Use native_arch for railfun multi and test it

This commit is contained in:
Spencer McIntyre 2017-03-01 13:07:04 -05:00
parent 4882927570
commit 2d51801b01
2 changed files with 21 additions and 2 deletions

View File

@ -49,7 +49,7 @@ class MultiCaller
# needed by DLL helper
@win_consts = win_consts
if @client.arch == ARCH_X64
if @client.native_arch == ARCH_X64
@native = 'Q<'
else
@native = 'V'

View File

@ -21,7 +21,7 @@ class MetasploitModule < Msf::Post
def test_api_function_calls
it "Results should include error information" do
it "Should include error information in the results" do
ret = true
result = session.railgun.kernel32.GetCurrentProcess()
ret &&= result['GetLastError'] == 0
@ -51,6 +51,25 @@ class MetasploitModule < Msf::Post
ret &&= result['nSize'].to_i == result['ComputerName'].length
end
it "Should support calling multiple functions at once" do
ret = true
multi_rail = [
['kernel32', 'LoadLibraryA', ['kernel32.dll']],
['kernel32', 'GetModuleHandleA', ['kernel32.dll']],
['kernel32', 'GetCurrentProcessId', []]
]
results = session.railgun.multi(multi_rail)
ret &&= results.length == multi_rail.length
results.each do |result|
ret &&= result['GetLastError'] == 0
ret &&= result['return'] != 0
end
# LoadLibraryA('kernel32.dll') == GetModuleHandleA('kernel32.dll')
ret &&= results[0]['return'] == results[1]['return']
ret &&= results[2]['return'] == session.sys.process.getpid
end
it "Should support reading memory" do
ret = true
result = client.railgun.kernel32.GetModuleHandleA('kernel32')