123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640 |
- package de.tudarmstadt.informatik.hostage.protocol;
- import java.nio.ByteBuffer;
- import java.util.ArrayList;
- import java.util.Calendar;
- import java.util.List;
- import java.util.Random;
- import java.util.TimeZone;
- import de.tudarmstadt.informatik.hostage.commons.HelperUtils;
- import de.tudarmstadt.informatik.hostage.wrapper.ByteArray;
- /**
- * SMB protocol
- * @author Wulf Pfeiffer
- */
- public final class SMB implements Protocol<ByteArray> {
- /**
- * Represents the states of the protocol
- */
- private static enum STATE {
- NONE, CONNECTED, AUTHENTICATED, LISTING, DISCONNECTED, CLOSED
- }
-
- /**
- * Denotes in which state the protocol is right now
- */
- private STATE state = STATE.NONE;
- @Override
- public int getPort() {
- return 445;
- }
- @Override
- public TALK_FIRST whoTalksFirst() {
- return TALK_FIRST.CLIENT;
- }
-
- private SMBPacket packet = new SMBPacket();
- @Override
- public List<ByteArray> processMessage(ByteArray message) {
- byte[] primitiveByteArray = message.get();
- packet.newMsg(primitiveByteArray);
- byte smbCommand = packet.getSmbCommand();
- List<ByteArray> response = new ArrayList<ByteArray>();
- switch (state) {
- case NONE:
- if (smbCommand == 0x72) {
- state = STATE.CONNECTED;
- response.add(new ByteArray(packet.getNego()));
- } else {
- state = STATE.DISCONNECTED;
- response.add(new ByteArray(packet.getTreeDisc()));
- }
- break;
- case CONNECTED:
- if (smbCommand == 0x73) {
- response.add(new ByteArray(packet.getSessSetup()));
- } else if (smbCommand == 0x75) {
- state = STATE.AUTHENTICATED;
- response.add(new ByteArray(packet.getTreeCon()));
- } else {
- state = STATE.DISCONNECTED;
- response.add(new ByteArray(packet.getTreeDisc()));
- }
- break;
- case AUTHENTICATED:
- if (smbCommand == (byte) 0xa2) {
- state = STATE.LISTING;
- response.add(new ByteArray(packet.getNTCreate()));
- } else if (smbCommand == 0x2b) {
- response.add(new ByteArray(packet.getEcho()));
- } else if (smbCommand == 0x32) {
- response.add(new ByteArray(packet.getTrans2()));
- } else if (smbCommand == 0x04) {
- response.add(new ByteArray(packet.getClose()));
- } else if (smbCommand == 0x71) {
- state = STATE.CLOSED;
- response.add(new ByteArray(packet.getTreeDisc()));
- } else {
- state = STATE.DISCONNECTED;
- response.add(new ByteArray(packet.getTreeDisc()));
- }
- break;
- case LISTING:
- if (smbCommand == 0x25) {
- response.add(new ByteArray(packet.getTrans()));
- } else if (smbCommand == 0x04) {
- response.add(new ByteArray(packet.getClose()));
- } else if (smbCommand == 0x71) {
- state = STATE.CLOSED;
- response.add(new ByteArray(packet.getTreeDisc()));
- } else if (smbCommand == 0x72) {
- state = STATE.CONNECTED;
- response.add(new ByteArray(packet.getNego()));
- } else {
- state = STATE.DISCONNECTED;
- response.add(new ByteArray(packet.getTreeDisc()));
- }
- break;
- case DISCONNECTED:
- state = STATE.CLOSED;
- response.add(new ByteArray(packet.getTreeDisc()));
- break;
- default:
- state = STATE.CLOSED;
- response.add(new ByteArray(packet.getTreeDisc()));
- }
- return response;
- }
- @Override
- public boolean isClosed() {
- return (state == STATE.CLOSED);
- }
- @Override
- public boolean isSecure() {
- return false;
- }
- @Override
- public Class<ByteArray> getType() {
- return ByteArray.class;
- }
- @Override
- public String toString() {
- return "SMB";
- }
- /**
- * Converts the current system time into a byte[] with windows specific time
- * @return current system time in windows format as byte[]
- */
- private byte[] getTimeInBytes() {
- long time = System.currentTimeMillis();
- Calendar calend = Calendar.getInstance();
- calend.setTimeZone(TimeZone.getTimeZone("UTC"));
- calend.set(1601, 0, 01, 00, 00, 00);
- time -= calend.getTimeInMillis();
- time *= 10000;
- byte[] b = new byte[8];
- byte[] b2 = ByteBuffer.allocate(8).putLong(time).array();
- for (int i = 0, j = 7; i < 8 && j > -1; i++, j--) {
- b[i] = (byte) (b2[j] & 0xff);
- }
- return b;
- }
-
- /**
- * Generates a random byte[] of a specified size
- * @param size of the byte[]
- * @return random byte[]
- */
- private byte[] randomBytes(int size) {
- byte[] bytes = new byte[size];
- Random rdm = new Random();
- rdm.nextBytes(bytes);
- return bytes;
- }
- /**
- * Denotes a SMB packet
- */
- private class SMBPacket {
- private byte[] message = null;
- private final byte[] serverGUID = randomBytes(16);
- private boolean authenticateNext = false;
- //components of a SMB packet
- private byte[] serverComp = new byte[4];
- private byte[] smbCommand = new byte[1];
- private byte[] ntStat = new byte[4];
- private byte[] smbFlags = new byte[1];
- private byte[] smbFlags2 = new byte[2];
- private byte[] processIDHigh = new byte[2];
- private byte[] signature = new byte[8];
- private byte[] reserved = new byte[2];
- private byte[] treeID = new byte[2];
- private byte[] processID = new byte[2];
- private byte[] userID = new byte[2];
- private byte[] multiplexID = new byte[2];
-
- /** Constructor */
- public SMBPacket() {}
-
- /**
- * Breaks a message from the client down into its components
- * @param message that is analyzed
- */
- public void newMsg(byte[] message) {
- this.message = message;
- serverComp = new byte[]{message[4], message[5], message[6], message[7]};
- smbCommand = new byte[]{message[8]};
- ntStat = new byte[]{message[9], message[10], message[11], message[12]};
- smbFlags = new byte[]{(byte) (message[13] | 0x80)}; // | 0x80 for mark response bit
- smbFlags2 = new byte[]{message[14], message[15]};
- processIDHigh = new byte[]{message[16], message[17]};
- signature = new byte[]{message[18], message[19], message[20], message[21], message[22], message[23], message[24], message[25]};
- reserved = new byte[]{message[26], message[27]};
- treeID = new byte[]{message[28], message[29]};
- processID = new byte[]{message[30], message[31]};
- userID = new byte[]{message[32], message[33]};
- multiplexID = new byte[]{message[34], message[35]};
- }
-
- /**
- * Wraps the Netbios header around a response
- * @param response that is wrapped
- * @return wrapped response
- */
- private byte[] wrapNetbios(byte[] response) {
- byte[] netbios = {0x00};
- byte[] buffer = ByteBuffer.allocate(4).putInt(response.length).array(); // allocate(4) because int is 4 bytes long
- byte[] netbiosLength = {buffer[1], buffer[2], buffer[3]}; // only bytes 1-3 needed, byte 0 is not needed
- return HelperUtils.concat(netbios, netbiosLength, response);
- }
-
- /**
- * Wraps the header around a response
- * @param response that is wrapped
- * @return wrapped response
- */
- private byte[] wrapHeader(byte[] response) {
- byte[] header = new byte[0];
- return HelperUtils.concat(header, serverComp, smbCommand, ntStat, smbFlags, smbFlags2, processIDHigh, signature,
- reserved, treeID, processID, userID, multiplexID, response);
- }
-
- /**
- * Builds the negotiate packet
- * @return negotiate packet
- */
- public byte[] getNego() {
- byte[] wordCount = {0x11};
- byte[] dialect = evaluateDialect();
- byte[] secMode = {0x03};
- byte[] maxMpxC = {0x32, 0x00};
- byte[] maxVcs = {0x01, 0x00};
- byte[] maxBufSize = {0x04, 0x11, 0x00, 0x00};
- byte[] maxRawBuf = {0x00, 0x00, 0x01, 0x00};
- byte[] sessionKey = {0x00, 0x00, 0x00, 0x00};
- byte[] capabilities = {(byte) 0xfc, (byte) 0xe3, 0x01, (byte) 0x80};
- byte[] sysTime = getTimeInBytes();
- byte[] timeZone = {(byte) 0x88, (byte) 0xff}; //FIXME correct time zone
- byte[] keyLength = {0x00};
- byte[] byteCount = {0x3a, 0x00};
- byte[] guid = serverGUID;
- byte[] secBlob = {0x60, 0x28, 0x06, 0x06};
- byte[] oid = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x02};
- byte[] protectNeg = {(byte) 0xa0, 0x1e};
- byte[] negToken = {0x30, 0x1c, (byte) 0xa0, 0x1a, 0x30, 0x18};
- byte[] mechType = {0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82, 0x37, 0x02, 0x02, 0x1e};
- byte[] mechType2 = {0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82, 0x37, 0x02, 0x02, 0x0a};
-
- byte[] response = HelperUtils.concat(wordCount, dialect, secMode, maxMpxC, maxVcs, maxBufSize, maxRawBuf,
- sessionKey, capabilities, sysTime, timeZone, keyLength, byteCount, guid, secBlob, oid,
- protectNeg, negToken, mechType, mechType2);
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Evaluates what Dialects are offered by the client and which position the used NT LM 0.12 dialect is at
- * @return position of the NT LM 0.12 dialect
- */
- private byte[] evaluateDialect() {
- byte[] dialectMsg = new byte[message.length-39];
- System.arraycopy(message, 39, dialectMsg, 0, message.length - 39);
- short dialectNumber = 0;
- for(int i = 0, start = 0; i < dialectMsg.length; i++) {
- if(dialectMsg[i] == 0x00) {
- byte[] dialect = new byte[i-start];
- System.arraycopy(dialectMsg, start, dialect, 0, i-start);
- if(byteToStr(dialect).contains("NT LM 0.12")) {
- return new byte[]{(byte)dialectNumber, (byte)(dialectNumber >> 8)};
- }
- start = i+1;
- dialectNumber++;
- }
- }
- return new byte[]{0x00, 0x00};
- }
-
- /**
- * Builds the session setup packet
- * @return session setup packet
- */
- public byte[] getSessSetup() {
- if(authenticateNext) return getSetupAuth();
- else {
- authenticateNext = true;
- return getSetupChal();
- }
- }
-
- /**
- * Builds the setup challange packet
- * @return setup challange packet
- */
- private byte[] getSetupChal() {
- byte[] wordCount = {0x04};
- byte[] andXCommand = {(byte) 0xff};
- byte[] reserved = {0x00};
- byte[] andXOffset = {0x60, 0x01};
- byte[] action = {0x00, 0x00};
- byte[] secBlobLength = {(byte) 0xc7, 0x00};
- byte[] byteCount = {0x35, 0x01};
- byte[] secBlob = {(byte) 0xa1, (byte) 0x81, (byte) 0xc4};
- byte[] negToken = {0x30, (byte) 0x81, (byte) 0xc1, (byte) 0xa0, 0x03, 0x0a, 0x01};
- byte[] negResult = {0x01};
- byte[] negToken2 = {(byte) 0xa1, 0x0c, 0x06, 0x0a};
- byte[] supportedMech = {0x2b, 0x06, 0x01, 0x04, 0x01, (byte) 0x82, 0x37, 0x02, 0x02, 0x0a};
- byte[] negToken3 = {(byte) 0xa2, (byte) 0x81, (byte) 0xab, 0x04, (byte) 0x81, (byte) 0xa8};
- byte[] respToken = {0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x02, 0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00,
- 0x38, 0x00, 0x00, 0x00, 0x15, (byte) 0x82, (byte) 0x8a, 0x62};
- byte[] challenge = randomBytes(8);
- byte[] respToken2 = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x60, 0x00, 0x48, 0x00, 0x00, 0x00,
- 0x06, 0x01, (byte) 0xb0, 0x1d, 0x00, 0x00, 0x00, 0x0f, 0x42, 0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00,
- 0x4e, 0x00, 0x45, 0x00, 0x53, 0x00, 0x53, 0x00, 0x02, 0x00, 0x10, 0x00, 0x42, 0x00, 0x55, 0x00,
- 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45, 0x00, 0x53, 0x00, 0x53, 0x00, 0x01, 0x00, 0x10, 0x00,
- 0x42, 0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45, 0x00, 0x53, 0x00, 0x53, 0x00,
- 0x04, 0x00, 0x10, 0x00, 0x42, 0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00, 0x4e, 0x00, 0x45, 0x00,
- 0x53, 0x00, 0x53, 0x00, 0x03, 0x00, 0x10, 0x00, 0x42, 0x00, 0x55, 0x00, 0x53, 0x00, 0x49, 0x00,
- 0x4e, 0x00, 0x45, 0x00, 0x53, 0x00, 0x53, 0x00, 0x07, 0x00, 0x08, 0x00};
- byte[] timeStamp = getTimeInBytes();
- byte[] respToken3 = {0x00, 0x00, 0x00, 0x00};
- byte[] nativOS = {0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
- 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37, 0x00, 0x20, 0x00, 0x50, 0x00, 0x72, 0x00,
- 0x6f, 0x00, 0x66, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00,
- 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x37, 0x00, 0x36, 0x00, 0x30, 0x00, 0x30, 0x00, 0x00, 0x00}; //Windows 7 Professional 7600
- byte[] nativLanMngr = {0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
- 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37, 0x00, 0x20, 0x00, 0x50, 0x00,
- 0x72, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
- 0x6e, 0x00, 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x36, 0x00, 0x2e, 0x00, 0x31, 0x00, 0x00, 0x00}; //Windows 7 Professional 6.1
-
- ntStat = new byte[]{0x16, 0x00, 0x00, (byte) 0xc0};
- userID = new byte[]{0x00, 0x08};
-
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, action, secBlobLength,
- byteCount, secBlob, negToken, negResult, negToken2, supportedMech, negToken3,
- respToken, challenge, respToken2, timeStamp, respToken3, nativOS, nativLanMngr);
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the setup authentication packet
- * @return setup authentication packet
- */
- private byte[] getSetupAuth() {
- byte[] wordCount = {0x04};
- byte[] andXCommand = {(byte) 0xff};
- byte[] reserved = {0x00};
- byte[] andXOffset = {(byte) 0xa2, 0x00};
- byte[] action = {0x01, 0x00};
- byte[] secBlobLength = {0x09, 0x00};
- byte[] byteCount = {(byte) 0x77, 0x00};
- byte[] secBlob = {(byte) 0xa1, 0x07, 0x30, 0x05, (byte) 0xa0, 0x03, 0x0a, 0x01, 0x00};
- byte[] nativOS = {0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
- 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37, 0x00, 0x20, 0x00, 0x50, 0x00, 0x72, 0x00,
- 0x6f, 0x00, 0x66, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00,
- 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x37, 0x00, 0x36, 0x00, 0x30, 0x00, 0x30, 0x00, 0x00, 0x00}; //Windows 7 Professional 7600
- byte[] nativLanMngr = {0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
- 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x37, 0x00, 0x20, 0x00, 0x50, 0x00,
- 0x72, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00,
- 0x6e, 0x00, 0x61, 0x00, 0x6c, 0x00, 0x20, 0x00, 0x36, 0x00, 0x2e, 0x00, 0x31, 0x00, 0x00, 0x00}; //Windows 7 Professional 6.1
-
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, action, secBlobLength,
- byteCount, secBlob, nativOS, nativLanMngr);
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the tree connect packet
- * @return tree connect packet
- */
- public byte[] getTreeCon() {
- String str = toString();
- byte[] wordCount = {0x00};
- byte[] andXCommand = {0x00, 0x00};
- byte[] response = null;
-
- if(str.contains("IPC$") || str.contains("DOCS")) {
- wordCount = new byte[] {0x07};
- andXCommand = new byte[] {(byte) 0xff};
- byte[] reserved = {0x00};
- byte[] andXOffset = {0x38, 0x00};
- byte[] optionalSupport = {0x01, 0x00};
- byte[] maxShareAccess = {(byte) 0xff, (byte) 0xff, 0x1f, 0x00};
- byte[] guestMaxShareAccess = {(byte) 0xff, (byte) 0xff, 0x1f, 0x00};
- byte[] byteCount = {0x07, 0x00};
- byte[] service = {0x49, 0x50, 0x43, 0x00};
- byte[] extraParameters = {0x00, 0x00, 0x00};
-
- treeID = new byte[]{0x00, 0x08};
-
- response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, optionalSupport, maxShareAccess,
- guestMaxShareAccess, byteCount, service, extraParameters);
- } else if(str.contains("C$") || str.contains("ADMIN$")) {
- ntStat = new byte[] {0x22, 0x00, 0x00, (byte) 0xc0};
- response = HelperUtils.concat(wordCount, andXCommand);
- } else {
- ntStat = new byte[] {(byte) 0xcc, 0x00, 0x00, (byte) 0xc0};
- response = HelperUtils.concat(wordCount, andXCommand);
- }
-
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the nt create packet
- * @return nt create packet
- */
- public byte[] getNTCreate() {
- byte[] wordCount = {0x22};
- byte[] andXCommand = {(byte) 0xff};
- byte[] reserved = {0x00};
- byte[] andXOffset = {0x67, 0x00};
- byte[] oplockLevel = {0x00};
- byte[] fid = {(byte) 0x00, 0x40};
- byte[] createAction = {0x01, 0x00, 0x00, 0x00};
- byte[] created = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] lastAccess = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] lastWrite = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] change = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] fileAttributes = {(byte) 0x80, 0x00, 0x00, 0x00};
- byte[] allocationSize = {0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] endOfFile = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] fileType = {0x02, 0x00};
- byte[] ipcState = {(byte) 0xff, 0x05};
- byte[] isDirectory = {0x00};
- byte[] byteCount = {0x00, 0x00};
-
- byte[] response = HelperUtils.concat(wordCount, andXCommand, reserved, andXOffset, oplockLevel, fid,
- createAction, created, lastAccess, lastWrite, change, fileAttributes, allocationSize,
- endOfFile, fileType, ipcState, isDirectory, byteCount);
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the trans packet
- * @return trans packet
- */
- public byte[] getTrans() {
- byte[] transSub = getTransSub();
- byte[] response = null;
- if(transSub[0] == 0x00 && transSub[1] == 0x0b) {
- byte[] wordCount = {0x0a};
- byte[] totalParamCount = {0x00,0x00};
- byte[] totalDataCount = {0x44,0x00};
- byte[] reserved = {0x00, 0x00};
- byte[] paramCount = {0x00, 0x00};
- byte[] paramOffset = {0x38, 0x00};
- byte[] paramDisplace = {0x00, 0x00};
- byte[] dataCount = {0x44, 0x00};
- byte[] dataOffset = {0x38, 0x00};
- byte[] dataDisplace = {0x00, 0x00};
- byte[] setupCount = {0x00};
- byte[] reserved2 = {0x00};
- byte[] byteCount = {0x45, 0x00};
- byte[] padding = {0x00};
-
- byte[] dcerpc = {0x05, 0x00,
- 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, (byte) 0xb8, 0x10,
- (byte) 0xb8, 0x10, 0x4a, 0x41, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x73, 0x72,
- 0x76, 0x73, 0x76, 0x63, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d,
- (byte) 0x88, (byte) 0x8a, (byte) 0xeb, 0x1c, (byte) 0xc9, 0x11, (byte) 0x9f, (byte) 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
- 0x00, 0x00};
-
- response = HelperUtils.concat(wordCount, totalParamCount, totalDataCount, reserved, paramCount, paramOffset,
- paramDisplace, dataCount, dataOffset, dataDisplace, setupCount, reserved2, byteCount, padding, dcerpc);
-
- } else if(transSub[0] == 0x00 && transSub[1] == 0x00) {
- byte[] wordCount = {0x0a};
- byte[] totalParamCount = {0x00, 0x00};
- byte[] totalDataCount = {0x54, 0x01};
- byte[] reserved = {0x00, 0x00};
- byte[] paramCount = {0x00, 0x00};
- byte[] paramOffset = {0x38, 0x00};
- byte[] paramDisplace = {0x00, 0x00};
- byte[] dataCount = {0x54, 0x01};
- byte[] dataOffset = {0x38, 0x00};
- byte[] dataDisplace = {0x00, 0x00};
- byte[] setupCount = {0x00};
- byte[] reserved2 = {0x00};
- byte[] byteCount = {0x55, 0x01};
- byte[] padding = {0x00};
-
- byte[] dcerpc = {0x05, 0x00,
- 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x54, 0x01, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x3c, 0x01,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
- byte[] serverService = {0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x08, 0x00,
- 0x02, 0x00, 0x00, 0x00, 0x00, (byte) 0x80, 0x0c, 0x00, 0x02, 0x00, 0x10, 0x00, 0x02, 0x00, 0x00, 0x00,
- 0x00, (byte) 0x80, 0x14, 0x00, 0x02, 0x00, 0x18, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00,
- 0x02, 0x00, 0x20, 0x00, 0x02, 0x00, 0x03, 0x00, 0x00, (byte) 0x80, 0x24, 0x00, 0x02, 0x00, 0x07, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x41, 0x00, 0x44, 0x00, 0x4d, 0x00,
- 0x49, 0x00, 0x4e, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x6f, 0x00, 0x74, 0x00,
- 0x65, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x43, 0x00,
- 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0e, 0x00,
- 0x00, 0x00, 0x44, 0x00, 0x65, 0x00, 0x66, 0x00, 0x61, 0x00, 0x75, 0x00, 0x6c, 0x00, 0x74, 0x00,
- 0x20, 0x00, 0x73, 0x00, 0x68, 0x00, 0x61, 0x00, 0x72, 0x00, 0x65, 0x00, 0x00, 0x00, 0x05, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x63, 0x00,
- 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00,
- 0x00, 0x00, 0x49, 0x00, 0x50, 0x00, 0x43, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x52, 0x00, 0x65, 0x00, 0x6d, 0x00,
- 0x6f, 0x00, 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x49, 0x00, 0x50, 0x00, 0x43, 0x00, 0x00, 0x00};
- byte[] totalEntries = {0x00, 0x00, 0x04, 0x00, 0x00, 0x00};
- byte[] referentID = {0x28, 0x00, 0x02, 0x00};
- byte[] resumeHandle = {0x00, 0x00, 0x00, 0x00};
- byte[] windowsError = {0x00, 0x00, 0x00, 0x00};
- response = HelperUtils.concat(wordCount, totalParamCount, totalDataCount, reserved, paramCount, paramOffset,
- paramDisplace, dataCount, dataOffset, dataDisplace, setupCount, reserved2, byteCount, padding, dcerpc,
- serverService, totalEntries, referentID, resumeHandle, windowsError);
-
-
- }
-
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the close packet
- * @return close packet
- */
- public byte[] getClose() {
- byte[] wordCount = {0x00};
- byte[] byteCount = {0x00, 0x00};
-
- smbCommand = new byte[]{0x04};
-
- byte[] response = HelperUtils.concat(wordCount, byteCount);
-
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the tree disconnect packet
- * @return tree disconnect packet
- */
- public byte[] getTreeDisc() {
- byte[] wordCount = {0x00};
- byte[] byteCount = {0x00, 0x00};
-
- smbCommand[0] = 0x71;
-
- byte[] response = HelperUtils.concat(wordCount, byteCount);
-
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the echo packet
- * @return echo packet
- */
- public byte[] getEcho() {
- byte[] wordCount = {0x01};
- byte[] echoSeq = {0x01, 0x00};
- byte[] byteCount = {0x10, 0x00};
- byte[] echoData = {(byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0,
- (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0, (byte) 0xf0};
- byte[] response = HelperUtils.concat(wordCount, echoSeq, byteCount, echoData);
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the trans2 packet
- * @return trans2 packet
- */
- public byte[] getTrans2() {
- byte[] response = null;
- byte[] wordCount = {0x00};
- byte[] andXCommand = {0x00, 0x00};
- ntStat = new byte[] {0x22, 0x00, 0x00, (byte) 0xc0};
- response = HelperUtils.concat(wordCount, andXCommand);
- return wrapNetbios(wrapHeader(response));
- }
-
- /**
- * Builds the trans sub packet
- * @return trans sub packet
- */
- private byte[] getTransSub() {
- byte[] transSub = new byte[2];
- if(smbCommand[0] == 0x32) transSub = new byte[]{message[66], message[65]};
- else if(smbCommand[0] == 0x25) transSub = new byte[]{0x00, message[90]};
- else transSub = new byte[]{0x00, 0x00};
- return transSub;
- }
- @Override
- public String toString() {
- return byteToStr(message);
- }
-
- /**
- * Converts a byte[] to a String, but only characters in ASCII between 32 and 127
- * @param bytes that are converted
- * @return converted String
- */
- private String byteToStr(byte[] bytes) {
- char[] chars = new char[bytes.length];
- for (int i = 0, j = 0; i < bytes.length && j < chars.length; i++) {
- if (isLetter((char) bytes[i])) {
- chars[j] = (char) bytes[i];
- j++;
- }
- }
- return new String(chars);
- }
- /**
- * Determines if a character is in ASCII between 32 and 127
- * @param character that is checked
- * @return true if the character is between 32 and 127, else false
- */
- private boolean isLetter(char character) {
- return (character >= 32 && character <= 127);
- }
-
- /**
- * Returns the command number from the current message
- * @return command number
- */
- public byte getSmbCommand() {
- return smbCommand[0];
- }
- }
- }
|