packetgen-plugin-smb 0.3.0 → 0.6.2

data/lib/packetgen/plugin/ntlm/negotiate.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+# This file is part of packetgen-plugin-smb.
+# See https://github.com/sdaubert/packetgen-plugin-smb for more informations
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
+# This program is published under MIT license.
+
+module PacketGen::Plugin
+  class NTLM
+    # NTLM Negotiate message
+    # @author Sylvain Daubert
+    class Negotiate < NTLM
+      # @return [String]
+      attr_accessor :domain_name
+      # @return [String]
+      attr_accessor :workstation
+
+      update_field :type, default: NTLM::TYPES['negotiate']
+      # @!attribute flags
+      #   Negotiate flags
+      #   @return [Integer]
+
+      # @!group Negotiate flags
+      # @!attribute nego56?
+      #   Also known as +flags_w?+.
+      #   @return [Boolean]
+      # @!attribute key_exch?
+      #   Also known as +flags_v?+
+      #   @return [Boolean]
+      # @!attribute nego128?
+      #   Also known as +flags_u?+
+      #   @return [Boolean]
+      # @!attribute version?
+      #   Also known as +flags_t+
+      #   @return [Integer]
+      # @!attribute target_info?
+      #   Also known as +flags_s?+
+      #   @return [Boolean]
+      # @!attribute non_nt_session_key?
+      #   Also known as +flags_r?+
+      #   @return [Boolean]
+      # @!attribute identify?
+      #   Also known as +flags_q+
+      #   @return [Boolean]
+      # @!attribute ext_session_security?
+      #   Also known as +flags_p?+
+      #   @return [Boolean]
+      # @!attribute target_type_server?
+      #   Also known as +flags_o?+
+      #   @return [Boolean]
+      # @!attribute target_type_domain?
+      #   Also known as +flags_n?+
+      #   @return [Boolean]
+      # @!attribute always_sign?
+      #   Also known as +flags_m?+
+      #   @return [Boolean]
+      # @!attribute oem_workstation_supplied?
+      #   Also known as +flags_l?+
+      #   @return [Boolean]
+      # @!attribute oem_domain_supplied?
+      #   Also known as +flags_k?+
+      #   @return [Boolean]
+      # @!attribute anonymous?
+      #   Also known as +flags_j?+
+      #   @return [Boolean]
+      # @!attribute ntlm?
+      #   Also known as +flags_h?+
+      #   @return [Boolean]
+      # @!attribute lm_key?
+      #   Also known as +flags_g?+
+      #   @return [Boolean]
+      # @!attribute datagram?
+      #   Also known as +flags_f?+
+      #   @return [Boolean]
+      # @!attribute seal?
+      #   Also known as +flags_e?+
+      #   @return [Boolean]
+      # @!attribute sign?
+      #   Also known as +flags_d?+
+      #   @return [Boolean]
+      # @!attribute request_target?
+      #   Also known as +flags_c?+
+      #   @return [Boolean]
+      # @!attribute oem?
+      #   Also known as +flags_b?+
+      #   @return [Boolean]
+      # @!attribute unicode?
+      #   Also known as +flags_a?+
+      #   @return [Boolean]
+      define_negotiate_flags
+      # @!endgroup Negotiate flags
+
+      # @!attribute domain_name
+      #  Name of the client authentication domain. Must be OEM encoded.
+      #  @return [PacketGen::Types::String]
+      # @!attribute domain_name_len
+      #  2-byte domain name length
+      #  @return [Integer]
+      # @!attribute domain_name_maxlen
+      #  2-byte domain name max length
+      #  @return [Integer]
+      # @!attribute domain_name_offset
+      #  4-byte domain name offset
+      #  @return [Integer]
+      define_in_payload :domain_name, PacketGen::Types::String
+
+      # @!attribute workstation
+      #  Name of the client machine. Must be OEM encoded.
+      #  @return [PacketGen::Types::String]
+      # @!attribute workstation_len
+      #  2-byte workstation length
+      #  @return [Integer]
+      # @!attribute workstation_maxlen
+      #  2-byte workstation max length
+      #  @return [Integer]
+      # @!attribute workstation_offset
+      #  4-byte workstation offset
+      #  @return [Integer]
+      define_in_payload :workstation, PacketGen::Types::String
+
+      # @!attribute version
+      #  8-byte version information
+      #  @return [String]
+      define_field_before :payload, :version, PacketGen::Types::String, static_length: 8, default: VOID_VERSION
+    end
+  end
+end

data/lib/packetgen/plugin/ntlm/ntlmv2_response.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# This file is part of packetgen-plugin-smb.
+# See https://github.com/sdaubert/packetgen-plugin-smb for more informations
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
+# This program is published under MIT license.
+
+module PacketGen::Plugin
+  class NTLM
+    class Ntlmv2Response < PacketGen::Types::Fields
+      # @!attribute response
+      #   16-byte array of unsigned char containing the client's NT challenge
+      #   response.
+      #   @return [String]
+      define_field :response, PacketGen::Types::String, static_length: 16
+      alias ntproof_str response
+      alias ntproof_str= response=
+
+      # @!attribute type
+      #   8-bit current version of the challenge. Should be 1.
+      #   @return [Integer]
+      define_field :type, PacketGen::Types::Int8, default: 1
+      # @!attribute hi_type
+      #   8-bit maximum supported version of the challenge. Should be 1.
+      #   @return [Integer]
+      define_field :hi_type, PacketGen::Types::Int8, default: 1
+      # @!attribute reserved1
+      #   16-bit reserved word.
+      #   @return [Integer]
+      define_field :reserved1, PacketGen::Types::Int16le
+      # @!attribute reserved2
+      #   32-bit reserved word.
+      #   @return [Integer]
+      define_field :reserved2, PacketGen::Types::Int32le
+      # @!attribute timestamp
+      #   64-bit current system time.
+      #   @return [SMB::Filetime]
+      define_field :timestamp, SMB::Filetime
+      # @!attribute client_challenge
+      #   8-byte challenge from client
+      #   @return [String]
+      define_field :client_challenge, PacketGen::Types::String, static_length: 8
+      # @!attribute reserved3
+      #   32-bit reserved word.
+      #   @return [Integer]
+      define_field :reserved3, PacketGen::Types::Int32le
+      # @!attribute avpairs
+      #   @return [ArrayOfAvPair]
+      define_field :avpairs, ArrayOfAvPair
+
+      # @return [false]
+      def empty?
+        false
+      end
+
+      alias size sz
+    end
+  end
+end

data/lib/packetgen/plugin/smb.rb

@@ -1,26 +1,26 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   # Server Message Block (SMB) header.
   # @author Sylvain Daubert
   class SMB < PacketGen::Header::Base
     # Known commands
     COMMANDS = {
-      'delete_dir'     => 0x01,
-      'close'          => 0x04,
-      'delete'         => 0x06,
-      'query_info2'    => 0x23,
-      'trans'          => 0x25,
-      'echo'           => 0x2b,
-      'open_and_x'     => 0x2d,
-      'read_and_x'     => 0x2e,
-      'write_and_x'    => 0x2f,
-      'trans2'         => 0x32,
+      'delete_dir' => 0x01,
+      'close' => 0x04,
+      'delete' => 0x06,
+      'query_info2' => 0x23,
+      'trans' => 0x25,
+      'echo' => 0x2b,
+      'open_and_x' => 0x2d,
+      'read_and_x' => 0x2e,
+      'write_and_x' => 0x2f,
+      'trans2' => 0x32,
       'tree_disconnect' => 0x71,
       'negotiate' => 0x72,
       'session_setup_and_x' => 0x73,
@@ -171,6 +171,13 @@ module PacketGen::Plugin
       self.bind kresponse, command: SMB::COMMANDS[command], flags: ->(v) { v.nil? ? 0 : (v & 0x80 == 0x80) }
     end
 
+    # Check if this is really a SMB2 header. Check {#protocol} has value {MARKER}.
+    # @return [Boolean]
+    def parse?
+      protocol == MARKER
+    end
+
+    # @return [String]
     def inspect
       super do |attr|
         case attr
@@ -190,14 +197,19 @@ module PacketGen::Plugin
     end
   end
   PacketGen::Header.add_class SMB
-  PacketGen::Header::NetBIOS::Session.bind SMB, body: ->(val) { val.nil? ? SMB::MARKER : val[0..3] == SMB::MARKER }
-  PacketGen::Header::NetBIOS::Datagram.bind SMB, body: ->(val) { val.nil? ? SMB::MARKER : val[0..3] == SMB::MARKER }
+  NetBIOS::Session.bind SMB, body: ->(val) { val.nil? ? SMB::MARKER : val[0..3] == SMB::MARKER }
+  NetBIOS::Datagram.bind SMB, body: ->(val) { val.nil? ? SMB::MARKER : val[0..3] == SMB::MARKER }
 end
 
 require_relative 'smb/string'
 require_relative 'smb/filetime'
+require_relative 'smb/blocks'
 require_relative 'smb/close'
 require_relative 'smb/trans'
 require_relative 'smb/nt_create_and_x'
+require_relative 'smb/negotiate'
 require_relative 'smb/browser'
-require_relative 'smb/blocks'
+
+# If unknown command, bind SMB blocks
+PacketGen::Header.add_class PacketGen::Plugin::SMB::Blocks
+PacketGen::Plugin::SMB.bind PacketGen::Plugin::SMB::Blocks

data/lib/packetgen/plugin/smb/blocks.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     # Common blocks used for unsupported SMB messages.
@@ -42,6 +42,4 @@ module PacketGen::Plugin
       end
     end
   end
-  PacketGen::Header.add_class SMB::Blocks
-  SMB.bind SMB::Blocks
 end

data/lib/packetgen/plugin/smb/browser.rb

@@ -1,16 +1,22 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     # Browser Trans sub-protocol.
     # See subclasses.
     # @author Sylvain Daubert
     class Browser < PacketGen::Header::Base
+      # Give protocol name for this class
+      # @return [String]
+      def self.protocol_name
+        'SMB::Browser'
+      end
+
       OPCODES = {
         'HostAnnouncement' => 1,
         'HostAnnouncementReq' => 2,
@@ -57,12 +63,6 @@ module PacketGen::Plugin
         end
       end
 
-      # Give protocol name for this class
-      # @return [String]
-      def protocol_name
-        'SMB::Browser'
-      end
-
       # Callback called when a Browser header is added to a packet.
       # Here, add +#smb_browser+ method as a shortcut to existing
       # +#smb_browser_*+ method.

data/lib/packetgen/plugin/smb/browser/domain_announcement.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     class Browser
@@ -20,11 +20,6 @@ module PacketGen::Plugin
         alias browser_conf_ver_min os_ver_min
         alias machine_group server_name
         alias local_master_name comment
-
-        # @return [String]
-        def protocol_name
-          'SMB::Browser::DomainAnnouncement'
-        end
       end
       PacketGen::Header.add_class DomainAnnouncement
       SMB::Trans::Request.bind DomainAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['DomainAnnouncement'] }

data/lib/packetgen/plugin/smb/browser/host_announcement.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     class Browser
@@ -14,6 +14,14 @@ module PacketGen::Plugin
       # specify the types of resources and services it supports.
       # @author Sylvain Daubert
       class HostAnnouncement < Browser
+        # @return [String]
+        def self.protocol_name
+          return @protocol_name if @protocol_name
+
+          basename = to_s.sub(/^.*::/, '')
+          @protocol_name = "SMB::Browser::#{basename}"
+        end
+
         remove_field :body
         update_field :opcode, default: 1
         # @!attribute update_count
@@ -58,11 +66,6 @@ module PacketGen::Plugin
         #  Null-terminated ASCII string.
         #  @return [String]
         define_field :comment, PacketGen::Types::CString
-
-        # @return [String]
-        def protocol_name
-          'SMB::Browser::HostAnnouncement'
-        end
       end
       PacketGen::Header.add_class HostAnnouncement
       SMB::Trans::Request.bind HostAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['HostAnnouncement'] }

data/lib/packetgen/plugin/smb/browser/local_master_announcement.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     class Browser
@@ -15,11 +15,6 @@ module PacketGen::Plugin
       # @author Sylvain Daubert
       class LocalMasterAnnouncement < HostAnnouncement
         update_field :opcode, default: 15
-
-        # @return [String]
-        def protocol_name
-          'SMB::Browser::LocalMasterAnnouncement'
-        end
       end
       PacketGen::Header.add_class LocalMasterAnnouncement
       SMB::Trans::Request.bind LocalMasterAnnouncement, name: '\\MAILSLOT\\BROWSE', body: ->(v) { v[0] == OPCODES['LocalMasterAnnouncement'] }

data/lib/packetgen/plugin/smb/close.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     # Namespace for CLOSE related classes

data/lib/packetgen/plugin/smb/close/request.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     module Close
@@ -36,7 +36,7 @@ module PacketGen::Plugin
 
         # Give protocol name for this class
         # @return [String]
-        def protocol_name
+        def self.protocol_name
           'SMB::Close::Request'
         end
       end

data/lib/packetgen/plugin/smb/close/response.rb

@@ -1,10 +1,10 @@
+# frozen_string_literal: true
+
 # This file is part of packetgen-plugin-smb.
 # See https://github.com/sdaubert/packetgen-plugin-smb for more informations
 # Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
 # This program is published under MIT license.
 
-# frozen_string_literal: true
-
 module PacketGen::Plugin
   class SMB
     module Close
@@ -27,7 +27,7 @@ module PacketGen::Plugin
 
         # Give protocol name for this class
         # @return [String]
-        def protocol_name
+        def self.protocol_name
           'SMB::Close::Response'
         end
       end