class Rex::Post::Meterpreter::Extensions::Stdapi::Sys::EventLog

This class provides access to the Windows event log on the remote machine.

Attributes

client[RW]

Public Class Methods

close(client, handle) click to toggle source

Close the event log

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 180
def self.close(client, handle)
  request = Packet.create_request('stdapi_sys_eventlog_close')
  request.add_tlv(TLV_TYPE_EVENT_HANDLE, handle);
  response = client.send_request(request, nil)
  return nil
end
finalize(client,handle) click to toggle source
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 67
def self.finalize(client,handle)
  proc { self.close(client,handle) }
end
new(hand) click to toggle source

Initializes an instance of the eventlog manipulator.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 59
def initialize(hand)
  self.client = self.class.client
  self.handle = hand

  # Ensure the remote object is closed when all references are removed
  ObjectSpace.define_finalizer(self, self.class.finalize(client, hand))
end
open(name) click to toggle source

Opens the supplied event log.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 35
def EventLog.open(name)
  request = Packet.create_request('stdapi_sys_eventlog_open')

  request.add_tlv(TLV_TYPE_EVENT_SOURCENAME, name);

  response = client.send_request(request)

  return self.new(response.get_tlv_value(TLV_TYPE_EVENT_HANDLE))
end

Public Instance Methods

_read(flags, offset = 0) click to toggle source

the low level read function (takes flags, not hash, etc).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 87
def _read(flags, offset = 0)
  request = Packet.create_request('stdapi_sys_eventlog_read')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle)
  request.add_tlv(TLV_TYPE_EVENT_READFLAGS, flags)
  request.add_tlv(TLV_TYPE_EVENT_RECORDOFFSET, offset)

  response = client.send_request(request)

  EventLogSubsystem::EventRecord.new(
    response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER),
    response.get_tlv_value(TLV_TYPE_EVENT_TIMEGENERATED),
    response.get_tlv_value(TLV_TYPE_EVENT_TIMEWRITTEN),
    response.get_tlv_value(TLV_TYPE_EVENT_ID),
    response.get_tlv_value(TLV_TYPE_EVENT_TYPE),
    response.get_tlv_value(TLV_TYPE_EVENT_CATEGORY),
    response.get_tlv_values(TLV_TYPE_EVENT_STRING),
    response.get_tlv_value(TLV_TYPE_EVENT_DATA)
  )
end
clear() click to toggle source

Clear the specified event log (and return nil).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 168
def clear
  request = Packet.create_request('stdapi_sys_eventlog_clear')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)
  return self
end
close() click to toggle source

Instance method

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 188
def close
  unless self.handle.nil?
    ObjectSpace.undefine_finalizer(self)
    self.class.close(self.client, self.handle)
    self.handle = nil
  end
end
each_backwards() { |read_backwards| ... } click to toggle source

Iterator for read_backwards.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 139
def each_backwards
  begin
    loop do
      yield(read_backwards)
    end
  rescue ::Exception
  end
end
each_forwards() { |read_forwards| ... } click to toggle source

Iterator for read_forwards.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 119
def each_forwards
  begin
    loop do
      yield(read_forwards)
    end
  rescue ::Exception
  end
end
length() click to toggle source

Return the number of records in the event log.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 74
def length
  request = Packet.create_request('stdapi_sys_eventlog_numrecords')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_EVENT_NUMRECORDS)
end
oldest() click to toggle source

Return the record number of the oldest event (not necessarily 1).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 151
def oldest
  request = Packet.create_request('stdapi_sys_eventlog_oldest')

  request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

  response = client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER)
end
read_backwards() click to toggle source

Read the eventlog backwards, meaning from newest to oldest. Returns a EventRecord, and throws an exception after no more records.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 132
def read_backwards
  _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ)
end
read_forwards() click to toggle source

Read the eventlog forwards, meaning from oldest to newest. Returns a EventRecord, and throws an exception after no more records.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 112
def read_forwards
  _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ)
end