Skip to content

Commit 751e602

Browse files
racerxdlracerxdl
committed
First Commit
1 parent 3683491 commit 751e602

14 files changed

+2168
-4
lines changed

‎App.ico‎

58.1 KB
Binary file not shown.

‎Constants.cs‎

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
using System;
2+
using System.Linq;
3+
using System.Runtime.InteropServices;
4+
using System.Text;
5+
6+
namespace MS17010Test {
7+
public static class Constants {
8+
public static byte[] negotiateProtoRequest() {
9+
byte[] netbios = new byte[] { 0x00, 0x00, 0x00, 0x54 };
10+
byte[] smbHeader = new byte[] {
11+
0xFF, 0x53, 0x4D, 0x42,
12+
0x72,
13+
0x00, 0x00, 0x00, 0x00,
14+
0x18,
15+
0x01, 0x28,
16+
0x00, 0x00,
17+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
18+
0x00, 0x00,
19+
0x00, 0x00,
20+
0x2F, 0x4B,
21+
0x00, 0x00,
22+
0xC5, 0x5E
23+
};
24+
25+
byte[] negotiateProtoRequest = new byte[] {
26+
0x00,
27+
0x31, 0x00,
28+
0x02,
29+
0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E, 0x30, 0x00,
30+
0x02,
31+
0x4C, 0x4D, 0x31, 0x2E, 0x32, 0x58, 0x30, 0x30, 0x32, 0x00,
32+
0x02,
33+
0x4E, 0x54, 0x20, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x20, 0x31, 0x2E, 0x30, 0x00,
34+
0x02,
35+
0x4E, 0x54, 0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32, 0x00
36+
};
37+
38+
return netbios.Concat(smbHeader).Concat(negotiateProtoRequest).ToArray();
39+
}
40+
41+
public static byte[] sessionSetupAndxRequest() {
42+
byte[] netbios = new byte[] { 0x00, 0x00, 0x00, 0x63 };
43+
byte[] smbHeader = new byte[] {
44+
0xFF, 0x53, 0x4D, 0x42,
45+
0x73,
46+
0x00, 0x00, 0x00, 0x00,
47+
0x18,
48+
0x01, 0x20,
49+
0x00, 0x00,
50+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
51+
0x00, 0x00,
52+
0x00, 0x00,
53+
0x2F, 0x4B,
54+
0x00, 0x00,
55+
0xC5, 0x5E
56+
};
57+
58+
byte[] setupAndxRequest = new byte[] {
59+
0x0D,
60+
0xFF,
61+
0x00,
62+
0x00, 0x00,
63+
0xDF, 0xFF,
64+
0x02, 0x00,
65+
0x01, 0x00,
66+
0x00, 0x00, 0x00, 0x00,
67+
0x00, 0x00,
68+
0x00, 0x00,
69+
0x00, 0x00, 0x00, 0x00,
70+
0x40, 0x00, 0x00, 0x00,
71+
0x26, 0x00,
72+
0x00,
73+
0x2e, 0x00,
74+
0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30, 0x30, 0x30, 0x20, 0x32, 0x31, 0x39, 0x35, 0x00,
75+
0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30, 0x30, 0x30, 0x20, 0x35, 0x2e, 0x30, 0x00,
76+
};
77+
78+
return netbios.Concat(smbHeader).Concat(setupAndxRequest).ToArray();
79+
}
80+
81+
public static byte[] treeConnectAndxRequest(string ip, UInt16 userid) {
82+
byte[] userIdB = BitConverter.GetBytes(userid);
83+
byte[] netbios = new byte[] { 0x00, 0x00, 0x00, 0x47 };
84+
byte[] smbHeader = new byte[] {
85+
0xFF, 0x53, 0x4D, 0x42,
86+
0x75,
87+
0x00, 0x00, 0x00, 0x00,
88+
0x18,
89+
0x01, 0x20,
90+
0x00, 0x00,
91+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
92+
0x00, 0x00,
93+
0x00, 0x00,
94+
0x2F, 0x4B,
95+
userIdB[0], userIdB[1],
96+
0xC5, 0x5E
97+
};
98+
99+
byte[] treeConnectAndxRequest = new byte[] {
100+
0x04,
101+
0xFF,
102+
0x00,
103+
0x00, 0x00,
104+
0x00, 0x00,
105+
0x01, 0x00,
106+
0x1C, 0x00,
107+
0x00,
108+
};
109+
110+
treeConnectAndxRequest = treeConnectAndxRequest.Concat(Encoding.ASCII.GetBytes($"\\\\{ip}\\IPC$"))
111+
.Concat(new byte[] { 0x00, 0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x00 }).ToArray();
112+
113+
int length = smbHeader.Length + treeConnectAndxRequest.Length;
114+
netbios[3] = (byte)(length & 0xFF);
115+
netbios[2] = (byte)((length >> 8) & 0xFF);
116+
netbios[1] = (byte)((length >> 16) & 0xFF);
117+
118+
return netbios.Concat(smbHeader).Concat(treeConnectAndxRequest).ToArray();
119+
}
120+
121+
public static byte[] peeknamedpipeRequest(UInt16 treeid, UInt16 processid, UInt16 userid, UInt16 multiplex_id) {
122+
byte[] netbios = new byte[] {
123+
0x00,
124+
0x00, 0x00, 0x4a
125+
};
126+
127+
byte[] treeIdB = BitConverter.GetBytes(treeid);
128+
byte[] processidB = BitConverter.GetBytes(processid);
129+
byte[] useridB = BitConverter.GetBytes(userid);
130+
byte[] multiplexidB = BitConverter.GetBytes(multiplex_id);
131+
132+
byte[] smbHeader = new byte[] {
133+
0xFF, 0x53, 0x4D, 0x42,
134+
0x25,
135+
0x00, 0x00, 0x00, 0x00,
136+
0x18,
137+
0x01, 0x28,
138+
0x00, 0x00,
139+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
140+
0x00, 0x00,
141+
treeIdB[0], treeIdB[1],
142+
processidB[0], processidB[1],
143+
useridB[0], useridB[1],
144+
multiplexidB[0], multiplexidB[1],
145+
};
146+
147+
byte[] peeknamedpipeRequest = new byte[] {
148+
0x10,
149+
0x00, 0x00,
150+
0x00, 0x00,
151+
0xff, 0xff,
152+
0xff, 0xff,
153+
0x00,
154+
0x00,
155+
0x00, 0x00,
156+
0x00, 0x00, 0x00, 0x00,
157+
0x00, 0x00,
158+
0x00, 0x00,
159+
0x4a, 0x00,
160+
0x00, 0x00,
161+
0x4a, 0x00,
162+
0x02,
163+
0x00,
164+
0x23, 0x00,
165+
0x00, 0x00,
166+
0x07, 0x00,
167+
0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x00
168+
};
169+
170+
return netbios.Concat(smbHeader).Concat(peeknamedpipeRequest).ToArray();
171+
}
172+
173+
public static byte[] sessionSetupRequest(UInt16 treeid, UInt16 processid, UInt16 userid, UInt16 multiplex_id) {
174+
byte[] netbios = new byte[] {
175+
0x00,
176+
0x00, 0x00, 0x4f
177+
};
178+
179+
byte[] smbHeader = new byte[] {
180+
0xFF, 0x53, 0x4D, 0x42,
181+
0x32,
182+
0x00, 0x00, 0x00, 0x00,
183+
0x18,
184+
0x07, 0xc0,
185+
0x00, 0x00,
186+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
187+
0x00, 0x00,
188+
(byte)(treeid & 0xFF), (byte)(treeid >> 8),
189+
(byte)(processid & 0xFF), (byte)(processid >> 8),
190+
(byte)(userid & 0xFF), (byte)(userid >> 8),
191+
(byte)(multiplex_id & 0xFF), (byte)(multiplex_id >> 8),
192+
};
193+
194+
byte[] sessionSetupRequest = new byte[] {
195+
0x0f,
196+
0x0c, 0x00,
197+
0x00, 0x00,
198+
0x01, 0x00,
199+
0x00, 0x00,
200+
0x00,
201+
0x00,
202+
0x00, 0x00,
203+
0xa6, 0xd9, 0xa4, 0x00,
204+
0x00, 0x00,
205+
0x0c, 0x00,
206+
0x42, 0x00,
207+
0x00, 0x00,
208+
0x4e, 0x00,
209+
0x01,
210+
0x00,
211+
0x0e, 0x00,
212+
0x00, 0x00,
213+
0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
214+
};
215+
216+
return netbios.Concat(smbHeader).Concat(sessionSetupRequest).ToArray();
217+
}
218+
219+
public static SmbHeader ByteArrayToSmbHeader(byte[] bytes) {
220+
GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned);
221+
SmbHeader stuff = (SmbHeader)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(SmbHeader));
222+
handle.Free();
223+
return stuff;
224+
}
225+
}
226+
}

‎Form1.Designer.cs‎

Lines changed: 103 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)