librex 0.0.68 → 0.0.70

data/lib/rex/proto/dcerpc/wdscp.rb

@@ -0,0 +1,3 @@
+# -*- coding: binary -*-
+require 'rex/proto/dcerpc/wdscp/constants'
+require 'rex/proto/dcerpc/wdscp/packet'

data/lib/rex/proto/dcerpc/wdscp/constants.rb

@@ -0,0 +1,89 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+module WDSCP
+# http://msdn.microsoft.com/en-us/library/dd891406(prot.20).aspx
+# http://msdn.microsoft.com/en-us/library/dd541332(prot.20).aspx
+# Not all values defined by the spec have been imported...
+class Constants
+    WDSCP_RPC_UUID		= "1A927394-352E-4553-AE3F-7CF4AAFCA620"
+    OS_DEPLOYMENT_GUID 	= "\x5a\xeb\xde\xd8\xfd\xef\xb2\x43\x99\xfc\x1a\x8a\x59\x21\xc2\x27"
+
+    VAR_NAME_ARCHITECTURE 	= "ARCHITECTURE"
+    VAR_NAME_CLIENT_GUID 	= "CLIENT_GUID"
+    VAR_NAME_CLIENT_MAC 	= "CLIENT_MAC"
+    VAR_NAME_VERSION 	= "VERSION"
+    VAR_NAME_MESSAGE_TYPE 	= "MESSAGE_TYPE"
+    VAR_NAME_TRANSACTION_ID = "TRANSACTION_ID"
+    VAR_NAME_FLAGS		= "FLAGS"
+    VAR_NAME_CC		= "CC" #Client Capabilities
+    VAR_NAME_IMDC		= "IMDC"
+
+    VAR_TYPE_LOOKUP = {
+      VAR_NAME_ARCHITECTURE 	=> :ULONG,
+      VAR_NAME_CLIENT_GUID	=> :WSTRING,
+      VAR_NAME_CLIENT_MAC	=> :WSTRING,
+      VAR_NAME_VERSION	=> :ULONG,
+      VAR_NAME_MESSAGE_TYPE	=> :ULONG,
+      VAR_NAME_TRANSACTION_ID	=> :WSTRING,
+      VAR_NAME_FLAGS		=> :ULONG,
+      VAR_NAME_CC		=> :ULONG,
+      VAR_NAME_IMDC		=> :ULONG
+    }
+
+    CC_FLAGS = {
+      :V2	=> 1,
+      :VHDX	=> 2
+    }
+
+    DOMAIN_JOIN_FLAGS = {
+      :JOIN_DOMAIN		=> 1,
+      :ACCOUNT_EXISTS		=> 2,
+      :PRESTAGE_USING_MAC	=> 3,
+      :RESET_BOOT_PROGRAM	=> 256
+    }
+
+    ARCHITECTURE = {
+      :X64 	=> 9,
+      :X86 	=> 0,
+      :IA64 	=> 6,
+      :ARM 	=> 5
+    }
+
+    PACKET_TYPE = {
+      :REQUEST 	=> 1,
+      :REPLY 		=> 2
+    }
+
+    OPCODE = {
+      :IMG_ENUMERATE 			=> 2,
+      :LOG_INIT 			=> 3,
+      :LOG_MSG 			=> 4,
+      :GET_CLIENT_UNATTEND 		=> 5,
+      :GET_UNATTEND_VARIABLES 	=> 6,
+      :GET_DOMAIN_JOIN_INFORMATION 	=> 7,
+      :RESET_BOOT_PROGRAM 		=> 8,
+      :GET_MACHINE_DRIVER_PACKAGES 	=> 200
+    }
+
+    BASE_TYPE = {
+      :BYTE		=> 0x0001,
+      :USHORT 	=> 0x0002,
+      :ULONG	 	=> 0x0004,
+      :ULONG64 	=> 0x0008,
+      :STRING 	=> 0x0010,
+      :WSTRING	=> 0x0020,
+      :BLOB	 	=> 0x0040
+    }
+
+    TYPE_MODIFIER = {
+      :NONE 	=> 0x0000,
+      :ARRAY 	=> 0x1000
+    }
+
+end
+end
+end
+end
+end

data/lib/rex/proto/dcerpc/wdscp/packet.rb

@@ -0,0 +1,94 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+module WDSCP
+class Packet
+
+  WDS_CONST 	= Rex::Proto::DCERPC::WDSCP::Constants
+
+  def initialize(packet_type, opcode)
+    if opcode.nil? || packet_type.nil?
+      raise(ArgumentError, "Packet arguments cannot be nil")
+    end
+
+    @variables = []
+    @packet_type = WDS_CONST::PACKET_TYPE[packet_type]
+    @opcode = WDS_CONST::OPCODE[opcode]
+  end
+
+  def add_var(name, type_mod=0, value_length=nil, array_size=0, value)
+    padding = 0
+    vt = WDS_CONST::VAR_TYPE_LOOKUP[name]
+    value_type = WDS_CONST::BASE_TYPE[vt]
+    name = Rex::Text.to_unicode(name).unpack('H*')[0]
+
+    # Terminate strings with null char
+    if vt == :STRING
+      value << "\x00"
+    elsif vt == :WSTRING
+      value = Rex::Text.to_unicode(value)
+      value << "\x00\x00"
+    end
+
+    value_length ||= value.length
+    # Variable block total size should be evenly divisible by 16.
+    len = 16 * (1 + (value_length/16))
+    @variables << 
+      [	name,
+        padding,
+        value_type,
+        type_mod,
+        value_length,
+        array_size,
+        value
+      ].pack('H132vvvVVa%i' % len)
+  end
+
+  def create
+    packet = []
+    var_count = @variables.count
+
+    packet_size = 0
+    @variables.each do |var|
+      packet_size += var.length
+    end
+
+    # variables + operation
+    packet_size += 16
+
+    # These bytes are not part of the spec but are not part of DCERPC according to Wireshark
+    # Perhaps something from MSRPC specific? Basically length of the WDSCP packet twice...
+    packet << [(packet_size+40)].pack('V') * 2
+    packet << create_endpoint_header(packet_size)
+    packet << create_operation_header(packet_size, var_count, @packet_type, @opcode)
+    packet.concat(@variables)
+
+    return packet.join
+  end
+
+  def create_operation_header(packet_size, var_count, packet_type=:REQUEST, opcode)
+    return 	[
+        packet_size, # PacketSize
+        256,         # Version
+        packet_type, # Packet_Type
+        0,           # Padding
+        opcode,      # Opcode
+        var_count,   # Variable Count
+      ].pack('VvCCVV')
+  end
+
+  def create_endpoint_header(packet_size)
+    return [
+        40,                            # Header_Size
+        256,                           # Version
+        packet_size,                   # Packet_Size - This doesn't differ from operation header despite the spec...
+        WDS_CONST::OS_DEPLOYMENT_GUID, # GUID
+        "\x00"*16,                     # Reserved
+      ].pack('vvVa16a16')
+  end
+end
+end
+end
+end
+end

data/lib/rex/proto/dhcp.rb

@@ -1,5 +1,4 @@
 # -*- coding: binary -*-
-# $Id: dhcp.rb 15548 2012-06-29 06:08:20Z rapid7 $
 #
 # DHCP Server support written by scriptjunkie
 #

data/lib/rex/proto/dhcp/constants.rb

@@ -1,5 +1,4 @@
 # -*- coding: binary -*-
-# $Id: constants.rb 15548 2012-06-29 06:08:20Z rapid7 $
 require 'rex/proto/dhcp'
 
 module Rex

data/lib/rex/proto/dhcp/server.rb

@@ -1,5 +1,4 @@
 # -*- coding: binary -*-
-# $Id: server.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 require 'rex/socket'
 require 'rex/proto/dhcp'
@@ -20,313 +19,313 @@ module DHCP
 
 class Server
 
-	include Rex::Socket
-
-	def initialize(hash, context = {})
-		self.listen_host = '0.0.0.0' # clients don't already have addresses. Needs to be 0.0.0.0
-		self.listen_port = 67 # mandatory (bootps)
-		self.context = context
-		self.sock = nil
-
-		self.myfilename = hash['FILENAME'] || ""
-		self.myfilename << ("\x00" * (128 - self.myfilename.length))
-
-		source = hash['SRVHOST'] || Rex::Socket.source_address
-		self.ipstring = Rex::Socket.addr_aton(source)
-
-		ipstart = hash['DHCPIPSTART']
-		if ipstart
-			self.start_ip = Rex::Socket.addr_atoi(ipstart)
-		else
-			# Use the first 3 octects of the server's IP to construct the
-			# default range of x.x.x.32-254
-			self.start_ip = "#{self.ipstring[0..2]}\x20".unpack("N").first
-		end
-		self.current_ip = start_ip
-
-		ipend = hash['DHCPIPEND']
-		if ipend
-			self.end_ip = Rex::Socket.addr_atoi(ipend)
-		else
-			# Use the first 3 octects of the server's IP to construct the
-			# default range of x.x.x.32-254
-			self.end_ip = "#{self.ipstring[0..2]}\xfe".unpack("N").first
-		end
-
-		# netmask
-		netmask = hash['NETMASK'] || "255.255.255.0"
-		self.netmaskn = Rex::Socket.addr_aton(netmask)
-
-		# router
-		router = hash['ROUTER'] || source
-		self.router = Rex::Socket.addr_aton(router)
-
-		# dns
-		dnsserv = hash['DNSSERVER'] || source
-		self.dnsserv = Rex::Socket.addr_aton(dnsserv)
-
-		# broadcast
-		if hash['BROADCAST']
-			self.broadcasta = Rex::Socket.addr_aton(hash['BROADCAST'])
-		else
-			self.broadcasta = Rex::Socket.addr_itoa( self.start_ip | (Rex::Socket.addr_ntoi(self.netmaskn) ^ 0xffffffff) )
-		end
-
-		self.served = {}
-		self.serveOnce = hash.include?('SERVEONCE')
-
-		self.servePXE = (hash.include?('PXE') or hash.include?('FILENAME') or hash.include?('PXEONLY'))
-		self.serveOnlyPXE = hash.include?('PXEONLY')
-
-		# Always assume we don't give out hostnames ...
-		self.give_hostname = false
-		self.served_over = 0
-		if (hash['HOSTNAME'])
-			self.give_hostname = true
-			self.served_hostname = hash['HOSTNAME']
-			if ( hash['HOSTSTART'] )
-				self.served_over = hash['HOSTSTART'].to_i
-			end
-		end
-
-		self.leasetime = 600
-		self.relayip = "\x00\x00\x00\x00" # relay ip - not currently suported
-		self.pxeconfigfile = "update2"
-		self.pxealtconfigfile = "update0"
-		self.pxepathprefix = ""
-		self.pxereboottime = 2000
-	end
-
-	def report(&block)
-		self.reporter = block
-	end
-
-	# Start the DHCP server
-	def start
-		self.sock = Rex::Socket::Udp.create(
-			'LocalHost' => listen_host,
-			'LocalPort' => listen_port,
-			'Context'   => context
-		)
-
-		self.thread = Rex::ThreadFactory.spawn("DHCPServerMonitor", false) {
-			monitor_socket
-		}
-	end
-
-	# Stop the DHCP server
-	def stop
-		self.thread.kill
-		self.served = {}
-		self.sock.close rescue nil
-	end
-
-
-	# Set an option
-	def set_option(opts)
-		allowed_options = [
-			:serveOnce, :pxealtconfigfile, :servePXE, :relayip, :leasetime, :dnsserv,
-			:pxeconfigfile, :pxepathprefix, :pxereboottime, :router,
-			:give_hostname, :served_hostname, :served_over, :serveOnlyPXE
-		]
-
-		opts.each_pair { |k,v|
-			next if not v
-			if allowed_options.include?(k)
-				self.instance_variable_set("@#{k}", v)
-			end
-		}
-	end
-
-
-	# Send a single packet to the specified host
-	def send_packet(ip, pkt)
-		port = 68 # bootpc
-		if ip
-			self.sock.sendto( pkt, ip, port )
-		else
-			if not self.sock.sendto( pkt, '255.255.255.255', port )
-				self.sock.sendto( pkt, self.broadcasta, port )
-			end
-		end
-	end
-
-	attr_accessor :listen_host, :listen_port, :context, :leasetime, :relayip, :router, :dnsserv
-	attr_accessor :sock, :thread, :myfilename, :ipstring, :served, :serveOnce
-	attr_accessor :current_ip, :start_ip, :end_ip, :broadcasta, :netmaskn
-	attr_accessor :servePXE, :pxeconfigfile, :pxealtconfigfile, :pxepathprefix, :pxereboottime, :serveOnlyPXE
-	attr_accessor :give_hostname, :served_hostname, :served_over, :reporter
+  include Rex::Socket
+
+  def initialize(hash, context = {})
+    self.listen_host = '0.0.0.0' # clients don't already have addresses. Needs to be 0.0.0.0
+    self.listen_port = 67 # mandatory (bootps)
+    self.context = context
+    self.sock = nil
+
+    self.myfilename = hash['FILENAME'] || ""
+    self.myfilename << ("\x00" * (128 - self.myfilename.length))
+
+    source = hash['SRVHOST'] || Rex::Socket.source_address
+    self.ipstring = Rex::Socket.addr_aton(source)
+
+    ipstart = hash['DHCPIPSTART']
+    if ipstart
+      self.start_ip = Rex::Socket.addr_atoi(ipstart)
+    else
+      # Use the first 3 octects of the server's IP to construct the
+      # default range of x.x.x.32-254
+      self.start_ip = "#{self.ipstring[0..2]}\x20".unpack("N").first
+    end
+    self.current_ip = start_ip
+
+    ipend = hash['DHCPIPEND']
+    if ipend
+      self.end_ip = Rex::Socket.addr_atoi(ipend)
+    else
+      # Use the first 3 octects of the server's IP to construct the
+      # default range of x.x.x.32-254
+      self.end_ip = "#{self.ipstring[0..2]}\xfe".unpack("N").first
+    end
+
+    # netmask
+    netmask = hash['NETMASK'] || "255.255.255.0"
+    self.netmaskn = Rex::Socket.addr_aton(netmask)
+
+    # router
+    router = hash['ROUTER'] || source
+    self.router = Rex::Socket.addr_aton(router)
+
+    # dns
+    dnsserv = hash['DNSSERVER'] || source
+    self.dnsserv = Rex::Socket.addr_aton(dnsserv)
+
+    # broadcast
+    if hash['BROADCAST']
+      self.broadcasta = Rex::Socket.addr_aton(hash['BROADCAST'])
+    else
+      self.broadcasta = Rex::Socket.addr_itoa( self.start_ip | (Rex::Socket.addr_ntoi(self.netmaskn) ^ 0xffffffff) )
+    end
+
+    self.served = {}
+    self.serveOnce = hash.include?('SERVEONCE')
+
+    self.servePXE = (hash.include?('PXE') or hash.include?('FILENAME') or hash.include?('PXEONLY'))
+    self.serveOnlyPXE = hash.include?('PXEONLY')
+
+    # Always assume we don't give out hostnames ...
+    self.give_hostname = false
+    self.served_over = 0
+    if (hash['HOSTNAME'])
+      self.give_hostname = true
+      self.served_hostname = hash['HOSTNAME']
+      if ( hash['HOSTSTART'] )
+        self.served_over = hash['HOSTSTART'].to_i
+      end
+    end
+
+    self.leasetime = 600
+    self.relayip = "\x00\x00\x00\x00" # relay ip - not currently suported
+    self.pxeconfigfile = "update2"
+    self.pxealtconfigfile = "update0"
+    self.pxepathprefix = ""
+    self.pxereboottime = 2000
+  end
+
+  def report(&block)
+    self.reporter = block
+  end
+
+  # Start the DHCP server
+  def start
+    self.sock = Rex::Socket::Udp.create(
+      'LocalHost' => listen_host,
+      'LocalPort' => listen_port,
+      'Context'   => context
+    )
+
+    self.thread = Rex::ThreadFactory.spawn("DHCPServerMonitor", false) {
+      monitor_socket
+    }
+  end
+
+  # Stop the DHCP server
+  def stop
+    self.thread.kill
+    self.served = {}
+    self.sock.close rescue nil
+  end
+
+
+  # Set an option
+  def set_option(opts)
+    allowed_options = [
+      :serveOnce, :pxealtconfigfile, :servePXE, :relayip, :leasetime, :dnsserv,
+      :pxeconfigfile, :pxepathprefix, :pxereboottime, :router,
+      :give_hostname, :served_hostname, :served_over, :serveOnlyPXE
+    ]
+
+    opts.each_pair { |k,v|
+      next if not v
+      if allowed_options.include?(k)
+        self.instance_variable_set("@#{k}", v)
+      end
+    }
+  end
+
+
+  # Send a single packet to the specified host
+  def send_packet(ip, pkt)
+    port = 68 # bootpc
+    if ip
+      self.sock.sendto( pkt, ip, port )
+    else
+      if not self.sock.sendto( pkt, '255.255.255.255', port )
+        self.sock.sendto( pkt, self.broadcasta, port )
+      end
+    end
+  end
+
+  attr_accessor :listen_host, :listen_port, :context, :leasetime, :relayip, :router, :dnsserv
+  attr_accessor :sock, :thread, :myfilename, :ipstring, :served, :serveOnce
+  attr_accessor :current_ip, :start_ip, :end_ip, :broadcasta, :netmaskn
+  attr_accessor :servePXE, :pxeconfigfile, :pxealtconfigfile, :pxepathprefix, :pxereboottime, :serveOnlyPXE
+  attr_accessor :give_hostname, :served_hostname, :served_over, :reporter
 
 protected
 
 
-	# See if there is anything to do.. If so, dispatch it.
-	def monitor_socket
-		while true
-			rds = [@sock]
-			wds = []
-			eds = [@sock]
-
-			r,w,e = ::IO.select(rds,wds,eds,1)
-
-			if (r != nil and r[0] == self.sock)
-				buf,host,port = self.sock.recvfrom(65535)
-				# Lame compatabilitiy :-/
-				from = [host, port]
-				dispatch_request(from, buf)
-			end
-
-		end
-	end
-
-	def dhcpoption(type, val = nil)
-		ret = ''
-		ret << [type].pack('C')
-
-		if val
-			ret << [val.length].pack('C') + val
-		end
-
-		ret
-	end
-
-	# Dispatch a packet that we received
-	def dispatch_request(from, buf)
-		type = buf.unpack('C').first
-		if (type != Request)
-			#dlog("Unknown DHCP request type: #{type}")
-			return
-		end
-
-		# parse out the members
-		hwtype = buf[1,1]
-		hwlen = buf[2,1].unpack("C").first
-		hops = buf[3,1]
-		txid = buf[4..7]
-		elapsed = buf[8..9]
-		flags = buf[10..11]
-		clientip = buf[12..15]
-		givenip = buf[16..19]
-		nextip = buf[20..23]
-		relayip = buf[24..27]
-		clienthwaddr = buf[28..(27+hwlen)]
-		servhostname = buf[44..107]
-		filename = buf[108..235]
-		magic = buf[236..239]
-
-		if (magic != DHCPMagic)
-			#dlog("Invalid DHCP request - bad magic.")
-			return
-		end
-
-		messageType = 0
-		pxeclient = false
-
-		# options parsing loop
-		spot = 240
-		while (spot < buf.length - 3)
-			optionType = buf[spot,1].unpack("C").first
-			break if optionType == 0xff
-
-			optionLen = buf[spot + 1,1].unpack("C").first
-			optionValue = buf[(spot + 2)..(spot + optionLen + 1)]
-			spot = spot + optionLen + 2
-			if optionType == 53
-				messageType = optionValue.unpack("C").first
-			elsif optionType == 150 or (optionType == 60 and optionValue.include? "PXEClient")
-				pxeclient = true
-			end
-		end
-
-		# don't serve if only serving PXE and not PXE request
-		return if pxeclient == false and self.serveOnlyPXE == true
-
-		# prepare response
-		pkt = [Response].pack('C')
-		pkt << buf[1..7] #hwtype, hwlen, hops, txid
-		pkt << "\x00\x00\x00\x00"  #elapsed, flags
-		pkt << clientip
-
-		# if this is somebody we've seen before, use the saved IP
-		if self.served.include?( buf[28..43] )
-			pkt << Rex::Socket.addr_iton(self.served[buf[28..43]][0])
-		else # otherwise go to next ip address
-			self.current_ip += 1
-			if self.current_ip > self.end_ip
-				self.current_ip = self.start_ip
-			end
-			self.served.merge!( buf[28..43] => [ self.current_ip, messageType == DHCPRequest ] )
-			pkt << Rex::Socket.addr_iton(self.current_ip)
-		end
-		pkt << self.ipstring #next server ip
-		pkt << self.relayip
-		pkt << buf[28..43] #client hw address
-		pkt << servhostname
-		pkt << self.myfilename
-		pkt << magic
-		pkt << "\x35\x01" #Option
-
-		if messageType == DHCPDiscover  #DHCP Discover - send DHCP Offer
-			pkt << [DHCPOffer].pack('C')
-			# check if already served an Ack based on hw addr (MAC address)
-			# if serveOnce & PXE, don't reply to another PXE request
-			# if serveOnce & ! PXE, don't reply to anything
-			if self.serveOnce == true and self.served.has_key?(buf[28..43]) and
-					self.served[buf[28..43]][1] and (pxeclient == false or self.servePXE == false)
-				return
-			end
-		elsif messageType == DHCPRequest #DHCP Request - send DHCP ACK
-			pkt << [DHCPAck].pack('C')
-			# now we ignore their discovers (but we'll respond to requests in case a packet was lost)
-			if ( self.served_over != 0 )
-				# NOTE: this is sufficient for low-traffic net
-				# for high-traffic, this will probably lead to
-				# hostname collision
-				self.served_over += 1
-			end
-		else
-			return  # ignore unknown DHCP request
-		end
-
-		# Options!
-		pkt << dhcpoption(OpDHCPServer, self.ipstring)
-		pkt << dhcpoption(OpLeaseTime, [self.leasetime].pack('N'))
-		pkt << dhcpoption(OpSubnetMask, self.netmaskn)
-		pkt << dhcpoption(OpRouter, self.router)
-		pkt << dhcpoption(OpDns, self.dnsserv)
-		if self.servePXE  # PXE options
-			pkt << dhcpoption(OpPXEMagic, PXEMagic)
-			# We already got this one, serve localboot file
-			if self.serveOnce == true and self.served.has_key?(buf[28..43]) and
-					self.served[buf[28..43]][1] and pxeclient == true
-				pkt << dhcpoption(OpPXEConfigFile, self.pxealtconfigfile)
-			else
-				# We are handing out an IP and our PXE attack
-				if(self.reporter)
-					self.reporter.call(buf[28..43],self.ipstring)
-				end
-				pkt << dhcpoption(OpPXEConfigFile, self.pxeconfigfile)
-			end
-			pkt << dhcpoption(OpPXEPathPrefix, self.pxepathprefix)
-			pkt << dhcpoption(OpPXERebootTime, [self.pxereboottime].pack('N'))
-			if ( self.give_hostname == true )
-				send_hostname = self.served_hostname
-				if ( self.served_over != 0 )
-					# NOTE : see above comments for the 'uniqueness' of this value
-					send_hostname += self.served_over.to_s
-				end
-				pkt << dhcpoption(OpHostname, send_hostname)
-			end
-		end
-		pkt << dhcpoption(OpEnd)
-
-		pkt << ("\x00" * 32) #padding
-
-		# And now we mark as requested
-		self.served[buf[28..43]][1] = true if messageType == DHCPRequest
-
-		send_packet(nil, pkt)
-	end
+  # See if there is anything to do.. If so, dispatch it.
+  def monitor_socket
+    while true
+      rds = [@sock]
+      wds = []
+      eds = [@sock]
+
+      r,w,e = ::IO.select(rds,wds,eds,1)
+
+      if (r != nil and r[0] == self.sock)
+        buf,host,port = self.sock.recvfrom(65535)
+        # Lame compatabilitiy :-/
+        from = [host, port]
+        dispatch_request(from, buf)
+      end
+
+    end
+  end
+
+  def dhcpoption(type, val = nil)
+    ret = ''
+    ret << [type].pack('C')
+
+    if val
+      ret << [val.length].pack('C') + val
+    end
+
+    ret
+  end
+
+  # Dispatch a packet that we received
+  def dispatch_request(from, buf)
+    type = buf.unpack('C').first
+    if (type != Request)
+      #dlog("Unknown DHCP request type: #{type}")
+      return
+    end
+
+    # parse out the members
+    hwtype = buf[1,1]
+    hwlen = buf[2,1].unpack("C").first
+    hops = buf[3,1]
+    txid = buf[4..7]
+    elapsed = buf[8..9]
+    flags = buf[10..11]
+    clientip = buf[12..15]
+    givenip = buf[16..19]
+    nextip = buf[20..23]
+    relayip = buf[24..27]
+    clienthwaddr = buf[28..(27+hwlen)]
+    servhostname = buf[44..107]
+    filename = buf[108..235]
+    magic = buf[236..239]
+
+    if (magic != DHCPMagic)
+      #dlog("Invalid DHCP request - bad magic.")
+      return
+    end
+
+    messageType = 0
+    pxeclient = false
+
+    # options parsing loop
+    spot = 240
+    while (spot < buf.length - 3)
+      optionType = buf[spot,1].unpack("C").first
+      break if optionType == 0xff
+
+      optionLen = buf[spot + 1,1].unpack("C").first
+      optionValue = buf[(spot + 2)..(spot + optionLen + 1)]
+      spot = spot + optionLen + 2
+      if optionType == 53
+        messageType = optionValue.unpack("C").first
+      elsif optionType == 150 or (optionType == 60 and optionValue.include? "PXEClient")
+        pxeclient = true
+      end
+    end
+
+    # don't serve if only serving PXE and not PXE request
+    return if pxeclient == false and self.serveOnlyPXE == true
+
+    # prepare response
+    pkt = [Response].pack('C')
+    pkt << buf[1..7] #hwtype, hwlen, hops, txid
+    pkt << "\x00\x00\x00\x00"  #elapsed, flags
+    pkt << clientip
+
+    # if this is somebody we've seen before, use the saved IP
+    if self.served.include?( buf[28..43] )
+      pkt << Rex::Socket.addr_iton(self.served[buf[28..43]][0])
+    else # otherwise go to next ip address
+      self.current_ip += 1
+      if self.current_ip > self.end_ip
+        self.current_ip = self.start_ip
+      end
+      self.served.merge!( buf[28..43] => [ self.current_ip, messageType == DHCPRequest ] )
+      pkt << Rex::Socket.addr_iton(self.current_ip)
+    end
+    pkt << self.ipstring #next server ip
+    pkt << self.relayip
+    pkt << buf[28..43] #client hw address
+    pkt << servhostname
+    pkt << self.myfilename
+    pkt << magic
+    pkt << "\x35\x01" #Option
+
+    if messageType == DHCPDiscover  #DHCP Discover - send DHCP Offer
+      pkt << [DHCPOffer].pack('C')
+      # check if already served an Ack based on hw addr (MAC address)
+      # if serveOnce & PXE, don't reply to another PXE request
+      # if serveOnce & ! PXE, don't reply to anything
+      if self.serveOnce == true and self.served.has_key?(buf[28..43]) and
+          self.served[buf[28..43]][1] and (pxeclient == false or self.servePXE == false)
+        return
+      end
+    elsif messageType == DHCPRequest #DHCP Request - send DHCP ACK
+      pkt << [DHCPAck].pack('C')
+      # now we ignore their discovers (but we'll respond to requests in case a packet was lost)
+      if ( self.served_over != 0 )
+        # NOTE: this is sufficient for low-traffic net
+        # for high-traffic, this will probably lead to
+        # hostname collision
+        self.served_over += 1
+      end
+    else
+      return  # ignore unknown DHCP request
+    end
+
+    # Options!
+    pkt << dhcpoption(OpDHCPServer, self.ipstring)
+    pkt << dhcpoption(OpLeaseTime, [self.leasetime].pack('N'))
+    pkt << dhcpoption(OpSubnetMask, self.netmaskn)
+    pkt << dhcpoption(OpRouter, self.router)
+    pkt << dhcpoption(OpDns, self.dnsserv)
+    if self.servePXE  # PXE options
+      pkt << dhcpoption(OpPXEMagic, PXEMagic)
+      # We already got this one, serve localboot file
+      if self.serveOnce == true and self.served.has_key?(buf[28..43]) and
+          self.served[buf[28..43]][1] and pxeclient == true
+        pkt << dhcpoption(OpPXEConfigFile, self.pxealtconfigfile)
+      else
+        # We are handing out an IP and our PXE attack
+        if(self.reporter)
+          self.reporter.call(buf[28..43],self.ipstring)
+        end
+        pkt << dhcpoption(OpPXEConfigFile, self.pxeconfigfile)
+      end
+      pkt << dhcpoption(OpPXEPathPrefix, self.pxepathprefix)
+      pkt << dhcpoption(OpPXERebootTime, [self.pxereboottime].pack('N'))
+      if ( self.give_hostname == true )
+        send_hostname = self.served_hostname
+        if ( self.served_over != 0 )
+          # NOTE : see above comments for the 'uniqueness' of this value
+          send_hostname += self.served_over.to_s
+        end
+        pkt << dhcpoption(OpHostname, send_hostname)
+      end
+    end
+    pkt << dhcpoption(OpEnd)
+
+    pkt << ("\x00" * 32) #padding
+
+    # And now we mark as requested
+    self.served[buf[28..43]][1] = true if messageType == DHCPRequest
+
+    send_packet(nil, pkt)
+  end
 
 end