rapid7/meterpreter — pull request #45 by OJ (2013-11-03 10:26:15+00:00)
Title: New Extension: Extended API

This PR contains code for a new extension called the Extended API. The goal of this extension is to contain functionality that is helpful with general Windows post-exploitation tasks, but contains functionality that doesn't belong in the Standard API project. That is, this code is useful, but optional.

So far the code contains the following functions:

1. Ability to enumerate Windows and child windows. This can be useful when searching for something that a user is doing, plus it harvests Window handles that can then be used with railgun calls.
1. Ability to enumerate all services. The data returned includes service names, display names, PIDs and statuses.
1. Ability to query a particular service by name. The query results in more detailed information about the service itself, including things such as the account that the service is running under and the DACL. (Note: at this point DACL parsing hasn't been implemented, it's coming).
1. Ability to read data from the clipboard. The formats that are supported are raw text, files and image data.
* Raw text, if present, is just displayed on screen.
* If the user has a selection of files on the cilpboard, they are listed along with their sizes in bytes. If the `-d` parameter is added to the call, then the files are downloaded to a local loot folder.
* If the user has an image selection on the clipboard (such as a screenshot or something from MSPaint) the image dimensions are shown. If the `-d` parameter is added then the image is downloaded to a local loot folder and then displayed. Note that GDI+ i used to enable this functionality instead of the jpeg library that is used elsewhere. Down the track, this functionality will be moved over to stdapi allowing us to reduce the size of image management payloads such as screenshot.dll.
1. Ability to set text on the cilpboard. More formats such as files and images might come later if they're useful.

This PR isn't perfect yet, but it's big enough to get the conversation going.

Future goals:

* Monitoring the clipboard and auto-looting when new data appears.
* DACL parsing into something human-readable.
* Service control (starting/stopping/disabling/etc)
* ... and a LOT more other stuff too good to mention here :)

This is the Meterpreter side of MSF PR https://github.com/rapid7/metasploit-framework/pull/2602 -- this is where you'll find the sample output from using the new set of commands in the extension.

Bring on the feedback!