infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Removal of obsolete DCERPC code 

git-svn-id: file:///home/svn/incoming/trunk@3633 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2006-05-03 05:23:52 +00:00
parent 1fd5d698a2
commit 304001a454
1 changed files with 0 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
lib/msf/core/exploit/smb.rb
View File

@ -111,115 +111,6 @@ module Exploit::Remote::SMB
def smb_create(pipe)
self.simple.create_pipe(pipe)
end
#
# All of the following code has been obsoleted by DCERPC
#
=begin
def smb_dcerpc_bind(pipe, handle)
self.dcerpc_socket = pipe
self.dcerpc_bind(handle)
end
# This method calls a DCERPC procedure over a SMB pipe
def smb_dcerpc_call(fid, func, stub = '')
# Create the request packets
pkts = dcerpc_make_call(func, stub)
if (pkts == nil)
return
end
# Verify that the socket exists
if (sock == nil)
return
end
print_status("Sending " + pkts.size.to_s + " DCERPC fragments...")
pkts.each { |chunk|
smb_dcerpc_pipe_write(fid, chunk)
}
data = smb_dcerpc_pipe_read(fid)
return DCERPCResponse.new(data) if data.length > 0
end
# This method provides a mechanism for executing DCERPC transactions
# using READ/WRITE SMB commands (vs TransactNP)
def smb_dcerpc_pipe_writeread(fid, request)
smb_dcerpc_pipe_write(fid, request)
smb_dcerpc_pipe_read(fid)
end
# This method writes out a DCERPC transaction in random size
# blocks with random offsets (offsets are ignored by the server)
def smb_dcerpc_pipe_write(fid, request)
pipe_write_min = datastore['SMB::pipe_write_min_size']
pipe_write_max = datastore['SMB::pipe_write_max_size']
if (pipe_write_min > pipe_write_max)
pipe_write_min = pipe_write_max
end
# Write the request out in random chunk sizes
while (request.length > 0)
wsize = rand(pipe_write_max - pipe_write_min) + pipe_write_min
fid.write( request.slice!(0, wsize), rand(1024)+1 )
end
end
# This method reads a DCERPC transaction response in random size
# blocks with random offsets (offsets are ignored by the server)
# XXX - If we read on a pipe with no data, our client code times out
# waiting for the response. A problem occurs when data becomes available
# at a later time - a read response is sent back from the server, which
# throws off the serial command processing code in the client. So, to
# avoid significant problems, never read on a pipe when you know there
# is no data left. This command will become obsolete once command queueing
# is implemented in the client.
def smb_dcerpc_pipe_read(fid)
pipe_read_min = datastore['SMB::pipe_read_min_size']
pipe_read_max = datastore['SMB::pipe_read_max_size']
if (pipe_read_min > pipe_read_max)
pipe_read_min = pipe_read_max
end
data = ''
# Read the response back a few bytes a time
begin
rsize = nil
while(true)
bsize = rand(pipe_read_max - pipe_read_min) + pipe_read_min
t = (fid.read(bsize, rand(1024)+1))
break if t.length == 0
data << t
# If we have at least 10 bytes of data, check the DCERPC
# header and determine how many bytes are left to go.
# We do this to avoid a read on an empty pipe.
if (rsize.nil? and data.length >= 10)
r = DCERPCResponse.new(data.slice(0,10))
rsize = r.frag_len
end
# Quit reading once the full response is read
break if data and rsize and data.length >= rsize
end
rescue XCEPT::NoReply
end
return data
end
=end
def smb_hostname
datastore['SMBNAME'] || '*SMBSERVER'