##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Post

  include Msf::Post::Windows::Registry

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Windows Gather Hardware Enumeration',
      'Description'    => %q{
          Enumerate PCI hardware information from the registry. Please note this script
        will run through registry subkeys such as: 'PCI', 'ACPI', 'ACPI_HAL', 'FDC', 'HID',
        'HTREE', 'IDE', 'ISAPNP', 'LEGACY'', LPTENUM', 'PCIIDE', 'SCSI', 'STORAGE', 'SW',
        and 'USB'; it will take time to finish. It is recommended to run this module as a
        background job.
        },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'Brandon Perry <bperry.volatile[at]gmail.com>' ],
      'Platform'       => [ 'win' ],
      'SessionTypes'   => [ 'meterpreter' ]
    ))
  end

  def list
    tbl = Rex::Ui::Text::Table.new(
      'Header'  => "Device Information",
      'Indent'  => 1,
      'Columns' =>
      [
        "Device Description",
        "Driver Version",
        "Class",
        "Manufacturer",
        "Extra",
      ])

    keys = [
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\PCI\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\ACPI\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\ACPI_HAL\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\FDC\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\HID\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\HTREE\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\IDE\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\ISAPNP\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\LEGACY\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\LPTENUM\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\PCIIDE\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\Root\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\SCSI\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\STORAGE\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\SW\\",
      "HKLM\\SYSTEM\\ControlSet001\\Enum\\USB\\",
    ]

    keys.each do |key|
      devices = registry_enumkeys(key)

      t = []

      while(not devices.nil? and not devices.empty?)
        1.upto(3) do
          t << framework.threads.spawn("Module(#{self.refname})", false, devices.shift) do |device|
            next if device.nil?
            vprint_status("Enumerating #{device}")

            infos = registry_enumkeys(key + "\\" + device)
            next if infos.nil?

            infos.each do |info|
              next if info.nil?

              info_key = key + "\\" + device + "\\" + info

              desc         = registry_getvaldata(info_key, "DeviceDesc")
              mfg          = registry_getvaldata(info_key, "Mfg")
              device_class = registry_getvaldata(info_key, "Class")
              driver_guid  = registry_getvaldata(info_key, "Driver")
              extra        = ""

              if key =~ /USB/ or key =~ /LPTENUM/
                extra = registry_getvaldata(info_key, "LocationInformation")
              end

              if key =~ /SCSI/ or key =~ /\\IDE/ or key =~ /ACPI\\/
                extra = registry_getvaldata(info_key, "FriendlyName")
              end

              desc = desc.split(';')[1] if desc =~ /^@/
              mfg = mfg.split(';')[1] if mfg =~ /^@/

              desc         = '' if desc.nil?
              mfg          = '' if mfg.nil?
              device_class = '' if device_class.nil?
              driver_guid  = '' if driver_guid.nil?
              extra        = '' if extra.nil?

              next if desc.empty? and mfg.empty?

              driver_version = ""

              if not driver_guid.nil? or not driver_guid.empty?
                if driver_guid =~ /\\/
                  k = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Class\\" + driver_guid
                  d = registry_getvaldata(k, "DriverVersion")
                  driver_version << d if not d.nil?
                end
              end

              done = false

              tbl.rows.each do |row|
                if row[0] == desc and
                  row[1] == driver_version and
                  row[2] == device_class and
                  row[3] == mfg and
                  row[4] == extra
                  done = true
                  break
                end
              end

              tbl << [desc, driver_version, device_class, mfg, extra] if not done
            end
          end
          t.map {|x| x.join }
        end
      end
    end

    results = tbl.to_s
    vprint_line("\n" + results)

    path = store_loot("host.hardware", "text/plain", session, results, "hardware.txt", "Host Hardware")
    print_status("Results saved in: #{path}")
  end

  def run
    print_status("Enumerating hardware on #{sysinfo['Computer']}")
    begin
      list
    rescue ::Exception => e
      if e.to_s =~ /execution expired/i
        print_error("Sorry, execution expired. Module could not finish running.")
      else
        print_error("An unexpected error has occurred: #{e.to_s}:\n#{e.backtrace}")
      end
    end
  end
end