rapid7/metasploit-framework — pull request #1604 by sempervictus (2013-03-15 05:21:08+00:00)
Title: Rex table search

Add regular expression matching to Rex::Ui::Text::Table rows.
Table initializers can pass a string assigned to the 'SearchTerm' opts hash key which will be converted to /#{string}/nmi. This regexp is matched during row output in to_s and to_csv methods in the class. As a result, this approach works for printing full tables with headers as well as creating CSV for -R flags where appropriate.

To demonstrate the functionality, the meterpreter ls, ps, and netstat commands have all be wired with this functionality (netstat is not a fun read when the blue team is looking to off your session).

Example - find a powershell running as system (likely a bad thing if its not yours):
```
meterpreter > ps -S powershell.*system

Process list
============

PID Name Arch Session User Path
--- ---- ---- ------- ---- ----
1016 powershell.exe x86 0 NT AUTHORITY\SYSTEM C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
5872 powershell.exe x86 0 NT AUTHORITY\SYSTEM C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
```
Example - find processes listening on UDP 500:
```
meterpreter > netstat -S udp.*\:500

Connection list
===============

Proto Local address Remote address State User Inode PID/Program name
----- ------------- -------------- ----- ---- ----- ----------------
udp 0.0.0.0:500 0.0.0.0:* 0 0 1000/svch
udp6 :::500 :::* 0 0 1000/svch
```
Example - identify all the batch files in Windows' temp folder:
```
meterpreter > ls -S bat$ '%windir%\temp'

Listing: %windir%\temp
======================

Mode Size Type Last modified Name
---- ---- ---- ------------- ----
0000/--------- 105055712 fif 1973-07-02 16:27:28 -0400 JEje.bat
0000/--------- 105055712 fif 1973-07-02 16:27:28 -0400 NjIAaSM.bat
0000/--------- 105055712 fif 1973-07-02 16:27:28 -0400 WyYeENy.bat
0000/--------- 105055712 fif 1973-07-02 16:27:28 -0400 fjurgK.bat
0000/--------- 105055712 fif 1973-07-02 16:27:28 -0400 kehsG.bat
0000/--------- 105055712 fif 1973-07-02 16:27:28 -0400 zQzOl.bat
```