Skip to content

Commit

Permalink
rolled changes into existing ps command
Browse files Browse the repository at this point in the history
Some users requested this be added to the ps
command via a -S opt instead of creating a new command.
This limits the search to only one search parameter at a time
but with the ability to pass RegEx I think that's fine
  • Loading branch information
David Maloney authored and David Maloney committed Sep 19, 2012
1 parent 4dbe776 commit 14c94e4
Showing 1 changed file with 30 additions and 36 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@ class Console::CommandDispatcher::Stdapi::Sys
"-r" => [ true, "The remote machine name to connect to (with current process credentials" ],
"-w" => [ false, "Set KEY_WOW64 flag, valid values [32|64]." ])

@@ps_opts = Rex::Parser::Arguments.new(
"-h" => [false, "Help menu."],
"-S" => [true, "RegEx term(s) to filter results with "])

#
# List of supported commands.
#
Expand All @@ -58,7 +62,6 @@ def commands
"getuid" => "Get the user that the server is running as",
"kill" => "Terminate a process",
"ps" => "List running processes",
"findpids" => "Find Processes by name",
"reboot" => "Reboots the remote computer",
"reg" => "Modify and interact with the remote registry",
"rev2self" => "Calls RevertToSelf() on the remote machine",
Expand All @@ -76,7 +79,6 @@ def commands
"getuid" => [ "stdapi_sys_config_getuid" ],
"kill" => [ "stdapi_sys_process_kill" ],
"ps" => [ "stdapi_sys_process_get_processes" ],
"findpids" => [ "stdapi_sys_process_get_processes" ],
"reboot" => [ "stdapi_sys_power_exitwindows" ],
"reg" => [
"stdapi_registry_load_key",
Expand Down Expand Up @@ -276,6 +278,24 @@ def cmd_kill(*args)
#
def cmd_ps(*args)
processes = client.sys.process.get_processes
@@ps_opts.parse(args) do |opt, idx, val|
case opt
when "-h"
cmd_ps_help
return true
when "-S"
print_line "Performing Search..."
searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new
processes.each do |proc|
if val.nil? or val.empty?
print_line "You must supply a search term!"
return false
end
searched_procs << proc if proc["name"].match(/#{val}/)
end
processes = searched_procs
end
end
if (processes.length == 0)
print_line("No running processes were found.")
else
Expand All @@ -286,40 +306,14 @@ def cmd_ps(*args)
return true
end

def cmd_findpids(*args)
if args.empty? or args.include? "-h"
cmd_findpids_help
return true
end
processes = client.sys.process.get_processes
if (processes.length == 0)
print_line("No running processes were found.")
else
searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new
processes.each do |proc|
args.each do |arg|
if proc["name"].match(/#{arg}/)
searched_procs << proc
break
end
end
end
searched_procs.compact!
if searched_procs.length == 0
print_line("No running processes were found matching the supplied names.")
else
print_line
print_line(searched_procs.to_table("Indent" => 1).to_s)
print_line
end
end
return true
end

def cmd_findpids_help
print_line "You must supply one or more process name to search for"
print_line "e.g. findpids explorer.exe notepad.exe"
print_line "You may also pass Regular Expressions: findpids *.svc.* *.dll.*"
def cmd_ps_help
print_line "Use the command with no arguments to see all running processes."
print_line "You may supply a search term to filter the results:"
print_line "\t ps -S explorer.exe"
print_line "\t Would return any processes named explorer.exe"
print_line "You may also pass Regular Expressions:"
print_line "\tps -S *.svc.* "
print_line "Would return any processes with 'svc' in the name"
end

#
Expand Down

1 comment on commit 14c94e4

@sempervictus
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've got similar functionality in #800, where ps -S searches through all of the columns, allowing search by name, user, arch, etc. Same thing for ls -S

Please sign in to comment.