infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update Offset counts with constants

bug/bundler_fix
jvazquez-r7 2015-02-25 16:25:16 -06:00
parent ee18cf592b
commit 993c75ec77
4 changed files with 17 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/msf/core/exploit/smb/server/share/command/read_andx.rb
View File

@ -29,7 +29,7 @@ module Msf
pkt['Payload'].v['AndX'] = 0xff # no more commands
pkt['Payload'].v['Remaining'] = 0xffff
pkt['Payload'].v['DataLenLow'] = length
pkt['Payload'].v['DataOffset'] = 59
pkt['Payload'].v['DataOffset'] = CONST::SMB_READ_RES_HDR_PKT_LENGTH
pkt['Payload'].v['DataLenHigh'] = 0
pkt['Payload'].v['Reserved3'] = 0
pkt['Payload'].v['Reserved4'] = 0x0a

12
lib/msf/core/exploit/smb/server/share/information_level/find.rb
View File

@ -65,9 +65,9 @@ module Msf
pkt['Payload'].v['ParamCountTotal'] = trans2_params.to_s.length
pkt['Payload'].v['DataCountTotal'] = find_file.to_s.length
pkt['Payload'].v['ParamCount'] = trans2_params.to_s.length
pkt['Payload'].v['ParamOffset'] = 56
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
pkt['Payload'].v['DataCount'] = find_file.to_s.length
pkt['Payload'].v['DataOffset'] = 68
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + trans2_params.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +
@ -116,9 +116,9 @@ module Msf
pkt['Payload'].v['ParamCountTotal'] = trans2_params.to_s.length
pkt['Payload'].v['DataCountTotal'] = find_file.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['ParamCount'] = trans2_params.to_s.length
pkt['Payload'].v['ParamOffset'] = 56
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
pkt['Payload'].v['DataCount'] = find_file.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['DataOffset'] = 68
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + trans2_params.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +
@ -186,9 +186,9 @@ module Msf
pkt['Payload'].v['ParamCountTotal'] = trans2_params.to_s.length
pkt['Payload'].v['DataCountTotal'] = find_file.to_s.length
pkt['Payload'].v['ParamCount'] = trans2_params.to_s.length
pkt['Payload'].v['ParamOffset'] = 56
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
pkt['Payload'].v['DataCount'] = find_file.to_s.length
pkt['Payload'].v['DataOffset'] = CONST::SMB_FIND_FILE_FULL_DIRECTORY_INFO_HDR_LENGTH
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + trans2_params.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +

12
lib/msf/core/exploit/smb/server/share/information_level/query.rb
View File

@ -41,9 +41,9 @@ module Msf
pkt['Payload'].v['ParamCountTotal'] = trans2_params.to_s.length
pkt['Payload'].v['DataCountTotal'] = query_path_info.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['ParamCount'] = trans2_params.to_s.length
pkt['Payload'].v['ParamOffset'] = 56
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
pkt['Payload'].v['DataCount'] = query_path_info.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['DataOffset'] = 60
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + trans2_params.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +
@ -101,9 +101,9 @@ module Msf
pkt['Payload'].v['ParamCountTotal'] = trans2_params.to_s.length
pkt['Payload'].v['DataCountTotal'] = query_path_info.to_s.length
pkt['Payload'].v['ParamCount'] = trans2_params.to_s.length
pkt['Payload'].v['ParamOffset'] = 56
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
pkt['Payload'].v['DataCount'] = query_path_info.to_s.length
pkt['Payload'].v['DataOffset'] = 60
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + trans2_params.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +
@ -162,9 +162,9 @@ module Msf
pkt['Payload'].v['ParamCountTotal'] = trans2_params.to_s.length
pkt['Payload'].v['DataCountTotal'] = query_path_info.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['ParamCount'] = trans2_params.to_s.length
pkt['Payload'].v['ParamOffset'] = 56
pkt['Payload'].v['ParamOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH
pkt['Payload'].v['DataCount'] = query_path_info.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['DataOffset'] = 60
pkt['Payload'].v['DataOffset'] = CONST::SMB_TRANS_RES_PKT_LENGTH + trans2_params.to_s.length + UNICODE_NULL_LENGTH
pkt['Payload'].v['Payload'] =
"\x00" + # Padding
trans2_params.to_s +

4
lib/rex/proto/smb/constants.rb
View File

@ -514,6 +514,7 @@ class Constants
[ 'uint8', 'WordCount', 0 ]
)
SMB_HDR_LENGTH = 33
# The SMB2 header template
SMB2_HDR = Rex::Struct2::CStructTemplate.new(
@ -820,6 +821,8 @@ class Constants
)
SMB_TRANS_RES_PKT = self.make_nbs(SMB_TRANS_RES_HDR_PKT)
SMB_TRANS_RES_PKT_LENGTH = SMB_HDR_LENGTH + 23
# A SMB template for SMB Transaction2 requests
SMB_TRANS2_HDR_PKT = Rex::Struct2::CStructTemplate.new(
[ 'template', 'SMB', SMB_HDR ],
@ -1188,6 +1191,7 @@ class Constants
)
SMB_READ_RES_PKT = self.make_nbs(SMB_READ_RES_HDR_PKT)
SMB_READ_RES_HDR_PKT_LENGTH = SMB_HDR_LENGTH + 26
# A SMB template for SMB Search requests
SMB_SEARCH_HDR_PKT = Rex::Struct2::CStructTemplate.new(