Contains information on the SMB_COM_SESSION_SETUP_ANDX response from server If the underlying SMB message's flags2 does not have SMB_FLAGS2_EXTENDED_SECURITY bit enabled, then the instance will have the following attributes, - action If the underlying SMB message's flags2 has
| 488 | |
| 489 | |
| 490 | class ComSessionSetupAndxResponse(Payload): |
| 491 | """ |
| 492 | Contains information on the SMB_COM_SESSION_SETUP_ANDX response from server |
| 493 | |
| 494 | If the underlying SMB message's flags2 does not have SMB_FLAGS2_EXTENDED_SECURITY bit enabled, |
| 495 | then the instance will have the following attributes, |
| 496 | - action |
| 497 | |
| 498 | If the underlying SMB message's flags2 has SMB_FLAGS2_EXTENDED_SECURITY bit enabled |
| 499 | and the message status is STATUS_MORE_PROCESSING_REQUIRED or equals to 0x00 (no error), |
| 500 | then the instance will have the following attributes, |
| 501 | - action |
| 502 | - securityblob |
| 503 | |
| 504 | If the underlying SMB message's flags2 has SMB_FLAGS2_EXTENDED_SECURITY bit enabled but |
| 505 | the message status is not STATUS_MORE_PROCESSING_REQUIRED |
| 506 | |
| 507 | References: |
| 508 | =========== |
| 509 | - [MS-SMB]: 2.2.4.6.2 |
| 510 | - [MS-CIFS]: 2.2.4.53.2 |
| 511 | """ |
| 512 | |
| 513 | NOSECURE_PARAMETER_STRUCT_FORMAT = '<BBHH' |
| 514 | NOSECURE_PARAMETER_STRUCT_SIZE = struct.calcsize(NOSECURE_PARAMETER_STRUCT_FORMAT) |
| 515 | |
| 516 | SECURE_PARAMETER_STRUCT_FORMAT = '<BBHHH' |
| 517 | SECURE_PARAMETER_STRUCT_SIZE = struct.calcsize(SECURE_PARAMETER_STRUCT_FORMAT) |
| 518 | |
| 519 | def decode(self, message): |
| 520 | assert message.command == SMB_COM_SESSION_SETUP_ANDX |
| 521 | if not message.hasExtendedSecurity: |
| 522 | if not message.status.hasError: |
| 523 | if len(message.parameters_data) < self.NOSECURE_PARAMETER_STRUCT_SIZE: |
| 524 | raise ProtocolError('Not enough data to decode SMB_COM_SESSION_SETUP_ANDX (no security extensions) parameters', message.raw_data, message) |
| 525 | |
| 526 | _, _, _, self.action = struct.unpack(self.NOSECURE_PARAMETER_STRUCT_FORMAT, message.parameters_data[:self.NOSECURE_PARAMETER_STRUCT_SIZE]) |
| 527 | else: |
| 528 | if not message.status.hasError or message.status.internal_value == 0xc0000016: # STATUS_MORE_PROCESSING_REQUIRED |
| 529 | if len(message.parameters_data) < self.SECURE_PARAMETER_STRUCT_SIZE: |
| 530 | raise ProtocolError('Not enough data to decode SMB_COM_SESSION_SETUP_ANDX (with security extensions) parameters', message.raw_data, message) |
| 531 | |
| 532 | _, _, _, self.action, blob_length = struct.unpack(self.SECURE_PARAMETER_STRUCT_FORMAT, message.parameters_data[:self.SECURE_PARAMETER_STRUCT_SIZE]) |
| 533 | if len(message.data) < blob_length: |
| 534 | raise ProtocolError('Not enough data to decode SMB_COM_SESSION_SETUP_ANDX (with security extensions) security blob', message.raw_data, message) |
| 535 | |
| 536 | self.security_blob = message.data[:blob_length] |
| 537 | |
| 538 | |
| 539 | class ComTreeConnectAndxRequest(Payload): |