Пример #1
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal void NTLMSSPNegotiate()
        {
            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x01, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x1f, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);
            Byte[] bHeader = header.GetHeader();

            SMB2NTLMSSPNegotiate NTLMSSPNegotiate = new SMB2NTLMSSPNegotiate(version);
            NTLMSSPNegotiate.SetFlags(flags);
            Byte[] bNegotiate = NTLMSSPNegotiate.GetSMB2NTLMSSPNegotiate();
            
            SMB2SessionSetupRequest sessionSetup = new SMB2SessionSetupRequest();
            sessionSetup.SetSecurityBlob(bNegotiate);
            Byte[] bData = sessionSetup.GetSMB2SessionSetupRequest();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] send = Combine.combine(bSessionService, bHeader);
            send = Combine.combine(send, bData);
            streamSocket.Write(send, 0, send.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);
        }
Пример #2
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        public void NegotiateSMB2()
        {   
            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x00, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x00, 0x00 });
            header.SetMessageID(messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);
            Byte[] bHeader = header.GetHeader();

            SMB2NegotiateProtocolRequest protocols = new SMB2NegotiateProtocolRequest();
            Byte[] bData = protocols.GetProtocols();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] send = Combine.combine(bSessionService, bHeader);
            send = Combine.combine(send, bData);
            streamSocket.Write(send, 0, send.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);
        }
Пример #3
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean CloseRequest()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x06, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2CloseRequest closeRequest = new SMB2CloseRequest();

            closeRequest.SetFileID(guidFileHandle);
            Byte[] bData = closeRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            else
            {
                header.SetFlags(new Byte[] { 0x00, 0x00, 0x00, 0x00 });
            }
            Byte[] bHeader = header.GetHeader();

            return(Send(bHeader, bData));
        }
Пример #4
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean TreeConnect(String share)
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x03, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2TreeConnectRequest treeConnect = new SMB2TreeConnectRequest();

            treeConnect.SetPath(share);
            Byte[] bData = treeConnect.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            return(Send(bHeader, bData));
        }
Пример #5
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean LogoffRequest()
        {
            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x02, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2SessionLogoffRequest logoffRequest = new SMB2SessionLogoffRequest();
            Byte[] bData = logoffRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
                return true;
            else
                return false;
        }
Пример #6
0
        internal Boolean RPCBind()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x09, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            DCERPCBind bind = new DCERPCBind();

            bind.SetFragLength(new Byte[] { 0x48, 0x00 });
            bind.SetCallID(1);
            bind.SetNumCtxItems(new Byte[] { 0x01 });
            bind.SetInterface(new Byte[] { 0x81, 0xbb, 0x7a, 0x36, 0x44, 0x98, 0xf1, 0x35, 0xad, 0x32, 0x98, 0xf0, 0x38, 0x00, 0x10, 0x03 });
            bind.SetInterfaceVer(new Byte[] { 0x02, 0x00 });
            Byte[] bData = bind.GetRequest();

            SMB2WriteRequest writeRequest = new SMB2WriteRequest();

            writeRequest.SetGuidHandleFile(guidFileHandle);
            writeRequest.SetLength(bData.Length);
            bData = Combine.combine(writeRequest.GetRequest(), bData);

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            return(Send(bHeader, bData));
        }
Пример #7
0
        internal Boolean CreateRequest(Byte[] ShareAccess)
        {
            treeId = recieve.Skip(40).Take(4).ToArray();

            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x05, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2CreateRequest createRequest = new SMB2CreateRequest();

            createRequest.SetFileName("svcctl");
            createRequest.SetShareAccess(ShareAccess);
            Byte[] bData = createRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            Boolean returnValue = Send(bHeader, bData);

            guidFileHandle = recieve.Skip(0x0084).Take(16).ToArray();

            return(returnValue);
        }
Пример #8
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal void IoctlRequest(String share)
        {
            treeId = new Byte[] { 0x01, 0x00, 0x00, 0x00 };

            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x0b, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2IoctlRequest ioctlRequest = new SMB2IoctlRequest();
            ioctlRequest.SetFileName(share);
            Byte[] bData = ioctlRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);
            treeId = new Byte[] { 0x00, 0x00, 0x00, 0x00 };
        }
Пример #9
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean Logoff()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x02, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2SessionLogoffRequest logoffRequest = new SMB2SessionLogoffRequest();

            Byte[] bData = logoffRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }

            Byte[] bHeader = header.GetHeader();

            return(Send(bHeader, bData));
        }
Пример #10
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        private Int32 _ReadRequest2(Int64 offset, Int32 length)
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x08, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);
            header.SetChainOffset(new Byte[] { 0x00, 0x00, 0x00, 0x00 });

            SMB2ReadRequest readRequest = new SMB2ReadRequest();

            readRequest.SetGuidHandleFile(guidFileHandle);
            readRequest.SetLength(BitConverter.GetBytes(length));
            readRequest.SetOffset(BitConverter.GetBytes(offset));
            Byte[] bData = readRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();

            Combine combine      = new Combine();
            Int32   streamLength = 0;

            Byte[] dataRecieved = new Byte[0];
            do
            {
                Byte[] part       = new Byte[65619];
                Int32  partLength = streamSocket.Read(part, 0, part.Length);
                streamLength += partLength;
                combine.Extend(part.Take(partLength).ToArray());
            }while (streamLength < length);
            Int32 padding = length < 65535 ? 0 : 54;

            recieve = combine.Retrieve().Skip(84).Take(streamLength - 84 - padding).ToArray();

            binaryWriter.Write(recieve);
            binaryWriter.Flush();

            return(recieve.Length);
        }
Пример #11
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean SetInfoRequest(String sourceFilePath, String destination)
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x11, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2SetInfo setInfo = new SMB2SetInfo();

            setInfo.SetClass(new Byte[] { 0x01 });
            setInfo.SetInfoLevel(new Byte[] { 0x14 });
            setInfo.SetGUIDHandleFile(guidFileHandle);

            //This may need to be coverted to int32
            using (FileStream fileStream = new FileStream(Path.GetFullPath(sourceFilePath), FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
            {
                using (BinaryReader binaryReader = new BinaryReader(fileStream))
                {
                    setInfo.SetBuffer(BitConverter.GetBytes(binaryReader.BaseStream.Length));
                }
            }

            setInfo.SetGUIDHandleFile(guidFileHandle);
            Byte[] bData = setInfo.GetRequest();

            header.SetChainOffset(bData.Length);
            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(bSessionService, Combine.combine(bHeader, bData));
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
            {
                treeId = recieve.Skip(40).Take(4).ToArray();
                return(true);
            }
            return(false);
        }
Пример #12
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal override Boolean ReadRequest()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x08, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);
            header.SetChainOffset(new Byte[] { 0x00, 0x00, 0x00, 0x00 });

            SMB2ReadRequest readRequest = new SMB2ReadRequest();

            readRequest.SetGuidHandleFile(guidFileHandle);
            readRequest.SetLength(BitConverter.GetBytes(4096));
            readRequest.SetOffset(BitConverter.GetBytes((Int64)0));
            Byte[] bData = readRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();

            Int16 i = 0;

            while (smbClient.Available < 8192 && i < 10)
            {
                System.Threading.Thread.Sleep(100);
                i++;
            }

            Int32 streamLength = streamSocket.Read(recieve, 0, recieve.Length);

            Byte[] data = recieve.Skip(84).Take((Int32)streamLength).ToArray();

            GetStatus(recieve.Skip(12).Take(4).ToArray());

            return(true);
        }
Пример #13
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal override Boolean CreateRequest(String folder)
        {
            treeId = recieve.Skip(40).Take(4).ToArray();

            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x05, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2CreateRequest createRequest = new SMB2CreateRequest();

            if (!String.IsNullOrEmpty(folder))
            {
                createRequest.SetFileName(folder);
            }
            createRequest.SetExtraInfo(1, 0);
            createRequest.SetCreateOptions(new Byte[] { 0x00, 0x00, 0x20, 0x00 });
            createRequest.SetAccessMask(new Byte[] { 0x89, 0x00, 0x12, 0x00 });
            createRequest.SetShareAccess(new Byte[] { 0x05, 0x00, 0x00, 0x00 });
            Byte[] bData = createRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
            {
                guidFileHandle = recieve.Skip(0x0084).Take(16).ToArray();
                return(true);
            }
            return(false);
        }
Пример #14
0
        internal Boolean StartServiceW()
        {
            Console.WriteLine("[+] Starting Service");
            serviceHandle = recieve.Skip(112).Take(20).ToArray();

            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x09, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SVCCTLSCMStartServiceW startServiceW = new SVCCTLSCMStartServiceW();

            startServiceW.SetContextHandle(serviceHandle);
            Byte[] bStartService = startServiceW.GetRequest();

            DCERPCRequest rpcRequest = new DCERPCRequest();

            rpcRequest.SetPacketFlags(new Byte[] { 0x03 });
            rpcRequest.SetFragLength(bStartService.Length, 0, 0);
            rpcRequest.SetCallID(new Byte[] { 0x01, 0x00, 0x00, 0x00 });
            rpcRequest.SetContextID(new Byte[] { 0x00, 0x00 });
            rpcRequest.SetOpnum(new Byte[] { 0x13, 0x00 });
            Byte[] bRPCRequest = rpcRequest.GetRequest();

            SMB2WriteRequest writeRequest = new SMB2WriteRequest();

            writeRequest.SetGuidHandleFile(guidFileHandle);
            writeRequest.SetLength(bRPCRequest.Length + bStartService.Length);
            Byte[] bWriteRequest = writeRequest.GetRequest();

            Combine combine = new Combine();

            combine.Extend(bWriteRequest);
            combine.Extend(bRPCRequest);
            combine.Extend(bStartService);
            Byte[] bData = combine.Retrieve();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            return(Send(bHeader, bData));
        }
Пример #15
0
        internal Boolean CloseServiceHandle()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x09, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SVCCTLSCMCloseServiceHandle closeServiceW = new SVCCTLSCMCloseServiceHandle();

            closeServiceW.SetContextHandle(serviceContectHandle);
            Byte[] bCloseServiceW = closeServiceW.GetRequest();

            DCERPCRequest rpcRequest = new DCERPCRequest();

            rpcRequest.SetPacketFlags(new Byte[] { 0x03 });
            rpcRequest.SetFragLength(bCloseServiceW.Length, 0, 0);
            rpcRequest.SetCallID(new Byte[] { 0x01, 0x00, 0x00, 0x00 });
            rpcRequest.SetContextID(new Byte[] { 0x00, 0x00 });
            rpcRequest.SetOpnum(new Byte[] { 0x00, 0x00 });
            Byte[] bRPCRequest = rpcRequest.GetRequest();

            SMB2WriteRequest writeRequest = new SMB2WriteRequest();

            writeRequest.SetGuidHandleFile(guidFileHandle);
            writeRequest.SetLength(bRPCRequest.Length + bCloseServiceW.Length);
            Byte[] bWriteRequest = writeRequest.GetRequest();

            Combine combine = new Combine();

            combine.Extend(bWriteRequest);
            combine.Extend(bRPCRequest);
            combine.Extend(bCloseServiceW);
            Byte[] bData = combine.Retrieve();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            return(Send(bHeader, bData));
        }
Пример #16
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean SetInfoRequest()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x11, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2SetInfo setInfo = new SMB2SetInfo();

            setInfo.SetClass(new Byte[] { 0x01 });
            setInfo.SetInfoLevel(new Byte[] { 0x0d });
            setInfo.SetGUIDHandleFile(guidFileHandle);
            setInfo.SetBuffer(new Byte[] { 0x01, 0x00, 0x00, 0x00 });
            Byte[] bData = setInfo.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(bSessionService, Combine.combine(bHeader, bData));
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatusSilent(recieve.Skip(12).Take(4).ToArray()))
            {
                Console.WriteLine("[+] File Deleted");
                return(true);
            }
            return(false);
        }
Пример #17
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal virtual Boolean InfoRequest()
        {
            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x10, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2GetInfo getInfo = new SMB2GetInfo();
            getInfo.SetClass(new Byte[] { 0x02 });
            getInfo.SetInfoLevel(new Byte[] { 0x05 });
            getInfo.SetMaxResponseSize(new Byte[] { 0x50, 0x00, 0x00, 0x00 });
            getInfo.SetGUIDHandleFile(recieve.Skip(132).Take(16).ToArray());
            Byte[] bData = getInfo.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
                return true;
            else
                return false;
        }
Пример #18
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        private void _WriteRequest(Byte[] buffer, Int64 offset)
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x09, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2WriteRequest writeRequest = new SMB2WriteRequest();

            writeRequest.SetGuidHandleFile(guidFileHandle);
            writeRequest.SetBuffer(buffer);
            writeRequest.SetOffset(offset);

            Byte[] bData = writeRequest.GetRequest();

            header.SetChainOffset(bData.Length);
            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(bSessionService, Combine.combine(bHeader, bData));
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);
        }
Пример #19
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean CloseRequest()
        {
            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x06, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2CloseRequest closeRequest = new SMB2CloseRequest();
            closeRequest.SetFileID(guidFileHandle);
            Byte[] bData = closeRequest.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            else
            {
                header.SetFlags(new Byte[] { 0x00, 0x00, 0x00, 0x00 });
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            return GetStatusSilent(recieve.Skip(12).Take(4).ToArray());
        }
Пример #20
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean FindRequest()
        {
            treeId = recieve.Skip(40).Take(4).ToArray();

            ////////////////////////////////////////////////////////////////////////////////
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x0e, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);
            header.SetChainOffset(new Byte[] { 0x68, 0x00, 0x00, 0x00 });

            SMB2FindFileRequestFile findFileRequestFile = new SMB2FindFileRequestFile();

            findFileRequestFile.SetInfoLevel(new Byte[] { 0x25 });
            findFileRequestFile.SetFileID(guidFileHandle);
            findFileRequestFile.SetPadding(new Byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });
            Byte[] bData = findFileRequestFile.GetRequest();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            ////////////////////////////////////////////////////////////////////////////////
            SMB2Header header2 = new SMB2Header();

            header2.SetCommand(new Byte[] { 0x0e, 0x00 });
            header2.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header2.SetMessageID(++messageId);
            header2.SetProcessID(processId);
            header2.SetTreeId(treeId);
            header2.SetSessionID(sessionId);
            header.SetFlags(new Byte[] { 0x04, 0x00, 0x00, 0x00 });

            SMB2FindFileRequestFile findFileRequestFile2 = new SMB2FindFileRequestFile();

            findFileRequestFile2.SetInfoLevel(new Byte[] { 0x25 });
            findFileRequestFile2.SetFileID(guidFileHandle);
            findFileRequestFile2.SetPadding(new Byte[] { 0x80, 0x00, 0x00, 0x00 });
            Byte[] bData2 = findFileRequestFile2.GetRequest();

            if (signing)
            {
                header2.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header2.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader2 = header2.GetHeader();

            ////////////////////////////////////////////////////////////////////////////////
            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length + bHeader2.Length);
            sessionService.SetDataLength(bData.Length + bData2.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Combine combine = new Combine();

            combine.Extend(bHeader);
            combine.Extend(bData);
            combine.Extend(bHeader2);
            combine.Extend(bData2);

            Byte[] bSend = Combine.combine(bSessionService, combine.Retrieve());
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            return(GetStatus(recieve.Skip(12).Take(4).ToArray()));
        }
Пример #21
0
        internal Boolean OpenSCManagerW()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x09, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SVCCTLSCMOpenSCManagerW openSCManagerW = new SVCCTLSCMOpenSCManagerW();

            Byte[] bSCManager = openSCManagerW.GetRequest();

            DCERPCRequest rpcRequest = new DCERPCRequest();

            rpcRequest.SetPacketFlags(new Byte[] { 0x03 });
            rpcRequest.SetFragLength(bSCManager.Length, 0, 0);
            rpcRequest.SetCallID(new Byte[] { 0x01, 0x00, 0x00, 0x00 });
            rpcRequest.SetContextID(new Byte[] { 0x00, 0x00 });
            rpcRequest.SetOpnum(new Byte[] { 0x0f, 0x00 });
            Byte[] bRPCRequest = rpcRequest.GetRequest();

            SMB2WriteRequest writeRequest = new SMB2WriteRequest();

            writeRequest.SetGuidHandleFile(guidFileHandle);
            writeRequest.SetLength(bRPCRequest.Length + bSCManager.Length);
            Byte[] bWriteRequest = writeRequest.GetRequest();

            Combine combine = new Combine();

            combine.Extend(bWriteRequest);
            combine.Extend(bRPCRequest);
            combine.Extend(bSCManager);
            Byte[] bData = combine.Retrieve();

            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            Byte[] bHeader = header.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
            {
                return(true);
            }
            else
            {
                return(false);
            }
        }
Пример #22
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean GetInfoRequest()
        {
            SMB2Header header = new SMB2Header();

            header.SetCommand(new Byte[] { 0x10, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2GetInfo getInfo = new SMB2GetInfo();

            getInfo.SetClass(new Byte[] { 0x02 });
            getInfo.SetInfoLevel(new Byte[] { 0x01 });
            getInfo.SetMaxResponseSize(new Byte[] { 0x58, 0x00, 0x00, 0x00 });
            getInfo.SetGetInfoInputOffset(new Byte[] { 0x00, 0x00 });
            getInfo.SetGUIDHandleFile(guidFileHandle);
            Byte[] bData = getInfo.GetRequest();

            header.SetChainOffset(bData.Length);
            if (signing)
            {
                header.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }

            Byte[] bHeader = header.GetHeader();

            SMB2Header header2 = new SMB2Header();

            header2.SetCommand(new Byte[] { 0x10, 0x00 });
            header2.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header2.SetMessageID(++messageId);
            header2.SetProcessID(processId);
            header2.SetTreeId(treeId);
            header2.SetSessionID(sessionId);
            header2.SetFlags(new Byte[] { 0x00, 0x00, 0x00, 0x04 });

            SMB2GetInfo getInfo2 = new SMB2GetInfo();

            getInfo2.SetClass(new Byte[] { 0x02 });
            getInfo2.SetInfoLevel(new Byte[] { 0x05 });
            getInfo2.SetMaxResponseSize(new Byte[] { 0x50, 0x00, 0x00, 0x00 });
            getInfo2.SetGetInfoInputOffset(new Byte[] { 0x00, 0x00 });
            getInfo2.SetGUIDHandleFile(guidFileHandle);
            Byte[] bData2 = getInfo2.GetRequest();

            if (signing)
            {
                header2.SetFlags(new Byte[] { 0x08, 0x00, 0x00, 0x00 });
                header2.SetSignature(sessionKey, ref bData2);
            }
            Byte[] bHeader2 = header2.GetHeader();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();

            sessionService.SetHeaderLength(bHeader.Length + bHeader2.Length);
            sessionService.SetDataLength(bData.Length + bData2.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Combine combine = new Combine();

            combine.Extend(bHeader);
            combine.Extend(bData);
            combine.Extend(bHeader2);
            combine.Extend(bData2);
            Byte[] bSend = Combine.combine(bSessionService, combine.Retrieve());
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
            {
                return(true);
            }
            return(false);
        }
Пример #23
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal Boolean Authenticate(String domain, String username, String hash)
        {
            String NTLMSSP = BitConverter.ToString(recieve).Replace("-", "");
            Int32 index = NTLMSSP.IndexOf("4E544C4D53535000") / 2;

            UInt16 wDomain = BitConverter.ToUInt16(recieve.Skip(index + 12).Take(2).ToArray(), 0);
            UInt16 wtarget = BitConverter.ToUInt16(recieve.Skip(index + 40).Take(2).ToArray(), 0);

            sessionId = recieve.Skip(44).Take(8).ToArray();
            Byte[] bServerChallenge = recieve.Skip(index + 24).Take(8).ToArray();
            Int32 start = index + 56 + wDomain;
            Int32 end = index + 55 + wDomain + wtarget;
            Byte[] details = recieve.Skip(start).Take(end - start + 1).ToArray();
            Byte[] bTime = details.Skip(details.Length - 12).Take(8).ToArray();

            Int32 j = 0;
            Byte[] bHash = new Byte[hash.Length / 2];
            for (Int32 i = 0; i < hash.Length; i += 2)
            {
                bHash[j++] = (Byte)((Char)Convert.ToInt16(hash.Substring(i, 2),16));
            }

            Byte[] bHostname = Encoding.Unicode.GetBytes(Environment.MachineName);
            Byte[] hostnameLength = BitConverter.GetBytes(bHostname.Length).Take(2).ToArray();

            Byte[] bDomain = Encoding.Unicode.GetBytes(domain);
            Byte[] domainLength = BitConverter.GetBytes(bDomain.Length).Take(2).ToArray();

            Byte[] bUsername = Encoding.Unicode.GetBytes(username);
            Byte[] usernameLength = BitConverter.GetBytes(bUsername.Length).Take(2).ToArray();

            Byte[] domainOffset = { 0x40, 0x00, 0x00, 0x00 };
            Byte[] usernameOffset = BitConverter.GetBytes(bDomain.Length + 64);
            Byte[] hostnameOffset = BitConverter.GetBytes(bDomain.Length + bUsername.Length + 64);
            Byte[] lmOffset = BitConverter.GetBytes(bDomain.Length + bUsername.Length + bHostname.Length + 64);
            Byte[] ntOffset = BitConverter.GetBytes(bDomain.Length + bUsername.Length + bHostname.Length + 88);

            String usernameTarget = username.ToUpper();
            Byte[] bUsernameTarget = Encoding.Unicode.GetBytes(usernameTarget);
            bUsernameTarget = Combine.combine(bUsernameTarget, bDomain);

            Byte[] NetNTLMv2Hash;
            using (HMACMD5 hmac = new HMACMD5())
            {
                hmac.Key = bHash;
                NetNTLMv2Hash = hmac.ComputeHash(bUsernameTarget);
            }

            Byte[] bClientChallenge = new Byte[8];
            Random random = new Random();
            for (Int32 i = 0; i < 8; i++)
            {
                bClientChallenge[i] = (Byte)random.Next(0, 255);
            }

            Byte[] blob = Combine.combine(new Byte[] { 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, bTime);
            blob = Combine.combine(blob, bClientChallenge);
            blob = Combine.combine(blob, new Byte[] { 0x00, 0x00, 0x00, 0x00 });
            blob = Combine.combine(blob, details);
            blob = Combine.combine(blob, new Byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });

            Byte[] bServerChallengeAndBlob = Combine.combine(bServerChallenge, blob);
            Byte[] NetNTLMv2Response;
            using (HMACMD5 hmacMD5 = new HMACMD5())
            {
                hmacMD5.Key = NetNTLMv2Hash;
                NetNTLMv2Response = hmacMD5.ComputeHash(bServerChallengeAndBlob);
            }

            if (signing)
            {
                using (HMACMD5 hmacMD5 = new HMACMD5())
                {
                    hmacMD5.Key = NetNTLMv2Hash;
                    sessionKey = hmacMD5.ComputeHash(NetNTLMv2Response);
                }
            }

            NetNTLMv2Response = Combine.combine(NetNTLMv2Response, blob);
            Byte[] NetNTLMv2ResponseLength = BitConverter.GetBytes(NetNTLMv2Response.Length).Take(2).ToArray();

            Byte[] sessionKeyOffset = BitConverter.GetBytes(bDomain.Length + bUsername.Length + bHostname.Length + NetNTLMv2Response.Length + 88);

            Byte[] NetNTLMSSPResponse = { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00 };
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, new Byte[] { 0x18, 0x00 });
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, new Byte[] { 0x18, 0x00 });
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, lmOffset);

            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, NetNTLMv2ResponseLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, NetNTLMv2ResponseLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, ntOffset);

            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, domainLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, domainLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, domainOffset);

            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, usernameLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, usernameLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, usernameOffset);

            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, hostnameLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, hostnameLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, hostnameOffset);

            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, sessionKeyLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, sessionKeyLength);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, sessionKeyOffset);

            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, flags);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, bDomain);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, bUsername);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, bHostname);
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, new Byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });
            NetNTLMSSPResponse = Combine.combine(NetNTLMSSPResponse, NetNTLMv2Response);

            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x01, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x1f, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);
            Byte[] bHeader = header.GetHeader();

            NTLMSSPAuth ntlmSSPAuth = new NTLMSSPAuth();
            ntlmSSPAuth.SetNetNTLMResponse(NetNTLMSSPResponse);
            Byte[] bNTLMSSPAuth = ntlmSSPAuth.GetNTLMSSPAuth();

            SMB2SessionSetupRequest sessionSetup = new SMB2SessionSetupRequest();
            sessionSetup.SetSecurityBlob(bNTLMSSPAuth);
            Byte[] bData = sessionSetup.GetSMB2SessionSetupRequest();

            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length);
            sessionService.SetDataLength(bData.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] send = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            streamSocket.Write(send, 0, send.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
            {
                Console.WriteLine("[+] Login Successful");
                return true;
            }
            else
                return false;
        }
Пример #24
0
        ////////////////////////////////////////////////////////////////////////////////
        //
        ////////////////////////////////////////////////////////////////////////////////
        internal virtual Boolean ReadRequest()
        {
            treeId = recieve.Skip(40).Take(4).ToArray();

            ////////////////////////////////////////////////////////////////////////////////
            SMB2Header header = new SMB2Header();
            header.SetCommand(new Byte[] { 0x05, 0x00 });
            header.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header.SetMessageID(++messageId);
            header.SetProcessID(processId);
            header.SetTreeId(treeId);
            header.SetSessionID(sessionId);

            SMB2ReadRequest readRequest = new SMB2ReadRequest();
            readRequest.SetGuidHandleFile(guidFileHandle);

            Byte[] bData = readRequest.GetRequest();

            header.SetChainOffset(bData.Length);
            if (signing)
            {
                header.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header.SetSignature(sessionKey, ref bData);
            }
            else
            {
                header.SetFlags(new Byte[] { 0x00, 0x00, 0x00, 0x00 });
            }
            Byte[] bHeader = header.GetHeader();


            ////////////////////////////////////////////////////////////////////////////////
            SMB2Header header2 = new SMB2Header();
            header2.SetCommand(new Byte[] { 0x0e, 0x00 });
            header2.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header2.SetMessageID(++messageId);
            header2.SetProcessID(processId);
            header2.SetTreeId(treeId);
            header2.SetSessionID(sessionId);
            header2.SetChainOffset(new Byte[] { 0x68, 0x00, 0x00, 0x00 });

            SMB2FindFileRequestFile requestFile = new SMB2FindFileRequestFile();
            requestFile.SetPadding(new Byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });
            Byte[] bData2 = requestFile.GetRequest();

            if (signing)
            {
                header2.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header2.SetSignature(sessionKey, ref bData2);
            }
            else
            {
                header2.SetFlags(new Byte[] { 0x04, 0x00, 0x00, 0x00 });
            }
            Byte[] bHeader2 = header2.GetHeader();


            ////////////////////////////////////////////////////////////////////////////////
            SMB2Header header3 = new SMB2Header();
            header3.SetCommand(new Byte[] { 0x0e, 0x00 });
            header3.SetCreditsRequested(new Byte[] { 0x01, 0x00 });
            header3.SetMessageID(++messageId);
            header3.SetProcessID(processId);
            header3.SetTreeId(treeId);
            header3.SetSessionID(sessionId);

            SMB2FindFileRequestFile requestFile2 = new SMB2FindFileRequestFile();
            requestFile2.SetOutputBufferLength(new Byte[] { 0x80, 0x00, 0x00, 0x00 });
            Byte[] bData3 = requestFile2.GetRequest();

            if (signing)
            {
                header3.SetFlags(new Byte[] { 0x0c, 0x00, 0x00, 0x00 });
                header3.SetSignature(sessionKey, ref bData3);
            }
            else
            {
                header3.SetFlags(new Byte[] { 0x04, 0x00, 0x00, 0x00 });
            }
            Byte[] bHeader3 = header3.GetHeader();


            ////////////////////////////////////////////////////////////////////////////////
            NetBIOSSessionService sessionService = new NetBIOSSessionService();
            sessionService.SetHeaderLength(bHeader.Length + bHeader2.Length + bHeader3.Length);
            sessionService.SetDataLength(bData.Length + bData2.Length + bData3.Length);
            Byte[] bSessionService = sessionService.GetNetBIOSSessionService();

            Byte[] bSend = Combine.combine(Combine.combine(bSessionService, bHeader), bData);
            bSend = Combine.combine(bSend, Combine.combine(bHeader2, bData2));
            bSend = Combine.combine(bSend, Combine.combine(bHeader3, bData3));
            streamSocket.Write(bSend, 0, bSend.Length);
            streamSocket.Flush();
            streamSocket.Read(recieve, 0, recieve.Length);

            if (GetStatus(recieve.Skip(12).Take(4).ToArray()))
                return true;
            else
                return false;
        }