metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb

#!/usr/bin/env ruby
# -*- coding: binary -*-

require 'rex/post/process'
require 'rex/post/meterpreter/packet'
require 'rex/post/meterpreter/client'
require 'rex/post/meterpreter/extensions/stdapi/constants'
require 'rex/post/meterpreter/extensions/stdapi/stdapi'
require 'rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key'
require 'rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_value'
require 'rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key'

module Rex
module Post
module Meterpreter
module Extensions
module Stdapi
module Sys

###
#
# This class provides access to the Windows registry on the remote
# machine.
#
###
class Registry

	class << self
		attr_accessor :client
	end

	##
	#
	# Registry key interaction
	#
	##

	#
	# Opens the supplied registry key relative to the root key with
	# the supplied permissions.  Right now this is merely a wrapper around
	# create_key.
	#

	def Registry.load_key(root_key,base_key,hive_file)
		request = Packet.create_request('stdapi_registry_load_key')
		request.add_tlv(TLV_TYPE_ROOT_KEY, root_key)
		request.add_tlv(TLV_TYPE_BASE_KEY, base_key)
		request.add_tlv(TLV_TYPE_FILE_PATH, client.unicode_filter_decode( hive_file ))

		response = client.send_request(request)
		return response.get_tlv(TLV_TYPE_RESULT).value
	end

	def Registry.unload_key(root_key,base_key)
		request = Packet.create_request('stdapi_registry_unload_key')
		request.add_tlv(TLV_TYPE_ROOT_KEY, root_key)
		request.add_tlv(TLV_TYPE_BASE_KEY, base_key)
		response = client.send_request(request)
		return response.get_tlv(TLV_TYPE_RESULT).value
	end


	def Registry.open_key(root_key, base_key, perm = KEY_READ)
		# If no base key was provided, just return the root_key.
		if (base_key == nil or base_key.length == 0)
			return RegistrySubsystem::RegistryKey.new(client, root_key, base_key, perm, root_key)
		end

		request = Packet.create_request('stdapi_registry_open_key')

		request.add_tlv(TLV_TYPE_ROOT_KEY, root_key)
		request.add_tlv(TLV_TYPE_BASE_KEY, base_key)
		request.add_tlv(TLV_TYPE_PERMISSION, perm)

		response = client.send_request(request)

		return Rex::Post::Meterpreter::Extensions::Stdapi::Sys::RegistrySubsystem::RegistryKey.new(
				client, root_key, base_key, perm, response.get_tlv(TLV_TYPE_HKEY).value)
	end

	#
	# Opens the supplied registry key on the specified remote host. Requires that the
	# current process has credentials to access the target and that the target has the
	# remote registry service running.
	#
	def Registry.open_remote_key(target_host, root_key)

		request = Packet.create_request('stdapi_registry_open_remote_key')

		request.add_tlv(TLV_TYPE_TARGET_HOST, target_host)
		request.add_tlv(TLV_TYPE_ROOT_KEY, root_key)


		response = client.send_request(request)

		return Rex::Post::Meterpreter::Extensions::Stdapi::Sys::RegistrySubsystem::RemoteRegistryKey.new(
				client, target_host, root_key, response.get_tlv(TLV_TYPE_HKEY).value)
	end

	#
	# Creates the supplied registry key or opens it if it already exists.
	#
	def Registry.create_key(root_key, base_key, perm = KEY_READ)
		request = Packet.create_request('stdapi_registry_create_key')

		request.add_tlv(TLV_TYPE_ROOT_KEY, root_key)
		request.add_tlv(TLV_TYPE_BASE_KEY, base_key)
		request.add_tlv(TLV_TYPE_PERMISSION, perm)

		response = client.send_request(request)

		return Rex::Post::Meterpreter::Extensions::Stdapi::Sys::RegistrySubsystem::RegistryKey.new(
				client, root_key, base_key, perm, response.get_tlv(TLV_TYPE_HKEY).value)
	end

	#
	# Deletes the supplied registry key.
	#
	def Registry.delete_key(root_key, base_key, recursive = true)
		request = Packet.create_request('stdapi_registry_delete_key')
		flags   = 0

		if (recursive)
			flags |= DELETE_KEY_FLAG_RECURSIVE
		end

		request.add_tlv(TLV_TYPE_ROOT_KEY, root_key)
		request.add_tlv(TLV_TYPE_BASE_KEY, base_key)
		request.add_tlv(TLV_TYPE_FLAGS, flags)

		if (client.send_request(request) != nil)
			return true
		end

		return false
	end

	#
	# Closes the supplied registry key.
	#
	def Registry.close_key(hkey)
		request = Packet.create_request('stdapi_registry_close_key')

		request.add_tlv(TLV_TYPE_HKEY, hkey)

		client.send_packet(request)

		return true
	end

	#
	# Enumerates the supplied registry key returning an array of key names.
	#
	def Registry.enum_key(hkey)
		keys    = []
		request = Packet.create_request('stdapi_registry_enum_key')

		request.add_tlv(TLV_TYPE_HKEY, hkey)

		response = client.send_request(request)

		# Enumerate through all of the registry keys
		response.each(TLV_TYPE_KEY_NAME) { |key_name|
			keys << key_name.value
		}

		return keys
	end

	##
	#
	# Registry value interaction
	#
	##

	#
	# Sets the registry value relative to the supplied hkey.
	#
	def Registry.set_value(hkey, name, type, data)
		request = Packet.create_request('stdapi_registry_set_value')

		request.add_tlv(TLV_TYPE_HKEY, hkey)
		request.add_tlv(TLV_TYPE_VALUE_NAME, name)
		request.add_tlv(TLV_TYPE_VALUE_TYPE, type)

		if (type == REG_SZ)
			data += "\x00"
		elsif (type == REG_DWORD)
			data = [ data.to_i ].pack("V")
		end

		request.add_tlv(TLV_TYPE_VALUE_DATA, data)

		response = client.send_request(request)

		return true
	end

	#
	# Queries the registry value supplied in name and returns an
	# initialized RegistryValue instance if a match is found.
	#
	def Registry.query_value(hkey, name)
		request = Packet.create_request('stdapi_registry_query_value')

		request.add_tlv(TLV_TYPE_HKEY, hkey)
		request.add_tlv(TLV_TYPE_VALUE_NAME, name)

		response = client.send_request(request)

		data = response.get_tlv(TLV_TYPE_VALUE_DATA).value;
		type = response.get_tlv(TLV_TYPE_VALUE_TYPE).value;

		if (type == REG_SZ)
			data = data[0..-2]
		elsif (type == REG_DWORD)
			data = data.unpack("N")[0]
		end

		return Rex::Post::Meterpreter::Extensions::Stdapi::Sys::RegistrySubsystem::RegistryValue.new(
				client, hkey, name, type, data)
	end

	#
	# Deletes the registry value supplied in name from the supplied
	# registry key.
	#
	def Registry.delete_value(hkey, name)
		request = Packet.create_request('stdapi_registry_delete_value')

		request.add_tlv(TLV_TYPE_HKEY, hkey)
		request.add_tlv(TLV_TYPE_VALUE_NAME, name)

		if (client.send_request(request) != nil)
			return true
		end

		return false
	end

	#
	# Queries the registry class name and returns a string
	#
	def Registry.query_class(hkey)
		request = Packet.create_request('stdapi_registry_query_class')

		request.add_tlv(TLV_TYPE_HKEY, hkey)

		response = client.send_request(request)
		cls = response.get_tlv(TLV_TYPE_VALUE_DATA)
		return nil if not cls
		data = cls.value.gsub(/\x00.*/, '')
		return data
	end

	#
	# Enumerates all of the values at the supplied hkey including their
	# names.  An array of RegistryValue's is returned.
	#
	def Registry.enum_value(hkey)
		request = Packet.create_request('stdapi_registry_enum_value')
		values  = []

		request.add_tlv(TLV_TYPE_HKEY, hkey)

		response = client.send_request(request)

		response.each(TLV_TYPE_VALUE_NAME) { |value_name|
			values << Rex::Post::Meterpreter::Extensions::Stdapi::Sys::RegistrySubsystem::RegistryValue.new(
					client, hkey, value_name.value)
		}

		return values
	end

	#
	# Return the key value associated with the supplied string.  This is useful
	# for converting HKLM as a string into its actual integer representation.
	#
	def self.key2str(key)
		if (key == 'HKLM' or key == 'HKEY_LOCAL_MACHINE')
			return HKEY_LOCAL_MACHINE
		elsif (key == 'HKCU' or key == 'HKEY_CURRENT_USER')
			return HKEY_CURRENT_USER
		elsif (key == 'HKU' or key == 'HKEY_USERS')
			return HKEY_USERS
		elsif (key == 'HKCR' or key == 'HKEY_CLASSES_ROOT')
			return HKEY_CLASSES_ROOT
		elsif (key == 'HKEY_CURRENT_CONFIG')
			return HKEY_CURRENT_CONFIG
		elsif (key == 'HKEY_PERFORMANCE_DATA')
			return HKEY_PERFORMANCE_DATA
		elsif (key == 'HKEY_DYN_DATA')
			return HKEY_DYN_DATA
		else
			raise ArgumentError, "Unknown key: #{key}"
		end
	end

	#
	# Returns the integer value associated with the supplied registry value
	# type (like REG_SZ).
	#
	def self.type2str(type)
		return REG_SZ if (type == 'REG_SZ')
		return REG_DWORD if (type == 'REG_DWORD')
		return REG_BINARY if (type == 'REG_BINARY')
		return REG_EXPAND_SZ if (type == 'REG_EXPAND_SZ')
		return REG_NONE if (type == 'REG_NONE')
		return nil
	end

	#
	# Split the supplied full registry key into its root key and base key.  For
	# instance, passing HKLM\Software\Dog will return [ HKEY_LOCAL_MACHINE,
	# 'Software\Dog' ]
	#
	def self.splitkey(str)
		if (str =~ /^(.+?)\\(.*)$/)
			[ key2str($1), $2 ]
		else
			[ key2str(str), nil ]
		end
	end

end

end; end; end; end; end; end