CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 14:49:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Do not trust SMB challenge length field with Extended Security in use

Browse source 
Some Samba servers fail to zero it out. See
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb/d883d0a5-5a0a-4626-8e3e-87b0b66b79aa
Fixes #1707, closes #1476
This commit is contained in:
nnposter 2019-09-08 00:40:27 +00:00
parent d608b26eb5
commit c491143358
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGELOG
View file

@ -18,6 +18,10 @@ o [NSE][GH#1720] Functions lsa_lookupnames2 and lsa_lookupsids2 in library
msrpc were incorrectly referencing function strjoin when called with debug
level 2 or higher. [Ivan Ivanov]
o [NSE][GH#1476][GH#1707] A MS-SMB spec non-compliance in Samba was causing
protocol negotiation to fail with data string too short error.
[Clément Notin, nnposter]
o [NSE][GH#1480][GH#1713][GH#1714] A bug in SMB library was causing scripts to
fail with bad format argument error. [Ivan Ivanov]

11
nselib/smb.lua
View file

@ -1020,15 +1020,11 @@ function negotiate_v1(smb, overrides)
end
-- Data section
if #data < smb.key_length then
return false, "SMB: ERROR: not enough data for server_challenge"
end
smb.server_challenge, pos = string.unpack(string.format("<c%d", smb['key_length']), data)
if(smb['extended_security'] == true) then
if #data < 16 then
return false, "SMB: ERROR: not enough data for extended security"
end
smb.server_guid, pos = string.unpack("<c16", data, pos)
smb.server_guid, pos = string.unpack("<c16", data)
-- do we have a security blob?
if ( #data - pos + 1 > 0 ) then
@ -1036,6 +1032,11 @@ function negotiate_v1(smb, overrides)
pos = #data + 1
end
else
if #data < smb.key_length then
return false, "SMB: ERROR: not enough data for server_challenge"
end
smb.server_challenge, pos = string.unpack(string.format("<c%d", smb['key_length']), data)
-- Get the (null-terminated) domain as a Unicode string
smb['domain'] = ""
smb['server'] = ""