class Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Priv::Elevate

The local privilege escalation portion of the extension.

Constants

ELEVATE_TECHNIQUE_ANY
ELEVATE_TECHNIQUE_DESCRIPTION
ELEVATE_TECHNIQUE_NONE
ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE
ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2
ELEVATE_TECHNIQUE_SERVICE_TOKENDUP
Klass

Public Instance Methods

cmd_getsystem( *args ) click to toggle source

Attempt to elevate the meterpreter to that of local system.

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 72
def cmd_getsystem( *args )

  technique = ELEVATE_TECHNIQUE_ANY

  desc = ""
  ELEVATE_TECHNIQUE_DESCRIPTION.each_index { |i| desc += "\n\t\t#{i} : #{ELEVATE_TECHNIQUE_DESCRIPTION[i]}" }

  getsystem_opts = Rex::Parser::Arguments.new(
    "-h" => [ false, "Help Banner." ],
    "-t" => [ true, "The technique to use. (Default to \'#{technique}\')." + desc ]
  )

  getsystem_opts.parse(args) { | opt, idx, val |
    case opt
      when "-h"
        print_line( "Usage: getsystem [options]\n" )
        print_line( "Attempt to elevate your privilege to that of local system." )
        print_line( getsystem_opts.usage )
        return
      when "-t"
        technique = val.to_i
    end
  }

  if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length )
    print_error( "Technique '#{technique}' is out of range." )
    return false;
  end

  begin
    result = client.priv.getsystem( technique )
  rescue Rex::Post::Meterpreter::RequestError => e
    print_error("#{e.message} The following was attempted:")
    translate_technique_index(technique).each do |desc|
      print_error(desc)
    end
    elog("#{e.class} #{e.message} (Technique: #{technique})\n#{e.backtrace * "\n"}")
    return
  end

  # got system?
  if result[0]
    print_line( "...got system via technique #{result[1]} (#{translate_technique_index(result[1]).first})." )
  else
    print_line( "...failed to get system while attempting the following:" )
    translate_technique_index(technique).each do |desc|
      print_error(desc)
    end
  end

  return result
end
commands() click to toggle source

List of supported commands.

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 36
def commands
  {
    "getsystem" => "Attempt to elevate your privilege to that of local system."
  }
end
name() click to toggle source

Name for this dispatcher.

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 45
def name
  "Priv: Elevate"
end
translate_technique_index(index) click to toggle source

Returns the description of the technique(s)

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb, line 53
def translate_technique_index(index)
  translation = ''

  case index
  when 0
    desc = ELEVATE_TECHNIQUE_DESCRIPTION.dup
    desc.shift
    translation = desc
  else
    translation = [ ELEVATE_TECHNIQUE_DESCRIPTION[index] ]
  end

  translation
end