metasploit-framework/lib/msf/java/rmi/client.rb

# -*- coding: binary -*-
require 'rex/proto/rmi'
require 'rex/java/serialization'
require 'stringio'

module Msf
  module Rmi
    module Client

      require 'msf/rmi/client/streams'

      include Msf::Rmi::Client::Streams
      include Exploit::Remote::Tcp

      # Returns the target host
      #
      # @return [String]
      def rhost
        datastore['RHOST']
      end

      # Returns the target port
      #
      # @return [Fixnum]
      def rport
        datastore['RPORT']
      end

      # Returns the RMI server peer
      #
      # @return [String]
      def peer
        "#{rhost}:#{rport}"
      end

      # Sends a RMI header stream
      #
      # @param opts [Hash]
      # @option opts [Rex::Socket::Tcp] :sock
      # @return [Fixnum] the number of bytes sent
      # @see Msf::Rmi::Client::Streams#build_header
      def send_header(opts = {})
        nsock = opts[:sock] || sock
        stream = build_header(opts)
        nsock.put(stream.encode + "\x00\x00\x00\x00\x00\x00")
      end

      # Sends a RMI CALL stream
      #
      # @param opts [Hash]
      # @option opts [Rex::Socket::Tcp] :sock
      # @return [Fixnum] the number of bytes sent
      # @see Msf::Rmi::Client::Streams#build_call
      def send_call(opts = {})
        nsock = opts[:sock] || sock
        stream = build_call(opts)
        nsock.put(stream.encode)
      end

      # Sends a RMI DGCACK stream
      #
      # @param opts [Hash]
      # @option opts [Rex::Socket::Tcp] :sock
      # @return [Fixnum] the number of bytes sent
      # @see Msf::Rmi::Client::Streams#build_dgc_ack
      def send_dgc_ack(opts = {})
        nsock = opts[:sock] || sock
        stream = build_dgc_ack(opts)
        nsock.put(stream.encode)
      end

      # Reads the Protocol Ack
      #
      # @param opts [Hash]
      # @option opts [Rex::Socket::Tcp] :sock
      # @return [Rex::Proto::Rmi::Model::ProtocolAck]
      # @see Rex::Proto::Rmi::Model::ProtocolAck.decode
      def recv_protocol_ack(opts = {})
        nsock = opts[:sock] || sock
        data = safe_get_once(nsock)
        begin
          ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(StringIO.new(data))
        rescue ::RuntimeError
          return nil
        end

        ack
      end

      # Reads a ReturnData message and returns the java serialized stream
      # with the return data value.
      #
      # @param opts [Hash]
      # @option opts [Rex::Socket::Tcp] :sock
      # @return [Rex::Java::Serialization::Stream]
      # @see Rex::Proto::Rmi::Model::ReturnData.decode
      def recv_return(opts = {})
        nsock = opts[:sock] || sock
        data = safe_get_once(nsock)
        begin
          return_data = Rex::Proto::Rmi::Model::ReturnData.decode(StringIO.new(data))
        rescue ::RuntimeError
          return nil
        end

        return_data.return_value
      end

      # Helper method to read fragmented data from a ```Rex::Socket::Tcp```
      #
      # @param opts [Hash]
      # @option opts [Rex::Socket::Tcp] :sock
      # @return [String]
      def safe_get_once(nsock = sock)
        data = ''
        begin
          res = nsock.get_once
        rescue ::EOFError
          res = nil
        end

        until res.nil? || res.length < 1448
          data << res
          begin
            res = nsock.get_once
          rescue ::EOFError
            res = nil
          end
        end

        data << res if res
        data
      end
    end
  end
end