internal void clientClipboardCapabilities()
{
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)MsgType.CB_CLIP_CAPS);
packet.WriteLittleEndian16((short)MsgFlags.NOT_SET);
packet.WriteLittleEndian32(16 + FourButesAlignLen); // length
packet.WriteLittleEndian16(1); // Колл-во cCapabilitiesSets
packet.WritePadding(2); // Padding 2
packet.WriteLittleEndian16((short)CapsType.CB_CAPSTYPE_GENERAL);
packet.WriteLittleEndian16(12); // lengthCapability
packet.WriteLittleEndian32((int)CapsVersion.CB_CAPS_VERSION_2);
if (ServerGeneralFlags.HasFlag(GeneralFlags.CB_STREAM_FILECLIP_ENABLED))
{
packet.WriteLittleEndian32((int)ServerGeneralFlags);
}
else
{
packet.WriteLittleEndian32((int)(GeneralFlags.CB_STREAM_FILECLIP_ENABLED | GeneralFlags.CB_USE_LONG_FORMAT_NAMES));
}
packet.WritePadding(FourButesAlign); // Add four bytes
send(packet);
}
internal void clientFormatList()
{
// Формируем строку, содержащую нулевой байт после каждого символа
string tempStr = "";
foreach (var ch in ClipboardFormatName)
{
tempStr += ch + "\0";
}
// Получаем байты строки
var bytes = ASCIIEncoding.GetBytes(tempStr, false).ToList();
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)MsgType.CB_FORMAT_LIST);
packet.WriteLittleEndian16((short)MsgFlags.NOT_SET);
packet.WriteLittleEndian32(bytes.Count + 4 + FourButesAlignLen); // length
// Устанавливаем Clipboard Format ID
packet.WriteLittleEndian32(ClipboardFormatID);
packet.Write(bytes.ToArray(), 0, bytes.Count);
packet.WritePadding(FourButesAlign); // Add four bytes
send(packet);
}
private static void sendBitmapcacheCaps(RdpPacket packet)
{
if (Options.cache_bitmaps && m_bServerSupportsCacheV2)
{
packet.WriteLittleEndian16((short)0x13);
packet.WriteLittleEndian16((short)40);
packet.WriteLittleEndian16(Options.persistentBmpCache ? ((ushort)1) : ((ushort)0));
packet.WriteByte(0);
packet.WriteByte(3);
uint num = Options.persistentBmpCache ? BMPCACHE2_FLAG_PERSIST : 0;
packet.WriteLittleEndian32(120);
packet.WriteLittleEndian32((uint)(120 | num));
packet.WriteLittleEndian32((uint)(0x400 | num));
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian32(0);
packet.Position += 12L;
}
else
{
packet.WriteLittleEndian16((short)4);
packet.WriteLittleEndian16((short)40);
packet.Position += 0x18L;
packet.WriteLittleEndian16((short)120);
packet.WriteLittleEndian16((short)0x300);
packet.WriteLittleEndian16((short)120);
packet.WriteLittleEndian16((short)0xc00);
packet.WriteLittleEndian16((short)0x400);
packet.WriteLittleEndian16((short)0x2000);
}
}
internal void clientFileContentsResponse()
{
// Вычисляем часть файла
byte[] tempArr = null;
if ((FileData.Length - Position) > 0)
{
if ((FileData.Length - Position) >= BufferNextPart)
{
tempArr = new byte[BufferNextPart];
Array.Copy(FileData, Position, tempArr, 0, BufferNextPart);
Position += BufferNextPart;
}
else
{
tempArr = new byte[(FileData.Length - Position)];
Array.Copy(FileData, Position, tempArr, 0, (FileData.Length - Position));
BufferNextPart = 0;
Position = 0;
}
}
else if ((FileData.Length - Position) == 0)
{
BufferNextPart = 0;
Position = 0;
return;
}
// Формируем пакет
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)MsgType.CB_FILECONTENTS_RESPONSE);
packet.WriteLittleEndian16((short)MsgFlags.CB_RESPONSE_OK);
// Устанавливаем длину сообщения
if (FileCanLoad)
{
packet.WriteLittleEndian32(tempArr.Length + 4); // length
}
else
{
packet.WriteLittleEndian32(8 + 4); // length
}
// Stream ID
packet.WriteLittleEndian32(StreamID);
// Устанавливаем размер или байты самого файла, в зависимости от значения FileCanLoad
if (FileCanLoad && FileData != null)
{
// requestedFileContentsData
packet.Write(tempArr, 0, tempArr.Length);
}
else
{
// requestedFileContentsData
packet.WriteLittleEndianU64(FileSize);
}
send(packet);
}
public void ProcessForNTLMv2()
{
this.Flags = 2;
this.ChannelBindings.length = 0x10;
this.ChannelBindings.value = new byte[0x10];
string s = "";
byte[] bytes = Encoding.Unicode.GetBytes(s);
this.TargetName.length = bytes.Length;
this.TargetName.value = bytes;
byte[] buffer = new byte[] {
0x5c, 0xca, 250, 0x4d, 0x40, 0x41, 0xc5, 0x8b, 0x43, 0x93, 0x16, 0x88, 0xce, 0x3b, 0x94, 0x63,
0xf1, 0xc5, 0x61, 0xf4, 0xe1, 0xde, 0xda, 0x7a, 0x43, 0xb8, 0xd6, 200, 0x9e, 80, 0x3f, 0x42
};
this.Restrictions.length = 0x30;
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian32(0x30);
packet.WritePadding(4);
packet.WriteByte(1);
packet.WritePadding(3);
packet.WriteLittleEndian32(0x2000);
packet.Write(buffer, 0, 0x20);
this.Restrictions.value = packet.ToArray();
if (this.Restrictions.value.Length != this.Restrictions.length)
{
throw new Exception("Restrictions invalid!");
}
}
internal static RdpPacket establishKey()
{
int num = modulus_size + 8;
int num2 = 1;
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian32(num2);
packet.WriteLittleEndian32(num);
packet.Write(m_Sec_Crypted_Random, 0, modulus_size);
packet.WritePadding(8);
return(packet);
}
internal void clientFormatDataResponse()
{
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)MsgType.CB_FORMAT_DATA_RESPONSE);
packet.WriteLittleEndian16((short)MsgFlags.CB_RESPONSE_OK);
packet.WriteLittleEndian32(520 + 76 + FourButesAlignLen); // length
// cItems
packet.WriteLittleEndian32(1); // 1 файл в списке файлов буфера обмена
// File Descriptor
packet.WriteLittleEndian32((int)(FD_FLAGS.FD_ATTRIBUTES));
packet.WritePadding(32); // Padding 32
packet.WriteLittleEndian32((int)(FILE_ATTRIBUTE.FILE_ATTRIBUTE_NORMAL));
packet.WritePadding(16); // Padding 16
packet.WriteLittleEndian64(DateTime.Now.Ticks); // lastWriteTime
packet.WriteLittleEndianU32((uint)FileSizeHigh);
packet.WriteLittleEndianU32((uint)FileSizeLow);
// Формируем строку, содержащую нулевой байт после каждого символа
string tempStr = "";
foreach (var ch in FileName)
{
tempStr += ch + "\0";
}
// Получаем байты строки
var bytes = ASCIIEncoding.GetBytes(tempStr, false).ToList();
if (bytes.Count > 520)
{
packet.Write(bytes.ToArray(), 0, 520);
}
else
{
int endPos = 520 - bytes.Count;
for (int i = 0; i < endPos; i++)
{
bytes.Add(0x00);
}
packet.Write(bytes.ToArray(), 0, bytes.Count);
}
packet.WritePadding(FourButesAlign); // Add four bytes
send(packet);
}
private void send(RdpPacket data)
{
data.Position = 0L;
int length = (int)data.Length;
int count = Math.Min(length, 1600);
int num = length - count;
if (num == 0)
{
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian32((int)length);
packet.WriteLittleEndian32((int)(CHANNEL_FLAG.CHANNEL_FLAG_FIRST | CHANNEL_FLAG.CHANNEL_FLAG_LAST | CHANNEL_FLAG.CHANNEL_FLAG_SHOW_PROTOCOL));
packet.copyToByteArray(data);
IsoLayer.SendToCannel(packet, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0, this.ChannelID);
}
else
{
RdpPacket packet2 = new RdpPacket();
packet2.WriteLittleEndian32((int)length);
packet2.WriteLittleEndian32((int)(CHANNEL_FLAG.CHANNEL_FLAG_FIRST | CHANNEL_FLAG.CHANNEL_FLAG_SHOW_PROTOCOL));
byte[] buffer = new byte[count];
data.Read(buffer, 0, count);
packet2.Write(buffer, 0, count);
IsoLayer.SendToCannel(packet2, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0, this.ChannelID);
}
while (num > 0)
{
count = Math.Min(num, 1600);
num -= count;
RdpPacket packet3 = new RdpPacket();
packet3.WriteLittleEndian32((int)length);
if (num == 0)
{
packet3.WriteLittleEndian32((int)(CHANNEL_FLAG.CHANNEL_FLAG_LAST | CHANNEL_FLAG.CHANNEL_FLAG_SHOW_PROTOCOL));
}
else
{
packet3.WriteLittleEndian32((int)(CHANNEL_FLAG.CHANNEL_FLAG_SHOW_PROTOCOL));
}
byte[] buffer2 = new byte[count];
data.Read(buffer2, 0, count);
packet3.Write(buffer2, 0, count);
IsoLayer.SendToCannel(packet3, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0, this.ChannelID);
}
}
private static void sendGlyphCacheCaps(RdpPacket packet)
{
packet.WriteLittleEndian16((short)0x10);
packet.WriteLittleEndian16((short)0x34);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)4);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)4);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)0x10);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)0x20);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)0x40);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)0x80);
packet.WriteLittleEndian16((short)0xfe);
packet.WriteLittleEndian16((short)0x100);
packet.WriteLittleEndian16((short)0x40);
packet.WriteLittleEndian16((short)0x800);
packet.WriteLittleEndian32(0x10000);
packet.WriteLittleEndian16((short)3);
packet.WriteLittleEndian16((short)0);
}
// Input Capability Set (TS_INPUT_CAPABILITYSET)
private static void sendInputCaps(RdpPacket packet)
{
packet.WriteLittleEndian16((short)Capstype.CAPSTYPE_INPUT);
packet.WriteLittleEndian16((short)0x58);
packet.WriteLittleEndian16((short)(
InputFlags.INPUT_FLAG_FASTPATH_INPUT |
InputFlags.INPUT_FLAG_FASTPATH_INPUT2 |
InputFlags.INPUT_FLAG_SCANCODES |
InputFlags.INPUT_FLAG_UNICODE));
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(Options.Keyboard); // Клавиатура
packet.WriteLittleEndian32(0x00000004); // IBM enhanced (101- or 102-key) keyboard
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian32(12); // Функциональные клавиши (F1-F12)
packet.Position += 0x40L;
}
private static void sendControl(int action)
{
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)action);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
IsoLayer.SendPDU(packet, IsoLayer.PDUType2.PDUTYPE2_CONTROL, Secure.RDPEncrypted() ? (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT) : 0);
}
private static void sendOrderCaps(RdpPacket data)
{
byte[] buffer = new byte[0x20];
buffer[0] = 1;
buffer[1] = 1;
buffer[2] = 1;
buffer[3] = 1;
buffer[4] = 1;
buffer[7] = 0;
buffer[8] = 1;
buffer[9] = 0;
buffer[11] = 1;
buffer[15] = 0;
buffer[0x10] = 1;
buffer[0x11] = 0;
buffer[0x12] = 1;
buffer[0x13] = 0;
buffer[20] = 0;
buffer[0x15] = 0;
buffer[0x16] = 1;
buffer[0x18] = 0;
buffer[0x19] = 0;
buffer[0x1a] = 0;
buffer[0x1b] = 1;
data.WriteLittleEndian16((short)3);
data.WriteLittleEndian16((short)0x58);
data.Position += 20L;
data.WriteLittleEndian16((short)1);
data.WriteLittleEndian16((short)20);
data.WriteLittleEndian16((short)0);
data.WriteLittleEndian16((short)1);
data.WriteLittleEndian16((short)0);
data.WriteLittleEndian16((short)170);
data.Write(buffer, 0, 0x20);
data.WriteLittleEndian16((short)0x6a1);
data.WriteLittleEndian16((short)2);
data.Position += 4L;
data.WriteLittleEndian32(0x38400);
data.WriteLittleEndian32(0);
data.WriteLittleEndian16((short)0x4e4);
data.WriteLittleEndian16((short)0);
}
internal static void send_request(byte[] client_random, byte[] rsa_data, byte[] username, byte[] host)
{
int num = 0x80;
int num2 = (username.Length == 0) ? 0 : (username.Length + 1);
int num3 = (host.Length == 0) ? 0 : (host.Length + 1);
int num4 = (0x80 + num2) + num3;
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian32(num);
packet.WriteByte(0x13);
packet.WriteByte(2);
packet.WriteLittleEndian16((short)num4);
packet.WriteLittleEndian32(1);
packet.WriteLittleEndianU32(0xff010000);
packet.Write(client_random, 0, 0x20);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)(Secure.modulus_size + 8));
packet.Write(rsa_data, 0, Secure.modulus_size);
packet.Position += 8L;
packet.WriteLittleEndian16((short)15);
packet.WriteLittleEndian16((short)num2);
if (num2 != 0)
{
packet.Write(username, 0, num2 - 1);
packet.WriteByte(0);
}
packet.WriteLittleEndian16((short)0x10);
packet.WriteLittleEndian16((short)num3);
if (num3 != 0)
{
packet.Write(host, 0, num3 - 1);
packet.WriteByte(0);
}
IsoLayer.SendMCS(packet, MCS.MSC_GLOBAL_CHANNEL);
}
public byte[] Negotiate()
{
RdpPacket packet = new RdpPacket();
uint num = (((((((0xe2000000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) | NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) | NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) | NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_OEM) | NTLMSSP_NEGOTIATE_UNICODE;
int position = (int)packet.Position;
packet.WriteString("NTLMSSP", false);
packet.WriteByte(0);
packet.WriteLittleEndian32(1);
packet.WriteLittleEndian32(num);
int num3 = ((int)packet.Position) - position;
num3 += 8;
num3 += 8;
if ((num & 0x2000000) != 0)
{
num3 += 8;
}
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
if ((num & 0x2000000) != 0)
{
this.WriteVersion(packet);
}
packet.Position = 0L;
this.m_NegotiateMsg = new byte[packet.Length];
packet.Read(this.m_NegotiateMsg, 0, this.m_NegotiateMsg.Length);
return(this.m_NegotiateMsg);
}
internal static void SlowSendInput(int time, int message_type, int device_flags, uint param1, uint param2)
{
if (Network.ConnectionAlive || (message_type == 0))
{
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)1);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(time);
packet.WriteLittleEndian16((short)message_type);
packet.WriteLittleEndian16((short)device_flags);
packet.WriteLittleEndian16((ushort)param1);
packet.WriteLittleEndian16((ushort)param2);
SendPDU(packet, PDUType2.PDUTYPE2_INPUT, Secure.RDPEncrypted() ? (int)MCS.TS_SECURITY_HEADER.SEC_ENCRYPT : 0);
}
}
/// <summary>
/// Client X.224 Connection Request PDU
/// </summary>
private static void sendConnectNegotiation(NegotiationProtocol NegotiationFlags, byte[] loadBalanceToken)
{
string domainAndUsername = Options.DomainAndUsername;
if (domainAndUsername.Length > 9)
{
domainAndUsername = domainAndUsername.Substring(0, 9);
}
RdpPacket packet = new RdpPacket();
packet.WriteByte(3);
packet.WriteByte(0);
long position = packet.Position;
packet.WriteBigEndian16((short)0);
packet.WriteByte(0);
packet.WriteByte(0xe0);
packet.WriteBigEndian16((short)0);
packet.WriteBigEndian16((short)0);
packet.WriteByte(0);
if (loadBalanceToken != null)
{
packet.Write(loadBalanceToken, 0, loadBalanceToken.Length);
packet.WriteString("\r\n", false);
}
else
{
packet.WriteString("Cookie: mstshash=" + domainAndUsername + "\r\n", true);
}
// RDP Negotiation Request
packet.WriteByte(0x01);
packet.WriteByte(0);
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian32((int)NegotiationFlags); // Standard RDP Security, TLS 1.0, CredSSP
long num2 = packet.Position;
packet.Position = position;
packet.WriteBigEndian16((short)num2);
packet.WriteByte((byte)(num2 - 5L));
IsoLayer.Write(packet);
}
internal static void send_authresp(byte[] token, byte[] crypt_hwid, byte[] signature)
{
int num = 0x80;
int num2 = 0x3a;
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian32(num);
packet.WriteByte(0x15);
packet.WriteByte(2);
packet.WriteLittleEndian16((short)num2);
packet.WriteLittleEndian16((short)1);
packet.WriteLittleEndian16((short)10);
packet.Write(token, 0, 10);
packet.WriteLittleEndian16((short)1);
packet.WriteLittleEndian16((short)20);
packet.Write(crypt_hwid, 0, 20);
packet.Write(signature, 0, 0x10);
IsoLayer.SendMCS(packet, MCS.MSC_GLOBAL_CHANNEL);
}
internal static void SendToCannel(RdpPacket secData, int flags, int channel)
{
secData.Position = 0L;
byte[] buffer = new byte[secData.Length];
secData.Read(buffer, 0, buffer.Length);
if ((Secure.enc_count == 0x1000) && Secure.RDPEncrypted())
{
Secure.m_Encrypt_Key = Secure.update(Secure.m_Encrypt_Key, Secure._r);
byte[] destinationArray = new byte[Secure.m_KeyLength];
Array.Copy(Secure.m_Encrypt_Key, 0, destinationArray, 0, Secure.m_KeyLength);
Secure.m_RC4_Enc.engineInitEncrypt(destinationArray);
Secure.enc_count = 0;
}
if (Secure.RDPEncrypted())
{
byte[] buffer1 = Secure.sign(Secure.m_Sec_Sign_Key, 8, Secure.m_KeyLength, buffer, buffer.Length);
byte[] buffer2 = Secure.m_RC4_Enc.crypt(buffer);
secData = new RdpPacket();
secData.WriteLittleEndian32(flags);
secData.Write(buffer1, 0, buffer1.Length);
secData.Write(buffer2, 0, buffer2.Length);
}
else
{
flags &= -9;
secData = new RdpPacket();
if (flags != 0)
{
secData.WriteLittleEndian32(flags);
}
secData.Write(buffer, 0, buffer.Length);
}
SendMCS(secData, channel);
Secure.enc_count++;
}
internal static void SendPDU(RdpPacket packet, PDUType2 type, int sec_flags)
{
RdpPacket packet2 = new RdpPacket();
packet.Position = 0L;
int num = ((int)packet.Length) + 0x12;
packet2.WriteLittleEndian16((short)num);
packet2.WriteLittleEndian16((short)Main.SecureValue7);
packet2.WriteLittleEndian16((short)(MCS.McsUserID + 0x3e9));
packet2.WriteLittleEndian32(ControlFlow.rdp_shareid);
packet2.WriteByte(0);
packet2.WriteByte(1);
packet2.WriteLittleEndian16((short)(num - 14));
packet2.WriteByte((byte)type);
packet2.WriteByte(0);
packet2.WriteLittleEndian16((short)0);
packet2.copyToByteArray(packet);
SendToGlobalChannel(packet2, sec_flags);
}
internal void clientTemporaryDirectory()
{
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian16((short)MsgType.CB_TEMP_DIRECTORY);
packet.WriteLittleEndian16((short)MsgFlags.NOT_SET);
packet.WriteLittleEndian32(520 + FourButesAlignLen); // length
// Формируем строку, содержащую нулевой байт после каждого символа
string tempStr = "";
foreach (var ch in ClientTempDir)
{
tempStr += ch + "\0";
}
// Получаем байты строки
var bytes = ASCIIEncoding.GetBytes(tempStr, false).ToList();
if (bytes.Count > 520)
{
packet.Write(bytes.ToArray(), 0, 520);
}
else
{
int endPos = 520 - bytes.Count;
for (int i = 0; i < endPos; i++)
{
bytes.Add(0x00);
}
packet.Write(bytes.ToArray(), 0, bytes.Count);
}
packet.WritePadding(FourButesAlign); // Add four bytes
send(packet);
}
private static void sendConfirmActive()
{
int num = 390;
int num2 = 0;
if (Secure.RDPEncrypted())
{
num2 |= (int)(MCS.TS_SECURITY_HEADER.SEC_ENCRYPT);
}
RdpPacket data = new RdpPacket();
data.WriteLittleEndian16((short)((0x10 + num) + RDP_SOURCE.Length));
data.WriteLittleEndian16((short)0x13);
data.WriteLittleEndian16((short)(MCS.McsUserID + 0x3e9));
data.WriteLittleEndian32(rdp_shareid);
data.WriteLittleEndian16((short)0x3ea);
data.WriteLittleEndian16((short)RDP_SOURCE.Length);
data.WriteLittleEndian16((short)num);
data.Write(RDP_SOURCE, 0, RDP_SOURCE.Length);
data.WriteLittleEndian16((short)13);
data.Position += 2L;
sendGeneralCaps(data);
sendBitmapCaps(data);
sendOrderCaps(data);
sendBitmapcacheCaps(data);
sendColorcacheCaps(data);
sendActivateCaps(data);
sendControlCaps(data);
sendPointerCaps(data);
sendShareCaps(data);
sendInputCaps(data);
sendSoundCaps(data);
sendFontCaps(data);
sendGlyphCacheCaps(data);
IsoLayer.SendToGlobalChannel(data, num2);
}
public byte[] Serialise()
{
RdpPacket packet = new RdpPacket();
if (this.NbDomainName.length > 0)
{
packet.WriteLittleEndian16((short)2);
packet.WriteLittleEndian16((short)this.NbDomainName.length);
packet.Write(this.NbDomainName.value, 0, this.NbDomainName.length);
}
if (this.NbComputerName.length > 0)
{
packet.WriteLittleEndian16((short)1);
packet.WriteLittleEndian16((short)this.NbComputerName.length);
packet.Write(this.NbComputerName.value, 0, this.NbComputerName.length);
}
if (this.DnsDomainName.length > 0)
{
packet.WriteLittleEndian16((short)4);
packet.WriteLittleEndian16((short)this.DnsDomainName.length);
packet.Write(this.DnsDomainName.value, 0, this.DnsDomainName.length);
}
if (this.DnsComputerName.length > 0)
{
packet.WriteLittleEndian16((short)3);
packet.WriteLittleEndian16((short)this.DnsComputerName.length);
packet.Write(this.DnsComputerName.value, 0, this.DnsComputerName.length);
}
if (this.DnsTreeName.length > 0)
{
packet.WriteLittleEndian16((short)5);
packet.WriteLittleEndian16((short)this.DnsTreeName.length);
packet.Write(this.DnsTreeName.value, 0, this.DnsTreeName.length);
}
if (this.Timestamp.length > 0)
{
packet.WriteLittleEndian16((short)7);
packet.WriteLittleEndian16((short)this.Timestamp.length);
packet.Write(this.Timestamp.value, 0, this.Timestamp.length);
}
if (this.Flags != 0)
{
packet.WriteLittleEndian16((short)6);
packet.WriteLittleEndian16((short)4);
packet.WriteLittleEndian32(this.Flags);
}
if (this.Restrictions.length > 0)
{
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian16((short)this.Restrictions.length);
packet.Write(this.Restrictions.value, 0, this.Restrictions.length);
}
if (this.ChannelBindings.length > 0)
{
packet.WriteLittleEndian16((short)10);
packet.WriteLittleEndian16((short)this.ChannelBindings.length);
packet.Write(this.ChannelBindings.value, 0, this.ChannelBindings.length);
}
if (this.TargetName.value != null)
{
packet.WriteLittleEndian16((short)9);
packet.WriteLittleEndian16((short)this.TargetName.length);
packet.Write(this.TargetName.value, 0, this.TargetName.length);
}
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WritePadding(8);
byte[] buffer = new byte[packet.Length];
packet.Position = 0L;
packet.Read(buffer, 0, buffer.Length);
return(buffer);
}
/// <summary>
/// Client Info PDU
/// </summary>
private static RdpPacket getLoginInfo(string domain, string username, string password, string command, string directory, bool bAutoReconnect)
{
int num1 = 2 * "127.0.0.1".Length;
int num2 = 2 * @"C:\WINNT\System32\mstscax.dll".Length;
int num3 = 2 * domain.Length;
int num4 = 2 * username.Length;
int num5 = 2 * password.Length;
int num6 = 2 * command.Length;
int num7 = 2 * directory.Length;
//int num8 = 0x213b;
int num8 = (int)(
ClientInfoFlags.INFO_AUTOLOGON |
ClientInfoFlags.INFO_DISABLECTRLALTDEL |
ClientInfoFlags.INFO_LOGONERRORS |
ClientInfoFlags.INFO_LOGONNOTIFY |
ClientInfoFlags.INFO_ENABLEWINDOWSKEY |
ClientInfoFlags.INFO_MOUSE |
ClientInfoFlags.INFO_NOAUDIOPLAYBACK |
ClientInfoFlags.INFO_UNICODE);
RdpPacket packet = new RdpPacket();
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian32(num8);
packet.WriteLittleEndian16((short)num3);
packet.WriteLittleEndian16((short)num4);
if ((num8 & 8) != 0)
{
packet.WriteLittleEndian16((short)num5);
}
else
{
packet.WriteLittleEndian16((short)0);
}
packet.WriteLittleEndian16((short)num6);
packet.WriteLittleEndian16((short)num7);
if (0 < num3)
{
packet.WriteUnicodeString(domain);
}
else
{
packet.WriteLittleEndian16((short)0);
}
packet.WriteUnicodeString(username);
if ((num8 & 8) != 0)
{
packet.WriteUnicodeString(password);
}
else
{
packet.WriteLittleEndian16((short)0);
}
if (0 < num6)
{
packet.WriteUnicodeString(command);
}
else
{
packet.WriteLittleEndian16((short)0);
}
if (0 < num7)
{
packet.WriteUnicodeString(directory);
}
else
{
packet.WriteLittleEndian16((short)0);
}
packet.WriteLittleEndian16((short)2);
packet.WriteLittleEndian16((short)(num1 + 2));
packet.WriteUnicodeString("127.0.0.1");
packet.WriteLittleEndian16((short)(num2 + 2));
packet.WriteUnicodeString(@"C:\WINNT\System32\mstscax.dll");
TimeZoneInfo info = TimeZoneInfo.Local;
packet.WriteLittleEndian32((int)info.BaseUtcOffset.TotalMinutes);
packet.WriteUnicodeString(info.StandardName);
packet.Position += 0x3e - (2 * info.StandardName.Length);
if (info.SupportsDaylightSavingTime)
{
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((ushort)10);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)30);
packet.WriteLittleEndian16((short)2);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
}
else
{
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
}
packet.WriteUnicodeString(info.DaylightName);
packet.Position += 0x3e - (2 * info.DaylightName.Length);
if (info.SupportsDaylightSavingTime)
{
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((ushort)3);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0x1b);
packet.WriteLittleEndian16((short)1);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32((int)(info.BaseUtcOffset.TotalMinutes + 1.0));
}
else
{
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
}
packet.WriteLittleEndianU32(0);
PerformanceFlags flags = (PerformanceFlags)0;
if (!Options.IsHostFlagSet(HostFlags.DesktopBackground))
{
flags |= PerformanceFlags.PERF_DISABLE_WALLPAPER;
}
if (Options.IsHostFlagSet(HostFlags.FontSmoothing))
{
flags |= PerformanceFlags.PERF_ENABLE_FONT_SMOOTHING;
}
if (Options.IsHostFlagSet(HostFlags.DesktopComposition))
{
flags |= PerformanceFlags.PERF_ENABLE_DESKTOP_COMPOSITION;
}
if (!Options.IsHostFlagSet(HostFlags.ShowWindowContents))
{
flags |= PerformanceFlags.PERF_DISABLE_FULLWINDOWDRAG;
}
if (!Options.IsHostFlagSet(HostFlags.MenuAnimation))
{
flags |= PerformanceFlags.PERF_DISABLE_MENUANIMATIONS;
}
if (!Options.IsHostFlagSet(HostFlags.VisualStyles))
{
flags |= PerformanceFlags.PERF_DISABLE_THEMING;
}
packet.WriteLittleEndian32((int)flags);
if (bAutoReconnect)
{
packet.WriteLittleEndian32(0x1c);
packet.WriteLittleEndian32(0x1c);
packet.WriteLittleEndian32(1);
packet.WriteLittleEndian32(Options.LogonID);
HMACT64 hmact = new HMACT64(Options.ReconnectCookie);
hmact.update(Secure.GetClentRandom());
byte[] buffer = hmact.digest();
packet.Write(buffer, 0, buffer.Length);
return(packet);
}
packet.WriteLittleEndian32(0);
return(packet);
}
/// <summary>
/// Client MCS Connect Initial PDU
/// Part 2
///
/// Create packet
/// </summary>
internal static RdpPacket sendMcsData(bool useRdp5, int num_channels, int serverSelectedProtocol)
{
RdpPacket packet = new RdpPacket();
// Проверка длины Client Name
string clientName = Options.ClientName;
if (clientName.Length > 15)
{
clientName = clientName.Substring(0, 15);
}
int num = 2 * clientName.Length;
int num2 = 0x9e;
if (useRdp5)
{
num2 += 0x60;
}
if (useRdp5 && (num_channels > 0))
{
num2 += (num_channels * 12) + 8;
}
if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED))
{
num2 += 8;
}
packet.WriteBigEndian16((short)5);
packet.WriteBigEndian16((short)20);
packet.WriteByte(0x7c);
packet.WriteBigEndian16((short)1);
packet.WriteBigEndian16((short)(num2 | 0x8000));
packet.WriteBigEndian16((short)8);
packet.WriteBigEndian16((short)0x10);
packet.WriteByte(0);
packet.WriteLittleEndian16((ushort)0xc001);
packet.WriteByte(0);
packet.WriteLittleEndian32(0x61637544);
packet.WriteBigEndian16((short)((num2 - 14) | 0x8000));
// Client Core Data (TS_UD_CS_CORE)
packet.WriteLittleEndian16((ushort)CLIENT.CS_CORE);
packet.WriteLittleEndian16(useRdp5 ? ((short)0xd8) : ((short)0x88));
packet.WriteLittleEndian16(useRdp5 ? ((short)4) : ((short)1));
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian16((short)Options.width); // Width
packet.WriteLittleEndian16((short)Options.height); // Height
packet.WriteLittleEndian16((ushort)0xca01);
packet.WriteLittleEndian16((ushort)0xaa03);
packet.WriteLittleEndian32(Options.Keyboard); // Клавиатура
packet.WriteLittleEndian32(useRdp5 ? 0xa28 : 0x1a3); // Client Build
packet.WriteUnicodeString(clientName); // Client Name
packet.Position += 30 - num;
packet.WriteLittleEndian32(0x00000004); // IBM enhanced (101- or 102-key) keyboard
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian32(12); // Функциональные клавиши (F1-F12)
packet.Position += 0x40L;
packet.WriteLittleEndian16((ushort)0xCA01); // NS_UD_COLOR_8BPP
packet.WriteLittleEndian16(useRdp5 ? ((short)1) : ((short)0));
if (useRdp5)
{
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian16((short)((byte)Options.server_bpp));
packet.WriteLittleEndian16((short)7);
packet.WriteLittleEndian16((short)1);
packet.Position += 0x40L;
packet.WriteByte(0);
packet.WriteByte(0);
packet.WriteLittleEndian32(serverSelectedProtocol);
// Client Cluster Data (TS_UD_CS_CLUSTER)
packet.WriteLittleEndian16((ushort)CLIENT.CS_CLUSTER);
packet.WriteLittleEndian16((short)12);
int num3 = 13;
if (Options.flags.HasFlag(HostFlags.ConsoleSession) || (Options.sessionID != 0))
{
num3 |= 2;
}
packet.WriteLittleEndian32(num3);
packet.WriteLittleEndian32(Options.sessionID);
}
// Client Security Data (TS_UD_CS_SEC)
packet.WriteLittleEndian16((ushort)CLIENT.CS_SECURITY);
packet.WriteLittleEndian16(useRdp5 ? ((short)12) : ((short)8));
int num4 = 0;
if (serverSelectedProtocol == 0)
{
num4 |= 3;
}
packet.WriteLittleEndian32(num4);
if (useRdp5)
{
packet.WriteLittleEndian32(0);
}
// Client Network Data (TS_UD_CS_NET)
if (useRdp5 && (num_channels > 0))
{
packet.WriteLittleEndian16((ushort)CLIENT.CS_NET);
packet.WriteLittleEndian16((short)((num_channels * 12) + 8));
packet.WriteLittleEndian32(num_channels);
foreach (IVirtualChannel channel in Channels.RegisteredChannels)
{
Debug.WriteLine("Client Network Data. Channel name length: " + channel.ChannelName.Length);
packet.WriteString(channel.ChannelName, false);
packet.WriteBigEndian32((uint)(CHANNEL_DEF.CHANNEL_OPTION_INITIALIZED));
}
}
// Client Message Channel Data (TS_UD_CS_MCS_MSGCHANNEL)
if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED))
{
packet.WriteLittleEndian16((ushort)CLIENT.CS_MCS_MSGCHANNEL);
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian32(0);
}
return(packet);
}
private byte[] Authenticate(byte[] lmChallengeResponse, byte[] ntChallengeResponse, string sDomainName, string sUser, string sWorkstation, byte[] EncryptedRandomSessionKey, byte[] ExportedSessionKey, bool bGenerateMIC)
{
RdpPacket packet = new RdpPacket();
uint flags = (
(((((0xe2800000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) |
NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) |
NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) |
NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_UNICODE;
DumpFlags(flags);
int position = (int)packet.Position;
packet.WriteString("NTLMSSP", false);
packet.WriteByte(0);
packet.WriteLittleEndian32(3);
int num3 = ((int)packet.Position) - position;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 4;
if ((flags & 0x2000000) != 0)
{
num3 += 8;
}
if (bGenerateMIC)
{
num3 += 0x10;
}
byte[] bytes = Encoding.Unicode.GetBytes(sDomainName);
byte[] buffer = Encoding.Unicode.GetBytes(sUser);
byte[] buffer3 = Encoding.Unicode.GetBytes(sWorkstation);
int num4 = num3;
int num5 = num4 + bytes.Length;
int num6 = num5 + buffer.Length;
int num7 = num6 + buffer3.Length;
int num8 = num7 + lmChallengeResponse.Length;
int num9 = num8 + ntChallengeResponse.Length;
packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length);
packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length);
packet.WriteLittleEndian32(num7);
num3 += lmChallengeResponse.Length;
packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length);
packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length);
packet.WriteLittleEndian32(num8);
num3 += ntChallengeResponse.Length;
packet.WriteLittleEndian16((ushort)bytes.Length);
packet.WriteLittleEndian16((ushort)bytes.Length);
packet.WriteLittleEndian32(num4);
num3 += bytes.Length;
packet.WriteLittleEndian16((ushort)buffer.Length);
packet.WriteLittleEndian16((ushort)buffer.Length);
packet.WriteLittleEndian32(num5);
num3 += buffer.Length;
packet.WriteLittleEndian16((ushort)buffer3.Length);
packet.WriteLittleEndian16((ushort)buffer3.Length);
packet.WriteLittleEndian32(num6);
num3 += buffer3.Length;
packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length);
packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length);
packet.WriteLittleEndian32(num9);
num3 += EncryptedRandomSessionKey.Length;
packet.WriteLittleEndian32(flags);
if ((flags & 0x2000000) != 0)
{
this.WriteVersion(packet);
}
long num10 = packet.Position;
if (bGenerateMIC)
{
packet.WritePadding(0x10);
}
packet.Write(bytes, 0, bytes.Length);
packet.Write(buffer, 0, buffer.Length);
packet.Write(buffer3, 0, buffer3.Length);
packet.Write(lmChallengeResponse, 0, lmChallengeResponse.Length);
packet.Write(ntChallengeResponse, 0, ntChallengeResponse.Length);
packet.Write(EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length);
if (bGenerateMIC)
{
packet.Position = 0L;
byte[] buffer4 = new byte[packet.Length];
packet.Read(buffer4, 0, buffer4.Length);
HMACT64 hmact = new HMACT64(ExportedSessionKey);
hmact.update(this.m_NegotiateMsg);
hmact.update(this.m_ChallengeMsg);
hmact.update(buffer4);
byte[] buffer5 = hmact.digest();
packet.Position = num10;
packet.Write(buffer5, 0, buffer5.Length);
}
packet.Position = 0L;
byte[] buffer6 = new byte[packet.Length];
packet.Read(buffer6, 0, buffer6.Length);
return(buffer6);
}
