jenkins-metasploit
1335 lines
57 KiB
HTML
1335 lines
57 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>
|
|
Module: Msf::Exploit::Remote::WDBRPC
|
|
|
|
— Documentation by YARD 0.9.37
|
|
|
|
</title>
|
|
|
|
<link rel="stylesheet" href="../../../css/style.css" type="text/css" />
|
|
|
|
<link rel="stylesheet" href="../../../css/common.css" type="text/css" />
|
|
|
|
<script type="text/javascript">
|
|
pathId = "Msf::Exploit::Remote::WDBRPC";
|
|
relpath = '../../../';
|
|
</script>
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../js/jquery.js"></script>
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../js/app.js"></script>
|
|
|
|
|
|
</head>
|
|
<body>
|
|
<div class="nav_wrap">
|
|
<iframe id="nav" src="../../../class_list.html?1"></iframe>
|
|
<div id="resizer"></div>
|
|
</div>
|
|
|
|
<div id="main" tabindex="-1">
|
|
<div id="header">
|
|
<div id="menu">
|
|
|
|
<a href="../../../_index.html">Index (W)</a> »
|
|
<span class='title'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> » <span class='title'><span class='object_link'><a href="../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span>
|
|
»
|
|
<span class="title">WDBRPC</span>
|
|
|
|
</div>
|
|
|
|
<div id="search">
|
|
|
|
<a class="full_list_link" id="class_list_link"
|
|
href="../../../class_list.html">
|
|
|
|
<svg width="24" height="24">
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
</svg>
|
|
</a>
|
|
|
|
</div>
|
|
<div class="clear"></div>
|
|
</div>
|
|
|
|
<div id="content"><h1>Module: Msf::Exploit::Remote::WDBRPC
|
|
|
|
|
|
|
|
</h1>
|
|
<div class="box_info">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<dl>
|
|
<dt>Included in:</dt>
|
|
<dd><span class='object_link'><a href="WDBRPC_Client.html" title="Msf::Exploit::Remote::WDBRPC_Client (module)">WDBRPC_Client</a></span></dd>
|
|
</dl>
|
|
|
|
|
|
|
|
<dl>
|
|
<dt>Defined in:</dt>
|
|
<dd>lib/msf/core/exploit/remote/wdbrpc.rb</dd>
|
|
</dl>
|
|
|
|
</div>
|
|
|
|
<h2>Overview</h2><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>This module exposes methods for manipulating the WDRPC service</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h2>
|
|
Instance Method Summary
|
|
<small><a href="#" class="summary_toggle">collapse</a></small>
|
|
</h2>
|
|
|
|
<ul class="summary">
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_checksum-instance_method" title="#wdbrpc_checksum (instance method)">#<strong>wdbrpc_checksum</strong>(data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_decode_arr-instance_method" title="#wdbrpc_decode_arr (instance method)">#<strong>wdbrpc_decode_arr</strong>(data, dtype) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_decode_bool-instance_method" title="#wdbrpc_decode_bool (instance method)">#<strong>wdbrpc_decode_bool</strong>(data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_decode_int-instance_method" title="#wdbrpc_decode_int (instance method)">#<strong>wdbrpc_decode_int</strong>(data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_decode_str-instance_method" title="#wdbrpc_decode_str (instance method)">#<strong>wdbrpc_decode_str</strong>(data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_parse_connect_reply-instance_method" title="#wdbrpc_parse_connect_reply (instance method)">#<strong>wdbrpc_parse_connect_reply</strong>(buff) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request-instance_method" title="#wdbrpc_request (instance method)">#<strong>wdbrpc_request</strong>(procedure, data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_connect-instance_method" title="#wdbrpc_request_connect (instance method)">#<strong>wdbrpc_request_connect</strong>(ip) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'>
|
|
<p>WDB_TARGET_CONNECT.</p>
|
|
</div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_connect2-instance_method" title="#wdbrpc_request_connect2 (instance method)">#<strong>wdbrpc_request_connect2</strong>(ip) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'>
|
|
<p>WDB_TARGET_CONNECT2.</p>
|
|
</div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_context_kill-instance_method" title="#wdbrpc_request_context_kill (instance method)">#<strong>wdbrpc_request_context_kill</strong>(ctx_type, ctx) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_disconnect-instance_method" title="#wdbrpc_request_disconnect (instance method)">#<strong>wdbrpc_request_disconnect</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'>
|
|
<p>WDB_TARGET_DISCONNECT.</p>
|
|
</div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_memread-instance_method" title="#wdbrpc_request_memread (instance method)">#<strong>wdbrpc_request_memread</strong>(offset = 0, length = 512, params = 0) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_memscan-instance_method" title="#wdbrpc_request_memscan (instance method)">#<strong>wdbrpc_request_memscan</strong>(offset = 0, depth = 1024, buff = '', params = 0) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_memwrite-instance_method" title="#wdbrpc_request_memwrite (instance method)">#<strong>wdbrpc_request_memwrite</strong>(offset = 0, buff = '', params = 0) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_regread-instance_method" title="#wdbrpc_request_regread (instance method)">#<strong>wdbrpc_request_regread</strong>(regset = 0, offset = 0, length = 512, params = 0) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#wdbrpc_request_seqno-instance_method" title="#wdbrpc_request_seqno (instance method)">#<strong>wdbrpc_request_seqno</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
<div id="instance_method_details" class="method_details_list">
|
|
<h2>Instance Method Details</h2>
|
|
|
|
|
|
<div class="method_details first">
|
|
<h3 class="signature first" id="wdbrpc_checksum-instance_method">
|
|
|
|
#<strong>wdbrpc_checksum</strong>(data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
195
|
|
196
|
|
197
|
|
198
|
|
199
|
|
200</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 195</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_checksum'>wdbrpc_checksum</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_sum'>sum</span> <span class='op'>=</span> <span class='int'>0</span>
|
|
<span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>n*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='lbrace'>{</span><span class='op'>|</span><span class='id identifier rubyid_c'>c</span><span class='op'>|</span> <span class='id identifier rubyid_sum'>sum</span> <span class='op'>+=</span> <span class='id identifier rubyid_c'>c</span> <span class='rbrace'>}</span>
|
|
<span class='id identifier rubyid_sum'>sum</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='id identifier rubyid_sum'>sum</span> <span class='op'>&</span> <span class='int'>0xffff</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='lparen'>(</span><span class='id identifier rubyid_sum'>sum</span> <span class='op'>>></span> <span class='int'>16</span><span class='rparen'>)</span>
|
|
<span class='lparen'>(</span><span class='op'>~</span><span class='id identifier rubyid_sum'>sum</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_decode_arr-instance_method">
|
|
|
|
#<strong>wdbrpc_decode_arr</strong>(data, dtype) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
218
|
|
219
|
|
220
|
|
221
|
|
222
|
|
223
|
|
224
|
|
225
|
|
226
|
|
227
|
|
228
|
|
229
|
|
230
|
|
231
|
|
232
|
|
233
|
|
234
|
|
235
|
|
236
|
|
237</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 218</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_decode_arr'>wdbrpc_decode_arr</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='comma'>,</span> <span class='id identifier rubyid_dtype'>dtype</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='kw'>if</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>4</span>
|
|
<span class='id identifier rubyid_res'>res</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
|
|
|
|
<span class='id identifier rubyid_alen'>alen</span> <span class='op'>=</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_slice!'>slice!</span><span class='lparen'>(</span><span class='int'>0</span><span class='comma'>,</span><span class='int'>4</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_res'>res</span> <span class='kw'>if</span> <span class='id identifier rubyid_alen'>alen</span> <span class='op'>==</span> <span class='int'>0</span>
|
|
|
|
<span class='int'>1</span><span class='period'>.</span><span class='id identifier rubyid_upto'>upto</span><span class='lparen'>(</span><span class='id identifier rubyid_alen'>alen</span><span class='rparen'>)</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_idx'>idx</span><span class='op'>|</span>
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_dtype'>dtype</span>
|
|
<span class='kw'>when</span> <span class='symbol'>:int</span>
|
|
<span class='id identifier rubyid_res'>res</span> <span class='op'><<</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>when</span> <span class='symbol'>:str</span>
|
|
<span class='id identifier rubyid_res'>res</span> <span class='op'><<</span> <span class='id identifier rubyid_wdbrpc_decode_str'>wdbrpc_decode_str</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>when</span> <span class='symbol'>:bool</span>
|
|
<span class='id identifier rubyid_res'>res</span> <span class='op'><<</span> <span class='id identifier rubyid_wdbrpc_decode_bool'>wdbrpc_decode_bool</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_res'>res</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_decode_bool-instance_method">
|
|
|
|
#<strong>wdbrpc_decode_bool</strong>(data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
239
|
|
240
|
|
241
|
|
242</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 239</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_decode_bool'>wdbrpc_decode_bool</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='kw'>if</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>4</span>
|
|
<span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_slice!'>slice!</span><span class='lparen'>(</span><span class='int'>0</span><span class='comma'>,</span><span class='int'>4</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='int'>0</span><span class='rparen'>)</span> <span class='op'>?</span> <span class='kw'>false</span> <span class='op'>:</span> <span class='kw'>true</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_decode_int-instance_method">
|
|
|
|
#<strong>wdbrpc_decode_int</strong>(data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
213
|
|
214
|
|
215
|
|
216</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 213</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='kw'>if</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>4</span>
|
|
<span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_slice!'>slice!</span><span class='lparen'>(</span><span class='int'>0</span><span class='comma'>,</span><span class='int'>4</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_decode_str-instance_method">
|
|
|
|
#<strong>wdbrpc_decode_str</strong>(data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
202
|
|
203
|
|
204
|
|
205
|
|
206
|
|
207
|
|
208
|
|
209
|
|
210
|
|
211</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 202</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_decode_str'>wdbrpc_decode_str</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='kw'>if</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>4</span>
|
|
<span class='id identifier rubyid_slen'>slen</span> <span class='op'>=</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_slice!'>slice!</span><span class='lparen'>(</span><span class='int'>0</span><span class='comma'>,</span><span class='int'>4</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span>
|
|
<span class='kw'>return</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span> <span class='kw'>if</span> <span class='id identifier rubyid_slen'>slen</span> <span class='op'>==</span> <span class='int'>0</span>
|
|
<span class='kw'>while</span> <span class='lparen'>(</span><span class='id identifier rubyid_slen'>slen</span> <span class='op'>%</span> <span class='int'>4</span> <span class='op'>!=</span> <span class='int'>0</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_slen'>slen</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_slice!'>slice!</span><span class='lparen'>(</span><span class='int'>0</span><span class='comma'>,</span><span class='id identifier rubyid_slen'>slen</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='period'>.</span><span class='id identifier rubyid_split'>split</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_parse_connect_reply-instance_method">
|
|
|
|
#<strong>wdbrpc_parse_connect_reply</strong>(buff) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
129
|
|
130
|
|
131
|
|
132
|
|
133
|
|
134
|
|
135
|
|
136
|
|
137
|
|
138
|
|
139
|
|
140
|
|
141
|
|
142
|
|
143
|
|
144
|
|
145
|
|
146
|
|
147
|
|
148
|
|
149
|
|
150
|
|
151</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 129</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_parse_connect_reply'>wdbrpc_parse_connect_reply</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|
<span class='id identifier rubyid_head'>head</span> <span class='op'>=</span> <span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_slice!'>slice!</span><span class='lparen'>(</span><span class='int'>0</span><span class='comma'>,</span><span class='int'>36</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:agent_ver</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_str'>wdbrpc_decode_str</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:agent_mtu</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:agent_mod</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_type</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_vers</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_str'>wdbrpc_decode_str</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_cpu_type</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_has_fpp</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_bool'>wdbrpc_decode_bool</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_has_wp</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_bool'>wdbrpc_decode_bool</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_page_size</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_endian</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_bsp_name</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_str'>wdbrpc_decode_str</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_bootline</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_str'>wdbrpc_decode_str</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_membase</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_memsize</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_region_count</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_regions</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_arr'>wdbrpc_decode_arr</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='comma'>,</span> <span class='symbol'>:int</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_hostpool_base</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span><span class='lbracket'>[</span><span class='symbol'>:rt_hostpool_size</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_wdbrpc_decode_int'>wdbrpc_decode_int</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_info'>info</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request-instance_method">
|
|
|
|
#<strong>wdbrpc_request</strong>(procedure, data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
153
|
|
154
|
|
155
|
|
156
|
|
157
|
|
158
|
|
159
|
|
160
|
|
161
|
|
162
|
|
163
|
|
164
|
|
165
|
|
166
|
|
167
|
|
168
|
|
169
|
|
170
|
|
171
|
|
172
|
|
173
|
|
174
|
|
175
|
|
176
|
|
177
|
|
178
|
|
179
|
|
180
|
|
181
|
|
182
|
|
183
|
|
184
|
|
185
|
|
186
|
|
187
|
|
188</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 153</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='id identifier rubyid_procedure'>procedure</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_pkt'>pkt</span> <span class='op'>=</span>
|
|
<span class='lbracket'>[</span>
|
|
<span class='int'>0x00000000</span><span class='comma'>,</span> <span class='comment'># XID (ignored by checksum and length)
|
|
</span> <span class='int'>0x00000000</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000002</span><span class='comma'>,</span>
|
|
<span class='int'>0x55555555</span><span class='comma'>,</span> <span class='comment'># Program
|
|
</span> <span class='int'>0x00000001</span><span class='comma'>,</span> <span class='comment'># Version
|
|
</span> <span class='id identifier rubyid_procedure'>procedure</span><span class='comma'>,</span> <span class='comment'># Procedure
|
|
</span> <span class='int'>0x00000000</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000000</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000000</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000000</span>
|
|
<span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_pkt'>pkt</span> <span class='op'>+=</span>
|
|
<span class='lbracket'>[</span>
|
|
<span class='int'>0x00000000</span><span class='comma'>,</span> <span class='comment'># Checksum
|
|
</span> <span class='int'>0x00000000</span><span class='comma'>,</span> <span class='comment'># Packet Size
|
|
</span> <span class='id identifier rubyid_wdbrpc_request_seqno'>wdbrpc_request_seqno</span>
|
|
<span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_pkt'>pkt</span> <span class='op'>+=</span> <span class='id identifier rubyid_data'>data</span>
|
|
|
|
<span class='comment'># Length excludes the XID
|
|
</span> <span class='id identifier rubyid_pkt'>pkt</span><span class='lbracket'>[</span><span class='int'>44</span><span class='comma'>,</span> <span class='int'>4</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='lbracket'>[</span> <span class='id identifier rubyid_pkt'>pkt</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>-</span> <span class='int'>4</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># Set the checksum flag and calculate the checksum
|
|
</span> <span class='id identifier rubyid_pkt'>pkt</span><span class='lbracket'>[</span><span class='int'>42</span><span class='comma'>,</span> <span class='int'>2</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='lbracket'>[</span> <span class='id identifier rubyid_wdbrpc_checksum'>wdbrpc_checksum</span><span class='lparen'>(</span><span class='id identifier rubyid_pkt'>pkt</span><span class='rparen'>)</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>n</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_pkt'>pkt</span><span class='lbracket'>[</span><span class='int'>40</span><span class='comma'>,</span> <span class='int'>2</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='int'>0xffff</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>n</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># Set the RPC XID
|
|
</span> <span class='id identifier rubyid_pkt'>pkt</span><span class='lbracket'>[</span> <span class='int'>0</span><span class='comma'>,</span> <span class='int'>4</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='lbracket'>[</span> <span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>0x100000000</span><span class='rparen'>)</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_pkt'>pkt</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_connect-instance_method">
|
|
|
|
#<strong>wdbrpc_request_connect</strong>(ip) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>WDB_TARGET_CONNECT</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
31
|
|
32
|
|
33
|
|
34</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 31</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_connect'>wdbrpc_request_connect</span><span class='lparen'>(</span><span class='id identifier rubyid_ip'>ip</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span> <span class='int'>0x00000002</span><span class='comma'>,</span> <span class='int'>0x00000000</span><span class='comma'>,</span> <span class='int'>0x00000000</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>1</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_connect2-instance_method">
|
|
|
|
#<strong>wdbrpc_request_connect2</strong>(ip) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>WDB_TARGET_CONNECT2</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
13
|
|
14
|
|
15
|
|
16
|
|
17
|
|
18
|
|
19
|
|
20
|
|
21
|
|
22
|
|
23
|
|
24
|
|
25
|
|
26
|
|
27
|
|
28</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 13</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_connect2'>wdbrpc_request_connect2</span><span class='lparen'>(</span><span class='id identifier rubyid_ip'>ip</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ip'>ip</span> <span class='op'>+=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>while</span><span class='lparen'>(</span><span class='id identifier rubyid_ip'>ip</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>%</span> <span class='int'>4</span> <span class='op'>!=</span> <span class='int'>0</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ip'>ip</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span>
|
|
<span class='int'>0x00000002</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000000</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000000</span><span class='comma'>,</span>
|
|
<span class='int'>0x00000001</span><span class='comma'>,</span>
|
|
<span class='id identifier rubyid_ip'>ip</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|
<span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'>+</span> <span class='id identifier rubyid_ip'>ip</span>
|
|
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>0x7a</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_context_kill-instance_method">
|
|
|
|
#<strong>wdbrpc_request_context_kill</strong>(ctx_type, ctx) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
115
|
|
116
|
|
117
|
|
118
|
|
119
|
|
120
|
|
121
|
|
122
|
|
123
|
|
124
|
|
125
|
|
126
|
|
127</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 115</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_context_kill'>wdbrpc_request_context_kill</span><span class='lparen'>(</span><span class='id identifier rubyid_ctx_type'>ctx_type</span><span class='comma'>,</span> <span class='id identifier rubyid_ctx'>ctx</span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># WDB_CTX
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span>
|
|
<span class='id identifier rubyid_ctx_type'>ctx_type</span><span class='comma'>,</span> <span class='comment'># WDB_CTX_SYSTEM (3 for task)
|
|
</span> <span class='id identifier rubyid_ctx'>ctx</span><span class='comma'>,</span> <span class='comment'># SYSTEM (or set for task)
|
|
</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># options
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'><<</span> <span class='lbracket'>[</span> <span class='int'>0</span> <span class='rbracket'>]</span> <span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>31</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_disconnect-instance_method">
|
|
|
|
#<strong>wdbrpc_request_disconnect</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>WDB_TARGET_DISCONNECT</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
37
|
|
38
|
|
39
|
|
40</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 37</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_disconnect'>wdbrpc_request_disconnect</span>
|
|
<span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span> <span class='int'>0x00000002</span><span class='comma'>,</span> <span class='int'>0x00000000</span><span class='comma'>,</span> <span class='int'>0x00000000</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>2</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_memread-instance_method">
|
|
|
|
#<strong>wdbrpc_request_memread</strong>(offset = 0, length = 512, params = 0) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
62
|
|
63
|
|
64
|
|
65
|
|
66
|
|
67
|
|
68
|
|
69
|
|
70
|
|
71
|
|
72</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 62</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_memread'>wdbrpc_request_memread</span><span class='lparen'>(</span><span class='id identifier rubyid_offset'>offset</span><span class='op'>=</span><span class='int'>0</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='op'>=</span><span class='int'>512</span><span class='comma'>,</span> <span class='id identifier rubyid_params'>params</span><span class='op'>=</span><span class='int'>0</span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># WDB_MEM_REGION
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span>
|
|
<span class='id identifier rubyid_offset'>offset</span><span class='comma'>,</span> <span class='comment'># baseAddress
|
|
</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='comment'># numberOfBytes
|
|
</span> <span class='id identifier rubyid_params'>params</span><span class='comma'>,</span> <span class='comment'># params
|
|
</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>10</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_memscan-instance_method">
|
|
|
|
#<strong>wdbrpc_request_memscan</strong>(offset = 0, depth = 1024, buff = '', params = 0) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
92
|
|
93
|
|
94
|
|
95
|
|
96
|
|
97
|
|
98
|
|
99
|
|
100
|
|
101
|
|
102
|
|
103
|
|
104
|
|
105
|
|
106
|
|
107
|
|
108
|
|
109
|
|
110
|
|
111
|
|
112
|
|
113</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 92</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_memscan'>wdbrpc_request_memscan</span><span class='lparen'>(</span><span class='id identifier rubyid_offset'>offset</span><span class='op'>=</span><span class='int'>0</span><span class='comma'>,</span> <span class='id identifier rubyid_depth'>depth</span><span class='op'>=</span><span class='int'>1024</span><span class='comma'>,</span> <span class='id identifier rubyid_buff'>buff</span><span class='op'>=</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='id identifier rubyid_params'>params</span><span class='op'>=</span><span class='int'>0</span><span class='rparen'>)</span>
|
|
<span class='comment'># Make sure its DWORD aligned
|
|
</span> <span class='kw'>while</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>%</span> <span class='int'>4</span> <span class='op'>!=</span> <span class='int'>0</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_buff'>buff</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='comment'># WDB_MEM_REGION
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span>
|
|
<span class='id identifier rubyid_offset'>offset</span><span class='comma'>,</span> <span class='comment'># baseAddress
|
|
</span> <span class='id identifier rubyid_depth'>depth</span><span class='comma'>,</span> <span class='comment'># numberOfBytes
|
|
</span> <span class='id identifier rubyid_params'>params</span><span class='comma'>,</span> <span class='comment'># params
|
|
</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># WDB_MEM_XFER
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'><<</span> <span class='lbracket'>[</span>
|
|
<span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='comma'>,</span>
|
|
<span class='int'>0</span><span class='comma'>,</span>
|
|
<span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|
<span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'>+</span> <span class='id identifier rubyid_buff'>buff</span>
|
|
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>11</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_memwrite-instance_method">
|
|
|
|
#<strong>wdbrpc_request_memwrite</strong>(offset = 0, buff = '', params = 0) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
74
|
|
75
|
|
76
|
|
77
|
|
78
|
|
79
|
|
80
|
|
81
|
|
82
|
|
83
|
|
84
|
|
85
|
|
86
|
|
87
|
|
88
|
|
89</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 74</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_memwrite'>wdbrpc_request_memwrite</span><span class='lparen'>(</span><span class='id identifier rubyid_offset'>offset</span><span class='op'>=</span><span class='int'>0</span><span class='comma'>,</span> <span class='id identifier rubyid_buff'>buff</span><span class='op'>=</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='id identifier rubyid_params'>params</span><span class='op'>=</span><span class='int'>0</span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># Make sure its DWORD aligned
|
|
</span> <span class='kw'>while</span><span class='lparen'>(</span><span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>%</span> <span class='int'>4</span> <span class='op'>!=</span> <span class='int'>0</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_buff'>buff</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='comment'># WDB_MEM_XFER
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span>
|
|
<span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='comma'>,</span>
|
|
<span class='id identifier rubyid_offset'>offset</span><span class='comma'>,</span> <span class='comment'># target
|
|
</span> <span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|
<span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'>+</span> <span class='id identifier rubyid_buff'>buff</span>
|
|
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>11</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_regread-instance_method">
|
|
|
|
#<strong>wdbrpc_request_regread</strong>(regset = 0, offset = 0, length = 512, params = 0) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
42
|
|
43
|
|
44
|
|
45
|
|
46
|
|
47
|
|
48
|
|
49
|
|
50
|
|
51
|
|
52
|
|
53
|
|
54
|
|
55
|
|
56
|
|
57
|
|
58
|
|
59</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 42</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_regread'>wdbrpc_request_regread</span><span class='lparen'>(</span><span class='id identifier rubyid_regset'>regset</span><span class='op'>=</span><span class='int'>0</span><span class='comma'>,</span> <span class='id identifier rubyid_offset'>offset</span><span class='op'>=</span><span class='int'>0</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='op'>=</span><span class='int'>512</span><span class='comma'>,</span> <span class='id identifier rubyid_params'>params</span><span class='op'>=</span><span class='int'>0</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_data'>data</span> <span class='op'>=</span> <span class='lbracket'>[</span> <span class='id identifier rubyid_regset'>regset</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># WDB_CTX
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'><<</span> <span class='lbracket'>[</span>
|
|
<span class='int'>0</span><span class='comma'>,</span> <span class='comment'># WDB_CTX_SYSTEM (3 for task)
|
|
</span> <span class='int'>0</span><span class='comma'>,</span> <span class='comment'># SYSTEM (or set for task)
|
|
</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># WDB_MEM_REGION
|
|
</span> <span class='id identifier rubyid_data'>data</span> <span class='op'><<</span> <span class='lbracket'>[</span>
|
|
<span class='id identifier rubyid_offset'>offset</span><span class='comma'>,</span> <span class='comment'># baseAddress
|
|
</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='comment'># numberOfBytes
|
|
</span> <span class='id identifier rubyid_params'>params</span><span class='comma'>,</span> <span class='comment'># params
|
|
</span> <span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_wdbrpc_request'>wdbrpc_request</span><span class='lparen'>(</span><span class='int'>40</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="wdbrpc_request_seqno-instance_method">
|
|
|
|
#<strong>wdbrpc_request_seqno</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
190
|
|
191
|
|
192
|
|
193</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/wdbrpc.rb', line 190</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wdbrpc_request_seqno'>wdbrpc_request_seqno</span>
|
|
<span class='ivar'>@wdbrpc_seqno</span> <span class='op'>||=</span> <span class='int'>0</span>
|
|
<span class='ivar'>@wdbrpc_seqno</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div id="footer">
|
|
Generated on Fri May 8 17:01:40 2026 by
|
|
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|
0.9.37 (ruby-3.1.5).
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html> |