Changeset 5466

Timestamp:

04/04/08 15:54:39 (4 months ago)

Author:

hdm

Message:

Properly handle SMB::pipe_(read|write)_(min|max)

Files:

• framework3/trunk/lib/msf/core/exploit/dcerpc.rb (modified) (1 diff)
• framework3/trunk/lib/rex/proto/dcerpc/client.rb (modified) (3 diffs)

framework3/trunk/lib/msf/core/exploit/dcerpc.rb

@@ -81 +81 @@
-                        end                             
-                end
-
-                if datastore['SMBUser']
-                        opts['smb_user'] = datastore['SMBUser']
-                end
-                
-                if datastore['SMBPass']
-                        opts['smb_pass'] = datastore['SMBPass']
-                end
-
-                if datastore['DCERPC::smb_pipeio']
-                        opts['smb_pipeio'] = datastore['DCERPC::smb_pipeio']
-                end
-                
-                if self.respond_to?('simple') and self.simple
-                        opts['smb_client'] = self.simple
-                end
-                
-                opts['connect_timeout'] = (datastore['ConnectTimeout'] || 10).to_i
-                
-                opts['read_timeout']    = (datastore['DCERPC::ReadTimeout'] || 10).to_i
+        
+        
+                # Configure the SMB evasion options
-                
+                if (datastore['SMBUser'])
+                        opts['smb_user'] = datastore['SMBUser']
+                end
-                
+                if (datastore['SMBPass'])
+                        opts['smb_pass'] = datastore['SMBPass']
+                end
+
+                if (datastore['DCERPC::smb_pipeio'])
+                        opts['smb_pipeio'] = datastore['DCERPC::smb_pipeio']
+                end
+                
+                if (datastore['SMB::pipe_write_min_size'])
+                        opts['pipe_write_min_size'] = datastore['SMB::pipe_write_min_size']
+                end
+
+                if (datastore['SMB::pipe_write_max_size'])
+                        opts['pipe_write_max_size'] = datastore['SMB::pipe_write_max_size']
+                end
+
+                if (datastore['SMB::pipe_read_min_size'])
+                        opts['pipe_read_min_size'] = datastore['SMB::pipe_read_min_size']
+                end
+
+                if (datastore['SMB::pipe_read_max_size'])
+                        opts['pipe_read_max_size'] = datastore['SMB::pipe_read_max_size']
+                end
+
+                if (self.respond_to?('simple') and self.simple)
+                        opts['smb_client'] = self.simple
+                end
+                
+                # Create the DCERPC client      
-                self.dcerpc = Rex::Proto::DCERPC::Client.new(h, self.sock, opts)
-

framework3/trunk/lib/rex/proto/dcerpc/client.rb

@@ -132 +132 @@
-
-        def read()
+        
+                max_read = self.options['pipe_read_max_size'] || nil
+                min_read = self.options['pipe_read_min_size'] || max_read
+                
-                raw_response = ''
-
-
+
+
+
-                        begin
- self.options['segment_read']
+(max_read)
-                                        while(true)
-
-
+
+
+
-                                                raw_response += data
-                                        end
@@ -152 +158 @@
-                                end
-                        end
-
-
-
+
+
+
+
-                                        while (true)
-rand(5)+5
-data == nil
-!
+(rand(max_read-min_read)+min_read)
+not data
+not
-                                                raw_response << data
-                                        end
-                                else 
+                                        # Just read the entire response in one go
-                                        raw_response = self.socket.get_once(-1, self.options['read_timeout'])
-                                end
-                        else
+                                # No segmented read support for non-TCP sockets
-                                raw_response = self.socket.read(0xFFFFFFFF / 2 - 1)  # read max data
-                        end
@@ -172 +181 @@
-        end
-
+        # Write data to the underlying socket, limiting the sizes of the writes based on
+        # the pipe_write_min / pipe_write_max options.
-        def write(data)
-        
-
+
+
+
+
+
+
+
+
+
+
+
-                        self.socket.write(data)
-                else
-                        while (data.length > 0)
-                                len = self.socket.write( data.slice!(0, (rand(20)+5)) )
-                        end
-                end
-