librex 0.0.17 → 0.0.18

data/lib/rex/proto/smb/simpleclient.rb

@@ -1,306 +0,0 @@
-module Rex
-module Proto
-module SMB
-class SimpleClient
-
-require 'rex/text'
-require 'rex/struct2'
-require 'rex/proto/smb/constants'
-require 'rex/proto/smb/exceptions'
-require 'rex/proto/smb/evasions'
-require 'rex/proto/smb/crypt'
-require 'rex/proto/smb/utils'
-require 'rex/proto/smb/client'
-
-# Some short-hand class aliases
-CONST = Rex::Proto::SMB::Constants
-CRYPT = Rex::Proto::SMB::Crypt
-UTILS = Rex::Proto::SMB::Utils
-XCEPT = Rex::Proto::SMB::Exceptions
-EVADE = Rex::Proto::SMB::Evasions
-
-
-	class OpenFile
-		attr_accessor	:name, :tree_id, :file_id, :mode, :client, :chunk_size
-		
-		def initialize(client, name, tree_id, file_id)
-			self.client = client
-			self.name = name
-			self.tree_id = tree_id
-			self.file_id = file_id
-			self.chunk_size = 48000
-		end
-		
-		def delete
-			begin
-				self.close
-			rescue
-			end
-			self.client.delete(self.name, self.tree_id)
-		end
-		
-		# Close this open file
-		def close
-			self.client.close(self.file_id, self.tree_id)
-		end
-		
-		# Read data from the file
-		def read(length = nil, offset = 0)	
-			if (length == nil)
-				data = ''
-				fptr = offset
-				ok = self.client.read(self.file_id, fptr, self.chunk_size)
-				while (ok and ok['Payload'].v['DataLenLow'] > 0)
-					buff = ok.to_s.slice(
-						ok['Payload'].v['DataOffset'] + 4,
-						ok['Payload'].v['DataLenLow']
-					)
-					data << buff
-					if ok['Payload'].v['Remaining'] == 0
-						break
-					end
-					fptr += ok['Payload'].v['DataLenLow']
-					
-					begin
-						ok = self.client.read(self.file_id, fptr, self.chunk_size)
-					rescue XCEPT::ErrorCode => e
-						case e.error_code					
-						when 0x00050001
-							# Novell fires off an access denied error on EOF
-							ok = nil
-						else
-							raise e
-						end
-					end
-				end
-
-				return data
-			else
-				ok = self.client.read(self.file_id, offset, length)
-				data = ok.to_s.slice(
-					ok['Payload'].v['DataOffset'] + 4,
-					ok['Payload'].v['DataLenLow']
-				)
-				return data
-			end
-		end
-
-		def << (data)
-			self.write(data)
-		end
-
-		# Write data to the file
-		def write(data, offset = 0)	
-			# Track our offset into the remote file
-			fptr = offset
-			
-			# Duplicate the data so we can use slice!
-			data = data.dup
-			
-			# Take our first chunk of bytes
-			chunk = data.slice!(0, self.chunk_size)
-			
-			# Keep writing data until we run out
-			while (chunk.length > 0)
-				ok = self.client.write(self.file_id, fptr, chunk)
-				cl = ok['Payload'].v['CountLow']
-				
-				# Partial write, push the failed data back into the queue
-				if (cl != chunk.length)
-					data = chunk.slice(cl - 1, chunk.length - cl) + data
-				end
-				
-				# Increment our painter and grab the next chunk
-				fptr += cl
-				chunk = data.slice!(0, self.chunk_size)
-			end
-		end
-	end
-	
-	class OpenPipe < OpenFile
-		
-		# Valid modes are: 'trans' and 'rw'
-		attr_accessor :mode
-		
-		def initialize(*args)
-			super(*args)
-			self.mode = 'rw'
-			@buff = ''
-		end
-		
-		def read_buffer(length, offset=0)
-			length ||= @buff.length
-			@buff.slice!(0, length)
-		end
-		
-		def read(length = nil, offset = 0)
-			case self.mode
-			when 'trans'
-				read_buffer(length, offset)
-			when 'rw'
-				super(length, offset)
-			else
-				raise ArgumentError
-			end
-		end
-		
-		def write(data, offset = 0)
-			case self.mode
-			
-			when 'trans'
-				write_trans(data, offset)
-			when 'rw'
-				super(data, offset)
-			else
-				raise ArgumentError
-			end
-		end
-		
-		def write_trans(data, offset=0)
-			ack = self.client.trans_named_pipe(self.file_id, data)
-			doff = ack['Payload'].v['DataOffset']
-			dlen = ack['Payload'].v['DataCount']
-			@buff << ack.to_s[4+doff, dlen]
-		end
-	end
-	
-
-# Public accessors
-attr_accessor	:last_error
-
-# Private accessors
-attr_accessor	:socket, :client, :direct, :shares, :last_share
-
-	# Pass the socket object and a boolean indicating whether the socket is netbios or cifs
-	def initialize(socket, direct = false)
-		self.socket = socket
-		self.direct = direct
-		self.client = Rex::Proto::SMB::Client.new(socket)
-		self.shares = { }
-	end
-	
-	def login(	name = '', user = '', pass = '', domain = '',
-			verify_signature = false, usentlmv2 = false, usentlm2_session = true, 
-			send_lm = true, use_lanman_key = false, send_ntlm = true,
-			native_os = 'Windows 2000 2195', native_lm = 'Windows 2000 5.0', spnopt = {})
-
-		begin
-			
-			if (self.direct != true)
-				self.client.session_request(name)
-			end
-			self.client.native_os = native_os 
-			self.client.native_lm = native_lm
-			self.client.verify_signature = verify_signature
-			self.client.use_ntlmv2 = usentlmv2
-			self.client.usentlm2_session = usentlm2_session
-			self.client.send_lm = send_lm
-			self.client.use_lanman_key =  use_lanman_key
-			self.client.send_ntlm = send_ntlm 
-			self.client.negotiate
-			self.client.spnopt = spnopt
-
-			ok = self.client.session_setup(user, pass, domain)
-		rescue ::Interrupt
-			raise $!
-		rescue ::Exception => e
-			n = XCEPT::LoginError.new
-			n.source = e
-			if(e.respond_to?('error_code'))
-				n.error_code   = e.error_code
-				n.error_reason = e.get_error(e.error_code)
-			end
-			raise n
-		end
-		
-		return true
-	end
-
-
-	def login_split_start_ntlm1(name = '')
-
-		begin
-			
-			if (self.direct != true)
-				self.client.session_request(name)
-			end
-			
-			# Disable extended security
-			self.client.negotiate(false)
-		rescue ::Interrupt
-			raise $!
-		rescue ::Exception => e
-			n = XCEPT::LoginError.new
-			n.source = e
-			if(e.respond_to?('error_code'))
-				n.error_code   = e.error_code
-				n.error_reason = e.get_error(e.error_code)
-			end
-			raise n
-		end
-		
-		return true
-	end
-	
-	
-	def login_split_next_ntlm1(user, domain, hash_lm, hash_nt)
-		begin
-			ok = self.client.session_setup_no_ntlmssp_prehash(user, domain, hash_lm, hash_nt)
-		rescue ::Interrupt
-			raise $!
-		rescue ::Exception => e
-			n = XCEPT::LoginError.new
-			n.source = e
-			if(e.respond_to?('error_code'))
-				n.error_code   = e.error_code
-				n.error_reason = e.get_error(e.error_code)
-			end
-			raise n
-		end
-		
-		return true			
-	end
-		
-	def connect(share)
-		ok = self.client.tree_connect(share)
-		tree_id = ok['Payload']['SMB'].v['TreeID']
-		self.shares[share] = tree_id
-		self.last_share = share
-	end
-	
-	def disconnect(share)
-		ok = self.client.tree_disconnect(self.shares[share])
-		self.shares.delete(share)
-	end	
-	
-
-	def open(path, perm, chunk_size = 48000)		
-		mode   = UTILS.open_mode_to_mode(perm)
-		access = UTILS.open_mode_to_access(perm)
-		
-		ok = self.client.open(path, mode, access)
-		file_id = ok['Payload'].v['FileID']
-		fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
-		fh.chunk_size = chunk_size
-		fh
-	end
-	
-	def delete(*args)
-		self.client.delete(*args)
-	end
-
-	def create_pipe(path, perm = 'c')
-		disposition = UTILS.create_mode_to_disposition(perm)
-		ok = self.client.create_pipe(path, disposition)
-		file_id = ok['Payload'].v['FileID']	
-		fh = OpenPipe.new(self.client, path, self.client.last_tree_id, file_id)
-	end
-
-	def trans_pipe(fid, data, no_response = nil)
-		client.trans_named_pipe(fid, data, no_response)
-	end
-	
-end
-end
-end
-end

data/lib/rex/proto/smb/simpleclient.rb.ut.rb

@@ -1,128 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
-
-require 'rex/test'
-require 'rex/proto/smb'
-require 'rex/proto/dcerpc'
-require 'rex/socket'
-
-class Rex::Proto::SMB::SimpleClient::UnitTest < Test::Unit::TestCase
-
-	Klass = Rex::Proto::SMB::SimpleClient
-
-	# Alias over the Rex DCERPC protocol modules
-	DCERPCPacket   = Rex::Proto::DCERPC::Packet
-	DCERPCClient   = Rex::Proto::DCERPC::Client
-	DCERPCResponse = Rex::Proto::DCERPC::Response
-	DCERPCUUID     = Rex::Proto::DCERPC::UUID
-	XCEPT          = Rex::Proto::SMB::Exceptions
-
-	FILE_CREATE = 0x10
-	FILE_TRUNC  = 0x02
-	FILE_OPEN   = 0x01
-
-
-	def test_smb_open_share
-		user = 'SMBTest'
-		pass = 'SMBTest'
-		share = 'C$'
-
-		write_data = ('A' * (1024 * 8))
-		filename = 'smb_tester.txt'
-		begin
-		Timeout.timeout($_REX_TEST_TIMEOUT) {
-		s = Rex::Socket.create_tcp(
-			'PeerHost' => $_REX_TEST_SMB_HOST,
-			'PeerPort' => 445
-		)
-
-		c = Klass.new(s, true)
-
-		begin
-	        c.login('*SMBSERVER', user, pass)
-		rescue XCEPT::LoginError
-			flunk('login failure')
-		end
-
-		c.connect(share)
-
-		f = c.open(filename, 'rwct')
-	    f << write_data
-		f.close
-
-		f = c.open(filename, 'ro')
-	    d = f.read()
-	    f.close
-
-		c.delete(filename)
-		c.disconnect(share)
-
-		s.close
-		}
-		rescue Timeout::Error
-			flunk('timeout')
-		end
-	end
-
-	def test_smb_dcerpc
-		begin
-		Timeout.timeout($_REX_TEST_TIMEOUT) {
-		s = Rex::Socket.create_tcp(
-			'PeerHost' => $_REX_TEST_SMB_HOST,
-			'PeerPort' => 445
-		)
-
-		c = Klass.new(s, true)
-
-		user = ''
-		pass = ''
-
-		begin
-			c.login('*SMBSERVER', user, pass)
-		rescue XCEPT::LoginError
-			flunk('login failure')
-		end
-
-		c.connect('IPC$')
-		f = c.create_pipe('\BROWSER')
-
-		bind, ctx = DCERPCPacket.make_bind_fake_multi(
-			'4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0',
-			10,
-			4
-		)
-
-		# Evasion techniques:
-		# 	1) Write the bind out a few bytes at a time with a random offset
-		#	2) Read the response back a few bytes at a time with a random offset
-
-		# Write the bind request out in random chunk sizes
-		while (bind.length > 0)
-		    f.write( bind.slice!(0, (rand(20)+5)), rand(1024)+1 )
-		end
-
-		d = ''
-		# Read the response back a few bytes a time
-		begin
-		    while(true)
-			    t = (f.read((rand(20)+5), rand(1024)+1))
-				last if ! t.length
-				d << t
-			end
-		rescue XCEPT::NoReply
-		end
-
-		r = DCERPCResponse.new(d)
-		assert_equal(r.type, 12)
-		assert_equal(r.ack_result[ctx-0], 0)
-		assert_equal(r.ack_result[ctx-1], 2)
-
-		s.close
-		}
-		rescue Timeout::Error
-			flunk('timeout')
-		end
-	end
-end
-

data/lib/rex/proto/smb/utils.rb

@@ -1,103 +0,0 @@
-require 'rex/text'
-require 'rex/proto/smb/constants'
-
-module Rex
-module Proto
-module SMB
-class Utils
-
-CONST = Rex::Proto::SMB::Constants
-
-	# Creates an access mask for use with the CLIENT.open() call based on a string
-	def self.open_mode_to_access(str)
-		access = CONST::OPEN_ACCESS_READ | CONST::OPEN_SHARE_DENY_NONE
-		str.each_byte { |c|
-			case [c].pack('C').downcase
-				when 'w'
-					access |= CONST::OPEN_ACCESS_READWRITE
-			end
-		}
-		return access
-	end
-	
-	# Creates a mode mask for use with the CLIENT.open() call based on a string
-	def self.open_mode_to_mode(str)
-		mode = 0
-		
-		str.each_byte { |c|
-			case [c].pack('C').downcase
-				when 'x' # Fail if the file already exists
-					mode |= CONST::OPEN_MODE_EXCL
-				when 't' # Truncate the file if it already exists
-					mode |= CONST::OPEN_MODE_TRUNC
-				when 'c' # Create the file if it does not exist
-					mode |= CONST::OPEN_MODE_CREAT	
-				when 'o' # Just open the file, clashes with x
-					mode |= CONST::OPEN_MODE_OPEN
-			end
-		}
-
-		return mode
-	end
-	
-	# Returns a disposition value for smb.create based on permission string
-	def self.create_mode_to_disposition(str)
-		str.each_byte { |c|
-			case [c].pack('C').downcase
-				when 'c' # Create the file if it does not exist
-					return CONST::CREATE_ACCESS_OPENCREATE
-				when 'o' # Just open the file and fail if it does not exist
-					return CONST::CREATE_ACCESS_EXIST
-			end
-		}
-
-		return CONST::CREATE_ACCESS_OPENCREATE
-	end
-
-	# NOTE: the difference below came from: Time.utc("1970-1-1") - Time.utc("1601-1-1")
-
-	# Convert a 64-bit signed SMB time to a unix timestamp
-	def self.time_smb_to_unix(thi, tlo)
-		(((thi << 32) + tlo) / 10000000) - 11644473600
-	end
-
-	# Convert a unix timestamp to a 64-bit signed server time
-	def self.time_unix_to_smb(unix_time)
-		t64 = (unix_time + 11644473600) * 10000000
-		thi = (t64 & 0xffffffff00000000) >> 32
-		tlo = (t64 & 0x00000000ffffffff)
-		return [thi, tlo]
-	end
-
-	# Convert a name to its NetBIOS equivalent
-	def self.nbname_encode(str)
-		encoded = ''
-		for x in (0..15)
-			if (x >= str.length)
-				encoded << 'CA'
-			else
-				c = str[x, 1].upcase[0,1].unpack('C*')[0]
-				encoded << [ (c / 16) + 0x41, (c % 16) + 0x41 ].pack('CC')
-			end
-		end
-		return encoded
-	end
-	
-	# Convert a name from its NetBIOS equivalent
-	def self.nbname_decode(str)
-		decoded = ''
-		str << 'A' if str.length % 2 != 0
-		while (str.length > 0)
-			two = str.slice!(0, 2).unpack('C*')
-			if (two.length == 2)
-				decoded << [ ((two[0] - 0x41) * 16) + two[1] - 0x41 ].pack('C')
-			end
-		end
-		return decoded
-	end
-
-
-end
-end
-end
-end