diff --git a/data/meterpreter/ext_server_espia.dll b/data/meterpreter/ext_server_espia.dll index 3a17a9ff96..f9cb6ce283 100644 Binary files a/data/meterpreter/ext_server_espia.dll and b/data/meterpreter/ext_server_espia.dll differ diff --git a/data/meterpreter/ext_server_espia.x64.dll b/data/meterpreter/ext_server_espia.x64.dll index d26f02fa96..21a076dae8 100644 Binary files a/data/meterpreter/ext_server_espia.x64.dll and b/data/meterpreter/ext_server_espia.x64.dll differ diff --git a/data/meterpreter/ext_server_incognito.dll b/data/meterpreter/ext_server_incognito.dll index f3bdce59fc..7642e32333 100755 Binary files a/data/meterpreter/ext_server_incognito.dll and b/data/meterpreter/ext_server_incognito.dll differ diff --git a/data/meterpreter/ext_server_incognito.x64.dll b/data/meterpreter/ext_server_incognito.x64.dll index 78815c469a..40cab47656 100644 Binary files a/data/meterpreter/ext_server_incognito.x64.dll and b/data/meterpreter/ext_server_incognito.x64.dll differ diff --git a/data/meterpreter/ext_server_priv.dll b/data/meterpreter/ext_server_priv.dll index 1d1b0ffb64..19265ccaa4 100755 Binary files a/data/meterpreter/ext_server_priv.dll and b/data/meterpreter/ext_server_priv.dll differ diff --git a/data/meterpreter/ext_server_priv.x64.dll b/data/meterpreter/ext_server_priv.x64.dll index d74e97e8d3..b3c7d5e33d 100644 Binary files a/data/meterpreter/ext_server_priv.x64.dll and b/data/meterpreter/ext_server_priv.x64.dll differ diff --git a/data/meterpreter/ext_server_sniffer.dll b/data/meterpreter/ext_server_sniffer.dll index b29ca0a5c1..72790e5d9d 100644 Binary files a/data/meterpreter/ext_server_sniffer.dll and b/data/meterpreter/ext_server_sniffer.dll differ diff --git a/data/meterpreter/ext_server_stdapi.dll b/data/meterpreter/ext_server_stdapi.dll index d3bfb95ec3..4bb08711da 100755 Binary files a/data/meterpreter/ext_server_stdapi.dll and b/data/meterpreter/ext_server_stdapi.dll differ diff --git a/data/meterpreter/ext_server_stdapi.x64.dll b/data/meterpreter/ext_server_stdapi.x64.dll index cae7608e01..89bd9d3888 100644 Binary files a/data/meterpreter/ext_server_stdapi.x64.dll and b/data/meterpreter/ext_server_stdapi.x64.dll differ diff --git a/data/meterpreter/metsrv.dll b/data/meterpreter/metsrv.dll index f046b623b5..9dd49cfb6a 100755 Binary files a/data/meterpreter/metsrv.dll and b/data/meterpreter/metsrv.dll differ diff --git a/data/meterpreter/metsrv.x64.dll b/data/meterpreter/metsrv.x64.dll index 851de265bc..e1bb1a099a 100644 Binary files a/data/meterpreter/metsrv.x64.dll and b/data/meterpreter/metsrv.x64.dll differ diff --git a/external/source/meterpreter/source/extensions/stdapi/server/sys/process/process.c b/external/source/meterpreter/source/extensions/stdapi/server/sys/process/process.c index b9c41afd63..1221ebff12 100644 --- a/external/source/meterpreter/source/extensions/stdapi/server/sys/process/process.c +++ b/external/source/meterpreter/source/extensions/stdapi/server/sys/process/process.c @@ -371,7 +371,7 @@ DWORD request_sys_process_get_processes(Remote *remote, Packet *packet) DWORD pids[512], numProcesses, index, needed; DWORD res = ERROR_SUCCESS; HANDLE psapi = NULL; - Tlv entries[3]; + Tlv entries[4]; do { @@ -415,12 +415,20 @@ DWORD request_sys_process_get_processes(Remote *remote, Packet *packet) index++) { CHAR path[1024], name[256]; + CHAR username[512], username_only[512], domainname_only[512]; DWORD pidNbo; HMODULE mod; HANDLE p; + LPVOID TokenUserInfo[4096]; + HANDLE token; + DWORD user_length = sizeof(username_only), domain_length = sizeof(domainname_only); + DWORD size = sizeof(username), sid_type = 0, returned_tokinfo_length; memset(name, 0, sizeof(name)); memset(path, 0, sizeof(path)); + memset(username, 0, sizeof(username)); + memset(username_only, 0, sizeof(username_only)); + memset(domainname_only, 0, sizeof(domainname_only)); // Try to attach to the process for querying information if (!(p = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, @@ -436,10 +444,21 @@ DWORD request_sys_process_get_processes(Remote *remote, Packet *packet) continue; } + // Convert the pid to network byte order + pidNbo = htonl(pids[index]); + // Try to get the process' file name getModuleFileNameEx(p, mod, path, sizeof(path) - 1); - pidNbo = htonl(pids[index]); + // Try to get the process' user name + if (OpenProcessToken(p, TOKEN_QUERY, &token)) { + if (GetTokenInformation(token, TokenUser, TokenUserInfo, 4096, &returned_tokinfo_length)) { + if(LookupAccountSidA(NULL, ((TOKEN_USER*)TokenUserInfo)->User.Sid, username_only, &user_length, domainname_only, &domain_length, (PSID_NAME_USE)&sid_type)) { + _snprintf(username, 512, "%s\\%s", domainname_only, username_only); + username[511] = '\0'; + } + } + } // Initialize the TLV entries entries[0].header.type = TLV_TYPE_PID; @@ -451,10 +470,12 @@ DWORD request_sys_process_get_processes(Remote *remote, Packet *packet) entries[2].header.type = TLV_TYPE_PROCESS_PATH; entries[2].header.length = strlen(path) + 1; entries[2].buffer = path; + entries[3].header.type = TLV_TYPE_USER_NAME; + entries[3].header.length = strlen(username) + 1; + entries[3].buffer = username; // Add the packet group entry for this item - packet_add_tlv_group(response, TLV_TYPE_PROCESS_GROUP, - entries, 3); + packet_add_tlv_group(response, TLV_TYPE_PROCESS_GROUP, entries, 4); CloseHandle(p); } diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb index ac47b6b5f1..3a0afa17c3 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb @@ -221,6 +221,7 @@ class Process < Rex::Post::Process 'pid' => p.get_tlv_value(TLV_TYPE_PID), 'name' => p.get_tlv_value(TLV_TYPE_PROCESS_NAME), 'path' => p.get_tlv_value(TLV_TYPE_PROCESS_PATH), + 'user' => p.get_tlv_value(TLV_TYPE_USER_NAME) } } diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb index 27939c042c..9f2033e850 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb @@ -211,10 +211,11 @@ class Console::CommandDispatcher::Stdapi::Sys "PID", "Name", "Path", + "User" ]) processes.each { |ent| - tbl << [ ent['pid'].to_s, ent['name'], ent['path'] ] + tbl << [ ent['pid'].to_s, ent['name'], ent['path'], ent['user'] ] } if (processes.length == 0)