Skip to content

Commit a3097b2

Browse files
jvazquez-r7jvazquez-r7
committed
Merge find information level refactoring
2 parents 6d6d5a7 + d544da2 commit a3097b2

File tree

14 files changed

+175
-237
lines changed

14 files changed

+175
-237
lines changed

‎lib/msf/core/exploit/smb/server.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ def smb_error(cmd, c, errorclass, esn = false)
133133
pkt = CONST::SMB_BASE_PKT.make_struct
134134
smb_set_defaults(c, pkt)
135135
pkt['Payload']['SMB'].v['Command'] = cmd
136-
pkt['Payload']['SMB'].v['Flags1'] = 0x88
136+
pkt['Payload']['SMB'].v['Flags1'] = CONST::FLAGS_REQ_RES | CONST::FLAGS_CASE_SENSITIVE
137137
if esn
138138
pkt['Payload']['SMB'].v['Flags2'] =
139139
CONST::FLAGS2_UNICODE_STRINGS +

‎lib/msf/core/exploit/smb/server/share.rb

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,6 @@ module Share
6666
CONST::SMB_WRITE_OWNER_ACCESS |
6767
CONST::SMB_SYNC_ACCESS
6868

69-
UNICODE_NULL_LENGTH = 2
70-
7169
attr_accessor :unc
7270
attr_accessor :share
7371
attr_accessor :path_name
@@ -87,14 +85,6 @@ def initialize(info = {})
8785
], Msf::Exploit::Remote::SMB::Server::Share)
8886
end
8987

90-
#
91-
# Debugging
92-
#
93-
def dprint(msg)
94-
$stdout.puts "#{msg}"
95-
#dlog("#{msg}", 'rex', LEV_3)
96-
end
97-
9888
def setup
9989
super
10090

@@ -140,7 +130,6 @@ def smb_conn(c)
140130
#
141131
def smb_cmd_dispatch(cmd, c, buff)
142132
smb = @state[c]
143-
#dprint("Received command #{cmd.to_s(16)} from #{smb[:name]}")
144133

145134
pkt = CONST::SMB_BASE_PKT.make_struct
146135
pkt.from_s(buff)
@@ -154,11 +143,11 @@ def smb_cmd_dispatch(cmd, c, buff)
154143
when CONST::SMB_COM_NEGOTIATE
155144
smb_cmd_negotiate(c, buff)
156145
when CONST::SMB_COM_SESSION_SETUP_ANDX
157-
wordcount = pkt['Payload']['SMB'].v['WordCount']
158-
if wordcount == 0x0D # Share Security Mode sessions
146+
word_count = pkt['Payload']['SMB'].v['WordCount']
147+
if word_count == 0x0D # Share Security Mode sessions
159148
smb_cmd_session_setup(c, buff)
160149
else
161-
dprint("SMB Share - #{smb[:ip]} Unknown SMB_COM_SESSION_SETUP_ANDX request type , ignoring... ")
150+
print_status("SMB Share - #{smb[:ip]} Unknown SMB_COM_SESSION_SETUP_ANDX request type , ignoring... ")
162151
smb_error(cmd, c, CONST::SMB_STATUS_SUCCESS)
163152
end
164153
when CONST::SMB_COM_TRANSACTION2

‎lib/msf/core/exploit/smb/server/share/command/close.rb

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ module Close
99
# Responds to a client CLOSE request
1010
#
1111
def smb_cmd_close(c, buff)
12-
dprint("[SMB_CMD_CLOSE]")
13-
pkt = CONST::SMB_CLOSE_PKT.make_struct
14-
pkt.from_s(buff)
15-
1612
pkt = CONST::SMB_CLOSE_RES_PKT.make_struct
1713
smb_set_defaults(c, pkt)
1814

‎lib/msf/core/exploit/smb/server/share/command/negotiate.rb

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,10 @@ module Negotiate
99
# Negotiates a SHARE session with the client
1010
#
1111
def smb_cmd_negotiate(c, buff)
12-
dprint("[SMB_CMD_NEGOTIATE]")
1312
pkt = CONST::SMB_NEG_PKT.make_struct
1413
pkt.from_s(buff)
1514

1615
dialects = pkt['Payload'].v['Payload'].gsub(/\x00/, '').split(/\x02/).grep(/^\w+/)
17-
1816
dialect = dialects.index("NT LM 0.12") || dialects.length-1
1917

2018
pkt = CONST::SMB_NEG_RES_NT_PKT.make_struct

‎lib/msf/core/exploit/smb/server/share/command/nt_create_andx.rb

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ module NtCreateAndx
99
# Responds to a client NT_CREATE_ANDX request
1010
#
1111
def smb_cmd_create(c, buff)
12-
dprint("[SMB_CMD_CREATE]")
1312
smb = @state[c]
1413
pkt = CONST::SMB_CREATE_PKT.make_struct
1514
pkt.from_s(buff)
@@ -25,23 +24,17 @@ def smb_cmd_create(c, buff)
2524

2625
if payload.ends_with?(file_name)
2726
fid = smb[:file_id].to_i
28-
attribs = 0x80 # File Attributes
27+
attribs = CONST::SMB_EXT_FILE_ATTR_NORMAL
2928
eof = exe_contents.length
3029
is_dir = 0
3130
elsif payload.eql?(path_name)
3231
fid = smb[:dir_id].to_i
33-
attribs = 0x10 # Ordinary Dir
32+
attribs = CONST::SMB_EXT_FILE_ATTR_DIRECTORY
3433
eof = 0
3534
is_dir = 1
3635
else
3736
# Otherwise send not found
38-
pkt = CONST::SMB_CREATE_RES_PKT.make_struct
39-
smb_set_defaults(c, pkt)
40-
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_NT_CREATE_ANDX
41-
pkt['Payload']['SMB'].v['ErrorClass'] = CONST::SMB_STATUS_OBJECT_NAME_NOT_FOUND
42-
pkt['Payload']['SMB'].v['Flags1'] = FLAGS
43-
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
44-
c.put(pkt.to_s)
37+
smb_error(CONST::SMB_COM_NT_CREATE_ANDX, c, CONST::SMB_STATUS_OBJECT_NAME_NOT_FOUND, true)
4538
return
4639
end
4740

@@ -51,7 +44,7 @@ def smb_cmd_create(c, buff)
5144
pkt['Payload']['SMB'].v['Flags1'] = FLAGS
5245
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
5346
pkt['Payload']['SMB'].v['WordCount'] = 42
54-
pkt['Payload'].v['AndX'] = 0xff # no further commands
47+
pkt['Payload'].v['AndX'] = CONST::SMB_COM_NO_ANDX_COMMAND
5548
pkt['Payload'].v['OpLock'] = CONST::LEVEL_II_OPLOCK # Grant Oplock on File
5649
pkt['Payload'].v['FileID'] = fid
5750
pkt['Payload'].v['Action'] = CONST::FILE_OPEN # The file existed and was opened

‎lib/msf/core/exploit/smb/server/share/command/read_andx.rb

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ module ReadAndx
1212
# and sending the appropriate chunk of the payload
1313
#
1414
def smb_cmd_read(c, buff)
15-
dprint("[SMB_CMD_READ]")
1615
pkt = CONST::SMB_READ_PKT.make_struct
1716
pkt.from_s(buff)
1817

@@ -26,7 +25,7 @@ def smb_cmd_read(c, buff)
2625
pkt['Payload']['SMB'].v['Flags1'] = FLAGS
2726
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
2827
pkt['Payload']['SMB'].v['WordCount'] = 12
29-
pkt['Payload'].v['AndX'] = 0xff # no more commands
28+
pkt['Payload'].v['AndX'] = CONST::SMB_COM_NO_ANDX_COMMAND
3029
pkt['Payload'].v['Remaining'] = 0xffff
3130
pkt['Payload'].v['DataLenLow'] = length
3231
pkt['Payload'].v['DataOffset'] = CONST::SMB_READ_RES_HDR_PKT_LENGTH

‎lib/msf/core/exploit/smb/server/share/command/session_setup_andx.rb

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,9 @@ module SessionSetupAndx
99
# Sets up an SMB session in response to a SESSION_SETUP_ANDX request
1010
#
1111
def smb_cmd_session_setup(c, buff)
12-
dprint("[SMB_CMD_SESSION_SETUP]")
13-
1412
tree_connect_response = CONST::SMB_TREE_CONN_ANDX_RES_PKT.make_struct
1513
tree_connect_response.v['WordCount'] = 7
16-
tree_connect_response.v['AndXCommand'] = 0xff
14+
tree_connect_response.v['AndXCommand'] = CONST::SMB_COM_NO_ANDX_COMMAND
1715
tree_connect_response.v['AndXReserved'] = 0
1816
tree_connect_response.v['AndXOffset'] = 0
1917
tree_connect_response.v['OptionalSupport'] = 1
@@ -28,7 +26,7 @@ def smb_cmd_session_setup(c, buff)
2826
pkt['Payload']['SMB'].v['Flags1'] = FLAGS
2927
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
3028
pkt['Payload']['SMB'].v['WordCount'] = 3
31-
pkt['Payload'].v['AndX'] = 0x75
29+
pkt['Payload'].v['AndX'] = CONST::SMB_COM_TREE_CONNECT_ANDX
3230
pkt['Payload'].v['Reserved1'] = 00
3331
pkt['Payload'].v['AndXOffset'] = 96
3432
pkt['Payload'].v['Action'] = CONST::SMB_SETUP_GUEST

‎lib/msf/core/exploit/smb/server/share/command/trans2.rb

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,29 +24,40 @@ def smb_cmd_trans(c, buff)
2424
data_trans2.from_s(pkt['Payload'].v['SetupData'])
2525

2626
sub_command = data_trans2.v['SubCommand']
27+
parameters = data_trans2.v['Parameters'].gsub(/^[\x00]*/, '') #delete padding
2728

2829
case sub_command
2930
when CONST::TRANS2_QUERY_FILE_INFO
30-
parameters = data_trans2.v['Parameters'].gsub(/^[\x00]*/, '') #delete padding
3131
smb_cmd_trans2_query_file_information(c, parameters)
3232
when CONST::TRANS2_QUERY_PATH_INFO
33-
parameters = data_trans2.v['Parameters'].gsub(/^[\x00]*/, '') #delete padding
3433
smb_cmd_trans2_query_path_information(c, parameters)
3534
when CONST::TRANS2_FIND_FIRST2
36-
parameters = data_trans2.v['Parameters'].gsub(/^[\x00]*/, '') #delete padding
3735
smb_cmd_trans2_find_first2(c, parameters)
3836
else
39-
dprint("\t[Unsupported/Unknown command] SUB_COMMAND: #{sub_command}")
40-
pkt = CONST::SMB_TRANS_RES_PKT.make_struct
41-
smb_set_defaults(c, pkt)
42-
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_TRANSACTION2
43-
pkt['Payload']['SMB'].v['Flags1'] = FLAGS
44-
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
45-
pkt['Payload']['SMB'].v['ErrorClass'] = 0xc0000225 # NT_STATUS_NOT_FOUND
46-
c.put(pkt.to_s)
37+
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_NT_STATUS_NOT_FOUND, true)
4738
end
4839
end
4940

41+
def send_trans2_res(c, parameters, data)
42+
pkt = CONST::SMB_TRANS_RES_PKT.make_struct
43+
smb_set_defaults(c, pkt)
44+
45+
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_TRANSACTION2
46+
pkt['Payload']['SMB'].v['Flags1'] = FLAGS
47+
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
48+
pkt['Payload']['SMB'].v['WordCount'] = 10
49+
pkt['Payload'].v['ParamCountTotal'] = parameters.to_s.length
50+
pkt['Payload'].v['DataCountTotal'] = data.to_s.length
51+
pkt['Payload'].v['ParamCount'] = parameters.to_s.length
52+
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
53+
pkt['Payload'].v['DataCount'] = data.to_s.length
54+
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + parameters.to_s.length
55+
pkt['Payload'].v['Payload'] =
56+
parameters.to_s +
57+
data.to_s
58+
59+
c.put(pkt.to_s)
60+
end
5061
end
5162
end
5263
end

‎lib/msf/core/exploit/smb/server/share/command/trans2/find_first2.rb

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ def smb_cmd_trans2_find_first2(c, buff)
1818
search_path.gsub!(/[\x00]*/, '') #delete padding
1919
search_path.gsub!(/\\x([0-9a-f]{2})/i, '') # delete hex chars
2020

21-
# Do some dummy managing for wildcards
22-
# TODO: improve
21+
# Do some managing for wildcards
22+
# TODO: Make it better / complete
2323
search_path.gsub!(/<\./, '*.') # manage wildcards
2424
extension = File.extname(file_name)
2525
if search_path == "#{path_name}*#{extension}"
@@ -34,8 +34,7 @@ def smb_cmd_trans2_find_first2(c, buff)
3434
when CONST::SMB_FIND_FILE_FULL_DIRECTORY_INFO
3535
smb_cmd_find_file_full_directory_info(c, search_path)
3636
else
37-
dprint("\t\tUnknown LOI [smb_cmd_trans2_find_first2] - #{loi}")
38-
# SEND success with the hope of going ahead...
37+
# Send STATUS_SUCCESS with the hope of going ahead
3938
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_SUCCESS)
4039
end
4140
end

‎lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information.rb

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ module Trans2
99
module QueryFileInformation
1010

1111
def smb_cmd_trans2_query_file_information(c, buff)
12-
1312
params = CONST::SMB_TRANS2_QUERY_FILE_PARAMETERS.make_struct
1413
params.from_s(buff)
1514

@@ -22,8 +21,7 @@ def smb_cmd_trans2_query_file_information(c, buff)
2221
when CONST::SMB_QUERY_FILE_BASIC_INFO, CONST::SMB_QUERY_FILE_BASIC_INFO_ALIAS, CONST::SMB_SET_FILE_BASIC_INFO_ALIAS
2322
smb_cmd_trans_query_file_info_basic(c, fid)
2423
else
25-
dprint("\t\tUnknown LOI [smb_cmd_trans2_query_file_information] - #{loi.to_s}")
26-
# SEND success with the hope of going ahead...
24+
# Send STATUS_SUCCESS with the hope of going ahead
2725
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_SUCCESS)
2826
end
2927
end

0 commit comments

Comments
 (0)