pkg/client/exfil/smb/smb_messages.go · contraband

        ● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
      

Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.

$ git clone https://shehzade.io/repos/contraband.git Copy

Source ZIP (1.93 MB)

Code 174 Commits 1

← Back to directory

162 lines · 5.2 KB

Raw

1	package smb
2
3	import (
4	"encoding/binary"
5	)
6
7	// Build SMB2 Negotiate Request
8	func BuildSMB2NegotiateRequest(messageID uint64) []byte {
9	hdr := SMB2Header{
10	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
11	StructureSize: 64,
12	Command: 0x0000, // SMB2_NEGOTIATE
13	CreditReqResp: 1,
14	MessageID: messageID,
15	}
16	body := make([]byte, 36+8) // 36 fixed + 4 dialects (2 bytes each)
17	binary.LittleEndian.PutUint16(body[0:2], 36)
18	binary.LittleEndian.PutUint16(body[2:4], 4) // 4 dialects
19	binary.LittleEndian.PutUint16(body[4:6], 1) // SecurityMode
20	// Dialects: 0x0202 (SMB 2.0.2), 0x0210 (SMB 2.1), 0x0300 (SMB 3.0), 0x0311 (SMB 3.1.1)
21	binary.LittleEndian.PutUint16(body[36:38], 0x0202)
22	binary.LittleEndian.PutUint16(body[38:40], 0x0210)
23	binary.LittleEndian.PutUint16(body[40:42], 0x0300)
24	binary.LittleEndian.PutUint16(body[42:44], 0x0311)
25
26	packet := append(hdr.Encode(), body...)
27	return packet
28	}
29
30	// Build SMB2 Session Setup Request
31	func BuildSMB2SessionSetupRequest(messageID uint64, sessionID uint64, ntlmsspPayload []byte) []byte {
32	hdr := SMB2Header{
33	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
34	StructureSize: 64,
35	Command: 0x0001, // SMB2_SESSION_SETUP
36	CreditReqResp: 1,
37	MessageID: messageID,
38	SessionID: sessionID,
39	}
40	body := make([]byte, 24)
41	binary.LittleEndian.PutUint16(body[0:2], 25)
42	body[2] = 0 // Flags
43	body[3] = 1 // SecurityMode
44	binary.LittleEndian.PutUint32(body[4:8], 0)
45	binary.LittleEndian.PutUint32(body[8:12], 0)
46	secBufOffset := uint16(64 + 24)
47	binary.LittleEndian.PutUint16(body[12:14], secBufOffset)
48	binary.LittleEndian.PutUint16(body[14:16], uint16(len(ntlmsspPayload)))
49	binary.LittleEndian.PutUint64(body[16:24], 0)
50
51	packet := append(hdr.Encode(), body...)
52	packet = append(packet, ntlmsspPayload...)
53	return packet
54	}
55
56	// Build SMB2 Tree Connect Request
57	func BuildSMB2TreeConnectRequest(messageID uint64, sessionID uint64, sharePath string) []byte {
58	hdr := SMB2Header{
59	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
60	StructureSize: 64,
61	Command: 0x0003, // SMB2_TREE_CONNECT
62	CreditReqResp: 1,
63	MessageID: messageID,
64	SessionID: sessionID,
65	}
66	pathBytes := EncodeUTF16LE(sharePath)
67	body := make([]byte, 8)
68	binary.LittleEndian.PutUint16(body[0:2], 9)
69	binary.LittleEndian.PutUint16(body[2:4], 0)
70	binary.LittleEndian.PutUint16(body[4:6], uint16(64+8))
71	binary.LittleEndian.PutUint16(body[6:8], uint16(len(pathBytes)))
72
73	packet := append(hdr.Encode(), body...)
74	packet = append(packet, pathBytes...)
75	return packet
76	}
77
78	// Build SMB2 Create Request
79	func BuildSMB2CreateRequest(messageID uint64, sessionID uint64, treeID uint32, fileName string) []byte {
80	hdr := SMB2Header{
81	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
82	StructureSize: 64,
83	Command: 0x0005, // SMB2_CREATE
84	CreditReqResp: 1,
85	MessageID: messageID,
86	SessionID: sessionID,
87	TreeID: treeID,
88	}
89	nameBytes := EncodeUTF16LE(fileName)
90	body := make([]byte, 56)
91	binary.LittleEndian.PutUint16(body[0:2], 57)
92	body[2] = 0 // SecurityFlags
93	body[3] = 0 // RequestedOplockLevel
94	binary.LittleEndian.PutUint32(body[4:8], 2)
95	binary.LittleEndian.PutUint32(body[24:28], 0x00120116) // DesiredAccess
96	binary.LittleEndian.PutUint32(body[28:32], 0x80) // FileAttributes
97	binary.LittleEndian.PutUint32(body[32:36], 7) // ShareAccess
98	binary.LittleEndian.PutUint32(body[36:40], 2) // CreateDisposition
99	binary.LittleEndian.PutUint16(body[44:46], uint16(64+56))
100	binary.LittleEndian.PutUint16(body[46:48], uint16(len(nameBytes)))
101
102	packet := append(hdr.Encode(), body...)
103	packet = append(packet, nameBytes...)
104	return packet
105	}
106
107	// Build SMB2 Write Request
108	func BuildSMB2WriteRequest(messageID uint64, sessionID uint64, treeID uint32, fileID [16]byte, fileOffset uint64, data []byte) []byte {
109	hdr := SMB2Header{
110	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
111	StructureSize: 64,
112	Command: 0x0009, // SMB2_WRITE
113	CreditReqResp: 1,
114	MessageID: messageID,
115	SessionID: sessionID,
116	TreeID: treeID,
117	}
118	body := make([]byte, 48)
119	binary.LittleEndian.PutUint16(body[0:2], 49)
120	binary.LittleEndian.PutUint16(body[2:4], uint16(64+48))
121	binary.LittleEndian.PutUint32(body[4:8], uint32(len(data)))
122	binary.LittleEndian.PutUint64(body[8:16], fileOffset)
123	copy(body[16:32], fileID[:])
124
125	packet := append(hdr.Encode(), body...)
126	packet = append(packet, data...)
127	return packet
128	}
129
130	// Build SMB2 Close Request
131	func BuildSMB2CloseRequest(messageID uint64, sessionID uint64, treeID uint32, fileID [16]byte) []byte {
132	hdr := SMB2Header{
133	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
134	StructureSize: 64,
135	Command: 0x0006, // SMB2_CLOSE
136	CreditReqResp: 1,
137	MessageID: messageID,
138	SessionID: sessionID,
139	TreeID: treeID,
140	}
141	body := make([]byte, 24)
142	binary.LittleEndian.PutUint16(body[0:2], 24)
143	copy(body[8:24], fileID[:])
144
145	return append(hdr.Encode(), body...)
146	}
147
148	// Build SMB2 Tree Disconnect Request
149	func BuildSMB2TreeDisconnectRequest(messageID uint64, sessionID uint64, treeID uint32) []byte {
150	hdr := SMB2Header{
151	ProtocolID: [4]byte{0xFE, 'S', 'M', 'B'},
152	StructureSize: 64,
153	Command: 0x0004, // SMB2_TREE_DISCONNECT
154	CreditReqResp: 1,
155	MessageID: messageID,
156	SessionID: sessionID,
157	TreeID: treeID,
158	}
159	body := make([]byte, 4)
160	binary.LittleEndian.PutUint16(body[0:2], 4)
161	return append(hdr.Encode(), body...)
162	}

package smb

import (
	"encoding/binary"
)

// Build SMB2 Negotiate Request
func BuildSMB2NegotiateRequest(messageID uint64) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0000, // SMB2_NEGOTIATE
		CreditReqResp: 1,
		MessageID:     messageID,
	}
	body := make([]byte, 36+8) // 36 fixed + 4 dialects (2 bytes each)
	binary.LittleEndian.PutUint16(body[0:2], 36)
	binary.LittleEndian.PutUint16(body[2:4], 4) // 4 dialects
	binary.LittleEndian.PutUint16(body[4:6], 1) // SecurityMode
	// Dialects: 0x0202 (SMB 2.0.2), 0x0210 (SMB 2.1), 0x0300 (SMB 3.0), 0x0311 (SMB 3.1.1)
	binary.LittleEndian.PutUint16(body[36:38], 0x0202)
	binary.LittleEndian.PutUint16(body[38:40], 0x0210)
	binary.LittleEndian.PutUint16(body[40:42], 0x0300)
	binary.LittleEndian.PutUint16(body[42:44], 0x0311)

	packet := append(hdr.Encode(), body...)
	return packet
}

// Build SMB2 Session Setup Request
func BuildSMB2SessionSetupRequest(messageID uint64, sessionID uint64, ntlmsspPayload []byte) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0001, // SMB2_SESSION_SETUP
		CreditReqResp: 1,
		MessageID:     messageID,
		SessionID:     sessionID,
	}
	body := make([]byte, 24)
	binary.LittleEndian.PutUint16(body[0:2], 25)
	body[2] = 0 // Flags
	body[3] = 1 // SecurityMode
	binary.LittleEndian.PutUint32(body[4:8], 0)
	binary.LittleEndian.PutUint32(body[8:12], 0)
	secBufOffset := uint16(64 + 24)
	binary.LittleEndian.PutUint16(body[12:14], secBufOffset)
	binary.LittleEndian.PutUint16(body[14:16], uint16(len(ntlmsspPayload)))
	binary.LittleEndian.PutUint64(body[16:24], 0)

	packet := append(hdr.Encode(), body...)
	packet = append(packet, ntlmsspPayload...)
	return packet
}

// Build SMB2 Tree Connect Request
func BuildSMB2TreeConnectRequest(messageID uint64, sessionID uint64, sharePath string) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0003, // SMB2_TREE_CONNECT
		CreditReqResp: 1,
		MessageID:     messageID,
		SessionID:     sessionID,
	}
	pathBytes := EncodeUTF16LE(sharePath)
	body := make([]byte, 8)
	binary.LittleEndian.PutUint16(body[0:2], 9)
	binary.LittleEndian.PutUint16(body[2:4], 0)
	binary.LittleEndian.PutUint16(body[4:6], uint16(64+8))
	binary.LittleEndian.PutUint16(body[6:8], uint16(len(pathBytes)))

	packet := append(hdr.Encode(), body...)
	packet = append(packet, pathBytes...)
	return packet
}

// Build SMB2 Create Request
func BuildSMB2CreateRequest(messageID uint64, sessionID uint64, treeID uint32, fileName string) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0005, // SMB2_CREATE
		CreditReqResp: 1,
		MessageID:     messageID,
		SessionID:     sessionID,
		TreeID:        treeID,
	}
	nameBytes := EncodeUTF16LE(fileName)
	body := make([]byte, 56)
	binary.LittleEndian.PutUint16(body[0:2], 57)
	body[2] = 0 // SecurityFlags
	body[3] = 0 // RequestedOplockLevel
	binary.LittleEndian.PutUint32(body[4:8], 2)
	binary.LittleEndian.PutUint32(body[24:28], 0x00120116) // DesiredAccess
	binary.LittleEndian.PutUint32(body[28:32], 0x80)       // FileAttributes
	binary.LittleEndian.PutUint32(body[32:36], 7)          // ShareAccess
	binary.LittleEndian.PutUint32(body[36:40], 2)          // CreateDisposition
	binary.LittleEndian.PutUint16(body[44:46], uint16(64+56))
	binary.LittleEndian.PutUint16(body[46:48], uint16(len(nameBytes)))

	packet := append(hdr.Encode(), body...)
	packet = append(packet, nameBytes...)
	return packet
}

// Build SMB2 Write Request
func BuildSMB2WriteRequest(messageID uint64, sessionID uint64, treeID uint32, fileID [16]byte, fileOffset uint64, data []byte) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0009, // SMB2_WRITE
		CreditReqResp: 1,
		MessageID:     messageID,
		SessionID:     sessionID,
		TreeID:        treeID,
	}
	body := make([]byte, 48)
	binary.LittleEndian.PutUint16(body[0:2], 49)
	binary.LittleEndian.PutUint16(body[2:4], uint16(64+48))
	binary.LittleEndian.PutUint32(body[4:8], uint32(len(data)))
	binary.LittleEndian.PutUint64(body[8:16], fileOffset)
	copy(body[16:32], fileID[:])

	packet := append(hdr.Encode(), body...)
	packet = append(packet, data...)
	return packet
}

// Build SMB2 Close Request
func BuildSMB2CloseRequest(messageID uint64, sessionID uint64, treeID uint32, fileID [16]byte) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0006, // SMB2_CLOSE
		CreditReqResp: 1,
		MessageID:     messageID,
		SessionID:     sessionID,
		TreeID:        treeID,
	}
	body := make([]byte, 24)
	binary.LittleEndian.PutUint16(body[0:2], 24)
	copy(body[8:24], fileID[:])

	return append(hdr.Encode(), body...)
}

// Build SMB2 Tree Disconnect Request
func BuildSMB2TreeDisconnectRequest(messageID uint64, sessionID uint64, treeID uint32) []byte {
	hdr := SMB2Header{
		ProtocolID:    [4]byte{0xFE, 'S', 'M', 'B'},
		StructureSize: 64,
		Command:       0x0004, // SMB2_TREE_DISCONNECT
		CreditReqResp: 1,
		MessageID:     messageID,
		SessionID:     sessionID,
		TreeID:        treeID,
	}
	body := make([]byte, 4)
	binary.LittleEndian.PutUint16(body[0:2], 4)
	return append(hdr.Encode(), body...)
}