Closes#17124
This fixes a Ruby 3 syntax issue in how the parameters are passed. The
issue caused TcpServerChannels to fail to enqueue new client
connections.
The address is returned in the packed format so it's always a string of
either length 0 (resolution failed), length 4 (IPv4) or length 16
(IPv6).
Anything else is invalid and will actually cause Rex::Socket.addr_ntoa
to throw an error. All meterpreters today return the IP address in one
of those three correct lengths.
This first bit of code aims to add a "map" to the packet functionality
that is able to translate to and from "method strings" to "command ids".
IDs are sent across the wire, and they're now integers. This removes the
need for the strings to be present in things like native meterp, and
hence makes things a little less obvious on the wire, and way less
obvious on disk/in the payload.
Given that we need this functionality in other Meterpreters to support
the removal of strings, some code has been added that can generate
source files for Python, C# and C. This code might move, but for now
it's at least in a spot where it's used the most.
This first bit of code aims to add a "map" to the packet functionality
that is able to translate to and from "method strings" to "command ids".
IDs are sent across the wire, and they're now integers. This removes the
need for the strings to be present in things like native meterp, and
hence makes things a little less obvious on the wire, and way less
obvious on disk/in the payload.
Given that we need this functionality in other Meterpreters to support
the removal of strings, some code has been added that can generate
source files for Python, C# and C. This code might move, but for now
it's at least in a spot where it's used the most.
Don't send a close message for a nil channel ID, and if we do send a close
message, only do it once. I could have added a mutex somewher in _close(), but
because it's a class method, it's a little awkward and would require all of the
callers to instead have voluntary lock. As an alternative, I just made the
finalizer close the channel instead.
Fixes#10177
This includes changes to the portfwd command so that the output is
nicer, things are easier to use, and users have the ability to create
reverse port forwards.
In current nomenclature, Rex Sockets are objects created by calls
to Rex::Socket::<Transport>.create and Rex::Socket.create_...
When the LocalHost or Comm parameters are set to remotely routed
addresses (currently via Meterpreter sessions), Rex will create a
Channel which will abstract communications with the remote end of
the session. These channel based abstractions are called pivots,
and present in three separate flavors:
1 - TcpClientChannel, a fully abstracted, selectable Socket.
2 - TcpServerChannel, a virtual Channel which distributes client
channels.
3 - UdpChannel, a virtual Channel which provides common methods for
UDP socket operations, but is not a full (selectable) abstraction.
Unfortunately this differentiation results in inconsistent returns
from the aforementioned socket creation calls, as the call chain
creates parameters and supplies them to the create method on the
comm object referenced in the params. The comm object may be a
channel, and produce a virtual representation of a socket with
functional methods analogous to Sockets, but without a kernel FD.
This commit begins the work of ensuring that all calls for socket
creation return selectable Rex::Socket objects with semantics
familiar to Ruby developers who have not read into the details of
Rex::Socket and Rex::Post.
-----
Summary of changes:
Convert Rex::IO::StreamAbstraction to SocketAbstraction and use
the new mixin in StreamAbstraction and DatagramAbstraction. This
approach allows for common methods to reuse the abstraction data
flow, while initializing separate types of socket obects and an
optional monitor as needed.
In the Rex::Post::Meterpreter namespace, extract common methods
from Stream to a SocketAbstraction mixin, include that mixin in
Stream, and add Datagram with the dio_write handler override
exported from the current implementation of UdpChannel, also using
the mixin. This relies on the Rex::IO work above to implement the
proper type of socket abstraction to the Channel descendants.
In Rex::Post::Meterpreter::Extensions::Stdapi::Net, convert the
UdpChannel to inherit from the Rex::Post::Meterpreter::Datagram
class, implementing only the send method at this tier. Convert
create_udp_channel to return the local socket side of the datagram
abstraction presented analogous to the TcpClientChannel approach
used before.
-----
Notes and intricacies:
In order to implement recvfrom on the UDP abstraction, a shim layer
has been put in place to forward the sockaddr information from the
remote peer to the local UDP socketpair in the abstraction. This
information takes up buffer space in the UDP socket, and in order
to maintain compatibility with consumers, the dio_write_handler
pushes the data buffer, and in a separate send call, he sockaddr
information from the remote socket. On the abstraction side, the
recvfrom_nonblock call of the real UDPSocket has been overriden
via the mixed in module to call the real method twice, once for
the data buffer, and once for the packed sockaddr data. The Rex
level consumer for recvfrom calls the underlying nonblock method
and expects this exact set of returns (as opposed to what standard
library UDPSocket.recvfrom returns, which is a data buffer and an
Array of sockaddr data).
-----
Testing:
Local and lab testing only so far.
Test RC script to be added in GH comments.
-----
Issues:
Currently, sendto on a remote socket does not appear to honor
LocalPort which causes DNS responses (#6611) to come from the
wrong port to remote clients being serviced over a pivot socket.
h00die