internal Smb2CreateRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Create")
{
this.nameOffset = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 44, true);
this.nameLength = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 46, true);
this.fileName = Utils.ByteConverter.ReadString(this.ParentFrame.Data, smb2Packet.PacketStartIndex + this.nameOffset, this.nameLength, true, true);
}
internal Smb2FindResponse(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Find Response")
{
ushort responseOffset = BitConverter.ToUInt16(this.ParentFrame.Data, PacketStartIndex + 2);
int responseSize = BitConverter.ToInt32(this.ParentFrame.Data, PacketStartIndex + 4);
this.fileInfoList = new List <Smb2FileInfo>();
int index = packetStartIndex + 8;
int responseEndIndex = index + responseSize;
while (index < packetEndIndex)
{
Smb2FileInfo fileInfo = new Smb2FileInfo(this.ParentFrame.Data, index, responseEndIndex);
fileInfoList.Add(fileInfo);
if (fileInfo.NextOffset > 0)
{
index += fileInfo.NextOffset;
}
else
{
break;
}
}
}
internal Smb2ReadRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Read")
{
this.readLength = BitConverter.ToUInt32(this.ParentFrame.Data, PacketStartIndex + 4);
this.fileOffset = BitConverter.ToInt64(this.ParentFrame.Data, PacketStartIndex + 8);
this.fileId = ReadSmb2FileId(this.ParentFrame.Data, packetStartIndex + 16);
}
internal Smb2CreateRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Create")
{
this.CreateDisposition = Enum.GetName(typeof(CREATE_DISPOSITION), Utils.ByteConverter.ToUInt32(this.ParentFrame.Data, packetStartIndex + 36, 4, true));
this.nameOffset = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 44, true);
this.nameLength = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 46, true);
this.FileName = Utils.ByteConverter.ReadString(this.ParentFrame.Data, smb2Packet.PacketStartIndex + this.nameOffset, this.nameLength, true, true);
}
internal class Smb2TreeConnectResponse : Smb2Command { //0x03
internal Smb2TreeConnectResponse(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Tree Connect Response")
{
if (base.Smb2Packet.ntStatus == NT_STATUS_SUCCESS)
{
//success
}
}
internal Smb2ReadResponse(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Read Response")
{
this.dataOffset = BitConverter.ToUInt16(this.ParentFrame.Data, PacketStartIndex + 2);
this.dataLength = BitConverter.ToUInt32(this.ParentFrame.Data, PacketStartIndex + 4);
this.readRemaining = BitConverter.ToUInt32(this.ParentFrame.Data, PacketStartIndex + 8);
this.fileData = new byte[this.dataLength];
Array.Copy(this.ParentFrame.Data, smb2Packet.PacketStartIndex + this.dataOffset, this.fileData, 0, this.dataLength);
}
} //in lack of a better name I'm using wireshark's "InfoLevel" name. This one specifies the format of the respones
internal Smb2FindRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Find Request")
{
this.infoLevel = this.ParentFrame.Data[PacketStartIndex + 2];
ushort searchPatternOffset = BitConverter.ToUInt16(this.ParentFrame.Data, PacketStartIndex + 24);//offset from start of SMB2 packet
ushort searchPatternLength = BitConverter.ToUInt16(this.ParentFrame.Data, PacketStartIndex + 26);
this.searchPattern = Utils.ByteConverter.ReadString(this.ParentFrame.Data, base.Smb2Packet.PacketStartIndex + searchPatternOffset, searchPatternLength, true, true);
}
internal Smb2SetInfoRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 SetInfo")
{
//https://wiki.wireshark.org/SMB2/SetInfo
uint infoDataLength = Utils.ByteConverter.ToUInt32(this.ParentFrame.Data, packetStartIndex + 4, 4, true);
ushort infoOffset = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 8, true);
this.FileID = ReadSmb2FileId(this.ParentFrame.Data, packetStartIndex + 16);
if (this.ParentFrame.Data[packetStartIndex + 3] == 0x14) //0x14 = SMB2_FILE_ENDOFFILE_INFO
{
this.EndOfFile = (long)Utils.ByteConverter.ToUInt64(ParentFrame.Data, smb2Packet.PacketStartIndex + infoOffset, true);
}
}
internal Smb2CreateResponse(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Create Response")
{
this.structureSize = BitConverter.ToInt16(this.ParentFrame.Data, packetStartIndex);
if (this.structureSize == VALID_STRUCTURE_SIZE)
{
this.creationTime = ReadFileTime(this.ParentFrame.Data, packetStartIndex + 8);
this.lastAccessTime = ReadFileTime(this.ParentFrame.Data, packetStartIndex + 16);
this.lastWriteTime = ReadFileTime(this.ParentFrame.Data, packetStartIndex + 24);
this.changeTime = ReadFileTime(this.ParentFrame.Data, packetStartIndex + 32);
this.fileId = ReadSmb2FileId(this.ParentFrame.Data, packetStartIndex + 64);
}
}
internal Smb2WriteRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Write")
{
this.dataOffset = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 2, true);
this.dataLength = Utils.ByteConverter.ToUInt32(this.ParentFrame.Data, packetStartIndex + 4, 4, true);
this.fileOffset = BitConverter.ToInt64(this.ParentFrame.Data, PacketStartIndex + 8);
//this.fileOffset = Utils.ByteConverter.ToUInt64(this.ParentFrame.Data, packetStartIndex + 8, true);
this.fileId = ReadSmb2FileId(this.ParentFrame.Data, packetStartIndex + 16);
this.fileData = new byte[this.dataLength];
Array.Copy(this.ParentFrame.Data, smb2Packet.PacketStartIndex + this.dataOffset, this.fileData, 0, this.dataLength);
}
internal Smb2CloseResponse(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Close Response")
{
if (smb2Packet.ntStatus == NT_STATUS_SUCCESS) //STATUS_SUCCESS
{
ushort structureSize = BitConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex);
if (structureSize == 0x3c)
{
//if status is success
this.endOfFile = BitConverter.ToInt64(this.ParentFrame.Data, packetStartIndex + 48);
}
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
if (this.messageType == 0x00 && PacketStartIndex + 4 < PacketEndIndex)
{
AbstractPacket packet;
try {
if (ParentFrame.Data[PacketStartIndex + 4] == 0xff)
{
packet = new SmbPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else if (ParentFrame.Data[PacketStartIndex + 4] == 0xfe)
{
packet = new Smb2Packet(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else
{
packet = new RawPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
}
catch (Exception e) {
SharedUtils.Logger.Log("Error parsing packet in NetBIOS SS payload in " + this.ParentFrame.ToString() + ". " + e.ToString(), SharedUtils.Logger.EventLogEntryType.Warning);
packet = new RawPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
if (this.messageType == 0x00 && PacketStartIndex + 4 < PacketEndIndex)
{
AbstractPacket packet;
try {
if (ParentFrame.Data[PacketStartIndex + 4] == 0xff)
{
packet = new SmbPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else if (ParentFrame.Data[PacketStartIndex + 4] == 0xfe)
{
packet = new Smb2Packet(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
else
{
packet = new RawPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
}
catch {
packet = new RawPacket(ParentFrame, PacketStartIndex + 4, PacketEndIndex);
}
yield return(packet);
foreach (AbstractPacket subPacket in packet.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
//what to do here?? SMB packet???
if (smbPacketIndex == null)
{
yield break;
}
else
{
AbstractPacket smb = null;
if (ParentFrame.Data[this.smbPacketIndex.Value] == 0xff)//SMB
{
smb = new SmbPacket(this.ParentFrame, this.smbPacketIndex.Value, this.PacketEndIndex);
}
else if (ParentFrame.Data[this.smbPacketIndex.Value] == 0xfe)//SMB2
{
smb = new Smb2Packet(this.ParentFrame, this.smbPacketIndex.Value, this.PacketEndIndex);
}
else
{
yield break;
}
if (smb != null)
{
foreach (AbstractPacket p in smb.GetSubPackets(true))
{
yield return(p);
}
}
}
}
internal Smb2CloseRequest(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Close")
{
this.fileId = ReadSmb2FileId(this.ParentFrame.Data, packetStartIndex + 8);
}
public override IEnumerable <AbstractPacket> GetSubPackets(bool includeSelfReference)
{
if (includeSelfReference)
{
yield return(this);
}
if (!this.IsResponse || this.ntStatus == NT_STATUS_SUCCESS || this.ntStatus == NT_STATUS_MORE_PROCESSING_REQUIRED)
{
if (!this.IsResponse && this.opCode == (ushort)OP_CODE.SessionSetup) //0x01
{
Smb2SessionSetupRequest p = new Smb2SessionSetupRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex);
yield return(p);
foreach (AbstractPacket subPacket in p.GetSubPackets(false))
{
yield return(subPacket);
}
}
else if (this.IsResponse && this.opCode == (ushort)OP_CODE.SessionSetup) //0x01
{
Smb2SessionSetupResponse p = new Smb2SessionSetupResponse(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex);
yield return(p);
foreach (AbstractPacket subPacket in p.GetSubPackets(false))
{
yield return(subPacket);
}
}
else if (!this.IsResponse && this.opCode == (ushort)OP_CODE.TreeConnect) //0x03
{
yield return(new Smb2TreeConnectRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (this.IsResponse && this.opCode == (ushort)OP_CODE.TreeConnect) //0x03
{
yield return(new Smb2TreeConnectResponse(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (!this.IsResponse && this.opCode == (ushort)OP_CODE.Create) //0x05
{
yield return(new Smb2CreateRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (this.IsResponse && this.opCode == (ushort)OP_CODE.Create) //0x05
{
yield return(new Smb2CreateResponse(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (!this.IsResponse && this.opCode == (ushort)OP_CODE.Close) //0x06
{
yield return(new Smb2CloseRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (this.IsResponse && this.opCode == (ushort)OP_CODE.Close) //0x06
{
yield return(new Smb2CloseResponse(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (!this.IsResponse && this.opCode == (short)OP_CODE.Read) //0x08
{
yield return(new Smb2ReadRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (this.IsResponse && this.opCode == (short)OP_CODE.Read) //0x08
{
yield return(new Smb2ReadResponse(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (!this.IsResponse && this.opCode == (ushort)OP_CODE.Write) //0x09
{
yield return(new Smb2WriteRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (!this.IsResponse && this.opCode == (short)OP_CODE.Find) //0x0e
{
yield return(new Smb2FindRequest(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
else if (this.IsResponse && this.opCode == (short)OP_CODE.Find) //0x0e
{
yield return(new Smb2FindResponse(this, this.PacketStartIndex + this.headerLength, this.PacketEndIndex));
}
}
if (this.chainOffset > 0)
{
Smb2Packet chainedPacket = new Smb2Packet(this.ParentFrame, this.PacketStartIndex + (int)this.chainOffset, this.PacketEndIndex);
yield return(chainedPacket);
foreach (AbstractPacket subPacket in chainedPacket.GetSubPackets(false))
{
yield return(subPacket);
}
}
}
internal Smb2Command(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex, string commandName)
: base(smb2Packet.ParentFrame, packetStartIndex, packetEndIndex, commandName)
{
this.smb2Packet = smb2Packet;
}
internal Smb2SessionSetupResponse(Smb2Packet smb2Packet, int packetStartIndex, int packetEndIndex)
: base(smb2Packet, packetStartIndex, packetEndIndex, "SMB2 Session Setup Response")
{
this.blobOffset = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 4, true);
this.blobLength = Utils.ByteConverter.ToUInt16(this.ParentFrame.Data, packetStartIndex + 6, true);
}