search

rapid7 / ruby_smb

A native Ruby implementation of the SMB Protocol Family
Other
79 stars 82 forks source link

Set the extended security flag when necessary #211

Closed zeroSteiner closed 2 years ago

zeroSteiner commented 2 years ago

Set the extended security flag when generating the NTLM challenge and it was set by the client in the type 1 message. This fixes the issue affecting smbclient version 4.3.11 as seen on Ubuntu 16.04 and reported in #201. With this in place, smbclient is able to authenticate to the server as intended.

Testing

Before the patch ``` root@4b11077b8eef:/# smbclient //192.168.159.128/public -U MSFLAB\\smcintyre WARNING: The "syslog" option is deprecated Enter MSFLAB\smcintyre's password: Connection to 192.168.159.128 failed (Error NT_STATUS_CONNECTION_REFUSED) root@4b11077b8eef:/# smbclient //192.168.159.128/public -U MSFLAB\\smcintyre WARNING: The "syslog" option is deprecated Enter MSFLAB\smcintyre's password: ntlmssp_handle_neg_flags: Got challenge flags[0xe2800001] - possible downgrade detected! missing_flags[0x00080000] - NT code 0x80090302 NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY SPNEGO(ntlmssp) login failed: NT code 0x80090302 session setup failed: NT code 0x80090302 root@4b11077b8eef:/# ```
After the patch ``` root@4b11077b8eef:/# smbclient //192.168.159.128/public -U MSFLAB\\smcintyre WARNING: The "syslog" option is deprecated Enter MSFLAB\smcintyre's password: Domain=[LOCALHOST] OS=[] Server=[] smb: \> dir cmd.x64.dll N 5120 Fri Mar 18 12:34:37 2022 cmd.x86.dll N 5120 Fri Mar 18 12:34:48 2022 meterpreter.x64.exe N 7168 Tue Jan 18 14:53:04 2022 meterpreter.x86.exe N 73802 Tue Jan 18 14:53:21 2022 payload.x64.dll N 8704 Fri Oct 1 22:00:02 2021 reverse_tcp.1.x64.dll R 8704 Mon Nov 29 20:37:22 2021 reverse_tcp.x64.dll N 8704 Fri Dec 17 18:01:24 2021 test D 0 Tue Mar 29 21:01:57 2022 test.txt N 13 Wed Dec 1 15:12:34 2021 Error in dskattr: NT_STATUS_NOT_SUPPORTED smb: \> exit ```

Closes #201

gwillcox-r7 commented 2 years ago

Works as expected:

root@937be16f46b8:/# smbclient //172.18.0.1/public -U MSFLAB\\smcintyre
WARNING: The "syslog" option is deprecated
Enter MSFLAB\smcintyre's password: 
Domain=[LOCALHOST] OS=[] Server=[]
smb: \> dir
  Hopper-v4-5.5.2-Linux-demo.deb      N 25004114  Mon Apr 11 19:07:09 2022
  payload.dll                         N     8704  Tue Jul 27 02:01:12 2021
  usernames.txt                       N     6340  Mon Apr 11 19:06:48 2022
Error in dskattr: NT_STATUS_NOT_SUPPORTED
smb: \>

And on the server side:

 ~/git/ruby_smb │ land-pr211:pr/211  sudo ruby examples/file_server.rb --path /var/public --share public --username MSFLAB\\smcintyre --password Password1!
D, [2022-04-21T15:10:46.941093 #68190] DEBUG -- : Adding disk share: public
server is running
received connection
I, [2022-04-21T15:15:22.118309 #68190]  INFO -- : Negotiated dialect: SMB v1 (NT LM 0.12)
D, [2022-04-21T15:15:22.128204 #68190] DEBUG -- : Dispatching request to do_session_setup_andx_smb1 (session: nil)
D, [2022-04-21T15:15:22.132749 #68190] DEBUG -- : Dispatching request to do_session_setup_andx_smb1 (session: #<Session id: 3557, user_id: nil, state: :in_progress>)
D, [2022-04-21T15:15:22.133226 #68190] DEBUG -- : NTLM authentication request received for MSFLAB\smcintyre
I, [2022-04-21T15:15:22.133470 #68190]  INFO -- : NTLM authentication request succeeded for MSFLAB\smcintyre
D, [2022-04-21T15:15:22.137033 #68190] DEBUG -- : Dispatching request to do_tree_connect_smb1 (session: #<Session id: 3557, user_id: "MSFLAB\\smcintyre", state: :valid>)
D, [2022-04-21T15:15:22.137426 #68190] DEBUG -- : Received TREE_CONNECT request for share: PUBLIC
I, [2022-04-21T15:15:22.250096 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
D, [2022-04-21T15:15:25.367546 #68190] DEBUG -- : Dispatching request to do_transactions2_smb1 (session: #<Session id: 3557, user_id: "MSFLAB\\smcintyre", state: :valid>)
D, [2022-04-21T15:15:25.367668 #68190] DEBUG -- : Received SMB_COM_TRANSACTION2 request for
 share: public
D, [2022-04-21T15:15:25.368047 #68190] DEBUG -- : Handling TRANSACTION2 FIND_FIRST2 request for class: 260 (SMB_FIND_FILE_BOTH_DIRECTORY_INFO)
D, [2022-04-21T15:15:25.384720 #68190] DEBUG -- : Dispatching request to do_transactions2_smb1 (session: #<Session id: 3557, user_id: "MSFLAB\\smcintyre", state: :valid>)
D, [2022-04-21T15:15:25.385182 #68190] DEBUG -- : Received SMB_COM_TRANSACTION2 request for share: public
W, [2022-04-21T15:15:25.385904 #68190]  WARN -- : Can not handle TRANSACTION2 QUERY_FS request for information level 1007 ()
E, [2022-04-21T15:15:25.386531 #68190] ERROR -- : Caught a NotImplementedError while handling a SMB_COM_TRANSACTION2 request (NotImplementedError)
I, [2022-04-21T15:15:25.391004 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_TRANSACTION2, status: 0xc00000bb (STATUS_NOT_SUPPORTED)
W, [2022-04-21T15:15:25.393115 #68190]  WARN -- : The SMB1  command is not supported
E, [2022-04-21T15:15:25.394594 #68190] ERROR -- : Caught a NotImplementedError while handling a  request (NotImplementedError)
I, [2022-04-21T15:15:25.398609 #68190]  INFO -- : Sending an error packet for SMB1 command: , status: 0xc00000bb (STATUS_NOT_SUPPORTED)
I, [2022-04-21T15:15:26.405312 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:15:31.418033 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:15:36.330690 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:15:41.347628 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:15:46.360773 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:15:51.373603 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:15:56.386372 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:01.400421 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:06.413195 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:11.426290 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:16.344846 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:21.358511 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:26.372573 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:31.385958 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:36.399168 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:41.411969 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:46.426638 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:51.340658 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:16:56.354792 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:01.367545 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:06.380446 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:11.393500 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:16.406369 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:21.418700 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:26.332035 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:31.345413 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:36.358348 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:41.371530 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:46.383611 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:51.397228 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:17:56.410056 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:18:01.427563 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:18:06.350302 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)
I, [2022-04-21T15:18:11.372306 #68190]  INFO -- : Sending an error packet for SMB1 command: SMB_COM_ECHO, status: 0xc0000203 (STATUS_USER_SESSION_DELETED)