diff --git a/c/meterpreter/source/common/common_metapi.h b/c/meterpreter/source/common/common_metapi.h index 138a8187..d617215a 100644 --- a/c/meterpreter/source/common/common_metapi.h +++ b/c/meterpreter/source/common/common_metapi.h @@ -186,4 +186,4 @@ typedef struct _MetApi extern MetApi* met_api; -#endif +#endif \ No newline at end of file diff --git a/c/meterpreter/source/extensions/stdapi/server/net/config/route.c b/c/meterpreter/source/extensions/stdapi/server/net/config/route.c index 377e0f1b..dd52c94d 100644 --- a/c/meterpreter/source/extensions/stdapi/server/net/config/route.c +++ b/c/meterpreter/source/extensions/stdapi/server/net/config/route.c @@ -1,20 +1,67 @@ #include "precomp.h" +#include "common.h" #include "common_metapi.h" +#include + +typedef NETIO_STATUS(NETIOAPI_API_* GETIPFORWARDTABLE2)(ADDRESS_FAMILY Family, PMIB_IPFORWARD_TABLE2* Table); + +typedef struct v6netmask +{ + unsigned int mask[4]; +} v6netmask; DWORD add_remove_route(Packet *request, BOOLEAN add); +static unsigned int bit32mask(unsigned bits){ + unsigned int netmask; + if (bits == 32) + netmask = 0xffffffff; + else{ + netmask = ((0xffffffff << (32 - (bits % 32))) & 0xffffffff); + } + return netmask; +} + +static void bit128mask(unsigned int bits, v6netmask* netmask){ + unsigned int part = bit32mask(bits); + if (bits >= 96) { + netmask->mask[0] = 0xffffffff; + netmask->mask[1] = 0xffffffff; + netmask->mask[2] = 0xffffffff; + netmask->mask[3] = htonl(part); + } + else if (bits >= 64) { + netmask->mask[0] = 0xffffffff; + netmask->mask[1] = 0xffffffff; + netmask->mask[2] = htonl(part); + netmask->mask[3] = 0x0; + } + else if (bits >= 32) { + netmask->mask[0] = 0xffffffff; + netmask->mask[1] = htonl(part); + netmask->mask[2] = 0x0; + netmask->mask[3] = 0x0; + } + else { + netmask->mask[0] = htonl(part); + netmask->mask[1] = 0x0; + netmask->mask[2] = 0x0; + netmask->mask[3] = 0x0; + } + return; +} /* * Returns zero or more routes to the requestor from the active routing table */ DWORD request_net_config_get_routes(Remote *remote, Packet *packet) { Packet *response = met_api->packet.create_response(packet); - DWORD result = ERROR_SUCCESS; + DWORD dwResult = ERROR_SUCCESS; DWORD index; DWORD metric_bigendian; PMIB_IPFORWARDTABLE table_ipv4 = NULL; - PMIB_IPFORWARDTABLE table_ipv6 = NULL; + PMIB_IPFORWARD_TABLE2 table_ipv6 = NULL; DWORD tableSize = sizeof(MIB_IPFORWARDROW) * 96; char int_name[20]; @@ -23,42 +70,94 @@ DWORD request_net_config_get_routes(Remote *remote, Packet *packet) // Allocate storage for the routing table if (!(table_ipv4 = (PMIB_IPFORWARDTABLE)malloc(tableSize))) { - result = ERROR_NOT_ENOUGH_MEMORY; + dwResult = ERROR_NOT_ENOUGH_MEMORY; break; } // Get the routing table if (GetIpForwardTable(table_ipv4, &tableSize, TRUE) != NO_ERROR) { - result = GetLastError(); - break; + BREAK_ON_ERROR("[NET] request_net_config_get_routes: GetIpForwardTable failed"); } // Enumerate it for (index = 0; - index < table_ipv4->dwNumEntries; - index++) + index < table_ipv4->dwNumEntries; + index++) { Tlv route[5]; - memset(int_name, 0, 20); + memset(int_name, 0, sizeof(int_name)); - route[0].header.type = TLV_TYPE_SUBNET; + route[0].header.type = TLV_TYPE_SUBNET; route[0].header.length = sizeof(DWORD); - route[0].buffer = (PUCHAR)&table_ipv4->table[index].dwForwardDest; - route[1].header.type = TLV_TYPE_NETMASK; + route[0].buffer = (PUCHAR)&table_ipv4->table[index].dwForwardDest; + route[1].header.type = TLV_TYPE_NETMASK; route[1].header.length = sizeof(DWORD); - route[1].buffer = (PUCHAR)&table_ipv4->table[index].dwForwardMask; - route[2].header.type = TLV_TYPE_GATEWAY; + route[1].buffer = (PUCHAR)&table_ipv4->table[index].dwForwardMask; + route[2].header.type = TLV_TYPE_GATEWAY; route[2].header.length = sizeof(DWORD); - route[2].buffer = (PUCHAR)&table_ipv4->table[index].dwForwardNextHop; + route[2].buffer = (PUCHAR)&table_ipv4->table[index].dwForwardNextHop; // we just get the interface index, not the name, because names can be __long__ - _itoa(table_ipv4->table[index].dwForwardIfIndex, int_name, 10); - route[3].header.type = TLV_TYPE_STRING; + _itoa(table_ipv4->table[index].dwForwardIfIndex, int_name, 10); + route[3].header.type = TLV_TYPE_STRING; + route[3].header.length = (DWORD)strlen(int_name) + 1; + route[3].buffer = (PUCHAR)int_name; + + metric_bigendian = htonl(table_ipv4->table[index].dwForwardMetric1); + route[4].header.type = TLV_TYPE_ROUTE_METRIC; + route[4].header.length = sizeof(DWORD); + route[4].buffer = (PUCHAR)&metric_bigendian; + + met_api->packet.add_tlv_group(response, TLV_TYPE_NETWORK_ROUTE, + route, 5); + } + + v6netmask v6_mask; + MIB_IPINTERFACE_ROW iface = { .Family = AF_INET6 }; + GETIPFORWARDTABLE2 pGetIpForwardTable2 = (GETIPFORWARDTABLE2)GetProcAddress(GetModuleHandle(TEXT("Iphlpapi.dll")), "GetIpForwardTable2"); + + // GetIpForwardTable2 is only available on Windows Vista and later. + if (!pGetIpForwardTable2) { + break; + } + if (pGetIpForwardTable2(AF_INET6, &table_ipv6) != NO_ERROR) { + BREAK_ON_ERROR("[NET] request_net_config_get_routes: GetIpForwardTable2 failed"); + } + + // Enumerate it + for (index = 0; + index < table_ipv6->NumEntries; + index++) + { + Tlv route[5]; + memset(int_name, 0, sizeof(int_name)); + iface.InterfaceIndex = table_ipv6->Table[index].InterfaceIndex; + if (GetIpInterfaceEntry(&iface) != NO_ERROR) + { + CONTINUE_ON_ERROR("[NET] request_net_config_get_routes: GetIpInterfaceEntry failed"); + } + + route[0].header.type = TLV_TYPE_SUBNET; + route[0].header.length = sizeof(DWORD)*4; + route[0].buffer = (PUCHAR)&table_ipv6->Table[index].DestinationPrefix.Prefix.Ipv6.sin6_addr; + + bit128mask(table_ipv6->Table[index].DestinationPrefix.PrefixLength, &v6_mask); + route[1].header.type = TLV_TYPE_NETMASK; + route[1].header.length = sizeof(DWORD)*4; + route[1].buffer = (PUCHAR)v6_mask.mask; + + route[2].header.type = TLV_TYPE_GATEWAY; + route[2].header.length = sizeof(DWORD)*4; + route[2].buffer = (PUCHAR)&table_ipv6->Table[index].NextHop.Ipv6.sin6_addr; + + // we just get the interface index, not the name, because names can be __long__ + _itoa(table_ipv6->Table[index].InterfaceIndex, int_name, 10); + route[3].header.type = TLV_TYPE_STRING; route[3].header.length = (DWORD)strlen(int_name)+1; route[3].buffer = (PUCHAR)int_name; - metric_bigendian = htonl(table_ipv4->table[index].dwForwardMetric1); + metric_bigendian = htonl(table_ipv6->Table[index].Metric + iface.Metric); route[4].header.type = TLV_TYPE_ROUTE_METRIC; route[4].header.length = sizeof(DWORD); route[4].buffer = (PUCHAR)&metric_bigendian; @@ -66,7 +165,6 @@ DWORD request_net_config_get_routes(Remote *remote, Packet *packet) met_api->packet.add_tlv_group(response, TLV_TYPE_NETWORK_ROUTE, route, 5); } - } while (0); if(table_ipv4) @@ -74,7 +172,7 @@ DWORD request_net_config_get_routes(Remote *remote, Packet *packet) if(table_ipv6) free(table_ipv6); - met_api->packet.transmit_response(result, remote, response); + met_api->packet.transmit_response(dwResult, remote, response); return ERROR_SUCCESS; }