Module: Msf::Exploit::Remote::SMBServer

Includes:
NTLM, TcpServer
Defined in:
lib/msf/core/exploit/smb.rb

Overview

This mixin provides a minimal SMB server

Constant Summary collapse

CONST =
::Rex::Proto::SMB::Constants
CRYPT =
::Rex::Proto::SMB::Crypt
UTILS =
::Rex::Proto::SMB::Utils
XCEPT =
::Rex::Proto::SMB::Exceptions
EVADE =
::Rex::Proto::SMB::Evasions

Constants included from NTLM

NTLM::NTLM_BASE, NTLM::NTLM_CONST, NTLM::NTLM_CRYPT, NTLM::NTLM_MESSAGE, NTLM::NTLM_UTILS

Instance Method Summary collapse

Methods included from TcpServer

#cleanup, #exploit, #primer, #regenerate_payload, #srvhost, #srvport, #ssl, #ssl_cert, #ssl_compression, #start_service, #stop_service

Instance Method Details

#initialize(info = {}) ⇒ Object


694
695
696
697
698
699
700
701
# File 'lib/msf/core/exploit/smb.rb', line 694

def initialize(info = {})
  super

  register_options(
    [
      OptPort.new('SRVPORT',    [ true, "The local port to listen on.", 445 ])
    ], self.class)
end

#on_client_close(client) ⇒ Object


719
720
721
# File 'lib/msf/core/exploit/smb.rb', line 719

def on_client_close(client)
  smb_stop(client)
end

#on_client_connect(client) ⇒ Object


708
709
710
711
# File 'lib/msf/core/exploit/smb.rb', line 708

def on_client_connect(client)
  # print_status("New SMB connection from #{client.peerhost}:#{client.peerport}")
  smb_conn(client)
end

#on_client_data(client) ⇒ Object


713
714
715
716
717
# File 'lib/msf/core/exploit/smb.rb', line 713

def on_client_data(client)
  # print_status("New data from #{client.peerhost}:#{client.peerport}")
  smb_recv(client)
  true
end

#setupObject


703
704
705
706
# File 'lib/msf/core/exploit/smb.rb', line 703

def setup
  super
  @state = {}
end

#smb_cmd_dispatch(cmd, c, buff) ⇒ Object


794
795
796
797
# File 'lib/msf/core/exploit/smb.rb', line 794

def smb_cmd_dispatch(cmd, c, buff)
  smb = @state[c]
  print_status("Received command #{cmd} from #{smb[:name]}")
end

#smb_conn(c) ⇒ Object


723
724
725
# File 'lib/msf/core/exploit/smb.rb', line 723

def smb_conn(c)
  @state[c] = {:name => "#{c.peerhost}:#{c.peerport}", :ip => c.peerhost, :port => c.peerport}
end

#smb_error(cmd, c, errorclass, esn = false) ⇒ Object


807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
# File 'lib/msf/core/exploit/smb.rb', line 807

def smb_error(cmd, c, errorclass, esn = false)
  # 0xc0000022 = Deny
  # 0xc000006D = Logon_Failure
  # 0x00000000 = Ignore
  pkt = CONST::SMB_BASE_PKT.make_struct
  smb_set_defaults(c, pkt)
  pkt['Payload']['SMB'].v['Command'] = cmd
  pkt['Payload']['SMB'].v['Flags1']  = 0x88
  if esn
    pkt['Payload']['SMB'].v['Flags2']  = 0xc801
  else
    pkt['Payload']['SMB'].v['Flags2']  = 0xc001
  end
  pkt['Payload']['SMB'].v['ErrorClass'] = errorclass
  c.put(pkt.to_s)
end

#smb_recv(c) ⇒ Object


731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
# File 'lib/msf/core/exploit/smb.rb', line 731

def smb_recv(c)
  smb = @state[c]
  smb[:data] ||= ''
  smb[:data] << c.get_once

  while(smb[:data].length > 0)

    return if smb[:data].length < 4

    plen = smb[:data][2,2].unpack('n')[0]

    return if smb[:data].length < plen+4

    buff = smb[:data].slice!(0, plen+4)

    pkt_nbs = CONST::NBRAW_PKT.make_struct
    pkt_nbs.from_s(buff)

    # print_status("NetBIOS request from #{smb[:name]} #{pkt_nbs.v['Type']} #{pkt_nbs.v['Flags']} #{buff.inspect}")

    # Check for a NetBIOS name request
    if (pkt_nbs.v['Type'] == 0x81)
      # Accept any name they happen to send

      host_dst = UTILS.nbname_decode(pkt_nbs.v['Payload'][1,32]).gsub(/[\x00\x20]+$/n, '')
      host_src = UTILS.nbname_decode(pkt_nbs.v['Payload'][35,32]).gsub(/[\x00\x20]+$/n, '')

      smb[:nbdst] = host_dst
      smb[:nbsrc] = host_src

      # print_status("NetBIOS session request from #{smb[:name]} (asking for #{host_dst} from #{host_src})")
      c.write("\x82\x00\x00\x00")
      next
    end


    #
    # TODO: Support AndX parameters
    #


    # Cast this to a generic SMB structure
    pkt = CONST::SMB_BASE_PKT.make_struct
    pkt.from_s(buff)

    # Only response to requests, ignore server replies
    if (pkt['Payload']['SMB'].v['Flags1'] & 128 != 0)
      print_status("Ignoring server response from #{smb[:name]}")
      next
    end

    cmd = pkt['Payload']['SMB'].v['Command']
    begin
      smb_cmd_dispatch(cmd, c, buff)
    rescue ::Interrupt
      raise $!
    rescue ::Exception => e
      print_status("Error processing request from #{smb[:name]} (#{cmd}): #{e.class} #{e} #{e.backtrace}")
      next
    end
  end
end

#smb_set_defaults(c, pkt) ⇒ Object


799
800
801
802
803
804
805
# File 'lib/msf/core/exploit/smb.rb', line 799

def smb_set_defaults(c, pkt)
  smb = @state[c]
  pkt['Payload']['SMB'].v['ProcessID'] = smb[:process_id].to_i
  pkt['Payload']['SMB'].v['UserID'] = smb[:user_id].to_i
  pkt['Payload']['SMB'].v['TreeID'] = smb[:tree_id].to_i
  pkt['Payload']['SMB'].v['MultiplexID'] = smb[:multiplex_id].to_i
end

#smb_stop(c) ⇒ Object


727
728
729
# File 'lib/msf/core/exploit/smb.rb', line 727

def smb_stop(c)
  @state.delete(c)
end