diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb index 31cc02e7ff..9381e068cd 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb @@ -224,13 +224,15 @@ class Process < Rex::Post::Process response.each(TLV_TYPE_PROCESS_GROUP) { |p| arch = "" - pa = p.get_tlv_value( TLV_TYPE_PROCESS_ARCH ) - if( pa != nil ) + pa = p.get_tlv_value(TLV_TYPE_PROCESS_ARCH) + if !pa.nil? if pa == 1 # PROCESS_ARCH_X86 arch = ARCH_X86 elsif pa == 2 # PROCESS_ARCH_X64 arch = ARCH_X86_64 end + else + arch = p.get_tlv_value(TLV_TYPE_PROCESS_ARCH_NAME) end processes << diff --git a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb index a3a147ae49..2207e7ae5e 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb @@ -156,6 +156,7 @@ TLV_TYPE_PROCESS_ARGUMENTS = TLV_META_TYPE_STRING | 2305 TLV_TYPE_PROCESS_ARCH = TLV_META_TYPE_UINT | 2306 TLV_TYPE_PARENT_PID = TLV_META_TYPE_UINT | 2307 TLV_TYPE_PROCESS_SESSION = TLV_META_TYPE_UINT | 2308 +TLV_TYPE_PROCESS_ARCH_NAME = TLV_META_TYPE_STRING | 2309 TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400 TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401 diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb index 3e1668e6c7..59193f4579 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb @@ -63,11 +63,11 @@ class Console::CommandDispatcher::Stdapi::Sys # Options for the 'ps' command. # @@ps_opts = Rex::Parser::Arguments.new( - "-S" => [ true, "String to search for (converts to regex)" ], - "-h" => [ false, "Help menu." ], - "-A" => [ true, "Filters processes on architecture (x86 or x86_64)" ], - "-s" => [ false, "Show only SYSTEM processes" ], - "-U" => [ true, "Filters processes on the user using the supplied RegEx" ]) + "-S" => [ true, "String to search for (converts to regex)" ], + "-h" => [ false, "Help menu." ], + "-A" => [ true, "Filters processes on architecture" ], + "-s" => [ false, "Show only SYSTEM processes" ], + "-U" => [ true, "Filters processes on the user using the supplied RegEx"]) # # Options for the 'suspend' command. @@ -445,8 +445,7 @@ class Console::CommandDispatcher::Stdapi::Sys searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new processes.each do |proc| next if proc['arch'].nil? or proc['arch'].empty? - if val.nil? or val.empty? or !(val == "x86" or val == "x86_64") - print_line "You must select either x86 or x86_64" + if val.nil? or val.empty? return false end searched_procs << proc if proc["arch"] == val