Example #1
0
 private static void sendBitmapcacheCaps(RdpPacket packet)
 {
     if (Options.cache_bitmaps && m_bServerSupportsCacheV2)
     {
         packet.WriteLittleEndian16((short)0x13);
         packet.WriteLittleEndian16((short)40);
         packet.WriteLittleEndian16(Options.persistentBmpCache ? ((ushort)1) : ((ushort)0));
         packet.WriteByte(0);
         packet.WriteByte(3);
         uint num = Options.persistentBmpCache ? BMPCACHE2_FLAG_PERSIST : 0;
         packet.WriteLittleEndian32(120);
         packet.WriteLittleEndian32((uint)(120 | num));
         packet.WriteLittleEndian32((uint)(0x400 | num));
         packet.WriteLittleEndian32(0);
         packet.WriteLittleEndian32(0);
         packet.Position += 12L;
     }
     else
     {
         packet.WriteLittleEndian16((short)4);
         packet.WriteLittleEndian16((short)40);
         packet.Position += 0x18L;
         packet.WriteLittleEndian16((short)120);
         packet.WriteLittleEndian16((short)0x300);
         packet.WriteLittleEndian16((short)120);
         packet.WriteLittleEndian16((short)0xc00);
         packet.WriteLittleEndian16((short)0x400);
         packet.WriteLittleEndian16((short)0x2000);
     }
 }
Example #2
0
        /// <summary>
        /// Client MCS Connect Initial PDU
        /// Part 1
        ///
        /// BER Encode packet and send
        /// </summary>
        internal static RdpPacket sendConnectInitial(RdpPacket data)
        {
            int length = (int)data.Length;
            int num2   = ((((9 + BER.domainParamSize(0x22, 2, 0, 0xffff))
                            + BER.domainParamSize(1, 1, 1, 0x420))
                           + BER.domainParamSize(0xffff, 0xfc17, 0xffff, 0xffff)) + 4) + length;

            RdpPacket packet = new RdpPacket();

            BER.sendBerHeader(packet, BER.BER_Header.CONNECT_INITIAL, num2);
            BER.sendBerHeader(packet, BER.BER_Header.BER_TAG_OCTET_STRING, 1);
            packet.WriteByte(1);
            BER.sendBerHeader(packet, BER.BER_Header.BER_TAG_OCTET_STRING, 1);
            packet.WriteByte(1);
            BER.sendBerHeader(packet, BER.BER_Header.BER_TAG_BOOLEAN, 1);
            packet.WriteByte(0xff);

            sendDomainParams(packet, 0x22, 2, 0, 0xffff);
            sendDomainParams(packet, 1, 1, 1, 0x420);
            sendDomainParams(packet, 0xffff, 0xffff, 0xffff, 0xffff);

            BER.sendBerHeader(packet, BER.BER_Header.BER_TAG_OCTET_STRING, length);
            packet.copyToByteArray(data);

            return(packet);
        }
Example #3
0
        /// <summary>
        /// Disconnect packet
        /// </summary>
        public static void Disconnect()
        {
            RdpPacket packet = new RdpPacket();

            packet.WriteLittleEndian16((short)1);
            packet.WriteLittleEndian16((short)0x3ea);
            IsoLayer.SendPDU(packet, IsoLayer.PDUType2.PDUTYPE2_SHUTDOWN_REQUEST, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0);
            packet = new RdpPacket();
            packet.WriteByte((byte)(DPUM << 2));
            packet.WriteByte(3);

            IsoLayer.SendTPKT(packet);
        }
Example #4
0
        internal static void SendMCS(RdpPacket packet, int channel)
        {
            int       length = (int)(packet.Length | 0x8000);
            RdpPacket data   = new RdpPacket();

            data.WriteByte((byte)(MCS.SDRQ << 2));
            data.WriteBigEndian16((short)MCS.McsUserID);
            data.WriteBigEndian16((short)channel);
            data.WriteByte(0x70);
            data.WriteBigEndian16((short)length);
            data.copyToByteArray(packet);

            SendTPKT(data);
        }
Example #5
0
        public static void SendTPKT(RdpPacket data)
        {
            short num = (short)(data.Length + 7L);

            data.Position = 0L;
            RdpPacket packet = new RdpPacket();

            packet.WriteByte(3);
            packet.WriteByte(0);
            packet.WriteBigEndian16(num);
            packet.WriteByte(2);
            packet.WriteByte((byte)Main.SecureValue8);
            packet.WriteByte(0x80);
            packet.copyToByteArray(data);
            Write(packet);
        }
Example #6
0
            public void ProcessForNTLMv2()
            {
                this.Flags = 2;
                this.ChannelBindings.length = 0x10;
                this.ChannelBindings.value  = new byte[0x10];
                string s = "";

                byte[] bytes = Encoding.Unicode.GetBytes(s);
                this.TargetName.length = bytes.Length;
                this.TargetName.value  = bytes;
                byte[] buffer = new byte[] {
                    0x5c, 0xca, 250, 0x4d, 0x40, 0x41, 0xc5, 0x8b, 0x43, 0x93, 0x16, 0x88, 0xce, 0x3b, 0x94, 0x63,
                    0xf1, 0xc5, 0x61, 0xf4, 0xe1, 0xde, 0xda, 0x7a, 0x43, 0xb8, 0xd6, 200, 0x9e, 80, 0x3f, 0x42
                };
                this.Restrictions.length = 0x30;
                RdpPacket packet = new RdpPacket();

                packet.WriteLittleEndian32(0x30);
                packet.WritePadding(4);
                packet.WriteByte(1);
                packet.WritePadding(3);
                packet.WriteLittleEndian32(0x2000);
                packet.Write(buffer, 0, 0x20);
                this.Restrictions.value = packet.ToArray();
                if (this.Restrictions.value.Length != this.Restrictions.length)
                {
                    throw new Exception("Restrictions invalid!");
                }
            }
Example #7
0
        /// <summary>
        /// Client MCS Attach User Request PDU
        /// </summary>
        private static void send_AttachUserRequest()
        {
            RdpPacket data = new RdpPacket();

            data.WriteByte((byte)(AURQ << 2));
            IsoLayer.SendTPKT(data);
        }
Example #8
0
        /// <summary>
        /// Client MCS Erect Domain Request PDU
        /// </summary>
        private static void send_ErectDomainRequest()
        {
            RdpPacket data = new RdpPacket();

            data.WriteByte((byte)(EDRQ << 2));
            data.WriteBigEndian16((short)1);
            data.WriteBigEndian16((short)1);
            IsoLayer.SendTPKT(data);
        }
Example #9
0
        /// <summary>
        /// Client MCS Channel Join Request PDU
        /// </summary>
        private static void send_ChannelJoinRequest(int channelId)
        {
            RdpPacket data = new RdpPacket();

            data.WriteByte((byte)(CJRQ << 2));
            data.WriteBigEndian16((short)McsUserID);
            data.WriteBigEndian16((short)channelId);
            IsoLayer.SendTPKT(data);
        }
Example #10
0
 private static void sendBitmapCaps(RdpPacket data)
 {
     data.WriteLittleEndian16((short)2);
     data.WriteLittleEndian16((short)0x1c);
     data.WriteLittleEndian16((short)Options.server_bpp);
     data.WriteLittleEndian16((short)1);
     data.WriteLittleEndian16((short)1);
     data.WriteLittleEndian16((short)1);
     data.WriteLittleEndian16((short)Options.width);
     data.WriteLittleEndian16((short)Options.height);
     data.WriteLittleEndian16((short)0);
     data.WriteLittleEndian16((short)1);
     data.WriteLittleEndian16((short)1);
     data.WriteByte(0);
     data.WriteByte(0);
     data.WriteLittleEndian16((short)1);
     data.WriteLittleEndian16((short)0);
 }
Example #11
0
 private void WriteVersion(RdpPacket packet)
 {
     packet.WriteByte(6);
     packet.WriteByte(1);
     packet.WriteByte(0xb0);
     packet.WriteByte(0x1d);
     packet.WriteByte(0);
     packet.WriteByte(0);
     packet.WriteByte(0);
     packet.WriteByte(15);
 }
Example #12
0
        internal static void send_authresp(byte[] token, byte[] crypt_hwid, byte[] signature)
        {
            int       num    = 0x80;
            int       num2   = 0x3a;
            RdpPacket packet = new RdpPacket();

            packet.WriteLittleEndian32(num);
            packet.WriteByte(0x15);
            packet.WriteByte(2);
            packet.WriteLittleEndian16((short)num2);
            packet.WriteLittleEndian16((short)1);
            packet.WriteLittleEndian16((short)10);
            packet.Write(token, 0, 10);
            packet.WriteLittleEndian16((short)1);
            packet.WriteLittleEndian16((short)20);
            packet.Write(crypt_hwid, 0, 20);
            packet.Write(signature, 0, 0x10);

            IsoLayer.SendMCS(packet, MCS.MSC_GLOBAL_CHANNEL);
        }
Example #13
0
        private static void sendSupressOutput(bool bAllowDisplayUpdates)
        {
            if (Options.suppress_output_supported)
            {
                RdpPacket packet = new RdpPacket();
                packet.WriteByte(bAllowDisplayUpdates ? ((byte)1) : ((byte)0));
                packet.WriteByte(0);
                packet.WriteByte(0);
                packet.WriteByte(0);

                if (bAllowDisplayUpdates)
                {
                    packet.WriteLittleEndian16((short)0);
                    packet.WriteLittleEndian16((short)0);
                    packet.WriteLittleEndian16((ushort)Options.width);
                    packet.WriteLittleEndian16((ushort)Options.height);
                }

                IsoLayer.SendPDU(packet, IsoLayer.PDUType2.PDUTYPE2_SUPPRESS_OUTPUT, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0);
            }
        }
Example #14
0
        internal static void SendPDU(RdpPacket packet, PDUType2 type, int sec_flags)
        {
            RdpPacket packet2 = new RdpPacket();

            packet.Position = 0L;
            int num = ((int)packet.Length) + 0x12;

            packet2.WriteLittleEndian16((short)num);
            packet2.WriteLittleEndian16((short)Main.SecureValue7);
            packet2.WriteLittleEndian16((short)(MCS.McsUserID + 0x3e9));
            packet2.WriteLittleEndian32(ControlFlow.rdp_shareid);
            packet2.WriteByte(0);
            packet2.WriteByte(1);
            packet2.WriteLittleEndian16((short)(num - 14));
            packet2.WriteByte((byte)type);
            packet2.WriteByte(0);
            packet2.WriteLittleEndian16((short)0);
            packet2.copyToByteArray(packet);

            SendToGlobalChannel(packet2, sec_flags);
        }
Example #15
0
        // Data
        internal static void RefreshRect(Rectangle[] Rectangles)
        {
            if (Network.ConnectionAlive)
            {
                RdpPacket packet = new RdpPacket();
                packet.WriteByte((byte)Rectangles.Length);
                packet.WriteByte(0);
                packet.WriteByte(0);
                packet.WriteByte(0);

                foreach (Rectangle rectangle in Rectangles)
                {
                    packet.WriteLittleEndian16((short)rectangle.Left);
                    packet.WriteLittleEndian16((short)rectangle.Top);
                    packet.WriteLittleEndian16((short)rectangle.Right);
                    packet.WriteLittleEndian16((short)rectangle.Bottom);
                }

                SendPDU(packet, PDUType2.PDUTYPE2_REFRESH_RECT, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0);
            }
        }
Example #16
0
        internal static void send_request(byte[] client_random, byte[] rsa_data, byte[] username, byte[] host)
        {
            int       num    = 0x80;
            int       num2   = (username.Length == 0) ? 0 : (username.Length + 1);
            int       num3   = (host.Length == 0) ? 0 : (host.Length + 1);
            int       num4   = (0x80 + num2) + num3;
            RdpPacket packet = new RdpPacket();

            packet.WriteLittleEndian32(num);
            packet.WriteByte(0x13);
            packet.WriteByte(2);
            packet.WriteLittleEndian16((short)num4);
            packet.WriteLittleEndian32(1);
            packet.WriteLittleEndianU32(0xff010000);
            packet.Write(client_random, 0, 0x20);
            packet.WriteLittleEndian16((short)0);
            packet.WriteLittleEndian16((short)(Secure.modulus_size + 8));
            packet.Write(rsa_data, 0, Secure.modulus_size);
            packet.Position += 8L;
            packet.WriteLittleEndian16((short)15);
            packet.WriteLittleEndian16((short)num2);

            if (num2 != 0)
            {
                packet.Write(username, 0, num2 - 1);
                packet.WriteByte(0);
            }

            packet.WriteLittleEndian16((short)0x10);
            packet.WriteLittleEndian16((short)num3);

            if (num3 != 0)
            {
                packet.Write(host, 0, num3 - 1);
                packet.WriteByte(0);
            }

            IsoLayer.SendMCS(packet, MCS.MSC_GLOBAL_CHANNEL);
        }
Example #17
0
        internal static void sendBerHeader(RdpPacket data, BER_Header berHeader, int param)
        {
            int num = (int)berHeader;

            if (num > 0xff)
            {
                data.WriteBigEndian16((short)num);
            }
            else
            {
                data.WriteByte((byte)num);
            }
            if (param >= 0x80)
            {
                data.WriteByte(130);
                data.WriteBigEndian16((short)param);
            }
            else
            {
                data.WriteByte((byte)param);
            }
        }
Example #18
0
        protected static void WriteOID(RdpPacket packet, string OID)
        {
            WriteTag(packet, 6, "OID");
            string[] strArray = OID.Split(new char[] { '.' });
            int      num      = 0;
            int      num2     = 0;

            foreach (string str in strArray)
            {
                int num3 = Convert.ToInt32(str);

                switch (num)
                {
                case 0:
                    num2 = 40 * num3;
                    break;

                case 1:
                    num2 += num3;
                    packet.WriteByte((byte)num3);
                    break;

                default:
                    if (num3 >= 0x10000000)
                    {
                        WriteByte(packet, 0x80 | ((num3 >> 0x1c) & 0x7f));
                    }

                    if (num3 >= 0x200000)
                    {
                        WriteByte(packet, 0x80 | ((num3 >> 0x15) & 0x7f));
                    }

                    if (num3 >= 0x4000)
                    {
                        WriteByte(packet, 0x80 | ((num3 >> 14) & 0x7f));
                    }

                    if (num3 >= 0x80)
                    {
                        WriteByte(packet, 0x80 | ((num3 >> 7) & 0x7f));
                    }

                    WriteByte(packet, num3 & 0x7f);
                    break;
                }
                num++;
            }

            CloseTag(packet, "OID");
        }
Example #19
0
        /// <summary>
        /// Client X.224 Connection Request PDU
        /// </summary>
        private static void sendConnectNegotiation(NegotiationProtocol NegotiationFlags, byte[] loadBalanceToken)
        {
            string domainAndUsername = Options.DomainAndUsername;

            if (domainAndUsername.Length > 9)
            {
                domainAndUsername = domainAndUsername.Substring(0, 9);
            }

            RdpPacket packet = new RdpPacket();

            packet.WriteByte(3);
            packet.WriteByte(0);
            long position = packet.Position;

            packet.WriteBigEndian16((short)0);
            packet.WriteByte(0);
            packet.WriteByte(0xe0);
            packet.WriteBigEndian16((short)0);
            packet.WriteBigEndian16((short)0);
            packet.WriteByte(0);

            if (loadBalanceToken != null)
            {
                packet.Write(loadBalanceToken, 0, loadBalanceToken.Length);
                packet.WriteString("\r\n", false);
            }
            else
            {
                packet.WriteString("Cookie: mstshash=" + domainAndUsername + "\r\n", true);
            }

            // RDP Negotiation Request
            packet.WriteByte(0x01);
            packet.WriteByte(0);
            packet.WriteLittleEndian16((short)8);
            packet.WriteLittleEndian32((int)NegotiationFlags); // Standard RDP Security, TLS 1.0, CredSSP

            long num2 = packet.Position;

            packet.Position = position;
            packet.WriteBigEndian16((short)num2);
            packet.WriteByte((byte)(num2 - 5L));

            IsoLayer.Write(packet);
        }
Example #20
0
        internal static void sendBerInteger(RdpPacket buffer, int value)
        {
            int num = 1;

            if (value > 0xff)
            {
                num = 2;
            }

            sendBerHeader(buffer, BER_Header.BER_TAG_INTEGER, num);

            if (value > 0xff)
            {
                buffer.WriteBigEndian16((short)value);
            }
            else
            {
                buffer.WriteByte((byte)value);
            }
        }
Example #21
0
        public byte[] Negotiate()
        {
            RdpPacket packet   = new RdpPacket();
            uint      num      = (((((((0xe2000000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) | NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) | NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) | NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_OEM) | NTLMSSP_NEGOTIATE_UNICODE;
            int       position = (int)packet.Position;

            packet.WriteString("NTLMSSP", false);
            packet.WriteByte(0);
            packet.WriteLittleEndian32(1);
            packet.WriteLittleEndian32(num);
            int num3 = ((int)packet.Position) - position;

            num3 += 8;
            num3 += 8;

            if ((num & 0x2000000) != 0)
            {
                num3 += 8;
            }

            packet.WriteLittleEndian16((short)0);
            packet.WriteLittleEndian16((short)0);
            packet.WriteLittleEndian32(0);
            packet.WriteLittleEndian16((short)0);
            packet.WriteLittleEndian16((short)0);
            packet.WriteLittleEndian32(0);

            if ((num & 0x2000000) != 0)
            {
                this.WriteVersion(packet);
            }

            packet.Position     = 0L;
            this.m_NegotiateMsg = new byte[packet.Length];
            packet.Read(this.m_NegotiateMsg, 0, this.m_NegotiateMsg.Length);

            return(this.m_NegotiateMsg);
        }
Example #22
0
        public static void SendMessage(int type)
        {
            short num = 0x12;

            byte[]    buffer = new byte[11];
            RdpPacket packet = new RdpPacket();

            packet.WriteByte(3);
            packet.WriteByte(0);
            packet.WriteBigEndian16(num);
            packet.WriteByte(6);
            packet.WriteByte((byte)type);
            packet.WriteByte(0x80);
            packet.WriteBigEndian16((short)0);
            packet.WriteBigEndian16((short)0);
            packet.WriteByte(0);
            packet.Write(buffer, 0, buffer.Length);

            Write(packet);
        }
Example #23
0
        protected static void UpdateLength(RdpPacket packet, string Identifier)
        {
            Fixup fixup = m_Fixup[Identifier];

            m_Fixup.Remove(Identifier);
            long position = packet.Position;

            if (fixup.Length != -1)
            {
                long num2 = packet.Position - fixup.Offset;

                if (num2 != fixup.Length)
                {
                    throw new Exception("DER Tag length invalid");
                }
            }
            else
            {
                long   num3  = packet.Position - (fixup.Offset + 1L);
                byte[] bytes = BitConverter.GetBytes(num3);
                packet.Position = fixup.Offset;

                if (num3 > 0xffffffL)
                {
                    packet.WriteByte(0x84);
                    packet.InsertByte(bytes[3]);
                    position += 1L;
                    packet.InsertByte(bytes[2]);
                    position += 1L;
                    packet.InsertByte(bytes[1]);
                    position += 1L;
                    packet.InsertByte(bytes[0]);
                    position += 1L;
                }
                else if (num3 > 0xffffL)
                {
                    packet.WriteByte(0x83);
                    packet.InsertByte(bytes[2]);
                    position += 1L;
                    packet.InsertByte(bytes[1]);
                    position += 1L;
                    packet.InsertByte(bytes[0]);
                    position += 1L;
                }
                else if (num3 > 0xffL)
                {
                    packet.WriteByte(130);
                    packet.InsertByte(bytes[1]);
                    position += 1L;
                    packet.InsertByte(bytes[0]);
                    position += 1L;
                }
                else if (num3 > 0x7fL)
                {
                    packet.WriteByte(0x81);
                    packet.InsertByte(bytes[0]);
                    position += 1L;
                }
                else
                {
                    packet.WriteByte(bytes[0]);
                }

                packet.Position = position;
            }
        }
Example #24
0
        protected static void WriteInteger(RdpPacket packet, int value)
        {
            packet.WriteByte(2);
            byte[] bytes = BitConverter.GetBytes(value);

            if (value > 0xffffff)
            {
                packet.WriteByte(4);
                packet.WriteByte(bytes[3]);
                packet.WriteByte(bytes[2]);
                packet.WriteByte(bytes[1]);
                packet.WriteByte(bytes[0]);
            }
            else if (value > 0xffff)
            {
                packet.WriteByte(3);
                packet.WriteByte(bytes[2]);
                packet.WriteByte(bytes[1]);
                packet.WriteByte(bytes[0]);
            }
            else if (value > 0xff)
            {
                packet.WriteByte(2);
                packet.WriteByte(bytes[1]);
                packet.WriteByte(bytes[0]);
            }
            else
            {
                packet.WriteByte(1);
                packet.WriteByte(bytes[0]);
            }
        }
Example #25
0
        private byte[] Authenticate(byte[] lmChallengeResponse, byte[] ntChallengeResponse, string sDomainName, string sUser, string sWorkstation, byte[] EncryptedRandomSessionKey, byte[] ExportedSessionKey, bool bGenerateMIC)
        {
            RdpPacket packet = new RdpPacket();
            uint      flags  = (
                (((((0xe2800000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) |
                    NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) |
                  NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) |
                NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_UNICODE;

            DumpFlags(flags);
            int position = (int)packet.Position;

            packet.WriteString("NTLMSSP", false);
            packet.WriteByte(0);
            packet.WriteLittleEndian32(3);
            int num3 = ((int)packet.Position) - position;

            num3 += 8;
            num3 += 8;
            num3 += 8;
            num3 += 8;
            num3 += 8;
            num3 += 8;
            num3 += 4;

            if ((flags & 0x2000000) != 0)
            {
                num3 += 8;
            }

            if (bGenerateMIC)
            {
                num3 += 0x10;
            }

            byte[] bytes   = Encoding.Unicode.GetBytes(sDomainName);
            byte[] buffer  = Encoding.Unicode.GetBytes(sUser);
            byte[] buffer3 = Encoding.Unicode.GetBytes(sWorkstation);
            int    num4    = num3;
            int    num5    = num4 + bytes.Length;
            int    num6    = num5 + buffer.Length;
            int    num7    = num6 + buffer3.Length;
            int    num8    = num7 + lmChallengeResponse.Length;
            int    num9    = num8 + ntChallengeResponse.Length;

            packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length);
            packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length);
            packet.WriteLittleEndian32(num7);
            num3 += lmChallengeResponse.Length;
            packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length);
            packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length);
            packet.WriteLittleEndian32(num8);
            num3 += ntChallengeResponse.Length;
            packet.WriteLittleEndian16((ushort)bytes.Length);
            packet.WriteLittleEndian16((ushort)bytes.Length);
            packet.WriteLittleEndian32(num4);
            num3 += bytes.Length;
            packet.WriteLittleEndian16((ushort)buffer.Length);
            packet.WriteLittleEndian16((ushort)buffer.Length);
            packet.WriteLittleEndian32(num5);
            num3 += buffer.Length;
            packet.WriteLittleEndian16((ushort)buffer3.Length);
            packet.WriteLittleEndian16((ushort)buffer3.Length);
            packet.WriteLittleEndian32(num6);
            num3 += buffer3.Length;
            packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length);
            packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length);
            packet.WriteLittleEndian32(num9);
            num3 += EncryptedRandomSessionKey.Length;
            packet.WriteLittleEndian32(flags);

            if ((flags & 0x2000000) != 0)
            {
                this.WriteVersion(packet);
            }

            long num10 = packet.Position;

            if (bGenerateMIC)
            {
                packet.WritePadding(0x10);
            }

            packet.Write(bytes, 0, bytes.Length);
            packet.Write(buffer, 0, buffer.Length);
            packet.Write(buffer3, 0, buffer3.Length);
            packet.Write(lmChallengeResponse, 0, lmChallengeResponse.Length);
            packet.Write(ntChallengeResponse, 0, ntChallengeResponse.Length);
            packet.Write(EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length);

            if (bGenerateMIC)
            {
                packet.Position = 0L;
                byte[] buffer4 = new byte[packet.Length];
                packet.Read(buffer4, 0, buffer4.Length);
                HMACT64 hmact = new HMACT64(ExportedSessionKey);
                hmact.update(this.m_NegotiateMsg);
                hmact.update(this.m_ChallengeMsg);
                hmact.update(buffer4);
                byte[] buffer5 = hmact.digest();
                packet.Position = num10;
                packet.Write(buffer5, 0, buffer5.Length);
            }

            packet.Position = 0L;
            byte[] buffer6 = new byte[packet.Length];
            packet.Read(buffer6, 0, buffer6.Length);

            return(buffer6);
        }
Example #26
0
        /// <summary>
        /// Client MCS Connect Initial PDU
        /// Part 2
        ///
        /// Create packet
        /// </summary>
        internal static RdpPacket sendMcsData(bool useRdp5, int num_channels, int serverSelectedProtocol)
        {
            RdpPacket packet = new RdpPacket();

            // Проверка длины Client Name
            string clientName = Options.ClientName;

            if (clientName.Length > 15)
            {
                clientName = clientName.Substring(0, 15);
            }

            int num  = 2 * clientName.Length;
            int num2 = 0x9e;

            if (useRdp5)
            {
                num2 += 0x60;
            }

            if (useRdp5 && (num_channels > 0))
            {
                num2 += (num_channels * 12) + 8;
            }

            if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED))
            {
                num2 += 8;
            }

            packet.WriteBigEndian16((short)5);
            packet.WriteBigEndian16((short)20);
            packet.WriteByte(0x7c);
            packet.WriteBigEndian16((short)1);
            packet.WriteBigEndian16((short)(num2 | 0x8000));
            packet.WriteBigEndian16((short)8);
            packet.WriteBigEndian16((short)0x10);
            packet.WriteByte(0);
            packet.WriteLittleEndian16((ushort)0xc001);
            packet.WriteByte(0);
            packet.WriteLittleEndian32(0x61637544);
            packet.WriteBigEndian16((short)((num2 - 14) | 0x8000));

            // Client Core Data (TS_UD_CS_CORE)
            packet.WriteLittleEndian16((ushort)CLIENT.CS_CORE);
            packet.WriteLittleEndian16(useRdp5 ? ((short)0xd8) : ((short)0x88));
            packet.WriteLittleEndian16(useRdp5 ? ((short)4) : ((short)1));
            packet.WriteLittleEndian16((short)8);
            packet.WriteLittleEndian16((short)Options.width);  // Width
            packet.WriteLittleEndian16((short)Options.height); // Height
            packet.WriteLittleEndian16((ushort)0xca01);
            packet.WriteLittleEndian16((ushort)0xaa03);
            packet.WriteLittleEndian32(Options.Keyboard);        // Клавиатура
            packet.WriteLittleEndian32(useRdp5 ? 0xa28 : 0x1a3); // Client Build
            packet.WriteUnicodeString(clientName);               // Client Name
            packet.Position += 30 - num;
            packet.WriteLittleEndian32(0x00000004);              // IBM enhanced (101- or 102-key) keyboard
            packet.WriteLittleEndian32(0);
            packet.WriteLittleEndian32(12);                      // Функциональные клавиши (F1-F12)
            packet.Position += 0x40L;
            packet.WriteLittleEndian16((ushort)0xCA01);          // NS_UD_COLOR_8BPP
            packet.WriteLittleEndian16(useRdp5 ? ((short)1) : ((short)0));

            if (useRdp5)
            {
                packet.WriteLittleEndian32(0);
                packet.WriteLittleEndian16((short)((byte)Options.server_bpp));
                packet.WriteLittleEndian16((short)7);
                packet.WriteLittleEndian16((short)1);
                packet.Position += 0x40L;
                packet.WriteByte(0);
                packet.WriteByte(0);
                packet.WriteLittleEndian32(serverSelectedProtocol);

                // Client Cluster Data (TS_UD_CS_CLUSTER)
                packet.WriteLittleEndian16((ushort)CLIENT.CS_CLUSTER);
                packet.WriteLittleEndian16((short)12);
                int num3 = 13;

                if (Options.flags.HasFlag(HostFlags.ConsoleSession) || (Options.sessionID != 0))
                {
                    num3 |= 2;
                }

                packet.WriteLittleEndian32(num3);
                packet.WriteLittleEndian32(Options.sessionID);
            }

            // Client Security Data (TS_UD_CS_SEC)
            packet.WriteLittleEndian16((ushort)CLIENT.CS_SECURITY);
            packet.WriteLittleEndian16(useRdp5 ? ((short)12) : ((short)8));

            int num4 = 0;

            if (serverSelectedProtocol == 0)
            {
                num4 |= 3;
            }

            packet.WriteLittleEndian32(num4);

            if (useRdp5)
            {
                packet.WriteLittleEndian32(0);
            }

            // Client Network Data (TS_UD_CS_NET)
            if (useRdp5 && (num_channels > 0))
            {
                packet.WriteLittleEndian16((ushort)CLIENT.CS_NET);
                packet.WriteLittleEndian16((short)((num_channels * 12) + 8));
                packet.WriteLittleEndian32(num_channels);

                foreach (IVirtualChannel channel in Channels.RegisteredChannels)
                {
                    Debug.WriteLine("Client Network Data. Channel name length: " + channel.ChannelName.Length);

                    packet.WriteString(channel.ChannelName, false);
                    packet.WriteBigEndian32((uint)(CHANNEL_DEF.CHANNEL_OPTION_INITIALIZED));
                }
            }

            // Client Message Channel Data (TS_UD_CS_MCS_MSGCHANNEL)
            if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED))
            {
                packet.WriteLittleEndian16((ushort)CLIENT.CS_MCS_MSGCHANNEL);
                packet.WriteLittleEndian16((short)8);
                packet.WriteLittleEndian32(0);
            }

            return(packet);
        }
Example #27
0
        // Input
        internal static void FastSendInput(List <Rdp.InputInfo> InputToSend)
        {
            if (Options.use_fastpath_input)
            {
                RdpPacket packet = new RdpPacket();
                ushort    num    = 1;
                int       count  = InputToSend.Count;

                if (count < 0x10)
                {
                    packet.WriteByte((byte)(count << 2));
                }
                else
                {
                    packet.WriteByte(0);
                    num = (ushort)(num + 1);
                }

                foreach (Rdp.InputInfo info in InputToSend)
                {
                    switch (info.Message_Type)
                    {
                    case Rdp.InputType.INPUT_EVENT_SCANCODE:
                        num = (ushort)(num + 2);
                        break;

                    case Rdp.InputType.INPUT_EVENT_UNICODE:
                        num = (ushort)(num + 3);
                        break;

                    case Rdp.InputType.INPUT_EVENT_MOUSE:
                        num = (ushort)(num + 7);
                        break;

                    case Rdp.InputType.INPUT_EVENT_SYNC:
                        num = (ushort)(num + 1);
                        break;
                    }
                }

                num = (ushort)(num + 1);

                if (num > 0x7f)
                {
                    num = (ushort)(num + 1);
                }

                packet.WriteEncodedUnsigned16(num);

                if (count >= 0x10)
                {
                    packet.WriteByte((byte)count);
                }

                foreach (Rdp.InputInfo info2 in InputToSend)
                {
                    int num3 = 0;

                    switch (info2.Message_Type)
                    {
                    case Rdp.InputType.INPUT_EVENT_SCANCODE:

                        if ((info2.Device_Flags & 0x8000) != 0)
                        {
                            num3 |= 0x01;
                        }

                        if ((info2.Device_Flags & 0x0100) != 0)
                        {
                            num3 |= 0x02;
                        }

                        packet.WriteByte((byte)num3);
                        packet.WriteByte((byte)info2.Param1);
                        break;

                    case Rdp.InputType.INPUT_EVENT_UNICODE:

                        if ((info2.Device_Flags & 0x8000) != 0)
                        {
                            num3 |= 1;
                        }

                        packet.WriteByte((byte)(0x80 | num3));
                        packet.WriteLittleEndian16((ushort)info2.Param1);
                        break;

                    case Rdp.InputType.INPUT_EVENT_MOUSE:
                        packet.WriteByte(0x20);
                        packet.WriteLittleEndian16((ushort)info2.Device_Flags);
                        packet.WriteLittleEndian16((ushort)info2.Param1);
                        packet.WriteLittleEndian16((ushort)info2.Param2);
                        break;

                    case Rdp.InputType.INPUT_EVENT_SYNC:
                        packet.WriteByte(0x60);
                        break;
                    }
                }

                Write(packet);
            }
            else
            {
                foreach (Rdp.InputInfo info3 in InputToSend)
                {
                    SlowSendInput(info3.Time, (int)info3.Message_Type, info3.Device_Flags, info3.Param1, info3.Param2);
                }
            }
        }
Example #28
0
 protected static void WriteByte(RdpPacket packet, int value)
 {
     packet.WriteByte((byte)value);
 }
Example #29
0
        private static void sendPersistKeyList()
        {
            int num   = 0;
            int num2  = 0;
            int num3  = 0;
            int num4  = 0;
            int num5  = 0;
            int num6  = 0;
            int num7  = 0;
            int num8  = 0;
            int num9  = 0;
            int num10 = 0;

            Cache.TotalBitmapCache(out num, out num2, out num3, out num4, out num5);
            int offset = 0;

            while ((((num6 < num) || (num7 < num2)) || ((num8 < num3) || (num9 < num4))) || (num10 < num5))
            {
                int          num12     = 0;
                int          num13     = 0;
                int          num14     = 0;
                int          num15     = 0;
                int          num16     = 0;
                bool         bMoreKeys = false;
                List <ulong> list      = Cache.GetBitmapCache(offset, 0xff, out num12, out num13, out num14, out num15, out num16, out bMoreKeys);
                RdpPacket    packet    = new RdpPacket();
                packet.WriteLittleEndian16((ushort)num12);
                packet.WriteLittleEndian16((ushort)num13);
                packet.WriteLittleEndian16((ushort)num14);
                packet.WriteLittleEndian16((ushort)num15);
                packet.WriteLittleEndian16((ushort)num16);
                packet.WriteLittleEndian16((ushort)num);
                packet.WriteLittleEndian16((ushort)num2);
                packet.WriteLittleEndian16((ushort)num3);
                packet.WriteLittleEndian16((ushort)num4);
                packet.WriteLittleEndian16((ushort)num5);
                byte num17 = 0;
                if (offset == 0)
                {
                    num17 = (byte)(num17 | 1);
                }
                if (!bMoreKeys)
                {
                    num17 = (byte)(num17 | 2);
                }
                packet.WriteByte(num17);
                packet.WriteByte(0);
                packet.WriteLittleEndian16((short)0);
                foreach (ulong num18 in list)
                {
                    packet.Write(BitConverter.GetBytes(num18), 0, 8);
                }
                IsoLayer.SendPDU(packet, IsoLayer.PDUType2.PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0);
                offset += list.Count;
                num6   += num12;
                num7   += num13;
                num8   += num14;
                num9   += num15;
                num10  += num16;
            }
        }