o CDi y@sddlZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl Tddl Tddl mZGdddZGd d d ZGd d d eZGd ddeZGdddeZGdddeZGdddeZGdddeZGdddeZGdddeZGdddeZGdddeZGdd d eZGd!d"d"eZGd#d$d$eZGd%d&d&eZGd'd(d(eZGd)d*d*eZ Gd+d,d,eZ!Gd-d.d.eZ"Gd/d0d0eZ#Gd1d2d2eZ$Gd3d4d4eZ%Gd5d6d6eZ&Gd7d8d8eZ'dS)9N)StringIO) ProtocolError)*)convertFILETIMEtoEpochc@seZdZdZeeZdZeeZdZ ee Z dZ e dZdZddd Zd d Zd d ZddZddZddZeddZeddZdS) SMB2Messagez <4sHHIHHIzzStatus: 0x%08X %szFlags: 0x%02X %sz PID: %d %sz MID: %d %sz TID: %d %szData: %d bytes %s%s %s)rwritecommandSMB2_COMMAND_NAMESgetoslinesepstatusflagspidmidtidlendatastrbinasciihexlifygetvalue)rbrrr__str__ s",zSMB2Message.__str__cCsjd|_d|_d|_d|_d|_d|_d|_d|_d|_d|_ d|_ d|_ d|_ d|_ d|_d|_d|_dS)Nrs)raw_datarrrnext_command_offsetr session_id signaturer rasync_idrrflags2uidsecurityparameters_datarrrrr +s" zSMB2Message.resetc Csp|jsJt|_|j|t|jd|jd|j |j d|j t|j |j |j|j|j|j|j}||jS)a# Encode this SMB2 message into a series of bytes suitable to be embedded with a NetBIOS session message. AssertionError will be raised if this SMB message has not been initialized with a Payload instance @return: a string containing the encoded SMB2 message SMBr)r rgetpidrpreparestructpackHEADER_STRUCT_FORMAT HEADER_SIZErrrSYNC_HEADER_STRUCT_FORMATr'rrr(r)r)r headers_datarrrencodeEs   " zSMB2Message.encodecCst|}|dkr td||t|j|d|j\}}|_|_|_ |_ |_ |dkr2td|||j kr;td|j rf||j|jkrKtd|t|j||j|j|j\|_|_|_|_|_n)||j|jkrstd|t|j||j|j|j\|_|_|_|_|_|_|jdkr|d|j|_||j |j|_n ||_||j d|_||jr|j|t|jS)aN Decodes the SMB message in buf. All fields of the SMB2Message object will be reset to default values before decoding. On errors, do not assume that the fields will be reinstated back to what they are before this method is invoked. References ========== - [MS-SMB2]: 2.2.1 @param buf: data containing one complete SMB2 message @type buf: string @return: a positive integer indicating the number of bytes used in buf to decode this SMB message @raise ProtocolError: raised when decoding fails rz%Not enough data to decode SMB2 headerNr0z"Invalid 4-byte SMB2 protocol fieldz"Invalid SMB2 header structure sizer)rrr r3unpackr5HEADER_STRUCT_SIZE credit_chargerr credit_rerr6isAsyncASYNC_HEADER_STRUCT_SIZEASYNC_HEADER_STRUCT_FORMATr'rr*r(r)SYNC_HEADER_STRUCT_SIZEr7rrr&r_decodeCommandr decode)rbufbuf_lenprotocol struct_sizerrrrCVsF         zSMB2Message.decodecCs |jtkr t|_dS|jtkrt|_dS|jtkr!t|_dS|jtkr,t |_dS|jt kr7t |_dS|jt krBt |_dS|jtkrMt|_dS|jtkrXt|_dS|jtkrct|_dS|jtkrnt|_dS|jtkryt|_dS|jtkrt|_dSdSr )r SMB2_COM_READSMB2ReadResponser SMB2_COM_WRITESMB2WriteResponseSMB2_COM_QUERY_DIRECTORYSMB2QueryDirectoryResponseSMB2_COM_CREATESMB2CreateResponseSMB2_COM_CLOSESMB2CloseResponseSMB2_COM_QUERY_INFOSMB2QueryInfoResponseSMB2_COM_SET_INFOSMB2SetInfoResponseSMB2_COM_IOCTLSMB2IoctlResponseSMB2_COM_TREE_CONNECTSMB2TreeConnectResponseSMB2_COM_SESSION_SETUPSMB2SessionSetupResponseSMB2_COM_NEGOTIATESMB2NegotiateResponse SMB2_COM_ECHOSMB2EchoResponser/rrrrBs2                        zSMB2Message._decodeCommandcCt|jt@Sr )boolrSMB2_FLAGS_ASYNC_COMMANDr/rrrr>zSMB2Message.isAsynccCr`r )rarSMB2_FLAGS_SERVER_TO_REDIRr/rrrisReplyrczSMB2Message.isReplyr )__name__ __module__ __qualname__r5r3calcsizer;r@r?r7rAr6logging getLoggerlogrFrr$r r9rCrBpropertyr>rerrrrr s(      ; rc@s$eZdZddZddZddZdS) StructurecCdSr rrmessagerrrr zStructure.initMessagecCtr NotImplementedErrorrprrrr2rrzStructure.preparecCrsr rtrprrrrCrrzStructure.decodeN)rfrgrhr r2rCrrrrrns rnc@&eZdZdZdZeeZddZdS)r]a Contains information on the SMB2_NEGOTIATE response from server After calling the decode method, each instance will contain the following attributes, - security_mode (integer) - dialect_revision (integer) - server_guid (string) - max_transact_size (integer) - max_read_size (integer) - max_write_size (integer) - system_time (long) - server_start_time (long) - security_blob (string) References: =========== - [MS-SMB2]: 2.2.4 zeZdZdZdZeeZeddZ eddZ ddZ d S) r[a  Contains information about the SMB2_COM_SESSION_SETUP response from the server. If the message has no errors, each instance contains the following attributes: - session_flags (integer) - security_blob (string) References: =========== - [MS-SMB2]: 2.2.6 ||_||_||_||_||_||_||_||_| pd|_dSNr%) filenamefile_attributes access_mask share_access create_dispcreate_optionsoplock impersonationcreate_context_data) rrrrrrrrrrrrrr`szSMB2CreateRequest.__init__cCrr )rnr rNrrprrrr orzSMB2CreateRequest.initMessagecCs|jd}t|}|jr:tj|jt|}|ddkr2|dd|d7}tj|jt|}n|}||j7}nd}|s@d}|ddksHJt|j dd|j |j dd|j |j |j|j|jtj|j||t|j||_dS)Nrr9)rr9rrrr6ryr3r4rxrrrrrrrr)rrqrD filename_lenncreate_context_offsetrrrr2ss@     zSMB2CreateRequest.prepareN) rfrgrhrrxr3riry SEC_ANONYMOUSSMB2_OPLOCK_LEVEL_NONErr r2rrrrrVs   rc@rv)rOa Contains information about the SMB2_COM_CREATE response from the server. If the message has no errors, each instance contains the following attributes: - oplock (integer): one of SMB2_OPLOCK_LEVEL_xxx constants - create_action (integer): one of SMB2_FILE_xxx constants - allocation_size (long) - file_size (long) - file_attributes (integer) - fid (16-bytes string) - create_time, lastaccess_time, lastwrite_time, change_time (float) References: =========== - [MS-SMB2]: 2.2.14 zt|jd|j|jt|jtj|j d|j |j |j|_dS)Nrr) r3r4rxrrrrrr6ryrrrprrrr2's  zSMB2SetInfoRequest.prepareNrrrrrrrrc@r)rUz= References: =========== - [MS-SMB2]: 2.2.40 cCror rrprrrrC:rrzSMB2SetInfoResponse.decodeNrrrrrrU3rrUc@s.eZdZdZdZeeZddZddZ dS)SMB2EchoRequestz= References: =========== - [MS-SMB2]: 2.2.28 zs   rc@r)r_z= References: =========== - [MS-SMB2]: 2.2.29 cCror rrprrrrCXrrzSMB2EchoResponse.decodeNrrrrrr_Qrr_)(rsysr3typesrjr timeior smb_structsr smb_constantssmb2_constantsutilsrrrnr]rr[rrYrrOrrKrrIrrWrrQrrMrrSrrUrr_rrrrs@8   + $!@$$$&& !&!