github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-02-28 06:13:03 +01:00
Code Releases Activity

Add support for page size

Browse Source
This commit is contained in:
OJ 2013-12-09 00:30:08 +11:00
parent ad86ac5b5c
commit b7f1c2c538
4 changed files with 34 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
c/meterpreter/source/extensions/extapi/adsi.c
View File

@ -6,6 +6,8 @@
#include "adsi.h"
#include "adsi_interface.h"
#define DEFAULT_PAGE_SIZE 100
/*!
* @brief Helper function that converts an ASCII string to a wide char string.
* @param lpValue ASCII string to convert.
@ -58,6 +60,7 @@ DWORD request_adsi_domain_query(Remote *remote, Packet *packet)
DWORD fieldIndex = 0;
Packet * response = packet_create_response(packet);
Tlv fieldTlv;
DWORD pageSize;
do
{
@ -84,6 +87,13 @@ DWORD request_adsi_domain_query(Remote *remote, Packet *packet)
break;
}
pageSize = packet_get_tlv_value_uint(packet, TLV_TYPE_EXT_ASDI_PAGESIZE);
if (pageSize == 0)
{
pageSize = DEFAULT_PAGE_SIZE;
}
dprintf("[EXTAPI ADSI] Page size will be %u", pageSize);
while (packet_enum_tlv(packet, fieldCount, TLV_TYPE_EXT_ADSI_FIELD, &fieldTlv) == ERROR_SUCCESS)
{
lpValue = (char*)fieldTlv.buffer;
@ -109,7 +119,7 @@ DWORD request_adsi_domain_query(Remote *remote, Packet *packet)
if (dwResult == ERROR_SUCCESS)
{
dprintf("[EXTAPI ADSI] Beginning user enumeration");
dwResult = domain_query(lpwDomain, lpwFilter, lpwFields, fieldCount, response);
dwResult = domain_query(lpwDomain, lpwFilter, lpwFields, fieldCount, pageSize, response);
}
} while (0);

24
c/meterpreter/source/extensions/extapi/adsi_interface.cpp
View File

@ -15,6 +15,7 @@ extern "C" {
#define VALUE_SIZE 512
#define PATH_SIZE 256
#define RESULT_PAGE_SIZE 200
/*! @brief The GUID of the Directory Search COM object. */
static const IID IID_IDirectorySearch = { 0x109BA8EC, 0x92F0, 0x11D0, { 0xA7, 0x90, 0x00, 0xC0, 0x4F, 0xD8, 0xD5, 0xA8 } };
@ -25,10 +26,11 @@ static const IID IID_IDirectorySearch = { 0x109BA8EC, 0x92F0, 0x11D0, { 0xA7, 0x
* @param lpwFilter The filter to use when reading objects (LDAP style).
* @param lpwQueryCols Array of column names representing fields to extract.
* @param queryColCount Number of columns in \c lpwQueryCols.
* @param pageSize The size of the page of results to return.
* @param response The response \c Packet to add the results to.
*/
DWORD domain_query(LPCWSTR lpwDomain, LPWSTR lpwFilter, LPWSTR* lpwQueryCols,
UINT queryColCount, Packet* response)
UINT queryColCount, DWORD pageSize, Packet* response)
{
HRESULT hResult;
WCHAR cbPath[PATH_SIZE];
@ -49,10 +51,24 @@ DWORD domain_query(LPCWSTR lpwDomain, LPWSTR lpwFilter, LPWSTR* lpwQueryCols,
dprintf("[ADSI] Unable to open domain: %x", hResult);
break;
}
dprintf("[ADSI] Domain opened");
// run the search for the values listed above
OutputDebugStringW(lpwFilter);
// set the limit of results so that we don't take forever on large domains
dprintf("[ADSI] Setting Page size to %u", (ADS_INTEGER)pageSize);
ADS_SEARCHPREF_INFO prefInfo[1];
prefInfo[0].dwSearchPref = ADS_SEARCHPREF_PAGESIZE;
prefInfo[0].vValue.dwType = ADSTYPE_INTEGER;
prefInfo[0].vValue.Integer = (ADS_INTEGER)pageSize;
prefInfo[1].dwSearchPref = ADS_SEARCHPREF_SEARCH_SCOPE;
prefInfo[1].vValue.dwType = ADSTYPE_INTEGER;
prefInfo[1].vValue.Integer = ADS_SCOPE_SUBTREE;
prefInfo[2].dwSearchPref = ADS_SEARCHPREF_CACHE_RESULTS;
prefInfo[2].vValue.dwType = ADSTYPE_BOOLEAN;
prefInfo[2].vValue.Boolean = false;
if (FAILED(hResult = pDirSearch->SetSearchPreference(prefInfo, 1)))
{
dprintf("[ADSI] Failed to set search settings %u %x", pageSize, hResult);
}
hResult = pDirSearch->ExecuteSearch(lpwFilter, lpwQueryCols, queryColCount, &hSearch);
if (hResult != S_OK)
{

3
c/meterpreter/source/extensions/extapi/adsi_interface.h
View File

@ -6,6 +6,7 @@
#ifndef _METERPRETER_SOURCE_EXTENSION_EXTAPI_ADSI_INTERFACE_H
#define _METERPRETER_SOURCE_EXTENSION_EXTAPI_ADSI_INTERFACE_H
DWORD domain_query(LPCWSTR lpwDomain, LPWSTR lpwFilter, LPWSTR* lpwQueryCols, UINT queryColCount, Packet* response);
DWORD domain_query(LPCWSTR lpwDomain, LPWSTR lpwFilter, LPWSTR* lpwQueryCols,
UINT queryColCount, DWORD pageSize, Packet* response);
#endif

1
c/meterpreter/source/extensions/extapi/extapi.h
View File

@ -47,5 +47,6 @@
#define TLV_TYPE_EXT_ADSI_FIELD MAKE_CUSTOM_TLV(TLV_META_TYPE_STRING, TLV_TYPE_EXTENSION_EXTAPI, TLV_EXTENSIONS + 57)
#define TLV_TYPE_EXT_ADSI_VALUE MAKE_CUSTOM_TLV(TLV_META_TYPE_STRING, TLV_TYPE_EXTENSION_EXTAPI, TLV_EXTENSIONS + 58)
#define TLV_TYPE_EXT_ADSI_RESULT MAKE_CUSTOM_TLV(TLV_META_TYPE_GROUP, TLV_TYPE_EXTENSION_EXTAPI, TLV_EXTENSIONS + 59)
#define TLV_TYPE_EXT_ASDI_PAGESIZE MAKE_CUSTOM_TLV(TLV_META_TYPE_UINT, TLV_TYPE_EXTENSION_EXTAPI, TLV_EXTENSIONS + 60)
#endif