class Rex::Post::Meterpreter::Extensions::Stdapi::Sys::EventLog
This class provides access to the Windows event log on the remote machine.
Attributes
client[RW]
Public Class Methods
close(client, handle)
click to toggle source
Close the event log
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 178 def self.close(client, handle) request = Packet.create_request('stdapi_sys_eventlog_close') request.add_tlv(TLV_TYPE_EVENT_HANDLE, handle); response = client.send_request(request, nil) return nil end
finalize(client,handle)
click to toggle source
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 65 def self.finalize(client,handle) proc { self.close(client,handle) } end
new(hand)
click to toggle source
Initializes an instance of the eventlog manipulator.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 59 def initialize(hand) self.client = self.class.client self.handle = hand ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) ) end
open(name)
click to toggle source
Opens the supplied event log.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 35 def EventLog.open(name) request = Packet.create_request('stdapi_sys_eventlog_open') request.add_tlv(TLV_TYPE_EVENT_SOURCENAME, name); response = client.send_request(request) return self.new(response.get_tlv_value(TLV_TYPE_EVENT_HANDLE)) end
Public Instance Methods
_read(flags, offset = 0)
click to toggle source
the low level read function (takes flags, not hash, etc).
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 85 def _read(flags, offset = 0) request = Packet.create_request('stdapi_sys_eventlog_read') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle) request.add_tlv(TLV_TYPE_EVENT_READFLAGS, flags) request.add_tlv(TLV_TYPE_EVENT_RECORDOFFSET, offset) response = client.send_request(request) EventLogSubsystem::EventRecord.new( response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER), response.get_tlv_value(TLV_TYPE_EVENT_TIMEGENERATED), response.get_tlv_value(TLV_TYPE_EVENT_TIMEWRITTEN), response.get_tlv_value(TLV_TYPE_EVENT_ID), response.get_tlv_value(TLV_TYPE_EVENT_TYPE), response.get_tlv_value(TLV_TYPE_EVENT_CATEGORY), response.get_tlv_values(TLV_TYPE_EVENT_STRING), response.get_tlv_value(TLV_TYPE_EVENT_DATA) ) end
clear()
click to toggle source
Clear the specified event log (and return nil).
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 166 def clear request = Packet.create_request('stdapi_sys_eventlog_clear') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle); response = client.send_request(request) return self end
close()
click to toggle source
Instance method
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 186 def close self.class.close(self.client, self.handle) end
each_backwards() { |read_backwards| ... }
click to toggle source
Iterator for read_backwards.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 137 def each_backwards begin loop do yield(read_backwards) end rescue ::Exception end end
each_forwards() { |read_forwards| ... }
click to toggle source
Iterator for read_forwards.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 117 def each_forwards begin loop do yield(read_forwards) end rescue ::Exception end end
length()
click to toggle source
Return the number of records in the event log.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 72 def length request = Packet.create_request('stdapi_sys_eventlog_numrecords') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle); response = client.send_request(request) return response.get_tlv_value(TLV_TYPE_EVENT_NUMRECORDS) end
oldest()
click to toggle source
Return the record number of the oldest event (not necessarily 1).
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 149 def oldest request = Packet.create_request('stdapi_sys_eventlog_oldest') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle); response = client.send_request(request) return response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER) end
read_backwards()
click to toggle source
Read the eventlog backwards, meaning from newest to oldest. Returns a EventRecord, and throws an exception after no more records.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 130 def read_backwards _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ) end
read_forwards()
click to toggle source
Read the eventlog forwards, meaning from oldest to newest. Returns a EventRecord, and throws an exception after no more records.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 110 def read_forwards _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ) end