● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
PUBLIC MIRRORGo v1.0

Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.

$ git clone https://shehzade.io/repos/contraband.git Copy
Source ZIP (1.93 MB)
Code 174 Commits 1
contraband / pkg / client / exfil / smb / smb_framing.go
← Back to directory
94 lines · 2.8 KB
Raw
1package smb
2
3import (
4 "encoding/binary"
5 "fmt"
6 "io"
7)
8
9// NetBIOS Session Service framing (RFC 1002)
10func PackNetBIOS(payload []byte) []byte {
11 out := make([]byte, 4+len(payload))
12 out[0] = 0x00
13 l := len(payload)
14 out[1] = byte(l >> 16)
15 out[2] = byte(l >> 8)
16 out[3] = byte(l)
17 copy(out[4:], payload)
18 return out
19}
20
21func ReadNetBIOSMessage(r io.Reader) ([]byte, error) {
22 hdr := make([]byte, 4)
23 if _, err := io.ReadFull(r, hdr); err != nil {
24 return nil, err
25 }
26 l := (int(hdr[1]) << 16) | (int(hdr[2]) << 8) | int(hdr[3])
27 if l <= 0 || l > 16*1024*1024 {
28 return nil, fmt.Errorf("invalid NetBIOS packet length: %d", l)
29 }
30 payload := make([]byte, l)
31 if _, err := io.ReadFull(r, payload); err != nil {
32 return nil, err
33 }
34 return payload, nil
35}
36
37// SMB2 Header
38type SMB2Header struct {
39 ProtocolID [4]byte // \xFESMB
40 StructureSize uint16 // 64
41 CreditCharge uint16
42 Status uint32
43 Command uint16
44 CreditReqResp uint16
45 Flags uint32
46 NextCommand uint32
47 MessageID uint64
48 Reserved uint32
49 TreeID uint32
50 SessionID uint64
51 Signature [16]byte
52}
53
54func (h *SMB2Header) Encode() []byte {
55 buf := make([]byte, 64)
56 copy(buf[0:4], h.ProtocolID[:])
57 binary.LittleEndian.PutUint16(buf[4:6], 64)
58 binary.LittleEndian.PutUint16(buf[6:8], h.CreditCharge)
59 binary.LittleEndian.PutUint32(buf[8:12], h.Status)
60 binary.LittleEndian.PutUint16(buf[12:14], h.Command)
61 binary.LittleEndian.PutUint16(buf[14:16], h.CreditReqResp)
62 binary.LittleEndian.PutUint32(buf[16:20], h.Flags)
63 binary.LittleEndian.PutUint32(buf[20:24], h.NextCommand)
64 binary.LittleEndian.PutUint64(buf[24:32], h.MessageID)
65 binary.LittleEndian.PutUint32(buf[32:36], h.Reserved)
66 binary.LittleEndian.PutUint32(buf[36:40], h.TreeID)
67 binary.LittleEndian.PutUint64(buf[40:48], h.SessionID)
68 copy(buf[48:64], h.Signature[:])
69 return buf
70}
71
72func DecodeSMB2Header(data []byte) (*SMB2Header, error) {
73 if len(data) < 64 {
74 return nil, fmt.Errorf("data too short for SMB2 header: %d", len(data))
75 }
76 if data[0] != 0xFE || data[1] != 'S' || data[2] != 'M' || data[3] != 'B' {
77 return nil, fmt.Errorf("invalid SMB2 magic: %x", data[0:4])
78 }
79 h := &SMB2Header{}
80 copy(h.ProtocolID[:], data[0:4])
81 h.StructureSize = binary.LittleEndian.Uint16(data[4:6])
82 h.CreditCharge = binary.LittleEndian.Uint16(data[6:8])
83 h.Status = binary.LittleEndian.Uint32(data[8:12])
84 h.Command = binary.LittleEndian.Uint16(data[12:14])
85 h.CreditReqResp = binary.LittleEndian.Uint16(data[14:16])
86 h.Flags = binary.LittleEndian.Uint32(data[16:20])
87 h.NextCommand = binary.LittleEndian.Uint32(data[20:24])
88 h.MessageID = binary.LittleEndian.Uint64(data[24:32])
89 h.Reserved = binary.LittleEndian.Uint32(data[32:36])
90 h.TreeID = binary.LittleEndian.Uint32(data[36:40])
91 h.SessionID = binary.LittleEndian.Uint64(data[40:48])
92 copy(h.Signature[:], data[48:64])
93 return h, nil
94}