Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve TLV Type handling #16258

Merged
merged 2 commits into from
Mar 4, 2022
Merged

Improve TLV Type handling #16258

merged 2 commits into from
Mar 4, 2022

Conversation

sjanusz-r7
Copy link
Contributor

This PR changes how TLV packet types are output when logging TLV packets.

Verification

  • Start msfconsole
  • Enable TLV logging in def dispatch_inbound_packet(packet) and def send_packet(packet, opts={})
  • Get a Meterpreter session
  • Verify that extension e.g. Stdapi types are shown as human-readable names

Before

RECV: #<Rex::Post::Meterpreter::Packet type=Response        tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=COMMAND-ID      meta=INT        value=1022 command=stdapi_net_config_get_routes>
  #<Rex::Post::Meterpreter::Tlv type=UUID            meta=RAW        value="T\xDE)\xB9\x9Ej\xAFR>G+S\\_\xDEs">
  #<Rex::Post::Meterpreter::GroupTlv type=unknown-1073743247 tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=unknown-263564  meta=RAW        value="\xC0\xA8\x81\x00">
  #<Rex::Post::Meterpreter::Tlv type=unknown-263565  meta=RAW        value="\xFF\xFF\xFF\x00">
  #<Rex::Post::Meterpreter::Tlv type=unknown-263566  meta=RAW        value="\x00\x00\x00\x00">
  #<Rex::Post::Meterpreter::Tlv type=STRING          meta=STRING     value="eth0">
  #<Rex::Post::Meterpreter::Tlv type=unknown-132515  meta=INT        value=100>
]>
  #<Rex::Post::Meterpreter::GroupTlv type=unknown-1073743247 tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=unknown-263564  meta=RAW        value="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=unknown-263565  meta=RAW        value="\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\ ...">
  #<Rex::Post::Meterpreter::Tlv type=unknown-263566  meta=RAW        value="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=STRING          meta=STRING     value="lo">
  #<Rex::Post::Meterpreter::Tlv type=unknown-132515  meta=INT        value=256>
]>
  #<Rex::Post::Meterpreter::GroupTlv type=unknown-1073743247 tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=unknown-263564  meta=RAW        value="\xFE\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=unknown-263565  meta=RAW        value="\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=unknown-263566  meta=RAW        value="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=STRING          meta=STRING     value="eth0">
  #<Rex::Post::Meterpreter::Tlv type=unknown-132515  meta=INT        value=100>
]>
  #<Rex::Post::Meterpreter::Tlv type=REQUEST-ID      meta=STRING     value="87853532539935089997869350942110">
  #<Rex::Post::Meterpreter::Tlv type=RESULT          meta=INT        value=0>
]>

After

RECV: #<Rex::Post::Meterpreter::Packet type=PACKET-TYPE-RESPONSE tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=COMMAND-ID      meta=INT        value=1022 command=stdapi_net_config_get_routes>
  #<Rex::Post::Meterpreter::Tlv type=UUID            meta=RAW        value="T\xDE)\xB9\x9Ej\xAFR>G+S\\_\xDEs">
  #<Rex::Post::Meterpreter::GroupTlv type=NETWORK-ROUTE   tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=SUBNET          meta=RAW        value="\xC0\xA8\x81\x00">
  #<Rex::Post::Meterpreter::Tlv type=NETMASK         meta=RAW        value="\xFF\xFF\xFF\x00">
  #<Rex::Post::Meterpreter::Tlv type=GATEWAY         meta=RAW        value="\x00\x00\x00\x00">
  #<Rex::Post::Meterpreter::Tlv type=STRING          meta=STRING     value="eth0">
  #<Rex::Post::Meterpreter::Tlv type=ROUTE-METRIC    meta=INT        value=100>
]>
  #<Rex::Post::Meterpreter::GroupTlv type=NETWORK-ROUTE   tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=SUBNET          meta=RAW        value="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=NETMASK         meta=RAW        value="\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\ ...">
  #<Rex::Post::Meterpreter::Tlv type=GATEWAY         meta=RAW        value="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=STRING          meta=STRING     value="lo">
  #<Rex::Post::Meterpreter::Tlv type=ROUTE-METRIC    meta=INT        value=256>
]>
  #<Rex::Post::Meterpreter::GroupTlv type=NETWORK-ROUTE   tlvs=[
  #<Rex::Post::Meterpreter::Tlv type=SUBNET          meta=RAW        value="\xFE\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=NETMASK         meta=RAW        value="\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=GATEWAY         meta=RAW        value="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ...">
  #<Rex::Post::Meterpreter::Tlv type=STRING          meta=STRING     value="eth0">
  #<Rex::Post::Meterpreter::Tlv type=ROUTE-METRIC    meta=INT        value=100>
]>
  #<Rex::Post::Meterpreter::Tlv type=REQUEST-ID      meta=STRING     value="12408185928188508781480957978798">
  #<Rex::Post::Meterpreter::Tlv type=RESULT          meta=INT        value=0>
]>

@sjanusz-r7 sjanusz-r7 force-pushed the convert-unknown-tlv-types-to-readable-strings branch 2 times, most recently from 2610869 to 7511738 Compare March 2, 2022 14:17
@jmartin-tech
Copy link
Contributor

@msjenkins-r7 test this please.

adfoster-r7
adfoster-r7 reviewed Mar 2, 2022
View reviewed changes
lib/rex/post/meterpreter/packet.rb Outdated
clazz.constants.each do |const|
next unless const.to_s.start_with?('TLV_TYPE_') || const.to_s.start_with?('PACKET_')

@@cached_tlv_types[const] = clazz.const_get(const)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like there's a weird edge case for returning multiple values here:

>> ([::Rex::Post::Meterpreter] + ::Rex::Post::Meterpreter::ExtensionMapper.get_extension_klasses).flat_map { |klass| klass.constants.map { |const| (klass.to_s + "::" + const.to_s) } }.select { |name| name.incl
ude?('TLV') || name.include?('PACKET') }.group_by { |name| eval(name) }.select { |id, names| names.length > 1 }
=> 
{0=>
  ["Rex::Post::Meterpreter::PACKET_TYPE_REQUEST",
   "Rex::Post::Meterpreter::TLV_META_TYPE_NONE",
   "Rex::Post::Meterpreter::TLV_RESERVED",
   "Rex::Post::Meterpreter::TLV_TYPE_ANY",
   "Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_EXTENSION_SNIFFER",
   "Rex::Post::Meterpreter::Extensions::Extapi::TLV_TYPE_EXTENSION_EXTAPI"],
 151075=>
  ["Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_SNIFFER_INTERFACE_HANDLE",
   "Rex::Post::Meterpreter::Extensions::Lanattacks::TLV_TYPE_LANATTACKS_UINT",
   "Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_WEBCAM_QUALITY"],
 1073761825=>["Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_SNIFFER_INTERFACES", "Rex::Post::Meterpreter::Extensions::Extapi::TLV_TYPE_EXT_WINDOW_ENUM_GROUP"],
 151074=>
  ["Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_SNIFFER_INTERFACE_ID",
   "Rex::Post::Meterpreter::Extensions::Extapi::TLV_TYPE_EXT_WINDOW_ENUM_PID",
   "Rex::Post::Meterpreter::Extensions::Peinjector::TLV_TYPE_PEINJECTOR_SHELLCODE_SIZE",
   "Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_WEBCAM_INTERFACE_ID"],
 151076=>
  ["Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_SNIFFER_PACKET_COUNT",
   "Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_CODE_LEN",
   "Rex::Post::Meterpreter::Extensions::Powershell::TLV_TYPE_POWERSHELL_ASSEMBLY_SIZE",
   "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_LIST_TOKENS_ORDER"],
 85546=>["Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_SNIFFER_ADDITIONAL_FILTER", "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_GROUPNAME"],
 151077=>["Rex::Post::Meterpreter::Extensions::Sniffer::TLV_TYPE_SNIFFER_BYTE_COUNT", "Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_CODE_TYPE"],
 85540=>
  ["Rex::Post::Meterpreter::Extensions::Extapi::TLV_TYPE_EXT_WINDOW_ENUM_TITLE",
   "Rex::Post::Meterpreter::Extensions::Peinjector::TLV_TYPE_PEINJECTOR_TARGET_EXECUTABLE",
   "Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_WEBCAM_NAME"],
 85542=>
  ["Rex::Post::Meterpreter::Extensions::Extapi::TLV_TYPE_EXT_WINDOW_ENUM_CLASSNAME",
   "Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_NAME",
   "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_GENERIC_RESPONSE"],
 85537=>
  ["Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_STDOUT",
   "Rex::Post::Meterpreter::Extensions::Powershell::TLV_TYPE_POWERSHELL_SESSIONID",
   "Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_SAM_HASHES"],
 85538=>
  ["Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_STDERR",
   "Rex::Post::Meterpreter::Extensions::Powershell::TLV_TYPE_POWERSHELL_CODE",
   "Rex::Post::Meterpreter::Extensions::Lanattacks::TLV_TYPE_LANATTACKS_OPTION_NAME",
   "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_LIST_TOKENS_DELEGATION"],
 85543=>["Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_RESULT_VAR", "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_USERNAME"],
 85544=>["Rex::Post::Meterpreter::Extensions::Python::TLV_TYPE_PYTHON_RESULT", "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_PASSWORD"],
 151073=>["Rex::Post::Meterpreter::Extensions::Unhook::TLV_TYPE_UNHOOK_ERROR_CODE", "Rex::Post::Meterpreter::Extensions::Winpmem::TLV_TYPE_WINPMEM_ERROR_CODE"],
 85539=>["Rex::Post::Meterpreter::Extensions::Powershell::TLV_TYPE_POWERSHELL_RESULT", "Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_LIST_TOKENS_IMPERSONATION"],
 282145=>
  ["Rex::Post::Meterpreter::Extensions::Lanattacks::TLV_TYPE_LANATTACKS_OPTION",
   "Rex::Post::Meterpreter::Extensions::Peinjector::TLV_TYPE_PEINJECTOR_SHELLCODE",
   "Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_WEBCAM_IMAGE"],
 85541=>["Rex::Post::Meterpreter::Extensions::Incognito::TLV_TYPE_INCOGNITO_IMPERSONATE_TOKEN", "Rex::Post::Meterpreter::Extensions::Peinjector::TLV_TYPE_PEINJECTOR_RESULT"],
 1073770846=>["Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_WLAN_GROUP", "Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_COLLECT_RESULT_WIFI"],
 94560=>["Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_WLAN_SSID", "Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_COLLECT_RESULT_WIFI_SSID"],
 94559=>["Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_WLAN_BSSID", "Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_COLLECT_RESULT_WIFI_BSSID"],
 160097=>["Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_WLAN_LEVEL", "Rex::Post::Meterpreter::Extensions::Android::TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL"],
 1049576=>["Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_HKEY", "Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_ROOT_KEY"]}

@sjanusz-r7 sjanusz-r7 force-pushed the convert-unknown-tlv-types-to-readable-strings branch from 283041c to 9b2b13e Compare March 3, 2022 14:19
@adfoster-r7 adfoster-r7 mentioned this pull request Mar 3, 2022
Open
adfoster-r7
adfoster-r7 reviewed Mar 4, 2022
View reviewed changes
lib/rex/post/meterpreter/command_mapper.rb Outdated
@@ -97,6 +98,30 @@ def self.get_commands(*extensions)
commands
end

def self.create_tlv_types_cache
Copy link
Contributor

@adfoster-r7 adfoster-r7 Mar 4, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since, for now, this can return an array

Suggested change
def self.create_tlv_types_cache
def self.get_tlv_names(value)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It'd be great to sprinkle some yard doc metadata here, specifically the @param and @return metadata with a link to #16267 explaining why it can return an array

Context: https://github.com/lsegal/yard

@sjanusz-r7 sjanusz-r7 force-pushed the convert-unknown-tlv-types-to-readable-strings branch from 9b2b13e to 38b8f2c Compare March 4, 2022 13:50
@sjanusz-r7 sjanusz-r7 force-pushed the convert-unknown-tlv-types-to-readable-strings branch 2 times, most recently from 586782c to 373ba0c Compare March 4, 2022 15:35
@sjanusz-r7 sjanusz-r7 force-pushed the convert-unknown-tlv-types-to-readable-strings branch from 373ba0c to 2df72c8 Compare March 4, 2022 15:48
@sjanusz-r7 sjanusz-r7 force-pushed the convert-unknown-tlv-types-to-readable-strings branch from 2df72c8 to ae704eb Compare March 4, 2022 16:20
@adfoster-r7 adfoster-r7 merged commit e9393e4 into rapid7:master Mar 4, 2022
@adfoster-r7 adfoster-r7 added the rn-enhancement release notes enhancement label Mar 4, 2022
@adfoster-r7
Copy link
Contributor

For future travellers, cross-referencing the PR that allow configurable tlv logging via setg #16135

@adfoster-r7
Copy link
Contributor

adfoster-r7 commented Mar 4, 2022 •
edited by jmartin-tech
Loading

Release Notes

This improves Meterpreter's TLV logging support to show human readable names for the Meterpreter TLV values. To view this functionality run setg SessionTlvLogging true with a Meterpreter session open. Next run a Meterpreter command such as dir.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@adfoster-r7 adfoster-r7 adfoster-r7 left review comments

Assignees
No one assigned
Labels
enhancement library rn-enhancement release notes enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sjanusz-r7 @jmartin-tech @adfoster-r7