rex 1.0.2 → 2.0.2

data/lib/rex/proto/dcerpc/handle.rb

@@ -0,0 +1,48 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+class Handle
+
+  require 'rex/proto/dcerpc/uuid'
+
+  @@protocols = ['ncacn_ip_tcp', 'ncacn_ip_udp', 'ncacn_np', 'ncacn_http']
+  attr_accessor :uuid, :protocol, :address, :options
+
+  # instantiate a handle object, akin to Microsoft's string binding handle by values
+  def initialize(uuid, protocol, address, options)
+    raise ArgumentError if !Rex::Proto
+    raise ArgumentError if !Rex::Proto::DCERPC::UUID.is?(uuid[0])
+    raise ArgumentError if !@@protocols.include?(protocol)
+    self.uuid = uuid
+    self.protocol = protocol
+    self.address = address
+    self.options = options
+  end
+
+  # instantiate a handle object, by parsing a string binding handle
+  def self.parse (handle)
+    uuid_re = '[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}'
+    rev_re = '\d+.\d+'
+    proto_re = '(?:' + @@protocols.join('|') + ')'
+    re = Regexp.new("(#{uuid_re}):(#{rev_re})\@(#{proto_re}):(.*?)\\[(.*)\\]$", true, 'n')
+    match = re.match(handle)
+    raise ArgumentError if !match
+
+    uuid = [match[1], match[2]]
+    protocol = match[3]
+    address = match[4]
+    options = match[5].split(',')
+    i = Rex::Proto::DCERPC::Handle.new(uuid, protocol, address, options)
+    return i
+  end
+
+  # stringify a handle
+  def to_s
+    self.uuid.join(':') + '@' + self.protocol + ':' + self.address + '[' + self.options.join(', ') + ']'
+  end
+
+end
+end
+end
+end

data/lib/rex/proto/dcerpc/ndr.rb

@@ -0,0 +1,73 @@
+# -*- coding: binary -*-
+require "rex/text"
+
+module Rex
+module Proto
+module DCERPC
+class NDR
+
+
+  # Provide padding to align the string to the 32bit boundary
+  def self.align(string)
+    warn 'should be using Rex::Encoder::NDR'
+    return "\x00" * ((4 - (string.length & 3)) & 3)
+  end
+
+  # Encode a 4 byte long
+  # use to encode:
+  #       long element_1;
+  def self.long(string)
+    warn 'should be using Rex::Encoder::NDR'
+    return [string].pack('V')
+  end
+
+  # Encode a 2 byte short
+  # use to encode:
+  #       short element_1;
+  def self.short(string)
+    warn 'should be using Rex::Encoder::NDR'
+    return [string].pack('v')
+  end
+
+  # Encode a single byte
+  # use to encode:
+  #       byte element_1;
+  def self.byte(string)
+    warn 'should be using Rex::Encoder::NDR'
+    return [string].pack('C')
+  end
+
+  # Encode a byte array
+  # use to encode:
+  #       char  element_1
+  def self.UniConformantArray(string)
+    warn 'should be using Rex::Encoder::NDR'
+    return long(string.length) + string + align(string)
+  end
+
+  # Encode a string
+  # use to encode:
+  #       w_char *element_1;
+  def self.UnicodeConformantVaryingString(string)
+    warn 'should be using Rex::Encoder::NDR'
+    string += "\x00" # null pad
+    return long(string.length) + long(0) + long(string.length) + Rex::Text.to_unicode(string) + align(Rex::Text.to_unicode(string))
+  end
+
+  # Encode a string that is already unicode encoded
+  # use to encode:
+  #       w_char *element_1;
+  def self.UnicodeConformantVaryingStringPreBuilt(string)
+    warn 'should be using Rex::Encoder::NDR'
+    # if the string len is odd, thats bad!
+    if string.length % 2 > 0
+      string += "\x00"
+    end
+    len = string.length / 2;
+    return long(len) + long(0) + long(len) + string + align(string)
+  end
+
+end
+end
+end
+end

data/lib/rex/proto/dcerpc/packet.rb

@@ -0,0 +1,264 @@
+# -*- coding: binary -*-
+module Rex
+module Proto
+module DCERPC
+class Packet
+
+require 'rex/proto/dcerpc/uuid'
+require 'rex/proto/dcerpc/response'
+require 'rex/text'
+
+  UUID = Rex::Proto::DCERPC::UUID
+
+  # Create a standard DCERPC BIND request packet
+  def self.make_bind(uuid, vers, xfer_syntax_uuid=UUID.xfer_syntax_uuid, xfer_syntax_vers=UUID.xfer_syntax_vers)
+
+    # Process the version strings ("1.0", 1.0, "1", 1)
+    bind_vers_maj, bind_vers_min = UUID.vers_to_nums(vers)
+    xfer_vers_maj, xfer_vers_min = UUID.vers_to_nums(xfer_syntax_vers)
+
+    if UUID.is? xfer_syntax_uuid
+      xfer_syntax_uuid = UUID.uuid_pack(xfer_syntax_uuid)
+    end
+
+    # Create the bind request packet
+    buff =
+    [
+      5,      # major version 5
+      0,      # minor version 0
+      11,     # bind type
+      3,      # flags
+      0x10000000,  # data representation
+      72,     # frag length
+      0,      # auth length
+      0,      # call id
+      5840,   # max xmit frag
+      5840,   # max recv frag
+      0,      # assoc group
+      1,      # num ctx items
+      0,      # context id
+      1,      # num trans items
+      UUID.uuid_pack(uuid),   # interface uuid
+      bind_vers_maj,       # interface major version
+      bind_vers_min,       # interface minor version
+      xfer_syntax_uuid,  # transfer syntax
+      xfer_vers_maj,       # syntax major version
+      xfer_vers_min,       # syntax minor version
+    ].pack('CCCCNvvVvvVVvvA16vvA16vv')
+
+    return buff, 0
+  end
+
+  # Create an obfuscated DCERPC BIND request packet
+  def self.make_bind_fake_multi(uuid, vers, bind_head=0, bind_tail=0)
+
+    bind_head = bind_head.to_i
+    bind_tail = bind_tail.to_i
+    bind_head = rand(6)+10 if bind_head == 0
+    bind_tail = rand(4)+1 if bind_head == 0
+
+    u = Rex::Proto::DCERPC::UUID
+
+    # Process the version strings ("1.0", 1.0, "1", 1)
+    bind_vers_maj, bind_vers_min = UUID.vers_to_nums(vers)
+    xfer_vers_maj, xfer_vers_min = UUID.vers_to_nums(UUID.xfer_syntax_vers)
+
+    bind_total = bind_head + bind_tail + 1
+    bind_size  = (bind_total * 44) + 28
+    real_ctx, ctx = 0, 0
+
+    # Create the header of the bind request
+    data =
+    [
+      5,      # major version 5
+      0,      # minor version 0
+      11,     # bind type
+      3,      # flags
+      0x10000000,  # data representation
+      bind_size,   # frag length
+      0,      # auth length
+      0,      # call id
+      5840,   # max xmit frag
+      5840,   # max recv frag
+      0,      # assoc group
+      bind_total,  # num ctx items
+    ].pack('CCCCNvvVvvVV')
+
+    # Generate the fake UUIDs prior to the real one
+    1.upto(bind_head) do ||
+      # Generate some random UUID and versions
+      rand_uuid = Rex::Text.rand_text(16)
+      rand_imaj = rand(6)
+      rand_imin = rand(4)
+
+      data +=
+      [
+        ctx,        # context id
+        1,          # num trans items
+        rand_uuid,  # interface uuid
+        rand_imaj,  # interface major version
+        rand_imin,  # interface minor version
+        UUID.xfer_syntax_uuid,  # transfer syntax
+        xfer_vers_maj,       # syntax major version
+        xfer_vers_min,       # syntax minor version
+      ].pack('vvA16vvA16vv')
+      ctx += 1
+    end
+
+    # Stuff the real UUID onto the end of the buffer
+    real_ctx = ctx;
+    data +=
+    [
+      ctx,      # context id
+      1,        # num trans items
+      UUID.uuid_pack(uuid),   # interface uuid
+      bind_vers_maj,       # interface major version
+      bind_vers_min,       # interface minor version
+      UUID.xfer_syntax_uuid,  # transfer syntax
+      xfer_vers_maj,       # syntax major version
+      xfer_vers_min,       # syntax minor version
+    ].pack('vvA16vvA16vv')
+    ctx += 1
+
+
+    # Generate the fake UUIDs after the real one
+    1.upto(bind_tail) do ||
+      # Generate some random UUID and versions
+      rand_uuid = Rex::Text.rand_text(16)
+      rand_imaj = rand(6)
+      rand_imin = rand(4)
+
+      data +=
+      [
+        ctx,        # context id
+        1,          # num trans items
+        rand_uuid,  # interface uuid
+        rand_imaj,  # interface major version
+        rand_imin,  # interface minor version
+        UUID.xfer_syntax_uuid,  # transfer syntax
+        xfer_vers_maj,       # syntax major version
+        xfer_vers_min,       # syntax minor version
+      ].pack('vvA16vvA16vv')
+      ctx += 1
+    end
+
+    # Return both the bind packet and the real context_id
+    return data, real_ctx
+  end
+
+  # Create a standard DCERPC ALTER_CONTEXT request packet
+  def self.make_alter_context(uuid, vers)
+    u = Rex::Proto::DCERPC::UUID
+
+    # Process the version strings ("1.0", 1.0, "1", 1)
+    bind_vers_maj, bind_vers_min = UUID.vers_to_nums(vers)
+    xfer_vers_maj, xfer_vers_min = UUID.vers_to_nums(UUID.xfer_syntax_vers)
+
+    buff =
+    [
+      5,      # major version 5
+      0,      # minor version 0
+      14,     # alter context
+      3,      # flags
+      0x10000000,     # data representation
+      72,     # frag length
+      0,      # auth length
+      0,      # call id
+      5840,   # max xmit frag
+      5840,   # max recv frag
+      0,      # assoc group
+      1,      # num ctx items
+      0,      # context id
+      1,      # num trans items
+      UUID.uuid_pack(uuid),   # interface uuid
+      bind_vers_maj,       # interface major version
+      bind_vers_min,       # interface minor version
+      UUID.xfer_syntax_uuid,  # transfer syntax
+      xfer_vers_maj,       # syntax major version
+      xfer_vers_min,       # syntax minor version
+    ].pack('CCCCNvvVvvVVvvA16vvA16vv')
+  end
+
+
+  # Used to create a piece of a DCERPC REQUEST packet
+  def self.make_request_chunk(flags=3, opnum=0, data="", ctx=0, object_id = '')
+
+    flags = flags.to_i
+    opnum = opnum.to_i
+    ctx   = ctx.to_i
+
+    dlen = data.length
+    flen = dlen + 24
+
+    use_object = 0
+
+    object_str = ''
+
+    if object_id.size > 0
+      flags |= 0x80
+      flen = flen + 16
+      object_str = UUID.uuid_pack(object_id)
+    end
+
+    buff =
+    [
+      5,      # major version 5
+      0,      # minor version 0
+      0,      # request type
+      flags,  # flags
+      0x10000000,     # data representation
+      flen,   # frag length
+      0,      # auth length
+      0,      # call id
+      dlen,   # alloc hint
+      ctx,    # context id
+      opnum,  # operation number
+    ].pack('CCCCNvvVVvv') + object_str + data
+  end
+
+  # Used to create standard DCERPC REQUEST packet(s)
+  def self.make_request(opnum=0, data="", size=data.length, ctx=0, object_id = '')
+
+    opnum = opnum.to_i
+    size  = [4000, size.to_i].min
+    ctx   = ctx.to_i
+
+    chunks, frags = [], []
+    ptr = 0
+
+    # Break the request into fragments of 'size' bytes
+    while ptr < data.length
+      chunks.push( data[ ptr, size ] )
+      ptr += size
+    end
+
+    # Process requests with no stub data
+    if chunks.length == 0
+      frags.push( make_request_chunk(3, opnum, '', ctx, object_id) )
+      return frags
+    end
+
+    # Process requests with only one fragment
+    if chunks.length == 1
+      frags.push( make_request_chunk(3, opnum, chunks[0], ctx, object_id) )
+      return frags
+    end
+
+    # Create the first fragment of the request
+    frags.push( make_request_chunk(1, opnum, chunks.shift, ctx, object_id) )
+
+    # Create all of the middle fragments
+    while chunks.length != 1
+      frags.push( make_request_chunk(0, opnum, chunks.shift, ctx, object_id) )
+    end
+
+    # Create the last fragment of the request
+    frags.push( make_request_chunk(2, opnum, chunks.shift, ctx, object_id) )
+
+    return frags
+  end
+
+end
+end
+end
+end

data/lib/rex/proto/dcerpc/response.rb

@@ -0,0 +1,188 @@
+# -*- coding: binary -*-
+require 'rex/proto/dcerpc/uuid'
+require 'rex/proto/dcerpc/exceptions'
+
+module Rex
+module Proto
+module DCERPC
+class Response
+
+  attr_accessor :frag_len, :auth_len, :type, :vers_major, :vers_minor
+  attr_accessor :flags, :data_rep, :call_id, :max_frag_xmit, :max_frag_recv
+  attr_accessor :assoc_group, :sec_addr_len, :sec_addr, :num_results
+  attr_accessor :nack_reason, :xfer_syntax_uuid, :xfer_syntax_vers
+  attr_accessor :ack_reason, :ack_result, :ack_xfer_syntax_uuid, :ack_xfer_syntax_vers
+  attr_accessor :alloc_hint, :context_id, :cancel_cnt, :status, :stub_data
+  attr_accessor :raw
+
+  # Create a new DCERPC::Response object
+  # This can be initialized in two ways:
+  # 1) Call .new() with the first 10 bytes of packet, then call parse on the rest
+  # 2) Call .new() with the full packet contents
+  def initialize(data)
+
+    self.ack_result = []
+    self.ack_reason = []
+    self.ack_xfer_syntax_uuid = []
+    self.ack_xfer_syntax_vers = []
+
+    if (! data or data.length < 10)
+      raise Rex::Proto::DCERPC::Exceptions::InvalidPacket, 'DCERPC response packet is incomplete'
+    end
+
+    if (data.length == 10)
+      self.frag_len = data[8,2].unpack('v')[0]
+      self.raw = data
+    end
+
+    if (data.length > 10)
+      self.raw = data
+      self.parse
+    end
+  end
+
+  # Parse the contents of a DCERPC response packet and fill out all the fields
+  def parse(body = '')
+    self.raw = self.raw + body
+    self.type = self.raw[2,1].unpack('C')[0]
+
+    uuid = Rex::Proto::DCERPC::UUID
+    data = self.raw
+
+
+    if(not data)
+      raise Rex::Proto::DCERPC::Exceptions::InvalidPacket, 'DCERPC response packet is incomplete'
+    end
+
+    # BIND_ACK == 12, ALTER_CONTEXT_RESP == 15
+    if (self.type == 12 or self.type == 15)
+
+      # Decode most of the DCERPC header
+      self.vers_major,
+      self.vers_minor,
+      trash,
+      self.flags,
+      self.data_rep,
+      self.frag_len,
+      self.auth_len,
+      self.call_id,
+      self.max_frag_xmit,
+      self.max_frag_recv,
+      self.assoc_group,
+      self.sec_addr_len = data.unpack('CCCCNvvVvvVv')
+
+
+      if(not self.frag_len or data.length < self.frag_len)
+        raise Rex::Proto::DCERPC::Exceptions::InvalidPacket, 'DCERPC response packet is incomplete'
+      end
+
+      # Keep an offset into the packet handy
+      x = 0
+
+      # XXX This is still somewhat broken (4 digit ports)
+      self.sec_addr = data[26, self.sec_addr_len]
+
+      # Move the pointer into the packet forward
+      x += 26 + self.sec_addr_len
+
+      # Align the pointer on a dword boundary
+      while (x % 4 != 0)
+        x += 1
+      end
+
+      # Figure out how many results we have (multiple-context binds)
+      self.num_results = data[ x, 4 ].unpack('V')[0]
+
+      # Move the pointer to the ack_result[0] offset
+      x += 4
+
+      # Initialize the ack_result index
+      ack = 0
+
+      # Scan through all results and add them to the result arrays
+      while ack < self.num_results
+        self.ack_result[ack] = data[ x + 0, 2 ].unpack('v')[0]
+        self.ack_reason[ack] = data[ x + 2, 2 ].unpack('v')[0]
+        self.ack_xfer_syntax_uuid[ack] = uuid.uuid_unpack(data[ x + 4, 16 ])
+        self.ack_xfer_syntax_vers[ack] = data[ x + 20, 4 ].unpack('V')[0]
+        x += 24
+        ack += 1
+      end
+
+      # End of BIND_ACK || ALTER_CONTEXT_RESP
+    end
+
+    # BIND_NACK == 13
+    if (self.type == 13)
+
+      # Decode most of the DCERPC header
+      self.vers_major,
+      self.vers_minor,
+      trash,
+      self.flags,
+      self.data_rep,
+      self.frag_len,
+      self.auth_len,
+      self.call_id,
+      self.nack_reason = data.unpack('CCCCNvvVv')
+    end
+
+    # RESPONSE == 2
+    if (self.type == 2)
+
+      # Decode the DCERPC response header
+      self.vers_major,
+      self.vers_minor,
+      trash,
+      self.flags,
+      self.data_rep,
+      self.frag_len,
+      self.auth_len,
+      self.call_id,
+      self.alloc_hint,
+      self.context_id,
+      self.cancel_cnt = data.unpack('CCCCNvvVVvC')
+
+      # Error out if the whole header was not read
+      if !(self.alloc_hint and self.context_id and self.cancel_cnt)
+        raise Rex::Proto::DCERPC::Exceptions::InvalidPacket, 'DCERPC response packet is incomplete'
+      end
+
+      # Put the application data into self.stub_data
+      self.stub_data = data[data.length - self.alloc_hint, 0xffff]
+      # End of RESPONSE
+    end
+
+    # FAULT == 3
+    if (self.type == 3)
+
+      # Decode the DCERPC response header
+      self.vers_major,
+      self.vers_minor,
+      trash,
+      self.flags,
+      self.data_rep,
+      self.frag_len,
+      self.auth_len,
+      self.call_id,
+      self.alloc_hint,
+      self.context_id,
+      self.cancel_cnt,
+      trash,
+      self.status = data.unpack('CCCCNvvVVvCCV')
+
+      # Put the application data into self.stub_data
+      self.stub_data = data[data.length - self.alloc_hint, 0xffff]
+      # End of FAULT
+    end
+
+  end
+
+protected
+#	attr_accessor :raw
+
+end
+end
+end
+end
+