rapid7 / ruby_smb

A native Ruby implementation of the SMB Protocol Family
Other
81 stars 83 forks source link

Fix the default offsets for create_request fields #187

Closed zeroSteiner closed 2 years ago

zeroSteiner commented 2 years ago

In PR #181 the name and context fields of the SMB 2/3 create request were updated to delayed_io fields. When that happened the initial value of their respective offsets was removed. This PR adds that calculation back in.

Without this issue, create requests would fail. This problem manifests itself by way of psexec failures within Metasploit.

To test this, use these changes and run the psexec module. It should work. Without these changes, one of the following two exceptions may be seen depending on the negotiated version of SMB.

msf6 exploit(windows/smb/psexec) > exploit

[*] Started reverse TCP handler on 192.168.250.134:4444 
[*] 192.168.159.41:445 - Connecting to the server...
[*] 192.168.159.41:445 - Authenticating to 192.168.159.41:445 as user 'Spencer McIntyre'...
[-] 192.168.159.41:445 - Exploit failed: RubySMB::Error::EncryptionError Error while decrypting RubySMB::SMB2::Packet::TransformHeader packet (SMB 0x0311}): Error while decrypting with 'AES-128-CCM' (OpenSSL::Cipher::CipherError: OpenSSL::Cipher::CipherError)
[*] Exploit completed, but no session was created.
msf6 exploit(windows/smb/psexec) > set SMB::PROTOCOLVERSION 2
SMB::PROTOCOLVERSION => 2
msf6 exploit(windows/smb/psexec) > exploit

[*] Started reverse TCP handler on 192.168.250.134:4444 
[*] 192.168.159.41:445 - Connecting to the server...
[*] 192.168.159.41:445 - Authenticating to 192.168.159.41:445 as user 'Spencer McIntyre'...
[*] 192.168.159.41:445 - Selecting native target
[!] 192.168.159.41:445 - peer_native_os is only available with SMB1 (current version: SMB2)
[*] 192.168.159.41:445 - Uploading payload... nvgblQXX.exe
[-] 192.168.159.41:445 - Exploit failed: RubySMB::Error::UnexpectedStatusCode The server responded with an unexpected status code: STATUS_INVALID_PARAMETER
[*] Exploit completed, but no session was created.
msf6 exploit(windows/smb/psexec) >
adfoster-r7 commented 2 years ago

Confirmed this fixes the spotted psexec issue :+1: