Cortana Tutorial - Armitage

stores binary data in a string. So long as you do not use character processing functions, the
content of the string will not change.
It is the scripter's responsibility to make local resources available on a remote server
before Metasploit references them. If Metasploit is running locally, these functions will
continue to work as expected.
Locking
Sometimes it is desirable for a script to signal to other scripts that they should not perform
an action or touch a resource for a time. Armitage and Cortana do this implicity with shell
sessions. If your script sends a command to a shell sesssion, Cortana queues the command,
and attempts to gain a lock for the shell before executing your script's commands.
It's possible to create your own locks using the &lock function. One place this is used in
Cortana is the &host_import function. This function uses the db_import console command
to import a file. If two scripts try to import a file at the same time, one or both imports will
fail. It's important to prevent this if possible. Here's how it's done:
sub host_import {
lock("db_import_lock_internal", 1, $1);
}
The &host_import function requests a lock for db_import_lock_internal. The second
parameter indicates that the lock should not be freed automatically after the locked_*
event handlers finish, rather the script would prefer to release the lock when it's ready.
This is safe to do by the way. If a client disconnects from the team server, all of its locks are
automatically freed.
Additional parameters to the lock function are stored and passed to the locked event when
it fires. The argument passing to the lock is important. It's possible that a script may want
to request a lock several times with different variations on each call. The argument passing
allows that script to differentiate between requests and service the right one.
Here's the locked event for our db_import_lock_internal lock:
on locked_db_import_lock_internal {
when('console_db_import', lambda({
fire_event_local("db_import", $hostf);
unlock("db_import_lock_internal");
}, $hostf => $1));
cmd_async("db_import \" $+ $1 $+ \"");
}
The locked_db_import_lock_internal event is fired when our script gains the requested
lock. The first thing our listener does is register a one-­‐time listener for the db_import
console command to complete. It then asynchronously executes the db_import command
with the argument passed by the &lock function.
Once the import completes, our one-­‐time listener fires and releases the lock.
23