Closed zeroSteiner closed 2 years ago
Tested the MS17-010 exploit successfully to make sure the Trans2 changes were in fact backwards compatible.
I found that listing directory with pushd requires SMB_FIND_FILE_BOTH_DIRECTORY_INFO find information level structure and it is not supported
I'll add SMB_FIND_FILE_BOTH_DIRECTORY_INFO support since Metasploit already has it so it's a feature gap with the existing implementation.
Finally, I would suggest to set the default domain value to an empty string instead of WORKSTATION in RubySMB::Gss::Provider::NTLM. This will accept a local user out-of-the-box. Without this, the user will need to be part of the WORKSTATION domain, which is not really a domain.
Would you mind submitting a PR for this if you'd like to see it changed? It's a bit off topic for here but I did try to change it from WORKSTATION to an empty string and it didn't appear to change anything for me so I'm not sure the intention and don't really want to dig into it here.
smbclient
version 4.3.11 and 4.7.6 sound like they're both failing before the session is established and the user is fully authenticated. That could be a pre-existing issue. Would you mind testing against master and seeing if you can reproduce them? If so it may make sense to track them in another ticket, otherwise I can dig into fixing it here.
I could reproduce the issue against master for both versions. Also, for 4.3.11, there was a typo in my comment: the error actually appears as soon as the NTLMSSP_CHALLENGE
Session Setup packet is received by the client. Anyway, I'll create a ticket for this. Thanks!
Thanks! Everything looks good to me now. I'll create tickets to keep track of some issues highlighted in this PR and land it.
This expands on the work started in #181. It adds SMB 1 protocol support but only for the latest NT LM 0.12 dialect to the SMB file server with sufficient capabilities for reading files.
There were no major architectural changes to comment on this time around.
Supported Features
The following is a combined list of capabilities implemented by this implementation, and the implementation currently offered by the Metasploit Framework which this will hopefully replace in the near future.
SMB1 Commands:
SMB_COM_NEGOTIATE
SMB_COM_SESSION_SETUP_ANDX
SMB_COM_TREE_CONNECT (RubySMB only)
SMB_COM_TRANSACTION2
Subcommands supported:
FIND_FIRST2
Level of interest supported:
Metasploit only[^1])QUERY_FILE_INFORMATION
Level of Interests supported:
QUERY_PATH_INFORMATION
Level of Interests supported:
SMB_COM_NT_CREATE_ANDX
SMB_COM_READ_ANDX
SMB_COM_CLOSE
SMB_COM_TREE_DISCONNECT (RubySMB only)
SMB_COM_LOGOFF (RubySMB only)
Next Steps
Taken from the original work in #181 but prioritized
Add file support for SMB 1 so this server can handle all the versionstools/
maybe?)Tested Scenarios
Start a test server using the existing
examples/file_server.rb
tool. Disable both SMBv2 and SMBv3 with their respective flags.type \\192.168.159.128\public\test.txt
copy \\192.168.159.128\public\test.txt .
rundll32 \\192.168.159.128\public\cmd.x64.dll,main
type \\192.168.159.128\public\test.txt
copy \\192.168.159.128\public\test.txt .
rundll32 \\192.168.159.128\public\cmd.x64.dll,main
ruby examples/read_file.rb --no-smbv2 --no-smbv3 --username MSFLAB\\smcintyre --password Password1\! 192.168.159.128 Public test.txt
See [How to detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows][1] for steps on detectiong and changing SMB version support in Windows.
Testing Steps
[^1]: To best close these feature gaps, examples of scenarios in which they are used would be necessary.