search

jfjallid / go-smb

A client library to interact with Windows RPC services such as MS-SRVS and MS-RRP.
MIT License
40 stars 9 forks source link

SMB: NegotiateProtocol function working unexpected #11

Closed XiaoliChan closed 6 months ago

XiaoliChan commented 6 months ago

A bug I found

github.com/jfjallid/go-smb/smb.(*Connection).NegotiateProtocol(0xc001120000)                                                                                                                               
        github.com/jfjallid/go-smb@v0.3.4/smb/session.go:185 +0x1ba5                                                                                                                                       
github.com/jfjallid/go-smb/smb.NewConnection({{0xc0004fc030, 0xc}, 0x1bd, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, ...}, ...})                                                                            
        github.com/jfjallid/go-smb@v0.3.4/smb/connection.go:368 +0x73d                                                                                                                                     
main/Plugins.SMBv2_NTLMInfo(0xc0006943c0)                                                                                                                                                            
        main/Plugins/smb.go:123 +0x158
main/Plugins.SMBScan(0x1?)                                                                                                                                                                           
        main/Plugins/smb.go:26 +0x78                                                           
reflect.Value.call({0xfbc380?, 0x1432e90?, 0x13?}, {0x1164e94, 0x4}, {0xc001104f78, 0x1, 0x1?})      
        reflect/value.go:586 +0xb07                                                                                                                                                                        
reflect.Value.Call({0xfbc380?, 0x1432e90?, 0xc0004fc03d?}, {0xc000c62778?, 0xc000c627b8?, 0x1?})                                                                                                           
        reflect/value.go:370 +0xbc                                                                                                                                                                         
main/Plugins.ScanFunc(0x43f705?, 0xc0006943c0)                                                                                                                                                       
        main/Plugins/scanner.go:160 +0x196                                                                                                                                                           
main/Plugins.AddScan.func1()                                                                                                                                                                         
        main/Plugins/scanner.go:148 +0xb7  
created by main/Plugins.AddScan
        main/Plugins/scanner.go:144 +0x18c

Easy to reproduce, just run a smb server with impacket's smbserver.py with command sudo smbserver.py a $(pwd) -username a -password a -smb2support

Version 0.3.2 has no issues

jfjallid commented 6 months ago

Did you encounter this error against something other than the impacket smbserver? As far as I can tell, the impacket implementation of the SMB server is incorrect in its handling of multi-protocol negotiation (which I implemented in version 0.3.3).

My library sends an initial SMB negotiate protocol request and suggests a dialect of SMB 2.??? and the correct response from a server should either be to terminate the connection if SMB 2.1 or higher is unsupported, or to respond with a dialect of SMB2 wildcard (0x2ff) which triggers a new protocol negotiation but this time using SMB2.

jfjallid commented 6 months ago

Added a fix in version 0.3.6 where the library will now attempt to renegotiate using SMB2 even when receiving an invalid response.

XiaoliChan commented 6 months ago

Confirm issues has been solved, issue close