librex 0.0.68 → 0.0.70

data/lib/rex/proto/smb/simpleclient.rb

@@ -12,6 +12,8 @@ require 'rex/proto/smb/evasions'
 require 'rex/proto/smb/crypt'
 require 'rex/proto/smb/utils'
 require 'rex/proto/smb/client'
+require 'rex/proto/smb/simpleclient/open_file'
+require 'rex/proto/smb/simpleclient/open_pipe'
 
 # Some short-hand class aliases
 CONST = Rex::Proto::SMB::Constants
@@ -20,295 +22,149 @@ UTILS = Rex::Proto::SMB::Utils
 XCEPT = Rex::Proto::SMB::Exceptions
 EVADE = Rex::Proto::SMB::Evasions
 
-
-	class OpenFile
-		attr_accessor	:name, :tree_id, :file_id, :mode, :client, :chunk_size
-
-		def initialize(client, name, tree_id, file_id)
-			self.client = client
-			self.name = name
-			self.tree_id = tree_id
-			self.file_id = file_id
-			self.chunk_size = 48000
-		end
-
-		def delete
-			begin
-				self.close
-			rescue
-			end
-			self.client.delete(self.name, self.tree_id)
-		end
-
-		# Close this open file
-		def close
-			self.client.close(self.file_id, self.tree_id)
-		end
-
-		# Read data from the file
-		def read(length = nil, offset = 0)
-			if (length == nil)
-				data = ''
-				fptr = offset
-				ok = self.client.read(self.file_id, fptr, self.chunk_size)
-				while (ok and ok['Payload'].v['DataLenLow'] > 0)
-					buff = ok.to_s.slice(
-						ok['Payload'].v['DataOffset'] + 4,
-						ok['Payload'].v['DataLenLow']
-					)
-					data << buff
-					if ok['Payload'].v['Remaining'] == 0
-						break
-					end
-					fptr += ok['Payload'].v['DataLenLow']
-
-					begin
-						ok = self.client.read(self.file_id, fptr, self.chunk_size)
-					rescue XCEPT::ErrorCode => e
-						case e.error_code
-						when 0x00050001
-							# Novell fires off an access denied error on EOF
-							ok = nil
-						else
-							raise e
-						end
-					end
-				end
-
-				return data
-			else
-				ok = self.client.read(self.file_id, offset, length)
-				data = ok.to_s.slice(
-					ok['Payload'].v['DataOffset'] + 4,
-					ok['Payload'].v['DataLenLow']
-				)
-				return data
-			end
-		end
-
-		def << (data)
-			self.write(data)
-		end
-
-		# Write data to the file
-		def write(data, offset = 0)
-			# Track our offset into the remote file
-			fptr = offset
-
-			# Duplicate the data so we can use slice!
-			data = data.dup
-
-			# Take our first chunk of bytes
-			chunk = data.slice!(0, self.chunk_size)
-
-			# Keep writing data until we run out
-			while (chunk.length > 0)
-				ok = self.client.write(self.file_id, fptr, chunk)
-				cl = ok['Payload'].v['CountLow']
-
-				# Partial write, push the failed data back into the queue
-				if (cl != chunk.length)
-					data = chunk.slice(cl - 1, chunk.length - cl) + data
-				end
-
-				# Increment our painter and grab the next chunk
-				fptr += cl
-				chunk = data.slice!(0, self.chunk_size)
-			end
-		end
-	end
-
-	class OpenPipe < OpenFile
-
-		# Valid modes are: 'trans' and 'rw'
-		attr_accessor :mode
-
-		def initialize(*args)
-			super(*args)
-			self.mode = 'rw'
-			@buff = ''
-		end
-
-		def read_buffer(length, offset=0)
-			length ||= @buff.length
-			@buff.slice!(0, length)
-		end
-
-		def read(length = nil, offset = 0)
-			case self.mode
-			when 'trans'
-				read_buffer(length, offset)
-			when 'rw'
-				super(length, offset)
-			else
-				raise ArgumentError
-			end
-		end
-
-		def write(data, offset = 0)
-			case self.mode
-
-			when 'trans'
-				write_trans(data, offset)
-			when 'rw'
-				super(data, offset)
-			else
-				raise ArgumentError
-			end
-		end
-
-		def write_trans(data, offset=0)
-			ack = self.client.trans_named_pipe(self.file_id, data)
-			doff = ack['Payload'].v['DataOffset']
-			dlen = ack['Payload'].v['DataCount']
-			@buff << ack.to_s[4+doff, dlen]
-		end
-	end
-
-
 # Public accessors
-attr_accessor	:last_error
+attr_accessor :last_error
 
 # Private accessors
-attr_accessor	:socket, :client, :direct, :shares, :last_share
-
-	# Pass the socket object and a boolean indicating whether the socket is netbios or cifs
-	def initialize(socket, direct = false)
-		self.socket = socket
-		self.direct = direct
-		self.client = Rex::Proto::SMB::Client.new(socket)
-		self.shares = { }
-	end
-
-	def login(	name = '', user = '', pass = '', domain = '',
-			verify_signature = false, usentlmv2 = false, usentlm2_session = true,
-			send_lm = true, use_lanman_key = false, send_ntlm = true,
-			native_os = 'Windows 2000 2195', native_lm = 'Windows 2000 5.0', spnopt = {})
-
-		begin
-
-			if (self.direct != true)
-				self.client.session_request(name)
-			end
-			self.client.native_os = native_os
-			self.client.native_lm = native_lm
-			self.client.verify_signature = verify_signature
-			self.client.use_ntlmv2 = usentlmv2
-			self.client.usentlm2_session = usentlm2_session
-			self.client.send_lm = send_lm
-			self.client.use_lanman_key =  use_lanman_key
-			self.client.send_ntlm = send_ntlm
-
-			self.client.negotiate
-
-			# Disable NTLMv2 Session for Windows 2000 (breaks authentication on some systems)
-			# XXX: This in turn breaks SMB auth for Windows 2000 configured to enforce NTLMv2
-			# XXX: Tracked by ticket #4785#4785
-			if self.client.native_lm =~ /Windows 2000 5\.0/ and usentlm2_session
-			#	self.client.usentlm2_session = false
-			end
-
-			self.client.spnopt = spnopt
-
-			ok = self.client.session_setup(user, pass, domain)
-		rescue ::Interrupt
-			raise $!
-		rescue ::Exception => e
-			n = XCEPT::LoginError.new
-			n.source = e
-			if(e.respond_to?('error_code'))
-				n.error_code   = e.error_code
-				n.error_reason = e.get_error(e.error_code)
-			end
-			raise n
-		end
-
-		return true
-	end
-
-
-	def login_split_start_ntlm1(name = '')
-
-		begin
-
-			if (self.direct != true)
-				self.client.session_request(name)
-			end
-
-			# Disable extended security
-			self.client.negotiate(false)
-		rescue ::Interrupt
-			raise $!
-		rescue ::Exception => e
-			n = XCEPT::LoginError.new
-			n.source = e
-			if(e.respond_to?('error_code'))
-				n.error_code   = e.error_code
-				n.error_reason = e.get_error(e.error_code)
-			end
-			raise n
-		end
-
-		return true
-	end
-
-
-	def login_split_next_ntlm1(user, domain, hash_lm, hash_nt)
-		begin
-			ok = self.client.session_setup_no_ntlmssp_prehash(user, domain, hash_lm, hash_nt)
-		rescue ::Interrupt
-			raise $!
-		rescue ::Exception => e
-			n = XCEPT::LoginError.new
-			n.source = e
-			if(e.respond_to?('error_code'))
-				n.error_code   = e.error_code
-				n.error_reason = e.get_error(e.error_code)
-			end
-			raise n
-		end
-
-		return true
-	end
-
-	def connect(share)
-		ok = self.client.tree_connect(share)
-		tree_id = ok['Payload']['SMB'].v['TreeID']
-		self.shares[share] = tree_id
-		self.last_share = share
-	end
-
-	def disconnect(share)
-		ok = self.client.tree_disconnect(self.shares[share])
-		self.shares.delete(share)
-	end
-
-
-	def open(path, perm, chunk_size = 48000)
-		mode   = UTILS.open_mode_to_mode(perm)
-		access = UTILS.open_mode_to_access(perm)
-
-		ok = self.client.open(path, mode, access)
-		file_id = ok['Payload'].v['FileID']
-		fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
-		fh.chunk_size = chunk_size
-		fh
-	end
-
-	def delete(*args)
-		self.client.delete(*args)
-	end
-
-	def create_pipe(path, perm = 'c')
-		disposition = UTILS.create_mode_to_disposition(perm)
-		ok = self.client.create_pipe(path, disposition)
-		file_id = ok['Payload'].v['FileID']
-		fh = OpenPipe.new(self.client, path, self.client.last_tree_id, file_id)
-	end
-
-	def trans_pipe(fid, data, no_response = nil)
-		client.trans_named_pipe(fid, data, no_response)
-	end
+attr_accessor :socket, :client, :direct, :shares, :last_share
+
+  # Pass the socket object and a boolean indicating whether the socket is netbios or cifs
+  def initialize(socket, direct = false)
+    self.socket = socket
+    self.direct = direct
+    self.client = Rex::Proto::SMB::Client.new(socket)
+    self.shares = { }
+  end
+
+  def login(name = '', user = '', pass = '', domain = '',
+      verify_signature = false, usentlmv2 = false, usentlm2_session = true,
+      send_lm = true, use_lanman_key = false, send_ntlm = true,
+      native_os = 'Windows 2000 2195', native_lm = 'Windows 2000 5.0', spnopt = {})
+
+    begin
+
+      if (self.direct != true)
+        self.client.session_request(name)
+      end
+      self.client.native_os = native_os
+      self.client.native_lm = native_lm
+      self.client.verify_signature = verify_signature
+      self.client.use_ntlmv2 = usentlmv2
+      self.client.usentlm2_session = usentlm2_session
+      self.client.send_lm = send_lm
+      self.client.use_lanman_key =  use_lanman_key
+      self.client.send_ntlm = send_ntlm
+
+      self.client.negotiate
+
+      # Disable NTLMv2 Session for Windows 2000 (breaks authentication on some systems)
+      # XXX: This in turn breaks SMB auth for Windows 2000 configured to enforce NTLMv2
+      # XXX: Tracked by ticket #4785#4785
+      if self.client.native_lm =~ /Windows 2000 5\.0/ and usentlm2_session
+      #	self.client.usentlm2_session = false
+      end
+
+      self.client.spnopt = spnopt
+
+      ok = self.client.session_setup(user, pass, domain)
+    rescue ::Interrupt
+      raise $!
+    rescue ::Exception => e
+      n = XCEPT::LoginError.new
+      n.source = e
+      if(e.respond_to?('error_code'))
+        n.error_code   = e.error_code
+        n.error_reason = e.get_error(e.error_code)
+      end
+      raise n
+    end
+
+    return true
+  end
+
+
+  def login_split_start_ntlm1(name = '')
+
+    begin
+
+      if (self.direct != true)
+        self.client.session_request(name)
+      end
+
+      # Disable extended security
+      self.client.negotiate(false)
+    rescue ::Interrupt
+      raise $!
+    rescue ::Exception => e
+      n = XCEPT::LoginError.new
+      n.source = e
+      if(e.respond_to?('error_code'))
+        n.error_code   = e.error_code
+        n.error_reason = e.get_error(e.error_code)
+      end
+      raise n
+    end
+
+    return true
+  end
+
+
+  def login_split_next_ntlm1(user, domain, hash_lm, hash_nt)
+    begin
+      ok = self.client.session_setup_no_ntlmssp_prehash(user, domain, hash_lm, hash_nt)
+    rescue ::Interrupt
+      raise $!
+    rescue ::Exception => e
+      n = XCEPT::LoginError.new
+      n.source = e
+      if(e.respond_to?('error_code'))
+        n.error_code   = e.error_code
+        n.error_reason = e.get_error(e.error_code)
+      end
+      raise n
+    end
+
+    return true
+  end
+
+  def connect(share)
+    ok = self.client.tree_connect(share)
+    tree_id = ok['Payload']['SMB'].v['TreeID']
+    self.shares[share] = tree_id
+    self.last_share = share
+  end
+
+  def disconnect(share)
+    ok = self.client.tree_disconnect(self.shares[share])
+    self.shares.delete(share)
+  end
+
+
+  def open(path, perm, chunk_size = 48000)
+    mode   = UTILS.open_mode_to_mode(perm)
+    access = UTILS.open_mode_to_access(perm)
+
+    ok = self.client.open(path, mode, access)
+    file_id = ok['Payload'].v['FileID']
+    fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
+    fh.chunk_size = chunk_size
+    fh
+  end
+
+  def delete(*args)
+    self.client.delete(*args)
+  end
+
+  def create_pipe(path, perm = 'c')
+    disposition = UTILS.create_mode_to_disposition(perm)
+    ok = self.client.create_pipe(path, disposition)
+    file_id = ok['Payload'].v['FileID']
+    fh = OpenPipe.new(self.client, path, self.client.last_tree_id, file_id)
+  end
+
+  def trans_pipe(fid, data, no_response = nil)
+    client.trans_named_pipe(fid, data, no_response)
+  end
 
 end
 end

data/lib/rex/proto/smb/simpleclient/open_file.rb

@@ -0,0 +1,106 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module SMB
+class SimpleClient
+
+class OpenFile
+  attr_accessor	:name, :tree_id, :file_id, :mode, :client, :chunk_size
+
+  def initialize(client, name, tree_id, file_id)
+    self.client = client
+    self.name = name
+    self.tree_id = tree_id
+    self.file_id = file_id
+    self.chunk_size = 48000
+  end
+
+  def delete
+    begin
+      self.close
+    rescue
+    end
+    self.client.delete(self.name, self.tree_id)
+  end
+
+  # Close this open file
+  def close
+    self.client.close(self.file_id, self.tree_id)
+  end
+
+  # Read data from the file
+  def read(length = nil, offset = 0)
+    if (length == nil)
+      data = ''
+      fptr = offset
+      ok = self.client.read(self.file_id, fptr, self.chunk_size)
+      while (ok and ok['Payload'].v['DataLenLow'] > 0)
+        buff = ok.to_s.slice(
+          ok['Payload'].v['DataOffset'] + 4,
+          ok['Payload'].v['DataLenLow']
+        )
+        data << buff
+        if ok['Payload'].v['Remaining'] == 0
+          break
+        end
+        fptr += ok['Payload'].v['DataLenLow']
+
+        begin
+          ok = self.client.read(self.file_id, fptr, self.chunk_size)
+        rescue XCEPT::ErrorCode => e
+          case e.error_code
+          when 0x00050001
+            # Novell fires off an access denied error on EOF
+            ok = nil
+          else
+            raise e
+          end
+        end
+      end
+
+      return data
+    else
+      ok = self.client.read(self.file_id, offset, length)
+      data = ok.to_s.slice(
+        ok['Payload'].v['DataOffset'] + 4,
+        ok['Payload'].v['DataLenLow']
+      )
+      return data
+    end
+  end
+
+  def << (data)
+    self.write(data)
+  end
+
+  # Write data to the file
+  def write(data, offset = 0)
+    # Track our offset into the remote file
+    fptr = offset
+
+    # Duplicate the data so we can use slice!
+    data = data.dup
+
+    # Take our first chunk of bytes
+    chunk = data.slice!(0, self.chunk_size)
+
+    # Keep writing data until we run out
+    while (chunk.length > 0)
+      ok = self.client.write(self.file_id, fptr, chunk)
+      cl = ok['Payload'].v['CountLow']
+
+      # Partial write, push the failed data back into the queue
+      if (cl != chunk.length)
+        data = chunk.slice(cl - 1, chunk.length - cl) + data
+      end
+
+      # Increment our painter and grab the next chunk
+      fptr += cl
+      chunk = data.slice!(0, self.chunk_size)
+    end
+  end
+end
+end
+end
+end
+end