Refactor SessionSetupAndx handler

kernelsmith · Feb 28, 2015 · 1d602d3 · 1d602d3
1 parent 544f886
commit 1d602d3
Showing 1 changed file with 35 additions and 12 deletions.
diff --git a/lib/msf/core/exploit/smb/server/share/command/session_setup_andx.rb b/lib/msf/core/exploit/smb/server/share/command/session_setup_andx.rb
@@ -19,26 +19,49 @@ def smb_cmd_session_setup(c, buff)
             tree_connect_response.v['GuestAccessRights'] = 0
             tree_connect_response.v['Payload'] = "A:\x00#{Rex::Text.to_unicode('NTFS')}\x00\x00"
 
+            data = Rex::Text.to_unicode('Unix', 'utf-16be') + "\x00\x00" + # Native OS # Samba signature
+              Rex::Text.to_unicode('Samba 3.4.7', 'utf-16be') + "\x00\x00" + # Native LAN Manager # Samba signature
+              Rex::Text.to_unicode('WORKGROUP', 'utf-16be') + "\x00\x00\x00" # Primary DOMAIN # Samba signature
+
+            send_session_setup_andx_res(c, {
+              action: CONST::SMB_SETUP_GUEST,
+              data: data,
+              andx: CONST::SMB_COM_TREE_CONNECT_ANDX,
+              andx_offset: 96,
+              andx_command: tree_connect_response
+            })
+          end
+
+          def send_session_setup_andx_res(c, opts = {})
+            action = opts[:action] || 0
+            andx_offset = opts[:andx_offset] || 0
+            reserved = opts[:reserved] || 0
+            andx = opts[:andx] || CONST::SMB_COM_NO_ANDX_COMMAND
+            data = opts[:data] || ''
+            andx_command = opts[:andx_command] || nil
+
+
             pkt = CONST::SMB_SETUP_RES_PKT.make_struct
             smb_set_defaults(c, pkt)
 
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_SESSION_SETUP_ANDX
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
             pkt['Payload']['SMB'].v['WordCount'] = 3
-            pkt['Payload'].v['AndX'] = CONST::SMB_COM_TREE_CONNECT_ANDX
-            pkt['Payload'].v['Reserved1'] = 00
-            pkt['Payload'].v['AndXOffset'] = 96
-            pkt['Payload'].v['Action'] = CONST::SMB_SETUP_GUEST
-            pkt['Payload'].v['Payload'] =
-              Rex::Text.to_unicode('Unix', 'utf-16be') + "\x00\x00" + # Native OS # Samba signature
-              Rex::Text.to_unicode('Samba 3.4.7', 'utf-16be') + "\x00\x00" + # Native LAN Manager # Samba signature
-              Rex::Text.to_unicode('WORKGROUP', 'utf-16be') + "\x00\x00\x00" # Primary DOMAIN # Samba signature
+            pkt['Payload'].v['AndX'] = andx
+            pkt['Payload'].v['Reserved1'] = reserved
+            pkt['Payload'].v['AndXOffset'] = andx_offset
+            pkt['Payload'].v['Action'] = action
+            pkt['Payload'].v['Payload'] = data
 
-            full_pkt = pkt.to_s + tree_connect_response.to_s
-            original_length = full_pkt[2, 2].unpack('n')[0]
-            original_length = original_length +  tree_connect_response.to_s.length
-            full_pkt[2, 2] = [original_length].pack('n')
+            if andx_command
+              full_pkt = pkt.to_s + andx_command.to_s
+              original_length = full_pkt[2, 2].unpack('n')[0]
+              original_length = original_length +  andx_command.to_s.length
+              full_pkt[2, 2] = [original_length].pack('n')
+            else
+              full_pkt = pkt.to_s
+            end
 
             c.put(full_pkt)
           end