(self, message)
| 247 | return self.mid |
| 248 | |
| 249 | def _updateState_SMB2(self, message): |
| 250 | if message.isReply: |
| 251 | if message.command == SMB2_COM_NEGOTIATE: |
| 252 | if message.status == 0: |
| 253 | self.has_negotiated = True |
| 254 | self.log.info('SMB2 dialect negotiation successful') |
| 255 | self._updateServerInfo(message.payload) |
| 256 | self._handleNegotiateResponse(message) |
| 257 | else: |
| 258 | raise ProtocolError('Unknown status value (0x%08X) in SMB2_COM_NEGOTIATE' % message.status, |
| 259 | message.raw_data, message) |
| 260 | elif message.command == SMB2_COM_SESSION_SETUP: |
| 261 | if message.status == 0: |
| 262 | self.session_id = message.session_id |
| 263 | try: |
| 264 | result = securityblob.decodeAuthResponseSecurityBlob(message.payload.security_blob) |
| 265 | if result == securityblob.RESULT_ACCEPT_COMPLETED: |
| 266 | self.has_authenticated = True |
| 267 | self.log.info('Authentication (on SMB2) successful!') |
| 268 | |
| 269 | # [MS-SMB2]: 3.2.5.3.1 |
| 270 | # If the security subsystem indicates that the session was established by an anonymous user, |
| 271 | # Session.SigningRequired MUST be set to FALSE. |
| 272 | # If the SMB2_SESSION_FLAG_IS_GUEST bit is set in the SessionFlags field of the |
| 273 | # SMB2 SESSION_SETUP Response and if Session.SigningRequired is TRUE, this indicates a SESSION_SETUP |
| 274 | # failure and the connection MUST be terminated. If the SMB2_SESSION_FLAG_IS_GUEST bit is set in the SessionFlags |
| 275 | # field of the SMB2 SESSION_SETUP Response and if RequireMessageSigning is FALSE, Session.SigningRequired |
| 276 | # MUST be set to FALSE. |
| 277 | if message.payload.isGuestSession or message.payload.isAnonymousSession: |
| 278 | self.is_signing_active = False |
| 279 | self.log.info('Signing disabled because session is guest/anonymous') |
| 280 | |
| 281 | self.onAuthOK() |
| 282 | else: |
| 283 | raise ProtocolError('SMB2_COM_SESSION_SETUP status is 0 but security blob negResult value is %d' % result, message.raw_data, message) |
| 284 | except securityblob.BadSecurityBlobError as ex: |
| 285 | raise ProtocolError(str(ex), message.raw_data, message) |
| 286 | elif message.status == 0xc0000016: # STATUS_MORE_PROCESSING_REQUIRED |
| 287 | self.session_id = message.session_id |
| 288 | try: |
| 289 | result, ntlm_token = securityblob.decodeChallengeSecurityBlob(message.payload.security_blob) |
| 290 | if result == securityblob.RESULT_ACCEPT_INCOMPLETE: |
| 291 | self._handleSessionChallenge(message, ntlm_token) |
| 292 | except ( securityblob.BadSecurityBlobError, securityblob.UnsupportedSecurityProvider ) as ex: |
| 293 | raise ProtocolError(str(ex), message.raw_data, message) |
| 294 | elif (message.status == 0xc000006d # STATUS_LOGON_FAILURE |
| 295 | or message.status == 0xc0000064 # STATUS_NO_SUCH_USER |
| 296 | or message.status == 0xc000006a):# STATUS_WRONG_PASSWORD |
| 297 | self.has_authenticated = False |
| 298 | self.log.info('Authentication (on SMB2) failed. Please check username and password.') |
| 299 | self.onAuthFailed() |
| 300 | elif (message.status == 0xc0000193 # STATUS_ACCOUNT_EXPIRED |
| 301 | or message.status == 0xC0000071): # STATUS_PASSWORD_EXPIRED |
| 302 | self.has_authenticated = False |
| 303 | self.log.info('Authentication (on SMB2) failed. Account or password has expired.') |
| 304 | self.onAuthFailed() |
| 305 | elif message.status == 0xc0000234: # STATUS_ACCOUNT_LOCKED_OUT |
| 306 | self.has_authenticated = False |
nothing calls this directly
no test coverage detected