Skip to content

Commit 544f886

Browse files
jvazquez-r7jvazquez-r7
committed
Merge more mixin refactor
2 parents a3097b2 + e5e1310 commit 544f886

File tree

5 files changed

+147
-161
lines changed

5 files changed

+147
-161
lines changed

‎lib/msf/core/exploit/smb/server/share/command/close.rb

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ module Close
99
# Responds to a client CLOSE request
1010
#
1111
def smb_cmd_close(c, buff)
12+
send_close_res(c)
13+
end
14+
15+
def send_close_res(c)
1216
pkt = CONST::SMB_CLOSE_RES_PKT.make_struct
1317
smb_set_defaults(c, pkt)
1418

‎lib/msf/core/exploit/smb/server/share/command/negotiate.rb

Lines changed: 35 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,32 @@ def smb_cmd_negotiate(c, buff)
1515
dialects = pkt['Payload'].v['Payload'].gsub(/\x00/, '').split(/\x02/).grep(/^\w+/)
1616
dialect = dialects.index("NT LM 0.12") || dialects.length-1
1717

18+
send_negotitate_res(c, {
19+
dialect: dialect,
20+
security_mode: CONST::NEG_SECURITY_PASSWORD,
21+
max_mpx: 50,
22+
max_vcs: 1,
23+
max_buff: 4356,
24+
max_raw: 65536,
25+
server_time_zone: 0,
26+
capabilities: CAPABILITIES,
27+
key_length: 8,
28+
key: Rex::Text.rand_text_hex(8)
29+
})
30+
end
31+
32+
def send_negotitate_res(c, opts = {})
33+
dialect = opts[:dialect] || 0
34+
security_mode = opts[:security_mode] || 0
35+
max_mpx = opts[:max_mpx] || 0
36+
max_vcs = opts[:max_vcs] || 0
37+
max_buff = opts[:max_buff] || 0
38+
max_raw = opts[:max_raw] || 0
39+
server_time_zone = opts[:server_time_zone] || 0
40+
capabilities = opts[:capabilities] || 0
41+
key_length = opts[:key_length] || 0
42+
key = opts[:key] || ''
43+
1844
pkt = CONST::SMB_NEG_RES_NT_PKT.make_struct
1945
smb_set_defaults(c, pkt)
2046

@@ -23,18 +49,18 @@ def smb_cmd_negotiate(c, buff)
2349
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
2450
pkt['Payload']['SMB'].v['WordCount'] = 17
2551
pkt['Payload'].v['Dialect'] = dialect
26-
pkt['Payload'].v['SecurityMode'] = CONST::NEG_SECURITY_PASSWORD
27-
pkt['Payload'].v['MaxMPX'] = 50
28-
pkt['Payload'].v['MaxVCS'] = 1
29-
pkt['Payload'].v['MaxBuff'] = 4356
30-
pkt['Payload'].v['MaxRaw'] = 65536
52+
pkt['Payload'].v['SecurityMode'] = security_mode
53+
pkt['Payload'].v['MaxMPX'] = max_mpx
54+
pkt['Payload'].v['MaxVCS'] = max_vcs
55+
pkt['Payload'].v['MaxBuff'] = max_buff
56+
pkt['Payload'].v['MaxRaw'] = max_raw
3157
pkt['Payload'].v['SystemTimeLow'] = lo
3258
pkt['Payload'].v['SystemTimeHigh'] = hi
33-
pkt['Payload'].v['ServerTimeZone'] = 0x0
59+
pkt['Payload'].v['ServerTimeZone'] = server_time_zone
3460
pkt['Payload'].v['SessionKey'] = 0
35-
pkt['Payload'].v['Capabilities'] = CAPABILITIES
36-
pkt['Payload'].v['KeyLength'] = 8
37-
pkt['Payload'].v['Payload'] = Rex::Text.rand_text_hex(8)
61+
pkt['Payload'].v['Capabilities'] = capabilities
62+
pkt['Payload'].v['KeyLength'] = key_length
63+
pkt['Payload'].v['Payload'] = key
3864

3965
c.put(pkt.to_s)
4066
end

‎lib/msf/core/exploit/smb/server/share/command/nt_create_andx.rb

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,22 @@ def smb_cmd_create(c, buff)
3838
return
3939
end
4040

41+
send_nt_create_andx_res(c, {
42+
file_id: fid,
43+
attributes: attribs,
44+
end_of_file_low: eof,
45+
is_directory: is_dir,
46+
alloc_low: 0x100000
47+
})
48+
end
49+
50+
def send_nt_create_andx_res(c, opts = {})
51+
file_id = opts[:file_id] || 0
52+
attributes = opts[:attributes] || 0
53+
end_of_file_low = opts[:end_of_file_low] || 0
54+
is_directory = opts[:is_directory] || 0
55+
alloc_low = opts[:alloc_low] || 0
56+
4157
pkt = CONST::SMB_CREATE_ANDX_RES_PKT.make_struct
4258
smb_set_defaults(c, pkt)
4359
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_NT_CREATE_ANDX
@@ -46,7 +62,7 @@ def smb_cmd_create(c, buff)
4662
pkt['Payload']['SMB'].v['WordCount'] = 42
4763
pkt['Payload'].v['AndX'] = CONST::SMB_COM_NO_ANDX_COMMAND
4864
pkt['Payload'].v['OpLock'] = CONST::LEVEL_II_OPLOCK # Grant Oplock on File
49-
pkt['Payload'].v['FileID'] = fid
65+
pkt['Payload'].v['FileID'] = file_id
5066
pkt['Payload'].v['Action'] = CONST::FILE_OPEN # The file existed and was opened
5167
pkt['Payload'].v['CreateTimeLow'] = lo
5268
pkt['Payload'].v['CreateTimeHigh'] = hi
@@ -56,14 +72,14 @@ def smb_cmd_create(c, buff)
5672
pkt['Payload'].v['WriteTimeHigh'] = hi
5773
pkt['Payload'].v['ChangeTimeLow'] = lo
5874
pkt['Payload'].v['ChangeTimeHigh'] = hi
59-
pkt['Payload'].v['Attributes'] = attribs
60-
pkt['Payload'].v['AllocLow'] = 0x100000
75+
pkt['Payload'].v['Attributes'] = attributes
76+
pkt['Payload'].v['AllocLow'] = alloc_low
6177
pkt['Payload'].v['AllocHigh'] = 0
62-
pkt['Payload'].v['EOFLow'] = eof
78+
pkt['Payload'].v['EOFLow'] = end_of_file_low
6379
pkt['Payload'].v['EOFHigh'] = 0
6480
pkt['Payload'].v['FileType'] = CONST::SMB_RESOURCE_FILE_TYPE_DISK
6581
pkt['Payload'].v['IPCState'] = 0x7 # Number maxim of instance a named pipe can have
66-
pkt['Payload'].v['IsDirectory'] = is_dir
82+
pkt['Payload'].v['IsDirectory'] = is_directory
6783
pkt['Payload'].v['MaxAccess'] = CREATE_MAX_ACCESS
6884
c.put(pkt.to_s)
6985
end

‎lib/msf/core/exploit/smb/server/share/command/read_andx.rb

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,18 @@ def smb_cmd_read(c, buff)
1818
offset = pkt['Payload'].v['Offset']
1919
length = pkt['Payload'].v['MaxCountLow']
2020

21+
send_read_andx_res(c, {
22+
data_len_low: length,
23+
byte_count: length,
24+
data: exe_contents[offset, length]
25+
})
26+
end
27+
28+
def send_read_andx_res(c, opts = {})
29+
data_len_low = opts[:data_len_low]
30+
byte_count = opts[:byte_count]
31+
data = opts[:data]
32+
2133
pkt = CONST::SMB_READ_RES_PKT.make_struct
2234
smb_set_defaults(c, pkt)
2335

@@ -27,13 +39,13 @@ def smb_cmd_read(c, buff)
2739
pkt['Payload']['SMB'].v['WordCount'] = 12
2840
pkt['Payload'].v['AndX'] = CONST::SMB_COM_NO_ANDX_COMMAND
2941
pkt['Payload'].v['Remaining'] = 0xffff
30-
pkt['Payload'].v['DataLenLow'] = length
42+
pkt['Payload'].v['DataLenLow'] = data_len_low
3143
pkt['Payload'].v['DataOffset'] = CONST::SMB_READ_RES_HDR_PKT_LENGTH
3244
pkt['Payload'].v['DataLenHigh'] = 0
3345
pkt['Payload'].v['Reserved3'] = 0
3446
pkt['Payload'].v['Reserved4'] = 0x0a
35-
pkt['Payload'].v['ByteCount'] = length
36-
pkt['Payload'].v['Payload'] = exe_contents[offset, length]
47+
pkt['Payload'].v['ByteCount'] = byte_count
48+
pkt['Payload'].v['Payload'] = data
3749
c.put(pkt.to_s)
3850
end
3951
end

0 commit comments

Comments
 (0)