Commit Graph

194 Commits (d7887b59aa1352dda460c69ba0a8e4fc58cdaacd)

Author SHA1 Message Date
jvazquez-r7 8328c5c5e9 Add specs for SMB_FIND_FILE_BOTH_DIRECTORY_INFO requests 2015-03-03 12:43:41 -06:00
jvazquez-r7 eb3aedf4a7 Define constants for WordCount in responses 2015-02-28 18:15:14 -06:00
jvazquez-r7 89a033c194 Delete unnecessary paddings due to miscalculations 2015-02-26 15:54:00 -06:00
jvazquez-r7 c73ffea1b9 Do minor cleanup 2015-02-26 12:50:45 -06:00
jvazquez-r7 970f0c94b2 Create CREATE_ANDX constants 2015-02-26 10:44:07 -06:00
Matthew Hall ab1bb0e50d bugfixes to https://github.com/jvazquez-r7/metasploit-framework/tree/review_3074_clean_server
to provide consistent support for various exploits and OS SMB Commands.

Reintroduces smb_cmd_trans_query_path_info_network for use with the Struts2 JSP injection vulnerability.
Reintroduces smb_cmd_trans_query_file_info_basic for common use with rundll32.
Corrects some issues with filename formatting and pattern matching for file requests (can still be improved).
2015-02-26 16:10:34 +00:00
jvazquez-r7 993c75ec77 Update Offset counts with constants 2015-02-25 16:25:16 -06:00
jvazquez-r7 df50aa0f06 Use constants for DataCount and DataCountTotal 2015-02-25 14:11:38 -06:00
jvazquez-r7 f21959a8a2 Add constants for session setup actions 2015-02-25 13:31:57 -06:00
jvazquez-r7 e967cfbfb3 Create Access rights constants 2015-02-25 13:22:16 -06:00
jvazquez-r7 1caffbea2d Add constants for Negotiation Capabilities 2015-02-25 12:50:33 -06:00
jvazquez-r7 50d50d5353 Define constants for SMB Flags 2015-02-25 12:28:25 -06:00
jvazquez-r7 e5d9bb0a47 Update from master 2015-02-25 11:37:13 -06:00
jvazquez-r7 ec9be4531b Add SMB_CREATE_ANDX_RES_PKT template 2015-02-25 11:33:08 -06:00
jvazquez-r7 d10385cfed Add template for SMB_TREE_CONN_ANDX_RES_PKT 2015-02-24 19:27:25 -06:00
jvazquez-r7 642765aeb5 Delete comments 2015-02-24 18:27:02 -06:00
jvazquez-r7 bb36899699 Do templates names consistent 2015-02-24 18:26:46 -06:00
jvazquez-r7 d29e9fc20b Parse TRAN2_FIND_FIRST2 commands 2015-02-24 17:02:49 -06:00
Brent Cook ab4a416958 comment out duplicate keys that can only be used for reference
ruby is ignoring all but the second instances, and 2.2 still throws a
warning
2015-02-24 08:50:02 -06:00
jvazquez-r7 ea483f14a1 Try to fix logic for query information levels 2015-02-23 17:17:33 -06:00
jvazquez-r7 3fca26a5de Add support for SMB_COM_TRANSACTION2 data blocks and params 2015-02-23 16:37:39 -06:00
jvazquez-r7 a06d07d6da Clean smb_cmd_trans2_query_file_information dispatching 2015-02-23 12:03:08 -06:00
jvazquez-r7 3d7381b62a Handle TRANS2 commands 2015-02-23 11:33:49 -06:00
jvazquez-r7 52a0e6dd1c Mark a couple of handlers for later review 2015-02-20 16:28:04 -06:00
jvazquez-r7 a91d19e0e7 Add template for SMB_QUERY_FILE_STANDARD_INFO 2015-02-20 10:58:15 -06:00
jvazquez-r7 21978a1bfe Add template for SMB_QUERY_FILE_BASIC_INFO 2015-02-20 10:40:45 -06:00
jvazquez-r7 cf63e09188 Add templates for SMB_FIND_FILE_FULL_DIRECTORY_INFO_HDR and SMB_FIND_FILE_NAMES_INFO_HDR 2015-02-20 09:17:51 -06:00
jvazquez-r7 f2405a5dc0 Create SMB_FIND_FILE_BOTH_DIRECTORY_INFO_HDR_LENGTH constant 2015-02-20 00:35:26 -06:00
jvazquez-r7 571dffa317 Create template for SMB_FIND_FILE_BOTH_DIRECTORY_INFO 2015-02-20 00:22:33 -06:00
jvazquez-r7 94ad64546c Create TRANS2_PARAMETERS template 2015-02-19 23:16:52 -06:00
jvazquez-r7 b24b94ddd3 Do first cleanup of find_first2 handlers 2015-02-19 19:08:56 -06:00
jvazquez-r7 415c671416 Move Rex code, we'll redesign as mixin 2015-02-18 13:44:02 -06:00
Matthew Hall 934af4cee9 Merge branch 'master' into module-smbfileserver 2015-02-17 17:01:44 +00:00
Matthew Hall 49971a6bc3 Add two more contants and handlers seen during testing. 2015-02-17 16:48:11 +00:00
Matthew Hall 1f6aebe3df Move to using constant values.
This commit adds several constants for TRANS2, QUERY_PATH_INFO, MAX_DATA_COUNT,
and NT2 FLAG2 Bits to smb/constants.rb, which have then been utilised in smb/server.rb
to reduce the use of magic values.
2015-02-17 14:31:31 +00:00
Matthew Hall 3110c7b40f Adds smb_cmd_trans_find_first2_full to respond to "Find File Full Directory Info" FIND_FIRST2 requests,
as seen when using "type \\ip\share\file".
2015-02-17 11:37:44 +00:00
Matthew Hall 3c10b04673 add start of rspec tests 2014-12-23 16:35:27 +00:00
Matthew Hall fca0484639 fix a few bugs with the code cleanup 2014-12-23 15:28:00 +00:00
Matthew Hall 6b98a7d444 Tidy up by removing some duplicate code; add framework to track payload requests through the file id 2014-12-23 14:14:06 +00:00
sinn3r 719db5d2b1 Fix #4119 - SMB lost search ID (sid) in find_first method
This will fix issue #4119. A bug in the find_first method in rex
SMB.

When the SMB client requests a TRANS2_FIND_FIRST2 for retriving
information about what items a directory has, the server returns
a response that contains an SID - a search identifier for the
transaction. If the SMB client wants more data, it must send a
TRANS2_FIND_NEXT2 request with the same SID. And then the server
will continue sending more until it runs out.

The root cause of this bug is that after the TRANS2_FIND_FIRST2
request is sent, our SMB's find_first method forgets the SID at
the end of the loop (out of scope).
2014-11-11 12:35:07 -06:00
sinn3r e54442af36 Fix #4089 - undefined method `downcase' for nil:NilClass 2014-11-07 02:45:22 -06:00
James Lee 51a9a763c0
Move error_name to InvalidPacket and check for nil
MSP-10713
2014-07-15 15:02:53 -05:00
James Lee 7d9c0da691
Record correct creds with non-success status 2014-07-09 13:26:49 -05:00
HD Moore b872fa0f0d Handle smb_recv corner case with a cache, clean up find_*, cosmetic 2014-06-23 16:14:18 -05:00
HD Moore 94388e3931 Fix typo in the constant name 2014-06-23 12:51:26 -05:00
Matthew Hall e8f46f97e1 Remove bin_to_hex function and replace with Rex::Text.to_hex 2014-05-01 15:42:04 +01:00
Matthew Hall ff14cf9bfb Implement QUERY_FILE_INFO_NETWORK SMB command
This commit adds support for the TRANS2 request 'query file info
network' (smb_cmd_trans_query_file_info_network) used in some SMB client
requests. This adds specific support for functions used by Apache Tomcat
in the Struts2 JSP injection exploit (CVE-2014-0094).
2014-05-01 12:23:31 +01:00
Matthew Hall b899504580 Bugfixes and additional protocol support for extra FIND_FIRST2 functions
These additions queue up support for the SMB functions used by the
ms13_071_theme expoit developed by Juan Vazquez, including support for
the FIND_FIRST2 functions:
 * Find File Both Directory Info
 * Find File Names Info

Additionally this commit fixes a few bugs in how the client SMB payload
is handled to determine whether a file, directory or "not found"
response needs to be returned and allows metasploit to serve arbitrary
files directly over SMB in addition to files being loaded in runtime
processes calling "LoadLibrary".
2014-04-30 11:58:34 +01:00
Matthew Hall c1db8e260f Add yardoc documentation for the SMBFileServer Class 2014-03-12 17:28:18 +00:00
Matthew Hall 0f259d3032 Tidy lib/rex/proto/smb/server.rb following feedback from jlee-r7
* Remove redundant ServerClient class
 * Use dlog/elog/ilog instead of printing to $stdout
2014-03-12 15:41:21 +00:00