Comments (8)
Looks like this is an issue with the documentation of SMB_STRING and not
implementing it correctly.
This has been raised with Microsoft previously:
1. According to 2.2.1.1, an SMB_STRING is a "null-terminated character sequence
fields that may be encoded in either Unicode or OEM characters".
However, according to the document notes, the FileName field in:
SMB_INFO_QUERY_EA_SIZE,
SMB_INFO_QUERY_EAS_FROM_LIST,
SMB_FIND_FILE_DIRECTORY_INFO
SMB_FIND_FILE_FULL_DIRECTORY_INFO
SMB_FIND_FILE_NAMES_INFO
SMB_FIND_FILE_BOTH_DIRECTORY_INFO,
which is denoted as SMB_STRING, does not terminate in 2 null bytes.
There is clearly a logical error here.
http://social.msdn.microsoft.com/Forums/en-US/713b6ce7-183b-489c-8b97-dbcda8ce7a
46/mscifs-possible-documentaion-mistakes?forum=os_specifications
Original comment by [email protected]
on 24 Aug 2014 at 11:14
- Added labels: ****
- Removed labels: ****
from impacket.
Hey mate.. thanks for the bug report + research!
I'll take a look at it.. how did you find this?.. coding a client asking for
those commands or through the smbserver.py?
If you have a repro test code that'd be great...
Original comment by [email protected]
on 24 Aug 2014 at 2:23
- Changed state: Accepted
- Added labels: ****
- Removed labels: ****
from impacket.
I've been working on some SMB pcap parsing, which means understanding both
ends. Fortunately, the smbserver provides significant help with at least one
direction. I've used wireshark as my source of truth for the data layout.
I've attached an example of the FileName without double NUL.
The padding aligning can make it seem like there is a NULs, so it took a few
test captures to get it.
Original comment by [email protected]
on 24 Aug 2014 at 3:13
- Added labels: ****
- Removed labels: ****
Attachments:
from impacket.
Thanks for the pcap file! I'll definitely take a look it at.
We all love wireshark :).. but don't forget about the Microsoft Network Monitor
(http://www.microsoft.com/en-us/download/details.aspx?id=4865). With all the
Windows protocol parsers on, it's just awesome. Might be useful for you. It was
key for me to develop the DCOM runtime, wireshark is not good parsing that
part..
Original comment by [email protected]
on 24 Aug 2014 at 3:28
- Added labels: ****
- Removed labels: ****
from impacket.
Thanks for the awesome tip! And yeah, I can see what you mean. Very
comprehensive and having quick access to the type definitions, plus
calculations for offsets. This will definitely save me some time.
Original comment by [email protected]
on 24 Aug 2014 at 3:42
- Added labels: ****
- Removed labels: ****
from impacket.
Good to know mate..
Hey.. take a look at this smb.py and tell me how it goes. Keep in mind you will
need to manually utf-16 decode the contents of the FileName structure member.
In case you didn't know, inside your code you can easily see how the structures
are being parsed by calling the dump() method (after you did a fromString() or
created an instance of a structure and fed some data).
I'm assuming you know where to put this smb.py and be sure it is loaded by your
code (e.g. being in the PYTHONPATH). If you have problems with this let me know
tell me how it goes..
Original comment by [email protected]
on 24 Aug 2014 at 9:11
- Added labels: ****
- Removed labels: ****
Attachments:
from impacket.
Perfect. That works a treat!
Cheers for this. After seeing your changes, it makes a lot on sense. Very
simple.
Nice work on this project :)
Original comment by [email protected]
on 30 Aug 2014 at 5:29
- Added labels: ****
- Removed labels: ****
from impacket.
Great to know it works ;).. I just updated trunk with these changes..
https://code.google.com/p/impacket/source/detail?r=1259
I'm glad you like impacket! :).. Let me know if you have other questions..
closing this ticket.
cheers
beto
Original comment by [email protected]
on 30 Aug 2014 at 8:22
- Changed state: Fixed
- Added labels: ****
- Removed labels: ****
from impacket.
Related Issues (20)
- smbrelayx.py prob HOT 9
- smbserver.py does not work with signing HOT 1
- SMBTransport instance has no attribute 'get_dce_rpc' HOT 5
- secretsdump.py not working against winXP HOT 1
- secretsdump not working against a Windows 2000 Server HOT 1
- Error on function set_bytes_from_string in ImpactPacket.py HOT 2
- Services.py pass the hash causes an error HOT 3
- Python 2.6 support for OrderedDict HOT 2
- esentutl.py crashes while dumping table from ntds.dit HOT 6
- retr_file permissions issue in smb.py HOT 12
- smbserver not working with OSX Mavericks
- On Windows 2012R2 reports Broken Pipe HOT 7
- Bad record decoding in ese.py HOT 3
- error: can only concatenate tuple (not "unicode") to tuple HOT 6
- secretsdump.py utf16 codec errors HOT 13
- SMBv1 stack doesn't talk unicode on the wire HOT 8
- New KRB5 module/lib isn't installed HOT 2
- Patch for /trunk/impacket/examples/serviceinstall.py HOT 1
- psexec.py script throwing exceptions
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from impacket.