Module: Msf::Exploit::Remote::SMB::Server::Share::InformationLevel::Query
- Included in:
- Msf::Exploit::Remote::SMB::Server::Share
- Defined in:
- lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb
Instance Method Summary collapse
-
#send_info_basic_res(c, opts = {}) ⇒ Integer
Builds and sends an TRANS2_QUERY_PATH_INFORMATION response with SMB_QUERY_FILE_BASIC_INFO information level.
-
#send_info_network_res(c, opts = {}) ⇒ Integer
Builds and sends an TRANS2_QUERY_PATH_INFORMATION response with SMB_QUERY_FILE_NETWORK_INFO information level.
-
#send_info_standard_res(c, opts = {}) ⇒ Integer
Builds and sends an TRANS2_QUERY_PATH_INFORMATION response with SMB_QUERY_FILE_STANDARD_INFO information level.
-
#smb_cmd_trans_query_file_info_basic(c, fid) ⇒ Integer
Handles a TRANS2_QUERY_FILE_INFORMATION transaction request with SMB_QUERY_FILE_BASIC_INFO Information Level.
-
#smb_cmd_trans_query_file_info_standard(c, fid) ⇒ Integer
Handles a TRANS2_QUERY_FILE_INFORMATION transaction request with SMB_QUERY_FILE_STANDARD_INFO Information Level.
-
#smb_cmd_trans_query_path_info_basic(c, path) ⇒ Integer
Handles a TRANS2_QUERY_PATH_INFORMATION transaction request with SMB_QUERY_FILE_BASIC_INFO Information Level.
-
#smb_cmd_trans_query_path_info_network(c, path) ⇒ Integer
Handles a TRANS2_QUERY_PATH_INFORMATION transaction request with SMB_QUERY_FILE_NETWORK_INFO Information Level.
-
#smb_cmd_trans_query_path_info_standard(c, path) ⇒ Integer
Handles a TRANS2_QUERY_PATH_INFORMATION transaction request with SMB_QUERY_FILE_STANDARD_INFO Information Level.
Instance Method Details
#send_info_basic_res(c, opts = {}) ⇒ Integer
Builds and sends an TRANS2_QUERY_PATH_INFORMATION response with SMB_QUERY_FILE_BASIC_INFO information level.
128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 128 def send_info_basic_res(c, opts = {}) file_attributes = opts[:file_attributes] || 0 trans2_params = CONST::SMB_TRANS2_QUERY_PATH_INFORMATION_RES_PARAMETERS.make_struct trans2_params.v['EaErrorOffset'] = 0 query_path_info = CONST::SMB_QUERY_FILE_BASIC_INFO_HDR.make_struct query_path_info.v['loCreationTime'] = lo query_path_info.v['hiCreationTime'] = hi query_path_info.v['loLastAccessTime'] = lo query_path_info.v['hiLastAccessTime'] = hi query_path_info.v['loLastWriteTime'] = lo query_path_info.v['hiLastWriteTime'] = hi query_path_info.v['loLastChangeTime'] = lo query_path_info.v['hiLastChangeTime'] = hi query_path_info.v['ExtFileAttributes'] = file_attributes send_trans2_res(c, trans2_params, query_path_info) end |
#send_info_network_res(c, opts = {}) ⇒ Integer
Builds and sends an TRANS2_QUERY_PATH_INFORMATION response with SMB_QUERY_FILE_NETWORK_INFO information level.
188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 188 def send_info_network_res(c, opts= {}) allocation_size = opts[:allocation_size] || 0 end_of_file = opts[:end_of_file] || 0 file_attributes = opts[:file_attributes] || 0 pkt = CONST::SMB_TRANS_RES_PKT.make_struct smb_set_defaults(c, pkt) trans2_params = CONST::SMB_TRANS2_QUERY_PATH_INFORMATION_RES_PARAMETERS.make_struct trans2_params.v['EaErrorOffset'] = 0 query_path_info = CONST::SMB_QUERY_FILE_NETWORK_INFO_HDR.make_struct query_path_info.v['loCreationTime'] = lo query_path_info.v['hiCreationTime'] = hi query_path_info.v['loLastAccessTime'] = lo query_path_info.v['hiLastAccessTime'] = hi query_path_info.v['loLastWriteTime'] = lo query_path_info.v['hiLastWriteTime'] = hi query_path_info.v['loLastChangeTime'] = lo query_path_info.v['hiLastChangeTime'] = hi query_path_info.v['AllocationSize'] = allocation_size query_path_info.v['EndOfFile'] = end_of_file query_path_info.v['ExtFileAttributes'] = file_attributes send_trans2_res(c, trans2_params, query_path_info) end |
#send_info_standard_res(c, opts = {}) ⇒ Integer
Builds and sends an TRANS2_QUERY_PATH_INFORMATION response with SMB_QUERY_FILE_STANDARD_INFO information level.
159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 159 def send_info_standard_res(c, opts = {}) allocation_size = opts[:allocation_size] || 0 number_links = opts[:number_links] || 0 delete_pending = opts[:delete_pending] || 0 directory = opts[:directory] || 0 end_of_file = opts[:end_of_file] || 0 trans2_params = CONST::SMB_TRANS2_QUERY_PATH_INFORMATION_RES_PARAMETERS.make_struct trans2_params.v['EaErrorOffset'] = 0 query_path_info = CONST::SMB_QUERY_FILE_STANDARD_INFO_HDR.make_struct query_path_info.v['AllocationSize'] = allocation_size query_path_info.v['EndOfFile'] = end_of_file query_path_info.v['NumberOfLinks'] = number_links query_path_info.v['DeletePending'] = delete_pending query_path_info.v['Directory'] = directory send_trans2_res(c, trans2_params, query_path_info) end |
#smb_cmd_trans_query_file_info_basic(c, fid) ⇒ Integer
Handles a TRANS2_QUERY_FILE_INFORMATION transaction request with SMB_QUERY_FILE_BASIC_INFO Information Level.
15 16 17 18 19 20 21 22 23 24 25 26 27 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 15 def smb_cmd_trans_query_file_info_basic(c, fid) smb = @state[c] if fid == smb[:file_id].to_i attrib = CONST::SMB_EXT_FILE_ATTR_NORMAL elsif fid.nil? || fid == 0 || fid == smb[:dir_id].to_i # empty fid attrib = CONST::SMB_EXT_FILE_ATTR_DIRECTORY else return smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_OBJECT_NAME_NOT_FOUND, true) end send_info_basic_res(c, { file_attributes: attrib }) end |
#smb_cmd_trans_query_file_info_standard(c, fid) ⇒ Integer
Handles a TRANS2_QUERY_FILE_INFORMATION transaction request with SMB_QUERY_FILE_STANDARD_INFO Information Level.
35 36 37 38 39 40 41 42 43 44 45 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 35 def smb_cmd_trans_query_file_info_standard(c, fid) contents = get_file_contents(client: c) send_info_standard_res(c, { allocation_size: 1048576, number_links: 1, delete_pending: 0, directory: 0, end_of_file: contents.length }) end |
#smb_cmd_trans_query_path_info_basic(c, path) ⇒ Integer
Handles a TRANS2_QUERY_PATH_INFORMATION transaction request with SMB_QUERY_FILE_BASIC_INFO Information Level.
53 54 55 56 57 58 59 60 61 62 63 64 65 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 53 def smb_cmd_trans_query_path_info_basic(c, path) if path && path.ends_with?(file_name.downcase) attrib = CONST::SMB_EXT_FILE_ATTR_NORMAL elsif path && folder_name && path.ends_with?(folder_name.downcase) attrib = CONST::SMB_EXT_FILE_ATTR_DIRECTORY elsif path.nil? || path.empty? || path == "\x00" || path == "\\" # empty path attrib = CONST::SMB_EXT_FILE_ATTR_DIRECTORY else return smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_OBJECT_NAME_NOT_FOUND, true) end send_info_basic_res(c, { file_attributes: attrib }) end |
#smb_cmd_trans_query_path_info_network(c, path) ⇒ Integer
Handles a TRANS2_QUERY_PATH_INFORMATION transaction request with SMB_QUERY_FILE_NETWORK_INFO Information Level.
101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 101 def smb_cmd_trans_query_path_info_network(c, path) contents = get_file_contents(client: c) if path && path.include?(file_name.downcase) attrib = CONST::SMB_EXT_FILE_ATTR_NORMAL elsif path && folder_name && path.ends_with?(folder_name.downcase) attrib = CONST::SMB_EXT_FILE_ATTR_DIRECTORY elsif path.nil? || path.empty? || path == "\x00" || path == "\\" # empty path attrib = CONST::SMB_EXT_FILE_ATTR_DIRECTORY else return smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_OBJECT_NAME_NOT_FOUND, true) end send_info_network_res(c, { allocation_size: 1048576, end_of_file: contents.length, file_attributes: attrib }) end |
#smb_cmd_trans_query_path_info_standard(c, path) ⇒ Integer
Handles a TRANS2_QUERY_PATH_INFORMATION transaction request with SMB_QUERY_FILE_STANDARD_INFO Information Level.
73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 |
# File 'lib/msf/core/exploit/remote/smb/server/share/information_level/query.rb', line 73 def smb_cmd_trans_query_path_info_standard(c, path) contents = get_file_contents(client: c) if path && path.include?(file_name.downcase) attrib = 0 # File attributes => file elsif path && folder_name && path.ends_with?(folder_name.downcase) attrib = 1 # File attributes => directory elsif path.nil? || path.empty? || path == "\x00" || path == "\\" # empty path attrib = 1 # File attributes => directory else return smb_error(CONST::SMB_COM_TRANSACTION2, c, CONST::SMB_STATUS_OBJECT_NAME_NOT_FOUND, true) end send_info_standard_res(c, { allocation_size: 1048576, number_links: 1, delete_pending: 0, directory: attrib, end_of_file: contents.length }) end |