infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix handlers

bug/bundler_fix
jvazquez-r7 2015-02-24 16:03:13 -06:00
parent ca7aabe9bc
commit 231a2f3110
5 changed files with 92 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/msf/core/exploit/smb/server/share/command/trans2/find_first2.rb
View File

@ -12,7 +12,19 @@ module Msf
ar = Rex::Text.to_hex(buff, '').to_s
loi = ar[156..159].unpack('n*').reverse.pack('n*').to_i(16)
=begin
# OLD DISPATCHING
case loi
when CONST::SMB_FIND_FILE_NAMES_INFO
smb_cmd_find_file_names_info(c, buff)
when CONST::SMB_FIND_FILE_BOTH_DIRECTORY_INFO
smb_cmd_find_file_both_directory_info(c, buff)
when CONST::SMB_FIND_FILE_FULL_DIRECTORY_INFO
smb_cmd_find_file_full_directory_info(c, buff)
else
smb_cmd_find_file_both_directory_info(c, buff)
end
=end
case loi
when CONST::SMB_FIND_FILE_NAMES_INFO
#dprint("\t[SMB_FIND_FILE_NAMES_INFO]")
@ -24,10 +36,9 @@ module Msf
#dprint("\t[SMB_FIND_FILE_FULL_DIRECTORY_INFO]")
smb_cmd_find_file_full_directory_info(c, buff)
else
#dprint("\t[Unexpected :?]") #TODO
#smb_cmd_trans_find_first2(c, buff)
dprint("Invalid or unknown TRANS2_FIND_FIRST2 REQUEST???")
fail_with(Failure::Unknown, "Invalid or unknown TRANS2_FIND_FIRST2 REQUEST???") #TODO
dprint("\t\tUnknown LOI [smb_cmd_trans2_find_first2] - #{loi}")
# SEND success with the hope of going ahead...
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_SUCCESS)
end
end
end

24
lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information.rb
View File

@ -7,6 +7,7 @@ module Msf
module Trans2
# This mixin provides methods to handle TRAN2_QUERY_FILE_INFORMATION subcommands
module QueryFileInformation
def smb_cmd_trans2_query_file_information(c, buff)
#dprint("[smb_cmd_trans2_query_file_information]")
ar = Rex::Text.to_hex(buff, '').to_s
@ -27,6 +28,29 @@ module Msf
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_SUCCESS)
end
end
=begin
# OLD DISPATCHING
def smb_cmd_trans2_query_file_information(c, buff)
#dprint("[smb_cmd_trans2_query_file_information]")
ar = Rex::Text.to_hex(buff, '').to_s
loi = ar[148..151].unpack('n*').reverse.pack('n*').to_i(16)
case loi
when 0x03ed
dprint("[smb_cmd_trans_query_path_info_standard]")
smb_cmd_trans_query_path_info_standard(c, buff)
when 0x03ec
dprint("[smb_cmd_trans_query_file_info_basic]")
smb_cmd_trans_query_file_info_basic(c, buff)
when 0x040a
dprint("[smb_cmd_trans_query_file_info_network]")
smb_cmd_trans_query_file_info_network(c, buff)
else
dprint("Unknown LOI [smb_cmd_trans_query_path_info_standard] - #{loi.to_s}")
smb_cmd_trans_query_file_info_standard(c, buff)
end
end
=end
end
end
end

37
lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information.rb
View File

@ -7,6 +7,7 @@ module Msf
module Trans2
# This mixin provides methods to handle TRAN2_QUERY_PATH_INFORMATION subcommands
module QueryPathInformation
def smb_cmd_trans2_query_path_information(c, buff)
#dprint("[smb_cmd_trans2_query_path_information]")
ar = Rex::Text.to_hex(buff, '').to_s
@ -18,17 +19,49 @@ module Msf
smb_cmd_trans_query_path_info_basic(c, buff)
when CONST::SMB_QUERY_FILE_STANDARD_INFO, CONST::SMB_QUERY_FILE_STANDARD_INFO_ALIAS
#dprint("\t\t[query_file_info_standard]")
#smb_cmd_trans_query_file_info_standard(c, buff)
smb_cmd_trans_query_path_info_standard(c, buff)
when CONST::SMB_QUERY_FILE_NETWORK_OPEN_INFO
dprint("\t\t[smb_cmd_trans_query_path_info_network]")
smb_cmd_trans_query_file_info_network(c, buff)
else
dprint("\t\tUnknown LOI [smb_cmd_trans_query_path_info_basic] - #{loi.to_s}")
dprint("\t\tUnknown LOI [smb_cmd_trans2_query_path_information] - #{loi.to_s}")
# SEND success with the hope of going ahead...
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_SUCCESS)
end
end
=begin
# oLD DISPATCHING
def smb_cmd_trans2_query_path_information(c, buff)
#dprint("[smb_cmd_trans2_query_path_information]")
ar = Rex::Text.to_hex(buff, '').to_s
mdc = ar[86..89].unpack('n*').reverse.pack('n*').to_i(16)
loi = ar[144..147].unpack('n*').reverse.pack('n*').to_i(16)
case mdc # MAX DATA COUNT
when CONST::SMB_QUERY_BASIC_MDC
case loi
when CONST::SMB_QUERY_FILE_BASIC_INFO
dprint("[query_file_info_basic]")
smb_cmd_trans_query_file_info_basic(c, buff)
else
dprint("Unknown LOI [smb_cmd_trans_query_path_info_basic] - #{loi.to_s}")
smb_cmd_trans_query_path_info_basic(c, buff)
end
when CONST::SMB_QUERY_STANDARD_MDC1, CONST::SMB_QUERY_STANDARD_MDC2
dprint("[smb_cmd_trans_query_path_info_standard]")
smb_cmd_trans_query_path_info_standard(c, buff)
when CONST::SMB_QUERY_FILE_INTERNAL_INFO_MDC
dprint("[smb_cmd_trans_query_file_info_standard]")
smb_cmd_trans_query_file_info_standard(c, buff)
when CONST::SMB_QUERY_FILE_NETWORK_INFO_MDC
dprint("[smb_cmd_trans_query_file_info_network]")
smb_cmd_trans_query_file_info_network(c, buff)
else
dprint("Unknown MDC - Sending to [query_path_info_standard]: #{mdc.to_s}")
smb_cmd_trans_query_path_info_standard(c, buff)
end
end
=end
end
end
end

12
lib/msf/core/exploit/smb/server/share/information_level/find.rb
View File

@ -20,6 +20,8 @@ module Msf
payload = pkt['Payload'].v['SetupData'].gsub(/\x00/, '').gsub(/.*\\/, '\\').chomp.strip
puts "FILE BOTH DIRECTORY INFO PAYLOAD\n#{Rex::Text.to_hex_dump(payload)}"
print_status("#{Rex::Text.to_hex_dump(payload)}")
pkt = CONST::SMB_TRANS_RES_PKT.make_struct
@ -107,6 +109,7 @@ module Msf
elsif payload && payload == path_name
data = Rex::Text.to_unicode(path_name)
else
#data = Rex::Text.to_unicode(path_name)
smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_NO_SUCH_FILE, true)
return
end
@ -135,10 +138,11 @@ module Msf
pkt['Payload'].v['DataCount'] = 14 + data.length
pkt['Payload'].v['DataOffset'] = 68
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +
"\x00\x00" + # Padding
find_file.to_s
"\x00" + # Padding
trans2_params.to_s +
"\x00\x00" + # Padding
find_file.to_s +
"\x00\x00"
c.put(pkt.to_s)
end

12
lib/msf/core/exploit/smb/server/share/information_level/query.rb
View File

@ -160,12 +160,14 @@ module Msf
c.put(pkt.to_s)
end
#
# Responds to QUERY_PATH_INFO (Standard) requests
#
# At the moment we just support '\\' path always send a SUCCESS...
def smb_cmd_trans_query_path_info_standard(c, buff)
#dprint("[smb_cmd_trans_query_path_info_standard]")
smb = @state[c]
pkt = CONST::SMB_TRANS2_PKT.make_struct
pkt.from_s(buff)
@ -181,6 +183,9 @@ module Msf
return
end
ar = Rex::Text.to_hex(buff, '').to_s
fid = ar[144..147].unpack('n*').reverse.pack('n*')
#puts "SETUP_DATA\n#{Rex::Text.to_hex_dump(pkt['Payload'].v['SetupData'])}"
smb_data = CONST::SMB_DATA_TRANS2.make_struct
smb_data.from_s(pkt['Payload'].v['SetupData'])
@ -211,6 +216,8 @@ module Msf
attrib = 1 # File attributes => file
#elsif path && path.ends_with?(file_name + '.Manifest')
#attrib = 0 # File attributes => file
elsif fid.hex.eql?(smb[:file_id].to_i)
attrib = 0
elsif path && path == path_name
# QUERY_PATH_INFO_PARAMETERS doesn't include a file name, return a Directory answer
attrib = 1 # File attributes => directory
@ -260,7 +267,7 @@ module Msf
#
# Responds to QUERY_FILE_INFO (Network) requests
#
# IT IS PROLLY NOT NEEDED
def smb_cmd_trans_query_file_info_network(c, buff)
pkt = CONST::SMB_TRANS2_PKT.make_struct
pkt.from_s(buff)
@ -280,7 +287,7 @@ module Msf
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_TRANSACTION2
pkt['Payload']['SMB'].v['Flags1'] = 0x88
pkt['Payload']['SMB'].v['Flags2'] = flags2
pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
pkt['Payload']['SMB'].v['WordCount'] = 10
pkt['Payload'].v['ParamCountTotal'] = 2
pkt['Payload'].v['DataCountTotal'] = 56
@ -310,7 +317,6 @@ module Msf
new_length = my_pkt[2, 2].unpack("n").first
c.put(pkt.to_s)
end
end
end
end