|
@@ -1,10 +1,12 @@
|
|
|
-package de.tudarmstadt.informatik.hostage.protocol.SMBUtils;
|
|
|
+package de.tudarmstadt.informatik.hostage.protocol.smbutils;
|
|
|
|
|
|
import java.nio.ByteBuffer;
|
|
|
import java.util.Calendar;
|
|
|
import java.util.GregorianCalendar;
|
|
|
import java.util.TimeZone;
|
|
|
|
|
|
+import javax.net.ssl.HostnameVerifier;
|
|
|
+
|
|
|
import de.tudarmstadt.informatik.hostage.commons.HelperUtils;
|
|
|
|
|
|
/**
|
|
@@ -15,7 +17,7 @@ import de.tudarmstadt.informatik.hostage.commons.HelperUtils;
|
|
|
public class SMBPacket {
|
|
|
|
|
|
private String[] serverVersion;
|
|
|
- private byte[] serverName = HelperUtils.fillWithZero(HelperUtils
|
|
|
+ private static byte[] serverName = HelperUtils.fillWithZero(HelperUtils
|
|
|
.getRandomString(16, true).getBytes());
|
|
|
private byte[] message = null;
|
|
|
private static final byte[] serverGUID = HelperUtils.randomBytes(16);
|
|
@@ -35,11 +37,15 @@ public class SMBPacket {
|
|
|
private byte[] userID = new byte[2];
|
|
|
private byte[] multiplexID = new byte[2];
|
|
|
|
|
|
+ //special nbds stuff
|
|
|
+ private byte[] workgroup;
|
|
|
+ private int type;
|
|
|
+
|
|
|
public SMBPacket(String[] serverVersion) {
|
|
|
this.serverVersion = serverVersion;
|
|
|
}
|
|
|
|
|
|
- public void prepareNextResponse() {
|
|
|
+ public void prepareNextResponse(int type, String serverName, String workgroup) {
|
|
|
serverComp = new byte[] { (byte) 0xff, 0x53, 0x4d, 0x42 };
|
|
|
smbCommand = new byte[] { 0x25 };
|
|
|
ntStat = new byte[] { 0x00, 0x00, 0x00, 0x00 };
|
|
@@ -53,6 +59,9 @@ public class SMBPacket {
|
|
|
processID = new byte[] { 0x00, 0x00 };
|
|
|
userID = new byte[] { 0x00, 0x00 };
|
|
|
multiplexID = new byte[] { 0x00, 0x00 };
|
|
|
+ this.workgroup = workgroup.getBytes();
|
|
|
+ this.type = type;
|
|
|
+ SMBPacket.serverName = serverName.getBytes();
|
|
|
}
|
|
|
|
|
|
public void prepareNextResponse(byte[] message) {
|
|
@@ -438,10 +447,9 @@ public class SMBPacket {
|
|
|
byte[] response = null;
|
|
|
|
|
|
if (transSub[0] == (byte) 0xff) { // for NMB in host announcement, NOT smb protocol
|
|
|
- System.out.println("Hi");
|
|
|
byte[] wordCount = { 0x11 };
|
|
|
byte[] totalParamCount = { 0x00, 0x00 };
|
|
|
- byte[] totalDataCount = { 0x2d, 0x00 };
|
|
|
+ byte[] totalDataCount = new byte[2]; //TODO
|
|
|
byte[] maxParamCount = { 0x00, 0x00 };
|
|
|
byte[] maxDataCount = { 0x00, 0x00 };
|
|
|
byte[] maxSetupCount = { 0x00 };
|
|
@@ -451,14 +459,46 @@ public class SMBPacket {
|
|
|
byte[] reserved2 = { 0x00, 0x00 };
|
|
|
byte[] paramCount = { 0x00, 0x00 };
|
|
|
byte[] paramOffset = { 0x00, 0x00 };
|
|
|
- byte[] dataCount = { 0x2d, 0x00 };
|
|
|
+ byte[] dataCount = new byte[2]; //TODO
|
|
|
byte[] dataOffset = { 0x56, 0x00 };
|
|
|
byte[] setupCount = { 0x03 };
|
|
|
byte[] reserved3 = { 0x00 };
|
|
|
+
|
|
|
+ //SMB MailSlot
|
|
|
+ byte[] opcode = new byte[]{0x01, 0x00};
|
|
|
+ byte[] priority = new byte[]{0x01, 0x00};
|
|
|
+ byte[] smbclass = new byte[]{0x02, 0x00};
|
|
|
+ byte[] size = new byte[2]; //TODO
|
|
|
+ byte[] name = HelperUtils.concat("\\MAILSLOT\\BROWSE".getBytes(), new byte[]{0x00});
|
|
|
+
|
|
|
+ byte[] windowsBrowser = null;
|
|
|
+ if (type == NBDSType.HOST_ANNOUNCEMENT_WITH_SERVICES || type == NBDSType.HOST_ANNOUNCEMENT
|
|
|
+ || type == NBDSType.LOCAL_MASTER_ANNOUNCEMENT_ALL || type == NBDSType.DOMAIN_ANNOUNCEMENT) {
|
|
|
+ windowsBrowser = getAnnouncement();
|
|
|
+ } else if (type == NBDSType.BROWSER) {
|
|
|
+ windowsBrowser = getBrowser();
|
|
|
+ } else if (type == NBDSType.REQUEST_ANNOUNCEMENT) {
|
|
|
+ byte[] command = {0x02};
|
|
|
+ byte[] unusedFlags = {0x01, 0x00};
|
|
|
+ byte[] responseCompName = serverName;
|
|
|
+ windowsBrowser = HelperUtils.concat(command, unusedFlags, responseCompName);
|
|
|
+ }
|
|
|
+
|
|
|
+ byte[] buffer = ByteBuffer.allocate(4).putInt(windowsBrowser.length).array();
|
|
|
+ totalDataCount[0] = buffer[3];
|
|
|
+ totalDataCount[1] = buffer[2];
|
|
|
+ dataCount = totalDataCount;
|
|
|
+
|
|
|
+ buffer = ByteBuffer.allocate(4).putInt(name.length + windowsBrowser.length).array();
|
|
|
+ size[0] = buffer[3];
|
|
|
+ size[1] = buffer[2];
|
|
|
+ byte[] smbMailSlot = HelperUtils.concat(opcode, priority, smbclass, size, name);
|
|
|
+
|
|
|
// no netbios header required for NMB!!
|
|
|
return wrapHeader(HelperUtils.concat(wordCount, totalParamCount, totalDataCount,
|
|
|
maxParamCount, maxDataCount, maxSetupCount, reserved, flags, timeout, reserved2,
|
|
|
- paramCount, paramOffset, dataCount, dataOffset, setupCount, reserved3));
|
|
|
+ paramCount, paramOffset, dataCount, dataOffset, setupCount, reserved3, smbMailSlot,
|
|
|
+ windowsBrowser));
|
|
|
} else if (transSub[0] == 0x00 && transSub[1] == 0x0b) { // bind_ack
|
|
|
byte[] wordCount = { 0x0a };
|
|
|
byte[] totalParamCount = { 0x00, 0x00 };
|
|
@@ -588,6 +628,67 @@ public class SMBPacket {
|
|
|
transSub = new byte[] { 0x00, 0x00 };
|
|
|
return transSub;
|
|
|
}
|
|
|
+
|
|
|
+ private byte[] getAnnouncement() {
|
|
|
+ //Microsoft Windows Browser
|
|
|
+ byte[] command = null;
|
|
|
+ if(type == NBDSType.LOCAL_MASTER_ANNOUNCEMENT_ALL) {
|
|
|
+ command = new byte[]{0x0f};
|
|
|
+ } else if (type == NBDSType.DOMAIN_ANNOUNCEMENT) {
|
|
|
+ command = new byte[]{0x0c};
|
|
|
+ } else {
|
|
|
+ command = new byte[]{0x01};
|
|
|
+ }
|
|
|
+ byte[] updateCount = new byte[]{0x00};
|
|
|
+ byte[] updatePeriodicity = null;
|
|
|
+ if (type == NBDSType.HOST_ANNOUNCEMENT_WITH_SERVICES) {
|
|
|
+ updatePeriodicity = new byte[]{0x60, (byte) 0xea, 0x00, 0x00};
|
|
|
+ } else if (type == NBDSType.HOST_ANNOUNCEMENT) {
|
|
|
+ updatePeriodicity = new byte[]{0x00, 0x00, 0x00, 0x00};
|
|
|
+ } else if (type == NBDSType.LOCAL_MASTER_ANNOUNCEMENT_ALL || type == NBDSType.DOMAIN_ANNOUNCEMENT) {
|
|
|
+ updatePeriodicity = new byte[]{(byte) 0xc0, (byte) 0xd4, 0x01, 0x00};
|
|
|
+ }
|
|
|
+ byte[] hostName = null;
|
|
|
+ if (type == NBDSType.DOMAIN_ANNOUNCEMENT) {
|
|
|
+ hostName = workgroup;
|
|
|
+ } else {
|
|
|
+ hostName = serverName;
|
|
|
+ }
|
|
|
+ for (int i = hostName.length; i < 16; i++) {
|
|
|
+ hostName = HelperUtils.concat(hostName, new byte[]{0x00});
|
|
|
+ }
|
|
|
+ byte[] osMajorVersion = new byte[]{0x04};
|
|
|
+ byte[] osMinorVersion = new byte[]{0x09};
|
|
|
+ byte[] serverType = null;
|
|
|
+ if (type == NBDSType.HOST_ANNOUNCEMENT_WITH_SERVICES || type == NBDSType.LOCAL_MASTER_ANNOUNCEMENT_ALL) {
|
|
|
+ serverType = new byte[]{0x03, (byte) 0x9a, (byte) 0x81, 0x00};
|
|
|
+ } else if (type == NBDSType.HOST_ANNOUNCEMENT) {
|
|
|
+ serverType = new byte[]{0x00, 0x00, 0x00, 0x00};
|
|
|
+ } else if (type == NBDSType.DOMAIN_ANNOUNCEMENT) {
|
|
|
+ serverType = new byte[]{0x00, 0x10, 0x00, (byte) 0x80};
|
|
|
+ }
|
|
|
+ byte[] browserProtocolMajorVer = new byte[]{0x0f};
|
|
|
+ byte[] browserProtocolMinorVer = new byte[]{0x01};
|
|
|
+ byte[] signature = new byte[]{0x55, (byte) 0xaa};
|
|
|
+ byte[] hostComment = null;
|
|
|
+ if (type == NBDSType.DOMAIN_ANNOUNCEMENT) {
|
|
|
+ hostComment = HelperUtils.concat(serverName, new byte[]{0x00});
|
|
|
+ } else {
|
|
|
+ hostComment = HelperUtils.concat("".getBytes(), new byte[]{0x00});
|
|
|
+ }
|
|
|
+
|
|
|
+ return HelperUtils.concat(command, updateCount, updatePeriodicity, hostName,
|
|
|
+ osMajorVersion, osMinorVersion, serverType, browserProtocolMajorVer, browserProtocolMinorVer,
|
|
|
+ signature, hostComment);
|
|
|
+ }
|
|
|
+
|
|
|
+ private byte[] getBrowser() {
|
|
|
+ byte[] command = {0x08};
|
|
|
+ byte[] electionVersion = {0x01};
|
|
|
+ byte[] electionCriteria = {0x02, 0x0f, 0x01, 0x14};
|
|
|
+ byte[] uptime = {(byte) 0xb0, 0x36, 0x00, 0x00, 0x00, 0x00,0x00, 0x00};
|
|
|
+ return HelperUtils.concat(command, electionVersion, electionCriteria, uptime, serverName, new byte[]{0x00});
|
|
|
+ }
|
|
|
|
|
|
/**
|
|
|
* Builds the tree connect packet
|