metasploit-gs/lib/msf/base/sessions/command_shell.rb

require 'msf/base'
require 'msf/base/sessions/scriptable'

module Msf
module Sessions

###
#
# This class provides basic interaction with a command shell on the remote
# endpoint.  This session is initialized with a stream that will be used
# as the pipe for reading and writing the command shell.
#
###
class CommandShell

	#
	# This interface supports basic interaction.
	#
	include Msf::Session::Basic

	#
	# This interface supports interacting with a single command shell.
	#
	include Msf::Session::Provider::SingleCommandShell

	include Msf::Session::Scriptable


	#
	# Executes the supplied script, must be specified as full path.
	#
	# Msf::Session::Scriptable implementor
	#
	def execute_file(full_path, args)
		o = Rex::Script::Shell.new(self, full_path)
		o.run(args)
	end

	#
	# Returns the type of session.
	#
	def self.type
		"shell"
	end

	def initialize(*args)
		self.platform ||= ""
		self.arch     ||= ""
		super
	end

	#
	# Returns the session description.
	#
	def desc
		"Command shell"
	end

	#
	# Explicitly runs a command.
	#
	def run_cmd(cmd)
		shell_command(cmd)
	end

	#
	# Calls the class method.
	#
	def type
		self.class.type
	end

	#
	# The shell will have been initialized by default.
	#
	def shell_init
		return true
	end

	#
	# Explicitly run a single command, return the output.
	#
	def shell_command(cmd)
		# Send the command to the session's stdin.
		shell_write(cmd + "\n")

		timeo = 5
		etime = ::Time.now.to_f + timeo
		buff = ""
		
		# Keep reading data until no more data is available or the timeout is 
		# reached. 
		while (::Time.now.to_f < etime and ::IO.select([rstream], nil, nil, timeo))
			res = shell_read(-1, 0.01)
			buff << res if res
			timeo = etime - ::Time.now.to_f
		end

		buff
	end

	#
	# Read from the command shell.
	#
	def shell_read(length=-1, timeout=1)
		begin
			rv = rstream.get_once(length, timeout)
			framework.events.on_session_output(self, rv) if rv
			return rv
		rescue ::Exception => e
			shell_close
			raise e
		end
	end

	#
	# Writes to the command shell.
	#
	def shell_write(buf)
		return if not buf

		begin
			framework.events.on_session_command(self, buf.strip)
			rstream.write(buf)
		rescue ::Exception => e
			shell_close
			raise e
		end
	end

	#
	# Closes the shell.
	#
	def shell_close()
		rstream.close rescue nil
		self.kill
	end

	#
	# Execute any specified auto-run scripts for this session
	#
	def process_autoruns(datastore)
		# Read the initial output and mash it into a single line
		if (not self.info or self.info.empty?)
			initial_output = shell_read(-1, 0.01)
			if (initial_output)
				initial_output.force_encoding("ASCII-8BIT") if initial_output.respond_to?(:force_encoding)
				initial_output.gsub!(/[\x00-\x08\x0b\x0c\x0e-\x19\x7f-\xff]+/n,"_")
				initial_output.gsub!(/[\r\n\t]+/, ' ')
				initial_output.strip!

				# Set the inital output to .info
				self.info = initial_output
			end
		end

		if (datastore['InitialAutoRunScript'] && datastore['InitialAutoRunScript'].empty? == false)
			args = datastore['InitialAutoRunScript'].split
			print_status("Session ID #{sid} (#{tunnel_to_s}) processing InitialAutoRunScript '#{datastore['InitialAutoRunScript']}'")
			execute_script(args.shift, *args)
		end

		if (datastore['AutoRunScript'] && datastore['AutoRunScript'].empty? == false)
			args = datastore['AutoRunScript'].split
			print_status("Session ID #{sid} (#{tunnel_to_s}) processing AutoRunScript '#{datastore['AutoRunScript']}'")
			execute_script(args.shift, *args)
		end
	end

	attr_accessor :arch
	attr_accessor :platform

protected

	# Override the basic session interaction to use shell_read and
	# shell_write instead of operating on rstream directly.
	def _interact
		framework.events.on_session_interact(self)

		fds = [rstream.fd, user_input.fd]
		while self.interacting
			sd = Rex::ThreadSafe.select(fds, nil, fds, 0.5)
			next if not sd

			if sd[0].include? rstream.fd
				user_output.print(shell_read)
			end
			if sd[0].include? user_input.fd
				shell_write(user_input.gets)
			end
		end
	end
end

class CommandShellWindows < CommandShell
	def initialize(*args)
		self.platform = "windows"
		super
	end
	def shell_command_token(cmd,timeout = 10)
		shell_command_token_win32(cmd,timeout)
	end
end

class CommandShellUnix < CommandShell
	def initialize(*args)
		self.platform = "unix"
		super
	end
	def shell_command_token(cmd,timeout = 10)
		shell_command_token_unix(cmd,timeout)
	end
end

end
end