rolled changes into existing ps command

Some users requested this be added to the ps
command via a -S opt instead of creating a new command.
This limits the search to only one search parameter at a time
but with the ability to pass RegEx I think that's fine
unstable
David Maloney 2012-09-19 08:28:36 -05:00
parent 4dbe7767ca
commit 14c94e4f03
1 changed files with 30 additions and 36 deletions

View File

@ -45,6 +45,10 @@ class Console::CommandDispatcher::Stdapi::Sys
"-r" => [ true, "The remote machine name to connect to (with current process credentials" ], "-r" => [ true, "The remote machine name to connect to (with current process credentials" ],
"-w" => [ false, "Set KEY_WOW64 flag, valid values [32|64]." ]) "-w" => [ false, "Set KEY_WOW64 flag, valid values [32|64]." ])
@@ps_opts = Rex::Parser::Arguments.new(
"-h" => [false, "Help menu."],
"-S" => [true, "RegEx term(s) to filter results with "])
# #
# List of supported commands. # List of supported commands.
# #
@ -58,7 +62,6 @@ class Console::CommandDispatcher::Stdapi::Sys
"getuid" => "Get the user that the server is running as", "getuid" => "Get the user that the server is running as",
"kill" => "Terminate a process", "kill" => "Terminate a process",
"ps" => "List running processes", "ps" => "List running processes",
"findpids" => "Find Processes by name",
"reboot" => "Reboots the remote computer", "reboot" => "Reboots the remote computer",
"reg" => "Modify and interact with the remote registry", "reg" => "Modify and interact with the remote registry",
"rev2self" => "Calls RevertToSelf() on the remote machine", "rev2self" => "Calls RevertToSelf() on the remote machine",
@ -76,7 +79,6 @@ class Console::CommandDispatcher::Stdapi::Sys
"getuid" => [ "stdapi_sys_config_getuid" ], "getuid" => [ "stdapi_sys_config_getuid" ],
"kill" => [ "stdapi_sys_process_kill" ], "kill" => [ "stdapi_sys_process_kill" ],
"ps" => [ "stdapi_sys_process_get_processes" ], "ps" => [ "stdapi_sys_process_get_processes" ],
"findpids" => [ "stdapi_sys_process_get_processes" ],
"reboot" => [ "stdapi_sys_power_exitwindows" ], "reboot" => [ "stdapi_sys_power_exitwindows" ],
"reg" => [ "reg" => [
"stdapi_registry_load_key", "stdapi_registry_load_key",
@ -276,6 +278,24 @@ class Console::CommandDispatcher::Stdapi::Sys
# #
def cmd_ps(*args) def cmd_ps(*args)
processes = client.sys.process.get_processes processes = client.sys.process.get_processes
@@ps_opts.parse(args) do |opt, idx, val|
case opt
when "-h"
cmd_ps_help
return true
when "-S"
print_line "Performing Search..."
searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new
processes.each do |proc|
if val.nil? or val.empty?
print_line "You must supply a search term!"
return false
end
searched_procs << proc if proc["name"].match(/#{val}/)
end
processes = searched_procs
end
end
if (processes.length == 0) if (processes.length == 0)
print_line("No running processes were found.") print_line("No running processes were found.")
else else
@ -286,40 +306,14 @@ class Console::CommandDispatcher::Stdapi::Sys
return true return true
end end
def cmd_findpids(*args) def cmd_ps_help
if args.empty? or args.include? "-h" print_line "Use the command with no arguments to see all running processes."
cmd_findpids_help print_line "You may supply a search term to filter the results:"
return true print_line "\t ps -S explorer.exe"
end print_line "\t Would return any processes named explorer.exe"
processes = client.sys.process.get_processes print_line "You may also pass Regular Expressions:"
if (processes.length == 0) print_line "\tps -S *.svc.* "
print_line("No running processes were found.") print_line "Would return any processes with 'svc' in the name"
else
searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new
processes.each do |proc|
args.each do |arg|
if proc["name"].match(/#{arg}/)
searched_procs << proc
break
end
end
end
searched_procs.compact!
if searched_procs.length == 0
print_line("No running processes were found matching the supplied names.")
else
print_line
print_line(searched_procs.to_table("Indent" => 1).to_s)
print_line
end
end
return true
end
def cmd_findpids_help
print_line "You must supply one or more process name to search for"
print_line "e.g. findpids explorer.exe notepad.exe"
print_line "You may also pass Regular Expressions: findpids *.svc.* *.dll.*"
end end
# #