Nmap Development mailing list archives
[NSELib + NSE RFC] NetBIOS + SMB
From: Ron <ron () skullsecurity net>
Date: Tue, 09 Sep 2008 22:28:06 -0500
Hey all, I completed another round of changes to my NetBIOS and SMB libraries, and they're starting to look/work great! I've attached the latest copies of the libraries and the scripts I've written/modified to work with them. The scripts are pretty small, now, since the vast majority of the work has been delegated to the nselib. smb.lua -- smb library, extremely incomplete in the big scheme of things, but does the basics well. netbios.lua -- netbios library, nearly complete. Just requires some datagram service stuff, which m|ke might appreciate. nbstat -- heavily modified Brandon's nbstat script to make use of my nselib. Basically rewrote the whole thing in a couple lines -- sorry Brandon! :) -- I'm attaching as a .nse rather than a patch because there's pretty much nothing left of the original. smb-security-mode -- prints out the server's security mode (plaintext passwords, message signing, etc). smb-os-discovery -- os discovery over SMB. Makes netbios-smb-os-discovery obsolete. I didn't want to change the netbios-smb one, because it had a copyright at the top for Sourcefire and I didn't really want to mess with that. It would have been a near-total rewrite anyways, though, so it didn't matter. smb-enum -- enumerates shares and a couple users. I didn't want to go too far, because of account lockouts. I only check Guest and Administrator. Guest *might* get locked out (although I kind of doubt it), but Administrator shouldn't (by default, they can't). No password bruteforcing happens, but I might write another script for that (which will, of course, interface with the generic username/password files). I can't hash passwords until I have some more OpenSSL functions, though. Hopefully somebody implements those soon! :P I'd like to expand smb-enum to use RPC calls in the future, but that's something I haven't learned yet. So yeah, these are working nicely for me right now. I'd like a couple others to try them out, and I want to fix a couple minor issues (like closing sockets), then I'll call it a stable (though incomplete) first release. And just in time for me to go on vacation next week! :) Ron PS: Damn, I nearly had a subject line that was justifiably all uppercase! :D
--- Sends a NetBIOS NBSTAT query to target host to try to determine the NetBIOS -- names and MAC address. By default, displays the name of the computer and the -- logged-in user; if verbosity is turned up, displays all names the system -- thinks it owns. -- -- @output -- (no verbose)\n -- |_ NBSTAT: NetBIOS name: TEST1, NetBIOS user: RON, NetBIOS MAC: 00:0c:29:f9:d9:28\n --\n -- (verbose)\n -- | NBSTAT: NetBIOS name: TEST1, NetBIOS user: RON, NetBIOS MAC: 00:0c:29:f9:d9:28\n -- | Name: TEST1<00> Flags: <unique><active>\n -- | Name: TEST1<20> Flags: <unique><active>\n -- | Name: WORKGROUP<00> Flags: <group><active>\n -- | Name: TEST1<03> Flags: <unique><active>\n -- | Name: WORKGROUP<1e> Flags: <group><active>\n -- | Name: RON<03> Flags: <unique><active>\n -- | Name: WORKGROUP<1d> Flags: <unique><active>\n -- |_ Name: \x01\x02__MSBROWSE__\x02<01> Flags: <group><active>\n id = "NBSTAT" description = "Sends a NetBIOS query to target host to try to determine \ the NetBIOS name and MAC address. For more information on the NetBIOS protocol, \ see 'nselib/netbios.lua'." author = "Brandon Enright <bmenrigh () ucsd edu>, Ron Bowes" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" -- Current version of this script was based entirly on Implementing CIFS, by -- Christopher R. Hertel. categories = {"default", "discovery", "safe"} require "comm" require "netbios" -- I have excluded the port function param because it doesn't make much sense -- for a hostrule. It works without warning. The NSE documentation is -- not explicit enough in this regard. hostrule = function(host) return true -- The following is an attempt to only run this script against hosts -- that will probably respond to a UDP 137 probe. One might argue -- that sending a single UDP packet and waiting for a response is no -- big deal and that it should be done for every host. In that case -- simply change this rule to always return true. local port_t135 = nmap.get_port_state(host, {number=135, protocol="tcp"}) local port_t139 = nmap.get_port_state(host, {number=139, protocol="tcp"}) local port_t445 = nmap.get_port_state(host, {number=445, protocol="tcp"}) local port_u137 = nmap.get_port_state(host, {number=137, protocol="udp"}) if ( (port_t135 ~= nil and port_t135.state == "open") or (port_t139 ~= nil and port_t139.state == "open") or (port_t445 ~= nil and port_t445.state == "open") or (port_u137 ~= nil and (port_u137.state == "open" or port_u137.state == "open|filtered"))) then return true else return false end end action = function(host) local i local status local names, statistics local server_name, user_name local mac local result = "" -- Get the list of NetBIOS names status, names, statistics = netbios.do_nbstat(host.ip) if(status == false) then return false, "ERROR: " .. names end -- Get the server name status, server_name = netbios.get_server_name(host.ip, names) if(status == false) then return false, "ERROR: " .. server_name end -- Get the logged in user status, user_name = netbios.get_user_name(host.ip, names) if(status == false) then return false, "ERROR: " .. user_name end -- Format the Mac address in the standard way mac = string.format("%02x:%02x:%02x:%02x:%02x:%02x", statistics:byte(1), statistics:byte(2), statistics:byte(3), statistics:byte(4), statistics:byte(5), statistics:byte(6)) -- Samba doesn't set the Mac address if(mac == "00:00:00:00:00:00") then mac = "<unknown>" end -- Check if we actually got a username if(user_name == nil) then user_name = "<unknown>" end result = result .. string.format("NetBIOS name: %s, NetBIOS user: %s, NetBIOS MAC: %s\n", server_name, user_name, mac) -- If verbosity is set, dump the whole list of names if(nmap.verbosity() >= 1) then for i = 1, #names, 1 do local padding = string.rep(" ", 17 - string.len(names[i]['name'])) local flags_str = netbios.flags_to_string(names[i]['flags']) result = result .. string.format("Name: %s<%02x>%sFlags: %s\n", names[i]['name'], names[i]['suffix'], padding, flags_str) end -- If super verbosity is set, print out the full statistics if(nmap.verbosity() >= 2) then result = result .. "Statistics: " for i = 1, #statistics, 1 do result = result .. string.format("%02x ", statistics:byte(i)) end result = result .. "\n" end end return result end
--- Returns information about the SMB security level determined by SMB. \n --\n -- Here is how to interpret the output:\n --\n -- User-level security: Each user has a separate username/password that is used -- to log into the system. This is the default setup of pretty much everything -- these days. \n -- Share-level security: The anonymous account should be used to log in, then -- the password is given (in plaintext) when a share is accessed. All users who -- have access to the share use this password. This was the original way of doing -- things, but isn't commonly seen, now. If a server uses share-level security, -- it is vulnerable to sniffing. \n --\n -- Challenge/response passwords: If enabled, the server can accept any type of -- password:\n -- * Plaintext\n -- * LM and NTLM\n -- * LMv2 and NTLMv2\n -- If it isn't set, the server can only accept plaintext passwords. Most servers -- are configured to use challenge/response these days. If a server is configured -- to accept plaintext passwords, it is vulnerable to sniffing. \n --\n -- Message signing: If required, all messages between the client and server must -- sign be signed by a shared key, derived from the password and the server -- challenge. If supported and not required, message signing is negotiated between -- clients and servers and used if both support and request it. By default, Windows clients -- don't sign messages, so if message signing isn't required by the server, messages -- probably won't be signed; additionally, if performing a man-in-the-middle attack, -- an attacker can negotiate no message signing. If message signing isn't required, the -- server is vulnerable to man-in-the-middle attacks. \n -- \n -- See nselib/smb.lua for more information on the protocol itself. \n -- --@usage -- nmap --script smb-security-mide.nse -p445 127.0.0.1\n -- sudo nmap -sU -sS --script smb-security-mide.nse -p U:137,T:139 127.0.0.1\n -- --@output -- | SMB Security: User-level authentication\n -- | SMB Security: Challenge/response passwords supported\n -- |_ SMB Security: Message signing supported\n -- ----------------------------------------------------------------------- id = "SMB Security" description = "Attempts to determine the security mode over the SMB protocol (ports 445 and 139)." author = "Ron Bowes" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"version"} require 'smb' --- Check whether or not this script should be run. hostrule = function(host) local port = smb.get_port(host) if(port == nil) then return false else return true end end action = function(host) local status, socket = smb.start(host) if(status == false) then return "Error: " .. socket end status, result = smb.negotiate_protocol(socket) if(status == false) then return "Error: " .. result end local security_mode = result['security_mode'] local response = "" -- User-level authentication or share-level authentication if(bit.band(security_mode, 1) == 1) then response = response .. "User-level authentication\n" else response = response .. " Share-level authentication\n" end -- Challenge/response supported? if(bit.band(security_mode, 2) == 0) then response = response .. "SMB Security: Plaintext only\n" else response = response .. "SMB Security: Challenge/response passwords supported\n" end -- Message signing supported/required? if(bit.band(security_mode, 8) == 8) then response = response .. "SMB Security: Message signing required\n" elseif(bit.band(security_mode, 4) == 4) then response = response .. "SMB Security: Message signing supported\n" else response = response .. "SMB Security: Message signing not supported\n" end return response end
--- Attempts to determine the operating system over SMB protocol (ports 445 and 139). -- See nselib/smb.lua for more information on this protocol. -- --@usage -- nmap --script smb-os-discovery.nse -p445 127.0.0.1\n -- sudo nmap -sU -sS --script smb-os-discovery.nse -p U:137,T:139 127.0.0.1\n -- --@output -- | OS from SMB: Windows 2000\n -- | LAN Manager: Windows 2000 LAN Manager\n -- | Name: WORKGROUP\TEST1\n -- |_ System time: 2008-09-09 20:55:55 UTC-5\n -- ----------------------------------------------------------------------- id = "OS from SMB" description = "Attempts to determine the operating system over the SMB protocol (ports 445 and 139)." author = "Ron Bowes" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"version"} require 'smb' --- Check whether or not this script should be run. hostrule = function(host) local port = smb.get_port(host) if(port == nil) then return false else return true end end --- Converts numbered Windows versions (5.0, 5.1) to the names (Windows 2000, Windows XP). --@param os The name of the OS --@return The actual name of the OS (or the same as the 'os' parameter) function get_windows_version(os) if(os == "Windows 5.0") then return "Windows 2000" elseif(os == "Windows 5.1")then return "Windows XP" end return os end action = function(host) status, socket = smb.start(host) if(status == false) then return "Error: " .. socket end status, negotiate_result = smb.negotiate_protocol(socket) if(status == false) then return "Error: " .. negotiate_result end status, session_result = smb.start_session(socket, "", negotiate_result['session_key'], negotiate_result['capabilities']) if(status == false) then return "Error: " .. session_result end return string.format("%s\nLAN Manager: %s\nName: %s\\%s\nSystem time: %s %s\n", get_windows_version(session_result['os']), session_result['lanmanager'], negotiate_result['domain'], negotiate_result['server'], negotiate_result['date'], negotiate_result['timezone_str']) end
--- Attempts to enumerate users and shares anonymously over SMB. \n --\n -- First, it logs in as the anonymous user and tries to connect to IPC$. -- If it is successful, it knows that Null sessions are enabled. If it -- is unsuccessful, it can still check for shares (because Windows is -- cool like that). A list of common shares is checked (see the 'shares' -- variable) to see what anonymous can access. Either a successful result -- is returned (has access), STATUS_ACCESS_DENIED is returned (exists but -- anonymous can't access), or STATUS_BAD_NETWORK_NAME is returned (doesn't -- exist). \n --\n -- Next, the Guest account is attempted with a blank password. If it's -- enabled, a message is displayed and shares that it has access to are -- checked the same as anonymous. \n --\n -- Finally, the Administrator account is attempted with a blank password. -- Because Administrator can't typically be locked out, this should be -- safe. That being said, it is possible to configure Administrator to -- be lockoutable, so watch out for that caveat. If you do lock yourself -- out of Administrator, there's a bootdisk that can help. :)\n --\n -- If Administrator has a blank password, it often doesn't allow remote -- logins, if this is the case, STATUS_ACCOUNT_RESTRICTION is returned -- instead of STATUS_ACCESS_DENIED, so we know the account has no password. \n --\n --@usage -- nmap --script smb-enum.nse -p445 127.0.0.1\n -- sudo nmap -sU -sS --script smb-enum.nse -p U:137,T:139 127.0.0.1\n -- --@output -- Host script results:\n -- | SMB Enumeration: \n -- | Null sessions enabled\n -- | Anonymous shares found: IPC$ \n -- | Restricted shares found: C$ TEST \n -- | Guest account is enabled\n -- | Guest can access: IPC$ TEST \n -- | Administrator account has a blank password\n -- |_ Administrator can access: IPC$ C$ TEST \n ----------------------------------------------------------------------- id = "SMB Enumeration" description = "Attempts to enumerate users and shares anonymously over SMB" author = "Ron Bowes" copyright = "Ron Bowes" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"version","intrusive"} require 'bit' require 'bin' require 'smb' -- Shares to try connecting to as Null session / GUEST local shares = {"IPC", "C", "D", "TEST", "SHARE", "HOME", "DFS", "COMCFG" } hostrule = function(host) local port = smb.get_port(host) if(port == nil) then return false else return true end end --- Attempts to connect to a list of shares as the given UID, returning the -- shares that it has and doesn't have access to. --@param socket The socket to use --@param ip The ip address of the host --@param uid The UserID we're logged in as --@return (allowed_shares, denied_shares) Lists of shares we can and can't access, -- but all of which exist. function find_shares(socket, ip, uid) local i local allowed_shares = {} local denied_shares = {} for i = 1, #shares, 1 do local share = string.format("\\\\%s\\%s", ip, shares[i]) status, tree_result = smb.tree_connect(socket, share, uid) if(status == false) then if(tree_result == 0xc0000022) then -- STATUS_ACCESS_DENIED denied_shares[#denied_shares + 1] = shares[i] end else allowed_shares[#allowed_shares + 1] = shares[i] end share = share .. "$" status, tree_result = smb.tree_connect(socket, share, uid) if(status == false) then if(tree_result == 0xc0000022) then -- STATUS_ACCESS_DENIED denied_shares[#denied_shares + 1] = shares[i] .. "$" end else allowed_shares[#allowed_shares + 1] = shares[i] .. "$" end end return allowed_shares, denied_shares end --- Join strings together with a space. function string_join(table) local i local response = " " for i = 1, #table, 1 do response = response .. table[i] .. " " end return response end action = function(host) local response = " \n" local status, socket, negotiate_result, session_result local allowed_shares, restricted_shares status, socket = smb.start(host) if(status == false) then return "ERROR: " .. socket end status, negotiate_result = smb.negotiate_protocol(socket) if(status == false) then return "ERROR: " .. negotiate_result end -- Start up a null session status, session_result = smb.start_session(socket, "", negotiate_result['session_key'], negotiate_result['capabilities']) if(status == false) then return "ERROR: " .. session_result end -- Check if null session has access to IPC$ status, result = smb.tree_connect(socket, "IPC$", session_result['uid']) if(status == true) then response = response .. "Null sessions enabled\n" end -- Find shares allowed_shares, restricted_shares = find_shares(socket, host.ip, session_result['uid']) -- Display shares the Null user had access to if(#allowed_shares > 0) then response = response .. "Anonymous shares found: " .. string_join(allowed_shares) .. "\n" end -- Display shares the Null user didn't have access to if(#restricted_shares > 0) then response = response .. "Restricted shares found: " .. string_join(restricted_shares) .. "\n" end -- Check if Guest can log in status, session_result = smb.start_session(socket, "GUEST", negotiate_result['session_key'], negotiate_result['capabilities']) if(status == true) then response = response .. "Guest account is enabled\n" -- Find shares for Guest allowed_shares, restricted_shares = find_shares(socket, host.ip, session_result['uid']) -- Display shares Guest had access to if(#allowed_shares > 0) then response = response .. "Guest can access: " .. string_join(allowed_shares) .. "\n" end end -- Check if Administrator has a blank password -- (we check Administrator and not other accounts because Administrator can't generally be locked out) status, session_result = smb.start_session(socket, "ADMINISTRATOR", negotiate_result['session_key'], negotiate_result['capabilities']) if(status == true) then response = response .. "Administrator account has a blank password\n" -- Find shares for Administrator allowed_shares, restricted_shares = find_shares(socket, host.ip, session_result['uid']) -- Display shares administrator had access to if(#allowed_shares > 0) then response = response .. "Administrator can access: " .. string_join(allowed_shares) .. "\n" end elseif(session_result == 0xc000006e) then -- STATUS_ACCOUNT_RESTRICTION response = response .. "Administrator account has a blank password, but can't use SMB\n" end return response end
--- A library for SMB (Server Message Block) (aka CIFS) traffic. This traffic is normally -- sent to/from ports 139 or 445 of Windows systems, although it's also implemented by -- others (the most notable one being Samba). \n --\n -- The intention of this library is toe ventually handle all aspects of the SMB protocol, -- A programmer using this library must already have some knowledge of the SMB protocol, -- although a lot isn't necessary. You can pick up a lot by looking at the code that uses -- this. The basic login is this:\n --\n -- [connect]\n -- C->S SMB_COM_NEGOTIATE_PROTOCOL\n -- S->C SMB_COM_NEGOTIATE_PROTOCOL\n -- C->S SMB_COM_SESSION_SETUP_ANDX\n -- S->C SMB_COM_SESSION_SETUP_ANDX\n -- C->S SMB_COM_TREE_CONNCT_ANDX\n -- S->C SMB_COM_TREE_CONNCT_ANDX\n --\n -- In terms of functions here, the protocol is:\n -- status, socket = smb.start(host)\n -- status, negotiate_result = smb.negotiate_protocol(socket)\n -- status, session_result = smb.start_session(socket, username, negotiate_result['session_key'], negotiate_result['capabilities'])\n -- status, tree_result = smb.tree_connect(socket, path, session_result['uid'])\n -- \n -- To initially begin the connection, there are two options:\n -- 1) Attempt to start a raw session over 445, if it's open. \n -- 2) Attempt to start a NetBIOS session over 139. Although the -- protocol's the same, it requires a "session request" packet. -- That packet requires the computer's name, which is requested -- using a NBSTAT probe over UDP port 137. \n --\n -- Once it's connected, a SMB_COM_NEGOTIATE_PROTOCOL packet is sent, -- requesting the protocol "NT LM 0.12", which is the most commonly -- supported one. Among other things, the server's response contains -- the host's security level, the system time, and the computer/domain -- name.\n --\n -- If that's successful, SMB_COM_SESSION_SETUP_ANDX is sent. It is essentially the logon -- packet, where the username, domain, and password are sent to the server for verification. -- The response to SMB_COM_SESSION_SETUP_ANDX is fairly simple, containing a boolean for -- success, along with the operating system and the lan manager name. \n --\n -- After a successful SMB_COM_SESSION_START_ANDX has been made, a -- SMB_COM_TREE_CONNECT_ANDX packet can be sent. This is what connects to a share. -- The server responds to this with a boolean answer, and little more information. \n --\n -- Each share will either return STATUS_BAD_NETWORK_NAME if the share doesn't -- exist, STATUS_ACCESS_DENIED if it exists but we don't have access, or -- STATUS_SUCCESS if exists and we do have access. \n --\n -- Thanks go to Christopher R. Hertel and Implementing CIFS, which -- taught me everything I know about Microsoft's protocols. \n --\n --@author Ron Bowes <ron () skullsecurity net> --@copyright See nmaps COPYING for licence ----------------------------------------------------------------------- module(... or "smb", package.seeall) require 'bit' require 'bin' require 'netbios' --- Determines whether or not SMB checks are possible on this host, and, if they are, -- which port is best to use. This is how it decides:\n --\n -- a) If port tcp/445 is open, use it for a raw connection\n -- b) Otherwise, if ports tcp/139 and udp/137 are open, do a NetBIOS connection. Since -- UDP scanning isn't default, we're also ok with udp/137 in an unknown state. \n -- --@param host The host object. --@return The port number to use, or nil if we don't have an SMB port function get_port(host) local port_u137 = nmap.get_port_state(host, {number=137, protocol="udp"}) local port_t139 = nmap.get_port_state(host, {number=139, protocol="tcp"}) local port_t445 = nmap.get_port_state(host, {number=445, protocol="tcp"}) if(port_t445 ~= nil and port_t445.state == "open") then -- tcp/445 is open, we're good return 445 end if(port_t139 ~= nil and port_t139.state == "open") then -- tcp/139 is open, check uf udp/137 is open or unknown if(port_u137 == nil or port_u137.state == "open" or port_u137.state == "open|filtered") then return 139 end end return nil end --- Begins a SMB session, automatically determining the best way to connect. -- -- @param host The host object -- @return (status, socket) if the status is true, result is the newly crated socket. -- otherwise, socket is the error message. function start(host) local port = get_port(host) if(port == nil) then return false, "Couldn't find a valid port to check" end if(port == 445) then return start_raw(host.ip, port) elseif(port == 139) then return start_netbios(host.ip, port) end return false, "Couldn't find a valid port to check" end --- Begins a raw SMB session, likely over port 445. Since nothing extra is required, this -- function simply makes a connection and returns the socket. -- it off to smb_start(). -- [TODO] error handling -- --@param host The host (or IP) to check. --@param port The port to use (most likely 445). --@return (status, socket) if status is true, result is the newly created socket. -- Otherwise, socket is the error message. function start_raw(host, port) local socket = nmap.new_socket() socket:connect(host, port, "tcp") return true, socket end --- Begins a SMB session over NetBIOS. This requires a NetBIOS Session Start message to -- be sent first, which in turn requires the NetBIOS name. The name can be provided as -- a parameter, or it can be automatically determined. -- --@param host The host (or IP) to check. --@param port The port to use (most likely 139). --@param name [optional] The NetBIOS name of the host. Will attempt to automatically determine -- if it isn't given. --@return (status, socket) if status is true, result is the port -- Otherwise, socket is the error message. function start_netbios(host, port, name) local pos, status, result, flags, length local socket = nmap.new_socket() if(name == nil) then -- Get the name of the server status, name = netbios.get_server_name(host) if(status == false) then return false, result end end -- Request a NetBIOS session session_request = bin.pack(">CCSzz", 0x81, -- session request 0x00, -- flags 0x44, -- length netbios.name_encode(name), -- server name netbios.name_encode("NMAP") -- client name ); socket:connect(host, port, "tcp") socket:send(session_request) socket:set_timeout(1000) -- Receive the session response status, result = socket:receive_bytes(4); pos, result, flags, length = bin.unpack(">CCS", result) -- Check for a position session response (0x82) if result ~= 0x82 then return false, "Server refused to grant a NetBIOS session" end return true, socket end --- Creates a string containing a SMB packet header. The header looks like this:\n -- --------------------------------------------------------------------------------------------------\n -- | 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 |\n -- --------------------------------------------------------------------------------------------------\n -- | 0xFF | 'S' | 'M' | 'B' |\n -- --------------------------------------------------------------------------------------------------\n -- | Command | Status... |\n -- --------------------------------------------------------------------------------------------------\n -- | ...Status | Flags | Flags2 |\n -- --------------------------------------------------------------------------------------------------\n -- | PID_high | Signature..... |\n -- --------------------------------------------------------------------------------------------------\n -- | ....Signature.... |\n -- --------------------------------------------------------------------------------------------------\n -- | ....Signature | Unused |\n -- --------------------------------------------------------------------------------------------------\n -- | TID | PID |\n -- --------------------------------------------------------------------------------------------------\n -- | UID | MID |\n -- ------------------------------------------------------------------------------------------------- \n -- -- All fields are, incidentally, encoded in little endian byte order. \n --\n -- For the purposes here, the program doesn't care about most of the fields so they're given default \n -- values. The fields of interest are:\n -- * Command -- The command of the packet (SMB_COM_NEGOTIATE, SMB_COM_SESSION_SETUP_ANDX, etc)\n -- * UID/TID -- Sent by the server, and just have to be echoed back\n --@param command The command to use. --@param uid The UserID, which is returned by SMB_COM_SESSION_SETUP_ANDX (0 otherwise) --@param tid The TreeID, which is returned by SMB_COM_TREE_CONNECT_ANDX (0 otherwise) --@return A binary string containing the packed packet header. local function smb_encode_header(command, uid, tid) -- Used for the header local smb = string.char(0xFF) .. "SMB" -- Pretty much every flags is deprecated. We set these two because they're required to be on. local flags = bit.bor(0x10, 0x08) -- SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES -- These flags are less deprecated. We negotiate 32-bit status codes and long names. We also don't include Unicode, which tells -- the server that we deal in ASCII. local flags2 = bit.bor(0x4000, 0x0040, 0x0001) -- SMB_FLAGS2_32BIT_STATUS | SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAMES local header = bin.pack("<CCCCCICSSLSSSSS", smb:byte(1), -- Header smb:byte(2), -- Header smb:byte(3), -- Header smb:byte(4), -- Header command, -- Command 0, -- status flags, -- flags flags2, -- flags2 0, -- extra (pid_high) 0, -- extra (signature) 0, -- extra (unused) tid, -- tid 0, -- pid uid, -- uid 0 -- mid ) return header end --- Converts a string containing the parameters section into the encoded parameters string. -- The encoding is simple:\n -- (1 byte) The number of 2-byte values in the parameters section\n -- (variable) The parameter section\n -- This is automatically done by smb_send(). -- -- @param parameters The parameters section. -- @return The encoded parameters. local function smb_encode_parameters(parameters) return bin.pack("<CA", string.len(parameters) / 2, parameters) end --- Converts a string containing the data section into the encoded data string. -- The encoding is simple:\n -- (2 bytes) The number of bytes in the data section\n -- (variable) The data section\n -- This is automatically done by smb_send(). -- -- @param data The data section. -- @return The encoded data. local function smb_encode_data(data) return bin.pack("<SA", string.len(data), data) end --- Prepends the NetBIOS header to the packet, which is essentially the length, encoded -- in 4 bytes of big endian, and sends it out. The length field is actually 17 or 24 bits -- wide, depending on whether or not we're using raw, but that shouldn't matter. -- [TODO] Error checking -- --@param socket The socket to send the packet on. --@param header The header, encoded with smb_get_header(). --@param parameters The parameters --@param data The data function smb_send(socket, header, parameters, data) local encoded_parameters = smb_encode_parameters(parameters) local encoded_data = smb_encode_data(data) local len = string.len(header) + string.len(encoded_parameters) + string.len(encoded_data) local out = bin.pack(">I<AAA", len, header, encoded_parameters, encoded_data) socket:send(out) end --- Reads the next packet from the socket, and parses it into the header, parameters, -- and data. -- [TODO] This assumes that exactly one packet arrives, which may not be the case. -- Some buffering should happen here. Currently, we're waiting on 32 bytes, which -- is the length of the header, but there's no guarantee that we get the entire -- body. --@param socket The socket to read the packet from --@return (status, header, parameters, data) If status is true, the header, -- parameters, and data are all the raw arrays (with the lengths already -- removed). If status is false, header contains an error message and parameters/ -- data are undefined. function smb_read(socket) local status, result local pos, length, header, parameter_length, parameters, data_length, data -- Receive the response -- [TODO] set the timeout length per jah's strategy: -- http://seclists.org/nmap-dev/2008/q3/0702.html socket:set_timeout(1000) status, result = socket:receive_bytes(32); -- Make sure the connection is still alive if(status ~= true) then return false, result end -- The length of the packet is 4 bytes of big endian (for our purposes). -- The header is 32 bytes. pos, length, header = bin.unpack(">I<A32", result) -- The parameters length is a 1-byte value. pos, parameter_length = bin.unpack("<C", result, pos) -- Double the length parameter, since parameters are two-byte values. pos, parameters = bin.unpack(string.format("<A%d", parameter_length*2), result, pos) -- The data length is a 2-byte value. pos, data_length = bin.unpack("<S", result, pos) -- Read that many bytes of data. pos, data = bin.unpack(string.format("<A%d", data_length), result, pos) return status, header, parameters, data end --- Sends out SMB_COM_NEGOTIATE_PROTOCOL, which is typically the first SMB packet sent out. -- Sends the following:\n -- * List of known protocols\n --\n -- Receives:\n -- * The prefered dialect\n -- * The security mode\n -- * Max number of multiplexed connectiosn, virtual circuits, and buffer sizes\n -- * The server's system time and timezone\n -- * The "encryption key" (aka, the server challenge)\n -- * The capabilities\n -- * The server and domain names\n --@param socket The socket, in the proper state (ie, newly connected). --@return (status, result) If status is false, result is an error message. Otherwise, result is a -- table with the following elements:\n -- 'security_mode' Whether or not to use cleartext passwords, message signatures, etc.\n -- 'max_mpx' Maximum number of multiplexed connections\n -- 'max_vc' Maximum number of virtual circuits\n -- 'max_buffer' Maximum buffer size\n -- 'max_raw_buffer' Maximum buffer size for raw connections (considered obsolete)\n -- 'session_key' A value that's basically just echoed back\n -- 'capabilities' The server's capabilities\n -- 'time' The server's time (in UNIX-style seconds since 1970)\n -- 'date' The server's date in a user-readable format\n -- 'timezone' The server's timezone, in hours from UTC\n -- 'timezone_str' The server's timezone, as a string\n -- 'server_challenge' A random string used for challenge/response\n -- 'domain' The server's primary domain\n -- 'server' The server's name\n function negotiate_protocol(socket) local header, parameters, data local pos local header1, header2, header3, ehader4, command, status, flags, flags2, pid_high, signature, unused, pid, mid local dialect, security_mode, max_mpx, max_vc, max_buffer, max_raw_buffer, session_key, capabilities, time, timezone, key_length local server_challenge, date, timezone_str local domain, server local response = {} header = smb_encode_header(0x72, 0, 0) -- Parameters are blank parameters = "" -- Data is a list of strings, terminated by a blank one. data = bin.pack("<CzCz", 2, "NT LM 0.12", 2, "") -- Send the negotiate request smb_send(socket, header, parameters, data) -- Read the result status, header, parameters, data = smb_read(socket) if(status ~= true) then return false, header end -- Since this is our first response, parse out the header pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header) -- Parse the parameter section pos, dialect, security_mode, max_mpx, max_vc, max_buffer, max_raw_buffer, session_key, capabilities, time, timezone, key_length = bin.unpack("<SCSSIIIILsC", parameters) -- Convert the time and timezone to more useful values time = (time / 10000000) - 11644473600 date = os.date("%Y-%m-%d %H:%M:%S", time) timezone = -(timezone / 60) if(timezone == 0) then timezone_str = "UTC+0" elseif(timezone < 0) then timezone_str = "UTC-" .. math.abs(timezone) else timezone_str = "UTC+" .. timezone end -- Data section -- This one's a little messier, because I don't appear to have unicode support pos, server_challenge = bin.unpack(string.format("<A%d", key_length), data) -- Get the domain as a Unicode string local ch, dummy domain = "" pos, ch, dummy = bin.unpack("<CC", data, pos) while ch ~= 0 do domain = domain .. string.char(ch) pos, ch, dummy = bin.unpack("<CC", data, pos) end -- Get the server name as a Unicode string server = "" pos, ch, dummy = bin.unpack("<CC", data, pos) while ch do server = server .. string.char(ch) pos, ch, dummy = bin.unpack("<CC", data, pos) end -- Fill out response variables response['security_mode'] = security_mode response['max_mpx'] = max_mpx response['max_vc'] = max_vc response['max_buffer'] = max_buffer response['max_raw_buffer'] = max_raw_buffer response['session_key'] = session_key response['capabilities'] = capabilities response['time'] = time response['date'] = date response['timezone'] = timezone response['timezone_str'] = timezone_str response['server_challenge'] = server_challenge response['domain'] = domain response['server'] = server return true, response end --- Sends out SMB_COM_SESSION_START_ANDX, which attempts to log a user in. -- Sends the following:\n -- * Negotiated parameters (multiplexed connections, virtual circuit, capabilities)\n -- * Passwords (plaintext, unicode, lanman, ntlm, lmv2, ntlmv2, etc)\n -- * Account name\n -- * OS (I just send "Nmap")\n -- * Native LAN Manager (no clue what that is, but it seems to be ignored)\n --\n -- Receives the following:\n -- * User ID\n -- * Server OS\n --\n --@param socket The socket, in the proper state (ie, after protocol has been negotiated). --@param username The account name to use. For Null sessions, leave it blank (''). --@param session_key The session_key value, returned by SMB_COM_NEGOTIATE_PROTOCOL. --@param capabilities The server's capabilities, returned by SMB_COM_NEGOTIATE_PROTOCOL. --@return (status, result) If status is false, result is an error message. Otherwise, result is a -- table with the following elements:\n -- 'uid' The UserID for the session -- 'is_guest' If set, the username wasn't found so the user was automatically logged in -- as the guest account -- 'os' The operating system -- 'lanmanager' The servers's LAN Manager function start_session(socket, username, session_key, capabilities) local status, result local header, parameters, data local pos local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid local andx_command, andx_reserved, andx_offset, action local os, lanmanager, domain local response = {} header = smb_encode_header(0x73, 0, 0) -- Parameters parameters = bin.pack("<CCSSSSISSII", 0xFF, -- ANDX -- no further commands 0x00, -- ANDX -- Reserved (0) 0x0000, -- ANDX -- next offset 0x1000, -- Max buffer size 0x0001, -- Max multiplexes 0x0000, -- Virtual circuit num session_key, -- The session key 0, -- ANSI/Lanman password length 0, -- Unicode/NTLM password length 0, -- Reserved capabilities -- Capabilities ) -- Data is a list of strings, terminated by a blank one. data = bin.pack("<zzzz", -- ANSI/Lanman password -- Unicode/NTLM password username, -- Account "", -- Domain "Nmap", -- OS "Native Lanman" -- Native LAN Manager ) -- Send the session setup request smb_send(socket, header, parameters, data) -- Read the result status, header, parameters, data = smb_read(socket) if(status ~= true) then return false, header end -- Check if we were allowed in pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header) if(status ~= 0) then return false, status end -- Parse the parameters pos, andx_command, andx_reserved, andx_offset, action = bin.unpack("<CCSS", parameters) -- Parse the data pos, os, lanmanager, domain = bin.unpack("<zzz", data) -- Fill in the response string response['uid'] = uid response['is_guest'] = bit.band(action, 1) response['os'] = os response['lanmanager'] = lanmanager return true, response end --- Sends out SMB_COM_SESSION_TREE_CONNECT_ANDX, which attempts to connect to a share. -- Sends the following:\n -- * Password (for share-level security, which we don't support)\n -- * Share name\n -- * Share type (or "?????" if it's unknown, that's what we do)\n --\n -- Receives the following:\n -- * Tree ID\n --\n --@param socket The socket, in the proper state. --@param path The path to connect (eg, \\servername\C$) --@param uid The UserID, returned by SMB_COM_SESSION_SETUP_ANDX --@return (status, result) If status is false, result is an error message. Otherwise, result is a -- table with the following elements:\n -- 'tid' The TreeID for the session function tree_connect(socket, path, uid) local response = "" local header, parameters, data local pos local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid local andx_command, andx_reserved, andx_offset, action local response = {} header = smb_encode_header(0x75, uid, 0) parameters = bin.pack("<CCSSS", 0xFF, -- ANDX no further commands 0x00, -- ANDX reserved 0x0000, -- ANDX offset 0x0000, -- flags 0x0000 -- password length (for share-level security) ) data = bin.pack("zz", -- Share-level password path, -- Path "?????" -- Type of tree ("?????" = any) ) -- Send the tree connect request smb_send(socket, header, parameters, data) -- Read the result status, header, parameters, data = smb_read(socket) if(status ~= true) then return false, header end -- Check if we were allowed in pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header) if(status ~= 0) then return false, status end response['tid'] = tid return true, response end
--- Creates and parses NetBIOS traffic. The primary use for this is to send -- NetBIOS name requests. -- --@author Ron Bowes <ron () skullsecurity net> --@copyright See nmaps COPYING for licence ----------------------------------------------------------------------- module(... or "netbios", package.seeall) require 'bit' require 'bin' --- Encode a NetBIOS name for transport. Most packets that use the NetBIOS name -- require this encoding to happen first. It takes a name containing any possible -- character, and converted it to all uppercase characters (so it can, for example, -- pass case-sensitive data in a case-insensitive way)\n --\n -- There are two levels of encoding performed:\n -- L1: Pad the string to 16 characters withs spaces (or NULLs if it's the -- wildcard "*") and replace each byte with two bytes representing each -- of its nibbles, plus 0x41. \n -- L2: Prepend the length to the string, and to each substring in the scope -- (separated by periods). \n --@param name The name that will be encoded (eg. "TEST1"). --@param scope [optional] The scope to encode it with. I've never seen scopes used -- in the real world (eg, "insecure.org"). --@return The L2-encoded name and scope -- (eg. "\x20FEEFFDFEDBCACACACACACACACACAAA\x08insecure\x03org") function name_encode(name, scope) -- Truncate or pad the string to 16 bytes if(string.len(name) > 16) then name = string.sub(name, 1, 16) else local padding = " " if name == "*" then padding = "\0" end repeat name = name .. padding until string.len(name) == 16 end -- Do the L1 encoding local L1_encoded = "" for i=1, string.len(name), 1 do local b = string.byte(name, i) L1_encoded = L1_encoded .. string.char(bit.rshift(bit.band(b, 0xF0), 4) + 0x41) L1_encoded = L1_encoded .. string.char(bit.rshift(bit.band(b, 0x0F), 0) + 0x41) end -- Do the L2 encoding local L2_encoded = string.char(32) .. L1_encoded if scope ~= nil then -- Split the scope at its periods local piece for piece in string.gmatch(scope, "[^.]+") do L2_encoded = L2_encoded .. string.char(string.len(piece)) .. piece end end return L2_encoded end --- Does the exact opposite of name_encode. Converts an encoded name to -- the string representation. If the encoding is invalid, it will still attempt -- to decode the string as best as possible. --@param encoded_name The L2-encoded name --@returns the decoded name and the scope. The name will still be padded, and the -- scope will never be nil (empty string is returned if no scope is present) function name_decode(encoded_name) local name = "" local scope = "" local len = string.byte(encoded_name, 1) local i for i = 2, len + 1, 2 do local ch = 0 ch = bit.bor(ch, bit.lshift(string.byte(encoded_name, i) - 0x41, 4)) ch = bit.bor(ch, bit.lshift(string.byte(encoded_name, i + 1) - 0x41, 0)) name = name .. string.char(ch) end -- Decode the scope local pos = 34 while string.len(encoded_name) > pos do local len = string.byte(encoded_name, pos) scope = scope .. string.sub(encoded_name, pos + 1, pos + len) .. "." pos = pos + 1 + len end -- If there was a scope, remove the trailing period if(string.len(scope) > 0) then scope = string.sub(scope, 1, string.len(scope) - 1) end return name, scope end --- Sends out a UDP probe on port 137 to get a human-readable list of names the -- the system is using. --@param host The IP or hostname to check. --@param prefix [optional] The prefix to put on each line when it's returned. --@return (status, result) If status is true, the result is a human-readable -- list of names. Otherwise, result is an error message. function get_names(host, prefix) local status, names, statistics = do_nbstat(host) if(prefix == nil) then prefix = "" end if(status) then local result = "" for i = 1, #names, 1 do result = result .. string.format("%s%s<%02x>\n", prefix, names[i]['name'], names[i]['prefix']) end return true, result else return false, names end end --- Sends out a UDP probe on port 137 to get the server's name (that is, the -- entry in its NBSTAT table with a 0x20 suffix). --@param host The IP or hostname of the server. --@param names [optional] The names to use, from do_nbstat(). --@return (status, result) If status is true, the result is the NetBIOS name. -- otherwise, result is an error message. function get_server_name(host, names) local status local i if names == nil then status, names = do_nbstat(host) if(status == false) then return false, names end end for i = 1, #names, 1 do if names[i]['suffix'] == 0x20 then return true, names[i]['name'] end end return false, "Couldn't find NetBIOS server name" end --- Sends out a UDP probe on port 137 to get the user's name (that is, the -- entry in its NBSTAT table with a 0x03 suffix, that isn't the same as -- the server's name. If the username can't be determined, which is frequently -- the case, nil is returned. --@param host The IP or hostname of the server. --@param names [optional] The names to use, from do_nbstat(). --@return (status, result) If status is true, the result is the NetBIOS name or nil. -- otherwise, result is an error message. function get_user_name(host, names) local status, server_name = get_server_name(host, names) if(status == false) then return false, server_name end if(names == nil) then status, names = do_nbstat(host) if(status == false) then return false, names end end for i = 1, #names, 1 do if names[i]['suffix'] == 0x03 and names[i]['name'] ~= server_name then return true, names[i]['name'] end end return true, nil end --- This is the function that actually handles the UDP query to retrieve -- the NBSTAT information. \n --\n -- The NetBIOS request's header looks like this:\n -- --------------------------------------------------\n -- | 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 |\n -- | NAME_TRN_ID |\n -- | R | OPCODE | NM_FLAGS | RCODE | (FLAGS)\n -- | QDCOUNT |\n -- | ANCOUNT |\n -- | NSCOUNT |\n -- | ARCOUNT |\n -- --------------------------------------------------\n --\n -- In this case, the TRN_ID is a constant (0x1337, what else?), the flags -- are 0, and we have one question. All fields are network byte order. \n --\n -- The body of the packet is a list of names to check for in the following -- format:\n -- (ntstring) encoded name\n -- (2 bytes) query type (0x0021 = NBSTAT)\n -- (2 bytes) query class (0x0001 = IN)\n --\n -- The response header is the exact same, except it'll have some flags set -- (0x8000 for sure, since it's a response), and ANCOUNT will be 1. The format -- of the answer is:\n -- (ntstring) requested name\n -- (2 bytes) query type\n -- (2 bytes) query class\n -- (2 bytes) time to live\n -- (2 bytes) record length\n -- (1 byte) number of names\n -- [for each name]\n -- (16 bytes) padded name, with a 1-byte suffix\n -- (2 bytes) flags\n -- (variable) statistics (usually mac address)\n -- -- [TODO] caching -- --@param host The IP or hostname of the system. --@return (status, names, statistics) If status is true, then the servers names are -- returned as a table containing 'name', 'suffix', and 'flags'. -- Otherwise, names is an error message and statistics is undefined. function do_nbstat(host) local socket = nmap.new_socket() local encoded_name = name_encode("*") local statistics -- Create the query header local query = bin.pack(">SSSSSS", 0x1337, -- Transaction id 0x0000, -- Flags 1, -- Questions 0, -- Answers 0, -- Authority 0 -- Extra ) query = query .. bin.pack(">zSS", encoded_name, -- Encoded name 0x0021, -- Query type (0x21 = NBSTAT) 0x0001 -- Class = IN ) socket:connect(host, 137, "udp") socket:send(query) socket:set_timeout(1000) local status, result = socket:receive_bytes(1); socket:close() if(status) then local pos, TRN_ID, FLAGS, QDCOUNT, ANCOUNT, NSCOUNT, ARCOUNT, rr_name, rr_type, rr_class, rr_ttl local rrlength, name_count pos, TRN_ID, FLAGS, QDCOUNT, ANCOUNT, NSCOUNT, ARCOUNT = bin.unpack(">SSSSSS", result) -- Sanity check the result (has to have the same TRN_ID, 1 answer, and proper flags) if(TRN_ID ~= 0x1337) then return false, string.format("Invalid transaction ID returned: 0x%04x", TRN_ID) end if(ANCOUNT ~= 1) then return false, "Server returned an invalid number of answers" end if(bit.band(FLAGS, 0x8000) == 0) then return false, "Server's flags didn't indicate a response" end if(bit.band(FLAGS, 0x0007) ~= 0) then return false, string.format("Server returned a NetBIOS error: 0x%02x", bit.band(FLAGS, 0x0007)) end -- Start parsing the answer field pos, rr_name, rr_type, rr_class, rr_ttl = bin.unpack(">zSSI", result, pos) -- More sanity checks if(rr_name ~= encoded_name) then return false, "Server returned incorrect name" end if(rr_class ~= 0x0001) then return false, "Server returned incorrect class" end if(rr_type ~= 0x0021) then return false, "Server returned incorrect query type" end pos, rrlength, name_count = bin.unpack(">SC", result, pos) local names = {} for i = 1, name_count do local name, suffix, flags -- Instead of reading the 16-byte name and pulling off the suffix, -- we read the first 15 bytes and then the 1-byte suffix. pos, name, suffix, flags = bin.unpack(">A15CS", result, pos) name = string.gsub(name, "[ ]*$", "") names[i] = {} names[i]['name'] = name names[i]['suffix'] = suffix names[i]['flags'] = flags -- Decrement the length rrlength = rrlength - 18 end pos, statistics = bin.unpack(string.format(">A%d", rrlength), result, pos) return true, names, statistics else return false, "Name query failed: " .. result end end ---Convert the 16-bit flags field to a string. --@param flags The 16-bit flags field --@return A string representing the flags function flags_to_string(flags) local result = "" if(bit.band(flags, 0x8000) ~= 0) then result = result .. "<group>" else result = result .. "<unique>" end if(bit.band(flags, 0x1000) ~= 0) then result = result .. "<deregister>" end if(bit.band(flags, 0x0800) ~= 0) then result = result .. "<conflict>" end if(bit.band(flags, 0x0400) ~= 0) then result = result .. "<active>" end if(bit.band(flags, 0x0200) ~= 0) then result = result .. "<permanent>" end return result end
_______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev Archived at http://SecLists.Org
Current thread:
- [NSELib + NSE RFC] NetBIOS + SMB Ron (Sep 09)