* no self wrapper to unicode
* update tests to make more sense when they fail git-svn-id: file:///home/svn/incoming/trunk@3557 4d416f70-5f16-0410-b530-b9f4589650daunstable
bmc
parent
57d50528f2
commit
93870878fe
|
|
@ -41,12 +41,8 @@ begin
|
|||
ckey64.pack('C*')
|
||||
end
|
||||
|
||||
def self.unicode (str)
|
||||
Rex::Text.to_unicode(str)
|
||||
end
|
||||
|
||||
def self.ntlm_md4(pass, chal)
|
||||
e_p24( [ md4_hash(unicode(pass)) ].pack('a21'), chal)
|
||||
e_p24( [ md4_hash(Rex::Text.to_unicode(pass)) ].pack('a21'), chal)
|
||||
end
|
||||
|
||||
def self.md4_hash(data)
|
||||
|
|
|
|||
|
|
@ -11,15 +11,10 @@ class Rex::Proto::SMB::Crypt::UnitTest < Test::Unit::TestCase
|
|||
|
||||
def test_parse
|
||||
|
||||
test_nt = "8d041858f078ccfa1560a4617690e55184fd70ec7f23b7f9"
|
||||
test_lm = "c248cf6165fe55efaca0300966dc3796046b9c0bb4a52e27"
|
||||
test_pass = "XXXXXXX"
|
||||
test_chal = "Z" * 8
|
||||
pass = "XXXXXXX"
|
||||
chal = "Z" * 8
|
||||
|
||||
res_lm = Klass.lanman_des(test_pass, test_chal).unpack("H*")[0]
|
||||
res_nt = Klass.ntlm_md4(test_pass, test_chal).unpack("H*")[0]
|
||||
|
||||
assert_equal(res_lm, test_lm)
|
||||
assert_equal(res_nt, test_nt)
|
||||
assert_equal("\xc2\x48\xcf\x61\x65\xfe\x55\xef\xac\xa0\x30\x09\x66\xdc\x37\x96\x04\x6b\x9c\x0b\xb4\xa5\x2e\x27", Klass.lanman_des(pass, chal), 'lanman_des')
|
||||
assert_equal("\x8d\x04\x18\x58\xf0\x78\xcc\xfa\x15\x60\xa4\x61\x76\x90\xe5\x51\x84\xfd\x70\xec\x7f\x23\xb7\xf9", Klass.ntlm_md4(pass, chal), 'ntlm_md4')
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -8,11 +8,6 @@ class Utils
|
|||
|
||||
CONST = Rex::Proto::SMB::Constants
|
||||
|
||||
# Convert a standard ASCII string to 16-bit Unicode
|
||||
def self.unicode (str)
|
||||
Rex::Text.to_unicode(str)
|
||||
end
|
||||
|
||||
# Creates an access mask for use with the CLIENT.open() call based on a string
|
||||
def self.open_mode_to_access(str)
|
||||
access = CONST::OPEN_ACCESS_READ | CONST::OPEN_SHARE_DENY_NONE
|
||||
|
|
@ -150,62 +145,65 @@ CONST = Rex::Proto::SMB::Constants
|
|||
|
||||
def self.make_ntlmv2_secblob_auth (domain = '', name = '', user = '', lmv2 = '', ntlm = '')
|
||||
|
||||
domain_uni = self.unicode(domain)
|
||||
user_uni = self.unicode(user)
|
||||
name_uni = self.unicode(name)
|
||||
domain_uni = Rex::Text.to_unicode(domain)
|
||||
user_uni = Rex::Text.to_unicode(user)
|
||||
name_uni = Rex::Text.to_unicode(name)
|
||||
|
||||
ptr = 0
|
||||
blob =
|
||||
"\xa1" + self.asn1encode(
|
||||
"\x30" + self.asn1encode(
|
||||
"\xa2" + self.asn1encode(
|
||||
"\x04" + self.asn1encode(
|
||||
|
||||
"NTLMSSP\x00" +
|
||||
[ 3 ].pack('V') +
|
||||
"\x30" + self.asn1encode(
|
||||
"\xa2" + self.asn1encode(
|
||||
"\x04" + self.asn1encode(
|
||||
|
||||
"NTLMSSP\x00" +
|
||||
[ 3 ].pack('V') +
|
||||
|
||||
[ # Lan Manager Response
|
||||
lmv2.length,
|
||||
lmv2.length,
|
||||
(ptr += 64)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # NTLM Manager Response
|
||||
ntlm.length,
|
||||
ntlm.length,
|
||||
(ptr += lmv2.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Domain Name
|
||||
domain_uni.length,
|
||||
domain_uni.length,
|
||||
(ptr += ntlm.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Username
|
||||
user_uni.length,
|
||||
user_uni.length,
|
||||
(ptr += domain_uni.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Hostname
|
||||
name_uni.length,
|
||||
name_uni.length,
|
||||
(ptr += user_uni.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Session Key (none)
|
||||
0, 0, 0
|
||||
].pack('vvV') +
|
||||
|
||||
[ 0x80201 ].pack('V') +
|
||||
|
||||
[ # Lan Manager Response
|
||||
lmv2.length,
|
||||
lmv2.length,
|
||||
(ptr += 64)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # NTLM Manager Response
|
||||
ntlm.length,
|
||||
ntlm.length,
|
||||
(ptr += lmv2.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Domain Name
|
||||
domain_uni.length,
|
||||
domain_uni.length,
|
||||
(ptr += ntlm.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Username
|
||||
user_uni.length,
|
||||
user_uni.length,
|
||||
(ptr += domain_uni.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Hostname
|
||||
name_uni.length,
|
||||
name_uni.length,
|
||||
(ptr += user_uni.length)
|
||||
].pack('vvV') +
|
||||
|
||||
[ # Session Key (none)
|
||||
0, 0, 0
|
||||
].pack('vvV') +
|
||||
|
||||
[ 0x80201 ].pack('V') +
|
||||
|
||||
lmv2 +
|
||||
ntlm +
|
||||
domain_uni +
|
||||
user_uni +
|
||||
name_uni
|
||||
))))
|
||||
lmv2 +
|
||||
ntlm +
|
||||
domain_uni +
|
||||
user_uni +
|
||||
name_uni
|
||||
)
|
||||
)
|
||||
)
|
||||
)
|
||||
return blob
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -17,12 +17,4 @@ class Rex::Proto::SMB::Utils::UnitTest < Test::Unit::TestCase
|
|||
assert_equal(Klass.nbname_encode(nbdecoded), nbencoded )
|
||||
assert_equal(Klass.nbname_decode(nbencoded), nbdecoded )
|
||||
end
|
||||
|
||||
def test_unicode
|
||||
plain = 'Metasploit!'
|
||||
unicode = "M\x00e\x00t\x00a\x00s\x00p\x00l\x00\o\x00i\x00t\x00!\x00"
|
||||
|
||||
assert_equal(Klass.unicode(plain), unicode)
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue