Test linux railgun

dupa.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/linux/system'
require 'msf/core/post/linux/priv'

class Metasploit3 < Msf::Post

	include Msf::Post::Common
	include Msf::Post::File
	include Msf::Post::Linux::System


	def initialize(info={})
		super( update_info( info,
				'Name'          => 'Blabla',
				'Description'   => %q{
					Test linux railgun
				},
				'License'       => MSF_LICENSE,
				'Author'        => ['mak'	],
				'Version'       => '$Revision$',
				'Platform'      => [ 'linux' ],
				'SessionTypes'  => [ 'meterpreter' ]
			))
          register_options([
                            OptString.new('MSG', [false, 'Message to write','It\'s alive!'])
                           ], self.class )


	end

        def fix_sign(x); [x].pack('i').unpack('i').first; end

        def make_test
          rg = client.railgun
          ret = rg.libc.open('/tmp/test1',1|0100 , 0644) # no consts so far
          if fix_sign(ret['return']) == -1
            print_error("open failed with errno: #{ret['GetLastError']}")
            return
          end
          fd = ret['return']

          msg = datastore['MSG'] + "\n\x00"
          ret = rg.libc.write(fd,msg,msg.size)
          if fix_sign(ret['return']) == -1
            print_error("write failed with errno: #{ret['GetLastError']}")
            return
          end
          rg.libc.close(fd)

          print_good('File Created ;]') if client.fs.file.exists?('/tmp/test1')
          ret = rg.libc.open('/tmp/test1',0 ,0) # no consts so far

          if fix_sign(ret['return']) == -1
            print_error("open failed with errno: #{ret['GetLastError']}")
            return
          end
          fd = ret['return']

          # ret =rg.libc.malloc(0x20)
          # if fix_sign(ret['return']) == -1
          #   print_error("malloc failed with errno: #{ret['GetLastError']}")
          #   return
          # end
          # buf = ret['return']
          # rg.libc.memset(buf,0x0,0x20)

          ret = rg.libc.read(fd,0x20,0x20)
          p ret
          if fix_sign(ret['return']) == -1
            print_error("read failed with errno: #{ret['GetLastError']}")
            returnx
          end
          rg.libc.close(fd)
#          print_good("String written: #{rg.memread(buf,0x20)}")

        end

        def make_test2
          rg = client.railgun
          ret = rg.libc.fopen('/tmp/test2','w') # no consts so far

          if fix_sign(ret['return']) == 0
            print_error("open failed with errno: #{ret['GetLastError']}")
            return
          end
          fd = ret['return']

          msg = datastore['MSG'] + "\n\x00"
          ret = rg.libc.fputs(msg,fd)

          if fix_sign(ret['return']) < 0
            print_error("write failed with errno: #{ret['GetLastError']}")
            return
          end
          rg.libc.fclose(fd)

          print_good('File Created ;]') if client.fs.file.exists?('/tmp/test2')
          ret = rg.libc.fopen('/tmp/test2',"r") # no consts so far

          if fix_sign(ret['return']) == 0
            print_error("open failed with errno: #{ret['GetLastError']}")
            return
          end
          fd = ret['return']

          # ret =rg.libc.malloc(0x20)
          # if fix_sign(ret['return']) < 0
          #   print_error("malloc failed with errno: #{ret['GetLastError']}")
          #   return
          # end
          # buf = ret['return']
          # rg.libc.memset(buf,0x0,0x20)

          ret = rg.libc.fgets(0x20,0x20,fd)
          p ret
          if fix_sign(ret['return']) < 0
            print_error("read failed with errno: #{ret['GetLastError']}")
            returnx
          end
          rg.libc.fclose(fd)
#          print_good("String written: #{rg.memread(buf,0x20)}")

        end

	def run
          if session.type != "meterpreter"
            print_error "Only meterpreter sessions are supported by this post module"
            return
          end
          rg = client.railgun

          begin
            rg.add_dll 'libc.so'
          rescue
          end

          ## memory operations
          rg.add_function('libc.so','malloc','LPVOID',[['DWORD','size','in']])
          rg.add_function('libc.so','memset','LPVOID',[['LPVOID','src','in'],['DWORD','c','in'],['DWORD','size','in']])

          ## unistd.h based file-op
          rg.add_function('libc.so','open','DWORD',[['PCHAR','path','in'],['DWORD','flags','in'],['DWORD','omode','in']])
          rg.add_function('libc.so','write','DWORD',[['DWORD','fd','in'],['PCHAR','buf','in'],['DWORD','size','in']])
          rg.add_function('libc.so','read','DWORD',[['DWORD','fd','in'],['PCHAR','buf','out'],['DWORD','size','in']])
          rg.add_function('libc.so','close','DWORD',[['DWORD','fd','in']])

          ## stdio.h based file-op
          rg.add_function('libc.so','fopen','LPVOID',[['PCHAR','path','in'],['PCHAR','mode','in']])
          rg.add_function('libc.so','fputs','DWORD',[['PCHAR','s','in'],['LPVOID','file','in']])
          rg.add_function('libc.so','fgets','LPVOID',[['PCHAR','s','out'],['DWORD','size','in'],['LPVOID','file','in']])
          rg.add_function('libc.so','fclose','DWORD',[['LPVOID','file','in']])

          make_test
          make_test2

          [1,2].each { |i| client.fs.file.rm("/tmp/test#{i}") }

	end
end