diff --git a/packets.py b/packets.py index f27bc4a..9939af0 100644 --- a/packets.py +++ b/packets.py @@ -1611,42 +1611,6 @@ class SMB2Session2Data(Packet): ]) -######################FindSMBTime.py########################## -class SMBHeaderReq(Packet): - fields = OrderedDict([ - ("Proto", "\xff\x53\x4d\x42"), - ("Cmd", "\x72"), - ("Error-Code", "\x00\x00\x00\x00" ), - ("Flag1", "\x10"), - ("Flag2", "\x00\x00"), - ("Pidhigh", "\x00\x00"), - ("Signature", "\x00\x00\x00\x00\x00\x00\x00\x00"), - ("Reserved", "\x00\x00"), - ("TID", "\x00\x00"), - ("PID", "\xff\xfe"), - ("UID", "\x00\x00"), - ("MID", "\x00\x00"), - ]) - -class SMB2NegoReq(Packet): - fields = OrderedDict([ - ("Wordcount", "\x00"), - ("Bcc", "\x62\x00"), - ("Data", "") - ]) - - def calculate(self): - self.fields["Bcc"] = StructWithLenPython2or3("i", len(''.join(payload))) return length +def ParseNegotiateSMB2Ans(data): + if data[4:8] == b"\xfeSMB": + return True + else: + return False + +def SMB2SigningMandatory(data): + global SMB2signing + if data[70] == "\x03": + SMB2signing = "True" + else: + SMB2signing = "False" + +def WorkstationFingerPrint(data): + return { + b"\x04\x00" :"Windows 95", + b"\x04\x0A" :"Windows 98", + b"\x04\x5A" :"Windows ME", + b"\x05\x00" :"Windows 2000", + b"\x05\x01" :"Windows XP", + b"\x05\x02" :"Windows XP(64-Bit)/Windows 2003", + b"\x06\x00" :"Windows Vista/Server 2008", + b"\x06\x01" :"Windows 7/Server 2008R2", + b"\x06\x02" :"Windows 8/Server 2012", + b"\x06\x03" :"Windows 8.1/Server 2012R2", + b"\x0A\x00" :"Windows 10/Server 2016/2019 (check build)", + }.get(data, 'Other than Microsoft') + +def GetOsBuildNumber(data): + ProductBuild = struct.unpack("