class Rex::Post::Meterpreter::Extensions::Extapi::Adsi::Adsi

This meterpreter extension contains extended API functions for querying and managing desktop windows.

Attributes

client[RW]

Public Class Methods

new(client) click to toggle source
# File lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb, line 17
def initialize(client)
  @client = client
end

Public Instance Methods

domain_query(domain_name, filter, max_results, page_size, fields) click to toggle source

Perform a generic domain query against ADSI.

@param domain_name [String] The FQDN of the target domain. @param filter [String] The filter to apply to the query in

LDAP format.

@param max_results [Integer] The maximum number of results

to return.

@param page_size [Integer] The size of the page of results

to return.

@param fields [Array] Array of string fields to return for

each result found

@return [Hash] Array of field names with associated results.

# File lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb, line 36
def domain_query(domain_name, filter, max_results, page_size, fields)
  request = Packet.create_request('extapi_adsi_domain_query')

  request.add_tlv(TLV_TYPE_EXT_ADSI_DOMAIN, domain_name)
  request.add_tlv(TLV_TYPE_EXT_ADSI_FILTER, filter)
  request.add_tlv(TLV_TYPE_EXT_ADSI_MAXRESULTS, max_results)
  request.add_tlv(TLV_TYPE_EXT_ADSI_PAGESIZE, page_size)

  fields.each do |f|
    request.add_tlv(TLV_TYPE_EXT_ADSI_FIELD, f)
  end

  response = client.send_request(request)

  results = extract_results(response)

  return {
    :fields  => fields,
    :results => results
  }
end

Protected Instance Methods

extract_results(response) click to toggle source

Retrieve the results of the query from the response

packet that was returned from Meterpreter.

@param response [Packet] Reference to the received

packet that was returned from Meterpreter.

@return [Array[Array[]] Collection of results from

the ADSI query.
# File lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb, line 72
def extract_results(response)
  results = []

  response.each(TLV_TYPE_EXT_ADSI_RESULT) do |r|
    results << extract_values(r)
  end

  results
end
extract_value(v) click to toggle source

Convert a single ADSI result value into a usable

value that also describes its type.

@param v [TLV] The TLV item that contains the value.

@return [Hash] The type/value pair from the TLV.

# File lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb, line 107
def extract_value(v)
  value = {
    :type => :unknown
  }

  case v.type
  when TLV_TYPE_EXT_ADSI_STRING
    value = {
      :type  => :string,
      :value => v.value
    }
  when TLV_TYPE_EXT_ADSI_NUMBER, TLV_TYPE_EXT_ADSI_BIGNUMBER
    value = {
      :type  => :number,
      :value => v.value
    }
  when TLV_TYPE_EXT_ADSI_BOOL
    value = {
      :type  => :bool,
      :value => v.value
    }
  when TLV_TYPE_EXT_ADSI_RAW
    value = {
      :type  => :raw,
      :value => v.value
    }
  when TLV_TYPE_EXT_ADSI_ARRAY
    value = {
      :type  => :array,
      :value => extract_values(v.value)
    }
  when TLV_TYPE_EXT_ADSI_PATH
    value = {
      :type     => :path,
      :volume   => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_VOL),
      :path     => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_PATH),
      :vol_type => v.get_tlv_value(TLV_TYPE_EXT_ADSI_PATH_TYPE)
    }
  when TLV_TYPE_EXT_ADSI_DN
    values = v.get_tlvs(TLV_TYPE_ALL)
    value = {
      :type   => :dn,
      :label  => values[0].value
    }

    if values[1].type == TLV_TYPE_EXT_ADSI_STRING
      value[:string] = value[1].value
    else
      value[:raw] = value[1].value
    end
  end

  value
end
extract_values(tlv_container) click to toggle source

Extract a single row of results from a TLV group.

@param tlv_container [Packet] Reference to the TLV

group to pull the values from.

@return [Array] Collection of values from

the single ADSI query result row.
# File lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb, line 91
def extract_values(tlv_container)
  values = []
  tlv_container.get_tlvs(TLV_TYPE_ANY).each do |v|
    values << extract_value(v)
  end
  values
end