DCE/MS RPC旁窥
目录:
☆ DCE/MS RPC架构简介
☆ BIND操作简介
1) "BIND Over TCP"简介
2) "BIND Over Transaction"简介
3) "BIND Over Write AndX"简介
4) "BIND Over ..."扩展
5) SMB_COM_TRANSACTION2与SMB_COM_NT_TRANSACTION
☆ PFC_OBJECT_UUID标志位
☆ MS02-045/Q326830
☆ WildPackets Free Filters for Detecting Malicious Worms/Viruses
☆ /pipe/epmapper
☆ 135/UDP相关讨论
1) XP SP1的msgsvc.dll(5.1.2600.1309)
2) 中文2000的msgsvc.dll(5.0.2195.4874)
3) 通过135/UDP访问MGMT
4) 通过135/UDP访问EPM
☆ Windows网络服务最小化
☆ MS05-040/KB893756
☆ DriverStudio Remote Control服务
☆ 参考资源
--------------------------------------------------------------------------
☆ DCE/MS RPC架构简介
本节属于科普性质，文字描述不那么规范，将就着看吧。
一个RPC服务可以绑定多种协议序列，也可以只绑定某一种协议序列，这是实现相关
的，没有定式。某接口绑定N种协议序列，就意味着有N条途径可以访问该接口。可以
用135dump.exe、ifids.exe等工具查询这类信息。
+-- ncacn_ip_tcp(动态TCP口)
|
DCE/MS RPC--+-- ncadg_ip_udp(动态UDP口)
|
+-- ncacn_np(固定的139、445/TCP口)
|
+-- ... ...(其它协议序列)
可以将DCE/MS RPC看作一层，这一层可以在不同的协议序列上跑，比如上面列出的三
种。实际上还有其它协议序列可用，但不常见，这里就不罗嗦了。
ncacn_ip_tcp与ncadg_ip_udp用到了动态端口，它们会向EPM接口注册所用动态端口，
而客户端可以向EPM接口查询服务端注册过的信息。如果客户端有其它手段提前知道
服务端所用动态端口，就可以省去向EPM接口查询的操作。
一般碰上的是版本5的RPC，ncacn_ip_tcp、ncacn_np等用的就是V5。而ncadg_ip_udp
用的则是版本4的RPC。V4与V5的差别很大。你在现实环境中很难观察到V4。历史上某
些版本的net send命令会用到V4，MS02-045/Q326830补丁取消了Messenger服务绑定
的ncadg_ip_udp协议序列，现在更难在现实环境中观察到V4了。
EPM接口本身是一个RPC服务，同样有多种协议序列可用来访问这个接口。
ncacn_np协议序列用到了SMB协议，DCE/MS RPC层位于SMB层上，SMB层再位于TCP层上。
有些文字会介绍说139/TCP口的通信是SMB层位于NBT层上，NBT层位于TCP层上。这一
点对于旁路协议分析来讲，没有必要区分，可以将NBT层那四字节划入SMB层。再简单
点说，旁路协议分析时，可以认为139、445/TCP仅仅是端口不同，没有其它区别。
SMB协议可以由多种命令来承载DCE/MS RPC层数据，同样是139、445/TCP上的通信，
因不同的SMB命令而导致不同的SMB层解码。
无论用哪种协议序列，用哪种SMB命令，访问一个RPC接口的典型步骤是:
a) Bind
b) Request
不同的协议序列、不同SMB命令就对应不同的Bind Over ...、Request Over ...。
分层解码后到了DCE/MS RPC这一层，就都一样了。
做DCE/MS RPC协议分析时，首先就应该关注Bind操作。
--------- --------- -------------- -------
动态TCP口 动态UDP口 139、445/TCP口 ... ...
----+---- ----+---- --------+----- ----+--
| | | |
| | ----+---- ----+--
| | SMB层解码 ... ...
| | ----+---- ----+--
| | | |
+-----------+--------+------+-----------+
|
-----+----------
DCE/MS RPC层解码
-----+----------
|
----------+--------------
RPC层各命令相关的首部解码
----------+--------------
|
+--------+--------+-----+-+------------+---------+--------+
| | | | | | |
-+-- --+-- ---+--- ---+---- ----+--- --+-- ---+---
Bind Fault Request Response Bind_ack AUTH3 ... ...
---- ----- ---+--- ---+---- -------- ----- -------
| |
+-----+-+
|
+-------+-+-----+-------+
| | | |
---+--- ---+--- ---+--- ---+---
Opnum 0 Opnum 1 ... ... Opnum N
---+--- ---+--- ---+--- ---+---
| | | |
+-------+---+---+-------+
|
-----+-------
stub data解码
-------------
在用Ethereal研究DCE/MS RPC协议时，经常看到所谓的stub data，这实际是RPC解码
关键所在。对于这些stub data的解码是IDL文件相关的，不同的IDL文件对应不同的
stub data解码。不同的RPC服务都有着各自不同的IDL文件，因此对stub data的解码
只能是具体问题具体分析，没有捷径可走。
☆ BIND操作简介
1) "BIND Over TCP"简介
一个最简单、常见的Bind_ack报文的例子如下(SMB_37_0.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 4166 (4166), Dst Port: 135 (135), Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: e1af8308-5d1f-11c9-91a4-08002b14a0fa
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0b 03 10 00 00 00 48 00 ........H.
0040 00 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 ................
0050 00 00 00 00 01 00 08 83 af e1 1f 5d c9 11 91 a4 ...........]....
0060 08 00 2b 14 a0 fa 03 00 00 00 04 5d 88 8a eb 1c ..+........]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
Transmission Control Protocol, Src Port: 135 (135), Dst Port: 4166 (4166), Len: 60
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00012bee
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0c 03 10 00 00 00 3c 00 ........<.
0040 00 00 01 00 00 00 d0 16 d0 16 ee 2b 01 00 04 00 ...........+....
0050 31 33 35 00 00 00 01 00 00 00 00 00 00 00 04 5d 135............]
0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
0070 00 00 ..
--------------------------------------------------------------------------
试图绑定DCE/MS RPC Endpoint Mapper Interface UUID时引发上述报文。
Auth Length一般情况下为0，但并非总为0。关于这个字段，参看MSDN中如下函数:
RpcServerRegisterAuthInfo
RpcBindingInqAuthClient
RpcBindingSetAuthInfo
Auth Length为0的情况下，Bind(11)报文的RPC层大小固定为72。
Bind_ack(12)报文的RPC层大小变动较大，一是受Auth Length的影响，二是受Scndry
Addr的影响，Scndry Addr后面的Num results要求对齐在四字节边界上。当Scndry
Addr对应字符串表示的端口号时，Scndry Addr len最大等于6，即"65535"所占字节
数，包括结尾的NUL字符。由于Num results四字节对齐的缘故，"65535"不会比"135"
多占任何字节，因此当Scndry Addr对应字符串表示的端口号时，Auth Length为0的
情况下，Bind_ack(12)报文的RPC层大小固定为60。这种情形很常见，ncacn_ip_tcp
协议序列对应的BIND操作多半是这种情形，换句话说，BIND Over TCP多半是这种情
形。但是，ncacn_np协议序列对应的BIND操作就不是这种情形。
收到Bind_ack(12)报文并不意味着BIND操作成功，要检查Ack result字段:
0 Acceptance
2 Provider rejection
应该还有其它值，但那不重要。解析Bind_ack报文时，务必判断Ack result字段是否
等于Acceptance(0)，此时意味着BIND操作成功。以前一直以为收到Bind_nak(13)报
文才意味着BIND操作失败，不想近日做实验时意外地发现结论错误。
一个解码陷阱源于Ack result在Scndry Addr之后。ncacn_ip_tcp协议序列下Ack
result在RPC层的偏移可以认为是固定的+0x024，ncacn_np协议序列下这个偏移就变
了。可移植的解决方案是无论哪种协议序列，先取Scndry Addr len，再考虑四字节
对齐的事，动态计算Ack result的偏移。这个方案不受Auth Length的影响，认证相
关的数据位于尾部。另一个方案是先获取Auth Length，并确保收到的是完整的非畸
型的Bind_ack报文，然后从尾部倒推偏移-Auth Length-0x018。这个方案并不比前一
个方案更有优势，看个人喜好了。为此修正了一批早期编写的代码。
下面是一个Provider rejection(2)的例子(SMB_37_1.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 60367 (60367), Dst Port: 135 (135), Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: ffffffff-ffff-ffff-ffff-ffffffffffff
Interface Ver: 0
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 05 00 0b 03 10 00 00 00 48 00 00 00 01 00 ........H.....
0050 00 00 b8 10 b8 10 00 00 00 00 01 00 00 00 00 00 ................
0060 01 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0070 ff ff 00 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 .......]........
0080 08 00 2b 10 48 60 02 00 00 00 ..+.H`....
Transmission Control Protocol, Src Port: 135 (135), Dst Port: 60367 (60367), Len: 60
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00012bf6
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Ack result: Provider rejection (2)
Ack reason: Abstract syntax not supported (1)
Transfer Syntax: 00000000-0000-0000-0000-000000000000
Syntax ver: 0
0040 05 00 0c 03 10 00 00 00 3c 00 00 00 01 00 ........<.....
0050 00 00 b8 10 b8 10 f6 2b 01 00 04 00 31 33 35 00 .......+....135.
0060 00 00 01 00 00 00 02 00 01 00 00 00 00 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
--------------------------------------------------------------------------
此次Ack result等于Provider rejection(2)时，Ack reason字段开始有意义，另一
明显变化是Transfer Syntax字段。
Bind_ack(12)报文的RPC层大小与协议序列有关，但与Ack result、Ack reason字段
无关，这是两个短整型，始终占去4字节。因此上述Bind_ack(12)报文的RPC层大小仍
等于60。
向135/TCP发送Bind报文试图绑定不存在的接口UUID，就引发出如上Bind_ack报文。
这是一次实验意外出错后的结果，现实环境中这样的报文相当罕见，折腾DCE/MS RPC
这么久，还是第一次看到，为此修正了一批早期编写的代码。
2) "BIND Over Transaction"简介
当Bind(11)由SMB命令Trans(0x25)承载时，即"BIND Over Transaction"。
这是枚举Windows 2000共享时抓取的报文(SMB_37_2.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 52635 (52635), Dst Port: 139 (139), Len: 160
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
.... ...0 = Add 0 to length
Length: 156
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: Trans (0x25)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x08
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 23643
User ID: 2048
Multiplex ID: 63744
Trans Request (0x25)
Word Count (WCT): 16
Total Parameter Count: 0
Total Data Count: 72
Max Parameter Count: 0
Max Data Count: 1024
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 0
Parameter Offset: 84
Data Count: 72
Data Offset: 84
Setup Count: 2
Reserved: 00
Byte Count (BCC): 89
Transaction Name: /PIPE/
Padding: 0000
SMB Pipe Protocol
Function: TransactNmPipe (0x0026)
FID: 0x4000
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 9c ff 53 4d 42 25 00 00 00 00 08 .....SMB%.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 5b 5c 00 08 00 f9 10 00 00 48 00 00 00 00 04 00 [/.......H......
0070 00 00 00 00 00 00 00 00 00 00 00 54 00 48 00 54 ...........T.H.T
0080 00 02 00 26 00 00 40 59 00 00 5c 00 50 00 49 00 ...&..@Y../.P.I.
0090 50 00 45 00 5c 00 00 00 00 00 05 00 0b 03 10 00 P.E./...........
00a0 00 00 48 00 00 00 01 00 00 00 b8 10 b8 10 00 00 ..H.............
00b0 00 00 01 00 00 00 00 00 01 00 c8 4f 32 4b 70 16 ...........O2Kp.
00c0 d3 01 12 78 5a 47 bf 6e e1 88 03 00 00 00 04 5d ...xZG.n.......]
00d0 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
00e0 00 00 ..
--------------------------------------------------------------------------
SMB Command字段表明此次RPC通信由Transaction承载。RPC层的Bind(11)报文仍占72
字节。本例与"BIND Over Tcp"的情形相比，一是RPC层的承载者由TCP变成了SMB，二
是接口UUID变了，除此之外，并无区别。微软很好地实现了协议分层处理。
Bind(11)报文对于DCE/MS RPC协议分析来讲，至关重要，直接体现在暴露了接口UUID。
在Google中搜索"4b324fc8-1670-01d3-1278-5a47bf6ee188"，重点推荐:
Well-known DCE RPC named pipes endpoints
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s05s03.html[/url]
这里有一张表"Named pipes used by DCE RPC servers"，列举了部分接口UUID对应
的服务或进程，协议分析爱好者可以参看。
接口UUID即上述显示中的Interface UUID字段，不要与Transfer Syntax字段混淆了。
分析DCE/MS RPC通信时，没有接口UUID寸步难行。后续的Request(0)报文中的Opnum
是接口UUID相关的，A接口的0号调用与B接口的0号调用显然是两个独立的调用。有时
会碰上求助者提供了CAP文件，居然只有Request(0)报文，没有Bind(11)报文，分析
者将很难进行有效分析。
那么怎么针对接口UUID设置过滤规则呢？先要搞清楚层次关系，我们可能碰上不同的
承载，就目前举例来讲，已经出现了TCP、SMB两种。
"BIND Over Tcp"对应协议序列ncacn_ip_tcp，目标端口理论上可以是任意TCP端口。
在设置端口过滤时，只能是具体问题具体分析，后面会单独讲这个问题。抛开端口不
谈，Interface UUID字段在TCP数据区(注意我的用词)的偏移是固定的+0x020，由于
UUID大小固定，后面版本字段在TCP数据区的偏移也是固定的。真正设置过滤规则时，
还可以对Version、Packet type、Transfer Syntax字段进行过滤，减少误报。
前面提到了"在TCP数据区的偏移"，意味着我假设手头的工具可以正确定位TCP数据区，
即剥掉IP首部、TCP首部之后的TCP数据区。你不能简单地从IP首部+40，要考虑可能
出现的IP选项、TCP选项。从协议分层的理念来讲，定位在TCP数据区的偏移也是合理
的。
"BIND Over Transaction"对应协议序列ncacn_np，目标端口理论上只有两个，139与
445/TCP，很容易设置端口过滤。一般必须同时观察这两个端口上的通信过程。A时刻
抓取的报文可能用了139/TCP，B时刻抓取的报文可能用了445/TCP。这不是RPC层的问
题，而是SMB层的问题。SMB层的实现最早只用到139/TCP，后来增加了445/TCP，微软
保持向后兼容性，宏观上139与445是竞争关系。抛开端口不谈，Interface UUID字段
在RPC层(注意我的用词)的偏移是固定的+0x020，由于UUID大小固定，后面版本字段
在RPC层的偏移也是固定的。真正设置过滤规则时，还可以对Version、Packet type、
Transfer Syntax字段进行过滤，减少误报。
前面提到了"在RPC层的偏移"，意味着我假设手头的工具可以正确定位RPC层。剥掉IP
首部、TCP首部可能好理解也好操作，大家都熟了，剥掉SMB层可能不太熟。看前面显
示的Data Offset字段，字段值加上4即RPC层在TCP数据区的偏移，SMB层就这样简单
地被剥掉了。别高兴得太早，Data Offset字段本身在TCP数据区的偏移是随SMB命令
而改变的，就Trans(0x25)而言，偏移是61。有人要问了，我先过滤出Trans(0x25)，
再直接假设RPC层在TCP数据区的偏移是+0x058，不就得了。嘿，这是有问题的。注意
看上面显示中的Padding字段，该字段的长度与值不固定！可能你抓了1000次包，都
没看到Padding字段的长度有变化，但第1001次你敢保证仍不变吗？事实上我最初写
代码时就是这样假设的，结果后来针对不同OS测试时意外出错，调试了半天才得到现
在的结论。
写程序时可以精确过滤并定位各个偏移，用协议分析工具时就得变通一下了。先过滤
先过滤出Trans(0x25)，再直接假设RPC层在TCP数据区的偏移是+0x058，进而针对RPC
层各字段进行过滤。因为Padding字段长度有变毕竟是极少数事件，万一哪天你细心
地碰上了，可以针对性地增加另一类过滤，然后逻辑或一下。
下面是前述Bind(11)报文的响应报文:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 139 (139), Dst Port: 52635 (52635), Len: 128
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
.... ...0 = Add 0 to length
Length: 124
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000545000 seconds
SMB Command: Trans (0x25)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x88
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 23643
User ID: 2048
Multiplex ID: 63744
Trans Response (0x25)
Word Count (WCT): 10
Total Parameter Count: 0
Total Data Count: 68
Reserved: 0000
Parameter Count: 0
Parameter Offset: 56
Parameter Displacement: 0
Data Count: 68
Data Offset: 56
Data Displacement: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 69
Padding: 00
SMB Pipe Protocol
Function: TransactNmPipe (0x0026)
FID: 0x4000
DCE RPC Bind_ack, Fragment: Single, FragLen: 68, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 68
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00011135
Scndry Addr len: 13
Scndry Addr: /PIPE/ntsvcs
Num results: 1
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 7c ff 53 4d 42 25 00 00 00 00 88 ...|.SMB%.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 5b 5c 00 08 00 f9 0a 00 00 44 00 00 00 00 00 38 [/.......D.....8
0070 00 00 00 44 00 38 00 00 00 00 00 45 00 00 05 00 ...D.8.....E....
0080 0c 03 10 00 00 00 44 00 00 00 01 00 00 00 b8 10 ......D.........
0090 b8 10 35 11 01 00 0d 00 5c 50 49 50 45 5c 6e 74 ..5...../PIPE/nt
00a0 73 76 63 73 00 00 01 00 00 00 00 00 00 00 04 5d svcs...........]
00b0 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
00c0 00 00 ..
--------------------------------------------------------------------------
协议序列为ncacn_np时，Scndry Addr len、Scndry Addr字段明显有变，以至RPC层
大小不再是60，但你也不能说它固定是68，显然因Scndry Addr的内容而变。要小心
获取Ack result字段在RPC层的偏移。
分析响应报文时同样需要正确定位RPC层。这次Data Offset字段本身在TCP数据区的
偏移是51(不再是61)，该字段的值加4后即RPC层在TCP数据区的偏移。
用协议分析工具时可以先过滤出Trans(0x25)，再直接假设RPC层在TCP数据区的偏移
是+0x03C，进而针对RPC层各字段进行过滤。
SMB_37_3.cap的显示就不文本化了，与SMB_37_1.cap类似。发送Bind报文试图绑定不
存在的接口UUID，引发Provider rejection(2)报文。区别在于承载者由TCP变成SMB，
其它分析不变。这个包不可能在身边的环境中抓到，我用程序发出来的，提供在此仅
用于研究，大家自己打开了看。
3) "BIND Over Write AndX"简介
当Bind(11)由SMB命令Write AndX(0x2f)承载时，即"BIND Over Write AndX"。
可以简单地将Transaction理解成Write/Read的合成命令，区别在于前者处理小数据
量的通信，后者处理大数据量的通信。至于多少算小多少算大，你我都不必关心细节。
它们之间的关系远非如此简单，与本文关系不大，不纠缠了。
前面说过，SMB层的实现同时用到了139、445/TCP，二者之间是竞争关系。此次出于
演示目的，我用程序手工发送报文，指定使用445/TCP。下面是一次枚举共享操作中
出现的报文(SMB_37_4.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 37665 (37665), Dst Port: 445 (445), Len: 140
NetBIOS Session Service
Message Type: Session message
Length: 136
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x08
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 38271
User ID: 2048
Multiplex ID: 25139
Write AndX Request (0x2f)
Word Count (WCT): 14
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Offset: 0
Reserved: FFFFFFFF
Write Mode: 0x0008
.... .... .... 1... = Message Start: This is the START of a MESSAGE (pipe)
.... .... .... .0.. = Write Raw: DON'T use WriteRawNamedPipe (pipe)
.... .... .... ..0. = Return Remaining: DON'T return remaining (pipe/dev)
.... .... .... ...0 = Write Through: Write through not requested
Remaining: 72
Data Length High (multiply with 64K): 0
Data Length Low: 72
Data Offset: 64
High Offset: 0
Byte Count (BCC): 73
Padding: 00
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 88 ff 53 4d 42 2f 00 00 00 00 08 .....SMB/.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 7f 95 00 08 33 62 0e ff 00 00 00 00 40 00 00 00 ....3b......@...
0070 00 ff ff ff ff 08 00 48 00 00 00 48 00 40 00 00 .......H...H.@..
0080 00 00 00 49 00 00 05 00 0b 03 10 00 00 00 48 00 ...I..........H.
0090 00 00 01 00 00 00 b8 10 b8 10 00 00 00 00 01 00 ................
00a0 00 00 00 00 01 00 c8 4f 32 4b 70 16 d3 01 12 78 .......O2Kp....x
00b0 5a 47 bf 6e e1 88 03 00 00 00 04 5d 88 8a eb 1c ZG.n.......]....
00c0 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
Transmission Control Protocol, Src Port: 445 (445), Dst Port: 37665 (37665), Len: 51
NetBIOS Session Service
Message Type: Session message
Length: 47
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000601000 seconds
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x88
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 38271
User ID: 2048
Multiplex ID: 25139
Write AndX Response (0x2f)
Word Count (WCT): 6
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 47
FID: 0x4000
Count Low: 72
Remaining: 65535
Count High (multiply with 64K): 0
Reserved: 0000
Byte Count (BCC): 0
0040 00 00 00 2f ff 53 4d 42 2f 00 00 00 00 88 .../.SMB/.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 7f 95 00 08 33 62 06 ff 00 2f 00 48 00 ff ff 00 ....3b.../.H....
0070 00 00 00 00 00 .....
--------------------------------------------------------------------------
对于139/TCP来说，TCP数据区前4字节算是NBT层的。对于445/TCP来说，TCP数据区前
4字节不算是NBT层的，直接交给SMB层的代码处理了，但在旁路解码处理时，不必关
心这些细节，方便起见，仍称这4字节为NBT层数据。
对比SMB_37_2.cap与SMB_37_4.cap中NBT层的解码，后者已经没有了Flags字段，而
Length字段由17-bits扩展到24-bits。
Write AndX(0x2f)承载的RPC层仍占72字节，与前面两小节相比没有任何区别，作为
承载者的SMB层本身却发生重大变化。SMB Command变成Write AndX(0x2f)，对SMB层
的解码也就变了，Data Offset字段本身在TCP数据区的偏移变成59。Data Length等
于72，正好是RPC层的大小，RPC层是做为SMB层数据区出现的！
至此已经很清晰地感受到协议分层处理这个事实。在讨论DCE/MS RPC时，应将SMB层
看作与TCP层一样的传输层，RPC层可以在这些传输层中选择一个作为承载者。至于传
输层内部如何实现，不关RPC层的事。
用协议分析工具时可以先过滤出Write AndX(0x2f)，再直接假设RPC层在TCP数据区的
偏移是+0x044，进而针对RPC层各字段进行过滤。
与前面两小节相比，另一个重要变化是Bind_ack(12)报文并未随Write AndX(0x2f)的
响应报文出现，此时必须显式调用Read AndX(0x2e)读取Bind_ack(12):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 37665 (37665), Dst Port: 445 (445), Len: 63
NetBIOS Session Service
Message Type: Session message
Length: 59
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 4
SMB Command: Read AndX (0x2e)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x08
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 39203
User ID: 2048
Multiplex ID: 46171
Read AndX Request (0x2e)
Word Count (WCT): 12
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Offset: 0
Max Count Low: 32767
Min Count: 32767
Remaining: 32767
High Offset: 0
Byte Count (BCC): 0
0040 00 00 00 3b ff 53 4d 42 2e 00 00 00 00 08 ...;.SMB......
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 23 99 00 08 5b b4 0c ff 00 00 00 00 40 00 00 00 #...[.......@...
0070 00 ff 7f ff 7f ff ff ff ff ff 7f 00 00 00 00 00 ................
0080 00 .
Transmission Control Protocol, Src Port: 445 (445), Dst Port: 37665 (37665), Len: 132
NetBIOS Session Service
Message Type: Session message
Length: 128
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 3
Time from request: 0.000471000 seconds
SMB Command: Read AndX (0x2e)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x88
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 39203
User ID: 2048
Multiplex ID: 46171
Read AndX Response (0x2e)
Word Count (WCT): 12
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Remaining: 0
Data Compaction Mode: 0
Reserved: 0000
Data Length Low: 68
Data Offset: 60
Data Length High (multiply with 64K): 0
Reserved: 000000000000
Byte Count (BCC): 69
Padding: 00
DCE RPC Bind_ack, Fragment: Single, FragLen: 68, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 68
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00024b67
Scndry Addr len: 13
Scndry Addr: /PIPE/ntsvcs
Num results: 1
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 80 ff 53 4d 42 2e 00 00 00 00 88 .....SMB......
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 23 99 00 08 5b b4 0c ff 00 00 00 00 00 00 00 00 #...[...........
0070 00 44 00 3c 00 00 00 00 00 00 00 00 00 00 00 45 .D.<...........E
0080 00 00 05 00 0c 03 10 00 00 00 44 00 00 00 01 00 ..........D.....
0090 00 00 b8 10 b8 10 67 4b 02 00 0d 00 5c 50 49 50 ......gK..../PIP
00a0 45 5c 6e 74 73 76 63 73 00 00 01 00 00 00 00 00 E/ntsvcs........
00b0 00 00 04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 ...]..........+.
00c0 48 60 02 00 00 00 H`....
--------------------------------------------------------------------------
Bind_ack(12)报文随Read AndX(0x2e)的响应报文出现。Data Offset字段本身在TCP
数据区的偏移是49。
用协议分析工具时可以先过滤出Read AndX(0x2e)，再直接假设RPC层在TCP数据区的
偏移是+0x040，进而针对RPC层各字段进行过滤。重复提醒，Padding字段长度不固定，
偏移+0x040只是权宜之计，如能动态根据Data Offset字段的值计算偏移最好不过。
前两小节的BIND操作只涉及一来一回两个报文，本小节的BIND操作却涉及四个报文，
麻烦了许多。一般"BIND Over Transaction"都能安全替代"BIND Over Write AndX"，
自己写程序实现BIND操作时不必选用后者。但是在协议分析过程中，却有可能同时碰
上二者。
扯远一点。当出现一些DCE/MS RPC类蠕虫时，会有公司或个人提供一些定制后的过滤
规则。从我们前期的短小分析来看，这些过滤规则面临一些难题，或者说因协议分析
工具自身能力不足带来的难题。一是动态端口，这个现在仍不急着讲。二是从协议层
次上精确定位RPC层，我不清楚现有工具中哪个可以识别了SMB Command之后动态定位
Data Offset字段本身在TCP数据区的偏移，动态根据Data Offset字段的值计算RPC层
在TCP数据区的偏移，同时以这个偏移为基准定位其它RPC层的协议字段。更多时候这
些公开发布的过滤规则就像我前面介绍的那样，做了一些重大假设，比如填充域长度
固定，只考虑"BIND Over Write AndX"，不考虑"BIND Over Transaction"等等。针对
蠕虫的某一特定实例，做这样的重大假设是可以的，其作者不太可能变态到同时实现
了两种BIND操作，随机挑着用。但我今天这么公开提到了，难说下次蠕虫作者不这样
干。真要出现这样的局面，只好设置多套过滤，逻辑或一下。总有人抱怨过滤规则不
工作，那是因为出现了蠕虫变种、Exploit变种等等，违背了原过滤规则所做的重大
假设。这时应抓取样本报文，自行设置过滤规则。话说回来，协议分析工具做这种事
确实太勉为其难了，交互式分析工具严重依赖于人的参与，这也导致NIDS、NIPS必然
出场。NIDS、NIPS是程序实现的解码分析，灵活得多。
协议分析工具、NIDS、NIPS的相同点是都要做协议分层解码，都要逐层剥离，一旦中
间某层解码失败，作为负载出现的后续层次都将解码失败。DCE/MS RPC由SMB承载时，
首先要对SMB层进行解码才好继续进行后续分析。Ethereal是目前我所用过的协议分
析工具中对SMB层解码最深入的一个，推荐使用。而Samba是目前我所见过的对SMB层
Hacking最深的开源项目，远比Ethereal深入，甚至可以说不在一个层次。即使现在
部份Windows源码泄露，也还是值得研读Samba源码。
协议分层越多，解码越麻烦，也越容易忽略许多例外情形。换句话说，很多工具、程
序只考虑到最常见的情形，多多少少、有意无意做了一些假设，当例外情形出现违背
了这些假设，问题就来了。Ethereal对SMB层解码太深，历史上出现过的问题就很多，
我敢打赌，到现在还有问题。至于Samba么，一样的，在Samba项目的历史上出现过很
多现在也鲜为人知的趣事，这群天才们从无到有Hacking SMB，那还是Windows的早期，
Samba与Windows通信时搞出个BSOD实在是太普通了。要是搁在现在，不成了大漏洞、
大新闻么。当时的环境、氛围与现在太不同，最终多半是安静地通知微软并协助修补
了事。有个叫Luke Kenneth Casson Leighton的人，此人是半路加盟Samba Team的，
也算是天才，很强悍，后来因个人理念冲突与Samba Team分道扬镳，再后来加入ISS
的XForce小组继续从事SMB协议分析。他写过一本书:
<>
99年出的。因为Ethereal已经得到相当程度的加强，这书搁到现在算不上稀世奇珍了，
但仍可从中找到一些Ethereal至今未做解码的内容，Samba早在99年之前就解码了！
他在该书中提到一件事，NT 4 SP4之前有一个与Auth Length字段相关的BUG，微软成
功地在保持了向后兼容性的前提下修正了BUG，作者称之为"quite a feat"。在该书
中看到多处历史上悄悄修补过的SMB层BUG，叹息啊，没赶上好时光，也没那群天才们
的实力，同时相当佩服微软保持向后兼容性的强悍。
其它协议分析工具对SMB层解码相比Ethereal就太浅了，但同时也少了很多麻烦，比
如Iris这个小不点，当成玩具就可以了，不会擦枪走火的。不要迷信商业版协议分析
软件，一样的，解码越深死得越快，不解码或只简单解码活下来的机会更大。snort、
tcpdump死得不比Ethereal少。ISS的商业版NIDS很强，对SMB层的解码分析能力是我
接触过的同型产品中最强的一个，没办法，人家的XForce小组中就有好几个前Samba
Team的人。但这同时意味着解码风险增加，已经出过几次问题了。想像一下，假设我
知道某竞争对手的产品对SMB层解码很强，就针对性地制造畸型SMB报文，会如何。不
过放心啦，国内的NIDS、NIPS没这水平，想搞它们都没机会。这事有点讽刺，就跟傻
也是一种幸福一样。
SMB_37_5.cap与SMB_37_3.cap类似。发送Bind报文试图绑定不存在的接口UUID，引发
Provider rejection(2)报文。承载者都是SMB，但这次是"BIND Over Write AndX"。
同样这个包不可能在身边的环境中抓到，我用程序发出来的，提供在此仅用于研究。
这一节只起对比作用，结果由技术文章写成八卦话题了，就当灌水吧。
4) "BIND Over ..."扩展
怀疑另外两个SMB命令NT Trans(0xa0)、Trans2(0x32)也可以承载Bind(11)，虽然我
在现实环境中尚未抓包观察到，最近也没时间写程序测试，记录于此，仅作备忘。
对此有两份文档([3]、[4])可供参考:
<>
3.2 NT Transact SMB
4.5.1 NT Transact
<>
2.9.4 Transaction SMBs
这三种Transaction命令的差别相当小。如果我写恶意程序，一定会尝试另两种Trans
命令，尽可能地规避IDS嘛。
5) SMB_COM_TRANSACTION2与SMB_COM_NT_TRANSACTION
在上一小节我提到这两个命令，并且怀疑它们亦可用于承载Bind(11)。拖了些日子，
昨天翻看draft-leach-cifs-v1-spec-02.txt([11])，发现原来的简单想象有问题。
参看如下小节:
3.13.1 SMB_COM_TRANSACTION and SMB_COM_TRANSACTION2 Formats
6.2 SMB_COM_TRANSACTION2 Subcommand codes
3.13.2 SMB_COM_NT_TRANSACTION Formats
6.3 SMB_COM_NT_TRANSACTION Subcommand Codes
4.6.1 NT_TRANSACT_IOCTL
SMB_COM_TRANSACTION2(0x32)请求包的格式与SMB_COM_TRANSACTION(0x25)非常像，
但是这次Setup Count由2变成了1。原来的Setup[]对应:
Setup[0] Function: TransactNmPipe (0x0026)
Setup[1] FID: 0x4000
现在的Setup[]对应:
Setup[0] Subcommand:
原来有"Transaction Name: /PIPE/"字段，现在没有这个字段。这实际意味着二者的
编码解码完全不同了，SMB_COM_TRANSACTION2的具体功能与Subcommand紧密相关，无
法承载抽象的Bind(11)。
在cmd中执行start ///，抓取SMB_37_6.cap:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 3268, Dst Port: 445, Len: 80
NetBIOS Session Service
Message Type: Session message
Length: 76
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: Trans2 (0x32)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2052
Process ID: 1576
User ID: 2049
Multiplex ID: 3584
Trans2 Request (0x32)
Word Count (WCT): 15
Total Parameter Count: 8
Total Data Count: 0
Max Parameter Count: 2
Max Data Count: 40
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 8
Parameter Offset: 68
Data Count: 0
Data Offset: 0
Setup Count: 1
Reserved: 00
Subcommand: QUERY_PATH_INFO (0x0005)
Byte Count (BCC): 11
Padding: 000000
QUERY_PATH_INFO Parameters
Level of Interest: Query File Basic Info (1004)
Reserved: 00000000
File Name:
0030 00 00 00 4c ff 53 4d 42 32 00 ...L.SMB2.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 04 08 28 06 01 08 00 0e 0f 08 00 00 00 02 ....(...........
0060 00 28 00 00 00 00 00 00 00 00 00 00 00 08 00 44 .(.............D
0070 00 00 00 00 00 01 00 05 00 0b 00 00 00 00 ec 03 ................
0080 00 00 00 00 00 00 ......
NetBIOS Session Service
Message Type: Session message
Length: 100
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000571000 seconds
SMB Command: Trans2 (0x32)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x98
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2052
Process ID: 1576
User ID: 2049
Multiplex ID: 3584
Trans2 Response (0x32)
Subcommand: QUERY_PATH_INFO (0x0005)
Word Count (WCT): 10
Total Parameter Count: 2
Total Data Count: 40
Reserved: 0000
Parameter Count: 2
Parameter Offset: 56
Parameter Displacement: 0
Data Count: 40
Data Offset: 60
Data Displacement: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 45
Padding: 00
QUERY_PATH_INFO Parameters
EA Error offset: 0
Padding: 0001
QUERY_PATH_INFO Data
Created: Jun 4, 2003 16:39:30.335908800
Last Access: Sep 12, 2003 13:15:38.276899200
Last Write: Aug 21, 2003 16:06:07.509022400
Change: Aug 22, 2003 10:04:31.689686400
File Attributes: 0x00000036
.0.. .... .... .... = Encrypted: This is NOT an encrypted file
..0. .... .... .... = Content Indexed: This file MAY be indexed by the content indexing service
...0 .... .... .... = Offline: This file is NOT offline
.... 0... .... .... = Compressed: This is NOT a compressed file
.... .0.. .... .... = Reparse Point: This file does NOT have an associated reparse point
.... ..0. .... .... = Sparse: This is NOT a sparse file
.... ...0 .... .... = Temporary: This is NOT a temporary file
.... .... 0... .... = Normal: This file has some attribute set
.... .... .0.. .... = Device: This is NOT a device
.... .... ..1. .... = Archive: This file has been modified since last ARCHIVE
.... .... ...1 .... = Directory: This is a DIRECTORY
.... .... .... 0... = Volume ID: This is NOT a volume ID
.... .... .... .1.. = System: This is a SYSTEM file
.... .... .... ..1. = Hidden: This is a HIDDEN file
.... .... .... ...0 = Read Only: This file is NOT read only
Unknown Data: 00000000
0030 00 00 00 64 ff 53 4d 42 32 00 ...d.SMB2.
0040 00 00 00 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 04 08 28 06 01 08 00 0e 0a 02 00 28 00 00 ....(........(..
0060 00 02 00 38 00 00 00 28 00 3c 00 00 00 00 00 2d ...8...(.<.....-
0070 00 00 00 00 00 01 70 8e c0 d0 74 2a c3 01 60 79 ......p...t*..`y
0080 2f e7 ec 78 c3 01 30 ed 31 13 bb 67 c3 01 60 5e /..x..0.1..g..`^
0090 e4 b9 51 68 c3 01 36 00 00 00 00 00 00 00 ..Qh..6.......
NetBIOS Session Service
Message Type: Session message
Length: 86
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans2 (0x32)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2052
Process ID: 1576
User ID: 2049
Multiplex ID: 3648
Trans2 Request (0x32)
Word Count (WCT): 15
Total Parameter Count: 18
Total Data Count: 0
Max Parameter Count: 10
Max Data Count: 16384
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 18
Parameter Offset: 68
Data Count: 0
Data Offset: 0
Setup Count: 1
Reserved: 00
Subcommand: FIND_FIRST2 (0x0001)
Byte Count (BCC): 21
Padding: 000000
FIND_FIRST2 Parameters
Search Attributes: 0x0016
.... .... .... ...0 = Read Only: Do NOT include read only files in search results
.... .... .... ..1. = Hidden: Include HIDDEN files in search results
.... .... .... .1.. = System: Include SYSTEM files in search results
.... .... .... 0... = Volume ID: Do NOT include volume IDs in search results
.... .... ...1 .... = Directory: Include DIRECTORIES in search results
.... .... ..0. .... = Archive: Do NOT include archive files in search results
Search Count: 1366
Flags: 0x0006
.... .... ...0 .... = Backup Intent: No backup intent
.... .... .... 0... = Continue: New search, do NOT continue from previous position
.... .... .... .1.. = Resume: Return RESUME keys
.... .... .... ..1. = Close on EOS: CLOSE search if END OF SEARCH is reached
.... .... .... ...0 = Close: Do NOT close search after this request
Level of Interest: Find File Both Directory Info (260)
Storage Type: 0
Search Pattern: /*
0030 00 00 00 56 ff 53 4d 42 32 00 ...V.SMB2.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 04 08 28 06 01 08 40 0e 0f 12 00 00 00 0a ....(...@.......
0060 00 00 40 00 00 00 00 00 00 00 00 00 00 12 00 44 [email protected]
0070 00 00 00 00 00 01 00 01 00 15 00 00 00 00 16 00 ................
0080 56 05 06 00 04 01 00 00 00 00 5c 00 2a 00 00 00 V........./.*...
--------------------------------------------------------------------------
我曾简单地将SMB_37_2.cap中请求包的SMB_COM_TRANSACTION(0x25)改成
SMB_COM_TRANSACTION2(0x32)发送出去，Ethereal解码时会显示:
Subcommand: Unkown (0x0026)
因为没有这个子命令嘛。响应包中会在SMB首部显示:
Error Class: Server Error (0x02)
Reserved: 00
Error Code: Non specific error code (0x0001)
显然服务端因无法识别有效子命令而报错。
SMB_COM_NT_TRANSACTION(0xA0)请求包的格式与前两种相差较大。其具体功能也是与
Subcommand紧密相关的，但这次子命令对应Function字段，而不是某个Setup[]元素。
Setup Count不再固定，而是随子命令变化，可能为0，可能为4，也可能为其它值。
比如子命令NT_TRANSACT_IOCTL(0x0002)对应的Setup Count为4，而
NT_TRANSACT_QUERY_SECURITY_DESC(0x0006)对应的Setup Count为0。我也没整明白
既然有Parameter区域，这里为什么要用Setup[]，没系统地看文档，可能有向后兼容
性方面的考虑吧。SMB_COM_NT_TRANSACTION(0xA0)无法承载抽象的Bind(11)。
至此彻底推翻了上一小节的猜想。不过也算有收获，学到点新东西。曾在跟踪漏洞
CVE-2003-0201、CVE-2005-0045、CVE-2005-1206时多次分析过这几类报文，但当时
的分析角度不同，可以结合当时写的文章深入理解:
<>
<>
<>
访问共享并查看文件属性的安全页时，会引发SMB_COM_NT_TRANSACTION(0xA0)报文，
抓取SMB_37_7.cap:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 3493, Dst Port: 445, Len: 88
NetBIOS Session Service
Message Type: Session message
Length: 84
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: NT Trans (0xa0)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28802
NT Trans Request (0xa0)
Word Count (WCT): 19
Max Setup Count: 0
Reserved: 0000
Total Parameter Count: 8
Total Data Count: 0
Max Parameter Count: 4
Max Data Count: 0
Parameter Count: 8
Parameter Offset: 76
Data Count: 0
Data Offset: 0
Setup Count: 0
Function: NT QUERY SECURITY DESC (6)
Byte Count (BCC): 11
Padding: 000000
NT QUERY SECURITY DESC Parameters
FID: 0x400d
Reserved: 0000
Security Information: 0x00000004
.... .... .... .... .... .... .... ...0 = Owner: NOT requesting owner security information
.... .... .... .... .... .... .... ..0. = Group: NOT requesting group security information
.... .... .... .... .... .... .... .1.. = DACL: Requesting DACL security information
.... .... .... .... .... .... .... 0... = SACL: NOT requesting SACL security information
0030 00 00 00 54 ff 53 4d 42 a0 00 ...T.SMB..
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 82 70 13 00 00 00 08 00 ....(....p......
0060 00 00 00 00 00 00 04 00 00 00 00 00 00 00 08 00 ................
0070 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 06 ..L.............
0080 00 0b 00 00 00 00 0d 40 00 00 04 00 00 00 .......@......
NetBIOS Session Service
Message Type: Session message
Length: 76
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000419000 seconds
SMB Command: NT Trans (0xa0)
NT Status: STATUS_BUFFER_TOO_SMALL (0xc0000023)
Flags: 0x98
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28802
NT Trans Response (0xa0)
Function: NT QUERY SECURITY DESC (6)
Word Count (WCT): 18
Reserved: 000000
Total Parameter Count: 4
Total Data Count: 0
Parameter Count: 4
Parameter Offset: 72
Parameter Displacement: 0
Data Count: 0
Data Offset: 76
Data Displacement: 0
Setup Count: 0
Byte Count (BCC): 5
Padding: 0B
NT QUERY SECURITY DESC Parameters
NT Security Descriptor Length: 48
0030 00 00 00 4c ff 53 4d 42 a0 23 ...L.SMB.#
0040 00 00 c0 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 82 70 12 00 00 00 04 00 ....(....p......
0060 00 00 00 00 00 00 04 00 00 00 48 00 00 00 00 00 ..........H.....
0070 00 00 00 00 00 00 4c 00 00 00 00 00 00 00 00 05 ......L.........
0080 00 0b 30 00 00 00 ..0...
NetBIOS Session Service
Message Type: Session message
Length: 84
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 4
SMB Command: NT Trans (0xa0)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28866
NT Trans Request (0xa0)
Word Count (WCT): 19
Max Setup Count: 0
Reserved: 0000
Total Parameter Count: 8
Total Data Count: 0
Max Parameter Count: 4
Max Data Count: 48
Parameter Count: 8
Parameter Offset: 76
Data Count: 0
Data Offset: 0
Setup Count: 0
Function: NT QUERY SECURITY DESC (6)
Byte Count (BCC): 11
Padding: 000000
NT QUERY SECURITY DESC Parameters
FID: 0x400d
Reserved: 0000
Security Information: 0x00000004
.... .... .... .... .... .... .... ...0 = Owner: NOT requesting owner security information
.... .... .... .... .... .... .... ..0. = Group: NOT requesting group security information
.... .... .... .... .... .... .... .1.. = DACL: Requesting DACL security information
.... .... .... .... .... .... .... 0... = SACL: NOT requesting SACL security information
0030 00 00 00 54 ff 53 4d 42 a0 00 ...T.SMB..
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 c2 70 13 00 00 00 08 00 ....(....p......
0060 00 00 00 00 00 00 04 00 00 00 30 00 00 00 08 00 ..........0.....
0070 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 06 ..L.............
0080 00 0b 00 00 00 00 0d 40 00 00 04 00 00 00 .......@......
NetBIOS Session Service
Message Type: Session message
Length: 124
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 3
Time from request: 0.000416000 seconds
SMB Command: NT Trans (0xa0)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x98
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28866
NT Trans Response (0xa0)
Function: NT QUERY SECURITY DESC (6)
Word Count (WCT): 18
Reserved: 000000
Total Parameter Count: 4
Total Data Count: 48
Parameter Count: 4
Parameter Offset: 72
Parameter Displacement: 0
Data Count: 48
Data Offset: 76
Data Displacement: 0
Setup Count: 0
Byte Count (BCC): 53
Padding: 0B
NT QUERY SECURITY DESC Parameters
NT Security Descriptor Length: 48
NT QUERY SECURITY DESC Data
NT Security Descriptor
Revision: 1
Type: 0x8004
1... .... .... .... = Self Relative: This SecDesc is SELF RELATIVE
.0.. .... .... .... = RM Control Valid: Rm control valid is FALSE
..0. .... .... .... = SACL Protected: The SACL is NOT protected
...0 .... .... .... = DACL Protected: The DACL is NOT protected
.... 0... .... .... = SACL Auto Inherited: SACL is NOT auto inherited
.... .0.. .... .... = DACL Auto Inherited: DACL is NOT auto inherited
.... ..0. .... .... = SACL Auto Inherit Required: SACL does NOT require auto inherit
.... ...0 .... .... = DACL Auto Inherit Required: DACL does NOT require auto inherit
.... .... 0... .... = Server Security: Server security is FALSE
.... .... .0.. .... = DACL Trusted: Dacl trusted is FALSE
.... .... ..0. .... = SACL Defaulted: SACL is NOT defaulted
.... .... ...0 .... = SACL Present: SACL is NOT present
.... .... .... 0... = DACL Defaulted: DACL is NOT defaulted
.... .... .... .1.. = DACL Present: DACL is PRESENT
.... .... .... ..0. = Group Defaulted: Group is NOT defaulted
.... .... .... ...0 = Owner Defaulted: Owner is NOT defaulted
Offset to owner SID: 0
Offset to group SID: 0
Offset to SACL: 0
Offset to DACL: 20
NT User (DACL) ACL
Revision: 2
Size: 28
Num ACEs: 1
NT ACE: S-1-1-0, flags 0x03, Access Allowed, mask 0x001f01ff
Type: Access Allowed (0)
NT ACE Flags: 0x03 Container Inherit, Object Inherit
0... .... = Audit Failed Accesses: Failed accesses will not be audited
.0.. .... = Audit Successful Accesses: Successful accesses will not be audited
...0 .... = Inherited ACE: This ACE was not inherited from its parent object
.... 0... = Inherit Only: This ACE applies to the current object
.... .0.. = Non-Propagate Inherit: Subordinate object will propagate the inherited ACE further
.... ..1. = Container Inherit: Subordinate containers will inherit this ACE
.... ...1 = Object Inherit: Subordinate files will inherit this ACE
Size: 20
Access required: 0x001f01ff
Generic rights: 0x00000000
0... .... .... .... .... .... .... .... = Generic read: Not set
.0.. .... .... .... .... .... .... .... = Generic write: Not set
..0. .... .... .... .... .... .... .... = Generic execute: Not set
...0 .... .... .... .... .... .... .... = Generic all: Not set
.... ..0. .... .... .... .... .... .... = Maximum allowed: Not set
.... .... 0... .... .... .... .... .... = Access SACL: Not set
Standard rights: 0x001f0000
.... .... ...1 .... .... .... .... .... = Synchronise: Set
.... .... .... 1... .... .... .... .... = Write owner: Set
.... .... .... .1.. .... .... .... .... = Write DAC: Set
.... .... .... ..1. .... .... .... .... = Read control: Set
.... .... .... ...1 .... .... .... .... = Delete: Set
Specific rights: 0x000001ff
.... .... .... .... 0... .... .... .... = Specific access, bit 15: Not set
.... .... .... .... .0.. .... .... .... = Specific access, bit 14: Not set
.... .... .... .... ..0. .... .... .... = Specific access, bit 13: Not set
.... .... .... .... ...0 .... .... .... = Specific access, bit 12: Not set
.... .... .... .... .... 0... .... .... = Specific access, bit 11: Not set
.... .... .... .... .... .0.. .... .... = Specific access, bit 10: Not set
.... .... .... .... .... ..0. .... .... = Specific access, bit 9: Not set
.... .... .... .... .... ...1 .... .... = Specific access, bit 8: Set
.... .... .... .... .... .... 1... .... = Specific access, bit 7: Set
.... .... .... .... .... .... .1.. .... = Specific access, bit 6: Set
.... .... .... .... .... .... ..1. .... = Specific access, bit 5: Set
.... .... .... .... .... .... ...1 .... = Specific access, bit 4: Set
.... .... .... .... .... .... .... 1... = Specific access, bit 3: Set
.... .... .... .... .... .... .... .1.. = Specific access, bit 2: Set
.... .... .... .... .... .... .... ..1. = Specific access, bit 1: Set
.... .... .... .... .... .... .... ...1 = Specific access, bit 0: Set
ACE: S-1-1-0
Revision: 1
Num Auth: 1
Authority: 1
Sub-authorities: 0
0030 00 00 00 7c ff 53 4d 42 a0 00 ...|.SMB..
0040 00 00 00 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 c2 70 12 00 00 00 04 00 ....(....p......
0060 00 00 30 00 00 00 04 00 00 00 48 00 00 00 00 00 ..0.......H.....
0070 00 00 30 00 00 00 4c 00 00 00 00 00 00 00 00 35 ..0...L........5
0080 00 0b 30 00 00 00 01 00 04 80 00 00 00 00 00 00 ..0.............
0090 00 00 00 00 00 00 14 00 00 00 02 00 1c 00 01 00 ................
00a0 00 00 00 03 14 00 ff 01 1f 00 01 01 00 00 00 00 ................
00b0 00 01 00 00 00 00 ......
--------------------------------------------------------------------------
☆ PFC_OBJECT_UUID标志位
一般来说，RPC层的Packet Flags字段等于0x03，如果PFC_OBJECT_UUID标志位置位，
RPC首部在常规24字节的尾部多出来16字节的UUID，换句话说，RPC首部变成40字节。
参看如下链接中对PFC_OBJECT_UUID的解释:
[url]http://www.opengroup.org/onlinepubs/9692999399/chap12.htm#tagcjh_17_06_03_01[/url]
[url]http://www.opengroup.org/onlinepubs/9692999399/chap12.htm#tagcjh_17_06_04_09[/url]
协议分析时要考虑PFC_OBJECT_UUID标志位。不要对Bind包做特殊处理。对Request包
要特殊处理。如果PFC_OBJECT_UUID标志位置位，Request包中必然包含有效接口UUID，
可以在单包中同时获取Opnum与接口UUID。
Ethereal 0.10.13可以正确解码PFC_OBJECT_UUID标志位置位的报文，而Sniffer Pro
4.70.564不能。
自己写程序对135/TCP口进行DUMP操作，下面是相应报文(SMB_37_8.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 43621, Dst Port: 135, Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x83
1... .... = Object: Set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: e1af8308-5d1f-11c9-91a4-08002b14a0fa
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 05 00 0b 83 10 00 00 00 48 00 00 00 01 00 ........H.....
0050 00 00 b8 10 b8 10 00 00 00 00 01 00 00 00 00 00 ................
0060 01 00 08 83 af e1 1f 5d c9 11 91 a4 08 00 2b 14 .......]......+.
0070 a0 fa 03 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 .......]........
0080 08 00 2b 10 48 60 02 00 00 00 ..+.H`....
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00011ddf
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 05 00 0c 03 10 00 00 00 3c 00 00 00 01 00 ........<.....
0050 00 00 b8 10 b8 10 df 1d 01 00 04 00 31 33 35 00 ............135.
0060 30 c2 01 00 00 00 00 00 00 00 04 5d 88 8a eb 1c 0..........]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
DCE RPC Request, Fragment: Single, FragLen: 80, Call: 1 Ctx: 0, [Resp: #4]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x83
1... .... = Object: Set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 80
Auth Length: 0
Call ID: 1
Alloc hint: 40
Context ID: 0
Opnum: 2
Object UUID: e1af8308-5d1f-11c9-91a4-08002b14a0fa
Response in frame: 4
DCE/RPC Endpoint Mapper, Lookup
Operation: Lookup (2)
Inquiry type: rpc_c_ep_all_elts (0)
(NULL pointer) Object:
(NULL pointer) Interface:
Version Option: 0
Handle: 0000000000000000000000000000000000000000
Max entries: 1
0040 05 00 00 83 10 00 00 00 50 00 00 00 01 00 ........P.....
0050 00 00 28 00 00 00 00 00 02 00 08 83 af e1 1f 5d ..(............]
0060 c9 11 91 a4 08 00 2b 14 a0 fa 00 00 00 00 00 00 ......+.........
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
0090 00 00 ..
DCE RPC Response, Fragment: Single, FragLen: 204, Call: 1 Ctx: 0, [Req: #3]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 204
Auth Length: 0
Call ID: 1
Alloc hint: 180
Context ID: 0
Cancel count: 0
Opnum: 2
Request in frame: 3
Time from request: 0.001162000 seconds
DCE/RPC Endpoint Mapper, Lookup
Operation: Lookup (2)
Handle: 000000003ED8635360C10A4DA82A977E3CEBC27F
Num entries: 1
Entries:
Max Count: 1
Offset: 0
Actual Count: 1
Entry:
Object: 00000000-0000-0000-0000-000000000000
Tower pointer:
Referent ID: 0x00000001
Length: 98
Length: 98
Number of floors: 5
Floor 1 UUID: bfa951d1-2f0e-11d3-bfd1-00c04fa3490a Version 1.0
LHS Length: 19
Protocol: UUID (0x0d)
UUID: bfa951d1-2f0e-11d3-bfd1-00c04fa3490a
Version 1.0
RHS Length: 2
not decoded yet
Floor 2 UUID: 8a885d04-1ceb-11c9-9fe8-08002b104860 Version 2.0
LHS Length: 19
Protocol: UUID (0x0d)
UUID: 8a885d04-1ceb-11c9-9fe8-08002b104860
Version 2.0
RHS Length: 2
not decoded yet
Floor 3 RPC connection-oriented protocol
LHS Length: 1
Protocol: RPC connection-oriented protocol (0x0b)
RHS Length: 2
Floor 4
LHS Length: 1
Protocol: Appletalk Stream (0x16)
RHS Length: 13
not decoded yet
Floor 5
LHS Length: 1
Protocol: Appletalk (0x18)
RHS Length: 16
not decoded yet
Annotation offset: 0
Annotation length: 1
Annotation:
Return code: 0x00000000
0040 05 00 02 03 10 00 00 00 cc 00 00 00 01 00 ..............
0050 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 3e d8 ..............>.
0060 63 53 60 c1 0a 4d a8 2a 97 7e 3c eb c2 7f 01 00 cS`..M.*.~<.....
0070 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
0090 00 00 00 00 00 00 01 00 00 00 00 00 00 00 62 00 ..............b.
00a0 00 00 62 00 00 00 05 00 13 00 0d d1 51 a9 bf 0e ..b.........Q...
00b0 2f d3 11 bf d1 00 c0 4f a3 49 0a 01 00 02 00 00 /......O.I......
00c0 00 13 00 0d 04 5d 88 8a eb 1c c9 11 9f e8 08 00 .....]..........
00d0 2b 10 48 60 02 00 02 00 00 00 01 00 0b 02 00 00 +.H`............
00e0 00 01 00 16 0d 00 44 79 6e 45 70 74 20 34 61 63 ......DynEpt 4ac
00f0 2e 31 00 01 00 18 10 00 4e 53 46 4f 43 55 53 2d .1......NSFOCUS-
0100 49 50 48 36 52 46 38 00 00 00 00 00 00 00 IPH6RF8.......
--------------------------------------------------------------------------
☆ MS02-045/Q326830
这个漏洞是02年8月22日在BugTraq邮件列表上被披露的。当时正是受这个漏洞影响，
决定系统整理一次SMB协议相关文档，才开始写这个系列的。
这是smbdie.exe([14])发送出来的攻击报文(SMB_37_9.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 4658, Dst Port: 139, Len: 99
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
.... ...0 = Add 0 to length
Length: 95
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
Error Class: Success (0x00)
Reserved: 00
Error Code: No Error
Flags: 0x00
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0x0000
0... .... .... .... = Unicode Strings: Strings are ASCII
.0.. .... .... .... = Error Code Type: Error codes are DOS error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...0 = Long Names Allowed: Long file names are not allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 1060
User ID: 2048
Multiplex ID: 0
Trans Request (0x25)
Word Count (WCT): 14
Total Parameter Count: 19
Total Data Count: 0
Max Parameter Count: 0
Max Data Count: 0
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 19
Parameter Offset: 76
Data Count: 0
Data Offset: 95
Setup Count: 0
Reserved: 00
Byte Count (BCC): 32
Transaction Name: /PIPE/LANMAN
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
Function Code: NetServerEnum2 (104)
Parameter Descriptor: WrLeh
Return Descriptor: B13BWz
Detail Level: 1
Receive Buffer Length: 65504
0030 00 00 00 5f ff 53 4d 42 25 00 ..._.SMB%.
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 24 04 00 08 00 00 0e 13 00 00 00 00 ....$...........
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 13 00 4c ...............L
0070 00 00 00 5f 00 00 00 20 00 5c 50 49 50 45 5c 4c ..._... ./PIPE/L
0080 41 4e 4d 41 4e 00 68 00 57 72 4c 65 68 00 42 31 ANMAN.h.WrLeh.B1
0090 33 42 57 7a 00 01 00 e0 ff 3BWz.....
--------------------------------------------------------------------------
这里Max Parameter Count、Max Data Count字段同时清零了，据CORE的报告不必同
时清零，是逻辑或的关系。vertex提供过一个针对Samba源码的patch，用于完成此攻
击，他也是将前述两个字段同时清零了。也就是说，公开发布的Exploit均将前述两
个字段同时清零。
攻击报文并不是在真实的NetServerEnum2()调用报文基础上修改而来。但是，攻击报
文仍完成了攻击。基于我们对SMB协议多年的跟踪分析，这个攻击报文是在
NetShareEnum()调用报文基础上修改而来，简单地将Function Code由0x0000换成
0x0068而得。
☆ WildPackets Free Filters for Detecting Malicious Worms/Viruses
在[url]www.netexpert.cn[/url]上有人贴了一个CAP文件，用WildPackets提供的Sasser Filter
([15])捕获到的部分报文，找人给分析一下，我就简单看了看，记录在此，备忘。
首先，他提供的CAP文件是高版本的，当时手头的台式机上没有装相应版本的软件，
好在有Ethereal 0.10.13，照看不误，因此下面的的某些字段，以Ethereal显示为例。
其次，这个Sasser Filter也是高版本的，直接用xml编写的，我没法在原软件中导入
过滤器并查看，只好用UltraEdit打开，当成文本看。
这样很可能绕了一个大弯，高版本软件本身应该带有文档介绍xml格式的过滤器吧，
笔记本又不在手边，不管了，硬看吧。如果做了无用功，也无所谓，此类分析本就要
做好这个思想准备。
Sasser Worm利用的是MS04-011/KB835732，关于漏洞本身不在此重复。参看:
<>
为完成攻击，肯定有一个针对"3919286a-b10c-11d0-9ba8-00c04fd92ef5 0.0"的BIND
操作。可以就此设计单包过滤器。这次是"BIND Over SMB"，不涉及动态RPC端口，目
标端口只可能是139/TCP或445/TCP。
漏洞对应的是9号调用lsasrv!DsRolerUpgradeDownlevelServer()，但客户端实现
netapi32!DsRoleUpgradeDownlevelServer()时不允许远程调用Opnum 9，只能向本机
请求调用Opnum 9，这意味着Opnum 9对应的报文正常情况下永远不会出现在网络上。
而蠕虫必然会发出Opnum 9对应的报文，可以就此设计另一个单包过滤器。
如果所用软件支持多包过滤器，应该设计多包过滤器，以减少误报。
那位同学提供的CAP文件全是误报，简化后有两类误报，见SMB_37_11.cap:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 4409, Dst Port: 445, Len: 1312
NetBIOS Session Service
Message Type: Session message
Length: 1308
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 432
User ID: 2048
Multiplex ID: 448
Trans Request (0x25)
Word Count (WCT): 16
Total Parameter Count: 0
Total Data Count: 1224
Max Parameter Count: 0
Max Data Count: 1024
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 0
Parameter Offset: 84
Data Count: 1224
Data Offset: 84
Setup Count: 2
Reserved: 00
Byte Count (BCC): 1241
Transaction Name: /PIPE/
Padding: 0000
SMB Pipe Protocol
Function: TransactNmPipe (0x0026)
FID: 0x4000
DCE RPC Request, Fragment: Single, FragLen: 1224, Call: 2 Ctx: 0
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 1224
Auth Length: 0
Call ID: 2
Alloc hint: 1200
Context ID: 0
Opnum: 8
Stub data (1200 bytes)
0030 00 00 05 1c ff 53 4d 42 25 00 .....SMB%.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 b0 01 00 08 c0 01 10 00 00 c8 04 00 ................
0060 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 c8 04 54 00 02 00 26 00 00 40 d9 04 00 5c 00 ...T...&..@.../.
0080 50 00 49 00 50 00 45 00 5c 00 00 00 00 00 05 00 P.I.P.E./.......
0090 00 03 10 00 00 00 c8 04 00 00 02 00 00 00 b0 04 ................
00a0 00 00 00 00 08 00 ......
[snip]
Transmission Control Protocol, Src Port: 1089, Dst Port: 445, Len: 158
NetBIOS Session Service
Message Type: Session message
Length: 154
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: NT Create AndX (0xa2)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 26625
Process ID: 304
User ID: 51201
Multiplex ID: 32704
NT Create AndX Request (0xa2)
Word Count (WCT): 24
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 57054
Reserved: 00
File Name Len: 68
Create Flags: 0x00000016
.... .... .... .... .... .... ...1 .... = Extended Response: Extended responses required
.... .... .... .... .... .... .... 0... = Create Directory: Target of open can be a file
.... .... .... .... .... .... .... .1.. = Batch Oplock: Requesting BATCH OPLOCK
.... .... .... .... .... .... .... ..1. = Exclusive Oplock: Requesting OPLOCK
Root FID: 0x00000000
Access Mask: 0x0002019f
0... .... .... .... .... .... .... .... = Generic Read: Generic read is NOT set
.0.. .... .... .... .... .... .... .... = Generic Write: Generic write is NOT set
..0. .... .... .... .... .... .... .... = Generic Execute: Generic execute is NOT set
...0 .... .... .... .... .... .... .... = Generic All: Generic all is NOT set
.... ..0. .... .... .... .... .... .... = Maximum Allowed: Maximum allowed is NOT set
.... ...0 .... .... .... .... .... .... = System Security: System security is NOT set
.... .... ...0 .... .... .... .... .... = Synchronize: Can NOT wait on handle to synchronize on completion of I/O
.... .... .... 0... .... .... .... .... = Write Owner: Can NOT write owner (take ownership)
.... .... .... .0.. .... .... .... .... = Write DAC: Owner may NOT write to the DAC
.... .... .... ..1. .... .... .... .... = Read Control: READ ACCESS to owner, group and ACL of the SID
.... .... .... ...0 .... .... .... .... = Delete: NO delete access
.... .... .... .... .... ...1 .... .... = Write Attributes: WRITE ATTRIBUTES access
.... .... .... .... .... .... 1... .... = Read Attributes: READ ATTRIBUTES access
.... .... .... .... .... .... .0.. .... = Delete Child: NO delete child access
.... .... .... .... .... .... ..0. .... = Execute: NO execute access
.... .... .... .... .... .... ...1 .... = Write EA: WRITE EXTENDED ATTRIBUTES access
.... .... .... .... .... .... .... 1... = Read EA: READ EXTENDED ATTRIBUTES access
.... .... .... .... .... .... .... .1.. = Append: APPEND access
.... .... .... .... .... .... .... ..1. = Write: WRITE access
.... .... .... .... .... .... .... ...1 = Read: READ access
Allocation Size: 0
File Attributes: 0x00000080
.... .... .... .... .0.. .... .... .... = Encrypted: This is NOT an encrypted file
.... .... .... .... ..0. .... .... .... = Content Indexed: This file MAY be indexed by the content indexing service
.... .... .... .... ...0 .... .... .... = Offline: This file is NOT offline
.... .... .... .... .... 0... .... .... = Compressed: This is NOT a compressed file
.... .... .... .... .... .0.. .... .... = Reparse Point: This file does NOT have an associated reparse point
.... .... .... .... .... ..0. .... .... = Sparse: This is NOT a sparse file
.... .... .... .... .... ...0 .... .... = Temporary: This is NOT a temporary file
.... .... .... .... .... .... 1... .... = Normal: This file is an ordinary file
.... .... .... .... .... .... .0.. .... = Device: This is NOT a device
.... .... .... .... .... .... ..0. .... = Archive: This file has NOT been modified since last archive
.... .... .... .... .... .... ...0 .... = Directory: This is NOT a directory
.... .... .... .... .... .... .... 0... = Volume ID: This is NOT a volume ID
.... .... .... .... .... .... .... .0.. = System: This is NOT a system file
.... .... .... .... .... .... .... ..0. = Hidden: This is NOT a hidden file
.... .... .... .... .... .... .... ...0 = Read Only: This file is NOT read only
Share Access: 0x00000003
.... .... .... .... .... .... .... .0.. = Delete: Object can NOT be shared for delete
.... .... .... .... .... .... .... ..1. = Write: Object can be shared for WRITE
.... .... .... .... .... .... .... ...1 = Read: Object can be shared for READ
Disposition: Create (if file exists fail, else create it) (2)
Create Options: 0x00000040
.... .... .... .... .... .... .... ...0 = Directory: File being created/opened must not be a directory
.... .... .... .... .... .... .... ..0. = Write Through: Writes need not flush buffered data before completing
.... .... .... .... .... .... .... .0.. = Sequential Only: The file might not only be accessed sequentially
.... .... .... .... .... .... ...0 .... = Sync I/O Alert: Operations NOT necessarily synchronous
.... .... .... .... .... .... ..0. .... = Sync I/O Nonalert: Operations NOT necessarily synchronous
.... .... .... .... .... .... .1.. .... = Non-Directory: File being created/opened must not be a directory
.... .... .... .... .... ..0. .... .... = No EA Knowledge: The client understands extended attributes
.... .... .... .... .... .0.. .... .... = 8.3 Only: The client understands long file names
.... .... .... .... .... 0... .... .... = Random Access: The file will not be accessed randomly
.... .... .... .... ...0 .... .... .... = Delete On Close: The file should not be deleted when it is closed
Impersonation: Impersonation (2)
Security Flags: 0x03
.... ...1 = Context Tracking: Security tracking mode is DYNAMIC
.... ..1. = Effective Only: ONLY ENABLED aspects of the client's security context are available
Byte Count (BCC): 71
File Name: /panda/adidas/05Dec/12.30/D7AA6100
0030 00 00 00 9a ff 53 4d 42 a2 00 .....SMB..
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 68 30 01 01 c8 c0 7f 18 ff 00 de de 00 ...h0...........
0060 44 00 16 00 00 00 00 00 00 00 9f 01 02 00 00 00 D...............
0070 00 00 00 00 00 00 80 00 00 00 03 00 00 00 02 00 ................
0080 00 00 40 00 00 00 02 00 00 00 03 47 00 00 5c 00 [email protected]../.
0090 70 00 61 00 6e 00 64 00 61 00 5c 00 61 00 64 00 p.a.n.d.a./.a.d.
00a0 69 00 64 00 61 00 73 00 5c 00 30 00 35 00 44 00 i.d.a.s./.0.5.D.
00b0 65 00 63 00 5c 00 31 00 32 00 2e 00 33 00 30 00 e.c./.1.2...3.0.
00c0 5c 00 44 00 37 00 41 00 41 00 36 00 31 00 30 00 /.D.7.A.A.6.1.0.
00d0 30 00 00 00 0...
--------------------------------------------------------------------------
第一个报文，从Ethereal的显示中可以看到Opnum 8。那位同学没有捕获BIND操作，
这个Opnum 8究竟对应哪个接口UUID不得而知，但只要不是9，从原理上就可以判定是
误报了。本节关心的是为什么会产生这个误报。
用UltraEdit打开sasser1.flt，这是个xml文件(感谢watercloud对行号显示的支持):
--------------------------------------------------------------------------
1:
显然这里才是过滤器开始的地方。
2:
3:
4:
5:
2-5行想必是说物理帧总长位于[200,1518]区间，从1518判断，WildPackets是将结尾
的四字节CRC检验和算进去了。
6:
表示前面那个filternode与后续规则是逻辑与的关系。
7:
8:
9:
这个协议规则是什么，我也没看明白。
10:
继续逻辑与。注意缩进的意义。
11:
12:
13:
14:
15:
16:
目标端口139。不要源端口139的。这里type="34"不是说物理帧偏移+0x022，而是说
data="008B"是用16进制表示的unsigned short int。我是怎么知道的？靠，结合上
下文大胆假设、小心求证出来的呗，还能怎么知道。
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
我们不想分析整个xml文件，只关心误报起因，忽略17-34行。再次提醒，注意缩进。
35:
逻辑或。
36:
37:
38:
39:
40:
41:
目标端口445。不要源端口445的。目标与源的关系靠accept1to2、accept2to1体现。
42:
逻辑与。注意and、or的优先级。
43:
44:
45:
46:
一个弱智的冗余，可以删除。
47:
48:
49:
50:
51:
52:
53:
54:
type="0"表示一个字节的10进制数据。offset等于62，即物理帧偏移+0x03E。看看两
个引起误报的报文，这个位置是SMB Command字段。
117即SMB_COM_TREE_CONNECT_ANDX(0x75)。
55:
56:
57:
58:
59:
60:
61:
62:
63:
我们这次不关心SMB_COM_TREE_CONNECT_ANDX(0x75)，略过55-63行。
64:
65:
66:
67:
68:
69:
70:
71:
type="4"表示四个字节的10进制数据。524744即0x000801C8，这是按网络字节序取上
来的值。实际是在检查Flags、Flags2字段。略过。
72:
73:
74:
75:
76:
77:
78:
79:
80:
略过72-80行。
81:
82:
83:
84:
85:
86:
87:
88:
SMB_COM_SESSION_SETUP_ANDX(0x73)。略过。
89:
90:
91:
92:
93:
94:
95:
96:
97:
略过89-97行。
98:
99:
100:
101:
102:
103:
104:
105:
SMB_COM_NT_CREATE_ANDX(0xA2)。注意看引起误报的第二个报文。
106:
107:
108:
109:
110:
111:
112:
113:
type="2"表示两个字节的10进制数据。57054即0xDEDE，实际是在检查AndXOffset字
段。由于前面是SMB_COM_NONE(0xFF)，该字段无意义，可为任意值。
114:
115:
116:
117:
118:
119:
120:
121:
122:
在[+0x064,+0x078]上搜索"Access Mask: 0x0002019f"。patterntype data="2"表示
patterndata data="9F010200"指定的是16进制字节流，注意是字节流。大小写敏感
搜索。我觉得这里没必要用搜索，因为检查AndXOffset字段时已经假设了固定偏移，
而Access Mask字段与AndXOffset字段之间的偏移也是固定的。
引起误报的第二个报文正是在此被抠住的。这完全是一个扯淡的过滤规则。
123:
124:
125:
126:
127:
128:
129:
130:
131:
从未见过SMB Command字段等于0x3F，不清楚WildPackets想干什么。略过。
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
略过132-149行。
150:
151:
152:
153:
154:
155:
156:
157:
SMB_COM_TRANSACTION(0x25)。注意看引起误报的第一个报文。
158:
逻辑与。
159:
160:
161:
162:
163:
164:
165:
mask type="4" data="65535"表示掩码是0x0000FFFF。637534272即0x26000040，对
应Function: TransactNmPipe (0x0026)、FID: 0x4000。显然FID不固定，不能用作
检查点，这点靠掩码保证。
应该是先将掩码按little-endian序展开成字节流"FF FF 00 00"，然后对字节流"26
00 00 40"应用掩码，对物理帧偏移+0x077处的四字节流应用掩码，比较二者是否相
等。
166:
167:
168:
169:
170:
171:
172:
173:
83886083即0x05000003，这是在检查如下几个字段(+0x08E):
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
遗憾的是，WildPackets只检查了是DCE Request(0)报文，却未检查Opnum。Opnum字
段与Version字段之间的偏移是固定的，完全可以检查Opnum。
174:
175:
176:
177:
178:
179:
180:
181:
182:
Frag Length字段(+0x096)大于(可能包含等于关系)1024。在GUI中应该可以看到是否
包含等于关系，我这是硬搞xml文件，所以不确定。
op data="2"与flags data="0"这两个中肯定有一个表示逻辑运算关系，比如>、<、
>=、<=、==、!=。另一个表示按什么字节序取报文中的数据或者是按什么字节序解释
xml文件中指定的特征值。仅从本xml文件无法判断出对应关系，不过只要取样够多，
很容易判断出来的。
引起误报的第一个报文在此被抠住。这条过滤规则的中心思想是说超大的"Request
Over Transaction"报文出现时报警。问题在于阈值1024很容易在正常报文中出现，
不误报才怪。
183:
184:
185:
整个过滤器未检查SMB_COM_WRITE_ANDX(0x2F)，因为该过滤器是抠Sasser Worm，不
是抠MS04-011/KB835732 Exploit，后者是前者的超集。该过滤器会漏报非蠕虫的攻
击，当然WildPackets没有义务理会这一点。
略过后续行。
186:
187:
188:
189:
190:
191:
因为与本节主旨无关，192行后面的不再继续分析，忽略。
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
--------------------------------------------------------------------------
现在流行用xml写过滤器？我是跟不上这形势，也很少折腾这些东西。WildPackets提
供了另外几个蠕虫的过滤器([15])，看完本节后，有兴趣的话可以自己去分析一下。
不过，不建议做这种无谓的分析，能从GUI上看的时候何苦来看xml文件呢。记录于此，
仅作备忘。
☆ /pipe/epmapper
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s08.html[/url]
这个链接是一篇长文中的一小节，全文都值得一看。
> net use //10.10.7.44/ipc$ "" /user:""
The command completed successfully.
> ifids.exe -p ncacn_np -e /pipe/epmapper -t 10.10.7.44
Interfaces[11] :
Interface UUID : e1af8308-5d1f-11c9-91a4-08002b14a0fa version 3.0 !!!
Interface UUID : 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b version 1.1
Interface UUID : 975201b0-59ca-11d0-a8d5-00a0c90d8051 version 1.0
Interface UUID : e60c73e6-88f9-11cf-9af1-0020af6e72f4 version 2.0
Interface UUID : 99fcfec4-5260-101b-bbcb-00aa0021347a version 0.0
Interface UUID : b9e79e60-3d52-11ce-aaa1-00006901293f version 0.2
Interface UUID : 412f241e-c12a-11ce-abff-0020af6e7a17 version 0.2
Interface UUID : 00000136-0000-0000-c000-000000000046 version 0.0
Interface UUID : c6f3ee72-ce7e-11d1-b71e-00c04fc3111a version 1.0
Interface UUID : 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 version 0.0
Interface UUID : 000001a0-0000-0000-c000-000000000046 version 0.0
建立空会话是必要步骤。有人什么也没得到，最大可能是忘记或不清楚需要提前建立
SMB会话才能访问远程命名管道。访问本地命名管道时无需提前建立SMB会话。
捕获前述操作，保存成SMB_37_12.cap:
--------------------------------------------------------------------------
Frame 1
NetBIOS Session Service
Message Type: Session message
Length: 104
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: NT Create AndX (0xa2)
File Name: /epmapper
Frame 3
Transmission Control Protocol, Src Port: 4763, Dst Port: 445, Len: 140
NetBIOS Session Service
Message Type: Session message
Length: 136
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: afa8bd80-7d8a-11c9-bef4-08002b102989
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Frame 6
Transmission Control Protocol, Src Port: 445, Dst Port: 4763, Len: 136
NetBIOS Session Service
Message Type: Session message
Length: 132
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Read AndX (0x2e)
DCE RPC Bind_ack, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00011dfc
Scndry Addr len: 15
Scndry Addr: /pipe/epmapper
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
--------------------------------------------------------------------------
Frame 1-6:
打开命名管道/pipe/epmapper，先做BIND操作，这次是"BIND Over Write AndX"。这
可是标准Windows API激发出来的报文。接口UUID是MGMT:
afa8bd80-7d8a-11c9-bef4-08002b102989
可能你注意到MGMT并未出现在ifids.exe返回结果中，但通过/pipe/epmapper确实可
以访问到MGMT。这类情形以后你还会在不同场合碰上。
Frame 7-8:
然后请求0号调用完成特定功能:
--------------------------------------------------------------------------
Frame 7 (166 bytes on wire, 166 bytes captured)
NetBIOS Session Service
Message Type: Session message
Length: 108
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
DCE RPC Request, Fragment: Single, FragLen: 24, Call: 1 Ctx: 0, [Resp: #8]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 24
Auth Length: 0
Call ID: 1
Alloc hint: 0
Context ID: 0
Opnum: 0
Response in frame: 8
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
0080 05 00 ..
0090 00 03 10 00 00 00 18 00 00 00 01 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 ......
Frame 8 (418 bytes on wire, 418 bytes captured)
NetBIOS Session Service
Message Type: Session message
Length: 360
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
DCE RPC Response, Fragment: Single, FragLen: 304, Call: 1 Ctx: 0, [Req: #7]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 304
Auth Length: 0
Call ID: 1
Alloc hint: 280
Context ID: 0
Cancel count: 0
Opnum: 0
Request in frame: 7
Time from request: 0.000416000 seconds
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
Stub data (280 bytes)
0070 05 00 02 03 10 00 00 00 30 01 00 00 01 00 ........0.....
0080 00 00 18 01 00 00 00 00 00 00 30 a7 0d 00 0b 00 ..........0.....
0090 00 00 0b 00 00 00 00 e8 0d 00 e0 e7 0d 00 c8 2f .............../
00a0 0c 00 a8 2f 0c 00 88 2f 0c 00 e8 4b 0e 00 e8 3e .../.../...K...>
00b0 0c 00 58 9f 0d 00 30 ea 0d 00 10 eb 0d 00 70 ea ..X...0.......p.
00c0 0d 00 08 83 af e1 1f 5d c9 11 91 a4 08 00 2b 14 .......]......+.
00d0 a0 fa 03 00 00 00 84 65 0a 0b 0f 9e cf 11 a3 cf .......e........
00e0 00 80 5f 68 cb 1b 01 00 01 00 b0 01 52 97 ca 59 .._h........R..Y
00f0 d0 11 a8 d5 00 a0 c9 0d 80 51 01 00 00 00 e6 73 .........Q.....s
0100 0c e6 f9 88 cf 11 9a f1 00 20 af 6e 72 f4 02 00 ......... .nr...
0110 00 00 c4 fe fc 99 60 52 1b 10 bb cb 00 aa 00 21 ......`R.......!
0120 34 7a 00 00 00 00 60 9e e7 b9 52 3d ce 11 aa a1 4z....`...R=....
0130 00 00 69 01 29 3f 00 00 02 00 1e 24 2f 41 2a c1 ..i.)?.....$/A*.
0140 ce 11 ab ff 00 20 af 6e 7a 17 00 00 02 00 36 01 ..... .nz.....6.
0150 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 .............F..
0160 00 00 72 ee f3 c6 7e ce d1 11 b7 1e 00 c0 4f c3 ..r...~.......O.
0170 11 1a 01 00 00 00 b8 4a 9f 4d 1c 7d cf 11 86 1e .......J.M.}....
0180 00 20 af 6e 7c 57 00 00 00 00 a0 01 00 00 00 00 . .n|W..........
0190 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 .........F......
01a0 00 00 ..
--------------------------------------------------------------------------
Ethereal 0.10.13未对响应报文的RPC数据区解码。最后关闭前面打开的命名管道:
--------------------------------------------------------------------------
Frame 9
NetBIOS Session Service
Message Type: Session message
Length: 41
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Close (0x04)
--------------------------------------------------------------------------
现在让我们用ncacn_ip_tcp协议序列完成同样的0号调用:
> ifids.exe -p ncacn_ip_tcp -e 135 -t 10.10.7.44
Interfaces[11] :
Interface UUID : e1af8308-5d1f-11c9-91a4-08002b14a0fa version 3.0 !!!
Interface UUID : 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b version 1.1
Interface UUID : 975201b0-59ca-11d0-a8d5-00a0c90d8051 version 1.0
Interface UUID : e60c73e6-88f9-11cf-9af1-0020af6e72f4 version 2.0
Interface UUID : 99fcfec4-5260-101b-bbcb-00aa0021347a version 0.0
Interface UUID : b9e79e60-3d52-11ce-aaa1-00006901293f version 0.2
Interface UUID : 412f241e-c12a-11ce-abff-0020af6e7a17 version 0.2
Interface UUID : 00000136-0000-0000-c000-000000000046 version 0.0
Interface UUID : c6f3ee72-ce7e-11d1-b71e-00c04fc3111a version 1.0
Interface UUID : 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 version 0.0
Interface UUID : 000001a0-0000-0000-c000-000000000046 version 0.0
捕获前述操作，保存成SMB_37_13.cap:
--------------------------------------------------------------------------
Frame 1 (126 bytes on wire, 126 bytes captured)
Transmission Control Protocol, Src Port: 4789, Dst Port: 135, Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: afa8bd80-7d8a-11c9-bef4-08002b102989
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0b 03 10 00 00 00 48 00 ........H.
0040 00 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 ................
0050 00 00 00 00 01 00 80 bd a8 af 8a 7d c9 11 be f4 ...........}....
0060 08 00 2b 10 29 89 01 00 00 00 04 5d 88 8a eb 1c ..+.)......]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
Frame 2 (114 bytes on wire, 114 bytes captured)
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00011e00
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0c 03 10 00 00 00 3c 00 ........<.
0040 00 00 01 00 00 00 d0 16 d0 16 00 1e 01 00 04 00 ................
0050 31 33 35 00 65 5c 01 00 00 00 00 00 00 00 04 5d 135.e/.........]
0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
0070 00 00 ..
Frame 3 (78 bytes on wire, 78 bytes captured)
DCE RPC Request, Fragment: Single, FragLen: 24, Call: 1 Ctx: 0, [Resp: #4]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 24
Auth Length: 0
Call ID: 1
Alloc hint: 0
Context ID: 0
Opnum: 0
Response in frame: 4
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
0030 05 00 00 03 10 00 00 00 18 00 ..........
0040 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ..............
Frame 4 (358 bytes on wire, 358 bytes captured)
DCE RPC Response, Fragment: Single, FragLen: 304, Call: 1 Ctx: 0, [Req: #3]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 304
Auth Length: 0
Call ID: 1
Alloc hint: 280
Context ID: 0
Cancel count: 0
Opnum: 0
Request in frame: 3
Time from request: 0.000374000 seconds
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
Stub data (280 bytes)
--------------------------------------------------------------------------
与SMB_37_12.cap相比，SMB_37_13.cap的通信数据量要少得多，但可以完成同样的0
号调用。
前面都是铺垫，本节重点在于强调另一件事。在第一次ifids.exe的返回结果中看到
接口EPM:
e1af8308-5d1f-11c9-91a4-08002b14a0fa
这意味着通过/pipe/epmapper可以访问到EPM，意味着可以不经135/TCP而访问EPM:
> net use //10.10.7.44/ipc$ /d /y
//10.10.7.44/ipc$ was deleted successfully.
> net use //10.10.7.44/ipc$ "" /user:""
The command completed successfully.
> 135dump.exe -p ncacn_np -t 10.10.7.44
(略)
同样需要提前建立SMB会话，再执行135dump.exe。捕获操作保存成SMB_37_14.cap:
--------------------------------------------------------------------------
1 162 SMB 10.10.7.2 10.10.7.44 4811 445 NT Create AndX Request, Path: /epmapper
2 193 SMB 10.10.7.44 10.10.7.2 445 4811 NT Create AndX Response, FID: 0x4001
3 194 DCERPC 10.10.7.2 10.10.7.44 4811 445 Bind: call_id: 1 UUID: EPM
4 105 SMB 10.10.7.44 10.10.7.2 445 4811 Write AndX Response, FID: 0x4001, 72 bytes
5 117 SMB 10.10.7.2 10.10.7.44 4811 445 Read AndX Request, FID: 0x4001, 1024 bytes at offset 0
6 190 DCERPC 10.10.7.44 10.10.7.2 445 4811 Bind_ack: call_id: 1 accept max_xmit: 4280 max_recv: 4280
7 242 EPM 10.10.7.2 10.10.7.44 4811 445 Lookup request
8 318 EPM 10.10.7.44 10.10.7.2 445 4811 Lookup response
--------------------------------------------------------------------------
这次SMB会话用了445/TCP，下次可能用139/TCP。访问动态注册过的RPC Server时往
往需要先访问EPM获取动态注册的端点信息，普遍是通过135/TCP完成的，但实际上通
过139、445/TCP、135/UDP也可以。比如:
> 135dump.exe -p ncacn_ip_tcp -t 10.10.7.44
> 135dump.exe -p ncadg_ip_udp -t 10.10.7.44
关于135/UDP我单独写一节来讲，那个与135/TCP差别较大。再说/pipe/epmapper，可
能你测试的时候发现没有这个命名管道了，或者说没看到EPM绑定在其上，这也不奇
怪，这些东西MS说变就变的，天知道什么时候出个什么岔子就没了，但你最好清楚有
过这么件事，万一啥时候就用上了。
☆ 135/UDP相关讨论
1) XP SP1的msgsvc.dll(5.1.2600.1309)
> sc config Messenger start= demand
> sc start Messenger
> ifids.exe -p ncacn_np -e /pipe/msgsvc -t //.
... ...
Interface UUID : 17fdd703-1827-4e34-79d4-24a55c53bb37 version 1.0
在这个版本里只找到一个接口msgsvc:
uuid( 17fdd703-1827-4e34-79d4-24a55c53bb37 ),
version( 1.0 )
没有找到msgsvcsend:
uuid( 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc ),
version( 1.0 )
也没有发现接口msgsvc绑定在协议序列ncadg_ip_udp上。参看:
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s09.html[/url]
2) 中文2000的msgsvc.dll(5.0.2195.4874)
> net use //10.10.7.44/ipc$ /user:Administrator
> ifids.exe -p ncacn_np -e /pipe/msgsvc -t 10.10.7.44
... ...
Interface UUID : 17fdd703-1827-4e34-79d4-24a55c53bb37 version 1.0
Interface UUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0
> ifids.exe -p ncadg_ip_udp -e 1027 -t 10.10.7.44
(同上)
注意两点。一是空会话无权访问/pipe/msgsvc，所以我建立了管理员会话。二是你测
试时未必是1027/UDP，需要用其它手段获取这个端口号，比如在服务端执行netstat
查看，或者在客户端用135dump一类的工具获取。
逆向这个版本的msgsvc.dll，同时包含两个接口:
--------------------------------------------------------------------------
uuid( 17fdd703-1827-4e34-79d4-24a55c53bb37 ),
version( 1.0 )
/*
* 0x00 0x76812A32 _NetrMessageNameAdd@8
* 0x01 0x76813F2C _NetrMessageNameEnum@20
* 0x02 0x7681416B _NetrMessageNameGetInfo@16
* 0x03 0x768128F6 _NetrMessageNameDel@8
*/
--------------------------------------------------------------------------
uuid( 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc ),
version( 1.0 )
/*
* 0x00 0x76814725 _NetrSendMessage@12
*/
long NetrSendMessage
(
[in,string] char *from,
[in,string] char *to,
[in,string] char *str
);
--------------------------------------------------------------------------
泄露的MS源码中只有前一个接口，没有后一个接口。这次我们只关心msgsvcsend接口。
SMB_37_15.cap:
--------------------------------------------------------------------------
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Server
Max Count: 1
Offset: 0
Actual Count: 1
Server:
Client
Max Count: 1
Offset: 0
Actual Count: 1
Client:
Message
Max Count: 2
Offset: 0
Actual Count: 2
Message: /r
00a0 01 00 00 00 00 00 00 00 01 00 ..........
00b0 00 00 00 ff d0 11 01 00 00 00 00 00 00 00 01 00 ................
00c0 00 00 00 5d 88 8a 02 00 00 00 00 00 00 00 02 00 ...]............
00d0 00 00 0d 00 ....
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Return code: STATUS_SUCCESS (0x00000000)
0080 00 00 00 00 ....
--------------------------------------------------------------------------
Ethereal 0.10.14对此通信进行了解码，只是将from/to的关系搞反了。
测试ncadg_ip_udp协议序列(SMB_37_16.cap):
--------------------------------------------------------------------------
1 174 Messenger 10.10.7.2 10.10.7.44 3713 1027 NetrSendMessage request
2 142 UDP 10.10.7.44 10.10.7.2 2536 3713 Source port: 2536 Destination port: 3713
3 146 UDP 10.10.7.2 10.10.7.44 3713 2536 Source port: 3713 Destination port: 2536
4 122 DCERPC 10.10.7.44 10.10.7.2 2536 3713 Ack: seq: 0
5 126 Messenger 10.10.7.44 10.10.7.2 1027 3713 NetrSendMessage response
6 122 DCERPC 10.10.7.2 10.10.7.44 3713 1027 Ack: seq: 0 [req: #1]
Frame 1 (174 bytes on wire, 174 bytes captured)
Internet Protocol, Src: 10.10.7.2, Dst: 10.10.7.44
User Datagram Protocol, Src Port: 3713, Dst Port: 1027
DCE RPC Request, Seq: 0, Serial: 0, Frag: 0, FragLen: 52, [Resp: #5]
Version: 4
Packet type: Request (0)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 71aadcbf-bb40-44d4-9632-87084702e1de
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 52
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Response in frame: 5
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Server
Max Count: 4
Offset: 0
Actual Count: 4
Server: scz
Client
Max Count: 3
Offset: 0
Actual Count: 3
Client: tt
Message
Max Count: 8
Offset: 0
Actual Count: 8
Message: who r u
0020 04 00 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc bf dc aa 71 40 bb d4 44 96 32 87 08 47 02 [email protected].
0060 e1 de 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
0070 ff ff ff ff 34 00 00 00 00 00 04 00 00 00 00 00 ....4...........
0080 00 00 04 00 00 00 73 63 7a 00 03 00 00 00 00 00 ......scz.......
0090 00 00 03 00 00 00 74 74 00 00 08 00 00 00 00 00 ......tt........
00a0 00 00 08 00 00 00 77 68 6f 20 72 20 75 00 ......who r u.
Frame 2 (142 bytes on wire, 142 bytes captured)
Internet Protocol, Src: 10.10.7.44, Dst: 10.10.7.2
User Datagram Protocol, Src Port: 2536, Dst Port: 3713
Data (100 bytes)
0020 04 00 20 04 10 00 .. ...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00 ..v":3..........
0050 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19 ..h.Ov..0060 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00 .D..............
0070 ff ff ff ff 14 00 00 00 00 00 bf dc aa 71 40 bb .............q@.
0080 d4 44 96 32 87 08 47 02 e1 de 02 3c be 41 .D.2..G....<.A
Frame 3 (146 bytes on wire, 146 bytes captured)
Internet Protocol, Src: 10.10.7.2, Dst: 10.10.7.44
User Datagram Protocol, Src Port: 3713, Dst Port: 2536
Data (104 bytes)
0020 04 02 08 04 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00 ..v":3..........
0050 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19 ..h.Ov..0060 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00 .D..............
0070 ff ff ff ff 18 00 00 00 00 00 00 00 00 00 55 82 ..............U.
0080 72 8e a9 05 e7 4d a1 45 d3 e1 55 38 5f 0b 00 00 r....M.E..U8_...
0090 00 00 ..
Frame 4 (122 bytes on wire, 122 bytes captured)
Internet Protocol, Src: 10.10.7.44, Dst: 10.10.7.2
User Datagram Protocol, Src Port: 2536, Dst Port: 3713
DCE RPC Ack, Seq: 0, Serial: 1, Frag: 1, FragLen: 0
Version: 4
Packet type: Ack (7)
Flags1: 0x20 "Idempotent"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 0... = No Fack: Not set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 333a2276-0000-0000-0d00-00809c000000
Activity: 764fea68-a992-453c-8e5f-91b6cb191144
Server boot time: Unknown (0)
Interface Ver: 3
Sequence num: 0
Opnum: 1
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 0
Fragment num: 1
Auth proto: None (0)
Serial Low: 0x01
0020 04 07 20 00 10 00 .. ...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00 ..v":3..........
0050 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19 ..h.Ov..0060 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00 .D..............
0070 ff ff ff ff 00 00 01 00 00 01 ..........
Frame 5 (126 bytes on wire, 126 bytes captured)
Internet Protocol, Src: 10.10.7.44, Dst: 10.10.7.2
User Datagram Protocol, Src Port: 1027, Dst Port: 3713
DCE RPC Response, Seq: 0, Serial: 0, Frag: 0, FragLen: 4, [Req: #1]
Version: 4
Packet type: Response (2)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 71aadcbf-bb40-44d4-9632-87084702e1de
Server boot time: Dec 14, 2004 09:04:02.000000000
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x0036
Fragment len: 4
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Request in frame: 1
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Return code: STATUS_SUCCESS (0x00000000)
0020 04 02 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc bf dc aa 71 40 bb d4 44 96 32 87 08 47 02 [email protected].
0060 e1 de 02 3c be 41 01 00 00 00 00 00 00 00 00 00 ...<.A..........
0070 ff ff 36 00 04 00 00 00 00 00 00 00 00 00 ..6...........
Frame 6 (122 bytes on wire, 122 bytes captured)
Internet Protocol, Src: 10.10.7.2, Dst: 10.10.7.44
User Datagram Protocol, Src Port: 3713, Dst Port: 1027
DCE RPC Ack, Seq: 0, Serial: 1, Frag: 1, FragLen: 0, [Req: #1]
Version: 4
Packet type: Ack (7)
Flags1: 0x00
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 0... = No Fack: Not set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 71aadcbf-bb40-44d4-9632-87084702e1de
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x0036
Fragment len: 0
Fragment num: 1
Auth proto: None (0)
Serial Low: 0x01
Request in frame: 1
0020 04 07 00 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc bf dc aa 71 40 bb d4 44 96 32 87 08 47 02 [email protected].
0060 e1 de 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
0070 ff ff 36 00 00 00 01 00 00 01 ..6.......
--------------------------------------------------------------------------
这次不讨论Messenger服务本身，也不讨论"net send"相关命令，关心的是135/UDP上
的RPC通信。
135/TCP上跑的是DCE/RPC V5，135/UDP上跑的是DCE/RPC V4。V4的RPC头固定是80字
节，解码时与V5明显不同。让过V4的RPC头，接下来就是IDL文件相关的RPC数据区，
这部分与V5完全相同。Ethereal 0.10.14真是烂啊，以前有个版本可以对2、3号报文
解码的，现在居然不解了，真是见鬼，它们对应conv_who_are_you2()。而Sniffer
Pro 4.70.564错误解码如下:
--------------------------------------------------------------------------
CL/DCE RPC: ----- Connectionless MS DCE/RPC Header -----
CL/DCE RPC:
CL/DCE RPC: RPC Version = 4
CL/DCE RPC: PDU Type = 0 (Request)
CL/DCE RPC: flags1 = 20
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = NOT Broadcast Request
CL/DCE RPC: ..1. .... = Idempotent Request
CL/DCE RPC: ...0 .... = NOT Maybe Request
CL/DCE RPC: .... 0... = FACK required
CL/DCE RPC: .... .0.. = PDU is NOT fragment
CL/DCE RPC: .... ..0. = PDU is NOT last fragment
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: flags2 = 04
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = Reserved
CL/DCE RPC: ..0. .... = Reserved
CL/DCE RPC: ...0 .... = Reserved
CL/DCE RPC: .... 0... = Reserved
CL/DCE RPC: .... .1.. = Reserved
CL/DCE RPC: .... ..0. = Cancel not Pending at the call end
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: Data Representation Format Label = 100000
CL/DCE RPC: Serial Number (High Byte) = 0
CL/DCE RPC: OID = 00000000-0000-0000-0000-000000000000
CL/DCE RPC: IID = 333A2276-0000-0000-0D00-00809C000000
CL/DCE RPC: AID = 764FEA68-A992-453C-8E5F-91B6CB191144
CL/DCE RPC: Server Boot Time = 0
CL/DCE RPC: I/F Version = 3
CL/DCE RPC: Sequence number = 0
CL/DCE RPC: Operation Number (Method) = 1
CL/DCE RPC: Interface hint = 65535
CL/DCE RPC: Activity hint = 65535
CL/DCE RPC: Packet Body Length = 20
CL/DCE RPC: Fragment Number = 0
CL/DCE RPC: Authentication protocol ID = 0
CL/DCE RPC: Serial Number (Low Byte) = 0
CL/DCE RPC:
DCOM: ----- MS RPC Application Header -----
DCOM:
DCOM: RPC IID = Conversation Mgr
DCOM: *** Conversation Manager Interface ***
DCOM: Handle = 71aadcbf
DCOM: UUID = 44D4BB40-3296-0887-4702-E1DE023CBE41
ADDR HEX
0020: 04 00 20 04 10 00
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0040: 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00
0050: 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19
0060: 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00
0070: ff ff ff ff 14 00 00 00 00 00 bf dc aa 71 40 bb
0080: d4 44 96 32 87 08 47 02 e1 de 02 3c be 41
CL/DCE RPC: ----- Connectionless MS DCE/RPC Header -----
CL/DCE RPC:
CL/DCE RPC: RPC Version = 4
CL/DCE RPC: PDU Type = 2 (Response)
CL/DCE RPC: flags1 = 08
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = NOT Broadcast Request
CL/DCE RPC: ..0. .... = NOT Idempotent Request
CL/DCE RPC: ...0 .... = NOT Maybe Request
CL/DCE RPC: .... 1... = No FACK required
CL/DCE RPC: .... .0.. = PDU is NOT fragment
CL/DCE RPC: .... ..0. = PDU is NOT last fragment
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: flags2 = 04
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = Reserved
CL/DCE RPC: ..0. .... = Reserved
CL/DCE RPC: ...0 .... = Reserved
CL/DCE RPC: .... 0... = Reserved
CL/DCE RPC: .... .1.. = Reserved
CL/DCE RPC: .... ..0. = Cancel not Pending at the call end
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: Data Representation Format Label = 100000
CL/DCE RPC: Serial Number (High Byte) = 0
CL/DCE RPC: OID = 00000000-0000-0000-0000-000000000000
CL/DCE RPC: IID = 333A2276-0000-0000-0D00-00809C000000
CL/DCE RPC: AID = 764FEA68-A992-453C-8E5F-91B6CB191144
CL/DCE RPC: Server Boot Time = 0
CL/DCE RPC: I/F Version = 3
CL/DCE RPC: Sequence number = 0
CL/DCE RPC: Operation Number (Method) = 1
CL/DCE RPC: Interface hint = 65535
CL/DCE RPC: Activity hint = 65535
CL/DCE RPC: Packet Body Length = 24
CL/DCE RPC: Fragment Number = 0
CL/DCE RPC: Authentication protocol ID = 0
CL/DCE RPC: Serial Number (Low Byte) = 0
CL/DCE RPC:
DCOM: ----- MS RPC Application Header -----
DCOM:
DCOM: RPC IID = Conversation Mgr
DCOM: *** Conversation Manager Interface ***
DCOM: Data = 000000005582728EA905E74DA145D3E155385F0B00000000
ADDR HEX
0020: 04 02 08 04 10 00
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0040: 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00
0050: 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19
0060: 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00
0070: ff ff ff ff 18 00 00 00 00 00 00 00 00 00 55 82
0080: 72 8e a9 05 e7 4d a1 45 d3 e1 55 38 5f 0b 00 00
0090: 00 00
--------------------------------------------------------------------------
rpcrt4.dll自己实现了这两个接口:
MGMT afa8bd80-7d8a-11c9-bef4-08002b102989 1.0
CONV 333a2276-0000-0000-0d00-00809c000000 3.0
[19]介绍了conv_who_are_you2与non-idempotent、Activity的关系，手工解码如下:
--------------------------------------------------------------------------
0xBF, 0xDC, 0xAA, 0x71, 0x40, 0xBB, 0xD4, 0x44, // +0x000 actuid: 71aadcbf-bb40-44d4-9632-87084702e1de
0x96, 0x32, 0x87, 0x08, 0x47, 0x02, 0xE1, 0xDE,
0x02, 0x3C, 0xBE, 0x41 // +0x010 boot_time: Dec 14, 2004 09:04:02.000000000
--------------------------------------------------------------------------
0x00, 0x00, 0x00, 0x00, // +0x000 seq:
0x55, 0x82, 0x72, 0x8E, 0xA9, 0x05, 0xE7, 0x4D, // +0x004 cas_uuid: 8e728255-05a9-4de7-a145-d3e155385f0b
0xA1, 0x45, 0xD3, 0xE1, 0x55, 0x38, 0x5F, 0x0B,
0x00, 0x00, 0x00, 0x00 // +0x014 st:
--------------------------------------------------------------------------
[18]第一次引起我对idempotent(幂等)的注意。
继续测试(SMB_37_17.cap):
--------------------------------------------------------------------------
Frame 1 (168 bytes on wire, 168 bytes captured)
User Datagram Protocol, Src Port: 3760, Dst Port: 1027
DCE RPC Request, Seq: 0, Serial: 0, Frag: 0, FragLen: 46, [Resp: #2]
Version: 4
Packet type: Request (0)
Flags1: 0x28 "Idempotent" "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 26cc9c3c-4425-4e45-aed4-32a35c4c1b20
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 46
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Response in frame: 2
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Server
Max Count: 1
Offset: 0
Actual Count: 1
Server:
Client
Max Count: 1
Offset: 0
Actual Count: 1
Client:
Message
Max Count: 2
Offset: 0
Actual Count: 2
Message: /r
0020 04 00 28 00 10 00 ..(...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc 3c 9c cc 26 25 44 45 4e ae d4 32 a3 5c 4c ..<..&%DEN..2./L
0060 1b 20 00 00 00 00 01 00 00 00 00 00 00 00 00 00 . ..............
0070 ff ff ff ff 2e 00 00 00 00 00 01 00 00 00 00 00 ................
0080 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
0090 00 00 01 00 00 00 00 00 00 00 02 00 00 00 00 00 ................
00a0 00 00 02 00 00 00 0d 00 ........
Frame 2 (126 bytes on wire, 126 bytes captured)
User Datagram Protocol, Src Port: 1027, Dst Port: 3760
DCE RPC Response, Seq: 0, Serial: 0, Frag: 0, FragLen: 4, [Req: #1]
Version: 4
Packet type: Response (2)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 00000000-0000-0000-0000-000000000000
Activity: 26cc9c3c-4425-4e45-aed4-32a35c4c1b20
Server boot time: Dec 14, 2004 09:04:02.000000000
Interface Ver: 0
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x004b
Fragment len: 4
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Request in frame: 1
Time from request: 0.001369000 seconds
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Return code: STATUS_SUCCESS (0x00000000)
0020 04 02 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 3c 9c cc 26 25 44 45 4e ae d4 32 a3 5c 4c ..<..&%DEN..2./L
0060 1b 20 02 3c be 41 00 00 00 00 00 00 00 00 00 00 . .<.A..........
0070 ff ff 4b 00 04 00 00 00 00 00 00 00 00 00 ..K...........
Frame 3 (122 bytes on wire, 122 bytes captured)
User Datagram Protocol, Src Port: 3760, Dst Port: 1027
DCE RPC Ack, Seq: 0, Serial: 1, Frag: 1, FragLen: 0, [Req: #1]
Version: 4
Packet type: Ack (7)
Flags1: 0x20 "Idempotent"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 0... = No Fack: Not set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 26cc9c3c-4425-4e45-aed4-32a35c4c1b20
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x004b
Fragment len: 0
Fragment num: 1
Auth proto: None (0)
Serial Low: 0x01
Request in frame: 1
Time from request: 0.002021000 seconds
0020 04 07 20 00 10 00 .. ...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc 3c 9c cc 26 25 44 45 4e ae d4 32 a3 5c 4c ..<..&%DEN..2./L
0060 1b 20 00 00 00 00 01 00 00 00 00 00 00 00 00 00 . ..............
0070 ff ff 4b 00 00 00 01 00 00 01 ..K.......
--------------------------------------------------------------------------
没有了conv_who_are_you2()相关的三个报文，但仍有一个Ack(7)报文。其实可以更
狠，反正不关心、不需要响应报文。
注意，135/UDP上没有Bind(11)操作，参[20]。接口UUID直接在V4 Request(0)的RPC
头部Interface字段指定。
3) 通过135/UDP访问MGMT
> ifids.exe -p ncadg_ip_udp -e 1027 -t 10.10.7.44
捕获前述操作，保存成SMB_37_19.cap:
--------------------------------------------------------------------------
1 122 MGMT 10.10.7.2 10.10.7.44 4717 1027 rpc__mgmt_inq_if_ids request
2 142 UDP 10.10.7.44 10.10.7.2 2536 4717 Source port: 2536 Destination port: 4717
3 146 UDP 10.10.7.2 10.10.7.44 4717 2536 Source port: 4717 Destination port: 2536
4 122 DCERPC 10.10.7.44 10.10.7.2 2536 4717 Ack: seq: 0
5 450 MGMT 10.10.7.44 10.10.7.2 1027 4717 rpc__mgmt_inq_if_ids response
6 122 DCERPC 10.10.7.2 10.10.7.44 4717 1027 Ack: seq: 0 [req: #1]
--------------------------------------------------------------------------
Win32 API没有指定Idempotent标志位，所以有conv_who_are_you2()出现。XP SP1自
带PFW让conv_who_are_you2 request进来了，不知策略细节是什么，总不至于仅根据
目标端口是4717/UDP吧。
4) 通过135/UDP访问EPM
> 135dump.exe -p ncadg_ip_udp -t 10.10.7.44
捕获前述操作，保存成SMB_37_20.cap:
--------------------------------------------------------------------------
1 198 EPM 10.10.7.2 10.10.7.44 4744 135 Lookup request
2 142 UDP 10.10.7.44 10.10.7.2 1487 4744 Source port: 1487 Destination port: 4744
3 146 UDP 10.10.7.2 10.10.7.44 4744 1487 Source port: 4744 Destination port: 1487
4 122 DCERPC 10.10.7.44 10.10.7.2 1487 4744 Ack: seq: 0
5 278 EPM 10.10.7.44 10.10.7.2 135 4744 Lookup response
6 198 EPM 10.10.7.2 10.10.7.44 4744 135 Lookup request
7 290 EPM 10.10.7.44 10.10.7.2 135 4744 Lookup response
8 198 EPM 10.10.7.2 10.10.7.44 4744 135 Lookup request
9 162 EPM 10.10.7.44 10.10.7.2 135 4744 Lookup response
10 122 DCERPC 10.10.7.2 10.10.7.44 4744 135 Ack: seq: 37 [req: #8]
--------------------------------------------------------------------------
Win32 API没有指定Idempotent标志位，所以有conv_who_are_you2()出现。
注意10号报文，这个Ack(7)不是每次收到Response(2)都会发出。客户端为完成某特
定任务，可能多次发送Request(0)。客户端自己知道哪次Request(0)是最后一次，当
收到对应的Response(2)之后，客户端显式发送Ack(7)，通知服务端完事了，确认响
应报文收到了，服务端应该停止响应。客户端也可以通过发送新的请求报文隐式确认
前次响应。4号是对3号的显式确认，6号是对5号的隐式确认，8号是对7号的隐式确认，
10号是对9号的显式确认。显然，只需要显式确认对应最后一次请求的响应，中间的
响应均可隐式确认，减少通信报文。
再次提醒，135/UDP上没有Bind(11)操作，接口UUID直接在V4 Request(0)的RPC头部
Interface字段指定。
通过135/UDP访问EPM没什么前途，XP SP1、2003 SP1以及某些HotFix之后都不再侦听
这个端口了。
☆ Windows网络服务最小化
2002年9月2日，Jean-Baptiste Marchand发布了一份文档:
[url]http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html[/url]
该文以2000/XP为例介绍了如何最小化Windows网络服务。
缺省安装后的Windows系统默认启用了各种各样的网络服务，它们中的大多数都可以
安全关闭。本文只介绍如何做，另两篇文章将解释更多技术细节:
[url]http://www.hsc.fr/ressources/articles/win_net_srv/[/url]
[url]http://www.hsc.fr/ressources/presentations/sambaxp2003/[/url]
在2000上执行"netstat -na"可以查看侦听中的TCP、UDP端口。在XP上执行"netstat
-nao"将额外返回与端口相关联的PID。
2003之前的netstat命令不能精确地报告TCP、UDP端口状态，这与它的实现有关。比
如:
> netstat -nao | find ":3639"
TCP 0.0.0.0:3639 0.0.0.0:0 LISTENING 868
TCP 192.168.7.2:3639 192.168.1.10:139 ESTABLISHED 868
第二行是正确信息，第一行则属于虚假信息，实际上没有任何进程侦听3639/TCP口。
对于每一条TCP出连接，都将伴随一条虚假信息，注意用find命令区分出虚假侦听端
口。2003已经修复了该BUG。
下面就着手关闭一些网络服务，演示中用了net、sc命令，没有sc或者使用不熟悉的
话，可以换用services.msc，进入GUI界面操作。
2000上IIS 5缺省是启动的，其中HTTP、SMTP等服务依赖于IIS管理服务，停止IIS管
理服务时将自动停止依赖它的那些服务。
> net stop iisadmin
在添加删除面版里删除IIS组件再好不过。
IKE协议(Internet Key Exchange)使用500/UDP口，停止IPSEC服务即可关闭它:
> net stop PolicyAgent
> sc config PolicyAgent start= demand
2000上MSDTC服务缺省是启动的，它侦听3372/TCP和一个高于1023的高端TCP端口。
> net stop msdtc
对于XP可以安全地禁用如下三个服务:
IPsec services (PolicyAgent)
SSDP Discovery Service (SSDPSRV)
Windows Time (W32Time)
> net stop policyagent
> net stop ssdpsrv
> net stop w32time
500/UDP、5000/TCP、1900/UDP、123/UDP随之关闭。
NetBT用到了137、138/UDP以及139/TCP。为了关闭这些端口，必须在每一块网卡上禁
用"NetBIOS over TCP/IP":
网络连接->选择网卡->属性->TCP/IP->属性->高级->WINS->禁用NetBT
这个操作热生效，不需要重启OS。
即使"TCP/IP NetBIOS Helper"服务禁用中，如果未做前述操作，前述端口仍将侦听
中。关闭这些端口后，可以一并禁用"TCP/IP NetBIOS Helper"服务:
> net stop lmhosts
> sc config lmhosts start= disabled
2000及其以后的Windows系统开始支持由TCP层直接承载的SMB协议，使用445/TCP。参
看:
[url]http://www.ubiqx.org/cifs/SMB.html#SMB.1.2[/url]
至少有两种办法可以关闭445/TCP:
. 禁用NetBT驱动
第一种方法彻底禁用了系统中的SMB机制，客户端、服务端支持均被取消。为了停止
NetBT驱动，必须先停止工作站、服务器服务，如果不这样做而试图直接停止NetBT驱
动，系统将出故障。
> net stop rdr
> net stop srv
> net stop netbt
rdr、srv不是服务名称，也不是显示名称，而是net命令自己支持的，在此分别等价
于lanmanworkstation、lanmanserver。
"NetBios over Tcpip"驱动可以手工停止，但不能手工启动，只能重启才可恢复。为
了阻止NetBT驱动在重启OS时自动加载，必须将启动类型由缺省的1改成4:
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NetBT]
"Start"=dword:00000004
--------------------------------------------------------------------------
> sc config netbt start= disabled
. 修改注册表
更多时候第一种方法不是我们所期望的，客户端SMB机制的支持还是需要的。通过修
改注册表可以实现禁用由TCP层直接承载的SMB协议，但继续启用NetBT。
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NetBT/Parameters]
"SmbDeviceEnabled"=dword:00000000
--------------------------------------------------------------------------
重启OS使之生效，445/TCP不再侦听中。
对于Windows 2000上的RPC服务，有一种网络接口限制技术(不适用于XP)可在一定程
度上增强安全性。
> rpccfg -q
RPCCFG: Using default selective binding settings
RPCCFG: Using default port settings
> rpccfg -l
Subnet Description
1 127.0.0.0 1 MS TCP Loopback interface
2 10.10.7.0 1 AMD PCNET Family Ethernet Adapter
> rpccfg -a 1
> rpccfg -q
Admit List
Subnet Description
1 127.0.0.0 1 MS TCP Loopback interface
对应的注册表设置:
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Rpc/Linkage]
"Bind"=hex(7):31,00,00,00,00,00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RpcSs]
"ListenOnInternet"="N"
--------------------------------------------------------------------------
Bind是一个REG_MULTI_SZ型键值，在2000上用regedt32编辑较方便。缺省情况下EPM
服务绑定在所有网络接口上，修改注册表并重启后，将只绑定在回送接口上。
> netstat -na
TCP 127.0.0.1:135 0.0.0.0:0 LISTENING
TCP 127.0.0.1:593 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
如果ListenOnInternet设置成Y:
> netstat -na
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
网络接口限制技术有局限性:
. 如果一个RPC服务显式地挨个绑定所有网络接口，则不受Bind的影响。
. 这是全局设置，不能针对各个RPC服务单独设置。
. 似乎只适用于ncacn_ip_tcp协议序列，比如对ncacn_np、ncadg_ip_udp无效。
在2000上测试表明该技术适用于如下服务(单指ncacn_ip_tcp协议序列):
Distributed Transaction Coordinator
Task Scheduler
IIS
缺省情况下RPC服务所用动态端口从1024开始(似乎Windows从未使用过1024)递增。可
以利用rpccfg指定动态端口范围，重启后生效。比如:
> rpccfg -d 0 -pe 5100-5300
> rpccfg -d 1 -pi 6100-6300
两条命令任选其一即可。对应的注册表设置:
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Rpc/Internet]
"UseInternetPorts"="Y"
"Ports"=hex(7):35,00,31,00,30,00,30,00,2d,00,35,00,33,00,30,00,30,00,00,00,00,/
00
"PortsInternetAvailable"="Y"
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Rpc/Internet]
"UseInternetPorts"="N"
"Ports"=hex(7):36,00,31,00,30,00,30,00,2d,00,36,00,33,00,30,00,30,00,00,00,00,/
00
"PortsInternetAvailable"="N"
--------------------------------------------------------------------------
☆ MS05-040/KB893756
我没有跟踪这个漏洞，只是简单研究了一下相应的RPC接口([22])。
> net start telephony
> ifids.exe -p ncalrpc -e tapsrvlpc -t ""
Interfaces[01] :
Interface UUID : 2f5f6520-ca46-1067-b319-00dd010662da version 1.0
> ifids.exe -p ncacn_np -e /pipe/tapsrv -t .
Interfaces[01] :
Interface UUID : 2f5f6520-ca46-1067-b319-00dd010662da version 1.0
测试(SMB_37_30.cap):
--------------------------------------------------------------------------
1 158 SMB 192.168.7.2 192.168.7.151 4256 139 NT Create AndX Request, Path: /tapsrv
2 193 SMB 192.168.7.151 192.168.7.2 139 4256 NT Create AndX Response, FID: 0x4007
3 194 DCERPC 192.168.7.2 192.168.7.151 4256 139 Bind: call_id: 1 UUID: TAPI
4 105 SMB 192.168.7.151 192.168.7.2 139 4256 Write AndX Response, FID: 0x4007, 72 bytes
5 117 SMB 192.168.7.2 192.168.7.151 4256 139 Read AndX Request, FID: 0x4007, 1024 bytes at offset 0
6 186 DCERPC 192.168.7.151 192.168.7.2 139 4256 Bind_ack: call_id: 1 accept max_xmit: 4280 max_recv: 4280
7 200 TAPI 192.168.7.2 192.168.7.151 4256 139 ClientAttach request
8 146 DCERPC 192.168.7.151 192.168.7.2 139 4256 Fault: call_id: 1 ctx_id: 0 status: nca_s_fault_access_denied
9 99 SMB 192.168.7.2 192.168.7.151 4256 139 Close Request, FID: 0x4007
10 93 SMB 192.168.7.151 192.168.7.2 139 4256 Close Response
--------------------------------------------------------------------------
这次没有调用RpcBindingSetAuthInfo()。BIND虽然成功，请求0号调用时仍返回访问
拒绝。
继续测试(SMB_37_31.cap):
--------------------------------------------------------------------------
1 158 SMB 192.168.7.2 192.168.7.151 4281 445 NT Create AndX Request, Path: /tapsrv
2 193 SMB 192.168.7.151 192.168.7.2 445 4281 NT Create AndX Response, FID: 0x4004
3 234 DCERPC 192.168.7.2 192.168.7.151 4281 445 Bind: call_id: 1 UUID: TAPI, NTLMSSP_NEGOTIATE
4 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4004, 112 bytes
5 117 SMB 192.168.7.2 192.168.7.151 4281 445 Read AndX Request, FID: 0x4004, 1024 bytes at offset 0
6 370 DCERPC 192.168.7.151 192.168.7.2 445 4281 Bind_ack: call_id: 1, NTLMSSP_CHALLENGE accept max_xmit: 4280 max_recv: 4280
7 237 DCERPC 192.168.7.2 192.168.7.151 4281 445 AUTH3: call_id: 1, NTLMSSP_AUTH, User: /
8 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4004, 115 bytes
9 238 TAPI 192.168.7.2 192.168.7.151 4281 445 ClientAttach request
10 146 DCERPC 192.168.7.151 192.168.7.2 445 4281 Fault: call_id: 1 ctx_id: 0 status: nca_s_fault_access_denied
11 99 SMB 192.168.7.2 192.168.7.151 4281 445 Close Request, FID: 0x4004
12 93 SMB 192.168.7.151 192.168.7.2 445 4281 Close Response
--------------------------------------------------------------------------
观察Frame 7，理解此时的NTLMSSP_AUTH报文，这是一次空认证。
--------------------------------------------------------------------------
DCE RPC AUTH3, Fragment: Single, FragLen: 115, Call: 1
Version: 5
Version (minor): 0
Packet type: AUTH3 (16)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 115
Auth Length: 87
Call ID: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337136
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_AUTH (0x00000003)
Lan Manager Response: 00
Length: 1
Maxlen: 1
Offset: 86
NTLM Response: Empty
Domain name: NULL
User name: NULL
Host name: NSFOCUS-SCZ
Length: 22
Maxlen: 22
Offset: 64
Session Key: Empty
Flags: 0xa0888a05
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 1... .... .... = Negotiate 0x00000800: Set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
0070 05 00 10 03 10 00 ......
0080 00 00 73 00 57 00 01 00 00 00 b8 10 b8 10 0a 02 ..s.W...........
0090 00 00 30 67 14 00 4e 54 4c 4d 53 53 50 00 03 00 ..0g..NTLMSSP...
00a0 00 00 01 00 01 00 56 00 00 00 00 00 00 00 57 00 ......V.......W.
00b0 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 ......@.......@.
00c0 00 00 16 00 16 00 40 00 00 00 00 00 00 00 57 00 [email protected].
00d0 00 00 05 8a 88 a0 4e 00 53 00 46 00 4f 00 43 00 ......N.S.F.O.C.
00e0 55 00 53 00 2d 00 53 00 43 00 5a 00 00 U.S.-.S.C.Z..
--------------------------------------------------------------------------
继续测试(SMB_37_32.cap):
--------------------------------------------------------------------------
1 158 SMB 192.168.7.2 192.168.7.151 4281 445 NT Create AndX Request, Path: /tapsrv
2 193 SMB 192.168.7.151 192.168.7.2 445 4281 NT Create AndX Response, FID: 0x4005
3 234 DCERPC 192.168.7.2 192.168.7.151 4281 445 Bind: call_id: 1 UUID: TAPI, NTLMSSP_NEGOTIATE
4 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4005, 112 bytes
5 117 SMB 192.168.7.2 192.168.7.151 4281 445 Read AndX Request, FID: 0x4005, 1024 bytes at offset 0
6 370 DCERPC 192.168.7.151 192.168.7.2 445 4281 Bind_ack: call_id: 1, NTLMSSP_CHALLENGE accept max_xmit: 4280 max_recv: 4280
7 292 DCERPC 192.168.7.2 192.168.7.151 4281 445 AUTH3: call_id: 1, NTLMSSP_AUTH, User: /test
8 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4005, 170 bytes
9 238 TAPI 192.168.7.2 192.168.7.151 4281 445 ClientAttach request
10 166 TAPI 192.168.7.151 192.168.7.2 445 4281 ClientAttach response
11 99 SMB 192.168.7.2 192.168.7.151 4281 445 Close Request, FID: 0x4005
12 93 SMB 192.168.7.151 192.168.7.2 445 4281 Close Response
--------------------------------------------------------------------------
观察Frame 3，与以前的Bind(11)报文相比，Auth Length不再等于零。Frag Length
包括了Auth Length。
对比出现在Session Setup AndX中的NTLMSSP_NEGOTIATE，就是那个格式。
--------------------------------------------------------------------------
DCE RPC Bind, Fragment: Single, FragLen: 112, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 112
Auth Length: 32
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 2f5f6520-ca46-1067-b319-00dd010662da
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337160
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_NEGOTIATE (0x00000001)
Flags: 0xa0088207
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 0... .... .... .... .... .... = Negotiate Target Info: Not set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..1. = Negotiate OEM: Set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
Calling workstation domain: NULL
Calling workstation name: NULL
0070 05 00 0b 03 10 00 ......
0080 00 00 70 00 20 00 01 00 00 00 b8 10 b8 10 00 00 ..p. ...........
0090 00 00 01 00 00 00 00 00 01 00 20 65 5f 2f 46 ca .......... e_/F.
00a0 67 10 b3 19 00 dd 01 06 62 da 01 00 00 00 04 5d g.......b......]
00b0 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
00c0 00 00 0a 02 00 00 48 67 14 00 4e 54 4c 4d 53 53 ......Hg..NTLMSS
00d0 50 00 01 00 00 00 07 82 08 a0 00 00 00 00 00 00 P...............
00e0 00 00 00 00 00 00 00 00 00 00 ..........
--------------------------------------------------------------------------
NTLMSSP_CHALLENGE出现在Bind_ack(12)中。
--------------------------------------------------------------------------
DCE RPC Bind_ack, Fragment: Single, FragLen: 252, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 252
Auth Length: 176
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x0003ccb9
Scndry Addr len: 13
Scndry Addr: /pipe/tapsrv
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337160
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_CHALLENGE (0x00000002)
Domain: SCZ-PWIN2K
Length: 20
Maxlen: 20
Offset: 56
Flags: 0xa28a8205
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..1. .... .... .... .... .... .... = Negotiate 0x02000000: Set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..1. .... .... .... .... = Negotiate Challenge Accept Response: Set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
NTLM Challenge: A36F0229C72A69C2
Reserved: 0000000000000000
Address List
Length: 100
Maxlen: 100
Offset: 76
Domain NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS domain name (0x0002)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS host name (0x0001)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Domain DNS Name: SCZ-PWIN2K
Target item type: DNS domain name (0x0004)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server DNS Name: SCZ-PWIN2K
Target item type: DNS host name (0x0003)
Target item Length: 20
Target item Content: SCZ-PWIN2K
List Terminator
Target item type: End of list (0x0000)
Target item Length: 0
0070 05 00 0c 03 10 00 00 00 fc 00 ..........
0080 b0 00 01 00 00 00 b8 10 b8 10 b9 cc 03 00 0d 00 ................
0090 5c 70 69 70 65 5c 74 61 70 73 72 76 00 00 01 00 /pipe/tapsrv....
00a0 00 00 00 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 .......]........
00b0 08 00 2b 10 48 60 02 00 00 00 0a 02 00 00 48 67 ..+.H`........Hg
00c0 14 00 4e 54 4c 4d 53 53 50 00 02 00 00 00 14 00 ..NTLMSSP.......
00d0 14 00 38 00 00 00 05 82 8a a2 a3 6f 02 29 c7 2a ..8........o.).*
00e0 69 c2 00 00 00 00 00 00 00 00 64 00 64 00 4c 00 i.........d.d.L.
00f0 00 00 05 00 93 08 00 00 00 0f 53 00 43 00 5a 00 ..........S.C.Z.
0100 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 02 00 -.P.W.I.N.2.K...
0110 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
0120 4e 00 32 00 4b 00 01 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
0130 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 04 00 -.P.W.I.N.2.K...
0140 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
0150 4e 00 32 00 4b 00 03 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
0160 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 00 00 -.P.W.I.N.2.K...
0170 00 00 ..
--------------------------------------------------------------------------
NTLMSSP_AUTH出现在AUTH3(16)中。
--------------------------------------------------------------------------
DCE RPC AUTH3, Fragment: Single, FragLen: 170, Call: 1
Version: 5
Version (minor): 0
Packet type: AUTH3 (16)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 170
Auth Length: 142
Call ID: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337160
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_AUTH (0x00000003)
Lan Manager Response: 3A10A26835C6373700000000000000000000000000000000
Length: 24
Maxlen: 24
Offset: 94
NTLM Response: D5B5E0C20FD9B2262987E5600F9CADC1C3EE15D14ECBAFD6
Length: 24
Maxlen: 24
Offset: 118
Domain name: NULL
User name: test
Length: 8
Maxlen: 8
Offset: 64
Host name: NSFOCUS-SCZ
Length: 22
Maxlen: 22
Offset: 72
Session Key: Empty
Flags: 0xa0888205
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
0070 05 00 10 03 10 00 ......
0080 00 00 aa 00 8e 00 01 00 00 00 b8 10 b8 10 0a 02 ................
0090 00 00 48 67 14 00 4e 54 4c 4d 53 53 50 00 03 00 ..Hg..NTLMSSP...
00a0 00 00 18 00 18 00 5e 00 00 00 18 00 18 00 76 00 ......^.......v.
00b0 00 00 00 00 00 00 40 00 00 00 08 00 08 00 40 00 ......@.......@.
00c0 00 00 16 00 16 00 48 00 00 00 00 00 00 00 8e 00 ......H.........
00d0 00 00 05 82 88 a0 74 00 65 00 73 00 74 00 4e 00 ......t.e.s.t.N.
00e0 53 00 46 00 4f 00 43 00 55 00 53 00 2d 00 53 00 S.F.O.C.U.S.-.S.
00f0 43 00 5a 00 3a 10 a2 68 35 c6 37 37 00 00 00 00 C.Z.:..h5.77....
0100 00 00 00 00 00 00 00 00 00 00 00 00 d5 b5 e0 c2 ................
0110 0f d9 b2 26 29 87 e5 60 0f 9c ad c1 c3 ee 15 d1 ...&)..`........
0120 4e cb af d6 N...
--------------------------------------------------------------------------
AUTH3(16)中口令有误的话并不会立即得到验证，接下来的Request(0)报文会招致访
问拒绝Fault(3)。
观察Frame 9，这个Request(0)中Auth Length等于16，Auth pad len等于14，鬼知道
为什么整出这么多填充字节。无论如何，与常规Request(0)报文明显不同。
--------------------------------------------------------------------------
DCE RPC Request, Fragment: Single, FragLen: 96, Call: 1 Ctx: 0, [Resp: #10]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 96
Auth Length: 16
Call ID: 1
Alloc hint: 34
Context ID: 0
Opnum: 0
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 14
Auth Rsrvd: 0
Auth Context ID: 1337160
Response in frame: 10
NTLMSSP Verifier
Version Number: 1
Verifier Body: 000000000000000000000000
Microsoft Telephony API Service, ClientAttach
Operation: ClientAttach (0)
Unknown long: 0x00000000
unknown string
Max Count: 1
Offset: 0
Actual Count: 1
Unknown string:
unknown string
Max Count: 1
Offset: 0
Actual Count: 1
Unknown string:
Auth Padding (14 bytes)
0080 05 00 ..
0090 00 03 10 00 00 00 60 00 10 00 01 00 00 00 22 00 ......`.......".
00a0 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
00b0 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
00c0 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00d0 00 00 00 00 00 00 0a 02 0e 00 48 67 14 00 01 00 ..........Hg....
00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
--------------------------------------------------------------------------
☆ DriverStudio Remote Control服务
2005年9月14日cocoruder对外发布了一份与该服务相关的文档([23])。他发现的这个
漏洞是指可以用空认证绕过权限检查，注意空认证与没有认证是两个概念。
去DriverStudio的设置界面里禁止远程访问即可，不过缺省是允许的。
他没有给演示代码及CAP文件，不过重点部分已经说清楚了。因为与AUTH3(16)报文有
关，顺便测试了一下，这里给两个示例。将启动方式改成disabled(测试的是3.1版):
--------------------------------------------------------------------------
166 DCERPC 192.168.7.2 192.168.7.151 3194 1032 Bind: call_id: 1 UUID: 32d90706-b698-4029-b236-e18ebff582b1 ver 1.0, NTLMSSP_NEGOTIATE
298 DCERPC 192.168.7.151 192.168.7.2 1032 3194 Bind_ack: call_id: 1, NTLMSSP_CHALLENGE accept max_xmit: 5840 max_recv: 5840
169 DCERPC 192.168.7.2 192.168.7.151 3194 1032 AUTH3: call_id: 1, NTLMSSP_AUTH, User: /
134 DCERPC 192.168.7.2 192.168.7.151 3194 1032 Request: call_id: 2 opnum: 1 ctx_id: 0 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
82 DCERPC 192.168.7.151 192.168.7.2 1032 3194 Response: call_id: 2 ctx_id: 0 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
DCE RPC Bind, Fragment: Single, FragLen: 112, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 112
Auth Length: 32
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 32d90706-b698-4029-b236-e18ebff582b1
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1373592
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_NEGOTIATE (0x00000001)
Flags: 0xa0088207
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 0... .... .... .... .... .... = Negotiate Target Info: Not set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..1. = Negotiate OEM: Set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
Calling workstation domain: NULL
Calling workstation name: NULL
0030 05 00 0b 03 10 00 00 00 70 00 ........p.
0040 20 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 ...............
0050 00 00 00 00 01 00 06 07 d9 32 98 b6 29 40 b2 36 .........2..)@.6
0060 e1 8e bf f5 82 b1 01 00 00 00 04 5d 88 8a eb 1c ...........]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 0a 02 ......+.H`......
0080 00 00 98 f5 14 00 4e 54 4c 4d 53 53 50 00 01 00 ......NTLMSSP...
0090 00 00 07 82 08 a0 00 00 00 00 00 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 ......
DCE RPC Bind_ack, Fragment: Single, FragLen: 244, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 244
Auth Length: 176
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00043360
Scndry Addr len: 5
Scndry Addr: 1032
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1373592
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_CHALLENGE (0x00000002)
Domain: SCZ-PWIN2K
Length: 20
Maxlen: 20
Offset: 56
Flags: 0xa28a8205
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..1. .... .... .... .... .... .... = Negotiate 0x02000000: Set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..1. .... .... .... .... = Negotiate Challenge Accept Response: Set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
NTLM Challenge: CF7750957193BBE0
Reserved: 0000000000000000
Address List
Length: 100
Maxlen: 100
Offset: 76
Domain NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS domain name (0x0002)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS host name (0x0001)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Domain DNS Name: SCZ-PWIN2K
Target item type: DNS domain name (0x0004)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server DNS Name: SCZ-PWIN2K
Target item type: DNS host name (0x0003)
Target item Length: 20
Target item Content: SCZ-PWIN2K
List Terminator
Target item type: End of list (0x0000)
Target item Length: 0
0030 05 00 0c 03 10 00 00 00 f4 00 ..........
0040 b0 00 01 00 00 00 d0 16 d0 16 60 33 04 00 05 00 ..........`3....
0050 31 30 33 32 00 00 01 00 00 00 00 00 00 00 04 5d 1032...........]
0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
0070 00 00 0a 02 00 00 98 f5 14 00 4e 54 4c 4d 53 53 ..........NTLMSS
0080 50 00 02 00 00 00 14 00 14 00 38 00 00 00 05 82 P.........8.....
0090 8a a2 cf 77 50 95 71 93 bb e0 00 00 00 00 00 00 ...wP.q.........
00a0 00 00 64 00 64 00 4c 00 00 00 05 00 93 08 00 00 ..d.d.L.........
00b0 00 0f 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
00c0 4e 00 32 00 4b 00 02 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
00d0 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 01 00 -.P.W.I.N.2.K...
00e0 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
00f0 4e 00 32 00 4b 00 04 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
0100 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 03 00 -.P.W.I.N.2.K...
0110 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
0120 4e 00 32 00 4b 00 00 00 00 00 N.2.K.....
DCE RPC AUTH3, Fragment: Single, FragLen: 115, Call: 1
Version: 5
Version (minor): 0
Packet type: AUTH3 (16)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 115
Auth Length: 87
Call ID: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1373592
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_AUTH (0x00000003)
Lan Manager Response: 00
Length: 1
Maxlen: 1
Offset: 86
NTLM Response: Empty
Domain name: NULL
User name: NULL
Host name: NSFOCUS-SCZ
Length: 22
Maxlen: 22
Offset: 64
Session Key: Empty
Flags: 0xa0888a05
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 1... .... .... = Negotiate 0x00000800: Set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
0030 05 00 10 03 10 00 00 00 73 00 ........s.
0040 57 00 01 00 00 00 d0 16 d0 16 0a 02 00 00 98 f5 W...............
0050 14 00 4e 54 4c 4d 53 53 50 00 03 00 00 00 01 00 ..NTLMSSP.......
0060 01 00 56 00 00 00 00 00 00 00 57 00 00 00 00 00 ..V.......W.....
0070 00 00 40 00 00 00 00 00 00 00 40 00 00 00 16 00 ..@.......@.....
0080 16 00 40 00 00 00 00 00 00 00 57 00 00 00 05 8a [email protected].....
0090 88 a0 4e 00 53 00 46 00 4f 00 43 00 55 00 53 00 ..N.S.F.O.C.U.S.
00a0 2d 00 53 00 43 00 5a 00 00 -.S.C.Z..
DCE RPC Request, Fragment: Single, FragLen: 80, Call: 2 Ctx: 0, [Resp: #7]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 80
Auth Length: 16
Call ID: 2
Alloc hint: 20
Context ID: 0
Opnum: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 12
Auth Rsrvd: 0
Auth Context ID: 1373592
Response in frame: 7
Stub data (20 bytes)
Auth Padding (12 bytes)
NTLMSSP Verifier
Version Number: 1
Verifier Body: 000000000000000000000000
0030 05 00 00 03 10 00 00 00 50 00 ........P.
0040 10 00 02 00 00 00 14 00 00 00 00 00 01 00 06 00 ................
0050 00 00 06 00 00 00 05 00 05 00 05 00 04 00 05 00 ................
0060 04 00 00 00 00 00 3b 00 00 00 01 00 00 00 0a 02 ......;.........
0070 0c 00 98 f5 14 00 01 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 ......
DCE RPC Response, Fragment: Single, FragLen: 28, Call: 2 Ctx: 0, [Req: #6]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 28
Auth Length: 0
Call ID: 2
Alloc hint: 4
Context ID: 0
Cancel count: 0
Opnum: 1
Request in frame: 6
Time from request: 0.004911000 seconds
Stub data (4 bytes)
0030 05 00 02 03 10 00 00 00 1c 00 ..........
0040 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 ................
0050 00 00 ..
--------------------------------------------------------------------------
用了空认证，结果仍成功调用了1号远程过程。
DCE/RPC V4时RpcBindingSetAuthInfo()的通信报文更加罕见，将启动方式改成
manual(测试的是3.1版):
--------------------------------------------------------------------------
166 DCERPC 192.168.7.2 192.168.7.151 4989 1033 Request: seq: 1 opnum: 1 len: 24 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
150 DCERPC 192.168.7.151 192.168.7.2 1033 4989 Response: seq: 1 opnum: 1 len: 8 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
DCE RPC Request, Seq: 1, Serial: 0, Frag: 0, FragLen: 24, [Resp: #7]
Version: 4
Packet type: Request (0)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 32d90706-b698-4029-b236-e18ebff582b1
Activity: f76a834e-c381-4e55-9eef-04e63b7bebe0
Server boot time: Feb 8, 2006 09:17:12.000000000
Interface Ver: 1
Sequence num: 1
Opnum: 1
Interface Hint: 0xffff
Activity Hint: 0x003a
Fragment len: 24
Fragment num: 0
Auth proto: NTLMSSP (10)
Serial Low: 0x00
Authentication verifier
Response in frame: 7
Stub data (24 bytes)
0020 04 00 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 06 07 d9 32 98 b6 29 40 b2 36 e1 8e bf f5 .....2..)@.6....
0050 82 b1 4e 83 6a f7 81 c3 55 4e 9e ef 04 e6 3b 7b ..N.j...UN....;{
0060 eb e0 98 46 e9 43 01 00 00 00 01 00 00 00 01 00 ...F.C..........
0070 ff ff 3a 00 18 00 00 00 0a 00 06 00 00 00 06 00 ..:.............
0080 00 00 05 00 05 00 05 00 04 00 05 00 03 00 00 00 ................
0090 00 00 04 00 12 00 01 00 00 00 c8 fa 12 00 44 d4 ..............D.
00a0 63 a7 bc d6 1c 87 c.....
DCE RPC Response, Seq: 1, Serial: 0, Frag: 0, FragLen: 8, [Req: #6]
Version: 4
Packet type: Response (2)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 0008e89f-102b-6048-0200-00000a020000
Activity: f76a834e-c381-4e55-9eef-04e63b7bebe0
Server boot time: Feb 8, 2006 09:17:12.000000000
Interface Ver: 56
Sequence num: 1
Opnum: 46286
Interface Hint: 0xffff
Activity Hint: 0x003a
Fragment len: 8
Fragment num: 0
Auth proto: NTLMSSP (10)
Serial Low: 0x00
Authentication verifier
Request in frame: 6
Time from request: 0.005263000 seconds
Stub data (8 bytes)
0020 04 02 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 9f e8 08 00 2b 10 48 60 02 00 00 00 0a 02 ......+.H`......
0050 00 00 4e 83 6a f7 81 c3 55 4e 9e ef 04 e6 3b 7b ..N.j...UN....;{
0060 eb e0 98 46 e9 43 38 00 00 00 01 00 00 00 ce b4 ...F.C8.........
0070 ff ff 3a 00 08 00 00 00 0a 00 00 00 00 00 08 4f ..:............O
0080 87 00 04 00 87 00 01 00 00 00 58 64 17 00 cd fa ..........Xd....
0090 e8 3e bc d6 1c 87 .>....
--------------------------------------------------------------------------
☆ 后记
☆ 参考资源
[ 3] NT LAN Manager SMB File Sharing Protocol Extensions - Microsoft Corporation [1992-08-24]
[url]http://us4.samba.org/samba/ftp/specs/smb-nt01.doc[/url]
[ 4] Implementing CIFS
[url]http://www.phptr.com/content/images/013047116X/downloads/013047116X_pdf.zip[/url]
[11] A Common Internet File System (CIFS/1.0) Protocol - Microsoft Corporation [1997-03-13]
[url]http://us4.samba.org/samba/ftp/specs/draft-leach-cifs-v1-spec-02.txt[/url]
[14] CORE-20020618: Vulnerabilities in Windows SMB (DoS) - [2002-08-22]
[url]http://www1.corest.com/common/showdoc.php?idx=262&idxseccion=10[/url]
Unchecked Buffer in Network Share Provider Can Lead to Denial of Service (Q326830)
[url]http://www.microsoft.com/technet/security/bulletin/MS02-045.mspx?pf=true[/url]
[url]http://support.microsoft.com/kb/326830[/url]
[url]http://packetstormsecurity.org/0208-exploits/SMBdie.zip[/url]
[15] Sasser Filter - detect multiple varients of W32/Sasser worm.
[url]http://www.wildpackets.com/elements/antivirus/sasserv1.zip[/url]
W32.Mydoom.OandM
[url]http://www.wildpackets.com/elements/antivirus/mydoom_om.zip[/url]
W32.Mydoom.A@mm
[url]http://www.wildpackets.com/elements/antivirus/w32_novarg_a.zip[/url]
"MSBlast," "Lovesan" or "Blaster" worm
[url]http://www.wildpackets.com/elements/antivirus/msblastv1.zip[/url]
SQL Slammer (aka Sapphire) virus
[url]http://www.wildpackets.com/elements/antivirus/Sapphire.zip[/url]
Windows Local Security Authority Service Remote Buffer Overflow
[url]http://www.eeye.com/html/Research/Advisories/AD20040413C.html[/url]
[18] Messenger Service abuse via Microsoft RPC - Jeremy Hewlett [2003]
[url]http://www.giac.com/practical/GCIH/Jeremy_Hewlett_GCIH.pdf[/url]
[Full-Disclosure] Re: Windows Messenger Popup Spam - advisory amended (followup for those interested) [2003-07-01]
[url]http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/006152.html[/url]
[19] Conversation Manager Interface Definition
[url]http://www.opengroup.org/onlinepubs/9629399/apdxp.htm[/url]
[20] Generic PDU Structure
[url]http://www.opengroup.org/onlinepubs/9629399/chap12.htm[/url]
[21] [CORE-2003-12-05] DCE RPC Vulnerabilities New Attack Vectors Analysis - [2003-12-10]
[url]http://www.coresecurity.com/common/showdoc.php?idx=393&idxseccion=10[/url]
[22] Vulnerability in Telephony Service Could Allow Remote Code Execution (893756)
[url]http://www.microsoft.com/technet/security/Bulletin/MS05-040.mspx?pf=true[/url]
[url]http://support.microsoft.com/kb/893756[/url]
Telephony service
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s10s16.html[/url]
[23] DriverStudio Remote Control远程调用认证绕过漏洞及其利用研究 - cocoruder <[email][email protected][/email]> [2005-09-14]
[url]http://www.xfocus.net/articles/200509/821.html[/url]
☆ DCE/MS RPC架构简介
☆ BIND操作简介
1) "BIND Over TCP"简介
2) "BIND Over Transaction"简介
3) "BIND Over Write AndX"简介
4) "BIND Over ..."扩展
5) SMB_COM_TRANSACTION2与SMB_COM_NT_TRANSACTION
☆ PFC_OBJECT_UUID标志位
☆ MS02-045/Q326830
☆ WildPackets Free Filters for Detecting Malicious Worms/Viruses
☆ /pipe/epmapper
☆ 135/UDP相关讨论
1) XP SP1的msgsvc.dll(5.1.2600.1309)
2) 中文2000的msgsvc.dll(5.0.2195.4874)
3) 通过135/UDP访问MGMT
4) 通过135/UDP访问EPM
☆ Windows网络服务最小化
☆ MS05-040/KB893756
☆ DriverStudio Remote Control服务
☆ 参考资源
--------------------------------------------------------------------------
☆ DCE/MS RPC架构简介
本节属于科普性质，文字描述不那么规范，将就着看吧。
一个RPC服务可以绑定多种协议序列，也可以只绑定某一种协议序列，这是实现相关
的，没有定式。某接口绑定N种协议序列，就意味着有N条途径可以访问该接口。可以
用135dump.exe、ifids.exe等工具查询这类信息。
+-- ncacn_ip_tcp(动态TCP口)
|
DCE/MS RPC--+-- ncadg_ip_udp(动态UDP口)
|
+-- ncacn_np(固定的139、445/TCP口)
|
+-- ... ...(其它协议序列)
可以将DCE/MS RPC看作一层，这一层可以在不同的协议序列上跑，比如上面列出的三
种。实际上还有其它协议序列可用，但不常见，这里就不罗嗦了。
ncacn_ip_tcp与ncadg_ip_udp用到了动态端口，它们会向EPM接口注册所用动态端口，
而客户端可以向EPM接口查询服务端注册过的信息。如果客户端有其它手段提前知道
服务端所用动态端口，就可以省去向EPM接口查询的操作。
一般碰上的是版本5的RPC，ncacn_ip_tcp、ncacn_np等用的就是V5。而ncadg_ip_udp
用的则是版本4的RPC。V4与V5的差别很大。你在现实环境中很难观察到V4。历史上某
些版本的net send命令会用到V4，MS02-045/Q326830补丁取消了Messenger服务绑定
的ncadg_ip_udp协议序列，现在更难在现实环境中观察到V4了。
EPM接口本身是一个RPC服务，同样有多种协议序列可用来访问这个接口。
ncacn_np协议序列用到了SMB协议，DCE/MS RPC层位于SMB层上，SMB层再位于TCP层上。
有些文字会介绍说139/TCP口的通信是SMB层位于NBT层上，NBT层位于TCP层上。这一
点对于旁路协议分析来讲，没有必要区分，可以将NBT层那四字节划入SMB层。再简单
点说，旁路协议分析时，可以认为139、445/TCP仅仅是端口不同，没有其它区别。
SMB协议可以由多种命令来承载DCE/MS RPC层数据，同样是139、445/TCP上的通信，
因不同的SMB命令而导致不同的SMB层解码。
无论用哪种协议序列，用哪种SMB命令，访问一个RPC接口的典型步骤是:
a) Bind
b) Request
不同的协议序列、不同SMB命令就对应不同的Bind Over ...、Request Over ...。
分层解码后到了DCE/MS RPC这一层，就都一样了。
做DCE/MS RPC协议分析时，首先就应该关注Bind操作。
--------- --------- -------------- -------
动态TCP口 动态UDP口 139、445/TCP口 ... ...
----+---- ----+---- --------+----- ----+--
| | | |
| | ----+---- ----+--
| | SMB层解码 ... ...
| | ----+---- ----+--
| | | |
+-----------+--------+------+-----------+
|
-----+----------
DCE/MS RPC层解码
-----+----------
|
----------+--------------
RPC层各命令相关的首部解码
----------+--------------
|
+--------+--------+-----+-+------------+---------+--------+
| | | | | | |
-+-- --+-- ---+--- ---+---- ----+--- --+-- ---+---
Bind Fault Request Response Bind_ack AUTH3 ... ...
---- ----- ---+--- ---+---- -------- ----- -------
| |
+-----+-+
|
+-------+-+-----+-------+
| | | |
---+--- ---+--- ---+--- ---+---
Opnum 0 Opnum 1 ... ... Opnum N
---+--- ---+--- ---+--- ---+---
| | | |
+-------+---+---+-------+
|
-----+-------
stub data解码
-------------
在用Ethereal研究DCE/MS RPC协议时，经常看到所谓的stub data，这实际是RPC解码
关键所在。对于这些stub data的解码是IDL文件相关的，不同的IDL文件对应不同的
stub data解码。不同的RPC服务都有着各自不同的IDL文件，因此对stub data的解码
只能是具体问题具体分析，没有捷径可走。
☆ BIND操作简介
1) "BIND Over TCP"简介
一个最简单、常见的Bind_ack报文的例子如下(SMB_37_0.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 4166 (4166), Dst Port: 135 (135), Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: e1af8308-5d1f-11c9-91a4-08002b14a0fa
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0b 03 10 00 00 00 48 00 ........H.
0040 00 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 ................
0050 00 00 00 00 01 00 08 83 af e1 1f 5d c9 11 91 a4 ...........]....
0060 08 00 2b 14 a0 fa 03 00 00 00 04 5d 88 8a eb 1c ..+........]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
Transmission Control Protocol, Src Port: 135 (135), Dst Port: 4166 (4166), Len: 60
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00012bee
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0c 03 10 00 00 00 3c 00 ........<.
0040 00 00 01 00 00 00 d0 16 d0 16 ee 2b 01 00 04 00 ...........+....
0050 31 33 35 00 00 00 01 00 00 00 00 00 00 00 04 5d 135............]
0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
0070 00 00 ..
--------------------------------------------------------------------------
试图绑定DCE/MS RPC Endpoint Mapper Interface UUID时引发上述报文。
Auth Length一般情况下为0，但并非总为0。关于这个字段，参看MSDN中如下函数:
RpcServerRegisterAuthInfo
RpcBindingInqAuthClient
RpcBindingSetAuthInfo
Auth Length为0的情况下，Bind(11)报文的RPC层大小固定为72。
Bind_ack(12)报文的RPC层大小变动较大，一是受Auth Length的影响，二是受Scndry
Addr的影响，Scndry Addr后面的Num results要求对齐在四字节边界上。当Scndry
Addr对应字符串表示的端口号时，Scndry Addr len最大等于6，即"65535"所占字节
数，包括结尾的NUL字符。由于Num results四字节对齐的缘故，"65535"不会比"135"
多占任何字节，因此当Scndry Addr对应字符串表示的端口号时，Auth Length为0的
情况下，Bind_ack(12)报文的RPC层大小固定为60。这种情形很常见，ncacn_ip_tcp
协议序列对应的BIND操作多半是这种情形，换句话说，BIND Over TCP多半是这种情
形。但是，ncacn_np协议序列对应的BIND操作就不是这种情形。
收到Bind_ack(12)报文并不意味着BIND操作成功，要检查Ack result字段:
0 Acceptance
2 Provider rejection
应该还有其它值，但那不重要。解析Bind_ack报文时，务必判断Ack result字段是否
等于Acceptance(0)，此时意味着BIND操作成功。以前一直以为收到Bind_nak(13)报
文才意味着BIND操作失败，不想近日做实验时意外地发现结论错误。
一个解码陷阱源于Ack result在Scndry Addr之后。ncacn_ip_tcp协议序列下Ack
result在RPC层的偏移可以认为是固定的+0x024，ncacn_np协议序列下这个偏移就变
了。可移植的解决方案是无论哪种协议序列，先取Scndry Addr len，再考虑四字节
对齐的事，动态计算Ack result的偏移。这个方案不受Auth Length的影响，认证相
关的数据位于尾部。另一个方案是先获取Auth Length，并确保收到的是完整的非畸
型的Bind_ack报文，然后从尾部倒推偏移-Auth Length-0x018。这个方案并不比前一
个方案更有优势，看个人喜好了。为此修正了一批早期编写的代码。
下面是一个Provider rejection(2)的例子(SMB_37_1.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 60367 (60367), Dst Port: 135 (135), Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: ffffffff-ffff-ffff-ffff-ffffffffffff
Interface Ver: 0
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 05 00 0b 03 10 00 00 00 48 00 00 00 01 00 ........H.....
0050 00 00 b8 10 b8 10 00 00 00 00 01 00 00 00 00 00 ................
0060 01 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0070 ff ff 00 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 .......]........
0080 08 00 2b 10 48 60 02 00 00 00 ..+.H`....
Transmission Control Protocol, Src Port: 135 (135), Dst Port: 60367 (60367), Len: 60
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00012bf6
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Ack result: Provider rejection (2)
Ack reason: Abstract syntax not supported (1)
Transfer Syntax: 00000000-0000-0000-0000-000000000000
Syntax ver: 0
0040 05 00 0c 03 10 00 00 00 3c 00 00 00 01 00 ........<.....
0050 00 00 b8 10 b8 10 f6 2b 01 00 04 00 31 33 35 00 .......+....135.
0060 00 00 01 00 00 00 02 00 01 00 00 00 00 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
--------------------------------------------------------------------------
此次Ack result等于Provider rejection(2)时，Ack reason字段开始有意义，另一
明显变化是Transfer Syntax字段。
Bind_ack(12)报文的RPC层大小与协议序列有关，但与Ack result、Ack reason字段
无关，这是两个短整型，始终占去4字节。因此上述Bind_ack(12)报文的RPC层大小仍
等于60。
向135/TCP发送Bind报文试图绑定不存在的接口UUID，就引发出如上Bind_ack报文。
这是一次实验意外出错后的结果，现实环境中这样的报文相当罕见，折腾DCE/MS RPC
这么久，还是第一次看到，为此修正了一批早期编写的代码。
2) "BIND Over Transaction"简介
当Bind(11)由SMB命令Trans(0x25)承载时，即"BIND Over Transaction"。
这是枚举Windows 2000共享时抓取的报文(SMB_37_2.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 52635 (52635), Dst Port: 139 (139), Len: 160
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
.... ...0 = Add 0 to length
Length: 156
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: Trans (0x25)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x08
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 23643
User ID: 2048
Multiplex ID: 63744
Trans Request (0x25)
Word Count (WCT): 16
Total Parameter Count: 0
Total Data Count: 72
Max Parameter Count: 0
Max Data Count: 1024
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 0
Parameter Offset: 84
Data Count: 72
Data Offset: 84
Setup Count: 2
Reserved: 00
Byte Count (BCC): 89
Transaction Name: /PIPE/
Padding: 0000
SMB Pipe Protocol
Function: TransactNmPipe (0x0026)
FID: 0x4000
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 9c ff 53 4d 42 25 00 00 00 00 08 .....SMB%.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 5b 5c 00 08 00 f9 10 00 00 48 00 00 00 00 04 00 [/.......H......
0070 00 00 00 00 00 00 00 00 00 00 00 54 00 48 00 54 ...........T.H.T
0080 00 02 00 26 00 00 40 59 00 00 5c 00 50 00 49 00 ...&..@Y../.P.I.
0090 50 00 45 00 5c 00 00 00 00 00 05 00 0b 03 10 00 P.E./...........
00a0 00 00 48 00 00 00 01 00 00 00 b8 10 b8 10 00 00 ..H.............
00b0 00 00 01 00 00 00 00 00 01 00 c8 4f 32 4b 70 16 ...........O2Kp.
00c0 d3 01 12 78 5a 47 bf 6e e1 88 03 00 00 00 04 5d ...xZG.n.......]
00d0 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
00e0 00 00 ..
--------------------------------------------------------------------------
SMB Command字段表明此次RPC通信由Transaction承载。RPC层的Bind(11)报文仍占72
字节。本例与"BIND Over Tcp"的情形相比，一是RPC层的承载者由TCP变成了SMB，二
是接口UUID变了，除此之外，并无区别。微软很好地实现了协议分层处理。
Bind(11)报文对于DCE/MS RPC协议分析来讲，至关重要，直接体现在暴露了接口UUID。
在Google中搜索"4b324fc8-1670-01d3-1278-5a47bf6ee188"，重点推荐:
Well-known DCE RPC named pipes endpoints
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s05s03.html[/url]
这里有一张表"Named pipes used by DCE RPC servers"，列举了部分接口UUID对应
的服务或进程，协议分析爱好者可以参看。
接口UUID即上述显示中的Interface UUID字段，不要与Transfer Syntax字段混淆了。
分析DCE/MS RPC通信时，没有接口UUID寸步难行。后续的Request(0)报文中的Opnum
是接口UUID相关的，A接口的0号调用与B接口的0号调用显然是两个独立的调用。有时
会碰上求助者提供了CAP文件，居然只有Request(0)报文，没有Bind(11)报文，分析
者将很难进行有效分析。
那么怎么针对接口UUID设置过滤规则呢？先要搞清楚层次关系，我们可能碰上不同的
承载，就目前举例来讲，已经出现了TCP、SMB两种。
"BIND Over Tcp"对应协议序列ncacn_ip_tcp，目标端口理论上可以是任意TCP端口。
在设置端口过滤时，只能是具体问题具体分析，后面会单独讲这个问题。抛开端口不
谈，Interface UUID字段在TCP数据区(注意我的用词)的偏移是固定的+0x020，由于
UUID大小固定，后面版本字段在TCP数据区的偏移也是固定的。真正设置过滤规则时，
还可以对Version、Packet type、Transfer Syntax字段进行过滤，减少误报。
前面提到了"在TCP数据区的偏移"，意味着我假设手头的工具可以正确定位TCP数据区，
即剥掉IP首部、TCP首部之后的TCP数据区。你不能简单地从IP首部+40，要考虑可能
出现的IP选项、TCP选项。从协议分层的理念来讲，定位在TCP数据区的偏移也是合理
的。
"BIND Over Transaction"对应协议序列ncacn_np，目标端口理论上只有两个，139与
445/TCP，很容易设置端口过滤。一般必须同时观察这两个端口上的通信过程。A时刻
抓取的报文可能用了139/TCP，B时刻抓取的报文可能用了445/TCP。这不是RPC层的问
题，而是SMB层的问题。SMB层的实现最早只用到139/TCP，后来增加了445/TCP，微软
保持向后兼容性，宏观上139与445是竞争关系。抛开端口不谈，Interface UUID字段
在RPC层(注意我的用词)的偏移是固定的+0x020，由于UUID大小固定，后面版本字段
在RPC层的偏移也是固定的。真正设置过滤规则时，还可以对Version、Packet type、
Transfer Syntax字段进行过滤，减少误报。
前面提到了"在RPC层的偏移"，意味着我假设手头的工具可以正确定位RPC层。剥掉IP
首部、TCP首部可能好理解也好操作，大家都熟了，剥掉SMB层可能不太熟。看前面显
示的Data Offset字段，字段值加上4即RPC层在TCP数据区的偏移，SMB层就这样简单
地被剥掉了。别高兴得太早，Data Offset字段本身在TCP数据区的偏移是随SMB命令
而改变的，就Trans(0x25)而言，偏移是61。有人要问了，我先过滤出Trans(0x25)，
再直接假设RPC层在TCP数据区的偏移是+0x058，不就得了。嘿，这是有问题的。注意
看上面显示中的Padding字段，该字段的长度与值不固定！可能你抓了1000次包，都
没看到Padding字段的长度有变化，但第1001次你敢保证仍不变吗？事实上我最初写
代码时就是这样假设的，结果后来针对不同OS测试时意外出错，调试了半天才得到现
在的结论。
写程序时可以精确过滤并定位各个偏移，用协议分析工具时就得变通一下了。先过滤
先过滤出Trans(0x25)，再直接假设RPC层在TCP数据区的偏移是+0x058，进而针对RPC
层各字段进行过滤。因为Padding字段长度有变毕竟是极少数事件，万一哪天你细心
地碰上了，可以针对性地增加另一类过滤，然后逻辑或一下。
下面是前述Bind(11)报文的响应报文:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 139 (139), Dst Port: 52635 (52635), Len: 128
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
.... ...0 = Add 0 to length
Length: 124
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000545000 seconds
SMB Command: Trans (0x25)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x88
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 23643
User ID: 2048
Multiplex ID: 63744
Trans Response (0x25)
Word Count (WCT): 10
Total Parameter Count: 0
Total Data Count: 68
Reserved: 0000
Parameter Count: 0
Parameter Offset: 56
Parameter Displacement: 0
Data Count: 68
Data Offset: 56
Data Displacement: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 69
Padding: 00
SMB Pipe Protocol
Function: TransactNmPipe (0x0026)
FID: 0x4000
DCE RPC Bind_ack, Fragment: Single, FragLen: 68, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 68
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00011135
Scndry Addr len: 13
Scndry Addr: /PIPE/ntsvcs
Num results: 1
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 7c ff 53 4d 42 25 00 00 00 00 88 ...|.SMB%.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 5b 5c 00 08 00 f9 0a 00 00 44 00 00 00 00 00 38 [/.......D.....8
0070 00 00 00 44 00 38 00 00 00 00 00 45 00 00 05 00 ...D.8.....E....
0080 0c 03 10 00 00 00 44 00 00 00 01 00 00 00 b8 10 ......D.........
0090 b8 10 35 11 01 00 0d 00 5c 50 49 50 45 5c 6e 74 ..5...../PIPE/nt
00a0 73 76 63 73 00 00 01 00 00 00 00 00 00 00 04 5d svcs...........]
00b0 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
00c0 00 00 ..
--------------------------------------------------------------------------
协议序列为ncacn_np时，Scndry Addr len、Scndry Addr字段明显有变，以至RPC层
大小不再是60，但你也不能说它固定是68，显然因Scndry Addr的内容而变。要小心
获取Ack result字段在RPC层的偏移。
分析响应报文时同样需要正确定位RPC层。这次Data Offset字段本身在TCP数据区的
偏移是51(不再是61)，该字段的值加4后即RPC层在TCP数据区的偏移。
用协议分析工具时可以先过滤出Trans(0x25)，再直接假设RPC层在TCP数据区的偏移
是+0x03C，进而针对RPC层各字段进行过滤。
SMB_37_3.cap的显示就不文本化了，与SMB_37_1.cap类似。发送Bind报文试图绑定不
存在的接口UUID，引发Provider rejection(2)报文。区别在于承载者由TCP变成SMB，
其它分析不变。这个包不可能在身边的环境中抓到，我用程序发出来的，提供在此仅
用于研究，大家自己打开了看。
3) "BIND Over Write AndX"简介
当Bind(11)由SMB命令Write AndX(0x2f)承载时，即"BIND Over Write AndX"。
可以简单地将Transaction理解成Write/Read的合成命令，区别在于前者处理小数据
量的通信，后者处理大数据量的通信。至于多少算小多少算大，你我都不必关心细节。
它们之间的关系远非如此简单，与本文关系不大，不纠缠了。
前面说过，SMB层的实现同时用到了139、445/TCP，二者之间是竞争关系。此次出于
演示目的，我用程序手工发送报文，指定使用445/TCP。下面是一次枚举共享操作中
出现的报文(SMB_37_4.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 37665 (37665), Dst Port: 445 (445), Len: 140
NetBIOS Session Service
Message Type: Session message
Length: 136
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x08
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 38271
User ID: 2048
Multiplex ID: 25139
Write AndX Request (0x2f)
Word Count (WCT): 14
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Offset: 0
Reserved: FFFFFFFF
Write Mode: 0x0008
.... .... .... 1... = Message Start: This is the START of a MESSAGE (pipe)
.... .... .... .0.. = Write Raw: DON'T use WriteRawNamedPipe (pipe)
.... .... .... ..0. = Return Remaining: DON'T return remaining (pipe/dev)
.... .... .... ...0 = Write Through: Write through not requested
Remaining: 72
Data Length High (multiply with 64K): 0
Data Length Low: 72
Data Offset: 64
High Offset: 0
Byte Count (BCC): 73
Padding: 00
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 88 ff 53 4d 42 2f 00 00 00 00 08 .....SMB/.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 7f 95 00 08 33 62 0e ff 00 00 00 00 40 00 00 00 ....3b......@...
0070 00 ff ff ff ff 08 00 48 00 00 00 48 00 40 00 00 .......H...H.@..
0080 00 00 00 49 00 00 05 00 0b 03 10 00 00 00 48 00 ...I..........H.
0090 00 00 01 00 00 00 b8 10 b8 10 00 00 00 00 01 00 ................
00a0 00 00 00 00 01 00 c8 4f 32 4b 70 16 d3 01 12 78 .......O2Kp....x
00b0 5a 47 bf 6e e1 88 03 00 00 00 04 5d 88 8a eb 1c ZG.n.......]....
00c0 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
Transmission Control Protocol, Src Port: 445 (445), Dst Port: 37665 (37665), Len: 51
NetBIOS Session Service
Message Type: Session message
Length: 47
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000601000 seconds
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x88
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 38271
User ID: 2048
Multiplex ID: 25139
Write AndX Response (0x2f)
Word Count (WCT): 6
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 47
FID: 0x4000
Count Low: 72
Remaining: 65535
Count High (multiply with 64K): 0
Reserved: 0000
Byte Count (BCC): 0
0040 00 00 00 2f ff 53 4d 42 2f 00 00 00 00 88 .../.SMB/.....
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 7f 95 00 08 33 62 06 ff 00 2f 00 48 00 ff ff 00 ....3b.../.H....
0070 00 00 00 00 00 .....
--------------------------------------------------------------------------
对于139/TCP来说，TCP数据区前4字节算是NBT层的。对于445/TCP来说，TCP数据区前
4字节不算是NBT层的，直接交给SMB层的代码处理了，但在旁路解码处理时，不必关
心这些细节，方便起见，仍称这4字节为NBT层数据。
对比SMB_37_2.cap与SMB_37_4.cap中NBT层的解码，后者已经没有了Flags字段，而
Length字段由17-bits扩展到24-bits。
Write AndX(0x2f)承载的RPC层仍占72字节，与前面两小节相比没有任何区别，作为
承载者的SMB层本身却发生重大变化。SMB Command变成Write AndX(0x2f)，对SMB层
的解码也就变了，Data Offset字段本身在TCP数据区的偏移变成59。Data Length等
于72，正好是RPC层的大小，RPC层是做为SMB层数据区出现的！
至此已经很清晰地感受到协议分层处理这个事实。在讨论DCE/MS RPC时，应将SMB层
看作与TCP层一样的传输层，RPC层可以在这些传输层中选择一个作为承载者。至于传
输层内部如何实现，不关RPC层的事。
用协议分析工具时可以先过滤出Write AndX(0x2f)，再直接假设RPC层在TCP数据区的
偏移是+0x044，进而针对RPC层各字段进行过滤。
与前面两小节相比，另一个重要变化是Bind_ack(12)报文并未随Write AndX(0x2f)的
响应报文出现，此时必须显式调用Read AndX(0x2e)读取Bind_ack(12):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 37665 (37665), Dst Port: 445 (445), Len: 63
NetBIOS Session Service
Message Type: Session message
Length: 59
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 4
SMB Command: Read AndX (0x2e)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x08
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 39203
User ID: 2048
Multiplex ID: 46171
Read AndX Request (0x2e)
Word Count (WCT): 12
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Offset: 0
Max Count Low: 32767
Min Count: 32767
Remaining: 32767
High Offset: 0
Byte Count (BCC): 0
0040 00 00 00 3b ff 53 4d 42 2e 00 00 00 00 08 ...;.SMB......
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 23 99 00 08 5b b4 0c ff 00 00 00 00 40 00 00 00 #...[.......@...
0070 00 ff 7f ff 7f ff ff ff ff ff 7f 00 00 00 00 00 ................
0080 00 .
Transmission Control Protocol, Src Port: 445 (445), Dst Port: 37665 (37665), Len: 132
NetBIOS Session Service
Message Type: Session message
Length: 128
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 3
Time from request: 0.000471000 seconds
SMB Command: Read AndX (0x2e)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x88
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 39203
User ID: 2048
Multiplex ID: 46171
Read AndX Response (0x2e)
Word Count (WCT): 12
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Remaining: 0
Data Compaction Mode: 0
Reserved: 0000
Data Length Low: 68
Data Offset: 60
Data Length High (multiply with 64K): 0
Reserved: 000000000000
Byte Count (BCC): 69
Padding: 00
DCE RPC Bind_ack, Fragment: Single, FragLen: 68, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 68
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00024b67
Scndry Addr len: 13
Scndry Addr: /PIPE/ntsvcs
Num results: 1
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 00 00 00 80 ff 53 4d 42 2e 00 00 00 00 88 .....SMB......
0050 01 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 23 99 00 08 5b b4 0c ff 00 00 00 00 00 00 00 00 #...[...........
0070 00 44 00 3c 00 00 00 00 00 00 00 00 00 00 00 45 .D.<...........E
0080 00 00 05 00 0c 03 10 00 00 00 44 00 00 00 01 00 ..........D.....
0090 00 00 b8 10 b8 10 67 4b 02 00 0d 00 5c 50 49 50 ......gK..../PIP
00a0 45 5c 6e 74 73 76 63 73 00 00 01 00 00 00 00 00 E/ntsvcs........
00b0 00 00 04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 ...]..........+.
00c0 48 60 02 00 00 00 H`....
--------------------------------------------------------------------------
Bind_ack(12)报文随Read AndX(0x2e)的响应报文出现。Data Offset字段本身在TCP
数据区的偏移是49。
用协议分析工具时可以先过滤出Read AndX(0x2e)，再直接假设RPC层在TCP数据区的
偏移是+0x040，进而针对RPC层各字段进行过滤。重复提醒，Padding字段长度不固定，
偏移+0x040只是权宜之计，如能动态根据Data Offset字段的值计算偏移最好不过。
前两小节的BIND操作只涉及一来一回两个报文，本小节的BIND操作却涉及四个报文，
麻烦了许多。一般"BIND Over Transaction"都能安全替代"BIND Over Write AndX"，
自己写程序实现BIND操作时不必选用后者。但是在协议分析过程中，却有可能同时碰
上二者。
扯远一点。当出现一些DCE/MS RPC类蠕虫时，会有公司或个人提供一些定制后的过滤
规则。从我们前期的短小分析来看，这些过滤规则面临一些难题，或者说因协议分析
工具自身能力不足带来的难题。一是动态端口，这个现在仍不急着讲。二是从协议层
次上精确定位RPC层，我不清楚现有工具中哪个可以识别了SMB Command之后动态定位
Data Offset字段本身在TCP数据区的偏移，动态根据Data Offset字段的值计算RPC层
在TCP数据区的偏移，同时以这个偏移为基准定位其它RPC层的协议字段。更多时候这
些公开发布的过滤规则就像我前面介绍的那样，做了一些重大假设，比如填充域长度
固定，只考虑"BIND Over Write AndX"，不考虑"BIND Over Transaction"等等。针对
蠕虫的某一特定实例，做这样的重大假设是可以的，其作者不太可能变态到同时实现
了两种BIND操作，随机挑着用。但我今天这么公开提到了，难说下次蠕虫作者不这样
干。真要出现这样的局面，只好设置多套过滤，逻辑或一下。总有人抱怨过滤规则不
工作，那是因为出现了蠕虫变种、Exploit变种等等，违背了原过滤规则所做的重大
假设。这时应抓取样本报文，自行设置过滤规则。话说回来，协议分析工具做这种事
确实太勉为其难了，交互式分析工具严重依赖于人的参与，这也导致NIDS、NIPS必然
出场。NIDS、NIPS是程序实现的解码分析，灵活得多。
协议分析工具、NIDS、NIPS的相同点是都要做协议分层解码，都要逐层剥离，一旦中
间某层解码失败，作为负载出现的后续层次都将解码失败。DCE/MS RPC由SMB承载时，
首先要对SMB层进行解码才好继续进行后续分析。Ethereal是目前我所用过的协议分
析工具中对SMB层解码最深入的一个，推荐使用。而Samba是目前我所见过的对SMB层
Hacking最深的开源项目，远比Ethereal深入，甚至可以说不在一个层次。即使现在
部份Windows源码泄露，也还是值得研读Samba源码。
协议分层越多，解码越麻烦，也越容易忽略许多例外情形。换句话说，很多工具、程
序只考虑到最常见的情形，多多少少、有意无意做了一些假设，当例外情形出现违背
了这些假设，问题就来了。Ethereal对SMB层解码太深，历史上出现过的问题就很多，
我敢打赌，到现在还有问题。至于Samba么，一样的，在Samba项目的历史上出现过很
多现在也鲜为人知的趣事，这群天才们从无到有Hacking SMB，那还是Windows的早期，
Samba与Windows通信时搞出个BSOD实在是太普通了。要是搁在现在，不成了大漏洞、
大新闻么。当时的环境、氛围与现在太不同，最终多半是安静地通知微软并协助修补
了事。有个叫Luke Kenneth Casson Leighton的人，此人是半路加盟Samba Team的，
也算是天才，很强悍，后来因个人理念冲突与Samba Team分道扬镳，再后来加入ISS
的XForce小组继续从事SMB协议分析。他写过一本书:
<
99年出的。因为Ethereal已经得到相当程度的加强，这书搁到现在算不上稀世奇珍了，
但仍可从中找到一些Ethereal至今未做解码的内容，Samba早在99年之前就解码了！
他在该书中提到一件事，NT 4 SP4之前有一个与Auth Length字段相关的BUG，微软成
功地在保持了向后兼容性的前提下修正了BUG，作者称之为"quite a feat"。在该书
中看到多处历史上悄悄修补过的SMB层BUG，叹息啊，没赶上好时光，也没那群天才们
的实力，同时相当佩服微软保持向后兼容性的强悍。
其它协议分析工具对SMB层解码相比Ethereal就太浅了，但同时也少了很多麻烦，比
如Iris这个小不点，当成玩具就可以了，不会擦枪走火的。不要迷信商业版协议分析
软件，一样的，解码越深死得越快，不解码或只简单解码活下来的机会更大。snort、
tcpdump死得不比Ethereal少。ISS的商业版NIDS很强，对SMB层的解码分析能力是我
接触过的同型产品中最强的一个，没办法，人家的XForce小组中就有好几个前Samba
Team的人。但这同时意味着解码风险增加，已经出过几次问题了。想像一下，假设我
知道某竞争对手的产品对SMB层解码很强，就针对性地制造畸型SMB报文，会如何。不
过放心啦，国内的NIDS、NIPS没这水平，想搞它们都没机会。这事有点讽刺，就跟傻
也是一种幸福一样。
SMB_37_5.cap与SMB_37_3.cap类似。发送Bind报文试图绑定不存在的接口UUID，引发
Provider rejection(2)报文。承载者都是SMB，但这次是"BIND Over Write AndX"。
同样这个包不可能在身边的环境中抓到，我用程序发出来的，提供在此仅用于研究。
这一节只起对比作用，结果由技术文章写成八卦话题了，就当灌水吧。
4) "BIND Over ..."扩展
怀疑另外两个SMB命令NT Trans(0xa0)、Trans2(0x32)也可以承载Bind(11)，虽然我
在现实环境中尚未抓包观察到，最近也没时间写程序测试，记录于此，仅作备忘。
对此有两份文档([3]、[4])可供参考:
<
3.2 NT Transact SMB
4.5.1 NT Transact
<
2.9.4 Transaction SMBs
这三种Transaction命令的差别相当小。如果我写恶意程序，一定会尝试另两种Trans
命令，尽可能地规避IDS嘛。
5) SMB_COM_TRANSACTION2与SMB_COM_NT_TRANSACTION
在上一小节我提到这两个命令，并且怀疑它们亦可用于承载Bind(11)。拖了些日子，
昨天翻看draft-leach-cifs-v1-spec-02.txt([11])，发现原来的简单想象有问题。
参看如下小节:
3.13.1 SMB_COM_TRANSACTION and SMB_COM_TRANSACTION2 Formats
6.2 SMB_COM_TRANSACTION2 Subcommand codes
3.13.2 SMB_COM_NT_TRANSACTION Formats
6.3 SMB_COM_NT_TRANSACTION Subcommand Codes
4.6.1 NT_TRANSACT_IOCTL
SMB_COM_TRANSACTION2(0x32)请求包的格式与SMB_COM_TRANSACTION(0x25)非常像，
但是这次Setup Count由2变成了1。原来的Setup[]对应:
Setup[0] Function: TransactNmPipe (0x0026)
Setup[1] FID: 0x4000
现在的Setup[]对应:
Setup[0] Subcommand:
原来有"Transaction Name: /PIPE/"字段，现在没有这个字段。这实际意味着二者的
编码解码完全不同了，SMB_COM_TRANSACTION2的具体功能与Subcommand紧密相关，无
法承载抽象的Bind(11)。
在cmd中执行start //
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 3268, Dst Port: 445, Len: 80
NetBIOS Session Service
Message Type: Session message
Length: 76
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: Trans2 (0x32)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2052
Process ID: 1576
User ID: 2049
Multiplex ID: 3584
Trans2 Request (0x32)
Word Count (WCT): 15
Total Parameter Count: 8
Total Data Count: 0
Max Parameter Count: 2
Max Data Count: 40
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 8
Parameter Offset: 68
Data Count: 0
Data Offset: 0
Setup Count: 1
Reserved: 00
Subcommand: QUERY_PATH_INFO (0x0005)
Byte Count (BCC): 11
Padding: 000000
QUERY_PATH_INFO Parameters
Level of Interest: Query File Basic Info (1004)
Reserved: 00000000
File Name:
0030 00 00 00 4c ff 53 4d 42 32 00 ...L.SMB2.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 04 08 28 06 01 08 00 0e 0f 08 00 00 00 02 ....(...........
0060 00 28 00 00 00 00 00 00 00 00 00 00 00 08 00 44 .(.............D
0070 00 00 00 00 00 01 00 05 00 0b 00 00 00 00 ec 03 ................
0080 00 00 00 00 00 00 ......
NetBIOS Session Service
Message Type: Session message
Length: 100
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000571000 seconds
SMB Command: Trans2 (0x32)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x98
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2052
Process ID: 1576
User ID: 2049
Multiplex ID: 3584
Trans2 Response (0x32)
Subcommand: QUERY_PATH_INFO (0x0005)
Word Count (WCT): 10
Total Parameter Count: 2
Total Data Count: 40
Reserved: 0000
Parameter Count: 2
Parameter Offset: 56
Parameter Displacement: 0
Data Count: 40
Data Offset: 60
Data Displacement: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 45
Padding: 00
QUERY_PATH_INFO Parameters
EA Error offset: 0
Padding: 0001
QUERY_PATH_INFO Data
Created: Jun 4, 2003 16:39:30.335908800
Last Access: Sep 12, 2003 13:15:38.276899200
Last Write: Aug 21, 2003 16:06:07.509022400
Change: Aug 22, 2003 10:04:31.689686400
File Attributes: 0x00000036
.0.. .... .... .... = Encrypted: This is NOT an encrypted file
..0. .... .... .... = Content Indexed: This file MAY be indexed by the content indexing service
...0 .... .... .... = Offline: This file is NOT offline
.... 0... .... .... = Compressed: This is NOT a compressed file
.... .0.. .... .... = Reparse Point: This file does NOT have an associated reparse point
.... ..0. .... .... = Sparse: This is NOT a sparse file
.... ...0 .... .... = Temporary: This is NOT a temporary file
.... .... 0... .... = Normal: This file has some attribute set
.... .... .0.. .... = Device: This is NOT a device
.... .... ..1. .... = Archive: This file has been modified since last ARCHIVE
.... .... ...1 .... = Directory: This is a DIRECTORY
.... .... .... 0... = Volume ID: This is NOT a volume ID
.... .... .... .1.. = System: This is a SYSTEM file
.... .... .... ..1. = Hidden: This is a HIDDEN file
.... .... .... ...0 = Read Only: This file is NOT read only
Unknown Data: 00000000
0030 00 00 00 64 ff 53 4d 42 32 00 ...d.SMB2.
0040 00 00 00 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 04 08 28 06 01 08 00 0e 0a 02 00 28 00 00 ....(........(..
0060 00 02 00 38 00 00 00 28 00 3c 00 00 00 00 00 2d ...8...(.<.....-
0070 00 00 00 00 00 01 70 8e c0 d0 74 2a c3 01 60 79 ......p...t*..`y
0080 2f e7 ec 78 c3 01 30 ed 31 13 bb 67 c3 01 60 5e /..x..0.1..g..`^
0090 e4 b9 51 68 c3 01 36 00 00 00 00 00 00 00 ..Qh..6.......
NetBIOS Session Service
Message Type: Session message
Length: 86
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans2 (0x32)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2052
Process ID: 1576
User ID: 2049
Multiplex ID: 3648
Trans2 Request (0x32)
Word Count (WCT): 15
Total Parameter Count: 18
Total Data Count: 0
Max Parameter Count: 10
Max Data Count: 16384
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 18
Parameter Offset: 68
Data Count: 0
Data Offset: 0
Setup Count: 1
Reserved: 00
Subcommand: FIND_FIRST2 (0x0001)
Byte Count (BCC): 21
Padding: 000000
FIND_FIRST2 Parameters
Search Attributes: 0x0016
.... .... .... ...0 = Read Only: Do NOT include read only files in search results
.... .... .... ..1. = Hidden: Include HIDDEN files in search results
.... .... .... .1.. = System: Include SYSTEM files in search results
.... .... .... 0... = Volume ID: Do NOT include volume IDs in search results
.... .... ...1 .... = Directory: Include DIRECTORIES in search results
.... .... ..0. .... = Archive: Do NOT include archive files in search results
Search Count: 1366
Flags: 0x0006
.... .... ...0 .... = Backup Intent: No backup intent
.... .... .... 0... = Continue: New search, do NOT continue from previous position
.... .... .... .1.. = Resume: Return RESUME keys
.... .... .... ..1. = Close on EOS: CLOSE search if END OF SEARCH is reached
.... .... .... ...0 = Close: Do NOT close search after this request
Level of Interest: Find File Both Directory Info (260)
Storage Type: 0
Search Pattern: /*
0030 00 00 00 56 ff 53 4d 42 32 00 ...V.SMB2.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 04 08 28 06 01 08 40 0e 0f 12 00 00 00 0a ....(...@.......
0060 00 00 40 00 00 00 00 00 00 00 00 00 00 12 00 44 [email protected]
0070 00 00 00 00 00 01 00 01 00 15 00 00 00 00 16 00 ................
0080 56 05 06 00 04 01 00 00 00 00 5c 00 2a 00 00 00 V........./.*...
--------------------------------------------------------------------------
我曾简单地将SMB_37_2.cap中请求包的SMB_COM_TRANSACTION(0x25)改成
SMB_COM_TRANSACTION2(0x32)发送出去，Ethereal解码时会显示:
Subcommand: Unkown (0x0026)
因为没有这个子命令嘛。响应包中会在SMB首部显示:
Error Class: Server Error (0x02)
Reserved: 00
Error Code: Non specific error code (0x0001)
显然服务端因无法识别有效子命令而报错。
SMB_COM_NT_TRANSACTION(0xA0)请求包的格式与前两种相差较大。其具体功能也是与
Subcommand紧密相关的，但这次子命令对应Function字段，而不是某个Setup[]元素。
Setup Count不再固定，而是随子命令变化，可能为0，可能为4，也可能为其它值。
比如子命令NT_TRANSACT_IOCTL(0x0002)对应的Setup Count为4，而
NT_TRANSACT_QUERY_SECURITY_DESC(0x0006)对应的Setup Count为0。我也没整明白
既然有Parameter区域，这里为什么要用Setup[]，没系统地看文档，可能有向后兼容
性方面的考虑吧。SMB_COM_NT_TRANSACTION(0xA0)无法承载抽象的Bind(11)。
至此彻底推翻了上一小节的猜想。不过也算有收获，学到点新东西。曾在跟踪漏洞
CVE-2003-0201、CVE-2005-0045、CVE-2005-1206时多次分析过这几类报文，但当时
的分析角度不同，可以结合当时写的文章深入理解:
<
<
<
访问共享并查看文件属性的安全页时，会引发SMB_COM_NT_TRANSACTION(0xA0)报文，
抓取SMB_37_7.cap:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 3493, Dst Port: 445, Len: 88
NetBIOS Session Service
Message Type: Session message
Length: 84
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 2
SMB Command: NT Trans (0xa0)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28802
NT Trans Request (0xa0)
Word Count (WCT): 19
Max Setup Count: 0
Reserved: 0000
Total Parameter Count: 8
Total Data Count: 0
Max Parameter Count: 4
Max Data Count: 0
Parameter Count: 8
Parameter Offset: 76
Data Count: 0
Data Offset: 0
Setup Count: 0
Function: NT QUERY SECURITY DESC (6)
Byte Count (BCC): 11
Padding: 000000
NT QUERY SECURITY DESC Parameters
FID: 0x400d
Reserved: 0000
Security Information: 0x00000004
.... .... .... .... .... .... .... ...0 = Owner: NOT requesting owner security information
.... .... .... .... .... .... .... ..0. = Group: NOT requesting group security information
.... .... .... .... .... .... .... .1.. = DACL: Requesting DACL security information
.... .... .... .... .... .... .... 0... = SACL: NOT requesting SACL security information
0030 00 00 00 54 ff 53 4d 42 a0 00 ...T.SMB..
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 82 70 13 00 00 00 08 00 ....(....p......
0060 00 00 00 00 00 00 04 00 00 00 00 00 00 00 08 00 ................
0070 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 06 ..L.............
0080 00 0b 00 00 00 00 0d 40 00 00 04 00 00 00 .......@......
NetBIOS Session Service
Message Type: Session message
Length: 76
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
Time from request: 0.000419000 seconds
SMB Command: NT Trans (0xa0)
NT Status: STATUS_BUFFER_TOO_SMALL (0xc0000023)
Flags: 0x98
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28802
NT Trans Response (0xa0)
Function: NT QUERY SECURITY DESC (6)
Word Count (WCT): 18
Reserved: 000000
Total Parameter Count: 4
Total Data Count: 0
Parameter Count: 4
Parameter Offset: 72
Parameter Displacement: 0
Data Count: 0
Data Offset: 76
Data Displacement: 0
Setup Count: 0
Byte Count (BCC): 5
Padding: 0B
NT QUERY SECURITY DESC Parameters
NT Security Descriptor Length: 48
0030 00 00 00 4c ff 53 4d 42 a0 23 ...L.SMB.#
0040 00 00 c0 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 82 70 12 00 00 00 04 00 ....(....p......
0060 00 00 00 00 00 00 04 00 00 00 48 00 00 00 00 00 ..........H.....
0070 00 00 00 00 00 00 4c 00 00 00 00 00 00 00 00 05 ......L.........
0080 00 0b 30 00 00 00 ..0...
NetBIOS Session Service
Message Type: Session message
Length: 84
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response in: 4
SMB Command: NT Trans (0xa0)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28866
NT Trans Request (0xa0)
Word Count (WCT): 19
Max Setup Count: 0
Reserved: 0000
Total Parameter Count: 8
Total Data Count: 0
Max Parameter Count: 4
Max Data Count: 48
Parameter Count: 8
Parameter Offset: 76
Data Count: 0
Data Offset: 0
Setup Count: 0
Function: NT QUERY SECURITY DESC (6)
Byte Count (BCC): 11
Padding: 000000
NT QUERY SECURITY DESC Parameters
FID: 0x400d
Reserved: 0000
Security Information: 0x00000004
.... .... .... .... .... .... .... ...0 = Owner: NOT requesting owner security information
.... .... .... .... .... .... .... ..0. = Group: NOT requesting group security information
.... .... .... .... .... .... .... .1.. = DACL: Requesting DACL security information
.... .... .... .... .... .... .... 0... = SACL: NOT requesting SACL security information
0030 00 00 00 54 ff 53 4d 42 a0 00 ...T.SMB..
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 c2 70 13 00 00 00 08 00 ....(....p......
0060 00 00 00 00 00 00 04 00 00 00 30 00 00 00 08 00 ..........0.....
0070 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 06 ..L.............
0080 00 0b 00 00 00 00 0d 40 00 00 04 00 00 00 .......@......
NetBIOS Session Service
Message Type: Session message
Length: 124
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 3
Time from request: 0.000416000 seconds
SMB Command: NT Trans (0xa0)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x98
1... .... = Request/Response: Message is a response to the client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2049
Process ID: 1576
User ID: 2049
Multiplex ID: 28866
NT Trans Response (0xa0)
Function: NT QUERY SECURITY DESC (6)
Word Count (WCT): 18
Reserved: 000000
Total Parameter Count: 4
Total Data Count: 48
Parameter Count: 4
Parameter Offset: 72
Parameter Displacement: 0
Data Count: 48
Data Offset: 76
Data Displacement: 0
Setup Count: 0
Byte Count (BCC): 53
Padding: 0B
NT QUERY SECURITY DESC Parameters
NT Security Descriptor Length: 48
NT QUERY SECURITY DESC Data
NT Security Descriptor
Revision: 1
Type: 0x8004
1... .... .... .... = Self Relative: This SecDesc is SELF RELATIVE
.0.. .... .... .... = RM Control Valid: Rm control valid is FALSE
..0. .... .... .... = SACL Protected: The SACL is NOT protected
...0 .... .... .... = DACL Protected: The DACL is NOT protected
.... 0... .... .... = SACL Auto Inherited: SACL is NOT auto inherited
.... .0.. .... .... = DACL Auto Inherited: DACL is NOT auto inherited
.... ..0. .... .... = SACL Auto Inherit Required: SACL does NOT require auto inherit
.... ...0 .... .... = DACL Auto Inherit Required: DACL does NOT require auto inherit
.... .... 0... .... = Server Security: Server security is FALSE
.... .... .0.. .... = DACL Trusted: Dacl trusted is FALSE
.... .... ..0. .... = SACL Defaulted: SACL is NOT defaulted
.... .... ...0 .... = SACL Present: SACL is NOT present
.... .... .... 0... = DACL Defaulted: DACL is NOT defaulted
.... .... .... .1.. = DACL Present: DACL is PRESENT
.... .... .... ..0. = Group Defaulted: Group is NOT defaulted
.... .... .... ...0 = Owner Defaulted: Owner is NOT defaulted
Offset to owner SID: 0
Offset to group SID: 0
Offset to SACL: 0
Offset to DACL: 20
NT User (DACL) ACL
Revision: 2
Size: 28
Num ACEs: 1
NT ACE: S-1-1-0, flags 0x03, Access Allowed, mask 0x001f01ff
Type: Access Allowed (0)
NT ACE Flags: 0x03 Container Inherit, Object Inherit
0... .... = Audit Failed Accesses: Failed accesses will not be audited
.0.. .... = Audit Successful Accesses: Successful accesses will not be audited
...0 .... = Inherited ACE: This ACE was not inherited from its parent object
.... 0... = Inherit Only: This ACE applies to the current object
.... .0.. = Non-Propagate Inherit: Subordinate object will propagate the inherited ACE further
.... ..1. = Container Inherit: Subordinate containers will inherit this ACE
.... ...1 = Object Inherit: Subordinate files will inherit this ACE
Size: 20
Access required: 0x001f01ff
Generic rights: 0x00000000
0... .... .... .... .... .... .... .... = Generic read: Not set
.0.. .... .... .... .... .... .... .... = Generic write: Not set
..0. .... .... .... .... .... .... .... = Generic execute: Not set
...0 .... .... .... .... .... .... .... = Generic all: Not set
.... ..0. .... .... .... .... .... .... = Maximum allowed: Not set
.... .... 0... .... .... .... .... .... = Access SACL: Not set
Standard rights: 0x001f0000
.... .... ...1 .... .... .... .... .... = Synchronise: Set
.... .... .... 1... .... .... .... .... = Write owner: Set
.... .... .... .1.. .... .... .... .... = Write DAC: Set
.... .... .... ..1. .... .... .... .... = Read control: Set
.... .... .... ...1 .... .... .... .... = Delete: Set
Specific rights: 0x000001ff
.... .... .... .... 0... .... .... .... = Specific access, bit 15: Not set
.... .... .... .... .0.. .... .... .... = Specific access, bit 14: Not set
.... .... .... .... ..0. .... .... .... = Specific access, bit 13: Not set
.... .... .... .... ...0 .... .... .... = Specific access, bit 12: Not set
.... .... .... .... .... 0... .... .... = Specific access, bit 11: Not set
.... .... .... .... .... .0.. .... .... = Specific access, bit 10: Not set
.... .... .... .... .... ..0. .... .... = Specific access, bit 9: Not set
.... .... .... .... .... ...1 .... .... = Specific access, bit 8: Set
.... .... .... .... .... .... 1... .... = Specific access, bit 7: Set
.... .... .... .... .... .... .1.. .... = Specific access, bit 6: Set
.... .... .... .... .... .... ..1. .... = Specific access, bit 5: Set
.... .... .... .... .... .... ...1 .... = Specific access, bit 4: Set
.... .... .... .... .... .... .... 1... = Specific access, bit 3: Set
.... .... .... .... .... .... .... .1.. = Specific access, bit 2: Set
.... .... .... .... .... .... .... ..1. = Specific access, bit 1: Set
.... .... .... .... .... .... .... ...1 = Specific access, bit 0: Set
ACE: S-1-1-0
Revision: 1
Num Auth: 1
Authority: 1
Sub-authorities: 0
0030 00 00 00 7c ff 53 4d 42 a0 00 ...|.SMB..
0040 00 00 00 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 08 28 06 01 08 c2 70 12 00 00 00 04 00 ....(....p......
0060 00 00 30 00 00 00 04 00 00 00 48 00 00 00 00 00 ..0.......H.....
0070 00 00 30 00 00 00 4c 00 00 00 00 00 00 00 00 35 ..0...L........5
0080 00 0b 30 00 00 00 01 00 04 80 00 00 00 00 00 00 ..0.............
0090 00 00 00 00 00 00 14 00 00 00 02 00 1c 00 01 00 ................
00a0 00 00 00 03 14 00 ff 01 1f 00 01 01 00 00 00 00 ................
00b0 00 01 00 00 00 00 ......
--------------------------------------------------------------------------
☆ PFC_OBJECT_UUID标志位
一般来说，RPC层的Packet Flags字段等于0x03，如果PFC_OBJECT_UUID标志位置位，
RPC首部在常规24字节的尾部多出来16字节的UUID，换句话说，RPC首部变成40字节。
参看如下链接中对PFC_OBJECT_UUID的解释:
[url]http://www.opengroup.org/onlinepubs/9692999399/chap12.htm#tagcjh_17_06_03_01[/url]
[url]http://www.opengroup.org/onlinepubs/9692999399/chap12.htm#tagcjh_17_06_04_09[/url]
协议分析时要考虑PFC_OBJECT_UUID标志位。不要对Bind包做特殊处理。对Request包
要特殊处理。如果PFC_OBJECT_UUID标志位置位，Request包中必然包含有效接口UUID，
可以在单包中同时获取Opnum与接口UUID。
Ethereal 0.10.13可以正确解码PFC_OBJECT_UUID标志位置位的报文，而Sniffer Pro
4.70.564不能。
自己写程序对135/TCP口进行DUMP操作，下面是相应报文(SMB_37_8.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 43621, Dst Port: 135, Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x83
1... .... = Object: Set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: e1af8308-5d1f-11c9-91a4-08002b14a0fa
Interface Ver: 3
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 05 00 0b 83 10 00 00 00 48 00 00 00 01 00 ........H.....
0050 00 00 b8 10 b8 10 00 00 00 00 01 00 00 00 00 00 ................
0060 01 00 08 83 af e1 1f 5d c9 11 91 a4 08 00 2b 14 .......]......+.
0070 a0 fa 03 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 .......]........
0080 08 00 2b 10 48 60 02 00 00 00 ..+.H`....
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00011ddf
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0040 05 00 0c 03 10 00 00 00 3c 00 00 00 01 00 ........<.....
0050 00 00 b8 10 b8 10 df 1d 01 00 04 00 31 33 35 00 ............135.
0060 30 c2 01 00 00 00 00 00 00 00 04 5d 88 8a eb 1c 0..........]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
DCE RPC Request, Fragment: Single, FragLen: 80, Call: 1 Ctx: 0, [Resp: #4]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x83
1... .... = Object: Set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 80
Auth Length: 0
Call ID: 1
Alloc hint: 40
Context ID: 0
Opnum: 2
Object UUID: e1af8308-5d1f-11c9-91a4-08002b14a0fa
Response in frame: 4
DCE/RPC Endpoint Mapper, Lookup
Operation: Lookup (2)
Inquiry type: rpc_c_ep_all_elts (0)
(NULL pointer) Object:
(NULL pointer) Interface:
Version Option: 0
Handle: 0000000000000000000000000000000000000000
Max entries: 1
0040 05 00 00 83 10 00 00 00 50 00 00 00 01 00 ........P.....
0050 00 00 28 00 00 00 00 00 02 00 08 83 af e1 1f 5d ..(............]
0060 c9 11 91 a4 08 00 2b 14 a0 fa 00 00 00 00 00 00 ......+.........
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
0090 00 00 ..
DCE RPC Response, Fragment: Single, FragLen: 204, Call: 1 Ctx: 0, [Req: #3]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 204
Auth Length: 0
Call ID: 1
Alloc hint: 180
Context ID: 0
Cancel count: 0
Opnum: 2
Request in frame: 3
Time from request: 0.001162000 seconds
DCE/RPC Endpoint Mapper, Lookup
Operation: Lookup (2)
Handle: 000000003ED8635360C10A4DA82A977E3CEBC27F
Num entries: 1
Entries:
Max Count: 1
Offset: 0
Actual Count: 1
Entry:
Object: 00000000-0000-0000-0000-000000000000
Tower pointer:
Referent ID: 0x00000001
Length: 98
Length: 98
Number of floors: 5
Floor 1 UUID: bfa951d1-2f0e-11d3-bfd1-00c04fa3490a Version 1.0
LHS Length: 19
Protocol: UUID (0x0d)
UUID: bfa951d1-2f0e-11d3-bfd1-00c04fa3490a
Version 1.0
RHS Length: 2
not decoded yet
Floor 2 UUID: 8a885d04-1ceb-11c9-9fe8-08002b104860 Version 2.0
LHS Length: 19
Protocol: UUID (0x0d)
UUID: 8a885d04-1ceb-11c9-9fe8-08002b104860
Version 2.0
RHS Length: 2
not decoded yet
Floor 3 RPC connection-oriented protocol
LHS Length: 1
Protocol: RPC connection-oriented protocol (0x0b)
RHS Length: 2
Floor 4
LHS Length: 1
Protocol: Appletalk Stream (0x16)
RHS Length: 13
not decoded yet
Floor 5
LHS Length: 1
Protocol: Appletalk (0x18)
RHS Length: 16
not decoded yet
Annotation offset: 0
Annotation length: 1
Annotation:
Return code: 0x00000000
0040 05 00 02 03 10 00 00 00 cc 00 00 00 01 00 ..............
0050 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 3e d8 ..............>.
0060 63 53 60 c1 0a 4d a8 2a 97 7e 3c eb c2 7f 01 00 cS`..M.*.~<.....
0070 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
0090 00 00 00 00 00 00 01 00 00 00 00 00 00 00 62 00 ..............b.
00a0 00 00 62 00 00 00 05 00 13 00 0d d1 51 a9 bf 0e ..b.........Q...
00b0 2f d3 11 bf d1 00 c0 4f a3 49 0a 01 00 02 00 00 /......O.I......
00c0 00 13 00 0d 04 5d 88 8a eb 1c c9 11 9f e8 08 00 .....]..........
00d0 2b 10 48 60 02 00 02 00 00 00 01 00 0b 02 00 00 +.H`............
00e0 00 01 00 16 0d 00 44 79 6e 45 70 74 20 34 61 63 ......DynEpt 4ac
00f0 2e 31 00 01 00 18 10 00 4e 53 46 4f 43 55 53 2d .1......NSFOCUS-
0100 49 50 48 36 52 46 38 00 00 00 00 00 00 00 IPH6RF8.......
--------------------------------------------------------------------------
☆ MS02-045/Q326830
这个漏洞是02年8月22日在BugTraq邮件列表上被披露的。当时正是受这个漏洞影响，
决定系统整理一次SMB协议相关文档，才开始写这个系列的。
这是smbdie.exe([14])发送出来的攻击报文(SMB_37_9.cap):
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 4658, Dst Port: 139, Len: 99
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
.... ...0 = Add 0 to length
Length: 95
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
Error Class: Success (0x00)
Reserved: 00
Error Code: No Error
Flags: 0x00
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0x0000
0... .... .... .... = Unicode Strings: Strings are ASCII
.0.. .... .... .... = Error Code Type: Error codes are DOS error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .0.. = Security Signatures: Security signatures are not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are not supported
.... .... .... ...0 = Long Names Allowed: Long file names are not allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 1060
User ID: 2048
Multiplex ID: 0
Trans Request (0x25)
Word Count (WCT): 14
Total Parameter Count: 19
Total Data Count: 0
Max Parameter Count: 0
Max Data Count: 0
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 19
Parameter Offset: 76
Data Count: 0
Data Offset: 95
Setup Count: 0
Reserved: 00
Byte Count (BCC): 32
Transaction Name: /PIPE/LANMAN
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
Function Code: NetServerEnum2 (104)
Parameter Descriptor: WrLeh
Return Descriptor: B13BWz
Detail Level: 1
Receive Buffer Length: 65504
0030 00 00 00 5f ff 53 4d 42 25 00 ..._.SMB%.
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 24 04 00 08 00 00 0e 13 00 00 00 00 ....$...........
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 13 00 4c ...............L
0070 00 00 00 5f 00 00 00 20 00 5c 50 49 50 45 5c 4c ..._... ./PIPE/L
0080 41 4e 4d 41 4e 00 68 00 57 72 4c 65 68 00 42 31 ANMAN.h.WrLeh.B1
0090 33 42 57 7a 00 01 00 e0 ff 3BWz.....
--------------------------------------------------------------------------
这里Max Parameter Count、Max Data Count字段同时清零了，据CORE的报告不必同
时清零，是逻辑或的关系。vertex提供过一个针对Samba源码的patch，用于完成此攻
击，他也是将前述两个字段同时清零了。也就是说，公开发布的Exploit均将前述两
个字段同时清零。
攻击报文并不是在真实的NetServerEnum2()调用报文基础上修改而来。但是，攻击报
文仍完成了攻击。基于我们对SMB协议多年的跟踪分析，这个攻击报文是在
NetShareEnum()调用报文基础上修改而来，简单地将Function Code由0x0000换成
0x0068而得。
☆ WildPackets Free Filters for Detecting Malicious Worms/Viruses
在[url]www.netexpert.cn[/url]上有人贴了一个CAP文件，用WildPackets提供的Sasser Filter
([15])捕获到的部分报文，找人给分析一下，我就简单看了看，记录在此，备忘。
首先，他提供的CAP文件是高版本的，当时手头的台式机上没有装相应版本的软件，
好在有Ethereal 0.10.13，照看不误，因此下面的的某些字段，以Ethereal显示为例。
其次，这个Sasser Filter也是高版本的，直接用xml编写的，我没法在原软件中导入
过滤器并查看，只好用UltraEdit打开，当成文本看。
这样很可能绕了一个大弯，高版本软件本身应该带有文档介绍xml格式的过滤器吧，
笔记本又不在手边，不管了，硬看吧。如果做了无用功，也无所谓，此类分析本就要
做好这个思想准备。
Sasser Worm利用的是MS04-011/KB835732，关于漏洞本身不在此重复。参看:
<
为完成攻击，肯定有一个针对"3919286a-b10c-11d0-9ba8-00c04fd92ef5 0.0"的BIND
操作。可以就此设计单包过滤器。这次是"BIND Over SMB"，不涉及动态RPC端口，目
标端口只可能是139/TCP或445/TCP。
漏洞对应的是9号调用lsasrv!DsRolerUpgradeDownlevelServer()，但客户端实现
netapi32!DsRoleUpgradeDownlevelServer()时不允许远程调用Opnum 9，只能向本机
请求调用Opnum 9，这意味着Opnum 9对应的报文正常情况下永远不会出现在网络上。
而蠕虫必然会发出Opnum 9对应的报文，可以就此设计另一个单包过滤器。
如果所用软件支持多包过滤器，应该设计多包过滤器，以减少误报。
那位同学提供的CAP文件全是误报，简化后有两类误报，见SMB_37_11.cap:
--------------------------------------------------------------------------
Transmission Control Protocol, Src Port: 4409, Dst Port: 445, Len: 1312
NetBIOS Session Service
Message Type: Session message
Length: 1308
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 432
User ID: 2048
Multiplex ID: 448
Trans Request (0x25)
Word Count (WCT): 16
Total Parameter Count: 0
Total Data Count: 1224
Max Parameter Count: 0
Max Data Count: 1024
Max Setup Count: 0
Reserved: 00
Flags: 0x0000
.... .... .... ..0. = One Way Transaction: Two way transaction
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Timeout: Return immediately (0)
Reserved: 0000
Parameter Count: 0
Parameter Offset: 84
Data Count: 1224
Data Offset: 84
Setup Count: 2
Reserved: 00
Byte Count (BCC): 1241
Transaction Name: /PIPE/
Padding: 0000
SMB Pipe Protocol
Function: TransactNmPipe (0x0026)
FID: 0x4000
DCE RPC Request, Fragment: Single, FragLen: 1224, Call: 2 Ctx: 0
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 1224
Auth Length: 0
Call ID: 2
Alloc hint: 1200
Context ID: 0
Opnum: 8
Stub data (1200 bytes)
0030 00 00 05 1c ff 53 4d 42 25 00 .....SMB%.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 b0 01 00 08 c0 01 10 00 00 c8 04 00 ................
0060 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 c8 04 54 00 02 00 26 00 00 40 d9 04 00 5c 00 ...T...&..@.../.
0080 50 00 49 00 50 00 45 00 5c 00 00 00 00 00 05 00 P.I.P.E./.......
0090 00 03 10 00 00 00 c8 04 00 00 02 00 00 00 b0 04 ................
00a0 00 00 00 00 08 00 ......
[snip]
Transmission Control Protocol, Src Port: 1089, Dst Port: 445, Len: 158
NetBIOS Session Service
Message Type: Session message
Length: 154
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: NT Create AndX (0xa2)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x18
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...1 .... = Canonicalized Pathnames: Pathnames are canonicalized
.... 1... = Case Sensitivity: Path names are caseless
.... ..0. = Receive Buffer Posted: Receive buffer has not been posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc807
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported
.... .... .0.. .... = Long Names Used: Path names in request are not long file names
.... .... .... .1.. = Security Signatures: Security signatures are supported
.... .... .... ..1. = Extended Attributes: Extended attributes are supported
.... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 26625
Process ID: 304
User ID: 51201
Multiplex ID: 32704
NT Create AndX Request (0xa2)
Word Count (WCT): 24
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 57054
Reserved: 00
File Name Len: 68
Create Flags: 0x00000016
.... .... .... .... .... .... ...1 .... = Extended Response: Extended responses required
.... .... .... .... .... .... .... 0... = Create Directory: Target of open can be a file
.... .... .... .... .... .... .... .1.. = Batch Oplock: Requesting BATCH OPLOCK
.... .... .... .... .... .... .... ..1. = Exclusive Oplock: Requesting OPLOCK
Root FID: 0x00000000
Access Mask: 0x0002019f
0... .... .... .... .... .... .... .... = Generic Read: Generic read is NOT set
.0.. .... .... .... .... .... .... .... = Generic Write: Generic write is NOT set
..0. .... .... .... .... .... .... .... = Generic Execute: Generic execute is NOT set
...0 .... .... .... .... .... .... .... = Generic All: Generic all is NOT set
.... ..0. .... .... .... .... .... .... = Maximum Allowed: Maximum allowed is NOT set
.... ...0 .... .... .... .... .... .... = System Security: System security is NOT set
.... .... ...0 .... .... .... .... .... = Synchronize: Can NOT wait on handle to synchronize on completion of I/O
.... .... .... 0... .... .... .... .... = Write Owner: Can NOT write owner (take ownership)
.... .... .... .0.. .... .... .... .... = Write DAC: Owner may NOT write to the DAC
.... .... .... ..1. .... .... .... .... = Read Control: READ ACCESS to owner, group and ACL of the SID
.... .... .... ...0 .... .... .... .... = Delete: NO delete access
.... .... .... .... .... ...1 .... .... = Write Attributes: WRITE ATTRIBUTES access
.... .... .... .... .... .... 1... .... = Read Attributes: READ ATTRIBUTES access
.... .... .... .... .... .... .0.. .... = Delete Child: NO delete child access
.... .... .... .... .... .... ..0. .... = Execute: NO execute access
.... .... .... .... .... .... ...1 .... = Write EA: WRITE EXTENDED ATTRIBUTES access
.... .... .... .... .... .... .... 1... = Read EA: READ EXTENDED ATTRIBUTES access
.... .... .... .... .... .... .... .1.. = Append: APPEND access
.... .... .... .... .... .... .... ..1. = Write: WRITE access
.... .... .... .... .... .... .... ...1 = Read: READ access
Allocation Size: 0
File Attributes: 0x00000080
.... .... .... .... .0.. .... .... .... = Encrypted: This is NOT an encrypted file
.... .... .... .... ..0. .... .... .... = Content Indexed: This file MAY be indexed by the content indexing service
.... .... .... .... ...0 .... .... .... = Offline: This file is NOT offline
.... .... .... .... .... 0... .... .... = Compressed: This is NOT a compressed file
.... .... .... .... .... .0.. .... .... = Reparse Point: This file does NOT have an associated reparse point
.... .... .... .... .... ..0. .... .... = Sparse: This is NOT a sparse file
.... .... .... .... .... ...0 .... .... = Temporary: This is NOT a temporary file
.... .... .... .... .... .... 1... .... = Normal: This file is an ordinary file
.... .... .... .... .... .... .0.. .... = Device: This is NOT a device
.... .... .... .... .... .... ..0. .... = Archive: This file has NOT been modified since last archive
.... .... .... .... .... .... ...0 .... = Directory: This is NOT a directory
.... .... .... .... .... .... .... 0... = Volume ID: This is NOT a volume ID
.... .... .... .... .... .... .... .0.. = System: This is NOT a system file
.... .... .... .... .... .... .... ..0. = Hidden: This is NOT a hidden file
.... .... .... .... .... .... .... ...0 = Read Only: This file is NOT read only
Share Access: 0x00000003
.... .... .... .... .... .... .... .0.. = Delete: Object can NOT be shared for delete
.... .... .... .... .... .... .... ..1. = Write: Object can be shared for WRITE
.... .... .... .... .... .... .... ...1 = Read: Object can be shared for READ
Disposition: Create (if file exists fail, else create it) (2)
Create Options: 0x00000040
.... .... .... .... .... .... .... ...0 = Directory: File being created/opened must not be a directory
.... .... .... .... .... .... .... ..0. = Write Through: Writes need not flush buffered data before completing
.... .... .... .... .... .... .... .0.. = Sequential Only: The file might not only be accessed sequentially
.... .... .... .... .... .... ...0 .... = Sync I/O Alert: Operations NOT necessarily synchronous
.... .... .... .... .... .... ..0. .... = Sync I/O Nonalert: Operations NOT necessarily synchronous
.... .... .... .... .... .... .1.. .... = Non-Directory: File being created/opened must not be a directory
.... .... .... .... .... ..0. .... .... = No EA Knowledge: The client understands extended attributes
.... .... .... .... .... .0.. .... .... = 8.3 Only: The client understands long file names
.... .... .... .... .... 0... .... .... = Random Access: The file will not be accessed randomly
.... .... .... .... ...0 .... .... .... = Delete On Close: The file should not be deleted when it is closed
Impersonation: Impersonation (2)
Security Flags: 0x03
.... ...1 = Context Tracking: Security tracking mode is DYNAMIC
.... ..1. = Effective Only: ONLY ENABLED aspects of the client's security context are available
Byte Count (BCC): 71
File Name: /panda/adidas/05Dec/12.30/D7AA6100
0030 00 00 00 9a ff 53 4d 42 a2 00 .....SMB..
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 01 68 30 01 01 c8 c0 7f 18 ff 00 de de 00 ...h0...........
0060 44 00 16 00 00 00 00 00 00 00 9f 01 02 00 00 00 D...............
0070 00 00 00 00 00 00 80 00 00 00 03 00 00 00 02 00 ................
0080 00 00 40 00 00 00 02 00 00 00 03 47 00 00 5c 00 [email protected]../.
0090 70 00 61 00 6e 00 64 00 61 00 5c 00 61 00 64 00 p.a.n.d.a./.a.d.
00a0 69 00 64 00 61 00 73 00 5c 00 30 00 35 00 44 00 i.d.a.s./.0.5.D.
00b0 65 00 63 00 5c 00 31 00 32 00 2e 00 33 00 30 00 e.c./.1.2...3.0.
00c0 5c 00 44 00 37 00 41 00 41 00 36 00 31 00 30 00 /.D.7.A.A.6.1.0.
00d0 30 00 00 00 0...
--------------------------------------------------------------------------
第一个报文，从Ethereal的显示中可以看到Opnum 8。那位同学没有捕获BIND操作，
这个Opnum 8究竟对应哪个接口UUID不得而知，但只要不是9，从原理上就可以判定是
误报了。本节关心的是为什么会产生这个误报。
用UltraEdit打开sasser1.flt，这是个xml文件(感谢watercloud对行号显示的支持):
--------------------------------------------------------------------------
1:
显然这里才是过滤器开始的地方。
2:
3:
4:
5:
2-5行想必是说物理帧总长位于[200,1518]区间，从1518判断，WildPackets是将结尾
的四字节CRC检验和算进去了。
6:
表示前面那个filternode与后续规则是逻辑与的关系。
7:
8:
9:
这个协议规则是什么，我也没看明白。
10:
继续逻辑与。注意缩进的意义。
11:
12:
13:
14:
15:
16:
目标端口139。不要源端口139的。这里type="34"不是说物理帧偏移+0x022，而是说
data="008B"是用16进制表示的unsigned short int。我是怎么知道的？靠，结合上
下文大胆假设、小心求证出来的呗，还能怎么知道。
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
我们不想分析整个xml文件，只关心误报起因，忽略17-34行。再次提醒，注意缩进。
35:
逻辑或。
36:
37:
38:
39:
40:
41:
目标端口445。不要源端口445的。目标与源的关系靠accept1to2、accept2to1体现。
42:
逻辑与。注意and、or的优先级。
43:
44:
45:
46:
一个弱智的冗余，可以删除。
47:
48:
49:
50:
51:
52:
53:
54:
type="0"表示一个字节的10进制数据。offset等于62，即物理帧偏移+0x03E。看看两
个引起误报的报文，这个位置是SMB Command字段。
117即SMB_COM_TREE_CONNECT_ANDX(0x75)。
55:
56:
57:
58:
59:
60:
61:
62:
63:
我们这次不关心SMB_COM_TREE_CONNECT_ANDX(0x75)，略过55-63行。
64:
65:
66:
67:
68:
69:
70:
71:
type="4"表示四个字节的10进制数据。524744即0x000801C8，这是按网络字节序取上
来的值。实际是在检查Flags、Flags2字段。略过。
72:
73:
74:
75:
76:
77:
78:
79:
80:
略过72-80行。
81:
82:
83:
84:
85:
86:
87:
88:
SMB_COM_SESSION_SETUP_ANDX(0x73)。略过。
89:
90:
91:
92:
93:
94:
95:
96:
97:
略过89-97行。
98:
99:
100:
101:
102:
103:
104:
105:
SMB_COM_NT_CREATE_ANDX(0xA2)。注意看引起误报的第二个报文。
106:
107:
108:
109:
110:
111:
112:
113:
type="2"表示两个字节的10进制数据。57054即0xDEDE，实际是在检查AndXOffset字
段。由于前面是SMB_COM_NONE(0xFF)，该字段无意义，可为任意值。
114:
115:
116:
117:
118:
119:
120:
121:
122:
在[+0x064,+0x078]上搜索"Access Mask: 0x0002019f"。patterntype data="2"表示
patterndata data="9F010200"指定的是16进制字节流，注意是字节流。大小写敏感
搜索。我觉得这里没必要用搜索，因为检查AndXOffset字段时已经假设了固定偏移，
而Access Mask字段与AndXOffset字段之间的偏移也是固定的。
引起误报的第二个报文正是在此被抠住的。这完全是一个扯淡的过滤规则。
123:
124:
125:
126:
127:
128:
129:
130:
131:
从未见过SMB Command字段等于0x3F，不清楚WildPackets想干什么。略过。
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
略过132-149行。
150:
151:
152:
153:
154:
155:
156:
157:
SMB_COM_TRANSACTION(0x25)。注意看引起误报的第一个报文。
158:
逻辑与。
159:
160:
161:
162:
163:
164:
165:
mask type="4" data="65535"表示掩码是0x0000FFFF。637534272即0x26000040，对
应Function: TransactNmPipe (0x0026)、FID: 0x4000。显然FID不固定，不能用作
检查点，这点靠掩码保证。
应该是先将掩码按little-endian序展开成字节流"FF FF 00 00"，然后对字节流"26
00 00 40"应用掩码，对物理帧偏移+0x077处的四字节流应用掩码，比较二者是否相
等。
166:
167:
168:
169:
170:
171:
172:
173:
83886083即0x05000003，这是在检查如下几个字段(+0x08E):
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
遗憾的是，WildPackets只检查了是DCE Request(0)报文，却未检查Opnum。Opnum字
段与Version字段之间的偏移是固定的，完全可以检查Opnum。
174:
175:
176:
177:
178:
179:
180:
181:
182:
Frag Length字段(+0x096)大于(可能包含等于关系)1024。在GUI中应该可以看到是否
包含等于关系，我这是硬搞xml文件，所以不确定。
op data="2"与flags data="0"这两个中肯定有一个表示逻辑运算关系，比如>、<、
>=、<=、==、!=。另一个表示按什么字节序取报文中的数据或者是按什么字节序解释
xml文件中指定的特征值。仅从本xml文件无法判断出对应关系，不过只要取样够多，
很容易判断出来的。
引起误报的第一个报文在此被抠住。这条过滤规则的中心思想是说超大的"Request
Over Transaction"报文出现时报警。问题在于阈值1024很容易在正常报文中出现，
不误报才怪。
183:
184:
185:
整个过滤器未检查SMB_COM_WRITE_ANDX(0x2F)，因为该过滤器是抠Sasser Worm，不
是抠MS04-011/KB835732 Exploit，后者是前者的超集。该过滤器会漏报非蠕虫的攻
击，当然WildPackets没有义务理会这一点。
略过后续行。
186:
187:
188:
189:
190:
191:
因为与本节主旨无关，192行后面的不再继续分析，忽略。
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
--------------------------------------------------------------------------
现在流行用xml写过滤器？我是跟不上这形势，也很少折腾这些东西。WildPackets提
供了另外几个蠕虫的过滤器([15])，看完本节后，有兴趣的话可以自己去分析一下。
不过，不建议做这种无谓的分析，能从GUI上看的时候何苦来看xml文件呢。记录于此，
仅作备忘。
☆ /pipe/epmapper
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s08.html[/url]
这个链接是一篇长文中的一小节，全文都值得一看。
> net use //10.10.7.44/ipc$ "" /user:""
The command completed successfully.
> ifids.exe -p ncacn_np -e /pipe/epmapper -t 10.10.7.44
Interfaces[11] :
Interface UUID : e1af8308-5d1f-11c9-91a4-08002b14a0fa version 3.0 !!!
Interface UUID : 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b version 1.1
Interface UUID : 975201b0-59ca-11d0-a8d5-00a0c90d8051 version 1.0
Interface UUID : e60c73e6-88f9-11cf-9af1-0020af6e72f4 version 2.0
Interface UUID : 99fcfec4-5260-101b-bbcb-00aa0021347a version 0.0
Interface UUID : b9e79e60-3d52-11ce-aaa1-00006901293f version 0.2
Interface UUID : 412f241e-c12a-11ce-abff-0020af6e7a17 version 0.2
Interface UUID : 00000136-0000-0000-c000-000000000046 version 0.0
Interface UUID : c6f3ee72-ce7e-11d1-b71e-00c04fc3111a version 1.0
Interface UUID : 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 version 0.0
Interface UUID : 000001a0-0000-0000-c000-000000000046 version 0.0
建立空会话是必要步骤。有人什么也没得到，最大可能是忘记或不清楚需要提前建立
SMB会话才能访问远程命名管道。访问本地命名管道时无需提前建立SMB会话。
捕获前述操作，保存成SMB_37_12.cap:
--------------------------------------------------------------------------
Frame 1
NetBIOS Session Service
Message Type: Session message
Length: 104
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: NT Create AndX (0xa2)
File Name: /epmapper
Frame 3
Transmission Control Protocol, Src Port: 4763, Dst Port: 445, Len: 140
NetBIOS Session Service
Message Type: Session message
Length: 136
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: afa8bd80-7d8a-11c9-bef4-08002b102989
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Frame 6
Transmission Control Protocol, Src Port: 445, Dst Port: 4763, Len: 136
NetBIOS Session Service
Message Type: Session message
Length: 132
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Read AndX (0x2e)
DCE RPC Bind_ack, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00011dfc
Scndry Addr len: 15
Scndry Addr: /pipe/epmapper
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
--------------------------------------------------------------------------
Frame 1-6:
打开命名管道/pipe/epmapper，先做BIND操作，这次是"BIND Over Write AndX"。这
可是标准Windows API激发出来的报文。接口UUID是MGMT:
afa8bd80-7d8a-11c9-bef4-08002b102989
可能你注意到MGMT并未出现在ifids.exe返回结果中，但通过/pipe/epmapper确实可
以访问到MGMT。这类情形以后你还会在不同场合碰上。
Frame 7-8:
然后请求0号调用完成特定功能:
--------------------------------------------------------------------------
Frame 7 (166 bytes on wire, 166 bytes captured)
NetBIOS Session Service
Message Type: Session message
Length: 108
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
DCE RPC Request, Fragment: Single, FragLen: 24, Call: 1 Ctx: 0, [Resp: #8]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 24
Auth Length: 0
Call ID: 1
Alloc hint: 0
Context ID: 0
Opnum: 0
Response in frame: 8
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
0080 05 00 ..
0090 00 03 10 00 00 00 18 00 00 00 01 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 ......
Frame 8 (418 bytes on wire, 418 bytes captured)
NetBIOS Session Service
Message Type: Session message
Length: 360
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Trans (0x25)
DCE RPC Response, Fragment: Single, FragLen: 304, Call: 1 Ctx: 0, [Req: #7]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 304
Auth Length: 0
Call ID: 1
Alloc hint: 280
Context ID: 0
Cancel count: 0
Opnum: 0
Request in frame: 7
Time from request: 0.000416000 seconds
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
Stub data (280 bytes)
0070 05 00 02 03 10 00 00 00 30 01 00 00 01 00 ........0.....
0080 00 00 18 01 00 00 00 00 00 00 30 a7 0d 00 0b 00 ..........0.....
0090 00 00 0b 00 00 00 00 e8 0d 00 e0 e7 0d 00 c8 2f .............../
00a0 0c 00 a8 2f 0c 00 88 2f 0c 00 e8 4b 0e 00 e8 3e .../.../...K...>
00b0 0c 00 58 9f 0d 00 30 ea 0d 00 10 eb 0d 00 70 ea ..X...0.......p.
00c0 0d 00 08 83 af e1 1f 5d c9 11 91 a4 08 00 2b 14 .......]......+.
00d0 a0 fa 03 00 00 00 84 65 0a 0b 0f 9e cf 11 a3 cf .......e........
00e0 00 80 5f 68 cb 1b 01 00 01 00 b0 01 52 97 ca 59 .._h........R..Y
00f0 d0 11 a8 d5 00 a0 c9 0d 80 51 01 00 00 00 e6 73 .........Q.....s
0100 0c e6 f9 88 cf 11 9a f1 00 20 af 6e 72 f4 02 00 ......... .nr...
0110 00 00 c4 fe fc 99 60 52 1b 10 bb cb 00 aa 00 21 ......`R.......!
0120 34 7a 00 00 00 00 60 9e e7 b9 52 3d ce 11 aa a1 4z....`...R=....
0130 00 00 69 01 29 3f 00 00 02 00 1e 24 2f 41 2a c1 ..i.)?.....$/A*.
0140 ce 11 ab ff 00 20 af 6e 7a 17 00 00 02 00 36 01 ..... .nz.....6.
0150 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 .............F..
0160 00 00 72 ee f3 c6 7e ce d1 11 b7 1e 00 c0 4f c3 ..r...~.......O.
0170 11 1a 01 00 00 00 b8 4a 9f 4d 1c 7d cf 11 86 1e .......J.M.}....
0180 00 20 af 6e 7c 57 00 00 00 00 a0 01 00 00 00 00 . .n|W..........
0190 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 .........F......
01a0 00 00 ..
--------------------------------------------------------------------------
Ethereal 0.10.13未对响应报文的RPC数据区解码。最后关闭前面打开的命名管道:
--------------------------------------------------------------------------
Frame 9
NetBIOS Session Service
Message Type: Session message
Length: 41
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Close (0x04)
--------------------------------------------------------------------------
现在让我们用ncacn_ip_tcp协议序列完成同样的0号调用:
> ifids.exe -p ncacn_ip_tcp -e 135 -t 10.10.7.44
Interfaces[11] :
Interface UUID : e1af8308-5d1f-11c9-91a4-08002b14a0fa version 3.0 !!!
Interface UUID : 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b version 1.1
Interface UUID : 975201b0-59ca-11d0-a8d5-00a0c90d8051 version 1.0
Interface UUID : e60c73e6-88f9-11cf-9af1-0020af6e72f4 version 2.0
Interface UUID : 99fcfec4-5260-101b-bbcb-00aa0021347a version 0.0
Interface UUID : b9e79e60-3d52-11ce-aaa1-00006901293f version 0.2
Interface UUID : 412f241e-c12a-11ce-abff-0020af6e7a17 version 0.2
Interface UUID : 00000136-0000-0000-c000-000000000046 version 0.0
Interface UUID : c6f3ee72-ce7e-11d1-b71e-00c04fc3111a version 1.0
Interface UUID : 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 version 0.0
Interface UUID : 000001a0-0000-0000-c000-000000000046 version 0.0
捕获前述操作，保存成SMB_37_13.cap:
--------------------------------------------------------------------------
Frame 1 (126 bytes on wire, 126 bytes captured)
Transmission Control Protocol, Src Port: 4789, Dst Port: 135, Len: 72
DCE RPC Bind, Fragment: Single, FragLen: 72, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 72
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: afa8bd80-7d8a-11c9-bef4-08002b102989
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0b 03 10 00 00 00 48 00 ........H.
0040 00 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 ................
0050 00 00 00 00 01 00 80 bd a8 af 8a 7d c9 11 be f4 ...........}....
0060 08 00 2b 10 29 89 01 00 00 00 04 5d 88 8a eb 1c ..+.)......]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 ......+.H`....
Frame 2 (114 bytes on wire, 114 bytes captured)
DCE RPC Bind_ack, Fragment: Single, FragLen: 60, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 60
Auth Length: 0
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00011e00
Scndry Addr len: 4
Scndry Addr: 135
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
0030 05 00 0c 03 10 00 00 00 3c 00 ........<.
0040 00 00 01 00 00 00 d0 16 d0 16 00 1e 01 00 04 00 ................
0050 31 33 35 00 65 5c 01 00 00 00 00 00 00 00 04 5d 135.e/.........]
0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
0070 00 00 ..
Frame 3 (78 bytes on wire, 78 bytes captured)
DCE RPC Request, Fragment: Single, FragLen: 24, Call: 1 Ctx: 0, [Resp: #4]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 24
Auth Length: 0
Call ID: 1
Alloc hint: 0
Context ID: 0
Opnum: 0
Response in frame: 4
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
0030 05 00 00 03 10 00 00 00 18 00 ..........
0040 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ..............
Frame 4 (358 bytes on wire, 358 bytes captured)
DCE RPC Response, Fragment: Single, FragLen: 304, Call: 1 Ctx: 0, [Req: #3]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 304
Auth Length: 0
Call ID: 1
Alloc hint: 280
Context ID: 0
Cancel count: 0
Opnum: 0
Request in frame: 3
Time from request: 0.000374000 seconds
DCE/RPC Remote Management, rpc__mgmt_inq_if_ids
Operation: rpc__mgmt_inq_if_ids (0)
Stub data (280 bytes)
--------------------------------------------------------------------------
与SMB_37_12.cap相比，SMB_37_13.cap的通信数据量要少得多，但可以完成同样的0
号调用。
前面都是铺垫，本节重点在于强调另一件事。在第一次ifids.exe的返回结果中看到
接口EPM:
e1af8308-5d1f-11c9-91a4-08002b14a0fa
这意味着通过/pipe/epmapper可以访问到EPM，意味着可以不经135/TCP而访问EPM:
> net use //10.10.7.44/ipc$ /d /y
//10.10.7.44/ipc$ was deleted successfully.
> net use //10.10.7.44/ipc$ "" /user:""
The command completed successfully.
> 135dump.exe -p ncacn_np -t 10.10.7.44
(略)
同样需要提前建立SMB会话，再执行135dump.exe。捕获操作保存成SMB_37_14.cap:
--------------------------------------------------------------------------
1 162 SMB 10.10.7.2 10.10.7.44 4811 445 NT Create AndX Request, Path: /epmapper
2 193 SMB 10.10.7.44 10.10.7.2 445 4811 NT Create AndX Response, FID: 0x4001
3 194 DCERPC 10.10.7.2 10.10.7.44 4811 445 Bind: call_id: 1 UUID: EPM
4 105 SMB 10.10.7.44 10.10.7.2 445 4811 Write AndX Response, FID: 0x4001, 72 bytes
5 117 SMB 10.10.7.2 10.10.7.44 4811 445 Read AndX Request, FID: 0x4001, 1024 bytes at offset 0
6 190 DCERPC 10.10.7.44 10.10.7.2 445 4811 Bind_ack: call_id: 1 accept max_xmit: 4280 max_recv: 4280
7 242 EPM 10.10.7.2 10.10.7.44 4811 445 Lookup request
8 318 EPM 10.10.7.44 10.10.7.2 445 4811 Lookup response
--------------------------------------------------------------------------
这次SMB会话用了445/TCP，下次可能用139/TCP。访问动态注册过的RPC Server时往
往需要先访问EPM获取动态注册的端点信息，普遍是通过135/TCP完成的，但实际上通
过139、445/TCP、135/UDP也可以。比如:
> 135dump.exe -p ncacn_ip_tcp -t 10.10.7.44
> 135dump.exe -p ncadg_ip_udp -t 10.10.7.44
关于135/UDP我单独写一节来讲，那个与135/TCP差别较大。再说/pipe/epmapper，可
能你测试的时候发现没有这个命名管道了，或者说没看到EPM绑定在其上，这也不奇
怪，这些东西MS说变就变的，天知道什么时候出个什么岔子就没了，但你最好清楚有
过这么件事，万一啥时候就用上了。
☆ 135/UDP相关讨论
1) XP SP1的msgsvc.dll(5.1.2600.1309)
> sc config Messenger start= demand
> sc start Messenger
> ifids.exe -p ncacn_np -e /pipe/msgsvc -t //.
... ...
Interface UUID : 17fdd703-1827-4e34-79d4-24a55c53bb37 version 1.0
在这个版本里只找到一个接口msgsvc:
uuid( 17fdd703-1827-4e34-79d4-24a55c53bb37 ),
version( 1.0 )
没有找到msgsvcsend:
uuid( 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc ),
version( 1.0 )
也没有发现接口msgsvc绑定在协议序列ncadg_ip_udp上。参看:
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s09.html[/url]
2) 中文2000的msgsvc.dll(5.0.2195.4874)
> net use //10.10.7.44/ipc$
> ifids.exe -p ncacn_np -e /pipe/msgsvc -t 10.10.7.44
... ...
Interface UUID : 17fdd703-1827-4e34-79d4-24a55c53bb37 version 1.0
Interface UUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0
> ifids.exe -p ncadg_ip_udp -e 1027 -t 10.10.7.44
(同上)
注意两点。一是空会话无权访问/pipe/msgsvc，所以我建立了管理员会话。二是你测
试时未必是1027/UDP，需要用其它手段获取这个端口号，比如在服务端执行netstat
查看，或者在客户端用135dump一类的工具获取。
逆向这个版本的msgsvc.dll，同时包含两个接口:
--------------------------------------------------------------------------
uuid( 17fdd703-1827-4e34-79d4-24a55c53bb37 ),
version( 1.0 )
/*
* 0x00 0x76812A32 _NetrMessageNameAdd@8
* 0x01 0x76813F2C _NetrMessageNameEnum@20
* 0x02 0x7681416B _NetrMessageNameGetInfo@16
* 0x03 0x768128F6 _NetrMessageNameDel@8
*/
--------------------------------------------------------------------------
uuid( 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc ),
version( 1.0 )
/*
* 0x00 0x76814725 _NetrSendMessage@12
*/
long NetrSendMessage
(
[in,string] char *from,
[in,string] char *to,
[in,string] char *str
);
--------------------------------------------------------------------------
泄露的MS源码中只有前一个接口，没有后一个接口。这次我们只关心msgsvcsend接口。
SMB_37_15.cap:
--------------------------------------------------------------------------
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Server
Max Count: 1
Offset: 0
Actual Count: 1
Server:
Client
Max Count: 1
Offset: 0
Actual Count: 1
Client:
Message
Max Count: 2
Offset: 0
Actual Count: 2
Message: /r
00a0 01 00 00 00 00 00 00 00 01 00 ..........
00b0 00 00 00 ff d0 11 01 00 00 00 00 00 00 00 01 00 ................
00c0 00 00 00 5d 88 8a 02 00 00 00 00 00 00 00 02 00 ...]............
00d0 00 00 0d 00 ....
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Return code: STATUS_SUCCESS (0x00000000)
0080 00 00 00 00 ....
--------------------------------------------------------------------------
Ethereal 0.10.14对此通信进行了解码，只是将from/to的关系搞反了。
测试ncadg_ip_udp协议序列(SMB_37_16.cap):
--------------------------------------------------------------------------
1 174 Messenger 10.10.7.2 10.10.7.44 3713 1027 NetrSendMessage request
2 142 UDP 10.10.7.44 10.10.7.2 2536 3713 Source port: 2536 Destination port: 3713
3 146 UDP 10.10.7.2 10.10.7.44 3713 2536 Source port: 3713 Destination port: 2536
4 122 DCERPC 10.10.7.44 10.10.7.2 2536 3713 Ack: seq: 0
5 126 Messenger 10.10.7.44 10.10.7.2 1027 3713 NetrSendMessage response
6 122 DCERPC 10.10.7.2 10.10.7.44 3713 1027 Ack: seq: 0 [req: #1]
Frame 1 (174 bytes on wire, 174 bytes captured)
Internet Protocol, Src: 10.10.7.2, Dst: 10.10.7.44
User Datagram Protocol, Src Port: 3713, Dst Port: 1027
DCE RPC Request, Seq: 0, Serial: 0, Frag: 0, FragLen: 52, [Resp: #5]
Version: 4
Packet type: Request (0)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 71aadcbf-bb40-44d4-9632-87084702e1de
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 52
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Response in frame: 5
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Server
Max Count: 4
Offset: 0
Actual Count: 4
Server: scz
Client
Max Count: 3
Offset: 0
Actual Count: 3
Client: tt
Message
Max Count: 8
Offset: 0
Actual Count: 8
Message: who r u
0020 04 00 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc bf dc aa 71 40 bb d4 44 96 32 87 08 47 02 [email protected].
0060 e1 de 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
0070 ff ff ff ff 34 00 00 00 00 00 04 00 00 00 00 00 ....4...........
0080 00 00 04 00 00 00 73 63 7a 00 03 00 00 00 00 00 ......scz.......
0090 00 00 03 00 00 00 74 74 00 00 08 00 00 00 00 00 ......tt........
00a0 00 00 08 00 00 00 77 68 6f 20 72 20 75 00 ......who r u.
Frame 2 (142 bytes on wire, 142 bytes captured)
Internet Protocol, Src: 10.10.7.44, Dst: 10.10.7.2
User Datagram Protocol, Src Port: 2536, Dst Port: 3713
Data (100 bytes)
0020 04 00 20 04 10 00 .. ...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00 ..v":3..........
0050 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19 ..h.Ov..
0070 ff ff ff ff 14 00 00 00 00 00 bf dc aa 71 40 bb .............q@.
0080 d4 44 96 32 87 08 47 02 e1 de 02 3c be 41 .D.2..G....<.A
Frame 3 (146 bytes on wire, 146 bytes captured)
Internet Protocol, Src: 10.10.7.2, Dst: 10.10.7.44
User Datagram Protocol, Src Port: 3713, Dst Port: 2536
Data (104 bytes)
0020 04 02 08 04 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00 ..v":3..........
0050 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19 ..h.Ov..
0070 ff ff ff ff 18 00 00 00 00 00 00 00 00 00 55 82 ..............U.
0080 72 8e a9 05 e7 4d a1 45 d3 e1 55 38 5f 0b 00 00 r....M.E..U8_...
0090 00 00 ..
Frame 4 (122 bytes on wire, 122 bytes captured)
Internet Protocol, Src: 10.10.7.44, Dst: 10.10.7.2
User Datagram Protocol, Src Port: 2536, Dst Port: 3713
DCE RPC Ack, Seq: 0, Serial: 1, Frag: 1, FragLen: 0
Version: 4
Packet type: Ack (7)
Flags1: 0x20 "Idempotent"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 0... = No Fack: Not set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 333a2276-0000-0000-0d00-00809c000000
Activity: 764fea68-a992-453c-8e5f-91b6cb191144
Server boot time: Unknown (0)
Interface Ver: 3
Sequence num: 0
Opnum: 1
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 0
Fragment num: 1
Auth proto: None (0)
Serial Low: 0x01
0020 04 07 20 00 10 00 .. ...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00 ..v":3..........
0050 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19 ..h.Ov..
0070 ff ff ff ff 00 00 01 00 00 01 ..........
Frame 5 (126 bytes on wire, 126 bytes captured)
Internet Protocol, Src: 10.10.7.44, Dst: 10.10.7.2
User Datagram Protocol, Src Port: 1027, Dst Port: 3713
DCE RPC Response, Seq: 0, Serial: 0, Frag: 0, FragLen: 4, [Req: #1]
Version: 4
Packet type: Response (2)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 71aadcbf-bb40-44d4-9632-87084702e1de
Server boot time: Dec 14, 2004 09:04:02.000000000
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x0036
Fragment len: 4
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Request in frame: 1
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Return code: STATUS_SUCCESS (0x00000000)
0020 04 02 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc bf dc aa 71 40 bb d4 44 96 32 87 08 47 02 [email protected].
0060 e1 de 02 3c be 41 01 00 00 00 00 00 00 00 00 00 ...<.A..........
0070 ff ff 36 00 04 00 00 00 00 00 00 00 00 00 ..6...........
Frame 6 (122 bytes on wire, 122 bytes captured)
Internet Protocol, Src: 10.10.7.2, Dst: 10.10.7.44
User Datagram Protocol, Src Port: 3713, Dst Port: 1027
DCE RPC Ack, Seq: 0, Serial: 1, Frag: 1, FragLen: 0, [Req: #1]
Version: 4
Packet type: Ack (7)
Flags1: 0x00
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 0... = No Fack: Not set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 71aadcbf-bb40-44d4-9632-87084702e1de
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x0036
Fragment len: 0
Fragment num: 1
Auth proto: None (0)
Serial Low: 0x01
Request in frame: 1
0020 04 07 00 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc bf dc aa 71 40 bb d4 44 96 32 87 08 47 02 [email protected].
0060 e1 de 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
0070 ff ff 36 00 00 00 01 00 00 01 ..6.......
--------------------------------------------------------------------------
这次不讨论Messenger服务本身，也不讨论"net send"相关命令，关心的是135/UDP上
的RPC通信。
135/TCP上跑的是DCE/RPC V5，135/UDP上跑的是DCE/RPC V4。V4的RPC头固定是80字
节，解码时与V5明显不同。让过V4的RPC头，接下来就是IDL文件相关的RPC数据区，
这部分与V5完全相同。Ethereal 0.10.14真是烂啊，以前有个版本可以对2、3号报文
解码的，现在居然不解了，真是见鬼，它们对应conv_who_are_you2()。而Sniffer
Pro 4.70.564错误解码如下:
--------------------------------------------------------------------------
CL/DCE RPC: ----- Connectionless MS DCE/RPC Header -----
CL/DCE RPC:
CL/DCE RPC: RPC Version = 4
CL/DCE RPC: PDU Type = 0 (Request)
CL/DCE RPC: flags1 = 20
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = NOT Broadcast Request
CL/DCE RPC: ..1. .... = Idempotent Request
CL/DCE RPC: ...0 .... = NOT Maybe Request
CL/DCE RPC: .... 0... = FACK required
CL/DCE RPC: .... .0.. = PDU is NOT fragment
CL/DCE RPC: .... ..0. = PDU is NOT last fragment
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: flags2 = 04
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = Reserved
CL/DCE RPC: ..0. .... = Reserved
CL/DCE RPC: ...0 .... = Reserved
CL/DCE RPC: .... 0... = Reserved
CL/DCE RPC: .... .1.. = Reserved
CL/DCE RPC: .... ..0. = Cancel not Pending at the call end
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: Data Representation Format Label = 100000
CL/DCE RPC: Serial Number (High Byte) = 0
CL/DCE RPC: OID = 00000000-0000-0000-0000-000000000000
CL/DCE RPC: IID = 333A2276-0000-0000-0D00-00809C000000
CL/DCE RPC: AID = 764FEA68-A992-453C-8E5F-91B6CB191144
CL/DCE RPC: Server Boot Time = 0
CL/DCE RPC: I/F Version = 3
CL/DCE RPC: Sequence number = 0
CL/DCE RPC: Operation Number (Method) = 1
CL/DCE RPC: Interface hint = 65535
CL/DCE RPC: Activity hint = 65535
CL/DCE RPC: Packet Body Length = 20
CL/DCE RPC: Fragment Number = 0
CL/DCE RPC: Authentication protocol ID = 0
CL/DCE RPC: Serial Number (Low Byte) = 0
CL/DCE RPC:
DCOM: ----- MS RPC Application Header -----
DCOM:
DCOM: RPC IID = Conversation Mgr
DCOM: *** Conversation Manager Interface ***
DCOM: Handle = 71aadcbf
DCOM: UUID = 44D4BB40-3296-0887-4702-E1DE023CBE41
ADDR HEX
0020: 04 00 20 04 10 00
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0040: 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00
0050: 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19
0060: 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00
0070: ff ff ff ff 14 00 00 00 00 00 bf dc aa 71 40 bb
0080: d4 44 96 32 87 08 47 02 e1 de 02 3c be 41
CL/DCE RPC: ----- Connectionless MS DCE/RPC Header -----
CL/DCE RPC:
CL/DCE RPC: RPC Version = 4
CL/DCE RPC: PDU Type = 2 (Response)
CL/DCE RPC: flags1 = 08
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = NOT Broadcast Request
CL/DCE RPC: ..0. .... = NOT Idempotent Request
CL/DCE RPC: ...0 .... = NOT Maybe Request
CL/DCE RPC: .... 1... = No FACK required
CL/DCE RPC: .... .0.. = PDU is NOT fragment
CL/DCE RPC: .... ..0. = PDU is NOT last fragment
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: flags2 = 04
CL/DCE RPC: 0... .... = Reserved
CL/DCE RPC: .0.. .... = Reserved
CL/DCE RPC: ..0. .... = Reserved
CL/DCE RPC: ...0 .... = Reserved
CL/DCE RPC: .... 0... = Reserved
CL/DCE RPC: .... .1.. = Reserved
CL/DCE RPC: .... ..0. = Cancel not Pending at the call end
CL/DCE RPC: .... ...0 = Reserved
CL/DCE RPC: Data Representation Format Label = 100000
CL/DCE RPC: Serial Number (High Byte) = 0
CL/DCE RPC: OID = 00000000-0000-0000-0000-000000000000
CL/DCE RPC: IID = 333A2276-0000-0000-0D00-00809C000000
CL/DCE RPC: AID = 764FEA68-A992-453C-8E5F-91B6CB191144
CL/DCE RPC: Server Boot Time = 0
CL/DCE RPC: I/F Version = 3
CL/DCE RPC: Sequence number = 0
CL/DCE RPC: Operation Number (Method) = 1
CL/DCE RPC: Interface hint = 65535
CL/DCE RPC: Activity hint = 65535
CL/DCE RPC: Packet Body Length = 24
CL/DCE RPC: Fragment Number = 0
CL/DCE RPC: Authentication protocol ID = 0
CL/DCE RPC: Serial Number (Low Byte) = 0
CL/DCE RPC:
DCOM: ----- MS RPC Application Header -----
DCOM:
DCOM: RPC IID = Conversation Mgr
DCOM: *** Conversation Manager Interface ***
DCOM: Data = 000000005582728EA905E74DA145D3E155385F0B00000000
ADDR HEX
0020: 04 02 08 04 10 00
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0040: 00 00 76 22 3a 33 00 00 00 00 0d 00 00 80 9c 00
0050: 00 00 68 ea 4f 76 92 a9 3c 45 8e 5f 91 b6 cb 19
0060: 11 44 00 00 00 00 03 00 00 00 00 00 00 00 01 00
0070: ff ff ff ff 18 00 00 00 00 00 00 00 00 00 55 82
0080: 72 8e a9 05 e7 4d a1 45 d3 e1 55 38 5f 0b 00 00
0090: 00 00
--------------------------------------------------------------------------
rpcrt4.dll自己实现了这两个接口:
MGMT afa8bd80-7d8a-11c9-bef4-08002b102989 1.0
CONV 333a2276-0000-0000-0d00-00809c000000 3.0
[19]介绍了conv_who_are_you2与non-idempotent、Activity的关系，手工解码如下:
--------------------------------------------------------------------------
0xBF, 0xDC, 0xAA, 0x71, 0x40, 0xBB, 0xD4, 0x44, // +0x000 actuid: 71aadcbf-bb40-44d4-9632-87084702e1de
0x96, 0x32, 0x87, 0x08, 0x47, 0x02, 0xE1, 0xDE,
0x02, 0x3C, 0xBE, 0x41 // +0x010 boot_time: Dec 14, 2004 09:04:02.000000000
--------------------------------------------------------------------------
0x00, 0x00, 0x00, 0x00, // +0x000 seq:
0x55, 0x82, 0x72, 0x8E, 0xA9, 0x05, 0xE7, 0x4D, // +0x004 cas_uuid: 8e728255-05a9-4de7-a145-d3e155385f0b
0xA1, 0x45, 0xD3, 0xE1, 0x55, 0x38, 0x5F, 0x0B,
0x00, 0x00, 0x00, 0x00 // +0x014 st:
--------------------------------------------------------------------------
[18]第一次引起我对idempotent(幂等)的注意。
继续测试(SMB_37_17.cap):
--------------------------------------------------------------------------
Frame 1 (168 bytes on wire, 168 bytes captured)
User Datagram Protocol, Src Port: 3760, Dst Port: 1027
DCE RPC Request, Seq: 0, Serial: 0, Frag: 0, FragLen: 46, [Resp: #2]
Version: 4
Packet type: Request (0)
Flags1: 0x28 "Idempotent" "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 26cc9c3c-4425-4e45-aed4-32a35c4c1b20
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 46
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Response in frame: 2
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Server
Max Count: 1
Offset: 0
Actual Count: 1
Server:
Client
Max Count: 1
Offset: 0
Actual Count: 1
Client:
Message
Max Count: 2
Offset: 0
Actual Count: 2
Message: /r
0020 04 00 28 00 10 00 ..(...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc 3c 9c cc 26 25 44 45 4e ae d4 32 a3 5c 4c ..<..&%DEN..2./L
0060 1b 20 00 00 00 00 01 00 00 00 00 00 00 00 00 00 . ..............
0070 ff ff ff ff 2e 00 00 00 00 00 01 00 00 00 00 00 ................
0080 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
0090 00 00 01 00 00 00 00 00 00 00 02 00 00 00 00 00 ................
00a0 00 00 02 00 00 00 0d 00 ........
Frame 2 (126 bytes on wire, 126 bytes captured)
User Datagram Protocol, Src Port: 1027, Dst Port: 3760
DCE RPC Response, Seq: 0, Serial: 0, Frag: 0, FragLen: 4, [Req: #1]
Version: 4
Packet type: Response (2)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 00000000-0000-0000-0000-000000000000
Activity: 26cc9c3c-4425-4e45-aed4-32a35c4c1b20
Server boot time: Dec 14, 2004 09:04:02.000000000
Interface Ver: 0
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x004b
Fragment len: 4
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Request in frame: 1
Time from request: 0.001369000 seconds
Microsoft Messenger Service, NetrSendMessage
Operation: NetrSendMessage (0)
Return code: STATUS_SUCCESS (0x00000000)
0020 04 02 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 3c 9c cc 26 25 44 45 4e ae d4 32 a3 5c 4c ..<..&%DEN..2./L
0060 1b 20 02 3c be 41 00 00 00 00 00 00 00 00 00 00 . .<.A..........
0070 ff ff 4b 00 04 00 00 00 00 00 00 00 00 00 ..K...........
Frame 3 (122 bytes on wire, 122 bytes captured)
User Datagram Protocol, Src Port: 3760, Dst Port: 1027
DCE RPC Ack, Seq: 0, Serial: 1, Frag: 1, FragLen: 0, [Req: #1]
Version: 4
Packet type: Ack (7)
Flags1: 0x20 "Idempotent"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 0... = No Fack: Not set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 26cc9c3c-4425-4e45-aed4-32a35c4c1b20
Server boot time: Unknown (0)
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0x004b
Fragment len: 0
Fragment num: 1
Auth proto: None (0)
Serial Low: 0x01
Request in frame: 1
Time from request: 0.002021000 seconds
0020 04 07 20 00 10 00 .. ...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc 3c 9c cc 26 25 44 45 4e ae d4 32 a3 5c 4c ..<..&%DEN..2./L
0060 1b 20 00 00 00 00 01 00 00 00 00 00 00 00 00 00 . ..............
0070 ff ff 4b 00 00 00 01 00 00 01 ..K.......
--------------------------------------------------------------------------
没有了conv_who_are_you2()相关的三个报文，但仍有一个Ack(7)报文。其实可以更
狠，反正不关心、不需要响应报文。
注意，135/UDP上没有Bind(11)操作，参[20]。接口UUID直接在V4 Request(0)的RPC
头部Interface字段指定。
3) 通过135/UDP访问MGMT
> ifids.exe -p ncadg_ip_udp -e 1027 -t 10.10.7.44
捕获前述操作，保存成SMB_37_19.cap:
--------------------------------------------------------------------------
1 122 MGMT 10.10.7.2 10.10.7.44 4717 1027 rpc__mgmt_inq_if_ids request
2 142 UDP 10.10.7.44 10.10.7.2 2536 4717 Source port: 2536 Destination port: 4717
3 146 UDP 10.10.7.2 10.10.7.44 4717 2536 Source port: 4717 Destination port: 2536
4 122 DCERPC 10.10.7.44 10.10.7.2 2536 4717 Ack: seq: 0
5 450 MGMT 10.10.7.44 10.10.7.2 1027 4717 rpc__mgmt_inq_if_ids response
6 122 DCERPC 10.10.7.2 10.10.7.44 4717 1027 Ack: seq: 0 [req: #1]
--------------------------------------------------------------------------
Win32 API没有指定Idempotent标志位，所以有conv_who_are_you2()出现。XP SP1自
带PFW让conv_who_are_you2 request进来了，不知策略细节是什么，总不至于仅根据
目标端口是4717/UDP吧。
4) 通过135/UDP访问EPM
> 135dump.exe -p ncadg_ip_udp -t 10.10.7.44
捕获前述操作，保存成SMB_37_20.cap:
--------------------------------------------------------------------------
1 198 EPM 10.10.7.2 10.10.7.44 4744 135 Lookup request
2 142 UDP 10.10.7.44 10.10.7.2 1487 4744 Source port: 1487 Destination port: 4744
3 146 UDP 10.10.7.2 10.10.7.44 4744 1487 Source port: 4744 Destination port: 1487
4 122 DCERPC 10.10.7.44 10.10.7.2 1487 4744 Ack: seq: 0
5 278 EPM 10.10.7.44 10.10.7.2 135 4744 Lookup response
6 198 EPM 10.10.7.2 10.10.7.44 4744 135 Lookup request
7 290 EPM 10.10.7.44 10.10.7.2 135 4744 Lookup response
8 198 EPM 10.10.7.2 10.10.7.44 4744 135 Lookup request
9 162 EPM 10.10.7.44 10.10.7.2 135 4744 Lookup response
10 122 DCERPC 10.10.7.2 10.10.7.44 4744 135 Ack: seq: 37 [req: #8]
--------------------------------------------------------------------------
Win32 API没有指定Idempotent标志位，所以有conv_who_are_you2()出现。
注意10号报文，这个Ack(7)不是每次收到Response(2)都会发出。客户端为完成某特
定任务，可能多次发送Request(0)。客户端自己知道哪次Request(0)是最后一次，当
收到对应的Response(2)之后，客户端显式发送Ack(7)，通知服务端完事了，确认响
应报文收到了，服务端应该停止响应。客户端也可以通过发送新的请求报文隐式确认
前次响应。4号是对3号的显式确认，6号是对5号的隐式确认，8号是对7号的隐式确认，
10号是对9号的显式确认。显然，只需要显式确认对应最后一次请求的响应，中间的
响应均可隐式确认，减少通信报文。
再次提醒，135/UDP上没有Bind(11)操作，接口UUID直接在V4 Request(0)的RPC头部
Interface字段指定。
通过135/UDP访问EPM没什么前途，XP SP1、2003 SP1以及某些HotFix之后都不再侦听
这个端口了。
☆ Windows网络服务最小化
2002年9月2日，Jean-Baptiste Marchand发布了一份文档:
[url]http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html[/url]
该文以2000/XP为例介绍了如何最小化Windows网络服务。
缺省安装后的Windows系统默认启用了各种各样的网络服务，它们中的大多数都可以
安全关闭。本文只介绍如何做，另两篇文章将解释更多技术细节:
[url]http://www.hsc.fr/ressources/articles/win_net_srv/[/url]
[url]http://www.hsc.fr/ressources/presentations/sambaxp2003/[/url]
在2000上执行"netstat -na"可以查看侦听中的TCP、UDP端口。在XP上执行"netstat
-nao"将额外返回与端口相关联的PID。
2003之前的netstat命令不能精确地报告TCP、UDP端口状态，这与它的实现有关。比
如:
> netstat -nao | find ":3639"
TCP 0.0.0.0:3639 0.0.0.0:0 LISTENING 868
TCP 192.168.7.2:3639 192.168.1.10:139 ESTABLISHED 868
第二行是正确信息，第一行则属于虚假信息，实际上没有任何进程侦听3639/TCP口。
对于每一条TCP出连接，都将伴随一条虚假信息，注意用find命令区分出虚假侦听端
口。2003已经修复了该BUG。
下面就着手关闭一些网络服务，演示中用了net、sc命令，没有sc或者使用不熟悉的
话，可以换用services.msc，进入GUI界面操作。
2000上IIS 5缺省是启动的，其中HTTP、SMTP等服务依赖于IIS管理服务，停止IIS管
理服务时将自动停止依赖它的那些服务。
> net stop iisadmin
在添加删除面版里删除IIS组件再好不过。
IKE协议(Internet Key Exchange)使用500/UDP口，停止IPSEC服务即可关闭它:
> net stop PolicyAgent
> sc config PolicyAgent start= demand
2000上MSDTC服务缺省是启动的，它侦听3372/TCP和一个高于1023的高端TCP端口。
> net stop msdtc
对于XP可以安全地禁用如下三个服务:
IPsec services (PolicyAgent)
SSDP Discovery Service (SSDPSRV)
Windows Time (W32Time)
> net stop policyagent
> net stop ssdpsrv
> net stop w32time
500/UDP、5000/TCP、1900/UDP、123/UDP随之关闭。
NetBT用到了137、138/UDP以及139/TCP。为了关闭这些端口，必须在每一块网卡上禁
用"NetBIOS over TCP/IP":
网络连接->选择网卡->属性->TCP/IP->属性->高级->WINS->禁用NetBT
这个操作热生效，不需要重启OS。
即使"TCP/IP NetBIOS Helper"服务禁用中，如果未做前述操作，前述端口仍将侦听
中。关闭这些端口后，可以一并禁用"TCP/IP NetBIOS Helper"服务:
> net stop lmhosts
> sc config lmhosts start= disabled
2000及其以后的Windows系统开始支持由TCP层直接承载的SMB协议，使用445/TCP。参
看:
[url]http://www.ubiqx.org/cifs/SMB.html#SMB.1.2[/url]
至少有两种办法可以关闭445/TCP:
. 禁用NetBT驱动
第一种方法彻底禁用了系统中的SMB机制，客户端、服务端支持均被取消。为了停止
NetBT驱动，必须先停止工作站、服务器服务，如果不这样做而试图直接停止NetBT驱
动，系统将出故障。
> net stop rdr
> net stop srv
> net stop netbt
rdr、srv不是服务名称，也不是显示名称，而是net命令自己支持的，在此分别等价
于lanmanworkstation、lanmanserver。
"NetBios over Tcpip"驱动可以手工停止，但不能手工启动，只能重启才可恢复。为
了阻止NetBT驱动在重启OS时自动加载，必须将启动类型由缺省的1改成4:
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NetBT]
"Start"=dword:00000004
--------------------------------------------------------------------------
> sc config netbt start= disabled
. 修改注册表
更多时候第一种方法不是我们所期望的，客户端SMB机制的支持还是需要的。通过修
改注册表可以实现禁用由TCP层直接承载的SMB协议，但继续启用NetBT。
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NetBT/Parameters]
"SmbDeviceEnabled"=dword:00000000
--------------------------------------------------------------------------
重启OS使之生效，445/TCP不再侦听中。
对于Windows 2000上的RPC服务，有一种网络接口限制技术(不适用于XP)可在一定程
度上增强安全性。
> rpccfg -q
RPCCFG: Using default selective binding settings
RPCCFG: Using default port settings
> rpccfg -l
Subnet Description
1 127.0.0.0 1 MS TCP Loopback interface
2 10.10.7.0 1 AMD PCNET Family Ethernet Adapter
> rpccfg -a 1
> rpccfg -q
Admit List
Subnet Description
1 127.0.0.0 1 MS TCP Loopback interface
对应的注册表设置:
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Rpc/Linkage]
"Bind"=hex(7):31,00,00,00,00,00
[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RpcSs]
"ListenOnInternet"="N"
--------------------------------------------------------------------------
Bind是一个REG_MULTI_SZ型键值，在2000上用regedt32编辑较方便。缺省情况下EPM
服务绑定在所有网络接口上，修改注册表并重启后，将只绑定在回送接口上。
> netstat -na
TCP 127.0.0.1:135 0.0.0.0:0 LISTENING
TCP 127.0.0.1:593 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
如果ListenOnInternet设置成Y:
> netstat -na
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
网络接口限制技术有局限性:
. 如果一个RPC服务显式地挨个绑定所有网络接口，则不受Bind的影响。
. 这是全局设置，不能针对各个RPC服务单独设置。
. 似乎只适用于ncacn_ip_tcp协议序列，比如对ncacn_np、ncadg_ip_udp无效。
在2000上测试表明该技术适用于如下服务(单指ncacn_ip_tcp协议序列):
Distributed Transaction Coordinator
Task Scheduler
IIS
缺省情况下RPC服务所用动态端口从1024开始(似乎Windows从未使用过1024)递增。可
以利用rpccfg指定动态端口范围，重启后生效。比如:
> rpccfg -d 0 -pe 5100-5300
> rpccfg -d 1 -pi 6100-6300
两条命令任选其一即可。对应的注册表设置:
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Rpc/Internet]
"UseInternetPorts"="Y"
"Ports"=hex(7):35,00,31,00,30,00,30,00,2d,00,35,00,33,00,30,00,30,00,00,00,00,/
00
"PortsInternetAvailable"="Y"
--------------------------------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Rpc/Internet]
"UseInternetPorts"="N"
"Ports"=hex(7):36,00,31,00,30,00,30,00,2d,00,36,00,33,00,30,00,30,00,00,00,00,/
00
"PortsInternetAvailable"="N"
--------------------------------------------------------------------------
☆ MS05-040/KB893756
我没有跟踪这个漏洞，只是简单研究了一下相应的RPC接口([22])。
> net start telephony
> ifids.exe -p ncalrpc -e tapsrvlpc -t ""
Interfaces[01] :
Interface UUID : 2f5f6520-ca46-1067-b319-00dd010662da version 1.0
> ifids.exe -p ncacn_np -e /pipe/tapsrv -t .
Interfaces[01] :
Interface UUID : 2f5f6520-ca46-1067-b319-00dd010662da version 1.0
测试(SMB_37_30.cap):
--------------------------------------------------------------------------
1 158 SMB 192.168.7.2 192.168.7.151 4256 139 NT Create AndX Request, Path: /tapsrv
2 193 SMB 192.168.7.151 192.168.7.2 139 4256 NT Create AndX Response, FID: 0x4007
3 194 DCERPC 192.168.7.2 192.168.7.151 4256 139 Bind: call_id: 1 UUID: TAPI
4 105 SMB 192.168.7.151 192.168.7.2 139 4256 Write AndX Response, FID: 0x4007, 72 bytes
5 117 SMB 192.168.7.2 192.168.7.151 4256 139 Read AndX Request, FID: 0x4007, 1024 bytes at offset 0
6 186 DCERPC 192.168.7.151 192.168.7.2 139 4256 Bind_ack: call_id: 1 accept max_xmit: 4280 max_recv: 4280
7 200 TAPI 192.168.7.2 192.168.7.151 4256 139 ClientAttach request
8 146 DCERPC 192.168.7.151 192.168.7.2 139 4256 Fault: call_id: 1 ctx_id: 0 status: nca_s_fault_access_denied
9 99 SMB 192.168.7.2 192.168.7.151 4256 139 Close Request, FID: 0x4007
10 93 SMB 192.168.7.151 192.168.7.2 139 4256 Close Response
--------------------------------------------------------------------------
这次没有调用RpcBindingSetAuthInfo()。BIND虽然成功，请求0号调用时仍返回访问
拒绝。
继续测试(SMB_37_31.cap):
--------------------------------------------------------------------------
1 158 SMB 192.168.7.2 192.168.7.151 4281 445 NT Create AndX Request, Path: /tapsrv
2 193 SMB 192.168.7.151 192.168.7.2 445 4281 NT Create AndX Response, FID: 0x4004
3 234 DCERPC 192.168.7.2 192.168.7.151 4281 445 Bind: call_id: 1 UUID: TAPI, NTLMSSP_NEGOTIATE
4 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4004, 112 bytes
5 117 SMB 192.168.7.2 192.168.7.151 4281 445 Read AndX Request, FID: 0x4004, 1024 bytes at offset 0
6 370 DCERPC 192.168.7.151 192.168.7.2 445 4281 Bind_ack: call_id: 1, NTLMSSP_CHALLENGE accept max_xmit: 4280 max_recv: 4280
7 237 DCERPC 192.168.7.2 192.168.7.151 4281 445 AUTH3: call_id: 1, NTLMSSP_AUTH, User: /
8 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4004, 115 bytes
9 238 TAPI 192.168.7.2 192.168.7.151 4281 445 ClientAttach request
10 146 DCERPC 192.168.7.151 192.168.7.2 445 4281 Fault: call_id: 1 ctx_id: 0 status: nca_s_fault_access_denied
11 99 SMB 192.168.7.2 192.168.7.151 4281 445 Close Request, FID: 0x4004
12 93 SMB 192.168.7.151 192.168.7.2 445 4281 Close Response
--------------------------------------------------------------------------
观察Frame 7，理解此时的NTLMSSP_AUTH报文，这是一次空认证。
--------------------------------------------------------------------------
DCE RPC AUTH3, Fragment: Single, FragLen: 115, Call: 1
Version: 5
Version (minor): 0
Packet type: AUTH3 (16)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 115
Auth Length: 87
Call ID: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337136
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_AUTH (0x00000003)
Lan Manager Response: 00
Length: 1
Maxlen: 1
Offset: 86
NTLM Response: Empty
Domain name: NULL
User name: NULL
Host name: NSFOCUS-SCZ
Length: 22
Maxlen: 22
Offset: 64
Session Key: Empty
Flags: 0xa0888a05
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 1... .... .... = Negotiate 0x00000800: Set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
0070 05 00 10 03 10 00 ......
0080 00 00 73 00 57 00 01 00 00 00 b8 10 b8 10 0a 02 ..s.W...........
0090 00 00 30 67 14 00 4e 54 4c 4d 53 53 50 00 03 00 ..0g..NTLMSSP...
00a0 00 00 01 00 01 00 56 00 00 00 00 00 00 00 57 00 ......V.......W.
00b0 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 ......@.......@.
00c0 00 00 16 00 16 00 40 00 00 00 00 00 00 00 57 00 [email protected].
00d0 00 00 05 8a 88 a0 4e 00 53 00 46 00 4f 00 43 00 ......N.S.F.O.C.
00e0 55 00 53 00 2d 00 53 00 43 00 5a 00 00 U.S.-.S.C.Z..
--------------------------------------------------------------------------
继续测试(SMB_37_32.cap):
--------------------------------------------------------------------------
1 158 SMB 192.168.7.2 192.168.7.151 4281 445 NT Create AndX Request, Path: /tapsrv
2 193 SMB 192.168.7.151 192.168.7.2 445 4281 NT Create AndX Response, FID: 0x4005
3 234 DCERPC 192.168.7.2 192.168.7.151 4281 445 Bind: call_id: 1 UUID: TAPI, NTLMSSP_NEGOTIATE
4 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4005, 112 bytes
5 117 SMB 192.168.7.2 192.168.7.151 4281 445 Read AndX Request, FID: 0x4005, 1024 bytes at offset 0
6 370 DCERPC 192.168.7.151 192.168.7.2 445 4281 Bind_ack: call_id: 1, NTLMSSP_CHALLENGE accept max_xmit: 4280 max_recv: 4280
7 292 DCERPC 192.168.7.2 192.168.7.151 4281 445 AUTH3: call_id: 1, NTLMSSP_AUTH, User: /test
8 105 SMB 192.168.7.151 192.168.7.2 445 4281 Write AndX Response, FID: 0x4005, 170 bytes
9 238 TAPI 192.168.7.2 192.168.7.151 4281 445 ClientAttach request
10 166 TAPI 192.168.7.151 192.168.7.2 445 4281 ClientAttach response
11 99 SMB 192.168.7.2 192.168.7.151 4281 445 Close Request, FID: 0x4005
12 93 SMB 192.168.7.151 192.168.7.2 445 4281 Close Response
--------------------------------------------------------------------------
观察Frame 3，与以前的Bind(11)报文相比，Auth Length不再等于零。Frag Length
包括了Auth Length。
对比出现在Session Setup AndX中的NTLMSSP_NEGOTIATE，就是那个格式。
--------------------------------------------------------------------------
DCE RPC Bind, Fragment: Single, FragLen: 112, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 112
Auth Length: 32
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 2f5f6520-ca46-1067-b319-00dd010662da
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337160
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_NEGOTIATE (0x00000001)
Flags: 0xa0088207
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 0... .... .... .... .... .... = Negotiate Target Info: Not set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..1. = Negotiate OEM: Set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
Calling workstation domain: NULL
Calling workstation name: NULL
0070 05 00 0b 03 10 00 ......
0080 00 00 70 00 20 00 01 00 00 00 b8 10 b8 10 00 00 ..p. ...........
0090 00 00 01 00 00 00 00 00 01 00 20 65 5f 2f 46 ca .......... e_/F.
00a0 67 10 b3 19 00 dd 01 06 62 da 01 00 00 00 04 5d g.......b......]
00b0 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
00c0 00 00 0a 02 00 00 48 67 14 00 4e 54 4c 4d 53 53 ......Hg..NTLMSS
00d0 50 00 01 00 00 00 07 82 08 a0 00 00 00 00 00 00 P...............
00e0 00 00 00 00 00 00 00 00 00 00 ..........
--------------------------------------------------------------------------
NTLMSSP_CHALLENGE出现在Bind_ack(12)中。
--------------------------------------------------------------------------
DCE RPC Bind_ack, Fragment: Single, FragLen: 252, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 252
Auth Length: 176
Call ID: 1
Max Xmit Frag: 4280
Max Recv Frag: 4280
Assoc Group: 0x0003ccb9
Scndry Addr len: 13
Scndry Addr: /pipe/tapsrv
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337160
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_CHALLENGE (0x00000002)
Domain: SCZ-PWIN2K
Length: 20
Maxlen: 20
Offset: 56
Flags: 0xa28a8205
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..1. .... .... .... .... .... .... = Negotiate 0x02000000: Set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..1. .... .... .... .... = Negotiate Challenge Accept Response: Set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
NTLM Challenge: A36F0229C72A69C2
Reserved: 0000000000000000
Address List
Length: 100
Maxlen: 100
Offset: 76
Domain NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS domain name (0x0002)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS host name (0x0001)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Domain DNS Name: SCZ-PWIN2K
Target item type: DNS domain name (0x0004)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server DNS Name: SCZ-PWIN2K
Target item type: DNS host name (0x0003)
Target item Length: 20
Target item Content: SCZ-PWIN2K
List Terminator
Target item type: End of list (0x0000)
Target item Length: 0
0070 05 00 0c 03 10 00 00 00 fc 00 ..........
0080 b0 00 01 00 00 00 b8 10 b8 10 b9 cc 03 00 0d 00 ................
0090 5c 70 69 70 65 5c 74 61 70 73 72 76 00 00 01 00 /pipe/tapsrv....
00a0 00 00 00 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 .......]........
00b0 08 00 2b 10 48 60 02 00 00 00 0a 02 00 00 48 67 ..+.H`........Hg
00c0 14 00 4e 54 4c 4d 53 53 50 00 02 00 00 00 14 00 ..NTLMSSP.......
00d0 14 00 38 00 00 00 05 82 8a a2 a3 6f 02 29 c7 2a ..8........o.).*
00e0 69 c2 00 00 00 00 00 00 00 00 64 00 64 00 4c 00 i.........d.d.L.
00f0 00 00 05 00 93 08 00 00 00 0f 53 00 43 00 5a 00 ..........S.C.Z.
0100 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 02 00 -.P.W.I.N.2.K...
0110 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
0120 4e 00 32 00 4b 00 01 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
0130 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 04 00 -.P.W.I.N.2.K...
0140 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
0150 4e 00 32 00 4b 00 03 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
0160 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 00 00 -.P.W.I.N.2.K...
0170 00 00 ..
--------------------------------------------------------------------------
NTLMSSP_AUTH出现在AUTH3(16)中。
--------------------------------------------------------------------------
DCE RPC AUTH3, Fragment: Single, FragLen: 170, Call: 1
Version: 5
Version (minor): 0
Packet type: AUTH3 (16)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 170
Auth Length: 142
Call ID: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1337160
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_AUTH (0x00000003)
Lan Manager Response: 3A10A26835C6373700000000000000000000000000000000
Length: 24
Maxlen: 24
Offset: 94
NTLM Response: D5B5E0C20FD9B2262987E5600F9CADC1C3EE15D14ECBAFD6
Length: 24
Maxlen: 24
Offset: 118
Domain name: NULL
User name: test
Length: 8
Maxlen: 8
Offset: 64
Host name: NSFOCUS-SCZ
Length: 22
Maxlen: 22
Offset: 72
Session Key: Empty
Flags: 0xa0888205
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
0070 05 00 10 03 10 00 ......
0080 00 00 aa 00 8e 00 01 00 00 00 b8 10 b8 10 0a 02 ................
0090 00 00 48 67 14 00 4e 54 4c 4d 53 53 50 00 03 00 ..Hg..NTLMSSP...
00a0 00 00 18 00 18 00 5e 00 00 00 18 00 18 00 76 00 ......^.......v.
00b0 00 00 00 00 00 00 40 00 00 00 08 00 08 00 40 00 ......@.......@.
00c0 00 00 16 00 16 00 48 00 00 00 00 00 00 00 8e 00 ......H.........
00d0 00 00 05 82 88 a0 74 00 65 00 73 00 74 00 4e 00 ......t.e.s.t.N.
00e0 53 00 46 00 4f 00 43 00 55 00 53 00 2d 00 53 00 S.F.O.C.U.S.-.S.
00f0 43 00 5a 00 3a 10 a2 68 35 c6 37 37 00 00 00 00 C.Z.:..h5.77....
0100 00 00 00 00 00 00 00 00 00 00 00 00 d5 b5 e0 c2 ................
0110 0f d9 b2 26 29 87 e5 60 0f 9c ad c1 c3 ee 15 d1 ...&)..`........
0120 4e cb af d6 N...
--------------------------------------------------------------------------
AUTH3(16)中口令有误的话并不会立即得到验证，接下来的Request(0)报文会招致访
问拒绝Fault(3)。
观察Frame 9，这个Request(0)中Auth Length等于16，Auth pad len等于14，鬼知道
为什么整出这么多填充字节。无论如何，与常规Request(0)报文明显不同。
--------------------------------------------------------------------------
DCE RPC Request, Fragment: Single, FragLen: 96, Call: 1 Ctx: 0, [Resp: #10]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 96
Auth Length: 16
Call ID: 1
Alloc hint: 34
Context ID: 0
Opnum: 0
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 14
Auth Rsrvd: 0
Auth Context ID: 1337160
Response in frame: 10
NTLMSSP Verifier
Version Number: 1
Verifier Body: 000000000000000000000000
Microsoft Telephony API Service, ClientAttach
Operation: ClientAttach (0)
Unknown long: 0x00000000
unknown string
Max Count: 1
Offset: 0
Actual Count: 1
Unknown string:
unknown string
Max Count: 1
Offset: 0
Actual Count: 1
Unknown string:
Auth Padding (14 bytes)
0080 05 00 ..
0090 00 03 10 00 00 00 60 00 10 00 01 00 00 00 22 00 ......`.......".
00a0 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
00b0 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 ................
00c0 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00d0 00 00 00 00 00 00 0a 02 0e 00 48 67 14 00 01 00 ..........Hg....
00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
--------------------------------------------------------------------------
☆ DriverStudio Remote Control服务
2005年9月14日cocoruder对外发布了一份与该服务相关的文档([23])。他发现的这个
漏洞是指可以用空认证绕过权限检查，注意空认证与没有认证是两个概念。
去DriverStudio的设置界面里禁止远程访问即可，不过缺省是允许的。
他没有给演示代码及CAP文件，不过重点部分已经说清楚了。因为与AUTH3(16)报文有
关，顺便测试了一下，这里给两个示例。将启动方式改成disabled(测试的是3.1版):
--------------------------------------------------------------------------
166 DCERPC 192.168.7.2 192.168.7.151 3194 1032 Bind: call_id: 1 UUID: 32d90706-b698-4029-b236-e18ebff582b1 ver 1.0, NTLMSSP_NEGOTIATE
298 DCERPC 192.168.7.151 192.168.7.2 1032 3194 Bind_ack: call_id: 1, NTLMSSP_CHALLENGE accept max_xmit: 5840 max_recv: 5840
169 DCERPC 192.168.7.2 192.168.7.151 3194 1032 AUTH3: call_id: 1, NTLMSSP_AUTH, User: /
134 DCERPC 192.168.7.2 192.168.7.151 3194 1032 Request: call_id: 2 opnum: 1 ctx_id: 0 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
82 DCERPC 192.168.7.151 192.168.7.2 1032 3194 Response: call_id: 2 ctx_id: 0 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
DCE RPC Bind, Fragment: Single, FragLen: 112, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind (11)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 112
Auth Length: 32
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00000000
Num Ctx Items: 1
Context ID: 0
Num Trans Items: 1
Interface UUID: 32d90706-b698-4029-b236-e18ebff582b1
Interface Ver: 1
Interface Ver Minor: 0
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1373592
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_NEGOTIATE (0x00000001)
Flags: 0xa0088207
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 0... .... .... .... .... .... = Negotiate Target Info: Not set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..1. = Negotiate OEM: Set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
Calling workstation domain: NULL
Calling workstation name: NULL
0030 05 00 0b 03 10 00 00 00 70 00 ........p.
0040 20 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 ...............
0050 00 00 00 00 01 00 06 07 d9 32 98 b6 29 40 b2 36 .........2..)@.6
0060 e1 8e bf f5 82 b1 01 00 00 00 04 5d 88 8a eb 1c ...........]....
0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 0a 02 ......+.H`......
0080 00 00 98 f5 14 00 4e 54 4c 4d 53 53 50 00 01 00 ......NTLMSSP...
0090 00 00 07 82 08 a0 00 00 00 00 00 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 ......
DCE RPC Bind_ack, Fragment: Single, FragLen: 244, Call: 1
Version: 5
Version (minor): 0
Packet type: Bind_ack (12)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 244
Auth Length: 176
Call ID: 1
Max Xmit Frag: 5840
Max Recv Frag: 5840
Assoc Group: 0x00043360
Scndry Addr len: 5
Scndry Addr: 1032
Num results: 1
Context ID: 0
Ack result: Acceptance (0)
Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
Syntax ver: 2
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1373592
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_CHALLENGE (0x00000002)
Domain: SCZ-PWIN2K
Length: 20
Maxlen: 20
Offset: 56
Flags: 0xa28a8205
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..1. .... .... .... .... .... .... = Negotiate 0x02000000: Set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..1. .... .... .... .... = Negotiate Challenge Accept Response: Set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
NTLM Challenge: CF7750957193BBE0
Reserved: 0000000000000000
Address List
Length: 100
Maxlen: 100
Offset: 76
Domain NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS domain name (0x0002)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server NetBIOS Name: SCZ-PWIN2K
Target item type: NetBIOS host name (0x0001)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Domain DNS Name: SCZ-PWIN2K
Target item type: DNS domain name (0x0004)
Target item Length: 20
Target item Content: SCZ-PWIN2K
Server DNS Name: SCZ-PWIN2K
Target item type: DNS host name (0x0003)
Target item Length: 20
Target item Content: SCZ-PWIN2K
List Terminator
Target item type: End of list (0x0000)
Target item Length: 0
0030 05 00 0c 03 10 00 00 00 f4 00 ..........
0040 b0 00 01 00 00 00 d0 16 d0 16 60 33 04 00 05 00 ..........`3....
0050 31 30 33 32 00 00 01 00 00 00 00 00 00 00 04 5d 1032...........]
0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`..
0070 00 00 0a 02 00 00 98 f5 14 00 4e 54 4c 4d 53 53 ..........NTLMSS
0080 50 00 02 00 00 00 14 00 14 00 38 00 00 00 05 82 P.........8.....
0090 8a a2 cf 77 50 95 71 93 bb e0 00 00 00 00 00 00 ...wP.q.........
00a0 00 00 64 00 64 00 4c 00 00 00 05 00 93 08 00 00 ..d.d.L.........
00b0 00 0f 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
00c0 4e 00 32 00 4b 00 02 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
00d0 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 01 00 -.P.W.I.N.2.K...
00e0 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
00f0 4e 00 32 00 4b 00 04 00 14 00 53 00 43 00 5a 00 N.2.K.....S.C.Z.
0100 2d 00 50 00 57 00 49 00 4e 00 32 00 4b 00 03 00 -.P.W.I.N.2.K...
0110 14 00 53 00 43 00 5a 00 2d 00 50 00 57 00 49 00 ..S.C.Z.-.P.W.I.
0120 4e 00 32 00 4b 00 00 00 00 00 N.2.K.....
DCE RPC AUTH3, Fragment: Single, FragLen: 115, Call: 1
Version: 5
Version (minor): 0
Packet type: AUTH3 (16)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 115
Auth Length: 87
Call ID: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 0
Auth Rsrvd: 0
Auth Context ID: 1373592
NTLMSSP
NTLMSSP identifier: NTLMSSP
NTLM Message Type: NTLMSSP_AUTH (0x00000003)
Lan Manager Response: 00
Length: 1
Maxlen: 1
Offset: 86
NTLM Response: Empty
Domain name: NULL
User name: NULL
Host name: NSFOCUS-SCZ
Length: 22
Maxlen: 22
Offset: 64
Session Key: Empty
Flags: 0xa0888a05
1... .... .... .... .... .... .... .... = Negotiate 56: Set
.0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set
..1. .... .... .... .... .... .... .... = Negotiate 128: Set
...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set
.... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set
.... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set
.... ..0. .... .... .... .... .... .... = Negotiate 0x02000000: Not set
.... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set
.... .... 1... .... .... .... .... .... = Negotiate Target Info: Set
.... .... .0.. .... .... .... .... .... = Negotiate 0x00400000: Not set
.... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set
.... .... ...0 .... .... .... .... .... = Negotiate 0x00100000: Not set
.... .... .... 1... .... .... .... .... = Negotiate NTLM2 key: Set
.... .... .... .0.. .... .... .... .... = Negotiate Challenge Non NT Session Key: Not set
.... .... .... ..0. .... .... .... .... = Negotiate Challenge Accept Response: Not set
.... .... .... ...0 .... .... .... .... = Negotiate Challenge Init Response: Not set
.... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set
.... .... .... .... .0.. .... .... .... = Negotiate This is Local Call: Not set
.... .... .... .... ..0. .... .... .... = Negotiate Workstation Supplied: Not set
.... .... .... .... ...0 .... .... .... = Negotiate Domain Supplied: Not set
.... .... .... .... .... 1... .... .... = Negotiate 0x00000800: Set
.... .... .... .... .... .0.. .... .... = Negotiate 0x00000400: Not set
.... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set
.... .... .... .... .... ...0 .... .... = Negotiate Netware: Not set
.... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set
.... .... .... .... .... .... .0.. .... = Negotiate Datagram Style: Not set
.... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set
.... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set
.... .... .... .... .... .... .... 0... = Request 0x00000008: Not set
.... .... .... .... .... .... .... .1.. = Request Target: Set
.... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set
.... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set
0030 05 00 10 03 10 00 00 00 73 00 ........s.
0040 57 00 01 00 00 00 d0 16 d0 16 0a 02 00 00 98 f5 W...............
0050 14 00 4e 54 4c 4d 53 53 50 00 03 00 00 00 01 00 ..NTLMSSP.......
0060 01 00 56 00 00 00 00 00 00 00 57 00 00 00 00 00 ..V.......W.....
0070 00 00 40 00 00 00 00 00 00 00 40 00 00 00 16 00 ..@.......@.....
0080 16 00 40 00 00 00 00 00 00 00 57 00 00 00 05 8a [email protected].....
0090 88 a0 4e 00 53 00 46 00 4f 00 43 00 55 00 53 00 ..N.S.F.O.C.U.S.
00a0 2d 00 53 00 43 00 5a 00 00 -.S.C.Z..
DCE RPC Request, Fragment: Single, FragLen: 80, Call: 2 Ctx: 0, [Resp: #7]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 80
Auth Length: 16
Call ID: 2
Alloc hint: 20
Context ID: 0
Opnum: 1
Auth type: NTLMSSP (10)
Auth level: Connect (2)
Auth pad len: 12
Auth Rsrvd: 0
Auth Context ID: 1373592
Response in frame: 7
Stub data (20 bytes)
Auth Padding (12 bytes)
NTLMSSP Verifier
Version Number: 1
Verifier Body: 000000000000000000000000
0030 05 00 00 03 10 00 00 00 50 00 ........P.
0040 10 00 02 00 00 00 14 00 00 00 00 00 01 00 06 00 ................
0050 00 00 06 00 00 00 05 00 05 00 05 00 04 00 05 00 ................
0060 04 00 00 00 00 00 3b 00 00 00 01 00 00 00 0a 02 ......;.........
0070 0c 00 98 f5 14 00 01 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 ......
DCE RPC Response, Fragment: Single, FragLen: 28, Call: 2 Ctx: 0, [Req: #6]
Version: 5
Version (minor): 0
Packet type: Response (2)
Packet Flags: 0x03
0... .... = Object: Not set
.0.. .... = Maybe: Not set
..0. .... = Did Not Execute: Not set
...0 .... = Multiplex: Not set
.... 0... = Reserved: Not set
.... .0.. = Cancel Pending: Not set
.... ..1. = Last Frag: Set
.... ...1 = First Frag: Set
Data Representation: 10000000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Frag Length: 28
Auth Length: 0
Call ID: 2
Alloc hint: 4
Context ID: 0
Cancel count: 0
Opnum: 1
Request in frame: 6
Time from request: 0.004911000 seconds
Stub data (4 bytes)
0030 05 00 02 03 10 00 00 00 1c 00 ..........
0040 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 ................
0050 00 00 ..
--------------------------------------------------------------------------
用了空认证，结果仍成功调用了1号远程过程。
DCE/RPC V4时RpcBindingSetAuthInfo()的通信报文更加罕见，将启动方式改成
manual(测试的是3.1版):
--------------------------------------------------------------------------
166 DCERPC 192.168.7.2 192.168.7.151 4989 1033 Request: seq: 1 opnum: 1 len: 24 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
150 DCERPC 192.168.7.151 192.168.7.2 1033 4989 Response: seq: 1 opnum: 1 len: 8 UNKUUID: 32d90706-b698-4029-b236-e18ebff582b1 rpcver: 1
DCE RPC Request, Seq: 1, Serial: 0, Frag: 0, FragLen: 24, [Resp: #7]
Version: 4
Packet type: Request (0)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 32d90706-b698-4029-b236-e18ebff582b1
Activity: f76a834e-c381-4e55-9eef-04e63b7bebe0
Server boot time: Feb 8, 2006 09:17:12.000000000
Interface Ver: 1
Sequence num: 1
Opnum: 1
Interface Hint: 0xffff
Activity Hint: 0x003a
Fragment len: 24
Fragment num: 0
Auth proto: NTLMSSP (10)
Serial Low: 0x00
Authentication verifier
Response in frame: 7
Stub data (24 bytes)
0020 04 00 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 06 07 d9 32 98 b6 29 40 b2 36 e1 8e bf f5 .....2..)@.6....
0050 82 b1 4e 83 6a f7 81 c3 55 4e 9e ef 04 e6 3b 7b ..N.j...UN....;{
0060 eb e0 98 46 e9 43 01 00 00 00 01 00 00 00 01 00 ...F.C..........
0070 ff ff 3a 00 18 00 00 00 0a 00 06 00 00 00 06 00 ..:.............
0080 00 00 05 00 05 00 05 00 04 00 05 00 03 00 00 00 ................
0090 00 00 04 00 12 00 01 00 00 00 c8 fa 12 00 44 d4 ..............D.
00a0 63 a7 bc d6 1c 87 c.....
DCE RPC Response, Seq: 1, Serial: 0, Frag: 0, FragLen: 8, [Req: #6]
Version: 4
Packet type: Response (2)
Flags1: 0x08 "No Fack"
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..0. .... = Idempotent: Not set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 0008e89f-102b-6048-0200-00000a020000
Activity: f76a834e-c381-4e55-9eef-04e63b7bebe0
Server boot time: Feb 8, 2006 09:17:12.000000000
Interface Ver: 56
Sequence num: 1
Opnum: 46286
Interface Hint: 0xffff
Activity Hint: 0x003a
Fragment len: 8
Fragment num: 0
Auth proto: NTLMSSP (10)
Serial Low: 0x00
Authentication verifier
Request in frame: 6
Time from request: 0.005263000 seconds
Stub data (8 bytes)
0020 04 02 08 00 10 00 ......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 9f e8 08 00 2b 10 48 60 02 00 00 00 0a 02 ......+.H`......
0050 00 00 4e 83 6a f7 81 c3 55 4e 9e ef 04 e6 3b 7b ..N.j...UN....;{
0060 eb e0 98 46 e9 43 38 00 00 00 01 00 00 00 ce b4 ...F.C8.........
0070 ff ff 3a 00 08 00 00 00 0a 00 00 00 00 00 08 4f ..:............O
0080 87 00 04 00 87 00 01 00 00 00 58 64 17 00 cd fa ..........Xd....
0090 e8 3e bc d6 1c 87 .>....
--------------------------------------------------------------------------
☆ 后记
☆ 参考资源
[ 3] NT LAN Manager SMB File Sharing Protocol Extensions - Microsoft Corporation [1992-08-24]
[url]http://us4.samba.org/samba/ftp/specs/smb-nt01.doc[/url]
[ 4] Implementing CIFS
[url]http://www.phptr.com/content/images/013047116X/downloads/013047116X_pdf.zip[/url]
[11] A Common Internet File System (CIFS/1.0) Protocol - Microsoft Corporation [1997-03-13]
[url]http://us4.samba.org/samba/ftp/specs/draft-leach-cifs-v1-spec-02.txt[/url]
[14] CORE-20020618: Vulnerabilities in Windows SMB (DoS) - [2002-08-22]
[url]http://www1.corest.com/common/showdoc.php?idx=262&idxseccion=10[/url]
Unchecked Buffer in Network Share Provider Can Lead to Denial of Service (Q326830)
[url]http://www.microsoft.com/technet/security/bulletin/MS02-045.mspx?pf=true[/url]
[url]http://support.microsoft.com/kb/326830[/url]
[url]http://packetstormsecurity.org/0208-exploits/SMBdie.zip[/url]
[15] Sasser Filter - detect multiple varients of W32/Sasser worm.
[url]http://www.wildpackets.com/elements/antivirus/sasserv1.zip[/url]
W32.Mydoom.OandM
[url]http://www.wildpackets.com/elements/antivirus/mydoom_om.zip[/url]
W32.Mydoom.A@mm
[url]http://www.wildpackets.com/elements/antivirus/w32_novarg_a.zip[/url]
"MSBlast," "Lovesan" or "Blaster" worm
[url]http://www.wildpackets.com/elements/antivirus/msblastv1.zip[/url]
SQL Slammer (aka Sapphire) virus
[url]http://www.wildpackets.com/elements/antivirus/Sapphire.zip[/url]
Windows Local Security Authority Service Remote Buffer Overflow
[url]http://www.eeye.com/html/Research/Advisories/AD20040413C.html[/url]
[18] Messenger Service abuse via Microsoft RPC - Jeremy Hewlett [2003]
[url]http://www.giac.com/practical/GCIH/Jeremy_Hewlett_GCIH.pdf[/url]
[Full-Disclosure] Re: Windows Messenger Popup Spam - advisory amended (followup for those interested) [2003-07-01]
[url]http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/006152.html[/url]
[19] Conversation Manager Interface Definition
[url]http://www.opengroup.org/onlinepubs/9629399/apdxp.htm[/url]
[20] Generic PDU Structure
[url]http://www.opengroup.org/onlinepubs/9629399/chap12.htm[/url]
[21] [CORE-2003-12-05] DCE RPC Vulnerabilities New Attack Vectors Analysis - [2003-12-10]
[url]http://www.coresecurity.com/common/showdoc.php?idx=393&idxseccion=10[/url]
[22] Vulnerability in Telephony Service Could Allow Remote Code Execution (893756)
[url]http://www.microsoft.com/technet/security/Bulletin/MS05-040.mspx?pf=true[/url]
[url]http://support.microsoft.com/kb/893756[/url]
Telephony service
[url]http://www.hsc.fr/ressources/articles/win_net_srv/ch04s10s16.html[/url]
[23] DriverStudio Remote Control远程调用认证绕过漏洞及其利用研究 - cocoruder <[email][email protected][/email]> [2005-09-14]
[url]http://www.xfocus.net/articles/200509/821.html[/url]