From c491143358f3417ed7f6712ae8a9d3e48699463a Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Sun, 8 Sep 2019 00:40:27 +0000
Subject: [PATCH] Do not trust SMB challenge length field with Extended
 Security in use Some Samba servers fail to zero it out. See
 https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb/d883d0a5-5a0a-4626-8e3e-87b0b66b79aa
 Fixes #1707, closes #1476

---
 CHANGELOG      |  4 ++++
 nselib/smb.lua | 11 ++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index d485a4fab..22e789239 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,10 @@ o [NSE][GH#1720] Functions lsa_lookupnames2 and lsa_lookupsids2 in library
   msrpc were incorrectly referencing function strjoin when called with debug
   level 2 or higher. [Ivan Ivanov]
 
+o [NSE][GH#1476][GH#1707] A MS-SMB spec non-compliance in Samba was causing
+  protocol negotiation to fail with data string too short error.
+  [Clément Notin, nnposter]
+
 o [NSE][GH#1480][GH#1713][GH#1714] A bug in SMB library was causing scripts to
   fail with bad format argument error. [Ivan Ivanov]
 
diff --git a/nselib/smb.lua b/nselib/smb.lua
index 174245d83..9d3fb1129 100644
--- a/nselib/smb.lua
+++ b/nselib/smb.lua
@@ -1020,15 +1020,11 @@ function negotiate_v1(smb, overrides)
   end
 
   -- Data section
-  if #data < smb.key_length then
-    return false, "SMB: ERROR: not enough data for server_challenge"
-  end
-  smb.server_challenge, pos = string.unpack(string.format("<c%d", smb['key_length']), data)
   if(smb['extended_security'] == true) then
     if #data < 16 then
       return false, "SMB: ERROR: not enough data for extended security"
     end
-    smb.server_guid, pos = string.unpack("<c16", data, pos)
+    smb.server_guid, pos = string.unpack("<c16", data)
 
     -- do we have a security blob?
     if ( #data - pos + 1 > 0 ) then
@@ -1036,6 +1032,11 @@ function negotiate_v1(smb, overrides)
       pos = #data + 1
     end
   else
+    if #data < smb.key_length then
+      return false, "SMB: ERROR: not enough data for server_challenge"
+    end
+    smb.server_challenge, pos = string.unpack(string.format("<c%d", smb['key_length']), data)
+
     -- Get the (null-terminated) domain as a Unicode string
     smb['domain'] = ""
     smb['server'] = ""