Skip to content

Commit 7f7b17c

Browse files
jvazquez-r7jvazquez-r7
committed
Really add specs
1 parent c213ed3 commit 7f7b17c

File tree

1 file changed

+337
-0
lines changed
  • spec/lib/msf/core/exploit/smb/server/share/information_level

1 file changed

+337
-0
lines changed

‎spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb

Lines changed: 337 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,337 @@
1+
# -*- coding:binary -*-
2+
require 'spec_helper'
3+
4+
require 'msf/core'
5+
require 'msf/core/exploit/smb/server/share'
6+
require 'rex/proto/smb/constants'
7+
8+
describe Msf::Exploit::Remote::SMB::Server::Share do
9+
10+
subject(:mod) do
11+
mod = Msf::Exploit.new
12+
mod.extend described_class
13+
mod.send(:initialize)
14+
15+
mod
16+
end
17+
18+
let(:client_string) { '' }
19+
let(:client) { StringIO.new(client_string) }
20+
21+
let(:default_find_file_both_directory_info_res_length) { 163 }
22+
let(:default_find_file_both_directory_info_res) do
23+
"\x00\x00\x00\x9f\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x88\x01\xc8" +
24+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x48\x47" +
25+
"\x00\x00\x44\x43\x0a\x0a\x00\x5e\x00\x00\x00\x0a\x00\x37\x00\x00" +
26+
"\x00\x5e\x00\x41\x00\x00\x00\x00\x00\x68\x00\xfd\xff\x00\x00\x00" +
27+
"\x00\x00\x00\x00\x00\x5e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
28+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
29+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
30+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
31+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
32+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
33+
"\x00\x00\x00"
34+
end
35+
36+
let(:default_find_file_names_info_res_length) { 81 }
37+
let(:default_find_file_names_info_res) do
38+
"\x00\x00\x00\x4d\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x88\x01\xc8" +
39+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x48\x47" +
40+
"\x00\x00\x44\x43\x0a\x0a\x00\x0c\x00\x00\x00\x0a\x00\x37\x00\x00" +
41+
"\x00\x0c\x00\x41\x00\x00\x00\x00\x00\x16\x00\xfd\xff\x01\x00\x01" +
42+
"\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
43+
"\x00"
44+
end
45+
46+
let(:default_find_full_directory_info_res_length) { 137 }
47+
let(:default_find_full_directory_info_res) do
48+
"\x00\x00\x00\x85\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x88\x01\xc8" +
49+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x48\x47" +
50+
"\x00\x00\x44\x43\x0a\x0a\x00\x44\x00\x00\x00\x0a\x00\x37\x00\x00" +
51+
"\x00\x44\x00\x41\x00\x00\x00\x00\x00\x4e\x00\xfd\xff\x00\x00\x00" +
52+
"\x00\x00\x00\x00\x00\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
53+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
54+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
55+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
56+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
57+
end
58+
59+
let(:non_existent_path) { 'non_existent' }
60+
let(:file_path) { 'test.exe' }
61+
let(:folder_path) { '\\' }
62+
63+
let(:error_res_length) { 39 }
64+
65+
let(:existent_file_file_both_dir_res_length) { 179 }
66+
let(:existent_folder_file_both_dir_res_length) { 165 }
67+
68+
let(:existent_file_file_names_res_length) { 97 }
69+
let(:existent_folder_file_names_res_length) { 83 }
70+
71+
let(:existent_file_file_full_res_length) { 153 }
72+
let(:existent_folder_file_full_res_length) { 139 }
73+
74+
75+
before(:each) do
76+
mod.instance_variable_set('@state', {
77+
client => {
78+
:multiplex_id => 0x41424344,
79+
:process_id => 0x45464748,
80+
:file_id => 0xdead,
81+
:dir_id => 0xbeef
82+
}
83+
})
84+
mod.lo = 0
85+
mod.hi = 0
86+
mod.share = 'test'
87+
mod.path_name = "\\"
88+
mod.file_name = 'test.exe'
89+
mod.file_contents = 'metasploit'
90+
91+
allow_any_instance_of(::StringIO).to receive(:put) do |io, data|
92+
io.write(data)
93+
end
94+
end
95+
96+
describe "#send_find_file_both_directory_info_res" do
97+
context "when no opts" do
98+
it "returns the number of bytes sent" do
99+
expect(mod.send_find_file_both_directory_info_res(client)).to eq(default_find_file_both_directory_info_res_length)
100+
end
101+
102+
it "sends a default TRANSACTION2 response" do
103+
mod.send_find_file_both_directory_info_res(client)
104+
client.seek(0)
105+
res = client.read
106+
expect(res).to eq(default_find_file_both_directory_info_res)
107+
end
108+
end
109+
end
110+
111+
describe "#send_find_file_names_info_res" do
112+
context "when no opts" do
113+
it "returns the number of bytes sent" do
114+
expect(mod.send_find_file_names_info_res(client)).to eq(default_find_file_names_info_res_length)
115+
end
116+
117+
it "sends a default TRANSACTION2 response" do
118+
mod.send_find_file_names_info_res(client)
119+
client.seek(0)
120+
res = client.read
121+
expect(res).to eq(default_find_file_names_info_res)
122+
end
123+
end
124+
end
125+
126+
describe "#send_find_full_directory_info_res" do
127+
context "when no opts" do
128+
it "returns the number of bytes sent" do
129+
expect(mod.send_find_full_directory_info_res(client)).to eq(default_find_full_directory_info_res_length)
130+
end
131+
132+
it "sends a default TRANSACTION2 response" do
133+
mod.send_find_full_directory_info_res(client)
134+
client.seek(0)
135+
res = client.read
136+
expect(res).to eq(default_find_full_directory_info_res)
137+
end
138+
end
139+
end
140+
141+
describe "#smb_cmd_find_file_both_directory_info" do
142+
context "when non existent path" do
143+
it "returns the number of bytes sent" do
144+
expect(mod.smb_cmd_find_file_both_directory_info(client, non_existent_path)).to eq(error_res_length)
145+
end
146+
147+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
148+
mod.smb_cmd_find_file_both_directory_info(client, non_existent_path)
149+
client.seek(0)
150+
res = client.read
151+
152+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
153+
trans2_res.from_s(res)
154+
155+
expect(trans2_res['Payload']['SMB'].v['ErrorClass']).to eq(Rex::Proto::SMB::Constants::SMB_STATUS_NO_SUCH_FILE)
156+
end
157+
end
158+
159+
context "when existent file path" do
160+
it "returns the number of bytes sent" do
161+
expect(mod.smb_cmd_find_file_both_directory_info(client, file_path)).to eq(existent_file_file_both_dir_res_length)
162+
end
163+
164+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
165+
mod.smb_cmd_find_file_both_directory_info(client, file_path)
166+
client.seek(0)
167+
res = client.read
168+
169+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
170+
trans2_res.from_s(res)
171+
param_count = trans2_res['Payload'].v['ParamCount']
172+
data_count = trans2_res['Payload'].v['DataCount']
173+
174+
data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count]
175+
smb_data = Rex::Proto::SMB::Constants::SMB_FIND_FILE_BOTH_DIRECTORY_INFO_HDR.make_struct
176+
smb_data.from_s(data)
177+
178+
expect(smb_data.v['FileName']).to eq(Rex::Text.to_unicode(mod.file_name))
179+
end
180+
end
181+
182+
context "when existent folder path" do
183+
it "returns the number of bytes sent" do
184+
expect(mod.smb_cmd_find_file_both_directory_info(client, folder_path)).to eq(existent_folder_file_both_dir_res_length)
185+
end
186+
187+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
188+
mod.smb_cmd_find_file_both_directory_info(client, folder_path)
189+
client.seek(0)
190+
res = client.read
191+
192+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
193+
trans2_res.from_s(res)
194+
param_count = trans2_res['Payload'].v['ParamCount']
195+
data_count = trans2_res['Payload'].v['DataCount']
196+
197+
data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count]
198+
smb_data = Rex::Proto::SMB::Constants::SMB_FIND_FILE_BOTH_DIRECTORY_INFO_HDR.make_struct
199+
smb_data.from_s(data)
200+
201+
expect(smb_data.v['FileName']).to eq(Rex::Text.to_unicode(mod.path_name))
202+
end
203+
end
204+
end
205+
206+
describe "#smb_cmd_find_file_names_info" do
207+
context "when non existent path" do
208+
it "returns the number of bytes sent" do
209+
expect(mod.smb_cmd_find_file_names_info(client, non_existent_path)).to eq(error_res_length)
210+
end
211+
212+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
213+
mod.smb_cmd_find_file_names_info(client, non_existent_path)
214+
client.seek(0)
215+
res = client.read
216+
217+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
218+
trans2_res.from_s(res)
219+
220+
expect(trans2_res['Payload']['SMB'].v['ErrorClass']).to eq(Rex::Proto::SMB::Constants::SMB_STATUS_NO_SUCH_FILE)
221+
end
222+
end
223+
224+
context "when existent file path" do
225+
it "returns the number of bytes sent" do
226+
expect(mod.smb_cmd_find_file_names_info(client, file_path)).to eq(existent_file_file_names_res_length)
227+
end
228+
229+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
230+
mod.smb_cmd_find_file_names_info(client, file_path)
231+
client.seek(0)
232+
res = client.read
233+
234+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
235+
trans2_res.from_s(res)
236+
param_count = trans2_res['Payload'].v['ParamCount']
237+
data_count = trans2_res['Payload'].v['DataCount']
238+
239+
data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count]
240+
smb_data = Rex::Proto::SMB::Constants::SMB_FIND_FILE_NAMES_INFO_HDR.make_struct
241+
smb_data.from_s(data)
242+
243+
expect(smb_data.v['FileName']).to eq(Rex::Text.to_unicode(mod.file_name))
244+
end
245+
end
246+
247+
context "when existent folder path" do
248+
it "returns the number of bytes sent" do
249+
expect(mod.smb_cmd_find_file_names_info(client, folder_path)).to eq(existent_folder_file_names_res_length)
250+
end
251+
252+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
253+
mod.smb_cmd_find_file_names_info(client, folder_path)
254+
client.seek(0)
255+
res = client.read
256+
257+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
258+
trans2_res.from_s(res)
259+
param_count = trans2_res['Payload'].v['ParamCount']
260+
data_count = trans2_res['Payload'].v['DataCount']
261+
262+
data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count]
263+
smb_data = Rex::Proto::SMB::Constants::SMB_FIND_FILE_NAMES_INFO_HDR.make_struct
264+
smb_data.from_s(data)
265+
266+
expect(smb_data.v['FileName']).to eq(Rex::Text.to_unicode(mod.path_name))
267+
end
268+
end
269+
end
270+
271+
describe "#smb_cmd_find_file_full_directory_info" do
272+
context "when non existent path" do
273+
it "returns the number of bytes sent" do
274+
expect(mod.smb_cmd_find_file_full_directory_info(client, non_existent_path)).to eq(error_res_length)
275+
end
276+
277+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
278+
mod.smb_cmd_find_file_full_directory_info(client, non_existent_path)
279+
client.seek(0)
280+
res = client.read
281+
282+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
283+
trans2_res.from_s(res)
284+
285+
expect(trans2_res['Payload']['SMB'].v['ErrorClass']).to eq(Rex::Proto::SMB::Constants::SMB_STATUS_NO_SUCH_FILE)
286+
end
287+
end
288+
289+
context "when existent file path" do
290+
it "returns the number of bytes sent" do
291+
expect(mod.smb_cmd_find_file_full_directory_info(client, file_path)).to eq(existent_file_file_full_res_length)
292+
end
293+
294+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
295+
mod.smb_cmd_find_file_full_directory_info(client, file_path)
296+
client.seek(0)
297+
res = client.read
298+
299+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
300+
trans2_res.from_s(res)
301+
param_count = trans2_res['Payload'].v['ParamCount']
302+
data_count = trans2_res['Payload'].v['DataCount']
303+
304+
data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count]
305+
smb_data = Rex::Proto::SMB::Constants::SMB_FIND_FILE_FULL_DIRECTORY_INFO_HDR.make_struct
306+
smb_data.from_s(data)
307+
308+
expect(smb_data.v['FileName']).to eq(Rex::Text.to_unicode(mod.file_name))
309+
end
310+
end
311+
312+
context "when existent folder path" do
313+
it "returns the number of bytes sent" do
314+
expect(mod.smb_cmd_find_file_full_directory_info(client, folder_path)).to eq(existent_folder_file_full_res_length)
315+
end
316+
317+
it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do
318+
mod.smb_cmd_find_file_full_directory_info(client, folder_path)
319+
client.seek(0)
320+
res = client.read
321+
322+
trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct
323+
trans2_res.from_s(res)
324+
param_count = trans2_res['Payload'].v['ParamCount']
325+
data_count = trans2_res['Payload'].v['DataCount']
326+
327+
data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count]
328+
smb_data = Rex::Proto::SMB::Constants::SMB_FIND_FILE_FULL_DIRECTORY_INFO_HDR.make_struct
329+
smb_data.from_s(data)
330+
331+
expect(smb_data.v['FileName']).to eq(Rex::Text.to_unicode(mod.path_name))
332+
end
333+
end
334+
end
335+
end
336+
337+

0 commit comments

Comments
 (0)