packetgen-plugin-smb 0.5.0 → 0.6.0

data/lib/packetgen/plugin/ntlm/negotiate.rb

@@ -0,0 +1,127 @@
+# This file is part of packetgen-plugin-smb.
+# See https://github.com/sdaubert/packetgen-plugin-smb for more informations
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
+# This program is published under MIT license.
+
+# frozen_string_literal: true
+
+module PacketGen::Plugin
+  class NTLM
+    # NTLM Negotiate message
+    # @author Sylvain Daubert
+    class Negotiate < NTLM
+      # @return [String]
+      attr_accessor :domain_name
+      # @return [String]
+      attr_accessor :workstation
+
+      update_field :type, default: NTLM::TYPES['negotiate']
+      # @!attribute flags
+      #   Negotiate flags
+      #   @return [Integer]
+
+      # @!group Negotiate flags
+      # @!attribute nego56?
+      #   Also known as +flags_w?+.
+      #   @return [Boolean]
+      # @!attribute key_exch?
+      #   Also known as +flags_v?+
+      #   @return [Boolean]
+      # @!attribute nego128?
+      #   Also known as +flags_u?+
+      #   @return [Boolean]
+      # @!attribute version?
+      #   Also known as +flags_t+
+      #   @return [Integer]
+      # @!attribute target_info?
+      #   Also known as +flags_s?+
+      #   @return [Boolean]
+      # @!attribute non_nt_session_key?
+      #   Also known as +flags_r?+
+      #   @return [Boolean]
+      # @!attribute identify?
+      #   Also known as +flags_q+
+      #   @return [Boolean]
+      # @!attribute ext_session_security?
+      #   Also known as +flags_p?+
+      #   @return [Boolean]
+      # @!attribute target_type_server?
+      #   Also known as +flags_o?+
+      #   @return [Boolean]
+      # @!attribute target_type_domain?
+      #   Also known as +flags_n?+
+      #   @return [Boolean]
+      # @!attribute always_sign?
+      #   Also known as +flags_m?+
+      #   @return [Boolean]
+      # @!attribute oem_workstation_supplied?
+      #   Also known as +flags_l?+
+      #   @return [Boolean]
+      # @!attribute oem_domain_supplied?
+      #   Also known as +flags_k?+
+      #   @return [Boolean]
+      # @!attribute anonymous?
+      #   Also known as +flags_j?+
+      #   @return [Boolean]
+      # @!attribute ntlm?
+      #   Also known as +flags_h?+
+      #   @return [Boolean]
+      # @!attribute lm_key?
+      #   Also known as +flags_g?+
+      #   @return [Boolean]
+      # @!attribute datagram?
+      #   Also known as +flags_f?+
+      #   @return [Boolean]
+      # @!attribute seal?
+      #   Also known as +flags_e?+
+      #   @return [Boolean]
+      # @!attribute sign?
+      #   Also known as +flags_d?+
+      #   @return [Boolean]
+      # @!attribute request_target?
+      #   Also known as +flags_c?+
+      #   @return [Boolean]
+      # @!attribute oem?
+      #   Also known as +flags_b?+
+      #   @return [Boolean]
+      # @!attribute unicode?
+      #   Also known as +flags_a?+
+      #   @return [Boolean]
+      define_negotiate_flags
+      # @!endgroup Negotiate flags
+
+      # @!attribute domain_name
+      #  Name of the client authentication domain. Must be OEM encoded.
+      #  @return [PacketGen::Types::String]
+      # @!attribute domain_name_len
+      #  2-byte domain name length
+      #  @return [Integer]
+      # @!attribute domain_name_maxlen
+      #  2-byte domain name max length
+      #  @return [Integer]
+      # @!attribute domain_name_offset
+      #  4-byte domain name offset
+      #  @return [Integer]
+      define_in_payload :domain_name, PacketGen::Types::String
+
+      # @!attribute workstation
+      #  Name of the client machine. Must be OEM encoded.
+      #  @return [PacketGen::Types::String]
+      # @!attribute workstation_len
+      #  2-byte workstation length
+      #  @return [Integer]
+      # @!attribute workstation_maxlen
+      #  2-byte workstation max length
+      #  @return [Integer]
+      # @!attribute workstation_offset
+      #  4-byte workstation offset
+      #  @return [Integer]
+      define_in_payload :workstation, PacketGen::Types::String
+
+      # @!attribute version
+      #  8-byte version information
+      #  @return [String]
+      define_field_before :payload, :version, PacketGen::Types::String, static_length: 8, default: VOID_VERSION
+    end
+  end
+end

data/lib/packetgen/plugin/ntlm/ntlmv2_response.rb

@@ -0,0 +1,59 @@
+# This file is part of packetgen-plugin-smb.
+# See https://github.com/sdaubert/packetgen-plugin-smb for more informations
+# Copyright (C) 2018 Sylvain Daubert <sylvain.daubert@laposte.net>
+# This program is published under MIT license.
+
+# frozen_string_literal: true
+
+module PacketGen::Plugin
+  class NTLM
+    class Ntlmv2Response < PacketGen::Types::Fields
+      # @!attribute response
+      #   16-byte array of unsigned char containing the client's NT challenge
+      #   response.
+      #   @return [String]
+      define_field :response, PacketGen::Types::String, static_length: 16
+      alias ntproof_str response
+      alias ntproof_str= response=
+
+      # @!attribute type
+      #   8-bit current version of the challenge. Should be 1.
+      #   @return [Integer]
+      define_field :type, PacketGen::Types::Int8, default: 1
+      # @!attribute hi_type
+      #   8-bit maximum supported version of the challenge. Should be 1.
+      #   @return [Integer]
+      define_field :hi_type, PacketGen::Types::Int8, default: 1
+      # @!attribute reserved1
+      #   16-bit reserved word.
+      #   @return [Integer]
+      define_field :reserved1, PacketGen::Types::Int16le
+      # @!attribute reserved2
+      #   32-bit reserved word.
+      #   @return [Integer]
+      define_field :reserved2, PacketGen::Types::Int32le
+      # @!attribute timestamp
+      #   64-bit current system time.
+      #   @return [SMB::Filetime]
+      define_field :timestamp, SMB::Filetime
+      # @!attribute client_challenge
+      #   8-byte challenge from client
+      #   @return [String]
+      define_field :client_challenge, PacketGen::Types::String, static_length: 8
+      # @!attribute reserved3
+      #   32-bit reserved word.
+      #   @return [Integer]
+      define_field :reserved3, PacketGen::Types::Int32le
+      # @!attribute avpairs
+      #   @return [ArrayOfAvPair]
+      define_field :avpairs, ArrayOfAvPair
+
+      # @return [false]
+      def empty?
+        false
+      end
+
+      alias size sz
+    end
+  end
+end

data/lib/packetgen/plugin/smb/filetime.rb

@@ -22,6 +22,12 @@ module PacketGen::Plugin
       # String to parse time
       PARSE_TIME_STR = '%Y-%m-%d %H:%M:%S.%N %Z'
 
+      # Return a new Filetime object initialized to current time.
+      # @return [Filetime]
+      def self.now
+        new(time: Time.now.utc)
+      end
+
       # @param [Hash] options
       # @option options [Integer] :filetime
       # @option options [Time] :time

data/lib/packetgen/plugin/smb/negotiate/response.rb

@@ -3,7 +3,7 @@ module PacketGen::Plugin
     module Negotiate
       # SMB Negotiation Response header.
       #
-      # See also {Blocks}, as {Negotiate::Rersponse} is a specialization of {Blocks#words}
+      # See also {Blocks}, as {Negotiate::Response} is a specialization of {Blocks#words}
       # and {Blocks#bytes}.
       # @author Sylvain Daubert
       class Response < Blocks

data/lib/packetgen/plugin/smb/string.rb

@@ -7,22 +7,28 @@
 
 module PacketGen::Plugin
   class SMB
-    # SMB strings (UTF-16 little-endian).
+    # SMB strings (UTF-16 little-endian or OEM).
     # @author Sylvain Daubert
     class String < PacketGen::Types::CString
       # @param [Boolean] value
       # @return [Boolean]
       attr_writer :unicode
+      # @param [Boolean] null_terminated
+      # @return [Boolean]
+      attr_writer :null_terminated
 
       # @param [Hash] options
       # @option options [Integer] :static_length set a static length for this string
       # @option options [Boolean] :unicode If +true+, string is encoded as a UTF-16
       #    unicode string. If +false+, string is encode in ASCII. Defaults to +true+.
+      # @option options [Boolean] :null_terminated If +true+, string is null-terminated.
+      #    If +false+, string is not null-terminated. Defaults to +true+.
       def initialize(options={})
         super
         @unicode = options.key?(:unicode) ? options[:unicode] : true
-        self.encode!('UTF-16LE') if @unicode
-        self.encode!('ASCII-8BIT') unless @unicode
+        @null_terminated = options.key?(:null_terminated) ? options[:null_terminated] : true
+        encoding = unicode? ? 'UTF-16LE' : 'ASCII-8BIT'
+        self.encode!(encoding)
       end
 
       # @return [Boolean]
@@ -30,6 +36,11 @@ module PacketGen::Plugin
         @unicode
       end
 
+      # @return [Boolean]
+      def null_terminated?
+        @null_terminated
+      end
+
       # @param [::String] str
       # @return [String] self
       def read(str)
@@ -57,6 +68,20 @@ module PacketGen::Plugin
         self
       end
 
+      # @return [String]
+      def to_s
+        s = super
+        s.encode(self_encoding)
+        return s if null_terminated?
+
+        s[0...-binary_terminator.size]
+      end
+
+      # @return [String]
+      def to_human
+        super.encode('UTF-8')
+      end
+
       private
 
       def self_encoding

data/lib/packetgen/plugin/smb2/negotiate/response.rb

@@ -184,8 +184,12 @@ module PacketGen::Plugin
         def calc_length
           self[:pad].read SMB2::MAX_PADDING
 
-          self.buffer_offset = SMB2::HEADER_SIZE + offset_of(:buffer)
           self.buffer_length = self[:buffer].sz
+          self.buffer_offset = if self.buffer_length.zero?
+                                 0
+                               else
+                                 SMB2::HEADER_SIZE + offset_of(:buffer)
+                               end
 
           self.context_offset = 0
           unless context_list.empty?

data/lib/packetgen/plugin/smb2/session_setup/request.rb

@@ -84,8 +84,12 @@ module PacketGen::Plugin
         # Calculate and set {#buffer_length} and {#buffer_offset} fields.
         # @return [void]
         def calc_length
-          self.buffer_offset = SMB2.new.sz + offset_of(:buffer)
           self.buffer_length = self[:buffer].sz
+          self.buffer_offset = if self.buffer_length.zero?
+                                 0
+                               else
+                                 SMB2.new.sz + offset_of(:buffer)
+                               end
         end
 
         # Protocol name

data/lib/packetgen/plugin/smb2/session_setup/response.rb

@@ -55,8 +55,12 @@ module PacketGen::Plugin
         # Calculate and set {#buffer_length} and {#buffer_offset} fields.
         # @return [void]
         def calc_length
-          self.buffer_offset = SMB2.new.sz + offset_of(:buffer)
           self.buffer_length = self[:buffer].sz
+          self.buffer_offset = if self.buffer_length.zero?
+                                 0
+                               else
+                                 SMB2.new.sz + offset_of(:buffer)
+                               end
         end
 
         # Protocol name

data/lib/packetgen/plugin/smb_version.rb

@@ -1,5 +1,5 @@
 module PacketGen
   module Plugin
-    SMB_VERSION = "0.5.0"
+    SMB_VERSION = "0.6.0"
   end
 end

data/packetgen-plugin-smb.gemspec

@@ -14,16 +14,21 @@ Gem::Specification.new do |spec|
   spec.files         = `git ls-files -z`.split("\x0").reject do |f|
     f.match(%r{^(test|spec|features)/})
   end
-  spec.require_paths = ['lib']
+  spec.bindir = 'bin'
+  spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.require_paths = %w[lib]
 
   spec.required_ruby_version = '>= 2.3.0'
 
-  spec.add_dependency 'packetgen', '~>3.0', '>= 3.0.2'
+  spec.add_dependency 'packetgen', '~>3.1', '>=3.1.2'
   spec.add_dependency 'rasn1', '~>0.6', '>= 0.6.8'
 
-  spec.add_development_dependency 'bundler', '~> 1.16'
+  spec.add_development_dependency 'bundler', '~> 1.17.3'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec', '~> 3.7'
   spec.add_development_dependency 'simplecov', '~> 0.16'
   spec.add_development_dependency 'yard', '~> 0.9'
+
+  #spec.add_development_dependency 'ruby-debug-ide'
+  #spec.add_development_dependency 'debase'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: packetgen-plugin-smb
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Sylvain Daubert
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-18 00:00:00.000000000 Z
+date: 2019-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: packetgen
@@ -16,20 +16,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.2
+        version: 3.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.2
+        version: 3.1.2
 - !ruby/object:Gem::Dependency
   name: rasn1
   requirement: !ruby/object:Gem::Requirement
@@ -56,14 +56,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: 1.17.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: 1.17.3
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -134,6 +134,8 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- examples/llmnr-responder
+- examples/smb-responder
 - lib/packetgen-plugin-smb.rb
 - lib/packetgen/plugin/gssapi.rb
 - lib/packetgen/plugin/llmnr.rb
@@ -141,6 +143,12 @@ files:
 - lib/packetgen/plugin/netbios/datagram.rb
 - lib/packetgen/plugin/netbios/name.rb
 - lib/packetgen/plugin/netbios/session.rb
+- lib/packetgen/plugin/ntlm.rb
+- lib/packetgen/plugin/ntlm/authenticate.rb
+- lib/packetgen/plugin/ntlm/av_pair.rb
+- lib/packetgen/plugin/ntlm/challenge.rb
+- lib/packetgen/plugin/ntlm/negotiate.rb
+- lib/packetgen/plugin/ntlm/ntlmv2_response.rb
 - lib/packetgen/plugin/smb.rb
 - lib/packetgen/plugin/smb/blocks.rb
 - lib/packetgen/plugin/smb/browser.rb
@@ -194,7 +202,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.7.6.2
 signing_key: 
 specification_version: 4
 summary: SMB plugin for packetgen.