


425
426
427
 
# File 'lib/rex/post/meterpreter/packet.rb', line 425

def value?(value)
  return self.value == value
end