Skip to content

Commit dc67fcd

Browse files
David MaloneyDavid Maloney
authored andcommitted
use RubySMB for anonymous login
use the new anonymous login capabilities in RubySMB
1 parent e4ea618 commit dc67fcd

File tree

3 files changed

+4
-25
lines changed

3 files changed

+4
-25
lines changed

Gemfile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ gemspec name: 'metasploit-framework'
66
gem 'bit-struct', git: 'https://github.com/busterb/bit-struct', branch: 'ruby-2.4'
77
gem 'method_source', git: 'https://github.com/banister/method_source', branch: 'master'
88

9+
910
# separate from test as simplecov is not run on travis-ci
1011
group :coverage do
1112
# code coverage for tests

Gemfile.lock

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -345,7 +345,7 @@ GEM
345345
rspec-mocks (~> 3.6.0)
346346
rspec-support (~> 3.6.0)
347347
rspec-support (3.6.0)
348-
ruby_smb (0.0.14)
348+
ruby_smb (0.0.17)
349349
bindata
350350
rubyntlm
351351
windows_error

modules/exploits/windows/smb/ms17_010_eternalblue.rb

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -283,30 +283,8 @@ def smb1_anonymous_connect_ipc()
283283
sock = connect(false)
284284
dispatcher = RubySMB::Dispatcher::Socket.new(sock)
285285
client = RubySMB::Client.new(dispatcher, smb1: true, smb2: false, username: '', password: '')
286-
client.negotiate
287-
288-
pkt = make_smb1_anonymous_login_packet
289-
sock.put(pkt)
290-
291-
code, raw, response = smb1_get_response(sock)
292-
293-
if code.nil?
294-
raise RubySMB::Error::UnexpectedStatusCode, "No response to login request"
295-
end
296-
297-
unless code == 0 # WindowsError::NTStatus::STATUS_SUCCESS
298-
raise RubySMB::Error::UnexpectedStatusCode, "Error with anonymous login"
299-
end
300-
301-
client.user_id = response.uid
302-
303-
304-
# todo: RubySMB throwing exceptions
305-
# sess = RubySMB::SMB1::Packet::SessionSetupResponse.new(raw)
306-
os = raw.split("\x00\x00")[-2]
307-
# todo: rubysmb should set this automatically?
308-
#client.peer_native_os = os
309-
286+
client.login
287+
os = client.peer_native_os
310288
tree = client.tree_connect("\\\\#{datastore['RHOST']}\\IPC$")
311289

312290
return client, tree, sock, os

0 commit comments

Comments
 (0)