class Rex::Post::Meterpreter::Extensions::Stdapi::Sys::EventLog

This class provides access to the Windows event log on the remote machine.

Attributes

client[RW]

Public Class Methods

close(client, handle) click to toggle source

Close the event log

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 178
def self.close(client, handle)
  request = Packet.create_request('stdapi_sys_eventlog_close')
  request.add_tlv(TLV_TYPE_EVENT_HANDLE, handle);
  response = client.send_request(request, nil)
  return nil
end
finalize(client,handle) click to toggle source
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 65
def self.finalize(client,handle)
  proc { self.close(client,handle) }
end
new(hand) click to toggle source

Initializes an instance of the eventlog manipulator.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 59
def initialize(hand)
  self.client = self.class.client
  self.handle = hand
  ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) )
end
open(name) click to toggle source

Opens the supplied event log.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 35
def EventLog.open(name)
  request = Packet.create_request('stdapi_sys_eventlog_open')

  request.add_tlv(TLV_TYPE_EVENT_SOURCENAME, name);

  response = client.send_request(request)

  return self.new(response.get_tlv_value(TLV_TYPE_EVENT_HANDLE))
end

Public Instance Methods

_read(flags, offset = 0) click to toggle source

the low level read function (takes flags, not hash, etc).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 85
def _read(flags, offset = 0)
  request = Packet.create_request('stdapi_sys_eventlog_read')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle)
  request.add_tlv(TLV_TYPE_EVENT_READFLAGS, flags)
  request.add_tlv(TLV_TYPE_EVENT_RECORDOFFSET, offset)

  response = client.send_request(request)

  EventLogSubsystem::EventRecord.new(
    response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER),
    response.get_tlv_value(TLV_TYPE_EVENT_TIMEGENERATED),
    response.get_tlv_value(TLV_TYPE_EVENT_TIMEWRITTEN),
    response.get_tlv_value(TLV_TYPE_EVENT_ID),
    response.get_tlv_value(TLV_TYPE_EVENT_TYPE),
    response.get_tlv_value(TLV_TYPE_EVENT_CATEGORY),
    response.get_tlv_values(TLV_TYPE_EVENT_STRING),
    response.get_tlv_value(TLV_TYPE_EVENT_DATA)
  )
end
clear() click to toggle source

Clear the specified event log (and return nil).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 166
def clear
  request = Packet.create_request('stdapi_sys_eventlog_clear')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)
  return self
end
close() click to toggle source

Instance method

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 186
def close
  self.class.close(self.client, self.handle)
end
each_backwards() { |read_backwards| ... } click to toggle source

Iterator for read_backwards.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 137
def each_backwards
  begin
    loop do
      yield(read_backwards)
    end
  rescue ::Exception
  end
end
each_forwards() { |read_forwards| ... } click to toggle source

Iterator for read_forwards.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 117
def each_forwards
  begin
    loop do
      yield(read_forwards)
    end
  rescue ::Exception
  end
end
length() click to toggle source

Return the number of records in the event log.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 72
def length
  request = Packet.create_request('stdapi_sys_eventlog_numrecords')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_EVENT_NUMRECORDS)
end
oldest() click to toggle source

Return the record number of the oldest event (not necessarily 1).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 149
def oldest
  request = Packet.create_request('stdapi_sys_eventlog_oldest')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER)
end
read_backwards() click to toggle source

Read the eventlog backwards, meaning from newest to oldest. Returns a EventRecord, and throws an exception after no more records.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 130
def read_backwards
  _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ)
end
read_forwards() click to toggle source

Read the eventlog forwards, meaning from oldest to newest. Returns a EventRecord, and throws an exception after no more records.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 110
def read_forwards
  _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ)
end