|
| 1 | +# -*- coding:binary -*- |
| 2 | +require 'spec_helper' |
| 3 | + |
| 4 | +require 'msf/core' |
| 5 | +require 'msf/core/exploit/smb/server/share' |
| 6 | +require 'rex/proto/smb/constants' |
| 7 | + |
| 8 | +describe Msf::Exploit::Remote::SMB::Server::Share do |
| 9 | + |
| 10 | + subject(:mod) do |
| 11 | + mod = Msf::Exploit.new |
| 12 | + mod.extend described_class |
| 13 | + mod.send(:initialize) |
| 14 | + |
| 15 | + mod |
| 16 | + end |
| 17 | + |
| 18 | + let(:client_string) { '' } |
| 19 | + let(:client) { StringIO.new(client_string) } |
| 20 | + |
| 21 | + let(:valid_query_file_standard_info_params) do |
| 22 | + "\xad\xde\xed\x03" |
| 23 | + end |
| 24 | + let(:query_file_standard_info_res_length) { 83 } |
| 25 | + |
| 26 | + before(:each) do |
| 27 | + mod.instance_variable_set('@state', { |
| 28 | + client => { |
| 29 | + :multiplex_id => 0x41424344, |
| 30 | + :process_id => 0x45464748, |
| 31 | + :file_id => 0xdead, |
| 32 | + :dir_id => 0xbeef |
| 33 | + } |
| 34 | + }) |
| 35 | + mod.lo = 0 |
| 36 | + mod.hi = 0 |
| 37 | + mod.share = 'test' |
| 38 | + mod.path_name = "\\" |
| 39 | + mod.file_name = 'test.exe' |
| 40 | + mod.file_contents = 'metasploit' |
| 41 | + |
| 42 | + allow_any_instance_of(::StringIO).to receive(:put) do |io, data| |
| 43 | + io.write(data) |
| 44 | + end |
| 45 | + end |
| 46 | + |
| 47 | + describe "#smb_cmd_trans2_query_file_information" do |
| 48 | + |
| 49 | + context "when valid SMB_QUERY_FILE_STANDARD_INFO parameters" do |
| 50 | + it "returns the number of bytes answered" do |
| 51 | + expect(mod.smb_cmd_trans2_query_file_information(client, valid_query_file_standard_info_params)).to eq(query_file_standard_info_res_length) |
| 52 | + end |
| 53 | + |
| 54 | + it "send SMB_QUERY_FILE_STANDARD_INFO response with the file size" do |
| 55 | + mod.smb_cmd_trans2_query_file_information(client, valid_query_file_standard_info_params) |
| 56 | + client.seek(0) |
| 57 | + res = client.read |
| 58 | + |
| 59 | + trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct |
| 60 | + trans2_res.from_s(res) |
| 61 | + param_count = trans2_res['Payload'].v['ParamCount'] |
| 62 | + data_count = trans2_res['Payload'].v['DataCount'] |
| 63 | + |
| 64 | + data = trans2_res['Payload'].v['SetupData'][2 + param_count, data_count] |
| 65 | + smb_data = Rex::Proto::SMB::Constants::SMB_QUERY_FILE_STANDARD_INFO_HDR.make_struct |
| 66 | + smb_data.from_s(data) |
| 67 | + |
| 68 | + expect(smb_data.v['EndOfFile']).to eq(mod.file_contents.length) |
| 69 | + end |
| 70 | + end |
| 71 | + end |
| 72 | + |
| 73 | +end |
| 74 | + |
| 75 | + |
0 commit comments