class Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Priv::Elevate
The local privilege escalation portion of the extension.
Constants
- ELEVATE_TECHNIQUE_ANY
- ELEVATE_TECHNIQUE_DESCRIPTION
- ELEVATE_TECHNIQUE_NONE
- ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE
- ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2
- ELEVATE_TECHNIQUE_SERVICE_TOKENDUP
- Klass
Public Instance Methods
cmd_getsystem( *args )
click to toggle source
Attempt to elevate the meterpreter to that of local system.
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 72 def cmd_getsystem( *args ) technique = ELEVATE_TECHNIQUE_ANY desc = "" ELEVATE_TECHNIQUE_DESCRIPTION.each_index { |i| desc += "\n\t\t#{i} : #{ELEVATE_TECHNIQUE_DESCRIPTION[i]}" } getsystem_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help Banner." ], "-t" => [ true, "The technique to use. (Default to \'#{technique}\')." + desc ] ) getsystem_opts.parse(args) { | opt, idx, val | case opt when "-h" print_line( "Usage: getsystem [options]\n" ) print_line( "Attempt to elevate your privilege to that of local system." ) print_line( getsystem_opts.usage ) return when "-t" technique = val.to_i end } if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length ) print_error( "Technique '#{technique}' is out of range." ) return false; end begin result = client.priv.getsystem( technique ) rescue Rex::Post::Meterpreter::RequestError => e print_error("#{e.message} The following was attempted:") translate_technique_index(technique).each do |desc| print_error(desc) end elog("#{e.class} #{e.message} (Technique: #{technique})\n#{e.backtrace * "\n"}") return end # got system? if result[0] print_line( "...got system via technique #{result[1]} (#{translate_technique_index(result[1]).first})." ) else print_line( "...failed to get system while attempting the following:" ) translate_technique_index(technique).each do |desc| print_error(desc) end end return result end
commands()
click to toggle source
List of supported commands.
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 36 def commands { "getsystem" => "Attempt to elevate your privilege to that of local system." } end
name()
click to toggle source
Name for this dispatcher.
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 45 def name "Priv: Elevate" end
translate_technique_index(index)
click to toggle source
Returns the description of the technique(s)
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 53 def translate_technique_index(index) translation = '' case index when 0 desc = ELEVATE_TECHNIQUE_DESCRIPTION.dup desc.shift translation = desc else translation = [ ELEVATE_TECHNIQUE_DESCRIPTION[index] ] end translation end