service_matcher-go/smb/smb.go
Administrator 7e4a2f1775 Revert "ing"
This reverts commit f265cbad85
2018-09-13 07:30:45 +00:00

167 lines
3.0 KiB
Go

package smb
import (
"bytes"
"encoding/binary"
"strings"
osm "git.loafle.net/overflow/service_matcher-go"
)
const (
SMB_COM_NEGOTIATE uint8 = 0x72
SMB_SUCCESS uint8 = 0x00
)
type netBIOS struct {
MsgType byte
MsgLength [3]uint8
}
type smb struct {
NetBios netBIOS
Component [4]uint8
SmbCommand uint8
NtStatus [4]uint8
Flags uint8
Flags2 [2]uint8
ProcessId uint16
Signature uint64
Reserved uint16
Tid uint16
Pid uint16
Uid uint16
Mid uint16
Wct uint8
Bcc uint16
Bf1 uint8
Name1 [23]uint8
Bf2 uint8
Name2 [10]uint8
Bf3 uint8
Name3 [28]uint8
Bf4 uint8
Name4 [10]uint8
Bf5 uint8
Name5 [10]uint8
Bf6 uint8
Name6 [11]uint8
}
type SMBMatcher struct {
osm.Matchers
}
func (m *SMBMatcher) Key() string {
return "SMB"
}
func (m *SMBMatcher) Type() string {
return "NETWORK"
}
func (m *SMBMatcher) Name(matchCtx *osm.MatchCtx) string {
return "SMB"
}
func (m *SMBMatcher) IsPrePacket() bool {
return false
}
func (m *SMBMatcher) HasResponse(matchCtx *osm.MatchCtx, index int) bool {
return true
}
func (m *SMBMatcher) IsError(matchCtx *osm.MatchCtx, index int, packet *osm.Packet) bool {
return false
}
func (m *SMBMatcher) Match(matchCtx *osm.MatchCtx, index int, packet *osm.Packet) error {
if packet == nil || !packet.Valid() {
return osm.NoPacketReceivedError()
}
reader := new(bytes.Buffer)
reader.Write(packet.Buffer)
s := smb{}
if err := binary.Read(reader, binary.BigEndian, &s); err != nil {
return err
}
var des [4]byte
copy(des[1:], s.NetBios.MsgLength[:])
packetLen := binary.BigEndian.Uint32(des[:])
if packetLen != uint32(packet.Len-4) {
return osm.NotMatchedError()
}
if !strings.Contains(string(s.Component[:]), "SMB") {
return osm.NotMatchedError()
}
if s.SmbCommand != SMB_COM_NEGOTIATE {
return osm.NotMatchedError()
}
return nil
}
func NewMatcher() osm.Matcher {
m := &SMBMatcher{}
query := smb{}
query.NetBios.MsgType = 0x00
query.NetBios.MsgLength[2] = 0x85
query.Component[0] = 0xff
query.Component[1] = 'S'
query.Component[2] = 'M'
query.Component[3] = 'B'
query.SmbCommand = SMB_COM_NEGOTIATE
query.NtStatus[3] = SMB_SUCCESS
query.Flags = 0x18
query.Flags2[0] = 0x53
query.Flags2[1] = 0xC8
query.ProcessId = 0x00
query.Signature = 0x00
query.Reserved = 0
query.Tid = 0
query.Pid = 0xfeff
query.Uid = 0
query.Mid = 0
query.Wct = 0
query.Bcc = 0x0062
query.Bf1 = 0x02
copy(query.Name1[:], "PC NETWORK PROGRAM 1.0")
query.Bf2 = 0x02
copy(query.Name2[:], "LANMAN1.0")
query.Bf3 = 0x02
copy(query.Name3[:], "Windows for Workgroups 3.1a")
query.Bf4 = 0x02
copy(query.Name4[:], "LM1.2X002")
query.Bf5 = 0x02
copy(query.Name5[:], "LANMAN2.1")
query.Bf6 = 0x02
copy(query.Name6[:], "NT LM 0.12")
writer := new(bytes.Buffer)
binary.Write(writer, binary.LittleEndian, query)
m.AddPacket(osm.NewPacket(writer.Bytes(), writer.Len()))
return m
}