protocols updated

src/de/tudarmstadt/informatik/hostage/protocol/FTP.java

@@ -1,11 +1,13 @@
 package de.tudarmstadt.informatik.hostage.protocol;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.regex.Pattern;
 
 public final class FTP implements Protocol {
 
 	private static enum STATE {
-		NONE, OPEN, CLOSED
+		NONE, OPEN, CLOSED, USER, LOGGED_IN
 	};
 
 	private STATE state = STATE.NONE;
@@ -21,21 +23,67 @@ public final class FTP implements Protocol {
 	}
 
 	@Override
-	public String processMessage(String message) {
+	public List<byte[]> processMessage(byte[] message) {
+		String request = new String(message);
+		List<byte[]> response = new ArrayList<byte[]>();
 		switch (state) {
 		case NONE:
-			state = STATE.OPEN;
-			return "Connection established.";
+			if (message == null) {
+				state = STATE.OPEN;
+				response.add("220 Service ready for new user.".getBytes());
+			} else {
+				state = STATE.CLOSED;
+				response.add("421 Service not available, closing control connection."
+						.getBytes());
+			}
+			break;
 		case OPEN:
-			if (Pattern.matches("^QUIT\\s?", message)) {
+			if (Pattern.matches("^QUIT\\s?", request)) {
 				state = STATE.CLOSED;
 				return null;
+			} else if (Pattern.matches("^USER (\\w)+$", request)) {
+				state = STATE.USER;
+				response.add("331 User name ok, need password.".getBytes());
+			} else if (message != null && Pattern.matches("^USER\\s?", request)) {
+				response.add("530 Not logged in.".getBytes());
+			} else if (message != null && Pattern.matches("^USER.*", request)) {
+				response.add("501 Syntax error in parameters or arguments"
+						.getBytes());
+			} else {
+				response.add("332 Need account for login.".getBytes());
+			}
+			break;
+		case USER:
+			if (Pattern.matches("^PASS (\\S)+$", request)) {
+				state = STATE.LOGGED_IN;
+				response.add("230 User logged in.".getBytes());
+			} else if (Pattern.matches("^PASS.*", request)) {
+				state = STATE.OPEN;
+				response.add("501 Syntax error in parameters or arguments"
+						.getBytes());
 			} else {
-				return message;
+				state = STATE.CLOSED;
+				response.add("221 Service closing control connection."
+						.getBytes());
+			}
+			break;
+		case LOGGED_IN:
+			if (Pattern.matches("^QUIT\\s?", request)) {
+				state = STATE.CLOSED;
+			} else if (message != null) {
+				response.add("502 Command not implemented.".getBytes());
+			} else {
+				state = STATE.CLOSED;
+				response.add("221 Service closing control connection."
+						.getBytes());
 			}
+			break;
 		default:
-			return "Connection closed.";
+			state = STATE.CLOSED;
+			response.add("421 Service not available, closing control connection."
+					.getBytes());
 		}
+		return response;
 	}
 
 	@Override

src/de/tudarmstadt/informatik/hostage/protocol/HTTP.java

@@ -1,15 +1,11 @@
 package de.tudarmstadt.informatik.hostage.protocol;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.regex.Pattern;
 
 public final class HTTP implements Protocol {
 
-	private static enum STATE {
-		NONE, OPEN, CLOSED
-	};
-
-	private STATE state = STATE.NONE;
-
 	@Override
 	public int getPort() {
 		return 8080;
@@ -17,30 +13,27 @@ public final class HTTP implements Protocol {
 
 	@Override
 	public TALK_FIRST whoTalksFirst() {
-		return TALK_FIRST.SERVER;
+		return TALK_FIRST.CLIENT;
 	}
 
 	@Override
-	public String processMessage(String message) {
-		switch (state) {
-		case NONE:
-			state = STATE.OPEN;
-			return "Connection established.";
-		case OPEN:
-			if (Pattern.matches("^QUIT\\s?", message)) {
-				state = STATE.CLOSED;
-				return null;
-			} else {
-				return message;
-			}
-		default:
-			return "Connection closed.";
+	public List<byte[]> processMessage(byte[] message) {
+		String request = new String(message);
+		List<byte[]> response = new ArrayList<byte[]>();
+		String r = new String(request);
+		if (Pattern.matches("^HEAD\\s?", r)) {
+			response.add(buildHeader().getBytes());
+		} else if (Pattern.matches("^GET\\s?", r)) {
+			response.add((buildHeader() + buildPage()).getBytes());
+		} else {
+			response.add("HTTP/1.1 501 Not Implemented".getBytes());
 		}
+		return response;
 	}
 
 	@Override
 	public boolean isClosed() {
-		return (state == STATE.CLOSED);
+		return true;
 	}
 
 	@Override
@@ -48,4 +41,30 @@ public final class HTTP implements Protocol {
 		return "HTTP";
 	}
 
+	private String buildHeader() {
+		StringBuilder builder = new StringBuilder();
+		builder.append("HTTP/1.1 200 OK\r\n");
+		builder.append("Server: Apache/2.4.6 (Unix) PHP/5.5.2\r\n");
+		builder.append("Content-Length: 148\r\n");
+		builder.append("Content-Language: en\r\n");
+		builder.append("Connection: close\r\n");
+		builder.append("Content-Type: text/html\r\n");
+		builder.append("\r\n");
+		return builder.toString();
+	}
+
+	private String buildPage() {
+		StringBuilder builder = new StringBuilder();
+		builder.append("<html>");
+		builder.append("<head>");
+		builder.append("<title>hostage</title>");
+		builder.append("<meta http-equiv=\"Content-Type\" content=\"text/html;charset=utf-8\" />");
+		builder.append("</head>");
+		builder.append("<body>");
+		builder.append("<p>Hello there!</p>");
+		builder.append("</body>");
+		builder.append("</html>");
+		return builder.toString();
+	}
+
 }

src/de/tudarmstadt/informatik/hostage/protocol/Protocol.java

@@ -1,5 +1,7 @@
 package de.tudarmstadt.informatik.hostage.protocol;
 
+import java.util.List;
+
 public interface Protocol {
 
 	public static enum TALK_FIRST {
@@ -10,7 +12,7 @@ public interface Protocol {
 
 	TALK_FIRST whoTalksFirst();
 
-	String processMessage(String message);
+	List<byte[]> processMessage(byte[] message);
 
 	boolean isClosed();
 

src/de/tudarmstadt/informatik/hostage/protocol/SMB.java

@@ -1,11 +1,17 @@
 package de.tudarmstadt.informatik.hostage.protocol;
 
+import java.nio.ByteBuffer;
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.List;
+import java.util.Random;
+import java.util.TimeZone;
 
 public final class SMB implements Protocol {
 
 	private static enum STATE {
-		NONE, OPEN, CLOSED
-	};
+		NONE, CONNECTED, AUTHENTICATED, LISTING, DISCONNECTED, CLOSED
+	}
 
 	private STATE state = STATE.NONE;
 
@@ -16,13 +22,78 @@ public final class SMB implements Protocol {
 
 	@Override
 	public TALK_FIRST whoTalksFirst() {
-		return TALK_FIRST.SERVER;
+		return TALK_FIRST.CLIENT;
 	}
 
 	@Override
-	public String processMessage(String message) {
-		message.getBytes();
-		return null;
+	public List<byte[]> processMessage(byte[] message) {
+		SmbPacket packet = new SmbPacket(message);
+		byte smbCommand = packet.getSmbCommand();
+		List<byte[]> response = new ArrayList<byte[]>();
+		switch (state) {
+		case NONE:
+			if (smbCommand == 0x72) {
+				state = STATE.CONNECTED;
+				response.add(packet.getNego());
+			} else {
+				state = STATE.DISCONNECTED;
+				response.add(packet.getTreeDisc());
+			}
+			break;
+		case CONNECTED:
+			if (smbCommand == 0x73) {
+				response.add(packet.getSessSetup());
+			} else if (smbCommand == 0x75) {
+				state = STATE.AUTHENTICATED;
+				response.add(packet.getTreeCon());
+			} else {
+				state = STATE.DISCONNECTED;
+				response.add(packet.getTreeDisc());
+			}
+			break;
+		case AUTHENTICATED:
+			if (smbCommand == (byte) 0xa2) {
+				state = STATE.LISTING;
+				response.add(packet.getNTCreate());
+			} else if (smbCommand == 0x2b) {
+				response.add(packet.getEcho());
+			} else if (smbCommand == 0x32) {
+				response.add(packet.getTrans2());
+			} else if (smbCommand == 0x04) {
+				response.add(packet.getClose());
+			} else if (smbCommand == 0x71) {
+				state = STATE.CLOSED;
+				response.add(packet.getTreeDisc());
+			} else {
+				state = STATE.DISCONNECTED;
+				response.add(packet.getTreeDisc());
+			}
+			break;
+		case LISTING:
+			if (smbCommand == 0x25) {
+				response.add(packet.getTrans());
+			} else if (smbCommand == 0x04) {
+				response.add(packet.getClose());
+			} else if (smbCommand == 0x71) {
+				state = STATE.CLOSED;
+				response.add(packet.getTreeDisc());
+			} else if (smbCommand == 0x72) {
+				state = STATE.CONNECTED;
+				response.add(packet.getNego());
+			} else {
+				state = STATE.DISCONNECTED;
+				response.add(packet.getTreeDisc());
+			}
+			break;
+		case DISCONNECTED:
+			state = STATE.CLOSED;
+			response.add(packet.getTreeDisc());
+			break;
+		default:
+			state = STATE.CLOSED;
+			response.add(packet.getTreeDisc());
+		}
+		return response;
 	}
 
 	@Override
@@ -35,4 +106,532 @@ public final class SMB implements Protocol {
 		return "SMB";
 	}
 
+	public byte[] concat(byte[]... bytes) {
+		int newSize = 0;
+		for (byte[] b : bytes)
+			newSize += b.length;
+		byte[] dst = new byte[newSize];
+
+		int currentPos = 0;
+		int newPos;
+		for (byte[] b : bytes) {
+			newPos = b.length;
+			System.arraycopy(b, 0, dst, currentPos, newPos);
+			currentPos += newPos;
+		}
+		return dst;
+	}
+
+	public byte[] getTimeInBytes() {
+		long time = System.currentTimeMillis();
+		Calendar calend = Calendar.getInstance();
+		calend.setTimeZone(TimeZone.getTimeZone("UTC"));
+		calend.set(1601, 0, 01, 00, 00, 00);
+		time -= calend.getTimeInMillis();
+		time *= 10000;
+
+		byte[] b = new byte[8];
+		byte[] b2 = ByteBuffer.allocate(8).putLong(time).array();
+
+		for (int i = 0, j = 7; i < 8 && j > -1; i++, j--) {
+			b[i] = (byte) (b2[j] & 0xff);
+		}
+
+		return b;
+	}
+
+	public byte[] randomBytes(int size) {
+		byte[] bytes = new byte[size];
+		Random rdm = new Random();
+		rdm.nextBytes(bytes);
+		return bytes;
+	}
+
+	public String charToString(char[] chars) {
+		char[] newChars = new char[chars.length];
+		for (int i = 0, j = 0; i < chars.length && j < newChars.length; i++) {
+			if (isLetter(chars[i])) {
+				newChars[j] = chars[i];
+				j++;
+			}
+		}
+		return new String(newChars);
+	}
+
+	public byte[] charToByte(char[] chars) {
+		byte[] bytes = new byte[chars.length];
+		for (int i = 0; i < chars.length; i++)
+			bytes[i] = (byte) chars[i];
+		return bytes;
+	}
+
+	public char[] byteToChar(byte[] bytes) {
+		char[] chars = new char[bytes.length];
+		for (int i = 0; i < bytes.length; i++)
+			chars[i] = (char) bytes[i];
+		return chars;
+	}
+
+	private boolean isLetter(char c) {
+		return (c >= 32 && c <= 127);
+	}
+
+	private class SmbPacket {
+		private byte[] msg = null;
+		private final byte[] serverGUID = randomBytes(16);
+		private boolean authenticateNext = false;
+
+		private byte[] serverComp = new byte[4];
+		private byte[] smbCommand = new byte[1];
+		private byte[] ntStat = new byte[4];
+		private byte[] smbFlags = new byte[1];
+		private byte[] smbFlags2 = new byte[2];
+		private byte[] processIDHigh = new byte[2];
+		private byte[] signature = new byte[8];
+		private byte[] reserved = new byte[2];
+		private byte[] treeID = new byte[2];
+		private byte[] processID = new byte[2];
+		private byte[] userID = new byte[2];
+		private byte[] multiplexID = new byte[2];
+
+		public SmbPacket(byte[] message) {
+			this.msg = message;
+			serverComp = new byte[] { message[4], message[5], message[6],
+					message[7] };
+			smbCommand = new byte[] { message[8] };
+			ntStat = new byte[] { message[9], message[10], message[11],
+					message[12] };
+			smbFlags = new byte[] { (byte) (message[13] | 0x80) }; // | 0x80 for
+																	// mark
+																	// response
+																	// bit
+			smbFlags2 = new byte[] { message[14], message[15] };
+			processIDHigh = new byte[] { message[16], message[17] };
+			signature = new byte[] { message[18], message[19], message[20],
+					message[21], message[22], message[23], message[24],
+					message[25] };
+			reserved = new byte[] { message[26], message[27] };
+			treeID = new byte[] { message[28], message[29] };
+			processID = new byte[] { message[30], message[31] };
+			userID = new byte[] { message[32], message[33] };
+			multiplexID = new byte[] { message[34], message[35] };
+		}
+
+		private byte[] getNetbios(byte[] response) {
+			byte[] netbios = { 0x00 };
+			byte[] buf = ByteBuffer.allocate(4).putInt(response.length).array(); // allocate(4)
+																					// because
+																					// int
+																					// is
+																					// 4
+																					// bytes
+																					// long
+			byte[] netbiosLength = { buf[1], buf[2], buf[3] }; // only bytes 1-3
+																// needed, byte
+																// 0 is not
+																// needed
+			return concat(netbios, netbiosLength);
+		}
+
+		private byte[] getHeader() {
+			byte[] header = new byte[0];
+			return concat(header, serverComp, smbCommand, ntStat, smbFlags,
+					smbFlags2, processIDHigh, signature, reserved, treeID,
+					processID, userID, multiplexID);
+		}
+
+		public byte[] getNego() {
+			byte[] wordCount = { 0x11 };
+			byte[] dialect = evaluateDialect();
+			byte[] secMode = { 0x03 };
+			byte[] maxMpxC = { 0x32, 0x00 };
+			byte[] maxVcs = { 0x01, 0x00 };
+			byte[] maxBufSize = { 0x04, 0x11, 0x00, 0x00 };
+			byte[] maxRawBuf = { 0x00, 0x00, 0x01, 0x00 };
+			byte[] sessionKey = { 0x00, 0x00, 0x00, 0x00 };
+			byte[] capabilities = { (byte) 0xfc, (byte) 0xe3, 0x01, (byte) 0x80 };
+			byte[] sysTime = getTimeInBytes();
+			byte[] timeZone = { (byte) 0x88, (byte) 0xff }; // FIXME correct
+															// time zone
+			byte[] keyLength = { 0x00 };
+			byte[] byteCount = { 0x3a, 0x00 };
+			byte[] guid = serverGUID;
+			byte[] secBlob = { 0x60, 0x28, 0x06, 0x06 };
+			byte[] oid = { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x02 };
+			byte[] protectNeg = { (byte) 0xa0, 0x1e };
+			byte[] negToken = { 0x30, 0x1c, (byte) 0xa0, 0x1a, 0x30, 0x18 };
+			byte[] mechType = { 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
+					(byte) 0x82, 0x37, 0x02, 0x02, 0x1e };
+			byte[] mechType2 = { 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
+					(byte) 0x82, 0x37, 0x02, 0x02, 0x0a };
+
+			byte[] response = concat(getHeader(), wordCount, dialect, secMode,
+					maxMpxC, maxVcs, maxBufSize, maxRawBuf, sessionKey,
+					capabilities, sysTime, timeZone, keyLength, byteCount,
+					guid, secBlob, oid, protectNeg, negToken, mechType,
+					mechType2);
+			return concat(getNetbios(response), response);
+		}
+
+		private byte[] evaluateDialect() {
+			byte[] dialectMsg = java.util.Arrays.copyOfRange(msg, 39,
+					msg.length);
+			short dialectNumber = 0;
+			for (int i = 0, start = 0; i < dialectMsg.length; i++) {
+				if (dialectMsg[i] == 0x00) {
+					if (new String(java.util.Arrays.copyOfRange(dialectMsg,
+							start, i)).contains("NT LM 0.12")) {
+						return new byte[] { (byte) dialectNumber,
+								(byte) (dialectNumber >> 8) };
+					}
+					start = i + 1;
+					dialectNumber++;
+				}
+			}
+			return new byte[] { 0x00, 0x00 };
+		}
+
+		public byte[] getSessSetup() {
+			if (authenticateNext)
+				return getSetupAuth();
+			else {
+				authenticateNext = true;
+				return getSetupChal();
+			}
+		}
+
+		private byte[] getSetupChal() {
+			byte[] wordCount = { 0x04 };
+			byte[] andXCommand = { (byte) 0xff };
+			byte[] reserved = { 0x00 };
+			byte[] andXOffset = { 0x60, 0x01 };
+			byte[] action = { 0x00, 0x00 };
+			byte[] secBlobLength = { (byte) 0xc7, 0x00 };
+			byte[] byteCount = { 0x35, 0x01 };
+			byte[] secBlob = { (byte) 0xa1, (byte) 0x81, (byte) 0xc4 };
+			byte[] negToken = { 0x30, (byte) 0x81, (byte) 0xc1, (byte) 0xa0,
+					0x03, 0x0a, 0x01 };
+			byte[] negResult = { 0x01 };
+			byte[] negToken2 = { (byte) 0xa1, 0x0c, 0x06, 0x0a };
+			byte[] supportedMech = { 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82,
+					0x37, 0x02, 0x02, 0x0a };
+			byte[] negToken3 = { (byte) 0xa2, (byte) 0x81, (byte) 0xab, 0x04,
+					(byte) 0x81, (byte) 0xa8 };
+			byte[] respToken = { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50,
+					0x00, 0x02, 0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x38,
+					0x00, 0x00, 0x00, 0x15, (byte) 0x82, (byte) 0x8a, 0x62 };
+			byte[] challenge = randomBytes(8);
+			byte[] respToken2 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+					0x00, 0x60, 0x00, 0x60, 0x00, 0x48, 0x00, 0x00, 0x00, 0x06,
+					0x01, (byte) 0xb0, 0x1d, 0x00, 0x00, 0x00, 0x0f, 0x42,
+					0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45,
+					0x00, 0x53, 0x00, 0x53, 0x00, 0x02, 0x00, 0x10, 0x00, 0x42,
+					0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45,
+					0x00, 0x53, 0x00, 0x53, 0x00, 0x01, 0x00, 0x10, 0x00, 0x42,
+					0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45,
+					0x00, 0x53, 0x00, 0x53, 0x00, 0x04, 0x00, 0x10, 0x00, 0x42,
+					0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45,
+					0x00, 0x53, 0x00, 0x53, 0x00, 0x03, 0x00, 0x10, 0x00, 0x42,
+					0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45,
+					0x00, 0x53, 0x00, 0x53, 0x00, 0x07, 0x00, 0x08, 0x00 };
+			byte[] timeStamp = getTimeInBytes();
+			byte[] respToken3 = { 0x00, 0x00, 0x00, 0x00 };
+			byte[] nativOS = { 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
+					0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37, 0x00,
+					0x20, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x66, 0x00,
+					0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
+					0x6e, 0x00, 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x37, 0x00,
+					0x36, 0x00, 0x30, 0x00, 0x30, 0x00, 0x00, 0x00 }; // Windows
+																		// 7
+																		// Professional
+																		// 7600
+			byte[] nativLanMngr = { 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64,
+					0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37,
+					0x00, 0x20, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x66,
+					0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f,
+					0x00, 0x6e, 0x00, 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x36,
+					0x00, 0x2e, 0x00, 0x31, 0x00, 0x00, 0x00 }; // Windows 7
+																// Professional
+																// 6.1
+
+			ntStat = new byte[] { 0x16, 0x00, 0x00, (byte) 0xc0 };
+			userID = new byte[] { 0x00, 0x08 };
+
+			byte[] response = concat(getHeader(), wordCount, andXCommand,
+					reserved, andXOffset, action, secBlobLength, byteCount,
+					secBlob, negToken, negResult, negToken2, supportedMech,
+					negToken3, respToken, challenge, respToken2, timeStamp,
+					respToken3, nativOS, nativLanMngr);
+			return concat(getNetbios(response), response);
+		}
+
+		private byte[] getSetupAuth() {
+			byte[] wordCount = { 0x04 };
+			byte[] andXCommand = { (byte) 0xff };
+			byte[] reserved = { 0x00 };
+			byte[] andXOffset = { (byte) 0xa2, 0x00 };
+			byte[] action = { 0x01, 0x00 };
+			byte[] secBlobLength = { 0x09, 0x00 };
+			byte[] byteCount = { (byte) 0x77, 0x00 };
+			byte[] secBlob = { (byte) 0xa1, 0x07, 0x30, 0x05, (byte) 0xa0,
+					0x03, 0x0a, 0x01, 0x00 };
+			byte[] nativOS = { 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
+					0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37, 0x00,
+					0x20, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x66, 0x00,
+					0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
+					0x6e, 0x00, 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x37, 0x00,
+					0x36, 0x00, 0x30, 0x00, 0x30, 0x00, 0x00, 0x00 }; // Windows
+																		// 7
+																		// Professional
+																		// 7600
+			byte[] nativLanMngr = { 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64,
+					0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37,
+					0x00, 0x20, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x66,
+					0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f,
+					0x00, 0x6e, 0x00, 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x36,
+					0x00, 0x2e, 0x00, 0x31, 0x00, 0x00, 0x00 }; // Windows 7
+																// Professional
+																// 6.1
+
+			byte[] response = concat(getHeader(), wordCount, andXCommand,
+					reserved, andXOffset, action, secBlobLength, byteCount,
+					secBlob, nativOS, nativLanMngr);
+			return concat(getNetbios(response), response);
+		}
+
+		public byte[] getTreeCon() {
+			String str = toString();
+			byte[] wordCount = { 0x00 };
+			byte[] andXCommand = { 0x00, 0x00 };
+			byte[] response = null;
+
+			if (str.contains("IPC$") || str.contains("DOCS")) {
+				wordCount = new byte[] { 0x07 };
+				andXCommand = new byte[] { (byte) 0xff };
+				byte[] reserved = { 0x00 };
+				byte[] andXOffset = { 0x38, 0x00 };
+				byte[] optionalSupport = { 0x01, 0x00 };
+				byte[] maxShareAccess = { (byte) 0xff, (byte) 0xff, 0x1f, 0x00 };
+				byte[] guestMaxShareAccess = { (byte) 0xff, (byte) 0xff, 0x1f,
+						0x00 };
+				byte[] byteCount = { 0x07, 0x00 };
+				byte[] service = { 0x49, 0x50, 0x43, 0x00 };
+				byte[] extraParameters = { 0x00, 0x00, 0x00 };
+
+				treeID = new byte[] { 0x00, 0x08 };
+
+				response = concat(getHeader(), wordCount, andXCommand,
+						reserved, andXOffset, optionalSupport, maxShareAccess,
+						guestMaxShareAccess, byteCount, service,
+						extraParameters);
+			} else if (str.contains("C$") || str.contains("ADMIN$")) {
+				ntStat = new byte[] { 0x22, 0x00, 0x00, (byte) 0xc0 };
+				response = concat(getHeader(), wordCount, andXCommand);
+			} else {
+				ntStat = new byte[] { (byte) 0xcc, 0x00, 0x00, (byte) 0xc0 };
+				response = concat(getHeader(), wordCount, andXCommand);
+			}
+
+			return concat(getNetbios(response), response);
+		}
+
+		public byte[] getNTCreate() {
+			byte[] wordCount = { 0x22 };
+			byte[] andXCommand = { (byte) 0xff };
+			byte[] reserved = { 0x00 };
+			byte[] andXOffset = { 0x67, 0x00 };
+			byte[] oplockLevel = { 0x00 };
+			byte[] fid = { (byte) 0x00, 0x40 };
+			byte[] createAction = { 0x01, 0x00, 0x00, 0x00 };
+			byte[] created = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+			byte[] lastAccess = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+					0x00 };
+			byte[] lastWrite = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+			byte[] change = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+			byte[] fileAttributes = { (byte) 0x80, 0x00, 0x00, 0x00 };
+			byte[] allocationSize = { 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
+					0x00 };
+			byte[] endOfFile = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+			byte[] fileType = { 0x02, 0x00 };
+			byte[] ipcState = { (byte) 0xff, 0x05 };
+			byte[] isDirectory = { 0x00 };
+			byte[] byteCount = { 0x00, 0x00 };
+
+			byte[] response = concat(getHeader(), wordCount, andXCommand,
+					reserved, andXOffset, oplockLevel, fid, createAction,
+					created, lastAccess, lastWrite, change, fileAttributes,
+					allocationSize, endOfFile, fileType, ipcState, isDirectory,
+					byteCount);
+			return concat(getNetbios(response), response);
+		}
+
+		public byte[] getTrans() {
+			byte[] transSub = getTransSub();
+			byte[] response = null;
+			if (transSub[0] == 0x00 && transSub[1] == 0x0b) {
+				byte[] wordCount = { 0x0a };
+				byte[] totalParamCount = { 0x00, 0x00 };
+				byte[] totalDataCount = { 0x44, 0x00 };
+				byte[] reserved = { 0x00, 0x00 };
+				byte[] paramCount = { 0x00, 0x00 };
+				byte[] paramOffset = { 0x38, 0x00 };
+				byte[] paramDisplace = { 0x00, 0x00 };
+				byte[] dataCount = { 0x44, 0x00 };
+				byte[] dataOffset = { 0x38, 0x00 };
+				byte[] dataDisplace = { 0x00, 0x00 };
+				byte[] setupCount = { 0x00 };
+				byte[] reserved2 = { 0x00 };
+				byte[] byteCount = { 0x45, 0x00 };
+				byte[] padding = { 0x00 };
+
+				byte[] dcerpc = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00,
+						0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+						(byte) 0xb8, 0x10, (byte) 0xb8, 0x10, 0x4a, 0x41, 0x00,
+						0x00, 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c,
+						0x73, 0x72, 0x76, 0x73, 0x76, 0x63, 0x00, 0x00, 0x01,
+						0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d,
+						(byte) 0x88, (byte) 0x8a, (byte) 0xeb, 0x1c,
+						(byte) 0xc9, 0x11, (byte) 0x9f, (byte) 0xe8, 0x08,
+						0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 };
+
+				response = concat(getHeader(), wordCount, totalParamCount,
+						totalDataCount, reserved, paramCount, paramOffset,
+						paramDisplace, dataCount, dataOffset, dataDisplace,
+						setupCount, reserved2, byteCount, padding, dcerpc);
+
+			} else if (transSub[0] == 0x00 && transSub[1] == 0x00) {
+				byte[] wordCount = { 0x0a };
+				byte[] totalParamCount = { 0x00, 0x00 };
+				byte[] totalDataCount = { 0x54, 0x01 };
+				byte[] reserved = { 0x00, 0x00 };
+				byte[] paramCount = { 0x00, 0x00 };
+				byte[] paramOffset = { 0x38, 0x00 };
+				byte[] paramDisplace = { 0x00, 0x00 };
+				byte[] dataCount = { 0x54, 0x01 };
+				byte[] dataOffset = { 0x38, 0x00 };
+				byte[] dataDisplace = { 0x00, 0x00 };
+				byte[] setupCount = { 0x00 };
+				byte[] reserved2 = { 0x00 };
+				byte[] byteCount = { 0x55, 0x01 };
+				byte[] padding = { 0x00 };
+
+				byte[] dcerpc = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00,
+						0x00, 0x54, 0x01, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+						0x3c, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+				byte[] serverService = { 0x01, 0x00, 0x00, 0x00, 0x01, 0x00,
+						0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x04, 0x00, 0x00,
+						0x00, 0x04, 0x00, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00,
+						0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, (byte) 0x80,
+						0x0c, 0x00, 0x02, 0x00, 0x10, 0x00, 0x02, 0x00, 0x00,
+						0x00, 0x00, (byte) 0x80, 0x14, 0x00, 0x02, 0x00, 0x18,
+						0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00,
+						0x02, 0x00, 0x20, 0x00, 0x02, 0x00, 0x03, 0x00, 0x00,
+						(byte) 0x80, 0x24, 0x00, 0x02, 0x00, 0x07, 0x00, 0x00,
+						0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
+						0x41, 0x00, 0x44, 0x00, 0x4d, 0x00, 0x49, 0x00, 0x4e,
+						0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00,
+						0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00,
+						0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00,
+						0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64,
+						0x00, 0x6d, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x00, 0x00,
+						0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+						0x00, 0x03, 0x00, 0x00, 0x00, 0x43, 0x00, 0x24, 0x00,
+						0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00,
+						0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x44, 0x00,
+						0x65, 0x00, 0x66, 0x00, 0x61, 0x00, 0x75, 0x00, 0x6c,
+						0x00, 0x74, 0x00, 0x20, 0x00, 0x73, 0x00, 0x68, 0x00,
+						0x61, 0x00, 0x72, 0x00, 0x65, 0x00, 0x00, 0x00, 0x05,
+						0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
+						0x00, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x63, 0x00, 0x73,
+						0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+						0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+						0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00,
+						0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x49, 0x00, 0x50,
+						0x00, 0x43, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00,
+						0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b,
+						0x00, 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00,
+						0x6f, 0x00, 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x49,
+						0x00, 0x50, 0x00, 0x43, 0x00, 0x00, 0x00 };
+				byte[] totalEntries = { 0x00, 0x00, 0x04, 0x00, 0x00, 0x00 };
+				byte[] referentID = { 0x28, 0x00, 0x02, 0x00 };
+				byte[] resumeHandle = { 0x00, 0x00, 0x00, 0x00 };
+				byte[] windowsError = { 0x00, 0x00, 0x00, 0x00 };
+
+				response = concat(getHeader(), wordCount, totalParamCount,
+						totalDataCount, reserved, paramCount, paramOffset,
+						paramDisplace, dataCount, dataOffset, dataDisplace,
+						setupCount, reserved2, byteCount, padding, dcerpc,
+						serverService, totalEntries, referentID, resumeHandle,
+						windowsError);
+
+			}
+
+			return concat(getNetbios(response), response);
+		}
+
+		public byte[] getClose() {
+			byte[] wordCount = { 0x00 };
+			byte[] byteCount = { 0x00, 0x00 };
+
+			smbCommand = new byte[] { 0x04 };
+
+			byte[] response = concat(getHeader(), wordCount, byteCount);
+
+			return concat(getNetbios(response), response);
+		}
+
+		public byte[] getTreeDisc() {
+			byte[] wordCount = { 0x00 };
+			byte[] byteCount = { 0x00, 0x00 };
+
+			smbCommand[0] = 0x71;
+
+			byte[] response = concat(getHeader(), wordCount, byteCount);
+
+			return concat(getNetbios(response), response);
+		}
+
+		public byte[] getEcho() {
+			byte[] wordCount = { 0x01 };
+			byte[] echoSeq = { 0x01, 0x00 };
+			byte[] byteCount = { 0x10, 0x00 };
+			byte[] echoData = { (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
+					(byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
+					(byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
+					(byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
+					(byte) 0xf0 };
+			byte[] response = concat(getHeader(), wordCount, echoSeq,
+					byteCount, echoData);
+			return concat(getNetbios(response), response);
+
+		}
+
+		public byte[] getTrans2() {
+			byte[] response = null;
+			byte[] wordCount = { 0x00 };
+			byte[] andXCommand = { 0x00, 0x00 };
+			ntStat = new byte[] { 0x22, 0x00, 0x00, (byte) 0xc0 };
+			response = concat(getHeader(), wordCount, andXCommand);
+			return concat(getNetbios(response), response);
+		}
+
+		private byte[] getTransSub() {
+			byte[] transSub = new byte[2];
+			if (smbCommand[0] == 0x32)
+				transSub = new byte[] { msg[66], msg[65] };
+			else if (smbCommand[0] == 0x25)
+				transSub = new byte[] { 0x00, msg[90] };
+			else
+				transSub = new byte[] { 0x00, 0x00 };
+			return transSub;
+		}
+
+		public String toString() {
+			return new String(msg);
+		}
+
+		public byte getSmbCommand() {
+			return smbCommand[0];
+		}
+	}
 }

src/de/tudarmstadt/informatik/hostage/protocol/SSH.java

@@ -1,6 +1,7 @@
 package de.tudarmstadt.informatik.hostage.protocol;
 
-import java.util.regex.Pattern;
+import java.util.ArrayList;
+import java.util.List;
 
 public final class SSH implements Protocol {
 
@@ -17,25 +18,13 @@ public final class SSH implements Protocol {
 
 	@Override
 	public TALK_FIRST whoTalksFirst() {
-		return TALK_FIRST.SERVER;
+		return TALK_FIRST.CLIENT;
 	}
 
 	@Override
-	public String processMessage(String message) {
-		switch (state) {
-		case NONE:
-			state = STATE.OPEN;
-			return "Connection established.";
-		case OPEN:
-			if (Pattern.matches("^QUIT\\s?", message)) {
-				state = STATE.CLOSED;
-				return null;
-			} else {
-				return message;
-			}
-		default:
-			return "Connection closed.";
-		}
+	public List<byte[]> processMessage(byte[] message) {
+		List<byte[]> response = new ArrayList<byte[]>();
+		return response;
 	}
 
 	@Override

src/de/tudarmstadt/informatik/hostage/protocol/TELNET.java

@@ -1,13 +1,19 @@
 package de.tudarmstadt.informatik.hostage.protocol;
 
+import java.util.ArrayList;
+import java.util.List;
+
 public final class TELNET implements Protocol {
 
 	private static enum STATE {
-		NONE, OPEN, CLOSED
+		NONE, OPEN, CLOSED, LOGIN, AUTHENTICATE, LOGGED_IN
 	};
 
 	private STATE state = STATE.NONE;
 
+	private byte[] usr;
+	private byte[] cmd;
+
 	@Override
 	public int getPort() {
 		return 8023;
@@ -15,13 +21,53 @@ public final class TELNET implements Protocol {
 
 	@Override
 	public TALK_FIRST whoTalksFirst() {
-		return TALK_FIRST.SERVER;
+		return TALK_FIRST.CLIENT;
 	}
 
 	@Override
-	public String processMessage(String message) {
-		message.getBytes();
-		return null;
+	public List<byte[]> processMessage(byte[] message) {
+		List<byte[]> response = new ArrayList<byte[]>();
+		switch (state) {
+		case NONE:
+			response.add(cmdRequests);
+			response.add(getCmdResponses(message));
+			state = STATE.OPEN;
+			break;
+		case OPEN:
+			response.add("Debian GNU/Linux 7.0\r\n".getBytes());
+			response.add("raspberrypi login: ".getBytes());
+			state = STATE.LOGIN;
+			break;
+		case LOGIN:
+			usr = java.util.Arrays.copyOfRange(message, 0, message.length - 2);
+			response.add("Password: ".getBytes());
+			state = STATE.AUTHENTICATE;
+			break;
+		case AUTHENTICATE:
+			response.add("Last Login: \r\nLinux raspberrypi 3.6.11+\r\n"
+					.getBytes());
+			response.add(concatenate(a, usr, b, usr, c));
+			state = STATE.LOGGED_IN;
+			break;
+		case LOGGED_IN:
+			cmd = java.util.Arrays.copyOfRange(message, 0, message.length - 2);
+			if (new String(cmd).contains("exit")) {
+				response.add("logout\r\n".getBytes());
+				state = STATE.CLOSED;
+			} else {
+				String bash = "-bash: " + new String(cmd)
+						+ ": command not found";
+				response.add(bash.getBytes());
+				response.add("\r\n".getBytes());
+				response.add(concatenate(a, usr, b, usr, c));
+			}
+			break;
+		default:
+			response.add("\r\nlogout\r\n".getBytes());
+			state = STATE.CLOSED;
+			break;
+		}
+		return response;
 	}
 
 	@Override
@@ -34,4 +80,47 @@ public final class TELNET implements Protocol {
 		return "TELNET";
 	}
 
+	private byte[] getCmdResponses(byte[] request) {
+		byte[] resp = new byte[request.length];
+		for (int i = 0; i < resp.length - 2; i += 3) { // respond to all
+														// requests with no
+			resp[i] = (byte) 0xff;
+			if (request[i + 1] == (byte) 0xfb)
+				resp[i + 1] = (byte) 0xfe;
+			else if (request[i + 1] == (byte) 0xfd)
+				resp[i + 1] = (byte) 0xfc;
+			else
+				resp[i + 1] = (byte) 0xfe;
+			resp[i + 2] = request[i + 2];
+		}
+		return resp;
+	}
+
+	private final byte[] cmdRequests = { (byte) 0xff, (byte) 0xfd, 0x18,
+			(byte) 0xff, (byte) 0xfd, 0x20, (byte) 0xff, (byte) 0xfd, 0x27 };
+	private final byte[] a = { 0x1b, 0x5d, 0x30, 0x3b };
+	private final byte[] b = { 0x40, 0x72, 0x61, 0x73, 0x70, 0x62, 0x65, 0x72,
+			0x72, 0x79, 0x70, 0x69, 0x3a, 0x20, 0x7e, 0x07, 0x1b, 0x5b, 0x30,
+			0x31, 0x3b, 0x33, 0x32, 0x6d };
+	private final byte[] c = { 0x40, 0x72, 0x61, 0x73, 0x70, 0x62, 0x65, 0x72,
+			0x72, 0x79, 0x70, 0x69, 0x1b, 0x5b, 0x30, 0x30, 0x6d, 0x20, 0x1b,
+			0x5b, 0x30, 0x31, 0x3b, 0x33, 0x34, 0x6d, 0x7e, 0x20, 0x24, 0x1b,
+			0x5b, 0x30, 0x30, 0x6d, 0x20 };
+
+	public byte[] concatenate(byte[]... bytes) {
+		int newSize = 0;
+		for (byte[] b : bytes)
+			newSize += b.length;
+		byte[] dst = new byte[newSize];
+
+		int currentPos = 0;
+		int newPos;
+		for (byte[] b : bytes) {
+			newPos = b.length;
+			System.arraycopy(b, 0, dst, currentPos, newPos);
+			currentPos += newPos;
+		}
+		return dst;
+	}
+
 }