00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022 #ifndef _SMB_H
00023 #define _SMB_H
00024 #define _CRT_SECURE_NO_DEPRECATE
00025 #include "ntlm.h"
00026 #define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF))
00027
00028 #define SMBPACKETLEN(x) ((x->SmbMessageLength) +4 )
00029
00030 #define GetDceRpcPacketFromBuffer(buf) ((DceRpcBind*)(char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (SMB_COM_TRANSACTION_STRUCT*)((smheader*)buf)->buffer)->TotalDataCount))
00031
00032
00033
00034 #define SMB_COM_CREATE_DIRECTORY 0x00
00035 #define SMB_COM_DELETE_DIRECTORY 0x01
00036 #define SMB_COM_OPEN 0x02
00037 #define SMB_COM_CREATE 0x03
00038 #define SMB_COM_CLOSE 0x04
00039 #define SMB_COM_FLUSH 0x05
00040 #define SMB_COM_DELETE 0x06
00041 #define SMB_COM_RENAME 0x07
00042 #define SMB_COM_QUERY_INFORMATION 0x08
00043 #define SMB_COM_SET_INFORMATION 0x09
00044 #define SMB_COM_READ 0x0A
00045 #define SMB_COM_WRITE 0x0B
00046 #define SMB_COM_LOCK_BYTE_RANGE 0x0C
00047 #define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
00048 #define SMB_COM_CREATE_TEMPORARY 0x0E
00049 #define SMB_COM_CREATE_NEW 0x0F
00050 #define SMB_COM_CHECK_DIRECTORY 0x10
00051 #define SMB_COM_PROCESS_EXIT 0x11
00052 #define SMB_COM_SEEK 0x12
00053 #define SMB_COM_LOCK_AND_READ 0x13
00054 #define SMB_COM_WRITE_AND_UNLOCK 0x14
00055 #define SMB_COM_READ_RAW 0x1A
00056 #define SMB_COM_READ_MPX 0x1B
00057 #define SMB_COM_READ_MPX_SECONDARY 0x1C
00058 #define SMB_COM_WRITE_RAW 0x1D
00059 #define SMB_COM_WRITE_MPX 0x1E
00060 #define SMB_COM_WRITE_COMPLETE 0x20
00061 #define SMB_COM_SET_INFORMATION2 0x22
00062 #define SMB_COM_QUERY_INFORMATION2 0x23
00063 #define SMB_COM_LOCKING_ANDX 0x24
00064 #define SMB_COM_TRANSACTION 0x25
00065 #define SMB_COM_TRANSACTION_SECONDARY 0x26
00066
00067 #define SMB_COM_IOCTL 0x27
00068 #define SMB_COM_IOCTL_SECONDARY 0x28
00069 #define SMB_COM_COPY 0x29
00070 #define SMB_COM_MOVE 0x2A
00071 #define SMB_COM_ECHO 0x2B
00072 #define SMB_COM_WRITE_AND_CLOSE 0x2C
00073 #define SMB_COM_OPEN_ANDX 0x2D
00074 #define SMB_COM_READ_ANDX 0x2E
00075 #define SMB_COM_WRITE_ANDX 0x2F
00076 #define SMB_COM_CLOSE_AND_TREE_DISC 0x31
00077 #define SMB_COM_TRANSACTION2 0x32
00078 #define SMB_COM_TRANSACTION2_SECONDARY 0x33
00079 #define SMB_COM_FIND_CLOSE2 0x34
00080 #define SMB_COM_FIND_NOTIFY_CLOSE 0x35
00081 #define SMB_COM_TREE_CONNECT 0x70
00082 #define SMB_COM_TREE_DISCONNECT 0x71
00083 #define SMB_COM_NEGOTIATE 0x72
00084 #define SMB_COM_SESSION_SETUP_ANDX 0x73
00085 #define SMB_COM_LOGOFF_ANDX 0x74
00086 #define SMB_COM_TREE_CONNECT_ANDX 0x75
00087
00088 #define SMB_COM_QUERY_INFORMATION_DISK 0x80
00089 #define SMB_COM_SEARCH 0x81
00090 #define SMB_COM_FIND 0x82
00091 #define SMB_COM_FIND_UNIQUE 0x83
00092 #define SMB_COM_NT_TRANSACT 0xA0
00093 #define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
00094 #define SMB_COM_NT_CREATE_ANDX 0xA2
00095 #define SMB_COM_NT_CANCEL 0xA4
00096 #define SMB_COM_OPEN_PRINT_FILE 0xC0
00097 #define SMB_COM_WRITE_PRINT_FILE 0xC1
00098 #define SMB_COM_CLOSE_PRINT_FILE 0xC2
00099 #define SMB_COM_GET_PRINT_QUEUE 0xC3
00100
00101 #define SMB_COM_READ_BULK 0xD8
00102 #define SMB_COM_WRITE_BULK 0xD9
00103 #define SMB_COM_WRITE_BULK_DATA 0xDA
00104
00105
00106
00107 #define SMBCLOSE 0x04
00108
00109 #define READANDX 0x2e
00110 #define WRITEANDX 0x2f
00111 #define FINDFIRST2 0x32
00112 #define NEGOTIATEPROTOCOLREQUEST 0x72
00113 #define SESSIONSETUPANDX 0x73
00114 #define SESSIONLOGOFF 0x74
00115 #define TREECONNETANDX 0x75
00116 #define NTCREATEANDX 0xa2
00117
00118
00119
00120 #define STOPSERVICE 1
00121 #define CHANGESERVICECONFIG 11
00122 #define CREATESERVICE 12
00123 #define OPENSCMANAGER 15
00124 #define OPENSERVICEW 16
00125 #define STARTSERVICE 19
00126 #define OPENSERVICEA 28
00127
00128
00129
00130
00131 #define CONTINUERESPONSE 1
00132 #define ERRORRESPONSE 2
00133
00134
00135 #define RPCBIND 0x0b
00136
00137 #define RPC_RESPONSE (uint8)0x02
00138
00139 #define STATUS_SHARING_VIOLATION 0xc0000043
00140 #define STATUS_BAD_NETWORK_NAME 0xcc
00141
00142
00143 #ifndef WCHAR
00144 #ifdef WIN32
00145 typedef wchar_t WCHAR;
00146 #else
00147 typedef unsigned short WCHAR;
00148 #endif
00149 #endif
00150
00151
00152
00153
00154
00155
00156
00157
00158
00159 typedef struct {
00160 uint16 SmbMessageType;
00161 uint16 SmbMessageLength;
00162 uint8 ProtocolHeader[4];
00163 uint8 SmbCommand;
00164 uint32 NtStatus;
00165 uint8 flags;
00166 uint16 flags2;
00167 uint16 ProcessIDHigh;
00168 uint8 signature[8];
00169 uint16 reserved;
00170 uint16 TreeId;
00171 uint16 ProccessID;
00172 uint16 UserID;
00173 uint16 multipleID;
00174 char buffer[16384];
00175 } smheader;
00176
00177
00178 typedef struct {
00179 uint8 VersionMayor;
00180 uint8 VersionMinor;
00181 uint8 PacketType;
00182 uint8 PacketFlags;
00183 uint32 DataRepresentation;
00184 uint16 FragmentLength;
00185 uint16 AuthLength;
00186 uint32 CallID;
00187 uint32 AllocHint;
00188 uint16 ContextID;
00189 uint16 OpNum;
00190 } DceRpcRequest;
00191
00192
00193 typedef struct {
00194 uint32 ReferentID;
00195 uint32 MaxCount;
00196 uint32 Offset;
00197 uint32 ActualCount;
00198
00199 uint16 lpFileNameW[256];
00200 uint32 Database;
00201 uint32 AccessMask;
00202 } MSCStruct;
00203
00204
00205 typedef struct {
00206 uint8 uuid[16];
00207 uint16 MayorVersion;
00208 uint16 MinorVersion;
00209
00210 } DceInterface;
00211
00212 typedef struct {
00213 uint16 ContextID;
00214 uint8 NumberOfTransItems;
00215 uint8 padding;
00216 DceInterface AbstractSyntaxis;
00217 DceInterface TransferSyntaxis;
00218 } CtxItem;
00219
00220 typedef struct {
00221 uint8 VersionMayor;
00222 uint8 VersionMinor;
00223 uint8 PacketType;
00224 uint8 PacketFlags;
00225 uint32 DataRepresentation;
00226 uint16 FragmentLength;
00227 uint16 AuthLength;
00228 uint32 CallID;
00229 uint16 MaxXmitFragment;
00230 uint16 MaxRecvFragment;
00231 uint32 AssocGroup;
00232 uint8 NumberOfCtx;
00233 uint8 padding[3];
00234 } DceRpcBind;
00235
00236 typedef struct {
00237 uint8 WordCount;
00238 uint16 TotalParameterCount;
00239 uint16 TotalDataCount;
00240 uint16 MaxParameterCount;
00241 uint16 MaxDataCount;
00242 uint8 MaxSetupCount;
00243 uint8 reserved;
00244 uint16 flags;
00245 uint32 timeout;
00246 uint16 reserved2;
00247 uint16 ParameterCount;
00248 uint16 ParameterOffset;
00249 uint16 DataCount;
00250 uint16 DataOffset;
00251 uint8 SetupCount;
00252 uint8 reserved3;
00253 uint16 Function;
00254 uint16 FID;
00255 uint16 ByteCount;
00256 uint8 padding;
00257 uint8 TransactionName[14];
00258 uint16 padding2;
00259
00260
00261 } SMB_COM_TRANSACTION_STRUCT;
00262
00263
00264
00265
00266
00267 typedef struct {
00268 uint8 ContextHandle[20];
00269 uint32 ServiceType;
00270 uint32 StartType;
00271 uint32 unknown1;
00272 uint16 unknown2;
00273 uint16 unknown3;
00274 uint32 MaxLenLow;
00275 uint32 MaxLenHigh;
00276 uint32 Lenght;
00277 uint8 buffer[1024];
00278 uint8 blank[32];
00279
00280
00281
00282
00283
00284
00285
00286
00287
00288
00289
00290
00291
00292
00293
00294
00295
00296
00297
00298
00299
00300
00301
00302
00303
00304
00305
00306
00307
00308
00309 } ChangeServiceConfigWStruct;
00310
00311
00312
00313 typedef struct {
00314 uint8 WordCount;
00315 uint8 AndXCommand;
00316 uint8 reserved2;
00317 uint16 AndXOffset;
00318 uint16 FID;
00319 uint32 Offset;
00320 uint32 reserved;
00321 uint16 WriteMode;
00322 uint16 Remaining;
00323 uint16 DataLengthHigh;
00324 uint16 DataLengthLow;
00325
00326 uint16 DataOffset;
00327 uint32 HighOffset;
00328 uint16 ByteCount;
00329 uint8 Padding;
00330 } WriteAndX;
00331
00332 typedef struct {
00333 uint8 WordCount;
00334 uint8 AndXCommand;
00335 uint8 reserved2;
00336 uint16 AndXOffset;
00337 uint16 FID;
00338 uint32 offset;
00339 uint16 MaxCountLow;
00340 uint16 MinCount;
00341 uint32 reserved;
00342 uint16 remaining;
00343 uint32 HighOffset;
00344 uint16 ByteCount;
00345 } ReadAndX;
00346
00347
00348 typedef struct {
00349 uint8 WordCount;
00350 uint8 AndXCommand;
00351 uint8 reserved2;
00352 uint16 AndXOffset;
00353
00354 uint16 MaxBuffer;
00355 uint16 MaxMpxCount;
00356 uint16 VcNumber;
00357 uint32 SessionKey;
00358 uint16 SecurityBloblength;
00359 uint32 reserved3;
00360 uint32 capabilities;
00361 uint16 ByteCount;
00362 } SessionSetupAndX;
00363
00364 typedef struct {
00365 uint8 WordCount;
00366 uint8 AndXCommand;
00367 uint8 reserved2;
00368 uint16 AndXOffset;
00369 uint16 Action;
00370 uint16 SecurityBloblength;
00371 uint16 ByteCount;
00372
00373 } SessionSetupAndXResponse;
00374
00375
00376
00377
00378
00379
00380
00381
00382 typedef struct {
00383 uint8 BufferFormat;
00384 char *Name;
00385 } DIALECT;
00386
00387
00388 typedef struct {
00389 uint8 WordCount;
00390 uint16 ByteCount;
00391
00392 char *Dialects;
00393 } NegotiateProtocolRequest;
00394
00395 typedef struct {
00396 uint8 WordCount;
00397 uint16 DialecIndex;
00398 uint8 SecurityMode;
00399 uint16 MaxMxpCount;
00400 uint16 MaxVcs;
00401 uint32 MaxBufferSize;
00402 uint32 MaxRawBuffer;
00403 uint32 SessionKey;
00404 uint32 Capabilities;
00405
00406 uint8 ServerTime[8];
00407 uint16 ServerTimeZone;
00408 uint8 KeyLength;
00409 uint16 ByteCount;
00410 uint8 ServerGuid[16];
00411 } NegotiateProtocolResponse;
00412
00413
00414 typedef struct {
00415 uint8 WordCount;
00416 uint8 AndXCommand;
00417 uint8 reserved2;
00418 uint16 AndXOffset;
00419 uint16 flags;
00420 uint16 PasswordLen;
00421 uint16 ByteCount;
00422 uint8 Password;
00423
00424
00425 } TreeConnectAndX;
00426
00427 typedef struct {
00428 uint8 WordCount;
00429 uint16 ByteCount;
00430 } TreeConnectAndXResponse;
00431
00432
00433 typedef struct {
00434 uint8 WordCount;
00435 uint16 TotalParameterCount;
00436 uint16 TotalDataCount;
00437 uint16 MaxParameterCount;
00438 uint16 MaxDataCount;
00439 uint8 MaxSetupCount;
00440 uint8 reserved;
00441 uint16 flags;
00442 uint32 timeout;
00443 uint16 reserved2;
00444 uint16 ParameterCount;
00445 uint16 ParameterOffset;
00446 uint16 DataCount;
00447 uint16 DataOffset;
00448 uint8 SetupCount;
00449 uint8 reserved3;
00450 uint16 SubCommand;
00451 uint16 ByteCount;
00452
00453 uint8 padding[3];
00454 uint16 SearchAttributes;
00455 uint16 SearchCount;
00456 uint16 Searchflags;
00457 uint16 LevelOfInterest;
00458 uint32 StorageType;
00459 uint8 *SearchPattern;
00460
00461
00462
00463 } FIND_FIRST2;
00464
00465
00466
00467
00468
00469
00470
00471
00472
00473
00474
00475
00476
00477
00478 typedef struct {
00479 uint8 WordCount;
00480 uint16 FID;
00481 uint32 LastWrite;
00482 uint16 ByteCount;
00483 } CLOSE;
00484
00485 typedef struct {
00486 uint8 WordCount;
00487 uint8 AndXCommand;
00488 uint8 reserved1;
00489 uint16 AndXOffset;
00490 uint8 reserved2;
00491 uint16 FilenameLen;
00492 uint32 CreationFlags;
00493 uint32 RootFID;
00494 uint32 AccessMask;
00495 uint32 AllocationSize;
00496 uint32 AllocationSizeHigh;
00497 uint32 FileAttributes;
00498 uint32 ShareAccess;
00499 uint32 Disposition;
00500 uint32 CreateOptions;
00501 uint32 Impersonation;
00502 uint8 SecurityFlags;
00503 uint16 ByteCount;
00504 uint8 padding;
00505 } NTCreateAndX;
00506
00507
00508 typedef struct {
00509 uint32 MaxLenLow;
00510 uint32 MaxLenHigh;
00511 uint32 Lenght;
00512 uint8 data[1024];
00513 } DataBlock;
00514
00515 typedef struct {
00516 uint8 ContextHandle[20];
00517 DataBlock ServiceName;
00518 uint32 unknown;
00519 DataBlock ServiceDescription;
00520 uint32 unknown1;
00521 uint32 ServiceType;
00522 uint32 StartType;
00523 uint32 unknown2;
00524 DataBlock path;
00525 uint8 blank[28];
00526 } CreateServiceWStruct;
00527
00528 typedef struct {
00529 uint8 ContextHandle[20];
00530
00531
00532
00533
00534
00535
00536
00537 DataBlock ServiceName;
00538
00539 uint32 flags;
00540 } OpenServiceAStruct;
00541
00542
00543 #ifndef WIN32
00544 #define SERVICE_QUERY_CONFIG 1
00545 #define SERVICE_CHANGE_CONFIG 2
00546 #define SERVICE_QUERY_STATUS 4
00547 #define SERVICE_ENUMERATE_DEPENDENTS 8
00548 #define SERVICE_START 16
00549 #define SERVICE_STOP 32
00550 #define SERVICE_PAUSE_CONTINUE 64
00551 #define SERVICE_INTERROGATE 128
00552 #define SERVICE_USER_DEFINED_CONTROL 256
00553 #define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SERVICE_QUERY_CONFIG|SERVICE_CHANGE_CONFIG|SERVICE_QUERY_STATUS|SERVICE_ENUMERATE_DEPENDENTS|SERVICE_START|SERVICE_STOP|SERVICE_PAUSE_CONTINUE|SERVICE_INTERROGATE|SERVICE_USER_DEFINED_CONTROL)
00554
00555 #define SC_MANAGER_ALL_ACCESS 0xf003f
00556 #define SC_MANAGER_CONNECT 1
00557 #define SC_MANAGER_CREATE_SERVICE 2
00558 #define SC_MANAGER_ENUMERATE_SERVICE 4
00559 #define SC_MANAGER_LOCK 8
00560 #define SC_MANAGER_QUERY_LOCK_STATUS 16
00561 #define SC_MANAGER_MODIFY_BOOT_CONFIG 32
00562
00563
00564 #define SERVICE_WIN32_OWN_PROCESS 0x00000010
00565 #define SERVICE_WIN32_SHARE_PROCESS 0x00000020
00566
00567
00568 #define SERVICE_BOOT_START 0x00000000
00569 #define SERVICE_SYSTEM_START 0x00000001
00570 #define SERVICE_AUTO_START 0x00000002
00571 #define SERVICE_DEMAND_START 0x00000003
00572 #define SERVICE_DISABLED 0x00000004
00573 #endif
00574
00575
00576 smheader *BuildSmbPacket(smheader *PreviousSmbMessage,uint8 SmbCommand,uint8 SubCommand, void *data, int DataSize);
00577
00578
00579 int CreateServiceWStub(char *destionation,char *ContextHandle,char *ServiceName, char *ServiceDescription,char *path, int StartType, int ServiceType);
00580 int ChangeServiceConfigWStub(char *destionation,char *ContextHandle,char *path, int StartType, int ServiceType);
00581 int OpenServiceWStub(char *destionation,char *ContextHandle,char *servicename, int flags);
00582 int OpenScManagerWStub(char *destionation, char *data, int flags);
00583
00584 int BuildTreeConnectAndXStub(char *destination,char *password, char *resource, char *service);
00585
00586 char *AddDialect(char *data, char *name, uint8 type, int *PacketSize);
00587
00588 #ifdef WIN32
00589 CtxItem *AddBinddingInformation(CtxItem *CurrentCtx, char *Abstract, char *Transfer, int MayorVersion, int MinorVersion,int *PacketSize);
00590 #endif
00591 void SetEnviroment(uint16 sessionUserID, uint16 sessionTreeID, uint16 sessionFID);
00592 #endif
00593
00594