librex 0.0.6 → 0.0.7

data/lib/rex/proto/smb/client.rb.ut.rb

@@ -50,7 +50,7 @@ class Rex::Proto::SMB::Client::UnitTest < Test::Unit::TestCase
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 
 		# puts "[*] Authenticating with NTLMv2..."
-		ok = c.session_setup_ntlmv2($_REX_TEXT_SMB_USER, $_REX_TEXT_SMB_PASS)
+		ok = c.session_setup_with_ntlmssp($_REX_TEXT_SMB_USER, $_REX_TEXT_SMB_PASS)
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 		assert_not_equal(c.auth_user_id, 0)
 
@@ -122,7 +122,7 @@ class Rex::Proto::SMB::Client::UnitTest < Test::Unit::TestCase
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 
 		# puts "[*] Authenticating with NTLMv2..."
-		ok = c.session_setup_ntlmv2($_REX_TEXT_SMB_USER, $_REX_TEXT_SMB_PASS)
+		ok = c.session_setup_with_ntlmssp($_REX_TEXT_SMB_USER, $_REX_TEXT_SMB_PASS)
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 		assert_not_equal(c.auth_user_id, 0)
 
@@ -171,11 +171,11 @@ class Rex::Proto::SMB::Client::UnitTest < Test::Unit::TestCase
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 
 		# puts "[*] Authenticating with NTLMv2..."
-		ok = c.session_setup_ntlmv2
+		ok = c.session_setup_with_ntlmssp
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 
 		# puts "[*] Authenticating with NTLMv1..."
-		ok = c.session_setup_ntlmv1
+		ok = c.session_setup_no_ntlmssp
 		assert_kind_of(Rex::Struct2::CStruct, ok)
 
 		# puts "[*] Authenticating with clear text passwords..."

data/lib/rex/proto/smb/constants.rb

@@ -263,7 +263,11 @@ FILE_VOLUME_IS_COMPRESSED = 0x00008000
 
 
 # SMB Error Codes
-SMB_ERROR_BUFFER_OVERFLOW = 0x80000005
+SMB_STATUS_SUCCESS =			0x00000000
+SMB_ERROR_BUFFER_OVERFLOW =		0x80000005
+SMB_STATUS_MORE_PROCESSING_REQUIRED =	0xC0000016 
+SMB_STATUS_ACCESS_DENIED =		0xC0000022
+SMB_STATUS_LOGON_FAILURE =		0xC000006D
 
 # SMB Dialect Compatibility
 DIALECT = {}
@@ -548,7 +552,7 @@ SMB_SETUP_NTLMV1_HDR_PKT = Rex::Struct2::CStructTemplate.new(
 SMB_SETUP_NTLMV1_PKT = self.make_nbs(SMB_SETUP_NTLMV1_HDR_PKT)
 
 
-# A SMB template for SMB Session Setup requests (NTLMV2)
+# A SMB template for SMB Session Setup requests (When extended security is being used)
 SMB_SETUP_NTLMV2_HDR_PKT = Rex::Struct2::CStructTemplate.new(
 	[ 'template', 'SMB',                 SMB_HDR ],
 	[ 'uint8',   'AndX',                 0 ],
@@ -569,7 +573,7 @@ SMB_SETUP_NTLMV2_HDR_PKT = Rex::Struct2::CStructTemplate.new(
 SMB_SETUP_NTLMV2_PKT = self.make_nbs(SMB_SETUP_NTLMV2_HDR_PKT)
 
 
-# A SMB template for SMB Session Setup responses (NTLMV2)
+# A SMB template for SMB Session Setup responses (When extended security is being used)
 SMB_SETUP_NTLMV2_RES_HDR_PKT = Rex::Struct2::CStructTemplate.new(
 	[ 'template', 'SMB',                 SMB_HDR ],
 	[ 'uint8',   'AndX',                 0 ],
@@ -1035,27 +1039,6 @@ SMB_SEARCH_HDR_PKT = Rex::Struct2::CStructTemplate.new(
 )
 SMB_SEARCH_PKT = self.make_nbs(SMB_SEARCH_HDR_PKT)
 
-# NTLMSSP Message Flags
-NEGOTIATE_UNICODE     = 0x00000001  # Only set if Type 1 contains it - this or oem, not both
-NEGOTIATE_OEM         = 0x00000002  # Only set if Type 1 contains it - this or unicode, not both
-REQUEST_TARGET        = 0x00000004  # If set in Type 1, must return domain or server
-NEGOTIATE_SIGN        = 0x00000010  # Session signature required
-NEGOTIATE_SEAL        = 0x00000020  # Session seal required
-NEGOTIATE_LMKEY       = 0x00000080  # LM Session Key should be used for signing and sealing
-NEGOTIATE_NTLM        = 0x00000200  # NTLM auth is supported
-NEGOTIATE_ANONYMOUS   = 0x00000800  # Anonymous context used
-NEGOTIATE_DOMAIN      = 0x00001000  # Sent in Type1, client gives domain info
-NEGOTIATE_WORKSTATION = 0x00002000  # Sent in Type1, client gives workstation info
-NEGOTIATE_LOCAL_CALL  = 0x00004000  # Server and client are on same machine
-NEGOTIATE_ALWAYS_SIGN = 0x00008000  # Add signatures to packets
-TARGET_TYPE_DOMAIN    = 0x00010000  # If REQUEST_TARGET, we're adding the domain name
-TARGET_TYPE_SERVER    = 0x00020000  # If REQUEST_TARGET, we're adding the server name
-TARGET_TYPE_SHARE     = 0x00040000  # Supposed to denote "a share" but for a webserver?
-NEGOTIATE_NTLM2_KEY   = 0x00080000  # NTLMv2 Signature and Key exchanges
-NEGOTIATE_TARGET_INFO = 0x00800000  # Server set when sending Target Information Block
-NEGOTIATE_128         = 0x20000000  # 128-bit encryption supported
-NEGOTIATE_KEY_EXCH    = 0x40000000  # Client will supply encrypted master key in Session Key field of Type3 msg
-NEGOTIATE_56          = 0x80000000  # 56-bit encryption supported
 
 end
 end

data/lib/rex/proto/smb/crypt.rb

@@ -12,82 +12,23 @@ class Crypt
 		@@loaded_openssl = true
 	rescue ::Exception
 	end
-	
-begin
-
-	def self.lanman_des(pass, chal)
-		e_p24( [ e_p16( [ pass.upcase()[0,14] ].pack('a14') ) ].pack('a21'), chal)
-	end
 
-	def self.e_p16(pass)
-		stat = "\x4b\x47\x53\x21\x40\x23\x24\x25"
-		des_hash(stat, pass[0,7]) << des_hash(stat, pass[7,7])
-	end
-
-	def self.e_p24(pass, chal)
-		des_hash(chal, pass[0,7]) << des_hash(chal, pass[7,7]) << des_hash(chal, pass[14,7])
-	end
-
-	def self.des_hash(data, ckey)
+	# Return a signed SMB packet
+	def self.sign_smb_packet(mackey, sequence_counter, data)
 		raise RuntimeError, "No OpenSSL support" if not @@loaded_openssl
-		cipher = OpenSSL::Cipher::Cipher.new('des-ecb')
-		cipher.encrypt
-		cipher.key = des_56_to_64(ckey)
-		cipher.update(data)
-	end
-
-	def self.des_56_to_64(ckey56s)
-		ckey64 = []
-		ckey56 = ckey56s.unpack('C*')
-		ckey64[0] = ckey56[0]
-		ckey64[1] = ((ckey56[0] << 7) & 0xFF) | (ckey56[1] >> 1)
-		ckey64[2] = ((ckey56[1] << 6) & 0xFF) | (ckey56[2] >> 2)
-		ckey64[3] = ((ckey56[2] << 5) & 0xFF) | (ckey56[3] >> 3)
-		ckey64[4] = ((ckey56[3] << 4) & 0xFF) | (ckey56[4] >> 4)
-		ckey64[5] = ((ckey56[4] << 3) & 0xFF) | (ckey56[5] >> 5)
-		ckey64[6] = ((ckey56[5] << 2) & 0xFF) | (ckey56[6] >> 6)
-		ckey64[7] =  (ckey56[6] << 1) & 0xFF
-		ckey64.pack('C*')
+		seq = Rex::Text::pack_int64le(sequence_counter)
+		netbios_hdr = data.slice!(0,4)
+		data[14,8] = seq 
+		signature = OpenSSL::Digest::MD5.digest(mackey + data)[0,8]
+		data[14,8] = signature
+		netbios_hdr + data
 	end
 
-	def self.ntlm_md4(pass, chal)
-		e_p24( [ md4_hash(Rex::Text.to_unicode(pass)) ].pack('a21'), chal)
+	def self.is_signature_correct?(mackey, sequence_counter, data)
+		signature1 = data[18,8]
+		signature2 = sign_smb_packet(mackey, sequence_counter, data.dup)[18,8]
+		return signature1 == signature2
 	end
-	
-	def self.md4_hash(data)
-		raise RuntimeError, "No OpenSSL support" if not @@loaded_openssl
-		digest = OpenSSL::Digest::MD4.digest(data)
-	end
-	
-	def self.md5_hash(data)
-		raise RuntimeError, "No OpenSSL support" if not @@loaded_openssl
-		digest = OpenSSL::Digest::MD5.digest(data)
-	end
-	
-	def self.lm2nt(pass, ntlm)
-		res = nil
-		Rex::Text.permute_case( pass.upcase ).each do |word|
-			if(md4_hash(Rex::Text.to_unicode(word)) == ntlm)
-				res = word
-				break
-			end
-		end
-		res
-	end
-
-	def self.lmchal2ntchal(pass, ntlm, challenge)
-		res = nil
-		Rex::Text.permute_case( pass.upcase ).each do |word|
-			if(ntlm_md4(word,challenge) == ntlm)
-				res = word
-				break
-			end
-		end
-		res
-	end
-
-rescue LoadError
-end
 
 end
 end

data/lib/rex/proto/smb/exceptions.rb

@@ -829,6 +829,18 @@ class NTLM2MissingChallenge < Error
 	end
 end
 
+class SigningError < Error
+	def to_s
+		"Unable to handle signing in this situation"
+	end
+end
+
+class IncorrectSigningError < Error
+	def to_s
+		"The signature sent by the server is not correct"
+	end
+end
+
 class SimpleClientError < Error
 	attr_accessor :source, :fatal
 end

data/lib/rex/proto/smb/simpleclient.rb

@@ -179,14 +179,24 @@ attr_accessor	:socket, :client, :direct, :shares, :last_share
 		self.shares = { }
 	end
 	
-	def login(name = '', user = '', pass = '', domain = '')
+	def login(	name = '', user = '', pass = '', domain = '',
+			verify_signature = false, usentlmv2 = false, usentlm2_session = true, 
+			send_lm = true, use_lanman_key = false, send_ntlm = true,
+			native_os = 'Windows 2000 2195', native_lm = 'Windows 2000 5.0')
 
 		begin
 			
 			if (self.direct != true)
 				self.client.session_request(name)
 			end
-		
+			self.client.native_os = native_os 
+			self.client.native_lm = native_lm
+			self.client.verify_signature = verify_signature
+			self.client.use_ntlmv2 = usentlmv2
+			self.client.usentlm2_session = usentlm2_session
+			self.client.send_lm = send_lm
+			self.client.use_lanman_key =  use_lanman_key
+			self.client.send_ntlm = send_ntlm 
 			self.client.negotiate
 			ok = self.client.session_setup(user, pass, domain)
 		rescue ::Interrupt
@@ -233,7 +243,7 @@ attr_accessor	:socket, :client, :direct, :shares, :last_share
 	
 	def login_split_next_ntlm1(user, domain, hash_lm, hash_nt)
 		begin
-			ok = self.client.session_setup_ntlmv1_prehash(user, domain, hash_lm, hash_nt)
+			ok = self.client.session_setup_no_ntlmssp_prehash(user, domain, hash_lm, hash_nt)
 		rescue ::Interrupt
 			raise $!
 		rescue ::Exception => e
@@ -261,14 +271,16 @@ attr_accessor	:socket, :client, :direct, :shares, :last_share
 		self.shares.delete(share)
 	end	
 	
-	def open(path, perm)		
+
+	def open(path, perm, chunk_size = 48000)		
 		mode   = UTILS.open_mode_to_mode(perm)
 		access = UTILS.open_mode_to_access(perm)
 		
 		ok = self.client.open(path, mode, access)
 		file_id = ok['Payload'].v['FileID']
-		
 		fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
+		fh.chunk_size = chunk_size
+		fh
 	end
 	
 	def delete(*args)

data/lib/rex/proto/smb/utils.rb

@@ -96,468 +96,11 @@ CONST = Rex::Proto::SMB::Constants
 		return decoded
 	end
 
-	#
-	# Prepends an ASN1 formatted length field to a piece of data
-	#
-	def self.asn1encode(str = '')
-		res = ''
-
-		# If the high bit of the first byte is 1, it contains the number of
-		# length bytes that follow
-
-		case str.length
-			when 0 .. 0x7F
-				res = [str.length].pack('C') + str
-			when 0x80 .. 0xFF
-				res = [0x81, str.length].pack('CC') + str
-			when 0x100 .. 0xFFFF
-				res = [0x82, str.length].pack('Cn') + str
-			when  0x10000 .. 0xffffff
-				res = [0x83, str.length >> 16, str.length & 0xFFFF].pack('CCn') + str
-			when  0x1000000 .. 0xffffffff
-				res = [0x84, str.length].pack('CN') + str
-			else
-				raise "ASN1 str too long"
-		end
-		return res
+	# Determine whether the password is a known hash format
+	def self.is_pass_ntlm_hash?(str)
+		str.downcase =~ /^[0-9a-f]{32}:[0-9a-f]{32}$/
 	end
-	
-	def self.make_ntlmv2_secblob_init(domain = 'WORKGROUP', name = 'WORKSTATION', flags=0x80201)
-		blob = 
-		"\x60" + self.asn1encode(		
-			"\x06" + self.asn1encode(
-				"\x2b\x06\x01\x05\x05\x02"
-			) +	
-			"\xa0" + self.asn1encode(
-				"\x30" + self.asn1encode(
-					"\xa0" + self.asn1encode(
-						"\x30" + self.asn1encode(
-							"\x06" + self.asn1encode(
-								"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"
-							)
-						)
-					) +
-					"\xa2" + self.asn1encode(
-						"\x04" + self.asn1encode(
-							"NTLMSSP\x00" +
-							[1, flags].pack('VV') +
-
-							[
-								domain.length,  #length
-								domain.length,  #max length
-								32
-							].pack('vvV') +
-
-							[
-								name.length,	#length
-								name.length, 	#max length
-								domain.length + 32
-							].pack('vvV') +	
-
-							domain + name
-						)
-					)
-				)
-			)
-		)
-
-		return blob	
-	end
-
-	def self.make_ntlmv2_secblob_auth(domain, name, user, lmv2, ntlm, flags = 0x080201)
-		
-		lmv2 ||= "\x00" * 24
-		ntlm ||= "\x00" * 24		
-	
-		domain_uni = Rex::Text.to_unicode(domain)
-		user_uni   = Rex::Text.to_unicode(user)
-		name_uni   = Rex::Text.to_unicode(name)
-		session    = ''
-		
-		ptr  = 64 
-		blob =
-			"\xa1" + self.asn1encode(
-				"\x30" + self.asn1encode(
-					"\xa2" + self.asn1encode(
-						"\x04" + self.asn1encode(
-					
-							"NTLMSSP\x00" +
-							[ 3 ].pack('V') +
-							
-							[	# Lan Manager Response
-								lmv2.length,
-								lmv2.length,
-								(ptr)
-							].pack('vvV') +
-							
-							[	# NTLM Manager Response
-								ntlm.length,
-								ntlm.length,
-								(ptr += lmv2.length)
-							].pack('vvV') +		
-									
-							[	# Domain Name
-								domain_uni.length,
-								domain_uni.length,
-								(ptr += ntlm.length)
-							].pack('vvV') +		
-			
-							[	# Username
-								user_uni.length,
-								user_uni.length,
-								(ptr += domain_uni.length)
-							].pack('vvV') +		
-			
-							[	# Hostname
-								name_uni.length,
-								name_uni.length,
-								(ptr += user_uni.length)
-							].pack('vvV') +		
-							
-							[	# Session Key (none)
-								session.length,
-								session.length,
-								(ptr += name_uni.length)
-							].pack('vvV') +		
-			
-							[ flags ].pack('V') +
-				
-							lmv2 +
-							ntlm +
-							domain_uni +
-							user_uni +
-							name_uni + 
-							session + "\x00"
-					)
-				)
-			)
-		)
-		return blob
-	end
-
-
-	def self.make_negotiate_secblob_resp(account, domain)
-		blob = 
-		"\x60" + self.asn1encode(		
-			"\x06" + self.asn1encode(
-				"\x2b\x06\x01\x05\x05\x02"
-			) +	
-			"\xa0" + self.asn1encode(
-				"\x30" + self.asn1encode(
-					"\xa0" + self.asn1encode(
-						"\x30" + self.asn1encode(
-							"\x06" + self.asn1encode(
-								"\x2a\x86\x48\x82\xf7\x12\x01\x02\x02"
-							) +
-							"\x06" + self.asn1encode(
-								"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"
-							) +
-							"\x06" + self.asn1encode(
-								"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03"
-							) +	
-							"\x06" + self.asn1encode(
-								"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"
-							)																						
-						)
-					) +
-					"\xa3" + self.asn1encode(
-						"\x30" + self.asn1encode(
-							"\xa0" + self.asn1encode(
-								"\x1b" + self.asn1encode(
-									account + '@' + domain
-								)
-							)
-						)
-					)
-				)
-			)
-		)
 
-		return blob	
-	end	
-
-	def self.make_ntlmv2_secblob_chall(win_domain, dns_domain, win_name, dns_name, chall, flags)
-		
-		win_domain = Rex::Text.to_unicode(win_domain)
-		dns_domain = Rex::Text.to_unicode(dns_domain)
-		win_name = Rex::Text.to_unicode(win_name)
-		dns_name = Rex::Text.to_unicode(dns_name)
-		
-		addr_list  = ''
-		addr_list  << [2, win_domain.length].pack('vv') + win_domain
-		addr_list  << [1, win_name.length].pack('vv') + win_name
-		addr_list  << [4, dns_domain.length].pack('vv') + dns_domain
-		addr_list  << [3, dns_name.length].pack('vv') + dns_name
-		addr_list  << [5, dns_domain.length].pack('vv') + dns_domain
-		addr_list  << [0, 0].pack('vv')
-
-		ptr  = 0 
-		blob =
-			"\xa1" + self.asn1encode(
-				"\x30" + self.asn1encode(
-					"\xa0" + self.asn1encode(
-						"\x0a" + self.asn1encode(
-							"\x01"
-						)
-					) +
-					"\xa1" + self.asn1encode(
-						"\x06" + self.asn1encode(
-							"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"
-						)
-					) +
-					"\xa2" + self.asn1encode(
-						"\x04" + self.asn1encode(
-							"NTLMSSP\x00" +
-							[2].pack('V') +
-							[
-								win_domain.length,  # length
-								win_domain.length,  # max length
-								(ptr += 48)
-							].pack('vvV') +
-							[ flags ].pack('V') +
-							chall + 
-							"\x00\x00\x00\x00\x00\x00\x00\x00" +
-							[
-								addr_list.length,  # length
-								addr_list.length,  # max length
-								(ptr += win_domain.length) 
-							].pack('vvV') +
-							win_domain + 
-							addr_list
-						)
-					)
-				)	
-			)
-
-		return blob
-	end
-
-	def self.make_ntlmv2_secblob_success
-		blob =
-			"\xa1" + self.asn1encode(
-				"\x30" + self.asn1encode(
-					"\xa0" + self.asn1encode(
-						"\x0a" + self.asn1encode(
-							"\x00"
-						)
-					)
-				)	
-			)
-		return blob
-	end
-	
-	#
-	# Process Type 3 NTLM Message (in Base64)
-	#
-	# from http://www.innovation.ch/personal/ronald/ntlm.html
-	#
-	#	struct {
-	#		byte  protocol[8];  // 'N', 'T', 'L', 'M', 'S', 'S', 'P', '\0'
-	#		byte  type;         // 0x03
-	#		byte  zero[3];
-	#
-	#		short lm_resp_len;  // LanManager response length (always 0x18)
-	#		short lm_resp_len;  // LanManager response length (always 0x18)
-	#		short lm_resp_off;  // LanManager response offset
-	#		byte  zero[2];
-	#
-	#		short nt_resp_len;  // NT response length (always 0x18)
-	#		short nt_resp_len;  // NT response length (always 0x18)
-	#		short nt_resp_off;  // NT response offset
-	#		byte  zero[2];
-	#
-	#		short dom_len;      // domain string length
-	#		short dom_len;      // domain string length
-	#		short dom_off;      // domain string offset (always 0x40)
-	#		byte  zero[2];
-	#
-	#		short user_len;     // username string length
-	#		short user_len;     // username string length
-	#		short user_off;     // username string offset
-	#		byte  zero[2];
-	#
-	#		short host_len;     // host string length
-	#		short host_len;     // host string length
-	#		short host_off;     // host string offset
-	#		byte  zero[6];
-	#
-	#		short msg_len;      // message length
-	#		byte  zero[2];
-	#
-	#		short flags;        // 0x8201
-	#		byte  zero[2];
-	#
-	#		byte  dom[*];       // domain string (unicode UTF-16LE)
-	#		byte  user[*];      // username string (unicode UTF-16LE)
-	#		byte  host[*];      // host string (unicode UTF-16LE)
-	#		byte  lm_resp[*];   // LanManager response
-	#		byte  nt_resp[*];   // NT response
-	#	} type_3_message
-	#
-	def self.process_type3_message(message)
-		decode = Rex::Text.decode_base64(message.strip)
-		type = decode[8,1].unpack("C").first
-		if (type == 3)
-			lm_len = decode[12,2].unpack("v").first
-			lm_offset = decode[16,2].unpack("v").first
-			lm = decode[lm_offset, lm_len].unpack("H*").first
-
-			nt_len = decode[20,2].unpack("v").first
-			nt_offset = decode[24,2].unpack("v").first
-			nt = decode[nt_offset, nt_len].unpack("H*").first
-
-			dom_len = decode[28,2].unpack("v").first
-			dom_offset = decode[32,2].unpack("v").first
-			domain = decode[dom_offset, dom_len]
-
-			user_len = decode[36,2].unpack("v").first
-			user_offset = decode[40,2].unpack("v").first
-			user = decode[user_offset, user_len]
-
-			host_len = decode[44,2].unpack("v").first
-			host_offset = decode[48,2].unpack("v").first
-			host = decode[host_offset, host_len]
-		
-			return domain, user, host, lm, nt
-		else
-			return "", "", "", "", ""
-		end
-	end
-	
-	#	 
-	# Process Type 1 NTLM Messages, return a Base64 Type 2 Message
-	#
-	def self.process_type1_message(message, nonce = "\x11\x22\x33\x44\x55\x66\x77\x88", win_domain = 'DOMAIN', 
-					win_name = 'SERVER', dns_name = 'server', dns_domain = 'example.com', downgrade = true)
-
-		dns_name = Rex::Text.to_unicode(dns_name + "." + dns_domain)
-		win_domain = Rex::Text.to_unicode(win_domain)
-		dns_domain = Rex::Text.to_unicode(dns_domain)
-		win_name = Rex::Text.to_unicode(win_name)
-		decode = Rex::Text.decode_base64(message.strip)
-
-		type = decode[8,1].unpack("C").first
-
-		if (type == 1)
-			# A type 1 message has been received, lets build a type 2 message response
-
-			reqflags = decode[12,4]
-			reqflags = reqflags.unpack("V").first
-
-			if (reqflags & CONST::REQUEST_TARGET) == CONST::REQUEST_TARGET
-
-				if (downgrade)
-					# At this time NTLMv2 and signing requirements are not supported
-					if (reqflags & CONST::NEGOTIATE_NTLM2_KEY) == CONST::NEGOTIATE_NTLM2_KEY
-						reqflags = reqflags - CONST::NEGOTIATE_NTLM2_KEY
-					end
-					if (reqflags & CONST::NEGOTIATE_ALWAYS_SIGN) == CONST::NEGOTIATE_ALWAYS_SIGN
-						reqflags = reqflags - CONST::NEGOTIATE_ALWAYS_SIGN
-					end				
-				end
-
-				flags = reqflags + CONST::TARGET_TYPE_DOMAIN + CONST::TARGET_TYPE_SERVER				
-				tid = true
-
-				tidoffset = 48 + win_domain.length
-				tidbuff = 
-					[2].pack('v') +				# tid type, win domain
-					[win_domain.length].pack('v') +
-					win_domain +
-					[1].pack('v') +				# tid type, server name
-					[win_name.length].pack('v') +
-					win_name +
-					[4].pack('v')	+			 # tid type, domain name
-					[dns_domain.length].pack('v') +
-					dns_domain +
-					[3].pack('v')	+			# tid type, dns_name
-					[dns_name.length].pack('v') +
-					dns_name
-			else
-				flags = CONST::NEGOTIATE_UNICODE + CONST::NEGOTIATE_NTLM
-				tid = false
-			end
-
-			type2msg = "NTLMSSP\0" + # protocol, 8 bytes
-				   "\x02\x00\x00\x00"		# type, 4 bytes
-
-			if (tid)
-				type2msg +=	# Target security info, 8 bytes. Filled if REQUEST_TARGET
-				[win_domain.length].pack('v') +	 # Length, 2 bytes
-				[win_domain.length].pack('v')	 # Allocated space, 2 bytes
-			end
-
-			type2msg +="\x30\x00\x00\x00" + #		Offset, 4 bytes
-				 [flags].pack('V') +	# flags, 4 bytes
-				 nonce +		# the nonce, 8 bytes
-			 	 "\x00" * 8		# Context (all 0s), 8 bytes
-
-			if (tid)
-				type2msg +=		# Target information security buffer. Filled if REQUEST_TARGET
-					[tidbuff.length].pack('v') +	# Length, 2 bytes
-					[tidbuff.length].pack('v') +	# Allocated space, 2 bytes
-					[tidoffset].pack('V') +		# Offset, 4 bytes (usually \x48 + length of win_domain)
-					win_domain +			# Target name data (domain in unicode if REQUEST_UNICODE)
-									# Target information data
-					tidbuff +			#	Type, 2 bytes
-									#	Length, 2 bytes
-									#	Data (in unicode if REQUEST_UNICODE)
-					"\x00\x00\x00\x00"		# Terminator, 4 bytes, all \x00
-			end
-
-			type2msg = Rex::Text.encode_base64(type2msg).delete("\n") # base64 encode and remove the returns
-		else
-			# This is not a Type2 message
-			type2msg = ""
-		end
-
-		return type2msg
-	end
-	
-	#
-	# Downgrading Type messages to LMv1/NTLMv1 and removing signing
-	#
-	def self.downgrade_type_message(message)
-		decode = Rex::Text.decode_base64(message.strip)
-
-		type = decode[8,1].unpack("C").first
-
-		if (type > 0 and type < 4)
-			reqflags = decode[12..15] if (type == 1 or type == 3)
-			reqflags = decode[20..23] if (type == 2)
-			reqflags = reqflags.unpack("V")
-
-			# Remove NEGOTIATE_NTLMV2_KEY and NEGOTIATE_ALWAYS_SIGN, this lowers the negotiation
-			# down to LMv1/NTLMv1.
-			if (reqflags & CONST::NEGOTIATE_NTLM2_KEY) == CONST::NEGOTIATE_NTLM2_KEY
-				reqflags = reqflags - CONST::NEGOTIATE_NTLM2_KEY
-			end
-			if (reqflags & CONST::NEGOTIATE_ALWAYS_SIGN) == CONST::NEGOTIATE_ALWAYS_SIGN
-				reqflags = reqflags - CONST::NEGOTIATE_ALWAYS_SIGN
-			end				
-			
-			# Return the flags back to the decode so we can base64 it again
-			flags = reqflags.to_s(16)
-			0.upto(8) do |idx|
-				if (idx > flags.length)
-					flags.insert(0, "0")
-				end
-			end
-
-			idx = 0
-			0.upto(3) do |cnt|
-				if (type == 2)
-					decode[23-cnt] = [flags[idx,1]].pack("C")
-				else
-					decode[15-cnt] = [flags[idx,1]].pack("C")
-				end
-				idx += 2
-			end
-			
-		end
-		return Rex::Text.encode_base64(decode).delete("\n") # base64 encode and remove the returns 
-	end
-	
 end
 end
 end