621 lines
30 KiB
Lua
621 lines
30 KiB
Lua
---
|
|
-- This module is designed to parse the <code>PERF_DATA_BLOCK</code> structure, which is
|
|
-- stored in the registry under HKEY_PERFORMANCE_DATA. By querying this structure, you can
|
|
-- get a whole lot of information about what's going on.
|
|
--
|
|
-- To use this from a script, see <code>get_performance_data</code>, it is the only
|
|
-- "public" function in this module.
|
|
--
|
|
-- My primary sources of information were:
|
|
-- * This 1996 journal by Matt Pietrek: <http://www.microsoft.com/msj/archive/S271.aspx>
|
|
-- * The followup article: <http://www.microsoft.com/msj/archive/S2A9.aspx>
|
|
-- * The WinPerf.h header file
|
|
--
|
|
-- And my primary inspiration was PsTools, specifically, <code>pstasklist.exe</code>.
|
|
--
|
|
--@author Ron Bowes <ron@skullsecurity.net>
|
|
--@copyright Same as Nmap--See https://nmap.org/book/man-legal.html
|
|
-----------------------------------------------------------------------
|
|
|
|
local msrpc = require "msrpc"
|
|
local msrpctypes = require "msrpctypes"
|
|
local stdnse = require "stdnse"
|
|
local string = require "string"
|
|
_ENV = stdnse.module("msrpcperformance", stdnse.seeall)
|
|
|
|
---Parses the title database, which is a series of null-terminated string pairs.
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_title_database(data, pos)
|
|
local result = {}
|
|
local i = 1
|
|
|
|
repeat
|
|
local number, name
|
|
number, name, pos = string.unpack("<zz", data, pos)
|
|
|
|
if(number == nil) then
|
|
return false, "Couldn't parse the title database: end of string encountered early"
|
|
elseif(tonumber(number) == nil) then -- Not sure if this actually happens, but it doesn't hurt to check
|
|
stdnse.debug1("MSRPC: ERROR: Couldn't parse the title database: string found where number expected (%d: '%s')", i, number)
|
|
return false, "Couldn't parse the title database"
|
|
end
|
|
|
|
result[tonumber(number)] = name
|
|
i = i + 1
|
|
until pos >= #data
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
---Parses a PERF_DATA_BLOCK, which has the following definition (from "WinPerf.h" on Visual Studio 8):
|
|
--
|
|
--<code>
|
|
-- typedef struct _PERF_DATA_BLOCK {
|
|
-- WCHAR Signature[4]; // Signature: Unicode "PERF"
|
|
-- DWORD LittleEndian; // 0 = Big Endian, 1 = Little Endian
|
|
-- DWORD Version; // Version of these data structures
|
|
-- // starting at 1
|
|
-- DWORD Revision; // Revision of these data structures
|
|
-- // starting at 0 for each Version
|
|
-- DWORD TotalByteLength; // Total length of data block
|
|
-- DWORD HeaderLength; // Length of this structure
|
|
-- DWORD NumObjectTypes; // Number of types of objects
|
|
-- // being reported
|
|
-- LONG DefaultObject; // Object Title Index of default
|
|
-- // object to display when data from
|
|
-- // this system is retrieved (-1 =
|
|
-- // none, but this is not expected to
|
|
-- // be used)
|
|
-- SYSTEMTIME SystemTime; // Time at the system under
|
|
-- // measurement
|
|
-- LARGE_INTEGER PerfTime; // Performance counter value
|
|
-- // at the system under measurement
|
|
-- LARGE_INTEGER PerfFreq; // Performance counter frequency
|
|
-- // at the system under measurement
|
|
-- LARGE_INTEGER PerfTime100nSec; // Performance counter time in 100 nsec
|
|
-- // units at the system under measurement
|
|
-- DWORD SystemNameLength; // Length of the system name
|
|
-- DWORD SystemNameOffset; // Offset, from beginning of this
|
|
-- // structure, to name of system
|
|
-- // being measured
|
|
-- } PERF_DATA_BLOCK, *PPERF_DATA_BLOCK;
|
|
--</code>
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_data_block(data, pos)
|
|
local result = {}
|
|
|
|
pos, result['Signature'] = msrpctypes.unicode_to_string(data, pos, 4, false)
|
|
if(result['Signature'] ~= "PERF") then
|
|
return false, "MSRPC: PERF_DATA_BLOCK signature is missing or incorrect"
|
|
end
|
|
|
|
pos, result['LittleEndian'] = msrpctypes.unmarshall_int32(data, pos)
|
|
if(result['LittleEndian'] ~= 1) then
|
|
return false, "MSRPC: PERF_DATA_BLOCK returned a non-understood endianness"
|
|
end
|
|
|
|
-- Parse the header
|
|
pos, result['Version'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['Revision'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['TotalByteLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['HeaderLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['NumObjectTypes'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['DefaultObject'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['SystemTime'] = msrpctypes.unmarshall_SYSTEMTIME(data, pos)
|
|
pos, result['PerfTime'] = msrpctypes.unmarshall_int64(data, pos)
|
|
pos, result['PerfFreq'] = msrpctypes.unmarshall_int64(data, pos)
|
|
pos, result['PerfTime100nSec'] = msrpctypes.unmarshall_int64(data, pos)
|
|
pos = pos + 4 -- This value doesn't seem to line up, so add 4
|
|
|
|
pos, result['SystemNameLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['SystemNameOffset'] = msrpctypes.unmarshall_int32(data, pos)
|
|
|
|
-- Ensure that the system name is directly after the header. This technically shouldn't matter, but Microsoft's documentation
|
|
-- (in WinPref.h) says that the actual object comes "after the PERF_DATA_BLOCK", so it doesn't make sense that the SystemName
|
|
-- could be anywhere else.
|
|
if(pos ~= result['SystemNameOffset'] + 1) then
|
|
return false, "MSRPC: PERF_DATA_BLOCK has SystemName in the wrong location"
|
|
end
|
|
|
|
-- Read the system name from the next location (which happens to be identical to SystemNameOffset, on a proper system)
|
|
pos, result['SystemName'] = msrpctypes.unicode_to_string(data, pos, result['SystemNameLength'] / 2, true)
|
|
|
|
pos = pos + 4 -- Again, we end up not lined up so here we fix it
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
|
|
---Parse a PERF_OBJECT_TYPE structure. From Microsoft's documentation:
|
|
--
|
|
--<code>
|
|
-- //
|
|
-- // The _PERF_DATA_BLOCK structure is followed by NumObjectTypes of
|
|
-- // data sections, one for each type of object measured. Each object
|
|
-- // type section begins with a _PERF_OBJECT_TYPE structure.
|
|
-- //
|
|
-- typedef struct _PERF_OBJECT_TYPE {
|
|
-- DWORD TotalByteLength; // Length of this object definition
|
|
-- // including this structure, the
|
|
-- // counter definitions, and the
|
|
-- // instance definitions and the
|
|
-- // counter blocks for each instance:
|
|
-- // This is the offset from this
|
|
-- // structure to the next object, if
|
|
-- // any
|
|
-- DWORD DefinitionLength; // Length of object definition,
|
|
-- // which includes this structure
|
|
-- // and the counter definition
|
|
-- // structures for this object: this
|
|
-- // is the offset of the first
|
|
-- // instance or of the counters
|
|
-- // for this object if there is
|
|
-- // no instance
|
|
-- DWORD HeaderLength; // Length of this structure: this
|
|
-- // is the offset to the first
|
|
-- // counter definition for this
|
|
-- // object
|
|
-- DWORD ObjectNameTitleIndex;
|
|
-- // Index to name in Title Database
|
|
-- #ifdef _WIN64
|
|
-- DWORD ObjectNameTitle; // Should use this as an offset
|
|
-- #else
|
|
-- LPWSTR ObjectNameTitle; // Initially NULL, for use by
|
|
-- // analysis program to point to
|
|
-- // retrieved title string
|
|
-- #endif
|
|
-- DWORD ObjectHelpTitleIndex;
|
|
-- // Index to Help in Title Database
|
|
-- #ifdef _WIN64
|
|
-- DWORD ObjectHelpTitle; // Should use this as an offset
|
|
-- #else
|
|
-- LPWSTR ObjectHelpTitle; // Initially NULL, for use by
|
|
-- // analysis program to point to
|
|
-- // retrieved title string
|
|
-- #endif
|
|
-- DWORD DetailLevel; // Object level of detail (for
|
|
-- // controlling display complexity);
|
|
-- // will be min of detail levels
|
|
-- // for all this object's counters
|
|
-- DWORD NumCounters; // Number of counters in each
|
|
-- // counter block (one counter
|
|
-- // block per instance)
|
|
-- LONG DefaultCounter; // Default counter to display when
|
|
-- // this object is selected, index
|
|
-- // starting at 0 (-1 = none, but
|
|
-- // this is not expected to be used)
|
|
-- LONG NumInstances; // Number of object instances
|
|
-- // for which counters are being
|
|
-- // returned from the system under
|
|
-- // measurement. If the object defined
|
|
-- // will never have any instance data
|
|
-- // structures (PERF_INSTANCE_DEFINITION)
|
|
-- // then this value should be -1, if the
|
|
-- // object can have 0 or more instances,
|
|
-- // but has none present, then this
|
|
-- // should be 0, otherwise this field
|
|
-- // contains the number of instances of
|
|
-- // this counter.
|
|
-- DWORD CodePage; // 0 if instance strings are in
|
|
-- // UNICODE, else the Code Page of
|
|
-- // the instance names
|
|
-- LARGE_INTEGER PerfTime; // Sample Time in "Object" units
|
|
-- //
|
|
-- LARGE_INTEGER PerfFreq; // Frequency of "Object" units in
|
|
-- // counts per second.
|
|
-- } PERF_OBJECT_TYPE, *PPERF_OBJECT_TYPE;
|
|
--</code>
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_object_type(data, pos)
|
|
local result = {}
|
|
|
|
pos, result['TotalByteLength'] = msrpctypes.unmarshall_int32(data, pos) -- Offset to the next object
|
|
pos, result['DefinitionLength'] = msrpctypes.unmarshall_int32(data, pos) -- Offset to the first instance (or counter, if no instances)
|
|
pos, result['HeaderLength'] = msrpctypes.unmarshall_int32(data, pos) -- Offset to the first counter definition
|
|
pos, result['ObjectNameTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) -- Index in the Title Database
|
|
pos, result['ObjectNameTitle'] = msrpctypes.unmarshall_int32(data, pos) -- TODO: will this work with 64-bit?
|
|
pos, result['ObjectHelpTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) -- Index in the Help Database
|
|
pos, result['ObjectHelpTitle'] = msrpctypes.unmarshall_int32(data, pos) -- TODO: will this workw ith 64-bit?
|
|
pos, result['DetailLevel'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['NumCounters'] = msrpctypes.unmarshall_int32(data, pos) -- The number of counters in each counter block
|
|
pos, result['DefaultCounter'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['NumInstances'] = msrpctypes.unmarshall_int32(data, pos) -- Numer of object instances for which counters are being returned
|
|
pos, result['CodePage'] = msrpctypes.unmarshall_int32(data, pos) -- 0 if strings are in UNICODE, otherwise the Code Page
|
|
-- if(result['CodePage'] ~= 0) then
|
|
-- return false, string.format("Unknown Code Page for data: %d\n", result['CodePage'])
|
|
-- end
|
|
pos, result['PerfTime'] = msrpctypes.unmarshall_int64(data, pos) -- Sample time in "Object" units
|
|
pos, result['PerfFreq'] = msrpctypes.unmarshall_int64(data, pos) -- Frequency of "Object" units in counts/second
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
|
|
---Parse a PERF_COUNTER_DEFINITION structure. From Microsoft's documentation:
|
|
--
|
|
--<code>
|
|
-- // There is one of the following for each of the
|
|
-- // PERF_OBJECT_TYPE.NumCounters. The Unicode names in this structure MUST
|
|
-- // come from a message file.
|
|
-- typedef struct _PERF_COUNTER_DEFINITION {
|
|
-- DWORD ByteLength; // Length in bytes of this structure
|
|
-- DWORD CounterNameTitleIndex;
|
|
-- // Index of Counter name into
|
|
-- // Title Database
|
|
-- #ifdef _WIN64
|
|
-- DWORD CounterNameTitle;
|
|
-- #else
|
|
-- LPWSTR CounterNameTitle; // Initially NULL, for use by
|
|
-- // analysis program to point to
|
|
-- // retrieved title string
|
|
-- #endif
|
|
-- DWORD CounterHelpTitleIndex;
|
|
-- // Index of Counter Help into
|
|
-- // Title Database
|
|
-- #ifdef _WIN64
|
|
-- DWORD CounterHelpTitle;
|
|
-- #else
|
|
-- LPWSTR CounterHelpTitle; // Initially NULL, for use by
|
|
-- // analysis program to point to
|
|
-- // retrieved title string
|
|
-- #endif
|
|
-- LONG DefaultScale; // Power of 10 by which to scale
|
|
-- // chart line if vertical axis is 100
|
|
-- // 0 ==> 1, 1 ==> 10, -1 ==>1/10, etc.
|
|
-- DWORD DetailLevel; // Counter level of detail (for
|
|
-- // controlling display complexity)
|
|
-- DWORD CounterType; // Type of counter
|
|
-- DWORD CounterSize; // Size of counter in bytes
|
|
-- DWORD CounterOffset; // Offset from the start of the
|
|
-- // PERF_COUNTER_BLOCK to the first
|
|
-- // byte of this counter
|
|
-- } PERF_COUNTER_DEFINITION, *PPERF_COUNTER_DEFINITION;
|
|
--</code>
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_counter_definition(data, pos)
|
|
local result = {}
|
|
local initial_pos = pos
|
|
|
|
pos, result['ByteLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterNameTitleIndex'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterNameTitle'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterHelpTitleIndex'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterHelpTitle'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['DefaultScale'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['DetailLevel'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterType'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterSize'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['CounterOffset'] = msrpctypes.unmarshall_int32(data, pos)
|
|
|
|
pos = initial_pos + result['ByteLength']
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
---Parse the actual counter value. This is a fairly simple function, it takes a counter
|
|
-- definition and pulls out data based on it.
|
|
--
|
|
-- Note: I don't think this is doing the 8-byte values right, I suspect that they're supposed
|
|
-- to be doubles.
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@param counter_definition The matching counter_definition.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_counter(data, pos, counter_definition)
|
|
local result
|
|
|
|
if(counter_definition['CounterSize'] == 4) then
|
|
pos, result = msrpctypes.unmarshall_int32(data, pos)
|
|
elseif(counter_definition['CounterSize'] == 8) then
|
|
pos, result = msrpctypes.unmarshall_int64(data, pos)
|
|
else
|
|
pos, result = msrpctypes.unmarshall_raw(data, pos, counter_definition['CounterSize'])
|
|
end
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
---Parse a PERF_INSTANCE_DEFINITION structure. From Microsoft's documentation:
|
|
--
|
|
--<code>
|
|
-- // If (PERF_DATA_BLOCK.NumInstances >= 0) then there will be
|
|
-- // PERF_DATA_BLOCK.NumInstances of a (PERF_INSTANCE_DEFINITION
|
|
-- // followed by a PERF_COUNTER_BLOCK followed by the counter data fields)
|
|
-- // for each instance.
|
|
-- //
|
|
-- // If (PERF_DATA_BLOCK.NumInstances < 0) then the counter definition
|
|
-- // structure above will be followed by only a PERF_COUNTER_BLOCK and the
|
|
-- // counter data for that COUNTER.
|
|
-- typedef struct _PERF_INSTANCE_DEFINITION {
|
|
-- DWORD ByteLength; // Length in bytes of this structure,
|
|
-- // including the subsequent name
|
|
-- DWORD ParentObjectTitleIndex;
|
|
-- // Title Index to name of "parent"
|
|
-- // object (e.g., if thread, then
|
|
-- // process is parent object type);
|
|
-- // if logical drive, the physical
|
|
-- // drive is parent object type
|
|
-- DWORD ParentObjectInstance;
|
|
-- // Index to instance of parent object
|
|
-- // type which is the parent of this
|
|
-- // instance.
|
|
-- LONG UniqueID; // A unique ID used instead of
|
|
-- // matching the name to identify
|
|
-- // this instance, -1 = none
|
|
-- DWORD NameOffset; // Offset from beginning of
|
|
-- // this struct to the Unicode name
|
|
-- // of this instance
|
|
-- DWORD NameLength; // Length in bytes of name; 0 = none
|
|
-- // this length includes the characters
|
|
-- // in the string plus the size of the
|
|
-- // terminating NULL char. It does not
|
|
-- // include any additional pad bytes to
|
|
-- // correct structure alignment
|
|
-- } PERF_INSTANCE_DEFINITION, *PPERF_INSTANCE_DEFINITION;
|
|
--</code>
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_instance_definition(data, pos)
|
|
local result = {}
|
|
|
|
-- Remember where we started. I noticed that where the counter part starts can move around, so we have to
|
|
-- determine it by adding ByteLength to the initial position
|
|
local initial_pos = pos
|
|
|
|
pos, result['ByteLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['ParentObjectTitleIndex'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['ParentObjectInstance'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['UniqueID'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['NameOffset'] = msrpctypes.unmarshall_int32(data, pos)
|
|
pos, result['NameLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
|
|
pos, result['InstanceName'] = msrpctypes.unicode_to_string(data, pos, result['NameLength'] / 2, true)
|
|
|
|
pos = initial_pos + result['ByteLength']
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
---Parse a PERF_COUNTER_BLOCK structure. From Microsoft's documentation:
|
|
--
|
|
--<code>
|
|
-- typedef struct _PERF_COUNTER_BLOCK {
|
|
-- DWORD ByteLength; // Length in bytes of this structure,
|
|
-- // including the following counters
|
|
-- } PERF_COUNTER_BLOCK, *PPERF_COUNTER_BLOCK;
|
|
--
|
|
--</code>
|
|
--
|
|
--@param data The data being processed.
|
|
--@param pos The position within <code>data</code>.
|
|
--@return (status, pos, result) The status (true if successful), the new position in <code>data</code> (or an error
|
|
-- message), and a table representing the datatype, if any.
|
|
local function parse_perf_counter_block(data, pos)
|
|
local result = {}
|
|
|
|
pos, result['ByteLength'] = msrpctypes.unmarshall_int32(data, pos)
|
|
|
|
return true, pos, result
|
|
end
|
|
|
|
---Retrieve the parsed performance data from the given host for the requested
|
|
-- object values.
|
|
--
|
|
-- To get a list of possible object values, leave 'objects' blank and look at
|
|
-- <code>result['title_database']</code> -- it'll contain a list of indexes
|
|
-- that can be looked up. These indexes are passed as a string or as a series
|
|
-- of space-separated strings (eg, "230" for "Process" and "238" for "Process"
|
|
-- and "Processor").
|
|
--
|
|
--@param host The host object
|
|
--@param objects [optional] The space-separated list of object numbers to
|
|
-- retrieve. Default: only retrieve the database.
|
|
function get_performance_data(host, objects)
|
|
|
|
-- Create the SMB session
|
|
local status, smbstate = msrpc.start_smb(host, msrpc.WINREG_PATH)
|
|
if(status == false) then
|
|
return false, smbstate
|
|
end
|
|
|
|
-- Bind to WINREG service
|
|
local status, bind_result = msrpc.bind(smbstate, msrpc.WINREG_UUID, msrpc.WINREG_VERSION, nil)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, bind_result
|
|
end
|
|
|
|
-- Open HKEY_PERFORMANCE_DATA
|
|
local status, openhkpd_result = msrpc.winreg_openhkpd(smbstate)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, openhkpd_result
|
|
end
|
|
|
|
local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openhkpd_result['handle'], "Counter 009")
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, queryvalue_result
|
|
end
|
|
|
|
-- Parse the title database
|
|
local pos = 1
|
|
local status
|
|
local result = {}
|
|
status, pos, result['title_database'] = parse_perf_title_database(queryvalue_result['value'], pos)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
result['title_database'][0] = "<null>"
|
|
|
|
|
|
if(objects ~= nil and #objects > 0) then
|
|
-- Query for the objects
|
|
local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openhkpd_result['handle'], objects)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, queryvalue_result
|
|
end
|
|
|
|
-- Parse the header
|
|
pos = 1
|
|
local status, data_block
|
|
status, pos, data_block = parse_perf_data_block(queryvalue_result['value'], pos)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
|
|
-- Move past the header
|
|
pos = 1 + data_block['HeaderLength']
|
|
|
|
-- Parse the data sections
|
|
for i = 1, data_block['NumObjectTypes'], 1 do
|
|
local object_start = pos
|
|
|
|
local counter_definitions = {}
|
|
local object_instances = {}
|
|
local counter_definitions = {}
|
|
|
|
-- Get the type of the object (this is basically the class definition -- info about the object instances)
|
|
local status, object_type
|
|
status, pos, object_type = parse_perf_object_type(queryvalue_result['value'], pos)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
|
|
-- Start setting up the result object
|
|
--stdnse.debug1("Index = %d\n", object_type['ObjectNameTitleIndex'])
|
|
local object_name = result['title_database'][object_type['ObjectNameTitleIndex']]
|
|
result[object_name] = {}
|
|
|
|
--stdnse.debug1("\n\nOBJECT: %s\n", object_name)
|
|
--stdnse.debug1(" Counters: %d\n", object_type['NumCounters'])
|
|
--stdnse.debug1(" Instances: %d\n", object_type['NumInstances'])
|
|
--stdnse.debug1("-----------------\n")
|
|
|
|
-- Bring the position to the beginning of the counter definitions
|
|
pos = object_start + object_type['HeaderLength']
|
|
|
|
-- Parse the counter definitions
|
|
for j = 1, object_type['NumCounters'], 1 do
|
|
status, pos, counter_definitions[j] = parse_perf_counter_definition(queryvalue_result['value'], pos)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
--stdnse.debug1(" Counter definition #%2d: [%d bytes] %s\n", j, counter_definitions[j]['CounterSize'], result['title_database'][counter_definitions[j]['CounterNameTitleIndex']])
|
|
end
|
|
|
|
-- Bring the position to the beginning of the instances (or counters)
|
|
pos = object_start + object_type['DefinitionLength']
|
|
|
|
-- Check if we have any instances (sometimes we don't -- if we don't, the value returned is a negative)
|
|
if (object_type['NumInstances'] & 0x80000000) == 0 then
|
|
-- Parse the object instances and counters
|
|
for j = 1, object_type['NumInstances'], 1 do
|
|
local instance_start = pos
|
|
|
|
-- Instance definition
|
|
local status
|
|
status, pos, object_instances[j] = parse_perf_instance_definition(queryvalue_result['value'], pos)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
|
|
-- Set up the instance array
|
|
local instance_name = object_instances[j]['InstanceName']
|
|
result[object_name][instance_name] = {}
|
|
|
|
-- Bring the pos to the start of the counter block
|
|
pos = instance_start + object_instances[j]['ByteLength']
|
|
|
|
--stdnse.debug1("\n INSTANCE: %s\n", instance_name)
|
|
--stdnse.debug1(" Length: %d\n", object_instances[j]['ByteLength'])
|
|
--stdnse.debug1(" NameOffset: %d\n", object_instances[j]['NameOffset'])
|
|
--stdnse.debug1(" NameLength: %d\n", object_instances[j]['NameLength'])
|
|
--stdnse.debug1(" --------------\n")
|
|
|
|
-- The counter block
|
|
local status, counter_block
|
|
status, pos, counter_block = parse_perf_counter_block(queryvalue_result['value'], pos)
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
|
|
for k = 1, object_type['NumCounters'], 1 do
|
|
-- Each individual counter
|
|
local status, counter_result
|
|
status, pos, counter_result = parse_perf_counter(queryvalue_result['value'], pos, counter_definitions[k])
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
|
|
local counter_name = result['title_database'][counter_definitions[k]['CounterNameTitleIndex']]
|
|
--stdnse.debug1(" %s: %s\n", counter_name, counter_result)
|
|
|
|
-- Save it in the result
|
|
result[object_name][instance_name][counter_name] = counter_result
|
|
end
|
|
|
|
-- Bring the pos to the end of the next section
|
|
pos = instance_start + object_instances[j]['ByteLength'] + counter_block['ByteLength']
|
|
end
|
|
else
|
|
for k = 1, object_type['NumCounters'], 1 do
|
|
-- Each individual counter
|
|
local status, counter_result
|
|
status, pos, counter_result = parse_perf_counter(queryvalue_result['value'], pos, counter_definitions[k])
|
|
if(status == false) then
|
|
msrpc.stop_smb(smbstate)
|
|
return false, pos
|
|
end
|
|
|
|
local counter_name = result['title_database'][counter_definitions[k]['CounterNameTitleIndex']]
|
|
--stdnse.debug1(" %s: %s\n", counter_name, counter_result)
|
|
|
|
-- Save it in the result
|
|
result[object_name][counter_name] = counter_result
|
|
end
|
|
end
|
|
end
|
|
|
|
-- Blank out the database
|
|
result['title_database'] = nil
|
|
end
|
|
|
|
msrpc.stop_smb(smbstate)
|
|
|
|
return true, result
|
|
end
|
|
|
|
|
|
|
|
return _ENV;
|