infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added SimpleClient, moderate bug fixes 

git-svn-id: file:///home/svn/incoming/trunk@2873 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2005-09-23 09:14:03 +00:00
parent 05069ac1e9
commit cfbeff077e
5 changed files with 277 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/rex/proto/smb.rb
View File

@ -4,4 +4,4 @@ require 'rex/proto/smb/evasions'
require 'rex/proto/smb/crypt'
require 'rex/proto/smb/utils'
require 'rex/proto/smb/client'
require 'rex/proto/smb/simpleclient'

36
lib/rex/proto/smb/client.rb
View File

@ -38,6 +38,7 @@ EVADE = Rex::Proto::SMB::Evasions
begin
head = self.socket.timed_read(4, self.read_timeout)
rescue TimeoutError
rescue
raise XCEPT::ReadHeader
end
@ -53,7 +54,14 @@ EVADE = Rex::Proto::SMB::Evasions
body = ''
while (body.length != recv_len)
buff = self.socket.timed_read(recv_len, self.read_timeout)
buff = ''
begin
buff = self.socket.timed_read(recv_len, self.read_timeout)
rescue TimeoutError
rescue
raise XCEPT::ReadPacket
end
# Failed to read one packet within the time limit
if (buff == nil or buff.length == 0)
@ -480,7 +488,7 @@ EVADE = Rex::Proto::SMB::Evasions
return self.session_setup_clear(*args)
end
return nil
raise XCEPT::UnknownDialect
end
# Authenticate using clear-text passwords
@ -610,9 +618,9 @@ EVADE = Rex::Proto::SMB::Evasions
# Make sure the error code tells us to continue processing
if (ack['Payload']['SMB'].v['ErrorClass'] != 0xc0000016)
failure = XCEPT::ErrorCode.new
failure.word_count = pkt['Payload']['SMB'].v['WordCount']
failure.command = pkt['Payload']['SMB'].v['Command']
failure.error_code = pkt['Payload']['SMB'].v['ErrorClass']
failure.word_count = ack['Payload']['SMB'].v['WordCount']
failure.command = ack['Payload']['SMB'].v['Command']
failure.error_code = ack['Payload']['SMB'].v['ErrorClass']
raise failure
end
@ -671,7 +679,20 @@ EVADE = Rex::Proto::SMB::Evasions
pkt['Payload'].v['Payload'] = blob + native_data
self.smb_send(pkt.to_s)
ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX)
ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX, true)
# Make sure that authentication succeeded
if (ack['Payload']['SMB'].v['ErrorClass'] != 0)
if (user.length == 0)
return self.session_setup_ntlmv1(user, pass, domain)
end
failure = XCEPT::ErrorCode.new
failure.word_count = ack['Payload']['SMB'].v['WordCount']
failure.command = ack['Payload']['SMB'].v['Command']
failure.error_code = ack['Payload']['SMB'].v['ErrorClass']
raise failure
end
self.auth_user_id = ack['Payload']['SMB'].v['UserID']
@ -825,7 +846,7 @@ EVADE = Rex::Proto::SMB::Evasions
end
# Closes an open file handle
def close(file_id = self.last_file_id)
def close(file_id = self.last_file_id, tree_id = self.last_tree_id)
pkt = CONST::SMB_CLOSE_PKT.make_struct
self.smb_defaults(pkt['Payload']['SMB'])
@ -833,6 +854,7 @@ EVADE = Rex::Proto::SMB::Evasions
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_CLOSE
pkt['Payload']['SMB'].v['Flags1'] = 0x18
pkt['Payload']['SMB'].v['Flags2'] = 0x2001
pkt['Payload']['SMB'].v['TreeID'] = tree_id
pkt['Payload']['SMB'].v['WordCount'] = 3
pkt['Payload'].v['FileID'] = file_id

14
lib/rex/proto/smb/exceptions.rb
View File

@ -30,6 +30,12 @@ class WritePacket < Error
end
end
class UnknownDialect < Error
def to_s
"The server uses an unsupported SMB dialect"
end
end
class InvalidPacket < Error
attr_accessor :word_count
attr_accessor :command
@ -71,7 +77,15 @@ class NetbiosSessionFailed < Error
end
end
class SimpleClientError < Error
attr_accessor :source, :fatal
end
class LoginError < SimpleClientError
def to_s
"Login Failed: " + self.source
end
end
end
end

164
lib/rex/proto/smb/simpleclient.rb Normal file
View File

@ -0,0 +1,164 @@
module Rex
module Proto
module SMB
class SimpleClient
require 'rex/text'
require 'rex/struct2'
require 'rex/proto/smb/constants'
require 'rex/proto/smb/exceptions'
require 'rex/proto/smb/evasions'
require 'rex/proto/smb/crypt'
require 'rex/proto/smb/utils'
require 'rex/proto/smb/client'
# Some short-hand class aliases
CONST = Rex::Proto::SMB::Constants
CRYPT = Rex::Proto::SMB::Crypt
UTILS = Rex::Proto::SMB::Utils
XCEPT = Rex::Proto::SMB::Exceptions
EVADE = Rex::Proto::SMB::Evasions
class OpenFile
attr_accessor :name, :tree_id, :file_id, :mode, :client, :chunk_size
def initialize(client, name, tree_id, file_id)
self.client = client
self.name = name
self.tree_id = tree_id
self.file_id = file_id
self.chunk_size = 48000
end
def delete
begin
self.close
rescue
end
self.client.delete(self.name, self.tree_id)
end
# Close this open file
def close
self.client.close(self.file_id, self.tree_id)
end
# Read data from the file
def read (length = nil, offset = 0)
if (length == nil)
data = ''
fptr = offset
ok = self.client.read(self.file_id, fptr, self.chunk_size)
while (ok['Payload'].v['DataLenLow'] > 0)
buff = ok.to_s.slice(
ok['Payload'].v['DataOffset'] + 4,
ok['Payload'].v['DataLenLow']
)
data << buff
fptr += ok['Payload'].v['DataLenLow']
ok = self.client.read(self.file_id, fptr, self.chunk_size)
end
return data
else
ok = self.client.read(self.file_id, offset, length)
data = ok.to_s.slice(
ok['Payload'].v['DataOffset'] + 4,
ok['Payload'].v['DataLenLow']
)
return data
end
end
def << (data)
self.write(data)
end
# Write data to the file
def write(data, offset = 0)
# Track our offset into the remote file
fptr = offset
# Duplicate the data so we can use slice!
data = data.dup
# Take our first chunk of bytes
chunk = data.slice!(0, self.chunk_size)
# Keep writing data until we run out
while (chunk.length > 0)
ok = self.client.write(self.file_id, fptr, chunk)
cl = ok['Payload'].v['CountLow']
# Partial write, push the failed data back into the queue
if (cl != chunk.length)
data = chunk.slice(cl - 1, chunk.length - cl) + data
end
# Increment our painter and grab the next chunk
fptr += cl
chunk = data.slice!(0, self.chunk_size)
end
end
end
# Public accessors
attr_accessor :last_error
# Private accessors
attr_accessor :socket, :client, :direct, :shares, :last_share
# Pass the socket object and a boolean indicating whether the socket is netbios or cifs
def initialize (socket, direct = false)
self.socket = socket
self.direct = direct
self.client = Rex::Proto::SMB::Client.new(socket)
self.shares = { }
end
def login (name = '*SMBSERVER', user = '', pass = '', domain = '')
begin
if (self.direct != true)
self.client.session_request(name)
end
self.client.negotiate
ok = self.client.session_setup(user, pass, domain)
rescue
e = XCEPT::LoginError.new
e.source = $!.to_s
raise e
end
return true
end
def connect (share)
ok = self.client.tree_connect(share)
tree_id = ok['Payload']['SMB'].v['TreeID']
self.shares[share] = tree_id
self.last_share = share
end
def disconnect (share)
ok = self.client.tree_disconnect(self.shares[share])
self.shares.delete(share)
end
def open (path, mode=0)
ok = self.client.open(path, mode)
file_id = ok['Payload'].v['FileID']
fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
end
def delete (*args)
self.client.delete(*args)
end
end
end
end
end

69
lib/rex/proto/smb/simpleclient.rb.ut.rb Normal file
View File

@ -0,0 +1,69 @@
#!/usr/bin/ruby
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
require 'test/unit'
require 'rex/proto/smb'
require 'rex/proto/dcerpc'
require 'rex/socket'
class Rex::Proto::SMB::Client::UnitTest < Test::Unit::TestCase
Klass = Rex::Proto::SMB::SimpleClient
# Alias over the Rex DCERPC protocol modules
DCERPCPacket = Rex::Proto::DCERPC::Packet
DCERPCClient = Rex::Proto::DCERPC::Client
DCERPCResponse = Rex::Proto::DCERPC::Response
DCERPCUUID = Rex::Proto::DCERPC::UUID
FILE_CREATE = 0x10
FILE_TRUNC = 0x02
FILE_OPEN = 0x01
@@host = '192.168.0.219'
@@port = 445
def test_smb_open_share
user = 'SMBTest'
pass = 'SMBTest'
share = 'C$'
write_data = ('A' * (1024 * 1024 * 1))
filename = 'smb_tester.txt'
s = Rex::Socket.create_tcp(
'PeerHost' => @@host,
'PeerPort' => @@port
)
c = Klass.new(s, true)
begin
c.login('*SMBSERVER', user, pass)
c.connect(share)
f = c.open(filename, FILE_CREATE|FILE_TRUNC)
f << write_data
f.close
f = c.open(filename, FILE_OPEN)
d = f.read()
f.close
c.delete(filename)
c.disconnect(share)
assert_equal(write_data, d)
rescue
puts $!.to_s + $!.backtrace.join("\n")
return
end
s.close
end
end