|
@@ -8,16 +8,18 @@ import java.util.GregorianCalendar;
|
|
|
import java.util.List;
|
|
|
import java.util.TimeZone;
|
|
|
|
|
|
+import android.content.Context;
|
|
|
import de.tudarmstadt.informatik.hostage.HoneyService;
|
|
|
import de.tudarmstadt.informatik.hostage.R;
|
|
|
import de.tudarmstadt.informatik.hostage.commons.HelperUtils;
|
|
|
import de.tudarmstadt.informatik.hostage.wrapper.Packet;
|
|
|
|
|
|
/**
|
|
|
- * SMB protocol.
|
|
|
- * It can handle the following requests: Negotiate Protocol Request, Session Setup AndX Request,
|
|
|
- * Tree Connect AndX Request, NT Create AndX Request, Bind, NetShareEnumAll, Close Request,
|
|
|
- * Tree Disconnect Request, Echo Request, Trans2 Request.
|
|
|
+ * SMB protocol. It can handle the following requests: Negotiate Protocol
|
|
|
+ * Request, Session Setup AndX Request, Tree Connect AndX Request, NT Create
|
|
|
+ * AndX Request, Bind, NetShareEnumAll, Close Request, Tree Disconnect Request,
|
|
|
+ * Echo Request, Trans2 Request.
|
|
|
+ *
|
|
|
* @author Wulf Pfeiffer
|
|
|
*/
|
|
|
public class SMB implements Protocol {
|
|
@@ -27,28 +29,164 @@ public class SMB implements Protocol {
|
|
|
private static enum STATE {
|
|
|
NONE, CONNECTED, AUTHENTICATED, LISTING, DISCONNECTED, CLOSED
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
+ // version stuff
|
|
|
+ private static String[][] possibleSmbVersions = {
|
|
|
+ { "Windows 7 Professional 7600", "Windows 7 Professional 6.1" },
|
|
|
+ { "Windows 8 Enterprise 9200", "Windows 8 Enterprise 9200" },
|
|
|
+ { "Windows Server 2008 R2 Enterprise 7600",
|
|
|
+ "Windows Server 2008 R2 Enterprise 6.1" },
|
|
|
+ { "Windows Server 2012 Standard 6.2",
|
|
|
+ "Windows Server 2012 Standard 6.2" }, { "Unix", "Samba" } };
|
|
|
+
|
|
|
+ /**
|
|
|
+ * Converts the current system time into a byte[] with windows specific time
|
|
|
+ *
|
|
|
+ * @return current system time in windows format as byte[]
|
|
|
+ */
|
|
|
+ private static byte[] getTimeInBytes() {
|
|
|
+ long time = System.currentTimeMillis();
|
|
|
+ Calendar calend = Calendar.getInstance();
|
|
|
+ calend.setTimeZone(TimeZone.getTimeZone("UTC"));
|
|
|
+ calend.set(1601, 0, 01, 00, 00, 00);
|
|
|
+ time -= calend.getTimeInMillis();
|
|
|
+ time *= 10000;
|
|
|
+
|
|
|
+ byte[] timeInWindowsBytes = new byte[8];
|
|
|
+ byte[] timeInBytes = ByteBuffer.allocate(8).putLong(time).array();
|
|
|
+
|
|
|
+ for (int i = 0, j = 7; i < 8 && j > -1; i++, j--) {
|
|
|
+ timeInWindowsBytes[i] = (byte) (timeInBytes[j] & 0xff);
|
|
|
+ }
|
|
|
+
|
|
|
+ return timeInWindowsBytes;
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
+ * Converts the current timezone into a byte[] with windows specific format
|
|
|
+ *
|
|
|
+ * @return current timezone in windows format as byte[]
|
|
|
+ */
|
|
|
+ private static byte[] getTimeZoneInBytes() {
|
|
|
+ Integer offset = new GregorianCalendar().getTimeZone().getRawOffset() / 1000 / 60; // get
|
|
|
+ // current
|
|
|
+ // timezone
|
|
|
+ // offset
|
|
|
+ // in
|
|
|
+ // minutes
|
|
|
+ char[] offsetChars = Integer.toBinaryString(offset).toCharArray();
|
|
|
+ boolean invert = false;
|
|
|
+ for (int i = offsetChars.length - 1; i > -1; i--) {
|
|
|
+ if (!invert && offsetChars[i] == '1') {
|
|
|
+ invert = true;
|
|
|
+ } else if (invert) {
|
|
|
+ offsetChars[i] = (offsetChars[i] == '0') ? '1' : '0';
|
|
|
+ }
|
|
|
+ }
|
|
|
+ char[] extendedChars = new char[31];
|
|
|
+ for (int i = 0; i < extendedChars.length - offsetChars.length; i++) {
|
|
|
+ extendedChars[i] = '1';
|
|
|
+ }
|
|
|
+ for (int i = 0; i < offsetChars.length; i++) {
|
|
|
+ extendedChars[i + extendedChars.length - offsetChars.length] = offsetChars[i];
|
|
|
+ }
|
|
|
+ int timezone = Integer.parseInt(new String(extendedChars), 2);
|
|
|
+ byte[] timezoneBytes = new byte[2];
|
|
|
+ timezoneBytes[1] = (byte) (timezone >> 8);
|
|
|
+ timezoneBytes[0] = (byte) (timezone);
|
|
|
+ return timezoneBytes;
|
|
|
+ }
|
|
|
+
|
|
|
+ private static String[] initServerVersion() {
|
|
|
+ String sharedPreferencePath = HoneyService.getContext().getString(
|
|
|
+ R.string.shared_preference_path);
|
|
|
+ String profile = HoneyService
|
|
|
+ .getContext()
|
|
|
+ .getSharedPreferences(sharedPreferencePath,
|
|
|
+ Context.MODE_PRIVATE).getString("profile", "");
|
|
|
+ System.out.println(profile);
|
|
|
+ if (profile.equals("Windows 7")) {
|
|
|
+ return possibleSmbVersions[0];
|
|
|
+ } else if (profile.equals("Windows 8")) {
|
|
|
+ return possibleSmbVersions[1];
|
|
|
+ } else if (profile.equals("Windows Server 2008")) {
|
|
|
+ return possibleSmbVersions[2];
|
|
|
+ } else if (profile.equals("Windows Server 2012")) {
|
|
|
+ return possibleSmbVersions[3];
|
|
|
+ } else if (profile.equals("Linux")) {
|
|
|
+ return possibleSmbVersions[4];
|
|
|
+ } else {
|
|
|
+ return possibleSmbVersions[new SecureRandom()
|
|
|
+ .nextInt(possibleSmbVersions.length)];
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
/**
|
|
|
* Denotes in which state the protocol is right now
|
|
|
*/
|
|
|
private STATE state = STATE.NONE;
|
|
|
|
|
|
private byte[] lastMessage;
|
|
|
-
|
|
|
+
|
|
|
+ private static byte[] serverName = HelperUtils.fillWithZero(HelperUtils
|
|
|
+ .getRandomString(16, true).getBytes());
|
|
|
+
|
|
|
+ private static String[] serverVersion = initServerVersion();
|
|
|
+
|
|
|
+ private byte[] message = null;
|
|
|
+
|
|
|
+ private static final byte[] serverGUID = HelperUtils.randomBytes(16);
|
|
|
+
|
|
|
+ private boolean authenticateNext = false;
|
|
|
+
|
|
|
+ // components of a SMB packet
|
|
|
+ private byte[] serverComp = new byte[4];
|
|
|
+
|
|
|
+ private byte[] smbCommand = new byte[1];
|
|
|
+ private byte[] ntStat = new byte[4];
|
|
|
+
|
|
|
+ private byte[] smbFlags = new byte[1];
|
|
|
+ private byte[] smbFlags2 = new byte[2];
|
|
|
+ private byte[] processIDHigh = new byte[2];
|
|
|
+ private byte[] signature = new byte[8];
|
|
|
+ private byte[] reserved = new byte[2];
|
|
|
+ private byte[] treeID = new byte[2];
|
|
|
+ private byte[] processID = new byte[2];
|
|
|
+ private byte[] userID = new byte[2];
|
|
|
+ private byte[] multiplexID = new byte[2];
|
|
|
+ // message constants
|
|
|
+ private static final byte SMB_COM_CLOSE = 0x04;
|
|
|
+ private static final byte SMB_COM_TRANSACTION = 0x25;
|
|
|
+ private static final byte SMB_COM_ECHO = 0x2B;
|
|
|
+ private static final byte SMB_COM_TRANSACTION2 = 0x32;
|
|
|
+ private static final byte SMB_COM_TREE_DISCONNECT = 0x71;
|
|
|
+ private static final byte SMB_COM_NEGOTIATE = 0x72;
|
|
|
+
|
|
|
+ private static final byte SMB_COM_SESSION_SETUP_ANDX = 0x73;
|
|
|
+
|
|
|
+ private static final byte SMB_COM_TREE_CONNECT_ANDX = 0x75;
|
|
|
+
|
|
|
+ private static final byte SMB_COM_NT_CREATE_ANDX = (byte) 0xA2;
|
|
|
+
|
|
|
@Override
|
|
|
- public int getDefaultPort() {
|
|
|
+ public int getPort() {
|
|
|
return 445;
|
|
|
}
|
|
|
|
|
|
@Override
|
|
|
- public TALK_FIRST whoTalksFirst() {
|
|
|
- return TALK_FIRST.CLIENT;
|
|
|
+ public boolean isClosed() {
|
|
|
+ return (state == STATE.CLOSED);
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public boolean isSecure() {
|
|
|
+ return false;
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
@Override
|
|
|
public List<Packet> processMessage(Packet requestPacket) {
|
|
|
- if(requestPacket != null)
|
|
|
- lastMessage = requestPacket.getMessage();
|
|
|
+ if (requestPacket != null)
|
|
|
+ lastMessage = requestPacket.getBytes();
|
|
|
parseMessageHeader(lastMessage);
|
|
|
byte smbCommand = getSmbCommand();
|
|
|
List<Packet> responsePackets = new ArrayList<Packet>();
|
|
@@ -120,615 +258,593 @@ public class SMB implements Protocol {
|
|
|
}
|
|
|
|
|
|
@Override
|
|
|
- public boolean isClosed() {
|
|
|
- return (state == STATE.CLOSED);
|
|
|
- }
|
|
|
-
|
|
|
- @Override
|
|
|
- public boolean isSecure() {
|
|
|
- return false;
|
|
|
+ public String toString() {
|
|
|
+ return "SMB";
|
|
|
}
|
|
|
|
|
|
@Override
|
|
|
- public Class<byte[]> getType() {
|
|
|
- return byte[].class;
|
|
|
+ public TALK_FIRST whoTalksFirst() {
|
|
|
+ return TALK_FIRST.CLIENT;
|
|
|
}
|
|
|
|
|
|
- @Override
|
|
|
- public String toString() {
|
|
|
- return "SMB";
|
|
|
+ /**
|
|
|
+ * Evaluates what Dialects are offered by the client and which position the
|
|
|
+ * used NT LM 0.12 dialect is at
|
|
|
+ *
|
|
|
+ * @return position of the NT LM 0.12 dialect
|
|
|
+ */
|
|
|
+ private byte[] evaluateDialect() {
|
|
|
+ byte[] dialectMsg = new byte[message.length - 39];
|
|
|
+ System.arraycopy(message, 39, dialectMsg, 0, message.length - 39);
|
|
|
+ short dialectNumber = 0;
|
|
|
+ for (int i = 0, start = 0; i < dialectMsg.length; i++) {
|
|
|
+ if (dialectMsg[i] == 0x00) {
|
|
|
+ byte[] dialect = new byte[i - start];
|
|
|
+ System.arraycopy(dialectMsg, start, dialect, 0, i - start);
|
|
|
+ if (HelperUtils.byteToStr(dialect).contains("NT LM 0.12")) {
|
|
|
+ return new byte[] { (byte) dialectNumber,
|
|
|
+ (byte) (dialectNumber >> 8) };
|
|
|
+ }
|
|
|
+ start = i + 1;
|
|
|
+ dialectNumber++;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ return new byte[] { 0x00, 0x00 };
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
- * Converts the current system time into a byte[] with windows specific time
|
|
|
- * @return current system time in windows format as byte[]
|
|
|
+ * Builds the close packet
|
|
|
+ *
|
|
|
+ * @return close packet
|
|
|
*/
|
|
|
- private static byte[] getTimeInBytes() {
|
|
|
- long time = System.currentTimeMillis();
|
|
|
- Calendar calend = Calendar.getInstance();
|
|
|
- calend.setTimeZone(TimeZone.getTimeZone("UTC"));
|
|
|
- calend.set(1601, 0, 01, 00, 00, 00);
|
|
|
- time -= calend.getTimeInMillis();
|
|
|
- time *= 10000;
|
|
|
+ private Packet getClose() {
|
|
|
+ byte[] wordCount = { 0x00 };
|
|
|
+ byte[] byteCount = { 0x00, 0x00 };
|
|
|
|
|
|
- byte[] timeInWindowsBytes = new byte[8];
|
|
|
- byte[] timeInBytes = ByteBuffer.allocate(8).putLong(time).array();
|
|
|
+ smbCommand = new byte[] { 0x04 };
|
|
|
|
|
|
- for (int i = 0, j = 7; i < 8 && j > -1; i++, j--) {
|
|
|
- timeInWindowsBytes[i] = (byte) (timeInBytes[j] & 0xff);
|
|
|
- }
|
|
|
+ byte[] response = HelperUtils.concat(wordCount, byteCount);
|
|
|
|
|
|
- return timeInWindowsBytes;
|
|
|
+ return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Converts the current timezone into a byte[] with windows specific format
|
|
|
- * @return current timezone in windows format as byte[]
|
|
|
+ * Builds the DCERPC packet
|
|
|
+ *
|
|
|
+ * @return DCERPC packet
|
|
|
*/
|
|
|
- private static byte[] getTimeZoneInBytes() {
|
|
|
- Integer offset = new GregorianCalendar().getTimeZone().getRawOffset() / 1000 / 60; // get current timezone offset in minutes
|
|
|
- char[] offsetChars = Integer.toBinaryString(offset).toCharArray();
|
|
|
- boolean invert = false;
|
|
|
- for(int i = offsetChars.length-1; i > -1; i--) {
|
|
|
- if(!invert && offsetChars[i] == '1') {
|
|
|
- invert = true;
|
|
|
- } else if(invert) {
|
|
|
- offsetChars[i] = (offsetChars[i] == '0')? '1' : '0';
|
|
|
- }
|
|
|
- }
|
|
|
- char[] extendedChars = new char[31];
|
|
|
- for(int i = 0; i < extendedChars.length-offsetChars.length; i++) {
|
|
|
- extendedChars[i] = '1';
|
|
|
- }
|
|
|
- for(int i = 0; i < offsetChars.length; i++) {
|
|
|
- extendedChars[i+extendedChars.length-offsetChars.length] = offsetChars[i];
|
|
|
- }
|
|
|
- int timezone = (int) Integer.parseInt(new String(extendedChars), 2);
|
|
|
- byte[] timezoneBytes = new byte[2];
|
|
|
- timezoneBytes[1] = (byte) (timezone >> 8);
|
|
|
- timezoneBytes[0] = (byte) (timezone);
|
|
|
- return timezoneBytes;
|
|
|
- }
|
|
|
+ private byte[] getDceRpc(byte[] transSub, int length) {
|
|
|
+ byte[] majorVersion = { 0x05 };
|
|
|
+ byte[] minorVersion = { 0x00 };
|
|
|
+ byte[] packetType = null;
|
|
|
+ byte[] packetFlags = { 0x03 };
|
|
|
+ byte[] dataRepres = { 0x10, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] fragLength = null;
|
|
|
+ byte[] authLength = { 0x00, 0x00 };
|
|
|
+ byte[] callID = null;
|
|
|
+ byte[] response = null;
|
|
|
|
|
|
- //version stuff
|
|
|
- private static String[][] possibleSmbVersions = {
|
|
|
- {"Windows 7 Professional 7600","Windows 7 Professional 6.1"},
|
|
|
- {"Windows 8 Enterprise 9200", "Windows 8 Enterprise 9200"},
|
|
|
- {"Windows Server 2008 R2 Enterprise 7600","Windows Server 2008 R2 Enterprise 6.1"},
|
|
|
- {"Windows Server 2012 Standard 6.2", "Windows Server 2012 Standard 6.2"},
|
|
|
- {"Unix", "Samba"}
|
|
|
- };
|
|
|
- private static String[] initServerVersion() {
|
|
|
- String sharedPreferencePath = HoneyService.getContext().getString(R.string.shared_preference_path);
|
|
|
- String profile = HoneyService.getContext().getSharedPreferences(sharedPreferencePath, HoneyService.MODE_PRIVATE).getString("profile", "");
|
|
|
- System.out.println(profile);
|
|
|
- if(profile.equals("Windows 7")) {
|
|
|
- return possibleSmbVersions[0];
|
|
|
- } else if(profile.equals("Windows 8")) {
|
|
|
- return possibleSmbVersions[1];
|
|
|
- } else if(profile.equals("Windows Server 2008")) {
|
|
|
- return possibleSmbVersions[2];
|
|
|
- } else if(profile.equals("Windows Server 2012")) {
|
|
|
- return possibleSmbVersions[3];
|
|
|
- } else if(profile.equals("Linux")) {
|
|
|
- return possibleSmbVersions[4];
|
|
|
- } else {
|
|
|
- return possibleSmbVersions[new SecureRandom().nextInt(possibleSmbVersions.length)];
|
|
|
+ if (transSub[0] == 0x00 && transSub[1] == 0x0b) {
|
|
|
+ packetType = new byte[] { 0x0c };
|
|
|
+ fragLength = new byte[] { 0x44, 0x00 };
|
|
|
+ callID = new byte[] { 0x01, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] maxXmitFrag = { (byte) 0xb8, 0x10 };
|
|
|
+ byte[] maxRecvFrag = { (byte) 0xb8, 0x10 };
|
|
|
+ byte[] assocGroup = { 0x4a, 0x41, 0x00, 0x00 };
|
|
|
+ byte[] scndryAddrLen = { 0x0d, 0x00 };
|
|
|
+ byte[] scndryAddr = { 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x73,
|
|
|
+ 0x72, 0x76, 0x73, 0x76, 0x63, 0x00, 0x00 };
|
|
|
+ byte[] numResults = { 0x01, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] ctxItem = { 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, (byte) 0x88,
|
|
|
+ (byte) 0x8a, (byte) 0xeb, 0x1c, (byte) 0xc9, 0x11,
|
|
|
+ (byte) 0x9f, (byte) 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48,
|
|
|
+ 0x60, 0x02, 0x00, 0x00, 0x00 };
|
|
|
+
|
|
|
+ response = HelperUtils.concat(majorVersion, minorVersion,
|
|
|
+ packetType, packetFlags, dataRepres, fragLength,
|
|
|
+ authLength, callID, maxXmitFrag, maxRecvFrag, assocGroup,
|
|
|
+ scndryAddrLen, scndryAddr, numResults, ctxItem);
|
|
|
+ } else if (transSub[0] == 0x00 && transSub[1] == 0x00) {
|
|
|
+ packetType = new byte[] { 0x02 };
|
|
|
+ byte[] tmp = ByteBuffer.allocate(4).putInt(length).array();
|
|
|
+ fragLength = new byte[] { tmp[3], tmp[2] };
|
|
|
+ callID = new byte[] { 0x02, 0x00, 0x00, 0x00 };
|
|
|
+ tmp = ByteBuffer.allocate(4).putInt(length - 24).array();
|
|
|
+ byte[] allocHint = new byte[] { tmp[3], tmp[2], tmp[1], tmp[0] };
|
|
|
+ byte[] contextID = { 0x00, 0x00 };
|
|
|
+ byte[] cancelCount = { 0x00, 0x00 };
|
|
|
+
|
|
|
+ response = HelperUtils.concat(majorVersion, minorVersion,
|
|
|
+ packetType, packetFlags, dataRepres, fragLength,
|
|
|
+ authLength, callID, allocHint, contextID, cancelCount);
|
|
|
}
|
|
|
+ return response;
|
|
|
}
|
|
|
-
|
|
|
- private static byte[] serverName = HelperUtils.fillWithZero(HelperUtils.getRandomString(16, true).getBytes());
|
|
|
- private static String[] serverVersion = initServerVersion();
|
|
|
-
|
|
|
- private byte[] message = null;
|
|
|
- private static final byte[] serverGUID = HelperUtils.randomBytes(16);
|
|
|
- private boolean authenticateNext = false;
|
|
|
- //components of a SMB packet
|
|
|
- private byte[] serverComp = new byte[4];
|
|
|
- private byte[] smbCommand = new byte[1];
|
|
|
- private byte[] ntStat = new byte[4];
|
|
|
- private byte[] smbFlags = new byte[1];
|
|
|
- private byte[] smbFlags2 = new byte[2];
|
|
|
- private byte[] processIDHigh = new byte[2];
|
|
|
- private byte[] signature = new byte[8];
|
|
|
- private byte[] reserved = new byte[2];
|
|
|
- private byte[] treeID = new byte[2];
|
|
|
- private byte[] processID = new byte[2];
|
|
|
- private byte[] userID = new byte[2];
|
|
|
- private byte[] multiplexID = new byte[2];
|
|
|
|
|
|
/**
|
|
|
- * Breaks a message from the client down into its components
|
|
|
- * @param message that is analyzed
|
|
|
- */
|
|
|
- private void parseMessageHeader(byte[] message) {
|
|
|
- this.message = message;
|
|
|
- serverComp = new byte[]{message[4], message[5], message[6], message[7]};
|
|
|
- smbCommand = new byte[]{message[8]};
|
|
|
- ntStat = new byte[]{message[9], message[10], message[11], message[12]};
|
|
|
- smbFlags = new byte[]{(byte) (message[13] | 0x80)}; // | 0x80 for mark response bit
|
|
|
- smbFlags2 = new byte[]{message[14], message[15]};
|
|
|
- processIDHigh = new byte[]{message[16], message[17]};
|
|
|
- signature = new byte[]{message[18], message[19], message[20], message[21], message[22], message[23], message[24], message[25]};
|
|
|
- reserved = new byte[]{message[26], message[27]};
|
|
|
- treeID = new byte[]{message[28], message[29]};
|
|
|
- processID = new byte[]{message[30], message[31]};
|
|
|
- userID = new byte[]{message[32], message[33]};
|
|
|
- multiplexID = new byte[]{message[34], message[35]};
|
|
|
- }
|
|
|
-
|
|
|
- /**
|
|
|
- * Wraps the Netbios header around a response
|
|
|
- * @param response that is wrapped
|
|
|
- * @return wrapped response
|
|
|
- */
|
|
|
- private byte[] wrapNetbios(byte[] response) {
|
|
|
- byte[] netbios = {0x00};
|
|
|
- byte[] buffer = ByteBuffer.allocate(4).putInt(response.length).array(); // allocate(4) because int is 4 bytes long
|
|
|
- byte[] netbiosLength = {buffer[1], buffer[2], buffer[3]}; // only bytes 1-3 needed, byte 0 is not needed
|
|
|
- return HelperUtils.concat(netbios, netbiosLength, response);
|
|
|
- }
|
|
|
-
|
|
|
- /**
|
|
|
- * Wraps the header around a response
|
|
|
- * @param response that is wrapped
|
|
|
- * @return wrapped response
|
|
|
+ * Builds the echo packet
|
|
|
+ *
|
|
|
+ * @return echo packet
|
|
|
*/
|
|
|
- private byte[] wrapHeader(byte[] response) {
|
|
|
- byte[] header = new byte[0];
|
|
|
- return HelperUtils.concat(header, serverComp, smbCommand, ntStat, smbFlags, smbFlags2, processIDHigh, signature,
|
|
|
- reserved, treeID, processID, userID, multiplexID, response);
|
|
|
+ private Packet getEcho() {
|
|
|
+ byte[] wordCount = { 0x01 };
|
|
|
+ byte[] echoSeq = { 0x01, 0x00 };
|
|
|
+ byte[] byteCount = { 0x10, 0x00 };
|
|
|
+ byte[] echoData = { (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
|
|
|
+ (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
|
|
|
+ (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
|
|
|
+ (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0 };
|
|
|
+ byte[] response = HelperUtils.concat(wordCount, echoSeq, byteCount,
|
|
|
+ echoData);
|
|
|
+ return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* Builds the negotiate packet
|
|
|
+ *
|
|
|
* @return negotiate packet
|
|
|
*/
|
|
|
private Packet getNego() {
|
|
|
- byte[] wordCount = {0x11};
|
|
|
- byte[] dialect = evaluateDialect();
|
|
|
- byte[] secMode = {0x03};
|
|
|
- byte[] maxMpxC = {0x32, 0x00};
|
|
|
- byte[] maxVcs = {0x01, 0x00};
|
|
|
- byte[] maxBufSize = {0x04, 0x11, 0x00, 0x00};
|
|
|
- byte[] maxRawBuf = {0x00, 0x00, 0x01, 0x00};
|
|
|
- byte[] sessionKey = {0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] capabilities = {(byte) 0xfc, (byte) 0xe3, 0x01, (byte) 0x80};
|
|
|
- byte[] sysTime = getTimeInBytes();
|
|
|
- byte[] timeZone = getTimeZoneInBytes();
|
|
|
- byte[] keyLength = {0x00};
|
|
|
- byte[] byteCount = {0x3a, 0x00};
|
|
|
- byte[] guid = serverGUID;
|
|
|
- byte[] secBlob = {0x60, 0x28, 0x06, 0x06};
|
|
|
- byte[] oid = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x02};
|
|
|
- byte[] protectNeg = {(byte) 0xa0, 0x1e};
|
|
|
- byte[] negToken = {0x30, 0x1c, (byte) 0xa0, 0x1a, 0x30, 0x18};
|
|
|
- byte[] mechType = {0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82, 0x37, 0x02, 0x02, 0x1e};
|
|
|
- byte[] mechType2 = {0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82, 0x37, 0x02, 0x02, 0x0a};
|
|
|
-
|
|
|
- byte[] response = HelperUtils.concat(wordCount, dialect, secMode, maxMpxC, maxVcs, maxBufSize, maxRawBuf,
|
|
|
- sessionKey, capabilities, sysTime, timeZone, keyLength, byteCount, guid, secBlob, oid,
|
|
|
- protectNeg, negToken, mechType, mechType2);
|
|
|
+ byte[] wordCount = { 0x11 };
|
|
|
+ byte[] dialect = evaluateDialect();
|
|
|
+ byte[] secMode = { 0x03 };
|
|
|
+ byte[] maxMpxC = { 0x32, 0x00 };
|
|
|
+ byte[] maxVcs = { 0x01, 0x00 };
|
|
|
+ byte[] maxBufSize = { 0x04, 0x11, 0x00, 0x00 };
|
|
|
+ byte[] maxRawBuf = { 0x00, 0x00, 0x01, 0x00 };
|
|
|
+ byte[] sessionKey = { 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] capabilities = { (byte) 0xfc, (byte) 0xe3, 0x01, (byte) 0x80 };
|
|
|
+ byte[] sysTime = getTimeInBytes();
|
|
|
+ byte[] timeZone = getTimeZoneInBytes();
|
|
|
+ byte[] keyLength = { 0x00 };
|
|
|
+ byte[] byteCount = { 0x3a, 0x00 };
|
|
|
+ byte[] guid = serverGUID;
|
|
|
+ byte[] secBlob = { 0x60, 0x28, 0x06, 0x06 };
|
|
|
+ byte[] oid = { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x02 };
|
|
|
+ byte[] protectNeg = { (byte) 0xa0, 0x1e };
|
|
|
+ byte[] negToken = { 0x30, 0x1c, (byte) 0xa0, 0x1a, 0x30, 0x18 };
|
|
|
+ byte[] mechType = { 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
|
|
|
+ (byte) 0x82, 0x37, 0x02, 0x02, 0x1e };
|
|
|
+ byte[] mechType2 = { 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
|
|
|
+ (byte) 0x82, 0x37, 0x02, 0x02, 0x0a };
|
|
|
+
|
|
|
+ byte[] response = HelperUtils.concat(wordCount, dialect, secMode,
|
|
|
+ maxMpxC, maxVcs, maxBufSize, maxRawBuf, sessionKey,
|
|
|
+ capabilities, sysTime, timeZone, keyLength, byteCount, guid,
|
|
|
+ secBlob, oid, protectNeg, negToken, mechType, mechType2);
|
|
|
return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Evaluates what Dialects are offered by the client and which position the used NT LM 0.12 dialect is at
|
|
|
- * @return position of the NT LM 0.12 dialect
|
|
|
+ * Builds the nt create packet
|
|
|
+ *
|
|
|
+ * @return nt create packet
|
|
|
*/
|
|
|
- private byte[] evaluateDialect() {
|
|
|
- byte[] dialectMsg = new byte[message.length-39];
|
|
|
- System.arraycopy(message, 39, dialectMsg, 0, message.length - 39);
|
|
|
- short dialectNumber = 0;
|
|
|
- for(int i = 0, start = 0; i < dialectMsg.length; i++) {
|
|
|
- if(dialectMsg[i] == 0x00) {
|
|
|
- byte[] dialect = new byte[i-start];
|
|
|
- System.arraycopy(dialectMsg, start, dialect, 0, i-start);
|
|
|
- if(HelperUtils.byteToStr(dialect).contains("NT LM 0.12")) {
|
|
|
- return new byte[]{(byte)dialectNumber, (byte)(dialectNumber >> 8)};
|
|
|
- }
|
|
|
- start = i+1;
|
|
|
- dialectNumber++;
|
|
|
- }
|
|
|
- }
|
|
|
- return new byte[]{0x00, 0x00};
|
|
|
+ private Packet getNTCreate() {
|
|
|
+ byte[] wordCount = { 0x22 };
|
|
|
+ byte[] andXCommand = { (byte) 0xff };
|
|
|
+ byte[] reserved = { 0x00 };
|
|
|
+ byte[] andXOffset = { 0x67, 0x00 };
|
|
|
+ byte[] oplockLevel = { 0x00 };
|
|
|
+ byte[] fid = { (byte) 0x00, 0x40 };
|
|
|
+ byte[] createAction = { 0x01, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] created = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] lastAccess = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] lastWrite = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] change = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] fileAttributes = { (byte) 0x80, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] allocationSize = { 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x00 };
|
|
|
+ byte[] endOfFile = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] fileType = { 0x02, 0x00 };
|
|
|
+ byte[] ipcState = { (byte) 0xff, 0x05 };
|
|
|
+ byte[] isDirectory = { 0x00 };
|
|
|
+ byte[] byteCount = { 0x00, 0x00 };
|
|
|
+
|
|
|
+ byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved,
|
|
|
+ andXOffset, oplockLevel, fid, createAction, created,
|
|
|
+ lastAccess, lastWrite, change, fileAttributes, allocationSize,
|
|
|
+ endOfFile, fileType, ipcState, isDirectory, byteCount);
|
|
|
+ return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* Builds the session setup packet
|
|
|
- * @ret urn session setup packet
|
|
|
+ *
|
|
|
+ * @ret urn session setup packet
|
|
|
*/
|
|
|
private Packet getSessSetup() {
|
|
|
- if(authenticateNext) {
|
|
|
+ if (authenticateNext) {
|
|
|
return new Packet(getSetupAuth());
|
|
|
} else {
|
|
|
authenticateNext = true;
|
|
|
return new Packet(getSetupChal());
|
|
|
}
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
+ /**
|
|
|
+ * Builds the session setup packet for authentication required
|
|
|
+ *
|
|
|
+ * @return session setup authentication packet
|
|
|
+ */
|
|
|
+ private byte[] getSetupAuth() {
|
|
|
+ byte[] wordCount = { 0x04 };
|
|
|
+ byte[] andXCommand = { (byte) 0xff };
|
|
|
+ byte[] reserved = { 0x00 };
|
|
|
+ byte[] andXOffset = { (byte) 0xa2, 0x00 };
|
|
|
+ byte[] action = { 0x01, 0x00 };
|
|
|
+ byte[] secBlobLength;
|
|
|
+ byte[] byteCount;
|
|
|
+ byte[] secBlob = { (byte) 0xa1, 0x07, 0x30, 0x05, (byte) 0xa0, 0x03,
|
|
|
+ 0x0a, 0x01, 0x00 };
|
|
|
+ byte[] nativOS = HelperUtils.fillWithZeroExtended(serverVersion[0]
|
|
|
+ .getBytes());
|
|
|
+ byte[] nativLanMngr = HelperUtils.fillWithZeroExtended(serverVersion[1]
|
|
|
+ .getBytes());
|
|
|
+
|
|
|
+ byte[] buffer = ByteBuffer.allocate(4).putInt(secBlob.length).array();
|
|
|
+ secBlobLength = new byte[] { buffer[3], buffer[2] };
|
|
|
+ buffer = ByteBuffer.allocate(4)
|
|
|
+ .putInt(secBlob.length + nativOS.length + nativLanMngr.length)
|
|
|
+ .array();
|
|
|
+ byteCount = new byte[] { buffer[3], buffer[2] };
|
|
|
+
|
|
|
+ byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved,
|
|
|
+ andXOffset, action, secBlobLength, byteCount, secBlob, nativOS,
|
|
|
+ nativLanMngr);
|
|
|
+ return wrapNetbios(wrapHeader(response));
|
|
|
+ }
|
|
|
+
|
|
|
/**
|
|
|
* Builds the session setup challange packet
|
|
|
+ *
|
|
|
* @return session setup challange packet
|
|
|
*/
|
|
|
private byte[] getSetupChal() {
|
|
|
- byte[] wordCount = {0x04};
|
|
|
- byte[] andXCommand = {(byte) 0xff};
|
|
|
- byte[] reserved = {0x00};
|
|
|
- byte[] andXOffset = {0x60, 0x01};
|
|
|
- byte[] action = {0x00, 0x00};
|
|
|
+ byte[] wordCount = { 0x04 };
|
|
|
+ byte[] andXCommand = { (byte) 0xff };
|
|
|
+ byte[] reserved = { 0x00 };
|
|
|
+ byte[] andXOffset = { 0x60, 0x01 };
|
|
|
+ byte[] action = { 0x00, 0x00 };
|
|
|
byte[] secBlobLength;
|
|
|
byte[] byteCount;
|
|
|
- byte[] secBlob = {(byte) 0xa1, (byte) 0x81, (byte) 0xc4};
|
|
|
- byte[] negToken = {0x30, (byte) 0x81, (byte) 0xc1, (byte) 0xa0, 0x03, 0x0a, 0x01};
|
|
|
- byte[] negResult = {0x01};
|
|
|
- byte[] negToken2 = {(byte) 0xa1, 0x0c, 0x06, 0x0a};
|
|
|
- byte[] supportedMech = {0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82, 0x37, 0x02, 0x02, 0x0a};
|
|
|
- byte[] negToken3 = {(byte) 0xa2, (byte) 0x81, (byte) 0xab, 0x04, (byte) 0x81, (byte) 0xa8};
|
|
|
- byte[] ntlmsspId = {0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00};
|
|
|
- byte[] nlmMsgType = {0x02, 0x00, 0x00, 0x00};
|
|
|
- byte[] buffer = ByteBuffer.allocate(4).putInt(serverName.length).array();
|
|
|
- byte[] targetNameLength = new byte[]{buffer[3], buffer[2]};
|
|
|
- byte[] targetNameMaxLength = new byte[]{buffer[3], buffer[2]};
|
|
|
- byte[] targetNameOffset = {0x38, 0x00, 0x00, 0x00};
|
|
|
- byte[] flags = {0x15, (byte) 0x82, (byte) 0x8a, 0x60};
|
|
|
- if(!serverVersion[0].contains("Unix")) {
|
|
|
+ byte[] secBlob = { (byte) 0xa1, (byte) 0x81, (byte) 0xc4 };
|
|
|
+ byte[] negToken = { 0x30, (byte) 0x81, (byte) 0xc1, (byte) 0xa0, 0x03,
|
|
|
+ 0x0a, 0x01 };
|
|
|
+ byte[] negResult = { 0x01 };
|
|
|
+ byte[] negToken2 = { (byte) 0xa1, 0x0c, 0x06, 0x0a };
|
|
|
+ byte[] supportedMech = { 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82,
|
|
|
+ 0x37, 0x02, 0x02, 0x0a };
|
|
|
+ byte[] negToken3 = { (byte) 0xa2, (byte) 0x81, (byte) 0xab, 0x04,
|
|
|
+ (byte) 0x81, (byte) 0xa8 };
|
|
|
+ byte[] ntlmsspId = { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 };
|
|
|
+ byte[] nlmMsgType = { 0x02, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] buffer = ByteBuffer.allocate(4).putInt(serverName.length)
|
|
|
+ .array();
|
|
|
+ byte[] targetNameLength = new byte[] { buffer[3], buffer[2] };
|
|
|
+ byte[] targetNameMaxLength = new byte[] { buffer[3], buffer[2] };
|
|
|
+ byte[] targetNameOffset = { 0x38, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] flags = { 0x15, (byte) 0x82, (byte) 0x8a, 0x60 };
|
|
|
+ if (!serverVersion[0].contains("Unix")) {
|
|
|
flags[3] = (byte) (flags[3] | 0x02);
|
|
|
}
|
|
|
- byte[] challenge = HelperUtils.randomBytes(8);
|
|
|
- byte[] reserved2 = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] targetInfoLength = {0x60, 0x00};
|
|
|
- byte[] targetInfoMaxLength = {0x60, 0x00};
|
|
|
- byte[] targetInfoOffset = {0x48, 0x00, 0x00, 0x00};
|
|
|
+ byte[] challenge = HelperUtils.randomBytes(8);
|
|
|
+ byte[] reserved2 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] targetInfoLength = { 0x60, 0x00 };
|
|
|
+ byte[] targetInfoMaxLength = { 0x60, 0x00 };
|
|
|
+ byte[] targetInfoOffset = { 0x48, 0x00, 0x00, 0x00 };
|
|
|
byte[] version = null;
|
|
|
- if(serverVersion[0].contains("Windows 7") || serverVersion[0].contains("Windows Server 2008")) {
|
|
|
- version = new byte[]{0x06, 0x01, (byte) 0xb0, 0x1d, 0x00, 0x00, 0x00, 0x0f};
|
|
|
- } else if(serverVersion[0].contains("Windows 8") || serverVersion[0].contains("Windows Server 2012")) {
|
|
|
- version = new byte[]{0x06, 0x02, (byte) 0xf0, 0x23, 0x00, 0x00, 0x00, 0x0f};
|
|
|
+ if (serverVersion[0].contains("Windows 7")
|
|
|
+ || serverVersion[0].contains("Windows Server 2008")) {
|
|
|
+ version = new byte[] { 0x06, 0x01, (byte) 0xb0, 0x1d, 0x00, 0x00,
|
|
|
+ 0x00, 0x0f };
|
|
|
+ } else if (serverVersion[0].contains("Windows 8")
|
|
|
+ || serverVersion[0].contains("Windows Server 2012")) {
|
|
|
+ version = new byte[] { 0x06, 0x02, (byte) 0xf0, 0x23, 0x00, 0x00,
|
|
|
+ 0x00, 0x0f };
|
|
|
}
|
|
|
// serverName
|
|
|
- byte[] attributeNBDomain = {0x02, 0x00, 0x10, 0x00};
|
|
|
- // serverName
|
|
|
- byte[] attributeNBcomputer = {0x01, 0x00, 0x10, 0x00};
|
|
|
- // serverName
|
|
|
- byte[] attributeDNSDomain = {0x04, 0x00, 0x10, 0x00};
|
|
|
+ byte[] attributeNBDomain = { 0x02, 0x00, 0x10, 0x00 };
|
|
|
// serverName
|
|
|
- byte[] attributeDNScomputer = {0x03, 0x00, 0x10, 0x00};
|
|
|
+ byte[] attributeNBcomputer = { 0x01, 0x00, 0x10, 0x00 };
|
|
|
// serverName
|
|
|
- byte[] attributeTimeStamp = {0x07, 0x00, 0x08, 0x00};
|
|
|
+ byte[] attributeDNSDomain = { 0x04, 0x00, 0x10, 0x00 };
|
|
|
+ // serverName
|
|
|
+ byte[] attributeDNScomputer = { 0x03, 0x00, 0x10, 0x00 };
|
|
|
+ // serverName
|
|
|
+ byte[] attributeTimeStamp = { 0x07, 0x00, 0x08, 0x00 };
|
|
|
byte[] timeStamp = getTimeInBytes();
|
|
|
- byte[] attributeEnd = {0x00, 0x00, 0x00, 0x00};
|
|
|
- secBlob = HelperUtils.concat(secBlob, negToken, negResult, negToken2, supportedMech, negToken3,
|
|
|
- ntlmsspId, nlmMsgType, targetNameLength, targetNameMaxLength, targetNameOffset,
|
|
|
- flags, challenge, reserved2, targetInfoLength, targetInfoMaxLength, targetInfoOffset,
|
|
|
- version, serverName, attributeNBDomain, serverName, attributeNBcomputer, serverName,
|
|
|
- attributeDNSDomain, serverName, attributeDNScomputer, serverName, attributeTimeStamp,
|
|
|
- timeStamp, attributeEnd);
|
|
|
- byte[] nativOS = HelperUtils.fillWithZeroExtended(serverVersion[0].getBytes());
|
|
|
- byte[] nativLanMngr = HelperUtils.fillWithZeroExtended(serverVersion[1].getBytes());
|
|
|
- buffer = ByteBuffer.allocate(4).putInt(secBlob.length).array();
|
|
|
- secBlobLength = new byte[]{buffer[3], buffer[2]};
|
|
|
- buffer = ByteBuffer.allocate(4).putInt(secBlob.length + nativOS.length + nativLanMngr.length).array();
|
|
|
- byteCount = new byte[]{buffer[3], buffer[2]};
|
|
|
-
|
|
|
- ntStat = new byte[]{0x16, 0x00, 0x00, (byte) 0xc0};
|
|
|
- userID = new byte[]{0x00, 0x08};
|
|
|
-
|
|
|
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, action, secBlobLength,
|
|
|
- byteCount, secBlob, nativOS, nativLanMngr);
|
|
|
+ byte[] attributeEnd = { 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ secBlob = HelperUtils.concat(secBlob, negToken, negResult, negToken2,
|
|
|
+ supportedMech, negToken3, ntlmsspId, nlmMsgType,
|
|
|
+ targetNameLength, targetNameMaxLength, targetNameOffset, flags,
|
|
|
+ challenge, reserved2, targetInfoLength, targetInfoMaxLength,
|
|
|
+ targetInfoOffset, version, serverName, attributeNBDomain,
|
|
|
+ serverName, attributeNBcomputer, serverName,
|
|
|
+ attributeDNSDomain, serverName, attributeDNScomputer,
|
|
|
+ serverName, attributeTimeStamp, timeStamp, attributeEnd);
|
|
|
+ byte[] nativOS = HelperUtils.fillWithZeroExtended(serverVersion[0]
|
|
|
+ .getBytes());
|
|
|
+ byte[] nativLanMngr = HelperUtils.fillWithZeroExtended(serverVersion[1]
|
|
|
+ .getBytes());
|
|
|
+ buffer = ByteBuffer.allocate(4).putInt(secBlob.length).array();
|
|
|
+ secBlobLength = new byte[] { buffer[3], buffer[2] };
|
|
|
+ buffer = ByteBuffer.allocate(4)
|
|
|
+ .putInt(secBlob.length + nativOS.length + nativLanMngr.length)
|
|
|
+ .array();
|
|
|
+ byteCount = new byte[] { buffer[3], buffer[2] };
|
|
|
+
|
|
|
+ ntStat = new byte[] { 0x16, 0x00, 0x00, (byte) 0xc0 };
|
|
|
+ userID = new byte[] { 0x00, 0x08 };
|
|
|
+
|
|
|
+ byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved,
|
|
|
+ andXOffset, action, secBlobLength, byteCount, secBlob, nativOS,
|
|
|
+ nativLanMngr);
|
|
|
return wrapNetbios(wrapHeader(response));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the session setup packet for authentication required
|
|
|
- * @return session setup authentication packet
|
|
|
+ * Returns the command number from the current message
|
|
|
+ *
|
|
|
+ * @return command number
|
|
|
*/
|
|
|
- private byte[] getSetupAuth() {
|
|
|
- byte[] wordCount = {0x04};
|
|
|
- byte[] andXCommand = {(byte) 0xff};
|
|
|
- byte[] reserved = {0x00};
|
|
|
- byte[] andXOffset = {(byte) 0xa2, 0x00};
|
|
|
- byte[] action = {0x01, 0x00};
|
|
|
- byte[] secBlobLength;
|
|
|
- byte[] byteCount;
|
|
|
- byte[] secBlob = {(byte) 0xa1, 0x07, 0x30, 0x05, (byte) 0xa0, 0x03, 0x0a, 0x01, 0x00};
|
|
|
- byte[] nativOS = HelperUtils.fillWithZeroExtended(serverVersion[0].getBytes());
|
|
|
- byte[] nativLanMngr = HelperUtils.fillWithZeroExtended(serverVersion[1].getBytes());
|
|
|
-
|
|
|
- byte[] buffer = ByteBuffer.allocate(4).putInt(secBlob.length).array();
|
|
|
- secBlobLength = new byte[]{buffer[3], buffer[2]};
|
|
|
- buffer = ByteBuffer.allocate(4).putInt(secBlob.length + nativOS.length + nativLanMngr.length).array();
|
|
|
- byteCount = new byte[]{buffer[3], buffer[2]};
|
|
|
-
|
|
|
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, action, secBlobLength,
|
|
|
- byteCount, secBlob, nativOS, nativLanMngr);
|
|
|
- return wrapNetbios(wrapHeader(response));
|
|
|
+ private byte getSmbCommand() {
|
|
|
+ return smbCommand[0];
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the tree connect packet
|
|
|
- * @return tree connect packet
|
|
|
+ * Builds the trans packet
|
|
|
+ *
|
|
|
+ * @return trans packet
|
|
|
*/
|
|
|
- private Packet getTreeCon() {
|
|
|
- String str = HelperUtils.byteToStr(message);
|
|
|
- byte[] wordCount = {0x00};
|
|
|
- byte[] andXCommand = {0x00, 0x00};
|
|
|
- byte[] response = null;
|
|
|
- if(str.contains("IPC$") || str.contains("C$")) {
|
|
|
- wordCount = new byte[] {0x07};
|
|
|
- andXCommand = new byte[] {(byte) 0xff};
|
|
|
- byte[] reserved = {0x00};
|
|
|
- byte[] andXOffset = {0x38, 0x00};
|
|
|
- byte[] optionalSupport = {0x01, 0x00};
|
|
|
- byte[] maxShareAccess = {(byte) 0xff, (byte) 0xff, 0x1f, 0x00};
|
|
|
- byte[] guestMaxShareAccess = {(byte) 0xff, (byte) 0xff, 0x1f, 0x00};
|
|
|
- byte[] byteCount = {0x07, 0x00};
|
|
|
- byte[] service = {0x49, 0x50, 0x43, 0x00};
|
|
|
- byte[] extraParameters = {0x00, 0x00, 0x00};
|
|
|
-
|
|
|
- treeID = new byte[]{0x00, 0x08};
|
|
|
-
|
|
|
- response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, optionalSupport, maxShareAccess,
|
|
|
- guestMaxShareAccess, byteCount, service, extraParameters);
|
|
|
- } else if(str.contains("ADMIN$")) {
|
|
|
- ntStat = new byte[] {0x22, 0x00, 0x00, (byte) 0xc0};
|
|
|
- response = HelperUtils.concat(wordCount, andXCommand);
|
|
|
- } else {
|
|
|
- ntStat = new byte[] {(byte) 0xcc, 0x00, 0x00, (byte) 0xc0};
|
|
|
- response = HelperUtils.concat(wordCount, andXCommand);
|
|
|
+ private Packet getTrans() {
|
|
|
+ byte[] transSub = getTransSub();
|
|
|
+ byte[] response = null;
|
|
|
+ if (transSub[0] == 0x00 && transSub[1] == 0x0b) { // bind_ack
|
|
|
+ byte[] wordCount = { 0x0a };
|
|
|
+ byte[] totalParamCount = { 0x00, 0x00 };
|
|
|
+ byte[] totalDataCount = { 0x44, 0x00 };
|
|
|
+ byte[] reserved = { 0x00, 0x00 };
|
|
|
+ byte[] paramCount = { 0x00, 0x00 };
|
|
|
+ byte[] paramOffset = { 0x38, 0x00 };
|
|
|
+ byte[] paramDisplace = { 0x00, 0x00 };
|
|
|
+ byte[] dataCount = { 0x44, 0x00 };
|
|
|
+ byte[] dataOffset = { 0x38, 0x00 };
|
|
|
+ byte[] dataDisplace = { 0x00, 0x00 };
|
|
|
+ byte[] setupCount = { 0x00 };
|
|
|
+ byte[] reserved2 = { 0x00 };
|
|
|
+ byte[] byteCount = { 0x45, 0x00 };
|
|
|
+ byte[] padding = { 0x00 };
|
|
|
+
|
|
|
+ byte[] dcerpc = getDceRpc(transSub, 0);
|
|
|
+
|
|
|
+ response = HelperUtils.concat(wordCount, totalParamCount,
|
|
|
+ totalDataCount, reserved, paramCount, paramOffset,
|
|
|
+ paramDisplace, dataCount, dataOffset, dataDisplace,
|
|
|
+ setupCount, reserved2, byteCount, padding, dcerpc);
|
|
|
+
|
|
|
+ } else if (transSub[0] == 0x00 && transSub[1] == 0x00) { // netShareEnumAll
|
|
|
+ byte[] wordCount = { 0x0a };
|
|
|
+ byte[] totalParamCount = { 0x00, 0x00 };
|
|
|
+ byte[] totalDataCount = { 0x20, 0x01 };
|
|
|
+ byte[] reserved = { 0x00, 0x00 };
|
|
|
+ byte[] paramCount = { 0x00, 0x00 };
|
|
|
+ byte[] paramOffset = { 0x38, 0x00 };
|
|
|
+ byte[] paramDisplace = { 0x00, 0x00 };
|
|
|
+ byte[] dataCount = { 0x20, 0x01 };
|
|
|
+ byte[] dataOffset = { 0x38, 0x00 };
|
|
|
+ byte[] dataDisplace = { 0x00, 0x00 };
|
|
|
+ byte[] setupCount = { 0x00 };
|
|
|
+ byte[] reserved2 = { 0x00 };
|
|
|
+ byte[] byteCount = new byte[2]/* = {0x21, 0x01} */;
|
|
|
+ byte[] padding = { 0x00 };
|
|
|
+
|
|
|
+ byte[] dcerpc = new byte[24];
|
|
|
+
|
|
|
+ byte[] levelPointer = { 0x01, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] ctr = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00 };
|
|
|
+ byte[] ctr1 = { 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00,
|
|
|
+ 0x03, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] array1Pointer = { 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ (byte) 0x80, 0x0c, 0x00, 0x02, 0x00 };
|
|
|
+ byte[] array2Pointer = { 0x10, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ (byte) 0x80, 0x14, 0x00, 0x02, 0x00 };
|
|
|
+ byte[] array3Pointer = { 0x18, 0x00, 0x02, 0x00, 0x03, 0x00, 0x00,
|
|
|
+ (byte) 0x80, 0x1c, 0x00, 0x02, 0x00 };
|
|
|
+ byte[] array1 = { 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x07, 0x00, 0x00, 0x00, 0x41, 0x00, 0x44, 0x00, 0x4d, 0x00,
|
|
|
+ 0x49, 0x00, 0x4e, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00,
|
|
|
+ 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00,
|
|
|
+ 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64, 0x00,
|
|
|
+ 0x6d, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] array2 = { 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x43, 0x00, 0x24, 0x00,
|
|
|
+ 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x44, 0x00, 0x65, 0x00,
|
|
|
+ 0x66, 0x00, 0x61, 0x00, 0x75, 0x00, 0x6c, 0x00, 0x74, 0x00,
|
|
|
+ 0x20, 0x00, 0x73, 0x00, 0x68, 0x00, 0x61, 0x00, 0x72, 0x00,
|
|
|
+ 0x65, 0x00 };
|
|
|
+ byte[] array3 = { 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x49, 0x00, 0x50, 0x00,
|
|
|
+ 0x43, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00,
|
|
|
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00,
|
|
|
+ 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00, 0x74, 0x00,
|
|
|
+ 0x65, 0x00, 0x20, 0x00, 0x49, 0x00, 0x50, 0x00, 0x43, 0x00,
|
|
|
+ 0x00, 0x00 };
|
|
|
+ byte[] totalEntries = { 0x00, 0x00, 0x03, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] referentID = { 0x20, 0x00, 0x02, 0x00 };
|
|
|
+ byte[] resumeHandle = { 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ byte[] windowsError = { 0x00, 0x00, 0x00, 0x00 };
|
|
|
+ int tmp = padding.length + dcerpc.length + levelPointer.length
|
|
|
+ + ctr.length + ctr1.length + array1Pointer.length
|
|
|
+ + array2Pointer.length + array3Pointer.length
|
|
|
+ + array1.length + array2.length + array3.length
|
|
|
+ + totalEntries.length + referentID.length
|
|
|
+ + resumeHandle.length + windowsError.length;
|
|
|
+ byte[] tmp2 = ByteBuffer.allocate(4).putInt(tmp).array();
|
|
|
+ byteCount = new byte[] { tmp2[3], tmp2[2] };
|
|
|
+ dcerpc = getDceRpc(transSub, tmp - 1);
|
|
|
+
|
|
|
+ response = HelperUtils.concat(wordCount, totalParamCount,
|
|
|
+ totalDataCount, reserved, paramCount, paramOffset,
|
|
|
+ paramDisplace, dataCount, dataOffset, dataDisplace,
|
|
|
+ setupCount, reserved2, byteCount, padding, dcerpc,
|
|
|
+ levelPointer, ctr, ctr1, array1Pointer, array2Pointer,
|
|
|
+ array3Pointer, array1, array2, array3, totalEntries,
|
|
|
+ referentID, resumeHandle, windowsError);
|
|
|
}
|
|
|
-
|
|
|
- return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
- }
|
|
|
-
|
|
|
- /**
|
|
|
- * Builds the nt create packet
|
|
|
- * @return nt create packet
|
|
|
- */
|
|
|
- private Packet getNTCreate() {
|
|
|
- byte[] wordCount = {0x22};
|
|
|
- byte[] andXCommand = {(byte) 0xff};
|
|
|
- byte[] reserved = {0x00};
|
|
|
- byte[] andXOffset = {0x67, 0x00};
|
|
|
- byte[] oplockLevel = {0x00};
|
|
|
- byte[] fid = {(byte) 0x00, 0x40};
|
|
|
- byte[] createAction = {0x01, 0x00, 0x00, 0x00};
|
|
|
- byte[] created = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] lastAccess = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] lastWrite = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] change = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] fileAttributes = {(byte) 0x80, 0x00, 0x00, 0x00};
|
|
|
- byte[] allocationSize = {0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] endOfFile = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] fileType = {0x02, 0x00};
|
|
|
- byte[] ipcState = {(byte) 0xff, 0x05};
|
|
|
- byte[] isDirectory = {0x00};
|
|
|
- byte[] byteCount = {0x00, 0x00};
|
|
|
-
|
|
|
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, oplockLevel, fid,
|
|
|
- createAction, created, lastAccess, lastWrite, change, fileAttributes, allocationSize,
|
|
|
- endOfFile, fileType, ipcState, isDirectory, byteCount);
|
|
|
+
|
|
|
return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the trans packet
|
|
|
- * @return trans packet
|
|
|
+ * Builds the trans2 packet
|
|
|
+ *
|
|
|
+ * @return trans2 packet
|
|
|
*/
|
|
|
- private Packet getTrans() {
|
|
|
- byte[] transSub = getTransSub();
|
|
|
+ private Packet getTrans2() {
|
|
|
byte[] response = null;
|
|
|
- if(transSub[0] == 0x00 && transSub[1] == 0x0b) { //bind_ack
|
|
|
- byte[] wordCount = {0x0a};
|
|
|
- byte[] totalParamCount = {0x00,0x00};
|
|
|
- byte[] totalDataCount = {0x44,0x00};
|
|
|
- byte[] reserved = {0x00, 0x00};
|
|
|
- byte[] paramCount = {0x00, 0x00};
|
|
|
- byte[] paramOffset = {0x38, 0x00};
|
|
|
- byte[] paramDisplace = {0x00, 0x00};
|
|
|
- byte[] dataCount = {0x44, 0x00};
|
|
|
- byte[] dataOffset = {0x38, 0x00};
|
|
|
- byte[] dataDisplace = {0x00, 0x00};
|
|
|
- byte[] setupCount = {0x00};
|
|
|
- byte[] reserved2 = {0x00};
|
|
|
- byte[] byteCount = {0x45, 0x00};
|
|
|
- byte[] padding = {0x00};
|
|
|
-
|
|
|
- byte[] dcerpc = getDceRpc(transSub, 0);
|
|
|
-
|
|
|
- response = HelperUtils.concat(wordCount, totalParamCount, totalDataCount, reserved, paramCount, paramOffset,
|
|
|
- paramDisplace, dataCount, dataOffset, dataDisplace, setupCount, reserved2, byteCount, padding, dcerpc);
|
|
|
-
|
|
|
- } else if(transSub[0] == 0x00 && transSub[1] == 0x00) { //netShareEnumAll
|
|
|
- byte[] wordCount = {0x0a};
|
|
|
- byte[] totalParamCount = {0x00, 0x00};
|
|
|
- byte[] totalDataCount = {0x20, 0x01};
|
|
|
- byte[] reserved = {0x00, 0x00};
|
|
|
- byte[] paramCount = {0x00, 0x00};
|
|
|
- byte[] paramOffset = {0x38, 0x00};
|
|
|
- byte[] paramDisplace = {0x00, 0x00};
|
|
|
- byte[] dataCount = {0x20, 0x01};
|
|
|
- byte[] dataOffset = {0x38, 0x00};
|
|
|
- byte[] dataDisplace = {0x00, 0x00};
|
|
|
- byte[] setupCount = {0x00};
|
|
|
- byte[] reserved2 = {0x00};
|
|
|
- byte[] byteCount = new byte[2]/*= {0x21, 0x01}*/;
|
|
|
- byte[] padding = {0x00};
|
|
|
-
|
|
|
- byte[] dcerpc = new byte[24];
|
|
|
-
|
|
|
- byte[] levelPointer = {0x01, 0x00, 0x00, 0x00};
|
|
|
- byte[] ctr = {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
|
|
|
- byte[] ctr1 = {0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x03, 0x00, 0x00, 0x00};
|
|
|
- byte[] array1Pointer = {0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, (byte) 0x80, 0x0c, 0x00, 0x02, 0x00};
|
|
|
- byte[] array2Pointer = {0x10, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, (byte) 0x80, 0x14, 0x00, 0x02, 0x00};
|
|
|
- byte[] array3Pointer = {0x18, 0x00, 0x02, 0x00, 0x03, 0x00, 0x00, (byte) 0x80, 0x1c, 0x00, 0x02, 0x00};
|
|
|
- byte[] array1 = {0x07, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x41, 0x00, 0x44, 0x00, 0x4d, 0x00,
|
|
|
- 0x49, 0x00, 0x4e, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00, 0x74, 0x00,
|
|
|
- 0x65, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x00, 0x00};
|
|
|
- byte[] array2 = {0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x43, 0x00,
|
|
|
- 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00,
|
|
|
- 0x00, 0x00, 0x44, 0x00, 0x65, 0x00, 0x66, 0x00, 0x61, 0x00, 0x75, 0x00, 0x6c, 0x00, 0x74, 0x00,
|
|
|
- 0x20, 0x00, 0x73, 0x00, 0x68, 0x00, 0x61, 0x00, 0x72, 0x00, 0x65, 0x00};
|
|
|
- byte[] array3 = {0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
|
|
|
- 0x00, 0x00, 0x49, 0x00, 0x50, 0x00, 0x43, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00,
|
|
|
- 0x6f, 0x00, 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x49, 0x00, 0x50, 0x00, 0x43, 0x00, 0x00, 0x00};
|
|
|
- byte[] totalEntries = {0x00, 0x00, 0x03, 0x00, 0x00, 0x00};
|
|
|
- byte[] referentID = {0x20, 0x00, 0x02, 0x00};
|
|
|
- byte[] resumeHandle = {0x00, 0x00, 0x00, 0x00};
|
|
|
- byte[] windowsError = {0x00, 0x00, 0x00, 0x00};
|
|
|
- int tmp = padding.length + dcerpc.length + levelPointer.length + ctr.length + ctr1.length
|
|
|
- + array1Pointer.length + array2Pointer.length + array3Pointer.length + array1.length
|
|
|
- + array2.length + array3.length + totalEntries.length + referentID.length + resumeHandle.length
|
|
|
- + windowsError.length;
|
|
|
- byte[] tmp2 = ByteBuffer.allocate(4).putInt(tmp).array();
|
|
|
- byteCount = new byte[] {tmp2[3], tmp2[2]};
|
|
|
- dcerpc = getDceRpc(transSub, tmp-1);
|
|
|
-
|
|
|
- response = HelperUtils.concat(wordCount, totalParamCount, totalDataCount, reserved, paramCount, paramOffset,
|
|
|
- paramDisplace, dataCount, dataOffset, dataDisplace, setupCount, reserved2, byteCount, padding, dcerpc,
|
|
|
- levelPointer, ctr, ctr1, array1Pointer, array2Pointer, array3Pointer,
|
|
|
- array1, array2, array3, totalEntries, referentID, resumeHandle, windowsError);
|
|
|
- }
|
|
|
-
|
|
|
- return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
+ byte[] wordCount = { 0x00 };
|
|
|
+ byte[] andXCommand = { 0x00, 0x00 };
|
|
|
+ ntStat = new byte[] { 0x22, 0x00, 0x00, (byte) 0xc0 };
|
|
|
+ response = HelperUtils.concat(wordCount, andXCommand);
|
|
|
+ return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the DCERPC packet
|
|
|
- * @return DCERPC packet
|
|
|
+ * Extracts the trans sub packet from message
|
|
|
+ *
|
|
|
+ * @return trans sub packet
|
|
|
*/
|
|
|
- private byte[] getDceRpc(byte[] transSub, int length) {
|
|
|
- byte[] majorVersion = {0x05};
|
|
|
- byte[] minorVersion = {0x00};
|
|
|
- byte[] packetType = null;
|
|
|
- byte[] packetFlags = {0x03};
|
|
|
- byte[] dataRepres = {0x10, 0x00, 0x00, 0x00};
|
|
|
- byte[] fragLength = null;
|
|
|
- byte[] authLength = {0x00, 0x00};
|
|
|
- byte[] callID = null;
|
|
|
- byte[] response = null;
|
|
|
-
|
|
|
- if(transSub[0] == 0x00 && transSub[1] == 0x0b) {
|
|
|
- packetType = new byte[]{0x0c};
|
|
|
- fragLength = new byte[]{0x44, 0x00};
|
|
|
- callID = new byte[]{0x01, 0x00, 0x00, 0x00};
|
|
|
- byte[] maxXmitFrag = {(byte) 0xb8, 0x10};
|
|
|
- byte[] maxRecvFrag = {(byte) 0xb8, 0x10};
|
|
|
- byte[] assocGroup = {0x4a, 0x41, 0x00, 0x00};
|
|
|
- byte[] scndryAddrLen = {0x0d, 0x00};
|
|
|
- byte[] scndryAddr = {0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x73, 0x72,
|
|
|
- 0x76, 0x73, 0x76, 0x63, 0x00, 0x00};
|
|
|
- byte[] numResults = {0x01, 0x00, 0x00, 0x00};
|
|
|
- byte[] ctxItem = {0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, (byte) 0x88, (byte) 0x8a,
|
|
|
- (byte) 0xeb, 0x1c, (byte) 0xc9, 0x11, (byte) 0x9f, (byte) 0xe8,
|
|
|
- 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00};
|
|
|
-
|
|
|
- response = HelperUtils.concat(majorVersion, minorVersion, packetType, packetFlags, dataRepres,fragLength,
|
|
|
- authLength, callID, maxXmitFrag, maxRecvFrag, assocGroup, scndryAddrLen, scndryAddr, numResults, ctxItem);
|
|
|
- } else if(transSub[0] == 0x00 && transSub[1] == 0x00) {
|
|
|
- packetType = new byte[]{0x02};
|
|
|
- byte[] tmp = ByteBuffer.allocate(4).putInt(length).array();
|
|
|
- fragLength = new byte[]{tmp[3], tmp[2]};
|
|
|
- callID = new byte[]{0x02, 0x00, 0x00, 0x00};
|
|
|
- tmp = ByteBuffer.allocate(4).putInt(length-24).array();
|
|
|
- byte[] allocHint = new byte[]{tmp[3], tmp[2], tmp[1], tmp[0]};
|
|
|
- byte[] contextID = {0x00, 0x00};
|
|
|
- byte[] cancelCount = {0x00, 0x00};
|
|
|
-
|
|
|
- response = HelperUtils.concat(majorVersion, minorVersion, packetType, packetFlags, dataRepres,fragLength,
|
|
|
- authLength, callID, allocHint, contextID, cancelCount);
|
|
|
- }
|
|
|
- return response;
|
|
|
+ private byte[] getTransSub() {
|
|
|
+ byte[] transSub = new byte[2];
|
|
|
+ if (smbCommand[0] == 0x32)
|
|
|
+ transSub = new byte[] { message[66], message[65] };
|
|
|
+ else if (smbCommand[0] == 0x25)
|
|
|
+ transSub = new byte[] { 0x00, message[90] };
|
|
|
+ else
|
|
|
+ transSub = new byte[] { 0x00, 0x00 };
|
|
|
+ return transSub;
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the close packet
|
|
|
- * @return close packet
|
|
|
+ * Builds the tree connect packet
|
|
|
+ *
|
|
|
+ * @return tree connect packet
|
|
|
*/
|
|
|
- private Packet getClose() {
|
|
|
- byte[] wordCount = {0x00};
|
|
|
- byte[] byteCount = {0x00, 0x00};
|
|
|
-
|
|
|
- smbCommand = new byte[]{0x04};
|
|
|
-
|
|
|
- byte[] response = HelperUtils.concat(wordCount, byteCount);
|
|
|
-
|
|
|
+ private Packet getTreeCon() {
|
|
|
+ String str = HelperUtils.byteToStr(message);
|
|
|
+ byte[] wordCount = { 0x00 };
|
|
|
+ byte[] andXCommand = { 0x00, 0x00 };
|
|
|
+ byte[] response = null;
|
|
|
+ if (str.contains("IPC$") || str.contains("C$")) {
|
|
|
+ wordCount = new byte[] { 0x07 };
|
|
|
+ andXCommand = new byte[] { (byte) 0xff };
|
|
|
+ byte[] reserved = { 0x00 };
|
|
|
+ byte[] andXOffset = { 0x38, 0x00 };
|
|
|
+ byte[] optionalSupport = { 0x01, 0x00 };
|
|
|
+ byte[] maxShareAccess = { (byte) 0xff, (byte) 0xff, 0x1f, 0x00 };
|
|
|
+ byte[] guestMaxShareAccess = { (byte) 0xff, (byte) 0xff, 0x1f, 0x00 };
|
|
|
+ byte[] byteCount = { 0x07, 0x00 };
|
|
|
+ byte[] service = { 0x49, 0x50, 0x43, 0x00 };
|
|
|
+ byte[] extraParameters = { 0x00, 0x00, 0x00 };
|
|
|
+
|
|
|
+ treeID = new byte[] { 0x00, 0x08 };
|
|
|
+
|
|
|
+ response = HelperUtils.concat(wordCount, andXCommand, reserved,
|
|
|
+ andXOffset, optionalSupport, maxShareAccess,
|
|
|
+ guestMaxShareAccess, byteCount, service, extraParameters);
|
|
|
+ } else if (str.contains("ADMIN$")) {
|
|
|
+ ntStat = new byte[] { 0x22, 0x00, 0x00, (byte) 0xc0 };
|
|
|
+ response = HelperUtils.concat(wordCount, andXCommand);
|
|
|
+ } else {
|
|
|
+ ntStat = new byte[] { (byte) 0xcc, 0x00, 0x00, (byte) 0xc0 };
|
|
|
+ response = HelperUtils.concat(wordCount, andXCommand);
|
|
|
+ }
|
|
|
+
|
|
|
return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* Builds the tree disconnect packet
|
|
|
+ *
|
|
|
* @return tree disconnect packet
|
|
|
*/
|
|
|
private Packet getTreeDisc() {
|
|
|
- byte[] wordCount = {0x00};
|
|
|
- byte[] byteCount = {0x00, 0x00};
|
|
|
-
|
|
|
+ byte[] wordCount = { 0x00 };
|
|
|
+ byte[] byteCount = { 0x00, 0x00 };
|
|
|
+
|
|
|
smbCommand[0] = 0x71;
|
|
|
-
|
|
|
+
|
|
|
byte[] response = HelperUtils.concat(wordCount, byteCount);
|
|
|
-
|
|
|
+
|
|
|
return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the echo packet
|
|
|
- * @return echo packet
|
|
|
+ * Breaks a message from the client down into its components
|
|
|
+ *
|
|
|
+ * @param message
|
|
|
+ * that is analyzed
|
|
|
*/
|
|
|
- private Packet getEcho() {
|
|
|
- byte[] wordCount = {0x01};
|
|
|
- byte[] echoSeq = {0x01, 0x00};
|
|
|
- byte[] byteCount = {0x10, 0x00};
|
|
|
- byte[] echoData = {(byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
|
|
|
- (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0};
|
|
|
- byte[] response = HelperUtils.concat(wordCount, echoSeq, byteCount, echoData);
|
|
|
- return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
+ private void parseMessageHeader(byte[] message) {
|
|
|
+ this.message = message;
|
|
|
+ serverComp = new byte[] { message[4], message[5], message[6],
|
|
|
+ message[7] };
|
|
|
+ smbCommand = new byte[] { message[8] };
|
|
|
+ ntStat = new byte[] { message[9], message[10], message[11], message[12] };
|
|
|
+ smbFlags = new byte[] { (byte) (message[13] | 0x80) }; // | 0x80 for
|
|
|
+ // mark response
|
|
|
+ // bit
|
|
|
+ smbFlags2 = new byte[] { message[14], message[15] };
|
|
|
+ processIDHigh = new byte[] { message[16], message[17] };
|
|
|
+ signature = new byte[] { message[18], message[19], message[20],
|
|
|
+ message[21], message[22], message[23], message[24], message[25] };
|
|
|
+ reserved = new byte[] { message[26], message[27] };
|
|
|
+ treeID = new byte[] { message[28], message[29] };
|
|
|
+ processID = new byte[] { message[30], message[31] };
|
|
|
+ userID = new byte[] { message[32], message[33] };
|
|
|
+ multiplexID = new byte[] { message[34], message[35] };
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
- * Builds the trans2 packet
|
|
|
- * @return trans2 packet
|
|
|
+ * Wraps the header around a response
|
|
|
+ *
|
|
|
+ * @param response
|
|
|
+ * that is wrapped
|
|
|
+ * @return wrapped response
|
|
|
*/
|
|
|
- private Packet getTrans2() {
|
|
|
- byte[] response = null;
|
|
|
- byte[] wordCount = {0x00};
|
|
|
- byte[] andXCommand = {0x00, 0x00};
|
|
|
- ntStat = new byte[] {0x22, 0x00, 0x00, (byte) 0xc0};
|
|
|
- response = HelperUtils.concat(wordCount, andXCommand);
|
|
|
- return new Packet(wrapNetbios(wrapHeader(response)));
|
|
|
- }
|
|
|
-
|
|
|
- /**
|
|
|
- * Extracts the trans sub packet from message
|
|
|
- * @return trans sub packet
|
|
|
- */
|
|
|
- private byte[] getTransSub() {
|
|
|
- byte[] transSub = new byte[2];
|
|
|
- if(smbCommand[0] == 0x32) transSub = new byte[]{message[66], message[65]};
|
|
|
- else if(smbCommand[0] == 0x25) transSub = new byte[]{0x00, message[90]};
|
|
|
- else transSub = new byte[]{0x00, 0x00};
|
|
|
- return transSub;
|
|
|
+ private byte[] wrapHeader(byte[] response) {
|
|
|
+ byte[] header = new byte[0];
|
|
|
+ return HelperUtils.concat(header, serverComp, smbCommand, ntStat,
|
|
|
+ smbFlags, smbFlags2, processIDHigh, signature, reserved,
|
|
|
+ treeID, processID, userID, multiplexID, response);
|
|
|
}
|
|
|
+
|
|
|
/**
|
|
|
- * Returns the command number from the current message
|
|
|
- * @return command number
|
|
|
+ * Wraps the Netbios header around a response
|
|
|
+ *
|
|
|
+ * @param response
|
|
|
+ * that is wrapped
|
|
|
+ * @return wrapped response
|
|
|
*/
|
|
|
- private byte getSmbCommand() {
|
|
|
- return smbCommand[0];
|
|
|
+ private byte[] wrapNetbios(byte[] response) {
|
|
|
+ byte[] netbios = { 0x00 };
|
|
|
+ byte[] buffer = ByteBuffer.allocate(4).putInt(response.length).array(); // allocate(4)
|
|
|
+ // because
|
|
|
+ // int
|
|
|
+ // is
|
|
|
+ // 4
|
|
|
+ // bytes
|
|
|
+ // long
|
|
|
+ byte[] netbiosLength = { buffer[1], buffer[2], buffer[3] }; // only
|
|
|
+ // bytes 1-3
|
|
|
+ // needed,
|
|
|
+ // byte 0 is
|
|
|
+ // not
|
|
|
+ // needed
|
|
|
+ return HelperUtils.concat(netbios, netbiosLength, response);
|
|
|
}
|
|
|
-
|
|
|
- //message constants
|
|
|
- private static final byte SMB_COM_CLOSE = 0x04;
|
|
|
- private static final byte SMB_COM_TRANSACTION = 0x25;
|
|
|
- private static final byte SMB_COM_ECHO = 0x2B;
|
|
|
- private static final byte SMB_COM_TRANSACTION2 = 0x32;
|
|
|
- private static final byte SMB_COM_TREE_DISCONNECT = 0x71;
|
|
|
- private static final byte SMB_COM_NEGOTIATE = 0x72;
|
|
|
- private static final byte SMB_COM_SESSION_SETUP_ANDX = 0x73;
|
|
|
- private static final byte SMB_COM_TREE_CONNECT_ANDX = 0x75;
|
|
|
- private static final byte SMB_COM_NT_CREATE_ANDX = (byte) 0xA2;
|
|
|
-
|
|
|
+
|
|
|
}
|