Changeset 5072

Timestamp:

08/09/07 10:39:56 (1 year ago)

Author:

hdm

Message:

Resolve a bugin the ASN1 function, add new functionality to the SMB client class.

Files:

• framework3/tags/framework-3.0/lib/rex/proto/smb/client.rb (modified) (4 diffs)
• framework3/tags/framework-3.0/lib/rex/proto/smb/simpleclient.rb (modified) (4 diffs)
• framework3/tags/framework-3.0/lib/rex/proto/smb/utils.rb (modified) (1 diff)

framework3/tags/framework-3.0/lib/rex/proto/smb/client.rb

@@ -433 +433 @@
-
-        # Negotiate a SMB dialect
-
+extended=true
-                
-                dialects = ['LANMAN1.0', 'LM1.2X002' ]
@@ -448 +448 @@
-                pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_NEGOTIATE
-                pkt['Payload']['SMB'].v['Flags1'] = 0x18
-
+
+
+
+
+
+
+
-                pkt['Payload'].v['Payload'] = data
-                
@@ -619 +625 @@
-                return ack
-        end     
+
+
+        # Authenticate using NTLMv1 with a precomputed hash pair
+        def session_setup_ntlmv1_prehash(user, domain, hash_lm, hash_nt)
+
+                data = ''
+                data << hash_lm
+                data << hash_nt
+                data << user + "\x00"
+                data << domain + "\x00"
+                data << self.native_os + "\x00"
+                data << self.native_lm + "\x00"         
+                
+                pkt = CONST::SMB_SETUP_NTLMV1_PKT.make_struct
+                self.smb_defaults(pkt['Payload']['SMB'])
+                                
+                pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_SESSION_SETUP_ANDX
+                pkt['Payload']['SMB'].v['Flags1'] = 0x18
+                pkt['Payload']['SMB'].v['Flags2'] = 0x2001
+                pkt['Payload']['SMB'].v['WordCount'] = 13
+                pkt['Payload'].v['AndX'] = 255
+                pkt['Payload'].v['MaxBuff'] = 0xffdf
+                pkt['Payload'].v['MaxMPX'] = 2
+                pkt['Payload'].v['VCNum'] = 1           
+                pkt['Payload'].v['PasswordLenLM'] = hash_lm.length
+                pkt['Payload'].v['PasswordLenNT'] = hash_nt.length
+                pkt['Payload'].v['Capabilities'] = 64
+                pkt['Payload'].v['SessionKey'] = self.session_id
+                pkt['Payload'].v['Payload'] = data
+                
+                self.smb_send(pkt.to_s)
+                ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX)
+                        
+                if (ack['Payload'].v['Action'] != 1 and user.length > 0)
+                        self.auth_user = user
+                end
+                
+                self.auth_user_id = ack['Payload']['SMB'].v['UserID']
+
+                info = ack['Payload'].v['Payload'].split(/\x00/)
+
+                self.peer_native_os = info[0]
+                self.peer_native_lm = info[1]
+                self.default_domain = info[2]
+                                
+                return ack
+        end
-        
-        # Authenticate using extended security negotiation (NTLMv2)
@@ -742 +795 @@
-                                
-                self.auth_user_id = ack['Payload']['SMB'].v['UserID']
+                
+                if (ack['Payload'].v['Action'] != 1 and user.length > 0)
+                        self.auth_user = user
+                end             
-
-                return ack

framework3/tags/framework-3.0/lib/rex/proto/smb/simpleclient.rb

@@ -51 +51 @@
-                                fptr = offset
-                                ok = self.client.read(self.file_id, fptr, self.chunk_size)
-
+ and ok
-                                        buff = ok.to_s.slice(
-                                                ok['Payload'].v['DataOffset'] + 4,
@@ -61 +61 @@
-                                        end
-                                        fptr += ok['Payload'].v['DataLenLow']
-
+
+
+
+
+
+
+
+
+
+
+
+
-                                end
+
-                                return data
-                        else
@@ -146 +158 @@
-                
-                def write_trans(data, offset=0)
-                        # Payload is not being filled the the response !?!!?
-                        ack = self.client.trans_named_pipe(self.file_id, data)
-
+
+
+
-                end
-        end
@@ -185 +198 @@
-                return true
-        end
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        def connect(share)
-                ok = self.client.tree_connect(share)

framework3/tags/framework-3.0/lib/rex/proto/smb/utils.rb

@@ -95 +95 @@
-        end
-
+        #
+        # Prepends an ASN1 formatted length field to a piece of data
+        #
-        def self.asn1encode(str = '')
-                res = ''
+
+                # If the high bit of the first byte is 1, it contains the number of
+                # length bytes that follow
+
-                case str.length
-80
+7F
-                                res = [str.length].pack('C') + str
-1 .. 0x100
+0 .. 0xFF
-                                res = [0x81, str.length].pack('CC') + str
-1 .. 0x100000
+0 .. 0xFFFF
-                                res = [0x82, str.length].pack('Cn') + str
-
-
-
+
+
+
+
+
+
+
-                return res
-        end