#include "ntlm.h"
Go to the source code of this file.
Data Structures | |
| struct | smheader |
| struct | DceRpcRequest |
| struct | MSCStruct |
| struct | DceInterface |
| struct | CtxItem |
| struct | DceRpcBind |
| struct | SMB_COM_TRANSACTION_STRUCT |
| struct | ChangeServiceConfigWStruct |
| struct | WriteAndX |
| struct | ReadAndX |
| struct | SessionSetupAndX |
| struct | SessionSetupAndXResponse |
| struct | DIALECT |
| struct | NegotiateProtocolRequest |
| struct | NegotiateProtocolResponse |
| struct | TreeConnectAndX |
| struct | TreeConnectAndXResponse |
| struct | FIND_FIRST2 |
| struct | CLOSE |
| struct | NTCreateAndX |
| struct | DataBlock |
| struct | CreateServiceWStruct |
| struct | OpenServiceAStruct |
Defines | |
| #define | _CRT_SECURE_NO_DEPRECATE |
| #define | SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF)) |
| #define | SMBPACKETLEN(x) ((x->SmbMessageLength) +4 ) |
| #define | GetDceRpcPacketFromBuffer(buf) ((DceRpcBind*)(char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (SMB_COM_TRANSACTION_STRUCT*)((smheader*)buf)->buffer)->TotalDataCount)) |
| #define | SMB_COM_CREATE_DIRECTORY 0x00 |
| #define | SMB_COM_DELETE_DIRECTORY 0x01 |
| #define | SMB_COM_OPEN 0x02 |
| #define | SMB_COM_CREATE 0x03 |
| #define | SMB_COM_CLOSE 0x04 |
| #define | SMB_COM_FLUSH 0x05 |
| #define | SMB_COM_DELETE 0x06 |
| #define | SMB_COM_RENAME 0x07 |
| #define | SMB_COM_QUERY_INFORMATION 0x08 |
| #define | SMB_COM_SET_INFORMATION 0x09 |
| #define | SMB_COM_READ 0x0A |
| #define | SMB_COM_WRITE 0x0B |
| #define | SMB_COM_LOCK_BYTE_RANGE 0x0C |
| #define | SMB_COM_UNLOCK_BYTE_RANGE 0x0D |
| #define | SMB_COM_CREATE_TEMPORARY 0x0E |
| #define | SMB_COM_CREATE_NEW 0x0F |
| #define | SMB_COM_CHECK_DIRECTORY 0x10 |
| #define | SMB_COM_PROCESS_EXIT 0x11 |
| #define | SMB_COM_SEEK 0x12 |
| #define | SMB_COM_LOCK_AND_READ 0x13 |
| #define | SMB_COM_WRITE_AND_UNLOCK 0x14 |
| #define | SMB_COM_READ_RAW 0x1A |
| #define | SMB_COM_READ_MPX 0x1B |
| #define | SMB_COM_READ_MPX_SECONDARY 0x1C |
| #define | SMB_COM_WRITE_RAW 0x1D |
| #define | SMB_COM_WRITE_MPX 0x1E |
| #define | SMB_COM_WRITE_COMPLETE 0x20 |
| #define | SMB_COM_SET_INFORMATION2 0x22 |
| #define | SMB_COM_QUERY_INFORMATION2 0x23 |
| #define | SMB_COM_LOCKING_ANDX 0x24 |
| #define | SMB_COM_TRANSACTION 0x25 |
| #define | SMB_COM_TRANSACTION_SECONDARY 0x26 |
| #define | SMB_COM_IOCTL 0x27 |
| #define | SMB_COM_IOCTL_SECONDARY 0x28 |
| #define | SMB_COM_COPY 0x29 |
| #define | SMB_COM_MOVE 0x2A |
| #define | SMB_COM_ECHO 0x2B |
| #define | SMB_COM_WRITE_AND_CLOSE 0x2C |
| #define | SMB_COM_OPEN_ANDX 0x2D |
| #define | SMB_COM_READ_ANDX 0x2E |
| #define | SMB_COM_WRITE_ANDX 0x2F |
| #define | SMB_COM_CLOSE_AND_TREE_DISC 0x31 |
| #define | SMB_COM_TRANSACTION2 0x32 |
| #define | SMB_COM_TRANSACTION2_SECONDARY 0x33 |
| #define | SMB_COM_FIND_CLOSE2 0x34 |
| #define | SMB_COM_FIND_NOTIFY_CLOSE 0x35 |
| #define | SMB_COM_TREE_CONNECT 0x70 |
| #define | SMB_COM_TREE_DISCONNECT 0x71 |
| #define | SMB_COM_NEGOTIATE 0x72 |
| #define | SMB_COM_SESSION_SETUP_ANDX 0x73 |
| #define | SMB_COM_LOGOFF_ANDX 0x74 |
| #define | SMB_COM_TREE_CONNECT_ANDX 0x75 |
| #define | SMB_COM_QUERY_INFORMATION_DISK 0x80 |
| #define | SMB_COM_SEARCH 0x81 |
| #define | SMB_COM_FIND 0x82 |
| #define | SMB_COM_FIND_UNIQUE 0x83 |
| #define | SMB_COM_NT_TRANSACT 0xA0 |
| #define | SMB_COM_NT_TRANSACT_SECONDARY 0xA1 |
| #define | SMB_COM_NT_CREATE_ANDX 0xA2 |
| #define | SMB_COM_NT_CANCEL 0xA4 |
| #define | SMB_COM_OPEN_PRINT_FILE 0xC0 |
| #define | SMB_COM_WRITE_PRINT_FILE 0xC1 |
| #define | SMB_COM_CLOSE_PRINT_FILE 0xC2 |
| #define | SMB_COM_GET_PRINT_QUEUE 0xC3 |
| #define | SMB_COM_READ_BULK 0xD8 |
| #define | SMB_COM_WRITE_BULK 0xD9 |
| #define | SMB_COM_WRITE_BULK_DATA 0xDA |
| #define | SMBCLOSE 0x04 |
| #define | READANDX 0x2e |
| #define | WRITEANDX 0x2f |
| #define | FINDFIRST2 0x32 |
| #define | NEGOTIATEPROTOCOLREQUEST 0x72 |
| #define | SESSIONSETUPANDX 0x73 |
| #define | SESSIONLOGOFF 0x74 |
| #define | TREECONNETANDX 0x75 |
| #define | NTCREATEANDX 0xa2 |
| #define | STOPSERVICE 1 |
| #define | CHANGESERVICECONFIG 11 |
| #define | CREATESERVICE 12 |
| #define | OPENSCMANAGER 15 |
| #define | OPENSERVICEW 16 |
| #define | STARTSERVICE 19 |
| #define | OPENSERVICEA 28 |
| #define | CONTINUERESPONSE 1 |
| #define | ERRORRESPONSE 2 |
| #define | RPCBIND 0x0b |
| #define | RPC_RESPONSE (uint8)0x02 |
| #define | STATUS_SHARING_VIOLATION 0xc0000043 |
| #define | STATUS_BAD_NETWORK_NAME 0xcc |
| #define | SERVICE_QUERY_CONFIG 1 |
| #define | SERVICE_CHANGE_CONFIG 2 |
| #define | SERVICE_QUERY_STATUS 4 |
| #define | SERVICE_ENUMERATE_DEPENDENTS 8 |
| #define | SERVICE_START 16 |
| #define | SERVICE_STOP 32 |
| #define | SERVICE_PAUSE_CONTINUE 64 |
| #define | SERVICE_INTERROGATE 128 |
| #define | SERVICE_USER_DEFINED_CONTROL 256 |
| #define | SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SERVICE_QUERY_CONFIG|SERVICE_CHANGE_CONFIG|SERVICE_QUERY_STATUS|SERVICE_ENUMERATE_DEPENDENTS|SERVICE_START|SERVICE_STOP|SERVICE_PAUSE_CONTINUE|SERVICE_INTERROGATE|SERVICE_USER_DEFINED_CONTROL) |
| #define | SC_MANAGER_ALL_ACCESS 0xf003f |
| #define | SC_MANAGER_CONNECT 1 |
| #define | SC_MANAGER_CREATE_SERVICE 2 |
| #define | SC_MANAGER_ENUMERATE_SERVICE 4 |
| #define | SC_MANAGER_LOCK 8 |
| #define | SC_MANAGER_QUERY_LOCK_STATUS 16 |
| #define | SC_MANAGER_MODIFY_BOOT_CONFIG 32 |
| #define | SERVICE_WIN32_OWN_PROCESS 0x00000010 |
| #define | SERVICE_WIN32_SHARE_PROCESS 0x00000020 |
| #define | SERVICE_BOOT_START 0x00000000 |
| #define | SERVICE_SYSTEM_START 0x00000001 |
| #define | SERVICE_AUTO_START 0x00000002 |
| #define | SERVICE_DEMAND_START 0x00000003 |
| #define | SERVICE_DISABLED 0x00000004 |
Typedefs | |
| typedef unsigned short | WCHAR |
Functions | |
| smheader * | BuildSmbPacket (smheader *PreviousSmbMessage, uint8 SmbCommand, uint8 SubCommand, void *data, int DataSize) |
| int | CreateServiceWStub (char *destionation, char *ContextHandle, char *ServiceName, char *ServiceDescription, char *path, int StartType, int ServiceType) |
| int | ChangeServiceConfigWStub (char *destionation, char *ContextHandle, char *path, int StartType, int ServiceType) |
| int | OpenServiceWStub (char *destionation, char *ContextHandle, char *servicename, int flags) |
| int | OpenScManagerWStub (char *destionation, char *data, int flags) |
| int | BuildTreeConnectAndXStub (char *destination, char *password, char *resource, char *service) |
| char * | AddDialect (char *data, char *name, uint8 type, int *PacketSize) |
| void | SetEnviroment (uint16 sessionUserID, uint16 sessionTreeID, uint16 sessionFID) |
| #define CHANGESERVICECONFIG 11 |
| #define CONTINUERESPONSE 1 |
Definition at line 131 of file smb.h.
Referenced by BuildSmbPacket(), and HandleIncommingSmbRequest().
| #define CREATESERVICE 12 |
| #define ERRORRESPONSE 2 |
Definition at line 132 of file smb.h.
Referenced by BuildSmbPacket(), and HandleIncommingSmbRequest().
| #define FINDFIRST2 0x32 |
| #define GetDceRpcPacketFromBuffer | ( | buf | ) | ((DceRpcBind*)(char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (SMB_COM_TRANSACTION_STRUCT*)((smheader*)buf)->buffer)->TotalDataCount)) |
| #define NEGOTIATEPROTOCOLREQUEST 0x72 |
Definition at line 112 of file smb.h.
Referenced by BuildSmbPacket(), HandleIncommingHTTPRequest(), HandleIncommingIMAPRequest(), HandleIncommingPOP3Request(), HandleIncommingSmbRequest(), HandleIncommingSMTPRequest(), and StablishNTLMSession().
| #define NTCREATEANDX 0xa2 |
Definition at line 116 of file smb.h.
Referenced by BuildSmbPacket(), ExecuteCode(), and WriteRemoteFile().
| #define OPENSCMANAGER 15 |
| #define OPENSERVICEW 16 |
| #define READANDX 0x2e |
| #define RPC_RESPONSE (uint8)0x02 |
| #define RPCBIND 0x0b |
| #define SC_MANAGER_CONNECT 1 |
| #define SC_MANAGER_CREATE_SERVICE 2 |
| #define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SERVICE_QUERY_CONFIG|SERVICE_CHANGE_CONFIG|SERVICE_QUERY_STATUS|SERVICE_ENUMERATE_DEPENDENTS|SERVICE_START|SERVICE_STOP|SERVICE_PAUSE_CONTINUE|SERVICE_INTERROGATE|SERVICE_USER_DEFINED_CONTROL) |
| #define SERVICE_AUTO_START 0x00000002 |
| #define SERVICE_CHANGE_CONFIG 2 |
| #define SERVICE_START 16 |
| #define SERVICE_STOP 32 |
| #define SERVICE_WIN32_OWN_PROCESS 0x00000010 |
| #define SERVICE_WIN32_SHARE_PROCESS 0x00000020 |
| #define SESSIONLOGOFF 0x74 |
| #define SESSIONSETUPANDX 0x73 |
Definition at line 113 of file smb.h.
Referenced by BuildSmbPacket(), BuildSmbPacket1(), GetSmbPacket3(), HandleIncommingHTTPRequest(), HandleIncommingIMAPRequest(), HandleIncommingPOP3Request(), HandleIncommingSmbRequest(), and HandleIncommingSMTPRequest().
| #define SMB_COM_CHECK_DIRECTORY 0x10 |
| #define SMB_COM_CLOSE_AND_TREE_DISC 0x31 |
| #define SMB_COM_CLOSE_PRINT_FILE 0xC2 |
| #define SMB_COM_COPY 0x29 |
| #define SMB_COM_CREATE 0x03 |
| #define SMB_COM_CREATE_DIRECTORY 0x00 |
| #define SMB_COM_CREATE_NEW 0x0F |
| #define SMB_COM_CREATE_TEMPORARY 0x0E |
| #define SMB_COM_DELETE 0x06 |
| #define SMB_COM_DELETE_DIRECTORY 0x01 |
| #define SMB_COM_ECHO 0x2B |
| #define SMB_COM_FIND 0x82 |
| #define SMB_COM_FIND_CLOSE2 0x34 |
| #define SMB_COM_FIND_NOTIFY_CLOSE 0x35 |
| #define SMB_COM_FIND_UNIQUE 0x83 |
| #define SMB_COM_FLUSH 0x05 |
| #define SMB_COM_GET_PRINT_QUEUE 0xC3 |
| #define SMB_COM_IOCTL 0x27 |
| #define SMB_COM_IOCTL_SECONDARY 0x28 |
| #define SMB_COM_LOCK_AND_READ 0x13 |
| #define SMB_COM_LOCK_BYTE_RANGE 0x0C |
| #define SMB_COM_LOCKING_ANDX 0x24 |
| #define SMB_COM_LOGOFF_ANDX 0x74 |
| #define SMB_COM_MOVE 0x2A |
| #define SMB_COM_NT_CANCEL 0xA4 |
| #define SMB_COM_NT_TRANSACT 0xA0 |
| #define SMB_COM_NT_TRANSACT_SECONDARY 0xA1 |
| #define SMB_COM_OPEN 0x02 |
| #define SMB_COM_OPEN_ANDX 0x2D |
| #define SMB_COM_OPEN_PRINT_FILE 0xC0 |
| #define SMB_COM_PROCESS_EXIT 0x11 |
| #define SMB_COM_QUERY_INFORMATION 0x08 |
| #define SMB_COM_QUERY_INFORMATION2 0x23 |
| #define SMB_COM_QUERY_INFORMATION_DISK 0x80 |
| #define SMB_COM_READ 0x0A |
| #define SMB_COM_READ_BULK 0xD8 |
| #define SMB_COM_READ_MPX 0x1B |
| #define SMB_COM_READ_MPX_SECONDARY 0x1C |
| #define SMB_COM_READ_RAW 0x1A |
| #define SMB_COM_RENAME 0x07 |
| #define SMB_COM_SEARCH 0x81 |
| #define SMB_COM_SEEK 0x12 |
| #define SMB_COM_SET_INFORMATION 0x09 |
| #define SMB_COM_SET_INFORMATION2 0x22 |
| #define SMB_COM_TRANSACTION 0x25 |
Definition at line 64 of file smb.h.
Referenced by AttackWeakServices(), BuildSmbPacket(), and ExecuteCode().
| #define SMB_COM_TRANSACTION2_SECONDARY 0x33 |
| #define SMB_COM_TRANSACTION_SECONDARY 0x26 |
| #define SMB_COM_TREE_CONNECT 0x70 |
| #define SMB_COM_TREE_DISCONNECT 0x71 |
| #define SMB_COM_UNLOCK_BYTE_RANGE 0x0D |
| #define SMB_COM_WRITE 0x0B |
| #define SMB_COM_WRITE_AND_CLOSE 0x2C |
| #define SMB_COM_WRITE_AND_UNLOCK 0x14 |
| #define SMB_COM_WRITE_BULK 0xD9 |
| #define SMB_COM_WRITE_BULK_DATA 0xDA |
| #define SMB_COM_WRITE_COMPLETE 0x20 |
| #define SMB_COM_WRITE_MPX 0x1E |
| #define SMB_COM_WRITE_PRINT_FILE 0xC1 |
| #define SMB_COM_WRITE_RAW 0x1D |
| #define SMBCLOSE 0x04 |
| #define STARTSERVICE 19 |
| #define STATUS_BAD_NETWORK_NAME 0xcc |
| #define STATUS_SHARING_VIOLATION 0xc0000043 |
| #define TREECONNETANDX 0x75 |
Definition at line 115 of file smb.h.
Referenced by BuildSmbPacket(), ExecuteCode(), and WriteRemoteFile().
| #define WRITEANDX 0x2f |
Definition at line 110 of file smb.h.
Referenced by BuildSmbPacket(), ExecuteCode(), and WriteRemoteFile().
| char* AddDialect | ( | char * | data, | |
| char * | name, | |||
| uint8 | type, | |||
| int * | PacketSize | |||
| ) |
Definition at line 175 of file smb.cpp.
Referenced by HandleIncommingHTTPRequest(), HandleIncommingIMAPRequest(), HandleIncommingPOP3Request(), HandleIncommingSmbRequest(), HandleIncommingSMTPRequest(), and StablishNTLMSession().
| smheader* BuildSmbPacket | ( | smheader * | PreviousSmbMessage, | |
| uint8 | SmbCommand, | |||
| uint8 | SubCommand, | |||
| void * | data, | |||
| int | DataSize | |||
| ) |
Definition at line 218 of file smb.cpp.
References smheader::buffer, chartoWide(), CONTINUERESPONSE, ERRORRESPONSE, FINDFIRST2, MultpleID, NEGOTIATEPROTOCOLREQUEST, NTCREATEANDX, READANDX, RPCBIND, SESSIONSETUPANDX, SMB_COM_CHECK_DIRECTORY, SMB_COM_CLOSE_AND_TREE_DISC, SMB_COM_CLOSE_PRINT_FILE, SMB_COM_COPY, SMB_COM_CREATE, SMB_COM_CREATE_DIRECTORY, SMB_COM_CREATE_NEW, SMB_COM_CREATE_TEMPORARY, SMB_COM_DELETE, SMB_COM_DELETE_DIRECTORY, SMB_COM_ECHO, SMB_COM_FIND, SMB_COM_FIND_CLOSE2, SMB_COM_FIND_NOTIFY_CLOSE, SMB_COM_FIND_UNIQUE, SMB_COM_FLUSH, SMB_COM_GET_PRINT_QUEUE, SMB_COM_IOCTL, SMB_COM_IOCTL_SECONDARY, SMB_COM_LOCK_AND_READ, SMB_COM_LOCK_BYTE_RANGE, SMB_COM_LOCKING_ANDX, SMB_COM_LOGOFF_ANDX, SMB_COM_MOVE, SMB_COM_NT_CANCEL, SMB_COM_NT_TRANSACT, SMB_COM_NT_TRANSACT_SECONDARY, SMB_COM_OPEN, SMB_COM_OPEN_ANDX, SMB_COM_OPEN_PRINT_FILE, SMB_COM_PROCESS_EXIT, SMB_COM_QUERY_INFORMATION, SMB_COM_QUERY_INFORMATION2, SMB_COM_QUERY_INFORMATION_DISK, SMB_COM_READ, SMB_COM_READ_BULK, SMB_COM_READ_MPX, SMB_COM_READ_MPX_SECONDARY, SMB_COM_READ_RAW, SMB_COM_RENAME, SMB_COM_SEARCH, SMB_COM_SEEK, SMB_COM_SET_INFORMATION, SMB_COM_SET_INFORMATION2, SMB_COM_TRANSACTION, SMB_COM_TRANSACTION2_SECONDARY, SMB_COM_TRANSACTION_SECONDARY, SMB_COM_TREE_CONNECT, SMB_COM_TREE_DISCONNECT, SMB_COM_UNLOCK_BYTE_RANGE, SMB_COM_WRITE, SMB_COM_WRITE_AND_CLOSE, SMB_COM_WRITE_AND_UNLOCK, SMB_COM_WRITE_BULK, SMB_COM_WRITE_BULK_DATA, SMB_COM_WRITE_COMPLETE, SMB_COM_WRITE_MPX, SMB_COM_WRITE_PRINT_FILE, SMB_COM_WRITE_RAW, SMBCLOSE, SREV, STATUS_BAD_NETWORK_NAME, TREECONNETANDX, smheader::UserID, UserID, and WRITEANDX.
Referenced by AttackWeakServices(), BuildSmbPacket1(), ExecuteCode(), GetSmbPacket3(), HandleIncommingHTTPRequest(), HandleIncommingIMAPRequest(), HandleIncommingPOP3Request(), HandleIncommingSmbRequest(), HandleIncommingSMTPRequest(), StablishNTLMSession(), and WriteRemoteFile().
| int BuildTreeConnectAndXStub | ( | char * | destination, | |
| char * | password, | |||
| char * | resource, | |||
| char * | service | |||
| ) |
Definition at line 156 of file smb.cpp.
References TreeConnectAndX::AndXCommand, TreeConnectAndX::AndXOffset, smheader::buffer, TreeConnectAndX::ByteCount, chartoWide(), TreeConnectAndX::flags, TreeConnectAndX::Password, TreeConnectAndX::PasswordLen, TreeConnectAndX::reserved2, and TreeConnectAndX::WordCount.
Referenced by ExecuteCode(), and WriteRemoteFile().
| int ChangeServiceConfigWStub | ( | char * | destionation, | |
| char * | ContextHandle, | |||
| char * | path, | |||
| int | StartType, | |||
| int | ServiceType | |||
| ) |
Definition at line 82 of file smb.cpp.
References chartoWide().
Referenced by AttackWeakServices().
| int CreateServiceWStub | ( | char * | destionation, | |
| char * | ContextHandle, | |||
| char * | ServiceName, | |||
| char * | ServiceDescription, | |||
| char * | path, | |||
| int | StartType, | |||
| int | ServiceType | |||
| ) |
Definition at line 48 of file smb.cpp.
References InitDataBlock().
Referenced by ExecuteCode().
| int OpenScManagerWStub | ( | char * | destionation, | |
| char * | data, | |||
| int | flags | |||
| ) |
Definition at line 125 of file smb.cpp.
References MSCStruct::AccessMask, MSCStruct::ActualCount, chartoWide(), MSCStruct::Database, MSCStruct::lpFileNameW, MSCStruct::MaxCount, MSCStruct::Offset, and MSCStruct::ReferentID.
Referenced by AttackWeakServices(), and ExecuteCode().
| int OpenServiceWStub | ( | char * | destionation, | |
| char * | ContextHandle, | |||
| char * | servicename, | |||
| int | flags | |||
| ) |
Definition at line 99 of file smb.cpp.
References InitDataBlock().
Referenced by AttackWeakServices(), and ExecuteCode().
1.5.4