Method decrypt

scapy/layers/smb2.py:4411–4438

[MS-SMB2] sect 3.2.5.1.1.1 - Decrypting the Message

(self, dialect, DecryptionKey, CipherId)

    ]

    def decrypt(self, dialect, DecryptionKey, CipherId):
        """
        [MS-SMB2] sect 3.2.5.1.1.1 - Decrypting the Message
        """
        if not isinstance(self.payload, conf.raw_layer):
            raise Exception("No payload to decrypt !")

        if "GCM" in CipherId:
            from cryptography.hazmat.primitives.ciphers.aead import AESGCM

            nonce = self.Nonce[:12]
            cipher = AESGCM(DecryptionKey)
        elif "CCM" in CipherId:
            from cryptography.hazmat.primitives.ciphers.aead import AESCCM

            nonce = self.Nonce[:11]
            cipher = AESCCM(DecryptionKey)
        else:
            raise Exception("Unknown CipherId !")

        # Decrypt the data
        aad = self.self_build()[20:]
        data = cipher.decrypt(
            nonce,
            self.payload.load + self.Signature,
            aad,
        )
        return SMB2_Header(data, _decrypted=True)


bind_layers(SMB2_Transform_Header, conf.raw_layer)