Linux tsuru-no-tsurugi 5.15.0-186-generic #196-Ubuntu SMP Sat Jun 20 16:09:34 UTC 2026 x86_64
Apache/2.4.52 (Ubuntu)
Server IP : 192.168.0.18 & Your IP : 216.73.217.105
Domains :
Cant Read [ /etc/named.conf ]
User : www-data
Terminal
Auto Root
Create File
Create Folder
Localroot Suggester
Backdoor Destroyer
Readme
/
usr /
share /
nmap /
nselib /
Delete
Unzip
Name
Size
Permission
Date
Action
data
[ DIR ]
drwxr-xr-x
2024-08-29 14:21
afp.lua
71.48
KB
-rw-r--r--
2023-01-13 02:40
ajp.lua
16.77
KB
-rw-r--r--
2023-01-13 02:40
amqp.lua
10.41
KB
-rw-r--r--
2023-01-13 02:40
anyconnect.lua
4.31
KB
-rw-r--r--
2023-01-13 02:40
asn1.lua
14.57
KB
-rw-r--r--
2023-01-13 02:40
base32.lua
7.36
KB
-rw-r--r--
2023-01-13 02:40
base64.lua
5.83
KB
-rw-r--r--
2023-01-13 02:40
bin.lua
12.99
KB
-rw-r--r--
2023-01-13 02:40
bitcoin.lua
18.25
KB
-rw-r--r--
2023-01-13 02:40
bits.lua
2.54
KB
-rw-r--r--
2023-01-13 02:40
bittorrent.lua
35.76
KB
-rw-r--r--
2023-01-13 02:40
bjnp.lua
9.55
KB
-rw-r--r--
2023-01-13 02:40
brute.lua
50.64
KB
-rw-r--r--
2023-01-13 02:40
cassandra.lua
5.48
KB
-rw-r--r--
2023-01-13 02:40
citrixxml.lua
16
KB
-rw-r--r--
2023-01-13 02:40
coap.lua
75.1
KB
-rw-r--r--
2023-01-13 02:40
comm.lua
11.03
KB
-rw-r--r--
2023-01-13 02:40
creds.lua
18.26
KB
-rw-r--r--
2023-01-13 02:40
cvs.lua
3.05
KB
-rw-r--r--
2023-01-13 02:40
datafiles.lua
11.05
KB
-rw-r--r--
2023-01-13 02:40
datetime.lua
7.5
KB
-rw-r--r--
2023-01-13 02:40
dhcp.lua
28.57
KB
-rw-r--r--
2023-01-13 02:40
dhcp6.lua
19.86
KB
-rw-r--r--
2023-01-13 02:40
dns.lua
51.07
KB
-rw-r--r--
2023-01-13 02:40
dnsbl.lua
19.01
KB
-rw-r--r--
2023-01-13 02:40
dnssd.lua
12.61
KB
-rw-r--r--
2023-01-13 02:40
drda.lua
24.08
KB
-rw-r--r--
2023-01-13 02:40
eap.lua
7.54
KB
-rw-r--r--
2023-01-13 02:40
eigrp.lua
12.98
KB
-rw-r--r--
2023-01-13 02:40
formulas.lua
5.68
KB
-rw-r--r--
2023-01-13 02:40
ftp.lua
9.03
KB
-rw-r--r--
2023-01-13 02:40
geoip.lua
1.71
KB
-rw-r--r--
2023-01-13 02:40
giop.lua
18.42
KB
-rw-r--r--
2023-01-13 02:40
gps.lua
3.38
KB
-rw-r--r--
2023-01-13 02:40
http.lua
117.07
KB
-rw-r--r--
2023-01-13 02:40
httpspider.lua
36.65
KB
-rw-r--r--
2023-01-13 02:40
iax2.lua
9.58
KB
-rw-r--r--
2023-01-13 02:40
idna.lua
17.14
KB
-rw-r--r--
2023-01-13 02:40
ike.lua
14.63
KB
-rw-r--r--
2023-01-13 02:40
imap.lua
9.59
KB
-rw-r--r--
2023-01-13 02:40
informix.lua
39.93
KB
-rw-r--r--
2023-01-13 02:40
ipOps.lua
29.06
KB
-rw-r--r--
2023-01-13 02:40
ipmi.lua
8.08
KB
-rw-r--r--
2023-01-13 02:40
ipp.lua
12.57
KB
-rw-r--r--
2023-01-13 02:40
irc.lua
757
B
-rw-r--r--
2023-01-13 02:40
iscsi.lua
21.38
KB
-rw-r--r--
2023-01-13 02:40
isns.lua
14.98
KB
-rw-r--r--
2023-01-13 02:40
jdwp.lua
43.52
KB
-rw-r--r--
2023-01-13 02:40
json.lua
11.62
KB
-rw-r--r--
2023-01-13 02:40
knx.lua
2.42
KB
-rw-r--r--
2023-01-13 02:40
ldap.lua
31.94
KB
-rw-r--r--
2023-01-13 02:40
lfs.luadoc
1.68
KB
-rw-r--r--
2023-01-13 02:40
libssh2-utility.lua
4.69
KB
-rw-r--r--
2023-01-13 02:40
libssh2.luadoc
4.75
KB
-rw-r--r--
2023-01-13 02:40
listop.lua
4.66
KB
-rw-r--r--
2023-01-13 02:40
lpeg-utility.lua
5.64
KB
-rw-r--r--
2023-01-13 02:40
lpeg.luadoc
351
B
-rw-r--r--
2023-01-13 02:40
ls.lua
10.96
KB
-rw-r--r--
2023-01-13 02:40
match.lua
2.05
KB
-rw-r--r--
2023-01-13 02:40
membase.lua
9.93
KB
-rw-r--r--
2023-01-13 02:40
mobileme.lua
8.46
KB
-rw-r--r--
2023-01-13 02:40
mongodb.lua
21.3
KB
-rw-r--r--
2023-01-13 02:40
mqtt.lua
28.86
KB
-rw-r--r--
2023-01-13 02:40
msrpc.lua
190.07
KB
-rw-r--r--
2023-01-13 02:40
msrpcperformance.lua
29.65
KB
-rw-r--r--
2023-01-13 02:40
msrpctypes.lua
168.52
KB
-rw-r--r--
2023-01-13 02:40
mssql.lua
109.43
KB
-rw-r--r--
2023-01-13 02:40
multicast.lua
5.97
KB
-rw-r--r--
2023-01-13 02:40
mysql.lua
16.03
KB
-rw-r--r--
2023-01-13 02:40
natpmp.lua
5.11
KB
-rw-r--r--
2023-01-13 02:40
nbd.lua
16.04
KB
-rw-r--r--
2023-01-13 02:40
ncp.lua
35.64
KB
-rw-r--r--
2023-01-13 02:40
ndmp.lua
11.43
KB
-rw-r--r--
2023-01-13 02:40
netbios.lua
14.44
KB
-rw-r--r--
2023-01-13 02:40
nmap.luadoc
40.34
KB
-rw-r--r--
2023-01-13 02:40
nrpc.lua
4.46
KB
-rw-r--r--
2023-01-13 02:40
nsedebug.lua
3.49
KB
-rw-r--r--
2023-01-13 02:40
omp2.lua
4.78
KB
-rw-r--r--
2023-01-13 02:40
oops.lua
3.61
KB
-rw-r--r--
2023-01-13 02:40
openssl.luadoc
7.5
KB
-rw-r--r--
2023-01-13 02:40
ospf.lua
15.29
KB
-rw-r--r--
2023-01-13 02:40
packet.lua
36.18
KB
-rw-r--r--
2023-01-13 02:40
pcre.luadoc
6.79
KB
-rw-r--r--
2023-01-13 02:40
pgsql.lua
20.6
KB
-rw-r--r--
2023-01-13 02:40
pop3.lua
5.74
KB
-rw-r--r--
2023-01-13 02:40
pppoe.lua
29.42
KB
-rw-r--r--
2023-01-13 02:40
proxy.lua
11.37
KB
-rw-r--r--
2023-01-13 02:40
punycode.lua
11.5
KB
-rw-r--r--
2023-01-13 02:40
rand.lua
2.7
KB
-rw-r--r--
2023-01-13 02:40
rdp.lua
14.73
KB
-rw-r--r--
2023-01-13 02:40
re.lua
8.22
KB
-rw-r--r--
2023-01-13 02:40
redis.lua
3.61
KB
-rw-r--r--
2023-01-13 02:40
rmi.lua
47.77
KB
-rw-r--r--
2023-01-13 02:40
rpc.lua
107.64
KB
-rw-r--r--
2023-01-13 02:40
rpcap.lua
11.08
KB
-rw-r--r--
2023-01-13 02:40
rsync.lua
5.22
KB
-rw-r--r--
2023-01-13 02:40
rtsp.lua
8.62
KB
-rw-r--r--
2023-01-13 02:40
sasl.lua
16.51
KB
-rw-r--r--
2023-01-13 02:40
shortport.lua
11.99
KB
-rw-r--r--
2023-01-13 02:40
sip.lua
30.07
KB
-rw-r--r--
2023-01-13 02:40
slaxml.lua
17.9
KB
-rw-r--r--
2023-01-13 02:40
smb.lua
173.22
KB
-rw-r--r--
2023-01-13 02:40
smb2.lua
15.34
KB
-rw-r--r--
2023-01-13 02:40
smbauth.lua
37.33
KB
-rw-r--r--
2023-01-13 02:40
smtp.lua
19.85
KB
-rw-r--r--
2023-01-13 02:40
snmp.lua
16
KB
-rw-r--r--
2023-01-13 02:40
socks.lua
8.25
KB
-rw-r--r--
2023-01-13 02:40
srvloc.lua
10.99
KB
-rw-r--r--
2023-01-13 02:40
ssh1.lua
9.15
KB
-rw-r--r--
2023-01-13 02:40
ssh2.lua
11.73
KB
-rw-r--r--
2023-01-13 02:40
sslcert.lua
33.35
KB
-rw-r--r--
2023-01-13 02:40
sslv2.lua
9.68
KB
-rw-r--r--
2023-01-13 02:40
stdnse.lua
32.64
KB
-rw-r--r--
2023-01-13 02:40
strbuf.lua
4.52
KB
-rw-r--r--
2023-01-13 02:40
strict.lua
2.53
KB
-rw-r--r--
2023-01-13 02:40
stringaux.lua
4.32
KB
-rw-r--r--
2023-01-13 02:40
stun.lua
11.08
KB
-rw-r--r--
2023-01-13 02:40
tab.lua
3.35
KB
-rw-r--r--
2023-01-13 02:40
tableaux.lua
2.06
KB
-rw-r--r--
2023-01-13 02:40
target.lua
3.93
KB
-rw-r--r--
2023-01-13 02:40
tftp.lua
9.41
KB
-rw-r--r--
2023-01-13 02:40
tls.lua
58.05
KB
-rw-r--r--
2023-01-13 02:40
tn3270.lua
46.99
KB
-rw-r--r--
2023-01-13 02:40
tns.lua
64.16
KB
-rw-r--r--
2023-01-13 02:40
unicode.lua
14.23
KB
-rw-r--r--
2023-01-13 02:40
unittest.lua
12.41
KB
-rw-r--r--
2023-01-13 02:40
unpwdb.lua
10.42
KB
-rw-r--r--
2023-01-13 02:40
upnp.lua
11.18
KB
-rw-r--r--
2023-01-13 02:40
url.lua
16.7
KB
-rw-r--r--
2023-01-13 02:40
versant.lua
8.58
KB
-rw-r--r--
2023-01-13 02:40
vnc.lua
25.54
KB
-rw-r--r--
2023-01-13 02:40
vulns.lua
76.45
KB
-rw-r--r--
2023-01-13 02:40
vuzedht.lua
16.21
KB
-rw-r--r--
2023-01-13 02:40
wsdd.lua
11.98
KB
-rw-r--r--
2023-01-13 02:40
xdmcp.lua
12.09
KB
-rw-r--r--
2023-01-13 02:40
xmpp.lua
15.91
KB
-rw-r--r--
2023-01-13 02:40
zlib.luadoc
4.88
KB
-rw-r--r--
2023-01-13 02:40
Save
Rename
--- -- Implements the Server Message Block (SMB) protocol version 2 and 3. -- -- The implementation extends smb.lua to support SMB dialects 2.02, 2.10, 3.0, -- 3.02 and 3.11. This is a work in progress and not all commands are -- implemented yet. Features/functionality will be added as the scripts -- get updated. I tried to be consistent with the current implementation of -- smb.lua but some fields may have changed name or don't exist anymore. -- -- @author Paulino Calderon <paulino@calderonpale.com> -- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html --- local datetime = require "datetime" local string = require "string" local stdnse = require "stdnse" local table = require "table" local tableaux = require "tableaux" local match = require "match" _ENV = stdnse.module("smb2", stdnse.seeall) local TIMEOUT = 10000 local command_names = {} local command_codes = { SMB2_COM_NEGOTIATE = 0x0000, SMB2_COM_SESSION_SETUP = 0x0001, SMB2_COM_LOGOFF = 0x0002, SMB2_COM_TREE_CONNECT = 0x0003, SMB2_COM_TREE_DISCONNECT = 0x0004, SMB2_COM_CREATE = 0x0005, SMB2_COM_CLOSE = 0x0006, SMB2_COM_FLUSH = 0x0007, SMB2_COM_READ = 0x0008, SMB2_COM_WRITE = 0x0009, SMB2_COM_LOCK = 0x000A, SMB2_COM_IOCTL = 0x000B, SMB2_COM_CANCEL = 0x000C, SMB2_COM_ECHO = 0x000D, SMB2_COM_QUERY_DIRECTORY = 0x000E, SMB2_COM_CHANGE_NOTIFY = 0x000F, SMB2_COM_QUERY_INFO = 0x0010, SMB2_COM_SET_INFO = 0x0011, SMB2_COM_OPLOCK_BREAK = 0x0012 } local smb2_values_codes = {} local smb2_values = { -- Security Mode SMB2_NEGOTIATE_SIGNING_ENABLED = 0x0001, SMB2_NEGOTIATE_SIGNING_REQUIRED = 0x0002, -- Capabilities SMB2_GLOBAL_CAP_DFS = 0x00000001, SMB2_GLOBAL_CAP_LEASING = 0x00000002, SMB2_GLOBAL_CAP_LARGE_MTU = 0x00000004, SMB2_GLOBAL_CAP_MULTI_CHANNEL = 0x00000008, SMB2_GLOBAL_CAP_PERSISTENT_HANDLES = 0x00000010, SMB2_GLOBAL_CAP_DIRECTORY_LEASING = 0x00000020, SMB2_GLOBAL_CAP_ENCRYPTION = 0x00000040, -- Context Types SMB2_ENCRYPTION_CAPABILITIES = 0x0002, SMB2_PREAUTH_INTEGRITY_CAPABILITIES = 0x0001 } for i, v in pairs(command_codes) do command_names[v] = i end for i, v in pairs(smb2_values) do smb2_values_codes[v] = i end --- -- Creates a SMB2 SYNC header packet. -- -- SMB2 Packet Header - SYNC: -- * https://msdn.microsoft.com/en-us/library/cc246529.aspx -- -- @param smb The SMB object associated with the connection. -- @param command The SMB2 command to execute. -- @param overrides Overrides table. -- @return header The encoded SMB2 SYNC header. --- function smb2_encode_header_sync(smb, command, overrides) overrides = overrides or {} local sig = "\xFESMB" -- SMB2 packet local structureSize = 64 -- SYNC header structure size local flags = 0 -- TODO: Set flags that will work for all dialects -- Increase the message id if smb['MessageId'] then smb['MessageId'] = smb['MessageId'] + 1 end -- Header structure local header = string.pack("<c4 I2 I2 I4 I2 I2 I4 I4 I8 I4 I4 I8 c16", sig, -- 4 bytes: ProtocolId structureSize, -- 2 bytes: StructureSize. Must be 64. (overrides['CreditCharge'] or 0), -- 2 bytes: CreditCharge. (overrides['Status'] or 0), -- 4 bytes: (ChannelSequence/Reserved)/Status. command, -- 2 bytes: Command. (overrides['CreditR'] or 0), -- 2 bytes: CreditRequest/CreditResponse. (overrides['Flags'] or flags), -- 4 bytes: Flags. TODO (overrides['NextCommand'] or 0), -- 4 bytes: NextCommand. (overrides['MessageId'] or smb['MessageId'] or 0), -- 8 bytes: MessageId. (overrides['Reserved'] or 0), -- 4 bytes: Reserved. (overrides['TreeId'] or smb['TreeId'] or 0), -- 4 bytes: TreeId. (overrides['SessionId'] or smb['SessionId'] or 0), -- 8 bytes: SessionId. (overrides['Signature'] or '1234567890123456') -- 16 bytes: Signature. ) return header end --- -- Sends a SMB2 packet -- @param smb The SMB object associated with the connection -- @param header The header encoded with <code>smb_encode_sync_header</code>. -- @param data The data. -- @param overrides Overrides table. -- @return Boolean Status. -- @return An error message if status is false. --- function smb2_send(smb, header, data, overrides) overrides = overrides or {} local body = header .. data local attempts = 5 local status, err local out = string.pack(">s4", body) repeat attempts = attempts - 1 stdnse.debug3("SMB: Sending SMB packet (len: %d, attempts remaining: %d)", #out, attempts) status, err = smb['socket']:send(out) until(status or (attempts == 0)) if(attempts == 0) then stdnse.debug1("SMB: Sending packet failed after 5 tries! Giving up.") end return status, err end --- -- Reads the next SMB2 packet from the socket, and parses it into the header and data. -- Netbios handling based taken from smb.lua. -- -- @param smb The SMB object associated with the connection -- @param read_data [optional] Return data section. Set to false if you only need the header. Default: true -- @return (status, header, data) If status is true, the header, -- and data are all the raw arrays of bytes. -- If status is false, header contains an error message and data is undefined. --- function smb2_read(smb, read_data) stdnse.debug3("SMB2: Receiving SMB2 packet") -- Receive the response -- we make sure to receive at least 4 bytes, the length of the NetBIOS length smb['socket']:set_timeout(TIMEOUT) -- attempt to read the Netbios header local status, netbios_data = smb['socket']:receive_buf(match.numbytes(4), true); -- Make sure the connection is still alive if not status then return false, "SMB2: Failed to receive bytes: " .. netbios_data end -- The length of the packet is 4 bytes of big endian (for our purposes). -- The NetBIOS header is 24 bits, big endian local netbios_length, pos = string.unpack(">I4", netbios_data) -- Make the length 24 bits netbios_length = netbios_length & 0x00FFFFFF -- The total length is the netbios_length, plus 4 (for the length itself) local length = netbios_length + 4 local status, smb_data = smb['socket']:receive_buf(match.numbytes(netbios_length), true) -- Make sure the connection is still alive if not status then return false, "SMB2: Failed to receive bytes after 5 attempts: " .. smb_data end local result = netbios_data .. smb_data if(#result ~= length) then stdnse.debug1("SMB2: ERROR: Received wrong number of bytes, there will likely be issues (received %d, expected %d)", #result, length) return false, string.format("SMB2: ERROR: Didn't receive the expected number of bytes; received %d, expected %d. This will almost certainly cause some errors.", #result, length) end -- The header is 64 bytes. if (pos + 64 > #result) then stdnse.debug2("SMB2: SMB2 packet too small. Size needed to be at least '%d' but we got '%d' bytes", pos+64, #result) return false, "SMB2: ERROR: Header packet too small." end local header, pos = string.unpack("<c64", result, pos) -- Read the data section or skip it if read_data is false. local data if(read_data == nil or read_data == true) then data = result:sub(pos) end stdnse.debug3("SMB2: smb2_read() received %d bytes", #result) return true, header, data end --- -- Sends SMB2_COM_NEGOTIATE command for a SMB2/SMB3 connection. -- This function works for dialects 2.02, 2.10, 3.0, 3.02 and 3.11. -- -- Packet structure: https://msdn.microsoft.com/en-us/library/cc246543.aspx -- -- @param smb The associated SMB connection object. -- @param overrides Overrides table. -- @return (status, dialect) If status is true, the negotiated dialect is returned as the second value. -- Otherwise if status is false, the error message is returned. function negotiate_v2(smb, overrides) local StructureSize = 36 -- Must be set to 36. local DialectCount if overrides['Dialects'] then DialectCount = #overrides['Dialects'] else DialectCount = 1 end -- The client MUST set SecurityMode bit to 0x01 if the SMB2_NEGOTIATE_SIGNING_REQUIRED bit is not set, -- and MUST NOT set this bit if the SMB2_NEGOTIATE_SIGNING_REQUIRED bit is set. -- The server MUST ignore this bit. local SecurityMode = overrides["SecurityMode"] or smb2_values['SMB2_NEGOTIATE_SIGNING_ENABLED'] local Capabilities = overrides["Capabilities"] or 0 -- SMB 3.x dialect requires capabilities to be constructed local GUID = overrides["GUID"] or "1234567890123456" local ClientStartTime = overrides["ClientStartTime"] or 0 -- ClientStartTime only used in dialects > 3.11 local total_data = 0 -- Data counter local padding_data = "" -- Padding string to align contexts local context_data -- Holds Context data local is_0311 = false -- Flag for SMB 3.11 local status, err if not( overrides['Dialects'] ) then -- Set 2.02 as default dialect if user didn't select one overrides['Dialects'] = {0x0202} end local header = smb2_encode_header_sync(smb, command_codes['SMB2_COM_NEGOTIATE'], overrides) -- We construct the first block that works for dialects 2.02 up to 3.11. local data = string.pack("<I2 I2 I2 I2 I4 c16", StructureSize, -- 2 bytes: StructureSize DialectCount, -- 2 bytes: DialectCount SecurityMode, -- 2 bytes: SecurityMode 0, -- 2 bytes: Reserved - Must be 0 Capabilities, -- 4 bytes: Capabilities - 0 for dialects > 3.x GUID -- 16 bytes: ClientGuid ) -- The next block gets interpreted in different ways depending on the dialect if tableaux.contains(overrides['Dialects'], 0x0311) then is_0311 = true end -- If we are dealing with 3.11 we need to set the following fields: -- NegotiateContextOffset, NegotiateContextCount, and Reserved2 if is_0311 then total_data = #header + #data + (DialectCount*2) padding_data = string.rep("\0", (8 - total_data % 8) % 8) total_data = total_data + #padding_data data = data .. string.pack("<I4 I2 I2", total_data+8, -- NegotiateContextOffset (4 bytes) 0x2, -- NegotiateContextCount (2 bytes) 0x0 -- Reserved2 (2 bytes) ) else -- If it's not 3.11, the bytes are the ClientStartTime (8 bytes) data = data .. string.pack("<I8", ClientStartTime) -- If it is not 3.11, we set it to 0 end -- if is_0311 -- Now we build the Dialect list, 16 bit integers if(overrides['Dialects'] == nil) then -- If no custom dialect is defined, used the default 2.10 data = data .. string.pack("<I2", 0x0210) else -- Dialects are set in overrides table for _, v in ipairs(overrides['Dialects']) do data = data .. string.pack("<I2", v) end end -- If 3.11, we now need to add some padding between the dialects and the NegotiateContextList -- I was only able to get this to work using both NegotiateContexts: -- * SMB2_PREAUTH_INTEGRITY_CAPABILITIES -- * SMB2_ENCRYPTION_CAPABILITIES if is_0311 then data = data .. padding_data local negotiate_context_list, context_data -- We set SMB2_ENCRYPTION_CAPABILITIES first context_data = string.pack("<I2 I2 I2", 0x2, -- CipherCount (2 bytes): 2 ciphers available 0x0002, -- Ciphers (2 bytes each): AES-128-GCM 0x0001 -- Ciphers (2 bytes each): AES-128-CCM ) data = data .. string.pack("<I2 I2 I4", smb2_values['SMB2_ENCRYPTION_CAPABILITIES'],-- ContextType (2 bytes) #context_data, -- DataLength (2 bytes) 0x0 -- Reserved (4 bytes) ) .. context_data -- Data (SMB2_ENCRYPTION_CAPABILITIES) -- We now add SMB2_PREAUTH_INTEGRITY_CAPABILITIES -- We add the padding between contexts so they are 8 byte aligned total_data = #header + #data padding_data = string.rep("\0", (8 - total_data % 8) % 8) data = data .. padding_data context_data = context_data .. string.pack("<I2 I2 I2 I16 I16", 0x1, -- HashAlgorithmCount (2 bytes) 0x20, -- SaltLength (2 bytes) 0x0001, -- HashAlgorithms (2 bytes each): SHA-512 0x0, -- Salt 0x1 -- Salt ) data = data .. string.pack("<I2 I2 I4", smb2_values['SMB2_PREAUTH_INTEGRITY_CAPABILITIES'], -- ContextType (2 bytes) #context_data, -- DataLength (2 bytes) 0x0 -- Reserved (4 bytes) ) .. context_data end status, err = smb2_send(smb, header, data) if not status then return false, err end status, header, data = smb2_read(smb) local protocol_version, structure_size, credit_charge, status = string.unpack("<c4 I2 I2 I4", header) -- Get the protocol version if(protocol_version ~= ("\xFESMB") or structure_size ~= 64) then return false, "SMB: Server returned an invalid SMBv2 packet" end stdnse.debug2("SMB2_COM_NEGOTIATE returned status '%s'", status) if status ~= 0 then stdnse.debug2("SMB2_COM_NEGOTIATE command failed: Dialect not supported.") return false, "SMB2: Dialect is not supported. Exiting." end local parameters_format = "<I2 I2 I2 I2 c16 I4 I4 I4 I4 I8 I8" if #data < string.packsize(parameters_format) then -- smb.lua can tolerate missing time/timezone, but it's less likely any -- SMB2 implementations will not have them. If this becomes a problem, we -- can shorten this unpack format like in smb.negotiate_v1 return false, "SMB2: ERROR: Server returned less data than it was supposed to (one or more fields are missing)" end local data_structure_size, security_mode, negotiate_context_count data_structure_size, smb['security_mode'], smb['dialect'], negotiate_context_count, smb['server_guid'], smb['capabilities'], smb['max_trans'], smb['max_read'], smb['max_write'], smb['time'], smb['start_time'] = string.unpack(parameters_format, data) if(data_structure_size ~= 65) then return false, string.format("Server returned an unknown structure size in SMB2 NEGOTIATE response") end -- Convert the time and timezone to human readable values (taken from smb.lua) smb['time'] = (smb['time'] // 10000000) - 11644473600 smb['date'] = datetime.format_timestamp(smb['time']) -- Samba does not report the boot time if smb['start_time'] ~= 0 then smb['start_time'] = (smb['start_time'] // 10000000) - 11644473600 smb['start_date'] = datetime.format_timestamp(smb['start_time']) else smb['start_date'] = "N/A" end local security_buffer_offset, security_buffer_length, neg_context_offset security_buffer_offset, security_buffer_length, neg_context_offset = string.unpack("<I2 I2 I4", data) if status == 0 then return true, overrides['Dialects'] else return false, string.format("Status error code:%s",status) end end return _ENV;