2012-06-29 05:18:28 +00:00
|
|
|
# -*- coding: binary -*-
|
2005-09-23 09:14:03 +00:00
|
|
|
module Rex
|
|
|
|
module Proto
|
|
|
|
module SMB
|
|
|
|
class SimpleClient
|
|
|
|
|
|
|
|
require 'rex/text'
|
|
|
|
require 'rex/struct2'
|
|
|
|
require 'rex/proto/smb/constants'
|
|
|
|
require 'rex/proto/smb/exceptions'
|
|
|
|
require 'rex/proto/smb/evasions'
|
|
|
|
require 'rex/proto/smb/crypt'
|
|
|
|
require 'rex/proto/smb/utils'
|
|
|
|
require 'rex/proto/smb/client'
|
2013-02-17 12:57:35 +00:00
|
|
|
require 'rex/proto/smb/simpleclient/open_file'
|
|
|
|
require 'rex/proto/smb/simpleclient/open_pipe'
|
2005-09-23 09:14:03 +00:00
|
|
|
|
|
|
|
# Some short-hand class aliases
|
|
|
|
CONST = Rex::Proto::SMB::Constants
|
|
|
|
CRYPT = Rex::Proto::SMB::Crypt
|
|
|
|
UTILS = Rex::Proto::SMB::Utils
|
|
|
|
XCEPT = Rex::Proto::SMB::Exceptions
|
|
|
|
EVADE = Rex::Proto::SMB::Evasions
|
|
|
|
|
|
|
|
# Public accessors
|
2013-02-17 12:57:35 +00:00
|
|
|
attr_accessor :last_error
|
2005-09-23 09:14:03 +00:00
|
|
|
|
|
|
|
# Private accessors
|
2013-02-17 12:57:35 +00:00
|
|
|
attr_accessor :socket, :client, :direct, :shares, :last_share
|
2005-09-23 09:14:03 +00:00
|
|
|
|
|
|
|
# Pass the socket object and a boolean indicating whether the socket is netbios or cifs
|
2006-04-30 19:49:27 +00:00
|
|
|
def initialize(socket, direct = false)
|
2005-09-23 09:14:03 +00:00
|
|
|
self.socket = socket
|
|
|
|
self.direct = direct
|
|
|
|
self.client = Rex::Proto::SMB::Client.new(socket)
|
|
|
|
self.shares = { }
|
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2013-02-17 12:57:35 +00:00
|
|
|
def login(name = '', user = '', pass = '', domain = '',
|
2011-06-20 22:54:13 +00:00
|
|
|
verify_signature = false, usentlmv2 = false, usentlm2_session = true,
|
2011-03-07 19:57:53 +00:00
|
|
|
send_lm = true, use_lanman_key = false, send_ntlm = true,
|
2011-03-16 00:12:07 +00:00
|
|
|
native_os = 'Windows 2000 2195', native_lm = 'Windows 2000 5.0', spnopt = {})
|
2006-06-17 17:36:19 +00:00
|
|
|
|
2005-09-23 09:14:03 +00:00
|
|
|
begin
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2005-09-23 09:14:03 +00:00
|
|
|
if (self.direct != true)
|
|
|
|
self.client.session_request(name)
|
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
self.client.native_os = native_os
|
2011-03-07 19:57:53 +00:00
|
|
|
self.client.native_lm = native_lm
|
|
|
|
self.client.verify_signature = verify_signature
|
|
|
|
self.client.use_ntlmv2 = usentlmv2
|
|
|
|
self.client.usentlm2_session = usentlm2_session
|
|
|
|
self.client.send_lm = send_lm
|
|
|
|
self.client.use_lanman_key = use_lanman_key
|
2011-06-20 22:54:13 +00:00
|
|
|
self.client.send_ntlm = send_ntlm
|
|
|
|
|
2005-09-23 09:14:03 +00:00
|
|
|
self.client.negotiate
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2011-06-20 23:32:29 +00:00
|
|
|
# Disable NTLMv2 Session for Windows 2000 (breaks authentication on some systems)
|
|
|
|
# XXX: This in turn breaks SMB auth for Windows 2000 configured to enforce NTLMv2
|
2011-06-20 23:38:30 +00:00
|
|
|
# XXX: Tracked by ticket #4785#4785
|
2011-06-20 22:54:13 +00:00
|
|
|
if self.client.native_lm =~ /Windows 2000 5\.0/ and usentlm2_session
|
2011-06-21 01:12:17 +00:00
|
|
|
# self.client.usentlm2_session = false
|
2011-06-20 22:54:13 +00:00
|
|
|
end
|
|
|
|
|
2011-03-16 00:12:07 +00:00
|
|
|
self.client.spnopt = spnopt
|
|
|
|
|
2005-09-23 09:14:03 +00:00
|
|
|
ok = self.client.session_setup(user, pass, domain)
|
2009-03-28 05:49:33 +00:00
|
|
|
rescue ::Interrupt
|
|
|
|
raise $!
|
|
|
|
rescue ::Exception => e
|
|
|
|
n = XCEPT::LoginError.new
|
|
|
|
n.source = e
|
|
|
|
if(e.respond_to?('error_code'))
|
|
|
|
n.error_code = e.error_code
|
|
|
|
n.error_reason = e.get_error(e.error_code)
|
|
|
|
end
|
|
|
|
raise n
|
2005-09-23 09:14:03 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2005-09-23 09:14:03 +00:00
|
|
|
return true
|
|
|
|
end
|
2007-07-03 04:20:50 +00:00
|
|
|
|
|
|
|
|
|
|
|
def login_split_start_ntlm1(name = '')
|
|
|
|
|
|
|
|
begin
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2007-07-03 04:20:50 +00:00
|
|
|
if (self.direct != true)
|
|
|
|
self.client.session_request(name)
|
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2007-07-03 04:20:50 +00:00
|
|
|
# Disable extended security
|
|
|
|
self.client.negotiate(false)
|
2009-03-28 05:49:33 +00:00
|
|
|
rescue ::Interrupt
|
|
|
|
raise $!
|
|
|
|
rescue ::Exception => e
|
|
|
|
n = XCEPT::LoginError.new
|
|
|
|
n.source = e
|
|
|
|
if(e.respond_to?('error_code'))
|
|
|
|
n.error_code = e.error_code
|
|
|
|
n.error_reason = e.get_error(e.error_code)
|
|
|
|
end
|
|
|
|
raise n
|
2007-07-03 04:20:50 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2007-07-03 04:20:50 +00:00
|
|
|
return true
|
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
|
|
|
|
2007-07-03 04:20:50 +00:00
|
|
|
def login_split_next_ntlm1(user, domain, hash_lm, hash_nt)
|
|
|
|
begin
|
2011-03-07 19:57:53 +00:00
|
|
|
ok = self.client.session_setup_no_ntlmssp_prehash(user, domain, hash_lm, hash_nt)
|
2009-03-28 05:49:33 +00:00
|
|
|
rescue ::Interrupt
|
|
|
|
raise $!
|
|
|
|
rescue ::Exception => e
|
|
|
|
n = XCEPT::LoginError.new
|
|
|
|
n.source = e
|
|
|
|
if(e.respond_to?('error_code'))
|
|
|
|
n.error_code = e.error_code
|
|
|
|
n.error_reason = e.get_error(e.error_code)
|
|
|
|
end
|
|
|
|
raise n
|
2007-07-03 04:20:50 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
|
|
|
return true
|
2007-07-03 04:20:50 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2006-04-08 06:35:35 +00:00
|
|
|
def connect(share)
|
2005-09-23 09:14:03 +00:00
|
|
|
ok = self.client.tree_connect(share)
|
|
|
|
tree_id = ok['Payload']['SMB'].v['TreeID']
|
|
|
|
self.shares[share] = tree_id
|
|
|
|
self.last_share = share
|
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2006-04-08 06:35:35 +00:00
|
|
|
def disconnect(share)
|
2005-09-23 09:14:03 +00:00
|
|
|
ok = self.client.tree_disconnect(self.shares[share])
|
|
|
|
self.shares.delete(share)
|
2011-06-20 22:54:13 +00:00
|
|
|
end
|
|
|
|
|
2011-03-07 19:57:53 +00:00
|
|
|
|
2011-06-20 22:54:13 +00:00
|
|
|
def open(path, perm, chunk_size = 48000)
|
2005-10-02 06:53:39 +00:00
|
|
|
mode = UTILS.open_mode_to_mode(perm)
|
|
|
|
access = UTILS.open_mode_to_access(perm)
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2005-10-02 06:53:39 +00:00
|
|
|
ok = self.client.open(path, mode, access)
|
2005-09-23 09:14:03 +00:00
|
|
|
file_id = ok['Payload'].v['FileID']
|
|
|
|
fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
|
2011-03-07 19:57:53 +00:00
|
|
|
fh.chunk_size = chunk_size
|
|
|
|
fh
|
2005-09-23 09:14:03 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2006-04-08 06:35:35 +00:00
|
|
|
def delete(*args)
|
2005-09-23 09:14:03 +00:00
|
|
|
self.client.delete(*args)
|
|
|
|
end
|
|
|
|
|
2006-04-08 06:35:35 +00:00
|
|
|
def create_pipe(path, perm = 'c')
|
2005-10-03 13:51:05 +00:00
|
|
|
disposition = UTILS.create_mode_to_disposition(perm)
|
2006-04-30 19:49:27 +00:00
|
|
|
ok = self.client.create_pipe(path, disposition)
|
2011-06-20 22:54:13 +00:00
|
|
|
file_id = ok['Payload'].v['FileID']
|
2006-04-26 16:59:44 +00:00
|
|
|
fh = OpenPipe.new(self.client, path, self.client.last_tree_id, file_id)
|
2005-10-02 06:53:39 +00:00
|
|
|
end
|
|
|
|
|
2006-06-01 15:18:53 +00:00
|
|
|
def trans_pipe(fid, data, no_response = nil)
|
|
|
|
client.trans_named_pipe(fid, data, no_response)
|
2006-04-08 06:35:35 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|
2005-09-23 09:14:03 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2008-11-12 19:31:11 +00:00
|
|
|
end
|
2011-06-20 22:54:13 +00:00
|
|
|
|