@@ -150,7 +150,7 @@ def make_smb_trans2_doublepulsar(tree_id)
150
150
151
151
# opcode 0x0e = SESSION_SETUP
152
152
setup = "\x0e \x00 \x00 \x00 "
153
- setup_count = 1 # 2 words
153
+ setup_count = 1 # 1 word
154
154
trans = "\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 "
155
155
156
156
# calculate offsets to the SetupData payload
@@ -162,7 +162,7 @@ def make_smb_trans2_doublepulsar(tree_id)
162
162
pkt [ 'Payload' ] [ 'SMB' ] . v [ 'Command' ] = Rex ::Proto ::SMB ::Constants ::SMB_COM_TRANSACTION2
163
163
pkt [ 'Payload' ] [ 'SMB' ] . v [ 'Flags1' ] = 0x18
164
164
pkt [ 'Payload' ] [ 'SMB' ] . v [ 'MultiplexID' ] = 65
165
- pkt [ 'Payload' ] [ 'SMB' ] . v [ 'Flags2' ] = 0xc007 # 0xc803 would unicode
165
+ pkt [ 'Payload' ] [ 'SMB' ] . v [ 'Flags2' ] = 0xc007
166
166
pkt [ 'Payload' ] [ 'SMB' ] . v [ 'TreeID' ] = tree_id
167
167
pkt [ 'Payload' ] [ 'SMB' ] . v [ 'WordCount' ] = 14 + setup_count
168
168
pkt [ 'Payload' ] . v [ 'Timeout' ] = 0x00a4d9a6
@@ -173,7 +173,6 @@ def make_smb_trans2_doublepulsar(tree_id)
173
173
pkt [ 'Payload' ] . v [ 'ParamOffset' ] = 66
174
174
pkt [ 'Payload' ] . v [ 'DataOffset' ] = 78
175
175
176
- # actual magic: PeekNamedPipe FID=0, \PIPE\
177
176
pkt [ 'Payload' ] . v [ 'SetupCount' ] = setup_count
178
177
pkt [ 'Payload' ] . v [ 'SetupData' ] = setup
179
178
pkt [ 'Payload' ] . v [ 'Payload' ] = trans
0 commit comments