Added SimpleClient, moderate bug fixes
git-svn-id: file:///home/svn/incoming/trunk@2873 4d416f70-5f16-0410-b530-b9f4589650daunstable
HD Moore
parent
05069ac1e9
commit
cfbeff077e
|
|
@ -4,4 +4,4 @@ require 'rex/proto/smb/evasions'
|
|||
require 'rex/proto/smb/crypt'
|
||||
require 'rex/proto/smb/utils'
|
||||
require 'rex/proto/smb/client'
|
||||
|
||||
require 'rex/proto/smb/simpleclient'
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
|
||||
begin
|
||||
head = self.socket.timed_read(4, self.read_timeout)
|
||||
rescue TimeoutError
|
||||
rescue
|
||||
raise XCEPT::ReadHeader
|
||||
end
|
||||
|
|
@ -53,7 +54,14 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
|
||||
body = ''
|
||||
while (body.length != recv_len)
|
||||
buff = self.socket.timed_read(recv_len, self.read_timeout)
|
||||
buff = ''
|
||||
|
||||
begin
|
||||
buff = self.socket.timed_read(recv_len, self.read_timeout)
|
||||
rescue TimeoutError
|
||||
rescue
|
||||
raise XCEPT::ReadPacket
|
||||
end
|
||||
|
||||
# Failed to read one packet within the time limit
|
||||
if (buff == nil or buff.length == 0)
|
||||
|
|
@ -480,7 +488,7 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
return self.session_setup_clear(*args)
|
||||
end
|
||||
|
||||
return nil
|
||||
raise XCEPT::UnknownDialect
|
||||
end
|
||||
|
||||
# Authenticate using clear-text passwords
|
||||
|
|
@ -610,9 +618,9 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
# Make sure the error code tells us to continue processing
|
||||
if (ack['Payload']['SMB'].v['ErrorClass'] != 0xc0000016)
|
||||
failure = XCEPT::ErrorCode.new
|
||||
failure.word_count = pkt['Payload']['SMB'].v['WordCount']
|
||||
failure.command = pkt['Payload']['SMB'].v['Command']
|
||||
failure.error_code = pkt['Payload']['SMB'].v['ErrorClass']
|
||||
failure.word_count = ack['Payload']['SMB'].v['WordCount']
|
||||
failure.command = ack['Payload']['SMB'].v['Command']
|
||||
failure.error_code = ack['Payload']['SMB'].v['ErrorClass']
|
||||
raise failure
|
||||
end
|
||||
|
||||
|
|
@ -671,8 +679,21 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
pkt['Payload'].v['Payload'] = blob + native_data
|
||||
|
||||
self.smb_send(pkt.to_s)
|
||||
ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX)
|
||||
ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX, true)
|
||||
|
||||
# Make sure that authentication succeeded
|
||||
if (ack['Payload']['SMB'].v['ErrorClass'] != 0)
|
||||
if (user.length == 0)
|
||||
return self.session_setup_ntlmv1(user, pass, domain)
|
||||
end
|
||||
|
||||
failure = XCEPT::ErrorCode.new
|
||||
failure.word_count = ack['Payload']['SMB'].v['WordCount']
|
||||
failure.command = ack['Payload']['SMB'].v['Command']
|
||||
failure.error_code = ack['Payload']['SMB'].v['ErrorClass']
|
||||
raise failure
|
||||
end
|
||||
|
||||
self.auth_user_id = ack['Payload']['SMB'].v['UserID']
|
||||
|
||||
return ack
|
||||
|
|
@ -825,7 +846,7 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
end
|
||||
|
||||
# Closes an open file handle
|
||||
def close(file_id = self.last_file_id)
|
||||
def close(file_id = self.last_file_id, tree_id = self.last_tree_id)
|
||||
|
||||
pkt = CONST::SMB_CLOSE_PKT.make_struct
|
||||
self.smb_defaults(pkt['Payload']['SMB'])
|
||||
|
|
@ -833,6 +854,7 @@ EVADE = Rex::Proto::SMB::Evasions
|
|||
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_CLOSE
|
||||
pkt['Payload']['SMB'].v['Flags1'] = 0x18
|
||||
pkt['Payload']['SMB'].v['Flags2'] = 0x2001
|
||||
pkt['Payload']['SMB'].v['TreeID'] = tree_id
|
||||
pkt['Payload']['SMB'].v['WordCount'] = 3
|
||||
|
||||
pkt['Payload'].v['FileID'] = file_id
|
||||
|
|
|
|||
|
|
@ -30,6 +30,12 @@ class WritePacket < Error
|
|||
end
|
||||
end
|
||||
|
||||
class UnknownDialect < Error
|
||||
def to_s
|
||||
"The server uses an unsupported SMB dialect"
|
||||
end
|
||||
end
|
||||
|
||||
class InvalidPacket < Error
|
||||
attr_accessor :word_count
|
||||
attr_accessor :command
|
||||
|
|
@ -71,7 +77,15 @@ class NetbiosSessionFailed < Error
|
|||
end
|
||||
end
|
||||
|
||||
class SimpleClientError < Error
|
||||
attr_accessor :source, :fatal
|
||||
end
|
||||
|
||||
class LoginError < SimpleClientError
|
||||
def to_s
|
||||
"Login Failed: " + self.source
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -0,0 +1,164 @@
|
|||
module Rex
|
||||
module Proto
|
||||
module SMB
|
||||
class SimpleClient
|
||||
|
||||
require 'rex/text'
|
||||
require 'rex/struct2'
|
||||
require 'rex/proto/smb/constants'
|
||||
require 'rex/proto/smb/exceptions'
|
||||
require 'rex/proto/smb/evasions'
|
||||
require 'rex/proto/smb/crypt'
|
||||
require 'rex/proto/smb/utils'
|
||||
require 'rex/proto/smb/client'
|
||||
|
||||
# Some short-hand class aliases
|
||||
CONST = Rex::Proto::SMB::Constants
|
||||
CRYPT = Rex::Proto::SMB::Crypt
|
||||
UTILS = Rex::Proto::SMB::Utils
|
||||
XCEPT = Rex::Proto::SMB::Exceptions
|
||||
EVADE = Rex::Proto::SMB::Evasions
|
||||
|
||||
|
||||
class OpenFile
|
||||
attr_accessor :name, :tree_id, :file_id, :mode, :client, :chunk_size
|
||||
|
||||
def initialize(client, name, tree_id, file_id)
|
||||
self.client = client
|
||||
self.name = name
|
||||
self.tree_id = tree_id
|
||||
self.file_id = file_id
|
||||
self.chunk_size = 48000
|
||||
end
|
||||
|
||||
def delete
|
||||
begin
|
||||
self.close
|
||||
rescue
|
||||
end
|
||||
self.client.delete(self.name, self.tree_id)
|
||||
end
|
||||
|
||||
# Close this open file
|
||||
def close
|
||||
self.client.close(self.file_id, self.tree_id)
|
||||
end
|
||||
|
||||
# Read data from the file
|
||||
def read (length = nil, offset = 0)
|
||||
if (length == nil)
|
||||
data = ''
|
||||
fptr = offset
|
||||
ok = self.client.read(self.file_id, fptr, self.chunk_size)
|
||||
while (ok['Payload'].v['DataLenLow'] > 0)
|
||||
buff = ok.to_s.slice(
|
||||
ok['Payload'].v['DataOffset'] + 4,
|
||||
ok['Payload'].v['DataLenLow']
|
||||
)
|
||||
data << buff
|
||||
fptr += ok['Payload'].v['DataLenLow']
|
||||
ok = self.client.read(self.file_id, fptr, self.chunk_size)
|
||||
end
|
||||
return data
|
||||
else
|
||||
ok = self.client.read(self.file_id, offset, length)
|
||||
data = ok.to_s.slice(
|
||||
ok['Payload'].v['DataOffset'] + 4,
|
||||
ok['Payload'].v['DataLenLow']
|
||||
)
|
||||
return data
|
||||
end
|
||||
end
|
||||
|
||||
def << (data)
|
||||
self.write(data)
|
||||
end
|
||||
|
||||
# Write data to the file
|
||||
def write(data, offset = 0)
|
||||
# Track our offset into the remote file
|
||||
fptr = offset
|
||||
|
||||
# Duplicate the data so we can use slice!
|
||||
data = data.dup
|
||||
|
||||
# Take our first chunk of bytes
|
||||
chunk = data.slice!(0, self.chunk_size)
|
||||
|
||||
# Keep writing data until we run out
|
||||
while (chunk.length > 0)
|
||||
ok = self.client.write(self.file_id, fptr, chunk)
|
||||
cl = ok['Payload'].v['CountLow']
|
||||
|
||||
# Partial write, push the failed data back into the queue
|
||||
if (cl != chunk.length)
|
||||
data = chunk.slice(cl - 1, chunk.length - cl) + data
|
||||
end
|
||||
|
||||
# Increment our painter and grab the next chunk
|
||||
fptr += cl
|
||||
chunk = data.slice!(0, self.chunk_size)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
# Public accessors
|
||||
attr_accessor :last_error
|
||||
|
||||
# Private accessors
|
||||
attr_accessor :socket, :client, :direct, :shares, :last_share
|
||||
|
||||
# Pass the socket object and a boolean indicating whether the socket is netbios or cifs
|
||||
def initialize (socket, direct = false)
|
||||
self.socket = socket
|
||||
self.direct = direct
|
||||
self.client = Rex::Proto::SMB::Client.new(socket)
|
||||
self.shares = { }
|
||||
end
|
||||
|
||||
def login (name = '*SMBSERVER', user = '', pass = '', domain = '')
|
||||
begin
|
||||
|
||||
if (self.direct != true)
|
||||
self.client.session_request(name)
|
||||
end
|
||||
|
||||
self.client.negotiate
|
||||
ok = self.client.session_setup(user, pass, domain)
|
||||
rescue
|
||||
e = XCEPT::LoginError.new
|
||||
e.source = $!.to_s
|
||||
raise e
|
||||
end
|
||||
|
||||
return true
|
||||
end
|
||||
|
||||
def connect (share)
|
||||
ok = self.client.tree_connect(share)
|
||||
tree_id = ok['Payload']['SMB'].v['TreeID']
|
||||
self.shares[share] = tree_id
|
||||
self.last_share = share
|
||||
end
|
||||
|
||||
def disconnect (share)
|
||||
ok = self.client.tree_disconnect(self.shares[share])
|
||||
self.shares.delete(share)
|
||||
end
|
||||
|
||||
def open (path, mode=0)
|
||||
ok = self.client.open(path, mode)
|
||||
file_id = ok['Payload'].v['FileID']
|
||||
|
||||
fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
|
||||
end
|
||||
|
||||
def delete (*args)
|
||||
self.client.delete(*args)
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
#!/usr/bin/ruby
|
||||
|
||||
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
|
||||
|
||||
require 'test/unit'
|
||||
require 'rex/proto/smb'
|
||||
require 'rex/proto/dcerpc'
|
||||
require 'rex/socket'
|
||||
|
||||
class Rex::Proto::SMB::Client::UnitTest < Test::Unit::TestCase
|
||||
|
||||
Klass = Rex::Proto::SMB::SimpleClient
|
||||
|
||||
# Alias over the Rex DCERPC protocol modules
|
||||
DCERPCPacket = Rex::Proto::DCERPC::Packet
|
||||
DCERPCClient = Rex::Proto::DCERPC::Client
|
||||
DCERPCResponse = Rex::Proto::DCERPC::Response
|
||||
DCERPCUUID = Rex::Proto::DCERPC::UUID
|
||||
|
||||
FILE_CREATE = 0x10
|
||||
FILE_TRUNC = 0x02
|
||||
FILE_OPEN = 0x01
|
||||
|
||||
|
||||
@@host = '192.168.0.219'
|
||||
@@port = 445
|
||||
|
||||
def test_smb_open_share
|
||||
|
||||
user = 'SMBTest'
|
||||
pass = 'SMBTest'
|
||||
share = 'C$'
|
||||
|
||||
write_data = ('A' * (1024 * 1024 * 1))
|
||||
filename = 'smb_tester.txt'
|
||||
|
||||
s = Rex::Socket.create_tcp(
|
||||
'PeerHost' => @@host,
|
||||
'PeerPort' => @@port
|
||||
)
|
||||
|
||||
c = Klass.new(s, true)
|
||||
|
||||
begin
|
||||
c.login('*SMBSERVER', user, pass)
|
||||
c.connect(share)
|
||||
|
||||
f = c.open(filename, FILE_CREATE|FILE_TRUNC)
|
||||
f << write_data
|
||||
f.close
|
||||
|
||||
f = c.open(filename, FILE_OPEN)
|
||||
d = f.read()
|
||||
f.close
|
||||
|
||||
c.delete(filename)
|
||||
c.disconnect(share)
|
||||
assert_equal(write_data, d)
|
||||
rescue
|
||||
puts $!.to_s + $!.backtrace.join("\n")
|
||||
return
|
||||
end
|
||||
|
||||
s.close
|
||||
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue