123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840 |
- package de.tudarmstadt.informatik.hostage.protocol;
- import java.nio.ByteBuffer;
- import java.security.SecureRandom;
- import java.util.ArrayList;
- import java.util.Calendar;
- import java.util.GregorianCalendar;
- import java.util.List;
- import java.util.TimeZone;
- import android.content.Context;
- import de.tudarmstadt.informatik.hostage.Hostage;
- import de.tudarmstadt.informatik.hostage.R;
- import de.tudarmstadt.informatik.hostage.commons.HelperUtils;
- import de.tudarmstadt.informatik.hostage.wrapper.Packet;
- /**
- * SMB protocol. It can handle the following requests: Negotiate Protocol
- * Request, Session Setup AndX Request, Tree Connect AndX Request, NT Create
- * AndX Request, Bind, NetShareEnumAll, Close Request, Tree Disconnect Request,
- * Echo Request, Trans2 Request.
- *
- * @author Wulf Pfeiffer
- */
- public class SMB implements Protocol {
- /**
- * Represents the states of the protocol
- */
- private static enum STATE {
- NONE, CONNECTED, AUTHENTICATED, LISTING, DISCONNECTED, CLOSED
- }
- // version stuff
- private String[][] possibleSmbVersions = {
- { "Windows 7 Professional 7600", "Windows 7 Professional 6.1" },
- { "Windows 8 Enterprise 9200", "Windows 8 Enterprise 9200" },
- { "Windows Server 2008 R2 Enterprise 7600", "Windows Server 2008 R2 Enterprise 6.1" },
- { "Windows Server 2012 Standard 6.2", "Windows Server 2012 Standard 6.2" },
- { "Unix", "Samba" },
- { "Windows 2002 Service Pack 2", "Windows 2002 5.1"}
- };
- /**
- * Converts the current system time into a byte[] with windows specific time
- *
- * @return current system time in windows format as byte[]
- */
- private static byte[] getTimeInBytes() {
- long time = System.currentTimeMillis();
- Calendar calend = Calendar.getInstance();
- calend.setTimeZone(TimeZone.getTimeZone("UTC"));
- calend.set(1601, 0, 01, 00, 00, 00);
- time -= calend.getTimeInMillis();
- time *= 10000;
- byte[] timeInWindowsBytes = new byte[8];
- byte[] timeInBytes = ByteBuffer.allocate(8).putLong(time).array();
- for (int i = 0, j = 7; i < 8 && j > -1; i++, j--) {
- timeInWindowsBytes[i] = (byte) (timeInBytes[j] & 0xff);
- }
- return timeInWindowsBytes;
- }
- /**
- * Converts the current timezone into a byte[] with windows specific format
- *
- * @return current timezone in windows format as byte[]
- */
- private static byte[] getTimeZoneInBytes() {
- // get current timezone offset in minutes
- Integer offset = new GregorianCalendar().getTimeZone().getRawOffset() / 1000 / 60;
- char[] offsetChars = Integer.toBinaryString(offset).toCharArray();
- boolean invert = false;
- for (int i = offsetChars.length - 1; i > -1; i--) {
- if (!invert && offsetChars[i] == '1') {
- invert = true;
- } else if (invert) {
- offsetChars[i] = (offsetChars[i] == '0') ? '1' : '0';
- }
- }
- char[] extendedChars = new char[31];
- for (int i = 0; i < extendedChars.length - offsetChars.length; i++) {
- extendedChars[i] = '1';
- }
- for (int i = 0; i < offsetChars.length; i++) {
- extendedChars[i + extendedChars.length - offsetChars.length] = offsetChars[i];
- }
- int timezone = Integer.parseInt(new String(extendedChars), 2);
- byte[] timezoneBytes = new byte[2];
- timezoneBytes[1] = (byte) (timezone >> 8);
- timezoneBytes[0] = (byte) (timezone);
- return timezoneBytes;
- }
- private String[] initServerVersion() {
- String sharedPreferencePath = Hostage.getContext().getString(
- R.string.shared_preference_path);
- String profile = Hostage
- .getContext()
- .getSharedPreferences(sharedPreferencePath,
- Context.MODE_PRIVATE).getString("os", "");
- System.out.println(profile);
- if (profile.equals("Windows 7")) {
- return possibleSmbVersions[0];
- } else if (profile.equals("Windows 8")) {
- return possibleSmbVersions[1];
- } else if (profile.equals("Windows Server 2008")) {
- return possibleSmbVersions[2];
- } else if (profile.equals("Windows Server 2012")) {
- return possibleSmbVersions[3];
- } else if (profile.equals("Linux")) {
- return possibleSmbVersions[4];
- } else if (profile.equals("Windows XP")) {
- return possibleSmbVersions[5];
- } else {
- return possibleSmbVersions[new SecureRandom()
- .nextInt(possibleSmbVersions.length)];
- }
- }
- /**
- * Denotes in which state the protocol is right now
- */
- private STATE state = STATE.NONE;
- private byte[] lastMessage;
- private byte[] serverName = HelperUtils.fillWithZero(HelperUtils
- .getRandomString(16, true).getBytes());
- private String[] serverVersion = initServerVersion();
- private byte[] message = null;
- private static final byte[] serverGUID = HelperUtils.randomBytes(16);
- private boolean authenticateNext = false;
- // components of a SMB packet
- private byte[] serverComp = new byte[4];
- private byte[] smbCommand = new byte[1];
- private byte[] ntStat = new byte[4];
- private byte[] smbFlags = new byte[1];
- private byte[] smbFlags2 = new byte[2];
- private byte[] processIDHigh = new byte[2];
- private byte[] signature = new byte[8];
- private byte[] reserved = new byte[2];
- private byte[] treeID = new byte[2];
- private byte[] processID = new byte[2];
- private byte[] userID = new byte[2];
- private byte[] multiplexID = new byte[2];
- // message constants
- private static final byte SMB_COM_CLOSE = 0x04;
- private static final byte SMB_COM_TRANSACTION = 0x25;
- private static final byte SMB_COM_ECHO = 0x2B;
- private static final byte SMB_COM_TRANSACTION2 = 0x32;
- private static final byte SMB_COM_TREE_DISCONNECT = 0x71;
- private static final byte SMB_COM_NEGOTIATE = 0x72;
- private static final byte SMB_COM_SESSION_SETUP_ANDX = 0x73;
- private static final byte SMB_COM_TREE_CONNECT_ANDX = 0x75;
- private static final byte SMB_COM_NT_CREATE_ANDX = (byte) 0xA2;
- @Override
- public int getPort() {
- return 445;
- }
- @Override
- public boolean isClosed() {
- return (state == STATE.CLOSED);
- }
- @Override
- public boolean isSecure() {
- return false;
- }
- @Override
- public List<Packet> processMessage(Packet requestPacket) {
- if (requestPacket != null)
- lastMessage = requestPacket.getBytes();
- parseMessageHeader(lastMessage);
- byte smbCommand = getSmbCommand();
- List<Packet> responsePackets = new ArrayList<Packet>();
- switch (state) {
- case NONE:
- if (smbCommand == SMB_COM_NEGOTIATE) {
- state = STATE.CONNECTED;
- responsePackets.add(getNego());
- } else {
- state = STATE.DISCONNECTED;
- responsePackets.add(getTreeDisc());
- }
- break;
- case CONNECTED:
- if (smbCommand == SMB_COM_SESSION_SETUP_ANDX) {
- responsePackets.add(getSessSetup());
- } else if (smbCommand == SMB_COM_TREE_CONNECT_ANDX) {
- state = STATE.AUTHENTICATED;
- responsePackets.add(getTreeCon());
- } else {
- state = STATE.DISCONNECTED;
- responsePackets.add(getTreeDisc());
- }
- break;
- case AUTHENTICATED:
- if (smbCommand == SMB_COM_NT_CREATE_ANDX) {
- state = STATE.LISTING;
- responsePackets.add(getNTCreate());
- } else if (smbCommand == SMB_COM_ECHO) {
- responsePackets.add(getEcho());
- } else if (smbCommand == SMB_COM_TRANSACTION2) {
- responsePackets.add(getTrans2());
- } else if (smbCommand == SMB_COM_CLOSE) {
- responsePackets.add(getClose());
- } else if (smbCommand == SMB_COM_TREE_DISCONNECT) {
- state = STATE.CLOSED;
- responsePackets.add(getTreeDisc());
- } else {
- state = STATE.DISCONNECTED;
- responsePackets.add(getTreeDisc());
- }
- break;
- case LISTING:
- if (smbCommand == SMB_COM_TRANSACTION) {
- responsePackets.add(getTrans());
- } else if (smbCommand == SMB_COM_CLOSE) {
- responsePackets.add(getClose());
- } else if (smbCommand == SMB_COM_TREE_DISCONNECT) {
- state = STATE.CLOSED;
- responsePackets.add(getTreeDisc());
- } else if (smbCommand == SMB_COM_NEGOTIATE) {
- state = STATE.CONNECTED;
- responsePackets.add(getNego());
- } else {
- state = STATE.DISCONNECTED;
- responsePackets.add(getTreeDisc());
- }
- break;
- case DISCONNECTED:
- state = STATE.CLOSED;
- responsePackets.add(getTreeDisc());
- break;
- default:
- state = STATE.CLOSED;
- responsePackets.add(getTreeDisc());
- }
- return responsePackets;
- }
- @Override
- public String toString() {
- return "SMB";
- }
- @Override
- public TALK_FIRST whoTalksFirst() {
- return TALK_FIRST.CLIENT;
- }
- /**
- * Evaluates what Dialects are offered by the client and which position the
- * used NT LM 0.12 dialect is at
- *
- * @return position of the NT LM 0.12 dialect
- */
- private byte[] evaluateDialect() {
- byte[] dialectMsg = new byte[message.length - 39];
- System.arraycopy(message, 39, dialectMsg, 0, message.length - 39);
- short dialectNumber = 0;
- for (int i = 0, start = 0; i < dialectMsg.length; i++) {
- if (dialectMsg[i] == 0x00) {
- byte[] dialect = new byte[i - start];
- System.arraycopy(dialectMsg, start, dialect, 0, i - start);
- if (HelperUtils.byteToStr(dialect).contains("NT LM 0.12")) {
- return new byte[] { (byte) dialectNumber,
- (byte) (dialectNumber >> 8) };
- }
- start = i + 1;
- dialectNumber++;
- }
- }
- return new byte[] { 0x00, 0x00 };
- }
- /**
- * Builds the close packet
- *
- * @return close packet
- */
- private Packet getClose() {
- byte[] wordCount = { 0x00 };
- byte[] byteCount = { 0x00, 0x00 };
- smbCommand = new byte[] { 0x04 };
- byte[] response = HelperUtils.concat(wordCount, byteCount);
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Builds the DCERPC packet
- *
- * @return DCERPC packet
- */
- private byte[] getDceRpc(byte[] transSub, int length) {
- byte[] majorVersion = { 0x05 };
- byte[] minorVersion = { 0x00 };
- byte[] packetType = null;
- byte[] packetFlags = { 0x03 };
- byte[] dataRepres = { 0x10, 0x00, 0x00, 0x00 };
- byte[] fragLength = null;
- byte[] authLength = { 0x00, 0x00 };
- byte[] callID = null;
- byte[] response = null;
- if (transSub[0] == 0x00 && transSub[1] == 0x0b) {
- packetType = new byte[] { 0x0c };
- fragLength = new byte[] { 0x44, 0x00 };
- callID = new byte[] { 0x01, 0x00, 0x00, 0x00 };
- byte[] maxXmitFrag = { (byte) 0xb8, 0x10 };
- byte[] maxRecvFrag = { (byte) 0xb8, 0x10 };
- byte[] assocGroup = { 0x4a, 0x41, 0x00, 0x00 };
- byte[] scndryAddrLen = { 0x0d, 0x00 };
- byte[] scndryAddr = { 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x73,
- 0x72, 0x76, 0x73, 0x76, 0x63, 0x00, 0x00 };
- byte[] numResults = { 0x01, 0x00, 0x00, 0x00 };
- byte[] ctxItem = { 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, (byte) 0x88,
- (byte) 0x8a, (byte) 0xeb, 0x1c, (byte) 0xc9, 0x11,
- (byte) 0x9f, (byte) 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48,
- 0x60, 0x02, 0x00, 0x00, 0x00 };
- response = HelperUtils.concat(majorVersion, minorVersion,
- packetType, packetFlags, dataRepres, fragLength,
- authLength, callID, maxXmitFrag, maxRecvFrag, assocGroup,
- scndryAddrLen, scndryAddr, numResults, ctxItem);
- } else if (transSub[0] == 0x00 && transSub[1] == 0x00) {
- packetType = new byte[] { 0x02 };
- byte[] tmp = ByteBuffer.allocate(4).putInt(length).array();
- fragLength = new byte[] { tmp[3], tmp[2] };
- callID = new byte[] { 0x02, 0x00, 0x00, 0x00 };
- tmp = ByteBuffer.allocate(4).putInt(length - 24).array();
- byte[] allocHint = new byte[] { tmp[3], tmp[2], tmp[1], tmp[0] };
- byte[] contextID = { 0x00, 0x00 };
- byte[] cancelCount = { 0x00, 0x00 };
- response = HelperUtils.concat(majorVersion, minorVersion,
- packetType, packetFlags, dataRepres, fragLength,
- authLength, callID, allocHint, contextID, cancelCount);
- }
- return response;
- }
- /**
- * Builds the echo packet
- *
- * @return echo packet
- */
- private Packet getEcho() {
- byte[] wordCount = { 0x01 };
- byte[] echoSeq = { 0x01, 0x00 };
- byte[] byteCount = { 0x10, 0x00 };
- byte[] echoData = { (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
- (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
- (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
- (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0 };
- byte[] response = HelperUtils.concat(wordCount, echoSeq, byteCount,
- echoData);
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Builds the negotiate packet
- *
- * @return negotiate packet
- */
- private Packet getNego() {
- byte[] wordCount = { 0x11 };
- byte[] dialect = evaluateDialect();
- byte[] secMode = { 0x03 };
- byte[] maxMpxC = { 0x32, 0x00 };
- byte[] maxVcs = { 0x01, 0x00 };
- byte[] maxBufSize = { 0x04, 0x11, 0x00, 0x00 };
- byte[] maxRawBuf = { 0x00, 0x00, 0x01, 0x00 };
- byte[] sessionKey = { 0x00, 0x00, 0x00, 0x00 };
- byte[] capabilities = { (byte) 0xfc, (byte) 0xe3, 0x01, (byte) 0x80 };
- byte[] sysTime = getTimeInBytes();
- byte[] timeZone = getTimeZoneInBytes();
- byte[] keyLength = { 0x00 };
- byte[] byteCount = { 0x3a, 0x00 };
- byte[] guid = serverGUID;
- byte[] secBlob = { 0x60, 0x28, 0x06, 0x06 };
- byte[] oid = { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x02 };
- byte[] protectNeg = { (byte) 0xa0, 0x1e };
- byte[] negToken = { 0x30, 0x1c, (byte) 0xa0, 0x1a, 0x30, 0x18 };
- byte[] mechType = { 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
- (byte) 0x82, 0x37, 0x02, 0x02, 0x1e };
- byte[] mechType2 = { 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
- (byte) 0x82, 0x37, 0x02, 0x02, 0x0a };
- byte[] response = HelperUtils.concat(wordCount, dialect, secMode,
- maxMpxC, maxVcs, maxBufSize, maxRawBuf, sessionKey,
- capabilities, sysTime, timeZone, keyLength, byteCount, guid,
- secBlob, oid, protectNeg, negToken, mechType, mechType2);
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Builds the nt create packet
- *
- * @return nt create packet
- */
- private Packet getNTCreate() {
- byte[] wordCount = { 0x22 };
- byte[] andXCommand = { (byte) 0xff };
- byte[] reserved = { 0x00 };
- byte[] andXOffset = { 0x67, 0x00 };
- byte[] oplockLevel = { 0x00 };
- byte[] fid = { (byte) 0x00, 0x40 };
- byte[] createAction = { 0x01, 0x00, 0x00, 0x00 };
- byte[] created = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- byte[] lastAccess = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- byte[] lastWrite = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- byte[] change = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- byte[] fileAttributes = { (byte) 0x80, 0x00, 0x00, 0x00 };
- byte[] allocationSize = { 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00 };
- byte[] endOfFile = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- byte[] fileType = { 0x02, 0x00 };
- byte[] ipcState = { (byte) 0xff, 0x05 };
- byte[] isDirectory = { 0x00 };
- byte[] byteCount = { 0x00, 0x00 };
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved,
- andXOffset, oplockLevel, fid, createAction, created,
- lastAccess, lastWrite, change, fileAttributes, allocationSize,
- endOfFile, fileType, ipcState, isDirectory, byteCount);
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Builds the session setup packet
- *
- * @ret urn session setup packet
- */
- private Packet getSessSetup() {
- if (authenticateNext) {
- return new Packet(getSetupAuth());
- } else {
- authenticateNext = true;
- return new Packet(getSetupChal());
- }
- }
- /**
- * Builds the session setup packet for authentication required
- *
- * @return session setup authentication packet
- */
- private byte[] getSetupAuth() {
- byte[] wordCount = { 0x04 };
- byte[] andXCommand = { (byte) 0xff };
- byte[] reserved = { 0x00 };
- byte[] andXOffset = { (byte) 0xa2, 0x00 };
- byte[] action = { 0x01, 0x00 };
- byte[] secBlobLength;
- byte[] byteCount;
- byte[] secBlob = { (byte) 0xa1, 0x07, 0x30, 0x05, (byte) 0xa0, 0x03,
- 0x0a, 0x01, 0x00 };
- byte[] nativOS = HelperUtils.fillWithZeroExtended(serverVersion[0]
- .getBytes());
- byte[] nativLanMngr = HelperUtils.fillWithZeroExtended(serverVersion[1]
- .getBytes());
- byte[] buffer = ByteBuffer.allocate(4).putInt(secBlob.length).array();
- secBlobLength = new byte[] { buffer[3], buffer[2] };
- buffer = ByteBuffer.allocate(4)
- .putInt(secBlob.length + nativOS.length + nativLanMngr.length)
- .array();
- byteCount = new byte[] { buffer[3], buffer[2] };
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved,
- andXOffset, action, secBlobLength, byteCount, secBlob, nativOS,
- nativLanMngr);
- return wrapNetbios(wrapHeader(response));
- }
- /**
- * Builds the session setup challange packet
- *
- * @return session setup challange packet
- */
- private byte[] getSetupChal() {
- byte[] wordCount = { 0x04 };
- byte[] andXCommand = { (byte) 0xff };
- byte[] reserved = { 0x00 };
- byte[] andXOffset = { 0x60, 0x01 };
- byte[] action = { 0x00, 0x00 };
- byte[] secBlobLength;
- byte[] byteCount;
- byte[] secBlob = { (byte) 0xa1, (byte) 0x81, (byte) 0xc4 };
- byte[] negToken = { 0x30, (byte) 0x81, (byte) 0xc1, (byte) 0xa0, 0x03,
- 0x0a, 0x01 };
- byte[] negResult = { 0x01 };
- byte[] negToken2 = { (byte) 0xa1, 0x0c, 0x06, 0x0a };
- byte[] supportedMech = { 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82,
- 0x37, 0x02, 0x02, 0x0a };
- byte[] negToken3 = { (byte) 0xa2, (byte) 0x81, (byte) 0xab, 0x04,
- (byte) 0x81, (byte) 0xa8 };
- byte[] ntlmsspId = { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 };
- byte[] nlmMsgType = { 0x02, 0x00, 0x00, 0x00 };
- byte[] buffer = ByteBuffer.allocate(4).putInt(serverName.length)
- .array();
- byte[] targetNameLength = new byte[] { buffer[3], buffer[2] };
- byte[] targetNameMaxLength = new byte[] { buffer[3], buffer[2] };
- byte[] targetNameOffset = { 0x38, 0x00, 0x00, 0x00 };
- byte[] flags = { 0x15, (byte) 0x82, (byte) 0x8a, 0x60 };
- if (!serverVersion[0].contains("Unix")) {
- flags[3] = (byte) (flags[3] | 0x02);
- }
- byte[] challenge = HelperUtils.randomBytes(8);
- byte[] reserved2 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- byte[] targetInfoLength = { 0x60, 0x00 };
- byte[] targetInfoMaxLength = { 0x60, 0x00 };
- byte[] targetInfoOffset = { 0x48, 0x00, 0x00, 0x00 };
- byte[] version = null;
- if (serverVersion[0].contains("Windows 7")
- || serverVersion[0].contains("Windows Server 2008")) {
- version = new byte[] { 0x06, 0x01, (byte) 0xb0, 0x1d, 0x00, 0x00,
- 0x00, 0x0f };
- } else if (serverVersion[0].contains("Windows 8")
- || serverVersion[0].contains("Windows Server 2012")) {
- version = new byte[] { 0x06, 0x02, (byte) 0xf0, 0x23, 0x00, 0x00,
- 0x00, 0x0f };
- }
- // serverName
- byte[] attributeNBDomain = { 0x02, 0x00, 0x10, 0x00 };
- // serverName
- byte[] attributeNBcomputer = { 0x01, 0x00, 0x10, 0x00 };
- // serverName
- byte[] attributeDNSDomain = { 0x04, 0x00, 0x10, 0x00 };
- // serverName
- byte[] attributeDNScomputer = { 0x03, 0x00, 0x10, 0x00 };
- // serverName
- byte[] attributeTimeStamp = { 0x07, 0x00, 0x08, 0x00 };
- byte[] timeStamp = getTimeInBytes();
- byte[] attributeEnd = { 0x00, 0x00, 0x00, 0x00 };
- secBlob = HelperUtils.concat(secBlob, negToken, negResult, negToken2,
- supportedMech, negToken3, ntlmsspId, nlmMsgType,
- targetNameLength, targetNameMaxLength, targetNameOffset, flags,
- challenge, reserved2, targetInfoLength, targetInfoMaxLength,
- targetInfoOffset, version, serverName, attributeNBDomain,
- serverName, attributeNBcomputer, serverName,
- attributeDNSDomain, serverName, attributeDNScomputer,
- serverName, attributeTimeStamp, timeStamp, attributeEnd);
- byte[] nativOS = HelperUtils.fillWithZeroExtended(serverVersion[0]
- .getBytes());
- byte[] nativLanMngr = HelperUtils.fillWithZeroExtended(serverVersion[1]
- .getBytes());
- buffer = ByteBuffer.allocate(4).putInt(secBlob.length).array();
- secBlobLength = new byte[] { buffer[3], buffer[2] };
- buffer = ByteBuffer.allocate(4)
- .putInt(secBlob.length + nativOS.length + nativLanMngr.length)
- .array();
- byteCount = new byte[] { buffer[3], buffer[2] };
- ntStat = new byte[] { 0x16, 0x00, 0x00, (byte) 0xc0 };
- userID = new byte[] { 0x00, 0x08 };
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved,
- andXOffset, action, secBlobLength, byteCount, secBlob, nativOS,
- nativLanMngr);
- return wrapNetbios(wrapHeader(response));
- }
- /**
- * Returns the command number from the current message
- *
- * @return command number
- */
- private byte getSmbCommand() {
- return smbCommand[0];
- }
- /**
- * Builds the trans packet
- *
- * @return trans packet
- */
- private Packet getTrans() {
- byte[] transSub = getTransSub();
- byte[] response = null;
- if (transSub[0] == 0x00 && transSub[1] == 0x0b) { // bind_ack
- byte[] wordCount = { 0x0a };
- byte[] totalParamCount = { 0x00, 0x00 };
- byte[] totalDataCount = { 0x44, 0x00 };
- byte[] reserved = { 0x00, 0x00 };
- byte[] paramCount = { 0x00, 0x00 };
- byte[] paramOffset = { 0x38, 0x00 };
- byte[] paramDisplace = { 0x00, 0x00 };
- byte[] dataCount = { 0x44, 0x00 };
- byte[] dataOffset = { 0x38, 0x00 };
- byte[] dataDisplace = { 0x00, 0x00 };
- byte[] setupCount = { 0x00 };
- byte[] reserved2 = { 0x00 };
- byte[] byteCount = { 0x45, 0x00 };
- byte[] padding = { 0x00 };
- byte[] dcerpc = getDceRpc(transSub, 0);
- response = HelperUtils.concat(wordCount, totalParamCount,
- totalDataCount, reserved, paramCount, paramOffset,
- paramDisplace, dataCount, dataOffset, dataDisplace,
- setupCount, reserved2, byteCount, padding, dcerpc);
- } else if (transSub[0] == 0x00 && transSub[1] == 0x00) { // netShareEnumAll
- byte[] wordCount = { 0x0a };
- byte[] totalParamCount = { 0x00, 0x00 };
- byte[] totalDataCount = { 0x20, 0x01 };
- byte[] reserved = { 0x00, 0x00 };
- byte[] paramCount = { 0x00, 0x00 };
- byte[] paramOffset = { 0x38, 0x00 };
- byte[] paramDisplace = { 0x00, 0x00 };
- byte[] dataCount = { 0x20, 0x01 };
- byte[] dataOffset = { 0x38, 0x00 };
- byte[] dataDisplace = { 0x00, 0x00 };
- byte[] setupCount = { 0x00 };
- byte[] reserved2 = { 0x00 };
- byte[] byteCount = new byte[2]/* = {0x21, 0x01} */;
- byte[] padding = { 0x00 };
- byte[] dcerpc = new byte[24];
- byte[] levelPointer = { 0x01, 0x00, 0x00, 0x00 };
- byte[] ctr = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00 };
- byte[] ctr1 = { 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00,
- 0x03, 0x00, 0x00, 0x00 };
- byte[] array1Pointer = { 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
- (byte) 0x80, 0x0c, 0x00, 0x02, 0x00 };
- byte[] array2Pointer = { 0x10, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
- (byte) 0x80, 0x14, 0x00, 0x02, 0x00 };
- byte[] array3Pointer = { 0x18, 0x00, 0x02, 0x00, 0x03, 0x00, 0x00,
- (byte) 0x80, 0x1c, 0x00, 0x02, 0x00 };
- byte[] array1 = { 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x07, 0x00, 0x00, 0x00, 0x41, 0x00, 0x44, 0x00, 0x4d, 0x00,
- 0x49, 0x00, 0x4e, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00,
- 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00,
- 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64, 0x00,
- 0x6d, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x00, 0x00 };
- byte[] array2 = { 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x43, 0x00, 0x24, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x44, 0x00, 0x65, 0x00,
- 0x66, 0x00, 0x61, 0x00, 0x75, 0x00, 0x6c, 0x00, 0x74, 0x00,
- 0x20, 0x00, 0x73, 0x00, 0x68, 0x00, 0x61, 0x00, 0x72, 0x00,
- 0x65, 0x00 };
- byte[] array3 = { 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x49, 0x00, 0x50, 0x00,
- 0x43, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00,
- 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00, 0x74, 0x00,
- 0x65, 0x00, 0x20, 0x00, 0x49, 0x00, 0x50, 0x00, 0x43, 0x00,
- 0x00, 0x00 };
- byte[] totalEntries = { 0x00, 0x00, 0x03, 0x00, 0x00, 0x00 };
- byte[] referentID = { 0x20, 0x00, 0x02, 0x00 };
- byte[] resumeHandle = { 0x00, 0x00, 0x00, 0x00 };
- byte[] windowsError = { 0x00, 0x00, 0x00, 0x00 };
- int tmp = padding.length + dcerpc.length + levelPointer.length
- + ctr.length + ctr1.length + array1Pointer.length
- + array2Pointer.length + array3Pointer.length
- + array1.length + array2.length + array3.length
- + totalEntries.length + referentID.length
- + resumeHandle.length + windowsError.length;
- byte[] tmp2 = ByteBuffer.allocate(4).putInt(tmp).array();
- byteCount = new byte[] { tmp2[3], tmp2[2] };
- dcerpc = getDceRpc(transSub, tmp - 1);
- response = HelperUtils.concat(wordCount, totalParamCount,
- totalDataCount, reserved, paramCount, paramOffset,
- paramDisplace, dataCount, dataOffset, dataDisplace,
- setupCount, reserved2, byteCount, padding, dcerpc,
- levelPointer, ctr, ctr1, array1Pointer, array2Pointer,
- array3Pointer, array1, array2, array3, totalEntries,
- referentID, resumeHandle, windowsError);
- }
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Builds the trans2 packet
- *
- * @return trans2 packet
- */
- private Packet getTrans2() {
- byte[] response = null;
- byte[] wordCount = { 0x00 };
- byte[] andXCommand = { 0x00, 0x00 };
- ntStat = new byte[] { 0x22, 0x00, 0x00, (byte) 0xc0 };
- response = HelperUtils.concat(wordCount, andXCommand);
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Extracts the trans sub packet from message
- *
- * @return trans sub packet
- */
- private byte[] getTransSub() {
- byte[] transSub = new byte[2];
- if (smbCommand[0] == 0x32)
- transSub = new byte[] { message[66], message[65] };
- else if (smbCommand[0] == 0x25)
- transSub = new byte[] { 0x00, message[90] };
- else
- transSub = new byte[] { 0x00, 0x00 };
- return transSub;
- }
- /**
- * Builds the tree connect packet
- *
- * @return tree connect packet
- */
- private Packet getTreeCon() {
- String str = HelperUtils.byteToStr(message);
- byte[] wordCount = { 0x00 };
- byte[] andXCommand = { 0x00, 0x00 };
- byte[] response = null;
- if (str.contains("IPC$") || str.contains("C$")) {
- wordCount = new byte[] { 0x07 };
- andXCommand = new byte[] { (byte) 0xff };
- byte[] reserved = { 0x00 };
- byte[] andXOffset = { 0x38, 0x00 };
- byte[] optionalSupport = { 0x01, 0x00 };
- byte[] maxShareAccess = { (byte) 0xff, (byte) 0xff, 0x1f, 0x00 };
- byte[] guestMaxShareAccess = { (byte) 0xff, (byte) 0xff, 0x1f, 0x00 };
- byte[] byteCount = { 0x07, 0x00 };
- byte[] service = { 0x49, 0x50, 0x43, 0x00 };
- byte[] extraParameters = { 0x00, 0x00, 0x00 };
- treeID = new byte[] { 0x00, 0x08 };
- response = HelperUtils.concat(wordCount, andXCommand, reserved,
- andXOffset, optionalSupport, maxShareAccess,
- guestMaxShareAccess, byteCount, service, extraParameters);
- } else if (str.contains("ADMIN$")) {
- ntStat = new byte[] { 0x22, 0x00, 0x00, (byte) 0xc0 };
- response = HelperUtils.concat(wordCount, andXCommand);
- } else {
- ntStat = new byte[] { (byte) 0xcc, 0x00, 0x00, (byte) 0xc0 };
- response = HelperUtils.concat(wordCount, andXCommand);
- }
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Builds the tree disconnect packet
- *
- * @return tree disconnect packet
- */
- private Packet getTreeDisc() {
- byte[] wordCount = { 0x00 };
- byte[] byteCount = { 0x00, 0x00 };
- smbCommand[0] = 0x71;
- byte[] response = HelperUtils.concat(wordCount, byteCount);
- return new Packet(wrapNetbios(wrapHeader(response)));
- }
- /**
- * Breaks a message from the client down into its components
- *
- * @param message
- * that is analyzed
- */
- private void parseMessageHeader(byte[] message) {
- this.message = message;
- serverComp = new byte[] { message[4], message[5], message[6],
- message[7] };
- smbCommand = new byte[] { message[8] };
- ntStat = new byte[] { message[9], message[10], message[11], message[12] };
- smbFlags = new byte[] { (byte) (message[13] | 0x80) }; // | 0x80 for
- // mark response
- // bit
- smbFlags2 = new byte[] { message[14], message[15] };
- processIDHigh = new byte[] { message[16], message[17] };
- signature = new byte[] { message[18], message[19], message[20],
- message[21], message[22], message[23], message[24], message[25] };
- reserved = new byte[] { message[26], message[27] };
- treeID = new byte[] { message[28], message[29] };
- processID = new byte[] { message[30], message[31] };
- userID = new byte[] { message[32], message[33] };
- multiplexID = new byte[] { message[34], message[35] };
- }
- /**
- * Wraps the header around a response
- *
- * @param response
- * that is wrapped
- * @return wrapped response
- */
- private byte[] wrapHeader(byte[] response) {
- byte[] header = new byte[0];
- return HelperUtils.concat(header, serverComp, smbCommand, ntStat,
- smbFlags, smbFlags2, processIDHigh, signature, reserved,
- treeID, processID, userID, multiplexID, response);
- }
- /**
- * Wraps the Netbios header around a response
- *
- * @param response
- * that is wrapped
- * @return wrapped response
- */
- private byte[] wrapNetbios(byte[] response) {
- byte[] netbios = { 0x00 };
- // allocate(4) because int is 4 bytes long
- byte[] buffer = ByteBuffer.allocate(4).putInt(response.length).array();
- // only bytes 1-3 needed, byte 0 is not needed
- byte[] netbiosLength = { buffer[1], buffer[2], buffer[3] };
- return HelperUtils.concat(netbios, netbiosLength, response);
- }
- }
|