Added SimpleClient, moderate bug fixes

git-svn-id: file:///home/svn/incoming/trunk@2873 4d416f70-5f16-0410-b530-b9f4589650da

lib/rex/proto/smb.rb

@@ -4,4 +4,4 @@ require 'rex/proto/smb/evasions'
 require 'rex/proto/smb/crypt'
 require 'rex/proto/smb/utils'
 require 'rex/proto/smb/client'
-
+require 'rex/proto/smb/simpleclient'

lib/rex/proto/smb/client.rb

@@ -38,6 +38,7 @@ EVADE = Rex::Proto::SMB::Evasions
 		
 		begin
 			head = self.socket.timed_read(4, self.read_timeout)
+		rescue TimeoutError
 		rescue
 			raise XCEPT::ReadHeader
 		end
@@ -53,7 +54,14 @@ EVADE = Rex::Proto::SMB::Evasions
 		
 		body = ''
 		while (body.length != recv_len)
-			buff = self.socket.timed_read(recv_len, self.read_timeout)
+			buff = ''
+
+			begin
+				buff = self.socket.timed_read(recv_len, self.read_timeout)
+			rescue TimeoutError
+			rescue
+				raise XCEPT::ReadPacket
+			end
 			
 			# Failed to read one packet within the time limit
 			if (buff == nil or buff.length == 0)
@@ -480,7 +488,7 @@ EVADE = Rex::Proto::SMB::Evasions
 			return self.session_setup_clear(*args)
 		end
 
-		return nil
+		raise XCEPT::UnknownDialect
 	end
 
 	# Authenticate using clear-text passwords
@@ -610,9 +618,9 @@ EVADE = Rex::Proto::SMB::Evasions
 		# Make sure the error code tells us to continue processing
 		if (ack['Payload']['SMB'].v['ErrorClass'] != 0xc0000016)
 			failure = XCEPT::ErrorCode.new
-			failure.word_count = pkt['Payload']['SMB'].v['WordCount']
-			failure.command = pkt['Payload']['SMB'].v['Command']
-			failure.error_code = pkt['Payload']['SMB'].v['ErrorClass']
+			failure.word_count = ack['Payload']['SMB'].v['WordCount']
+			failure.command = ack['Payload']['SMB'].v['Command']
+			failure.error_code = ack['Payload']['SMB'].v['ErrorClass']
 			raise failure
 		end
 
@@ -671,8 +679,21 @@ EVADE = Rex::Proto::SMB::Evasions
 		pkt['Payload'].v['Payload'] = blob + native_data 
 		
 		self.smb_send(pkt.to_s)
-		ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX)
+		ack = self.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX, true)
 		
+		# Make sure that authentication succeeded
+		if (ack['Payload']['SMB'].v['ErrorClass'] != 0)
+			if (user.length == 0)
+				return self.session_setup_ntlmv1(user, pass, domain)
+			end
+			
+			failure = XCEPT::ErrorCode.new
+			failure.word_count = ack['Payload']['SMB'].v['WordCount']
+			failure.command = ack['Payload']['SMB'].v['Command']
+			failure.error_code = ack['Payload']['SMB'].v['ErrorClass']
+			raise failure
+		end
+				
 		self.auth_user_id = ack['Payload']['SMB'].v['UserID']
 
 		return ack
@@ -825,7 +846,7 @@ EVADE = Rex::Proto::SMB::Evasions
 	end
 
 	# Closes an open file handle
-	def close(file_id = self.last_file_id)
+	def close(file_id = self.last_file_id, tree_id = self.last_tree_id)
 		
 		pkt = CONST::SMB_CLOSE_PKT.make_struct
 		self.smb_defaults(pkt['Payload']['SMB'])
@@ -833,6 +854,7 @@ EVADE = Rex::Proto::SMB::Evasions
 		pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_CLOSE
 		pkt['Payload']['SMB'].v['Flags1'] = 0x18
 		pkt['Payload']['SMB'].v['Flags2'] = 0x2001
+		pkt['Payload']['SMB'].v['TreeID'] = tree_id
 		pkt['Payload']['SMB'].v['WordCount'] = 3
 		
 		pkt['Payload'].v['FileID'] = file_id

lib/rex/proto/smb/exceptions.rb

@@ -30,6 +30,12 @@ class WritePacket < Error
 	end
 end
 
+class UnknownDialect < Error
+	def to_s
+		"The server uses an unsupported SMB dialect"
+	end
+end
+
 class InvalidPacket < Error
 	attr_accessor :word_count
 	attr_accessor :command
@@ -71,7 +77,15 @@ class NetbiosSessionFailed < Error
 	end
 end
 
+class SimpleClientError < Error
+	attr_accessor :source, :fatal
+end
 
+class LoginError < SimpleClientError
+	def to_s
+		"Login Failed: " + self.source
+	end
+end
 
 end
 end

lib/rex/proto/smb/simpleclient.rb

@@ -0,0 +1,164 @@
+module Rex
+module Proto
+module SMB
+class SimpleClient
+
+require 'rex/text'
+require 'rex/struct2'
+require 'rex/proto/smb/constants'
+require 'rex/proto/smb/exceptions'
+require 'rex/proto/smb/evasions'
+require 'rex/proto/smb/crypt'
+require 'rex/proto/smb/utils'
+require 'rex/proto/smb/client'
+
+# Some short-hand class aliases
+CONST = Rex::Proto::SMB::Constants
+CRYPT = Rex::Proto::SMB::Crypt
+UTILS = Rex::Proto::SMB::Utils
+XCEPT = Rex::Proto::SMB::Exceptions
+EVADE = Rex::Proto::SMB::Evasions
+
+
+	class OpenFile
+		attr_accessor	:name, :tree_id, :file_id, :mode, :client, :chunk_size
+		
+		def initialize(client, name, tree_id, file_id)
+			self.client = client
+			self.name = name
+			self.tree_id = tree_id
+			self.file_id = file_id
+			self.chunk_size = 48000
+		end
+		
+		def delete
+			begin
+				self.close
+			rescue
+			end
+			self.client.delete(self.name, self.tree_id)
+		end
+		
+		# Close this open file
+		def close
+			self.client.close(self.file_id, self.tree_id)
+		end
+		
+		# Read data from the file
+		def read (length = nil, offset = 0)	
+			if (length == nil)
+				data = ''
+				fptr = offset
+				ok = self.client.read(self.file_id, fptr, self.chunk_size)
+				while (ok['Payload'].v['DataLenLow'] > 0)
+					buff = ok.to_s.slice(
+						ok['Payload'].v['DataOffset'] + 4,
+						ok['Payload'].v['DataLenLow']
+					)
+					data << buff
+					fptr += ok['Payload'].v['DataLenLow']
+					ok = self.client.read(self.file_id, fptr, self.chunk_size)
+				end
+				return data
+			else
+				ok = self.client.read(self.file_id, offset, length)
+				data = ok.to_s.slice(
+					ok['Payload'].v['DataOffset'] + 4,
+					ok['Payload'].v['DataLenLow']
+				)
+				return data
+			end
+		end
+
+		def << (data)
+			self.write(data)
+		end
+
+		# Write data to the file
+		def write(data, offset = 0)	
+			# Track our offset into the remote file
+			fptr = offset
+			
+			# Duplicate the data so we can use slice!
+			data = data.dup
+			
+			# Take our first chunk of bytes
+			chunk = data.slice!(0, self.chunk_size)
+			
+			# Keep writing data until we run out
+			while (chunk.length > 0)
+				ok = self.client.write(self.file_id, fptr, chunk)	
+				cl = ok['Payload'].v['CountLow']
+				
+				# Partial write, push the failed data back into the queue
+				if (cl != chunk.length)
+					data = chunk.slice(cl - 1, chunk.length - cl) + data
+				end
+				
+				# Increment our painter and grab the next chunk
+				fptr += cl
+				chunk = data.slice!(0, self.chunk_size)
+			end
+		end
+	end
+	
+
+# Public accessors
+attr_accessor	:last_error
+
+# Private accessors
+attr_accessor	:socket, :client, :direct, :shares, :last_share
+
+	# Pass the socket object and a boolean indicating whether the socket is netbios or cifs
+	def initialize (socket, direct = false)
+		self.socket = socket
+		self.direct = direct
+		self.client = Rex::Proto::SMB::Client.new(socket)
+		self.shares = { }
+	end
+	
+	def login (name = '*SMBSERVER', user = '', pass = '', domain = '')
+		begin
+			
+			if (self.direct != true)
+				self.client.session_request(name)
+			end
+			
+			self.client.negotiate
+			ok = self.client.session_setup(user, pass, domain)
+		rescue
+			e = XCEPT::LoginError.new
+			e.source = $!.to_s 
+			raise e
+		end
+		
+		return true
+	end
+	
+	def connect (share)
+		ok = self.client.tree_connect(share)
+		tree_id = ok['Payload']['SMB'].v['TreeID']
+		self.shares[share] = tree_id
+		self.last_share = share
+	end
+	
+	def disconnect (share)
+		ok = self.client.tree_disconnect(self.shares[share])
+		self.shares.delete(share)
+	end	
+	
+	def open (path, mode=0)
+		ok = self.client.open(path, mode)
+		file_id = ok['Payload'].v['FileID']
+		
+		fh = OpenFile.new(self.client, path, self.client.last_tree_id, file_id)
+	end
+	
+	def delete (*args)
+		self.client.delete(*args)
+	end
+
+end
+end
+end
+end

lib/rex/proto/smb/simpleclient.rb.ut.rb

@@ -0,0 +1,69 @@
+#!/usr/bin/ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'test/unit'
+require 'rex/proto/smb'
+require 'rex/proto/dcerpc'
+require 'rex/socket'
+
+class Rex::Proto::SMB::Client::UnitTest < Test::Unit::TestCase
+	
+	Klass = Rex::Proto::SMB::SimpleClient
+
+	# Alias over the Rex DCERPC protocol modules
+	DCERPCPacket   = Rex::Proto::DCERPC::Packet
+	DCERPCClient   = Rex::Proto::DCERPC::Client
+	DCERPCResponse = Rex::Proto::DCERPC::Response
+	DCERPCUUID     = Rex::Proto::DCERPC::UUID
+	
+	FILE_CREATE = 0x10
+	FILE_TRUNC  = 0x02
+	FILE_OPEN   = 0x01
+	
+	
+	@@host = '192.168.0.219'
+	@@port = 445
+
+	def test_smb_open_share
+		
+		user = 'SMBTest'
+		pass = 'SMBTest'
+		share = 'C$'
+		
+		write_data = ('A' * (1024 * 1024 * 1))
+		filename = 'smb_tester.txt'
+		
+		s = Rex::Socket.create_tcp(
+			'PeerHost' => @@host,
+			'PeerPort' => @@port
+		)
+
+		c = Klass.new(s, true)
+		
+		begin
+			c.login('*SMBSERVER', user, pass)
+			c.connect(share)
+			
+			f = c.open(filename, FILE_CREATE|FILE_TRUNC)
+			f << write_data
+			f.close
+			
+			f = c.open(filename, FILE_OPEN)
+			d = f.read()
+			f.close
+			
+			c.delete(filename)
+			c.disconnect(share)
+			assert_equal(write_data, d)
+		rescue
+			puts $!.to_s + $!.backtrace.join("\n")
+			return
+		end
+
+		s.close	
+		
+	end
+
+	
+end