
    h^                        d Z ddlZddlmZ ddlmZmZmZ ddlm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z# ddl$m%Z%m&Z& ddl'm(Z(m)Z)m*Z*m+Z+ ddl,m-Z-m.Z. dd	l/m0Z0 dd
l1m2Z2m3Z3 i ddddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+i d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMi dNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndoi dpdqdrdsdtdudvdwdxdydzd{d|d}d~dddddddddddddddddddddddddddZ4 G d de          Z5 G d de          Z6 G d de          Z7 ee5e7dp           d Z8d Z9 G d de          Z:g dZ; G d de:          Z< ee5e<dpdz            G d de:          Z= ee5e=dpdzd            G d de:          Z> ee5e>dpdz            G d de          Z? ee5e?dr            G d de          Z@ ee5e@dv            ee?e@dv            G d de          ZA ee5eAdrd            G d de          ZB ee5eBdrdz            G d deB          ZC ee5eCdrdzd            G d de          ZD ee5eDdr           de*jE        fde*jF        fgZG G d de          ZHd ZI G d de(          ZJ ee5eJdJ            G dĄ deJ          ZK G dƄ de(          ZL ee5eLdJdz           dddddddΜZMdddddddddddٜ
ZN G dڄ de          ZO G d܄ deO          ZP G dބ deO          ZQ G d deO          ZRi ddՓddؓddd*dd@ddddzdddddddddddddddddddddddddZS G d d eOe&          ZT G d de          ZU G d deOe&          ZV G d de          ZW G d deW          ZX G d	 d
eW          ZY G d deX          ZZ G d de          Z[ ee-e[            ee.e[           dS (  a  
SMB 1.0 (Server Message Block), also known as CIFS.

.. note::
    You will find more complete documentation for this layer over at
    `SMB <https://scapy.readthedocs.io/en/latest/layers/smb.html>`_

Specs:

- [MS-CIFS] (base)
- [MS-SMB] (extension of CIFS - SMB v1)
    N)conf)Packetbind_layersbind_top_down)ByteEnumField	ByteFieldConditionalFieldFieldLenFieldFieldListField
FlagsFieldIPFieldLEFieldLenFieldLEIntEnumField
LEIntFieldLELongFieldLEShortEnumFieldLEShortFieldMultipleTypeFieldPacketFieldPacketLenFieldPacketListFieldReversePadFieldScalingField
ShortFieldStrFixedLenFieldStrNullFieldStrNullFieldUtf16UTCTimeField	UUIDFieldXLEShortFieldXStrLenField)DNSStrFieldDNSCompressedPacket)_NTLMPayloadPacket_NTLMPayloadField
_NTLM_ENUM_NTLM_post_build)
NBTSessionNBTDatagram)GSSAPI_BLOB)STATUS_ERREFSMB2_HeaderSMB_COM_CREATE_DIRECTORY   SMB_COM_DELETE_DIRECTORY   SMB_COM_OPEN   SMB_COM_CREATE   SMB_COM_CLOSE   SMB_COM_FLUSH   SMB_COM_DELETE   SMB_COM_RENAME   SMB_COM_QUERY_INFORMATION	   SMB_COM_SET_INFORMATION
   SMB_COM_READ   SMB_COM_WRITE   SMB_COM_LOCK_BYTE_RANGE   SMB_COM_UNLOCK_BYTE_RANGE   SMB_COM_CREATE_TEMPORARY   SMB_COM_CREATE_NEW   SMB_COM_CHECK_DIRECTORY   SMB_COM_PROCESS_EXIT   SMB_COM_SEEK   SMB_COM_LOCK_AND_READ   SMB_COM_WRITE_AND_UNLOCK   SMB_COM_READ_RAW   SMB_COM_READ_MPX   SMB_COM_READ_MPX_SECONDARY   SMB_COM_WRITE_RAW   SMB_COM_WRITE_MPX   SMB_COM_WRITE_MPX_SECONDARY    SMB_COM_WRITE_COMPLETE!   SMB_COM_QUERY_SERVER"   SMB_COM_SET_INFORMATION2#   SMB_COM_QUERY_INFORMATION2$   SMB_COM_LOCKING_ANDX%   SMB_COM_TRANSACTION&   SMB_COM_TRANSACTION_SECONDARY'   SMB_COM_IOCTL(   SMB_COM_IOCTL_SECONDARY)   SMB_COM_COPY*   SMB_COM_MOVE+   SMB_COM_ECHO,   SMB_COM_WRITE_AND_CLOSE-   SMB_COM_OPEN_ANDX.   SMB_COM_READ_ANDX/   SMB_COM_WRITE_ANDX0   SMB_COM_NEW_FILE_SIZE1   SMB_COM_CLOSE_AND_TREE_DISC2   SMB_COM_TRANSACTION23   SMB_COM_TRANSACTION2_SECONDARY4   SMB_COM_FIND_CLOSE25   SMB_COM_FIND_NOTIFY_CLOSEp   SMB_COM_TREE_CONNECTq   SMB_COM_TREE_DISCONNECTr   SMB_COM_NEGOTIATEs   SMB_COM_SESSION_SETUP_ANDXt   SMB_COM_LOGOFF_ANDXu   SMB_COM_TREE_CONNECT_ANDX~   SMB_COM_SECURITY_PACKAGE_ANDX   SMB_COM_QUERY_INFORMATION_DISK   SMB_COM_SEARCH   SMB_COM_FIND   SMB_COM_FIND_UNIQUE   SMB_COM_FIND_CLOSE   SMB_COM_NT_TRANSACT   SMB_COM_NT_TRANSACT_SECONDARY   SMB_COM_NT_CREATE_ANDX   SMB_COM_NT_CANCEL   SMB_COM_NT_RENAME   SMB_COM_OPEN_PRINT_FILE   SMB_COM_WRITE_PRINT_FILESMB_COM_CLOSE_PRINT_FILESMB_COM_GET_PRINT_QUEUESMB_COM_READ_BULKSMB_COM_WRITE_BULKSMB_COM_WRITE_BULK_DATASMB_COM_INVALIDSMB_COM_NO_ANDX_COMMAND)                     c                   N    e Zd ZdZ eddd           edde           edde           e	d	d
dg d           e	dddg d           e
dd           eddd           e
dd           e
dd           e
dd           e
dd           e
dd          gZ fdZd Z xZS )
SMB_HeaderzSMB 1 Protocol Request HeaderStart   SMBr4   Commandr   Statusr   Flags   r<   )LOCK_AND_READ_OK	BUF_AVAILresCASE_INSENSITIVECANONICALIZED_PATHSOPLOCKOPBATCHREPLYFlags2)
LONG_NAMESEASSMB_SECURITY_SIGNATURE
COMPRESSEDSMB_SECURITY_SIGNATURE_REQUIREDr   IS_LONG_NAMEr   r   r   REPARSE_PATHEXTENDED_SECURITYDFS	PAGING_IO	NT_STATUSUNICODEPIDHighSecuritySignature    lengthReservedTIDPIDLowUIDMIDc                    |s(t          t          |                               |          S t          |d d                   }| j        dk    r-| j        j        r| j        j        rt          S t          S t          S | j        dk    r|dk    rt          S | j        j        r4|dk    rt          S |dk    rt          S | j        j        rt          S t          S |dk    rt          S |dk    rt           S | j        j        rt          S t           S | j        d	k    r4| j        j        r|d
k    rt"          S t$          S |d
k    rt"          S t&          S t          t          |                               |          S )Nr.   r   r   r   r4   r2   rD   rF   rl   rN   )superr   guess_payload_classordr   r   r   r   r   'SMBNegotiate_Response_Extended_SecuritySMBNegotiate_Response_SecuritySMBNegotiate_RequestSMBSession_Null0SMBSession_Setup_AndX_Response_Extended_SecuritySMBSession_Setup_AndX_Response/SMBSession_Setup_AndX_Request_Extended_SecuritySMBSession_Setup_AndX_RequestSMBMailslot_WriteSMBTransaction_ResponseSMBTransaction_Request)selfpayload	WordCount	__class__s      T/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/layers/smb.pyr   zSMB_Header.guess_payload_class   s}    	HT**>>wGGG$$	<4z ,;0 :BB99++\T!!A~~&&z 9$$KK$&&99;0 :KK99$$JJ$&&88;0 9JJ88\T!!z 	2$$,,22$$,,11Z&&::7CCCr   c                     t           |v S N)r   )r   pkts     r   answerszSMB_Header.answers   s    S  r   )__name__
__module____qualname__namer   r   SMB_COMr   r+   r   r   fields_descr   r  __classcell__r   s   @r   r   r      sQ       *D*a00iw//xL11
	 	 			
 	
 	
  		
 	
. 	Y'',c!<<<Z%%UAXq!!UAUAa1Kf-D -D -D -D -D^! ! ! ! ! ! !r   r   c                   H    e Zd ZdZ edd           edd          gZd ZdS )SMB_DialectzSMB DialectBufferFormatr0   DialectStringz
NT LM 0.12c                     t           j        S r   r   padding_layerr   r   s     r   default_payload_classz!SMB_Dialect.default_payload_class      !!r   N)r  r  r  r  r   r   r  r   r   r   r  r    sM        D	.$''_l33K
" " " " "r   r  c                   v    e Zd ZdZ edd           eddd           ed e            ged 	          gZdS )
r   zSMB Negotiate Requestr   r   	ByteCountNDialects	length_ofc                     | j         S r   r  r   s    r   <lambda>zSMBNegotiate_Request.<lambda>  s    CM r   length_from)	r  r  r  r  r   r   r   r  r  r  r   r   r   r     sh        "D	+q!!TZ@@@[]]O11		
 	
 	
	KKKr   r   )r   c                 f    d }t          t          | |          |fgt          | |                    S )zb
    Returns a StrNullField that is either normal or UTF-16 depending
    on the SMB headers.
    c                     t          | d          s%| j        r| j        } t          | d          s| j        t          | d          o| j        j        S )Nr   )hasattr
underlayerr   r   r  s    r   _isUTF16z"_SMBStrNullField.<locals>._isUTF16(  s[    #x(( 	!S^ 	!.C #x(( 	!S^ 	!sH%%<#**<<r   )r   r   r   )r  defaultr$  s      r   _SMBStrNullFieldr&  "  sG    = = =
 
D'
*
*H	56T7##  r   c                 z    |                      |          \  }}t          |                    | |d                    S )zD
    Returns the length of a field, works with Unicode strings.
    r   )getfield_and_vallenaddfield)r   r  fldvs       r   _lenr-  3  s9     !!$''FCs||CC(()))r   c                   &    e Zd Zedd            ZdS )_SMBNegotiate_ResponseNc                     |rLt          |          dk    r9t          j        d|d d                   }|dk    rt          S |dk    rn|dk    r| S | S )Nr0   <Hr.   rF   rN   )r)  structunpack SMBNegotiate_Response_NoSecurity)cls_pktargskargswcs        r   dispatch_hookz$_SMBNegotiate_Response.dispatch_hook<  sc     	CIINN tT"1"X..BQww77s t

r   r   r  r  r  classmethodr:  r  r   r   r/  r/  ;  s2           [  r   r/  ) RAW_MODEMPX_MODEr   LARGE_FILESNT_SMBSRPC_REMOTE_APISSTATUS32LEVEL_II_OPLOCKSLOCK_AND_READNT_FINDr   r   r   INFOLEVEL_PASSTHRULARGE_READXLARGE_WRITEXLWIOr   r   r   r   r   r   UNIXr   COMPRESSED_DATAr   r   r   DYNAMIC_REAUTHPERSISTENT_HANDLESr   c                      e Zd ZdZ edd           edd           edddg d	           ed
d           edd           edd           edd           edd           eddde           e	dddg dd           e
dddd            ed!dd"d#$           ed%dd&d' (           ed"d)d* +           ed&d,          gZdS )-r4  z)SMB Negotiate No-Security Response (CIFS)r   r.   DialectIndexr:   SecurityModer2   r<   )USER_SECURITYENCRYPT_PASSWORDSSECURITY_SIGNATURES_ENABLEDSECURITY_SIGNATURES_REQUIREDMaxMpxCountr   MaxNumberVCMaxBufferSize?  
MaxRawSize   
SessionKeyr   ServerCapabilitiesi  
ServerTimeNz<Q)iA  r.   r.   r   r   r   g    cA)fmtepochcustom_scalingServerTimeZone<   z<hzmin-UTC)r_  unitChallengeLength	Challengez<Br  r_  r  
DomainNamec                 0    |t          | j                  z   S r   )r)  rf  r   xs     r   r  z)SMBNegotiate_Response_NoSecurity.<lambda>  s    !c#-&8&8"8 r   r  adjustr   c                     | j         S r   re  r  s    r   r  z)SMBNegotiate_Response_NoSecurity.<lambda>  	    C$7 r   r  	WORKGROUP)r  r  r  r  r   r   r   r   _SMB_ServerCapabilitiesr   r   r
   r   r!   r   r  r  r   r   r4  r4  w  s|       6D	+s##^Q''
  	
	
 
	
 	]B'']A&&
?E**
<''
<((
'6MNN'''	
 	
 	
 	%tIFFF!	
 	
 	
 	"88		
 	
 	
 	77	
 	
 	

 	\;//]/KKKr   r4  )r   r   c            
           e Zd ZdZdZej        dd          edddd           ej        d	          ed
dej	                   e
dded           gz   ZdS )r   z.SMB Negotiate Extended Security Response (SMB)rN   NrD   r  SecurityBlobc                     |dz   S NrL   r  )_rk  s     r   r  z0SMBNegotiate_Response_Extended_Security.<lambda>  s    QQSV r   rl  rF   GUIDuuid_fmtc                     | j         dz
  S rv  r  rk  s    r   r  z0SMBNegotiate_Response_Extended_Security.<lambda>  s    Q[SUEU r   r  )r  r  r  r  r   r4  r  r   r   	FORMAT_LEr   r*   r  r   r   r   r     s        ;DI2>ssC@S@S	
 	
 	
 	)4R8	&$)<===D+;U;U	
 	
 	
	G 	KKKr   r   i   )r   r   r   c                       e Zd ZdZdZej        dd          edddd            ed	d
d            e	dd           e	dd          gz   ZdS )r   z2SMB Negotiate Non-Extended Security Response (SMB)rN   NrD   r  rh  c                 P    |dz   t          | d          z   t          | d          z   S )Nr0   rf  
ServerName)r-  rj  s     r   r  z'SMBNegotiate_Response_Security.<lambda>  s4    !#3$$#% 3%%#& r   rl  rf  r   c                     | j         S r   ro  r  s    r   r  z'SMBNegotiate_Response_Security.<lambda>  rp  r   r  rq  r  RMFF1)
r  r  r  r  r   r4  r  r   r!   r&  r  r   r   r   r     s        ?DI2>ssC"& &		
 	
 	
 	77	
 	
 	

 	{33w//!G KKKr   r   c                      e Zd ZdZ edd           edde           edd           edd	           ed
d           edd           edd           edd           e	dd	d           e	dd	d           edd           e
ddde           edd	           eddd            eddd            e edd          d d!           ed"d#           ed$d%           ed&d%          gZd' Zd	S )(r   z!Session Setup AndX Request (CIFS)r   rF   AndXCommandr   AndXReservedr   
AndXOffsetNrW  rX  MaxMPXCountr   VCNumberr[  OEMPasswordLengthOEMPasswordr  UnicodePasswordLengthUnicodePasswordr   r\  r6   r]  r  Passc                     | j         S r   )r  r|  s    r   r  z&SMBSession_Setup_AndX_Request.<lambda>  s	    !BU r   r  c                     | j         S r   )r  r|  s    r   r  z&SMBSession_Setup_AndX_Request.<lambda>  s	    Q=T r   AccountNameGUESTr0       PrimaryDomain NativeOSWindows 4.0NativeLanManc                    | j         F| j        dk    r;|d d         t          j        dt	          |          dz             z   |dd          z   }| j        ;|d d         t          j        dt	          |          dz
            z   |dd          z   }| j        rbt          | j        d          rM|rK|d d         t          j        dt	          |          t	          |          z   dz             z   |dd          z   }||z   S )	Nr   r2   r1  rb   r6   rX   r\   r  )r  r  r2  packr)  r  r   r"  r   r   pays      r   
post_buildz(SMBSession_Setup_AndX_Request.post_build  s    ?"t'74'?'?bqb'FKc#hhm<<<s122wFC>!crc(V[s3xx"}===BCCHC< 	RGDL,?? 	RC 	Rbqb'FKc#hhS.AB.FGGG#abb'QCSyr   )r  r  r  r  r   r   r  r   r   r   r   rr  r!   r   r&  r  r  r  r   r   r   r     s       .D	+t$$mT733	.!$$\4((_e,,]B''Z##
<##+T]KKK/ARSSS
:q!!
's4KLL[$'']F8U8UVVVv3T3T	
 	
 	
 	((@@!UKK"--]3377+K0    r   r   c                       e Zd ZdZdZej        dd          edddg d           eddd	d
           e	dd           e
d	dd            e edd          d           edd          gz   Zd ZdS )SMBTree_Connect_AndXzSession Tree Connect AndXr4   Nr   r  r   )DISCONNECT_TIDr2EXTENDED_SIGNATURESEXTENDED_RESPONSEPasswordLengthPasswordr1  rg  r  r   c                     | j         S r   )r  r  s    r   r  zSMBTree_Connect_AndX.<lambda>  s	    c>P r   r  Pathz\\WIN2K\IPC$r0   Servicez?????c                     ||z  }| j         ;|d d         t          j        dt          |          dz
            z   |dd          z   }|S Nr>   r1  rB   r  r2  r  r)  r  s      r   r  zSMBTree_Connect_AndX.post_build"  sM    s
>!bqb'FKc#hhm<<<s233xGC
r   )r  r  r  r  r   r   r  r   r
   r   r!   r   r&  r   r  r  r   r   r  r    s        &DI/;BQB?
PPP		
 	
 	&
MMM[$''Z2P2PQQQ((1BCCQGGY((C K    r   r  )r  c            	           e Zd ZdZdZej        dd          eddd          gz   ej        dd         z    ed	d           e	dde
d
            e edd          dd           edd          gz   Zd ZdS )r   z2Session Setup AndX Extended Security Request (SMB)rD   Nr<   SecurityBlobLengthrt  r  r@   r  c                     | j         S r   )r  r|  s    r   r  z8SMBSession_Setup_AndX_Request_Extended_Security.<lambda>>  s	    a&: r   r  r  r  r0   r  r  c                     | j         ;|d d         t          j        dt          |          dz
            z   |dd          z   }||z   S )N   r1  rX   r  r  s      r   r  z:SMBSession_Setup_AndX_Request_Extended_Security.post_buildI  sI    >!crc(V[s3xx"}===BCCHCSyr   )r  r  r  r  r   r   r  r   r   r   r*   r   r&  r  r  r   r   r   r   /  s        ?DI%1"1"5O0$.QQQ
	
 (
3BrE
:		; Ld++N::	   O  ];; 
 ^];;
	
 .    r   r   )r   r   c                      e Zd ZdZ edd           edde           edd           edd	           ed
ddddd           edd           e	dd           e	dd           e	dd           edd           edde           edd           edd           edd           edd           e
dd            e
d!d          gZd" Zd	S )#r   z"Session Setup AndX Response (CIFS)r   r2   r  r   r  r   r  NActionr   SMB_SETUP_GUESTSMB_SETUP_USE_LANMAN_KEYr.   r0   r  r  r  r  r  r  r  
WordCount2AndXCommand2	Reserved3AndXOffset2P   OptionalSupportr.   
ByteCount2r6   r  IPCNativeFileSystemc                     | j         ;|d d         t          j        dt          |          dz             z   |dd          z   }||z   S )Nr2   r1  rb   r6   )r  r2  r  r)  r  s      r   r  z)SMBSession_Setup_AndX_Response.post_build{  sI    ?"bqb'FKc#hhm<<<s122wFCSyr   )r  r  r  r  r   r   r  r   r   r&  r   r  r  r  r   r   r   r   \  sR       /D	+s##mT733	.!$$\4((
)2 		
 	
 	["%%]3377"--	,""ndG44	+q!!]B''&--\1%%Y&&',,5K:    r   r   c                        e Zd ZdZdZej        dd         ej        d         gz   ej        dd         z   Z fdZ xZ	S )r   z3Session Setup AndX Extended Security Response (SMB)r4   Nr6   r<   rB   c                     | j         ;|d d         t          j        dt          |          dz
            z   |dd          z   }t	          t
          |                               ||          S r  )r  r2  r  r)  r   r   r  )r   r   r  r   s      r   r  z;SMBSession_Setup_AndX_Response_Extended_Security.post_build  sh    >!bqb'FKc#hhm<<<s233xGCEtLLWW
 
 	
r   )
r  r  r  r  r   r   r  r   r  r  r	  s   @r   r   r     s         ADI&22A26:FqI
J	K
9
Ebcc
J	K 
 
 
 
 
 
 
 
 
r   r   c                   >    e Zd Z edd           edd          gZdS )r   r   r   r  N)r  r  r  r   r   r  r  r   r   r   r     s0        9[!,,ll;.J.JKKKKr   r   LenBufferOffsetc                       e Zd Zd ZdS )_SMB_TransactionRequest_Datac                     |j         dk    rt          |          S |j         dk    s|j        dk    rt          |          S t	          j        |          S )Ns   \MAILSLOT\NET\NETLOGONs   \MAILSLOT\BROWSEs   \MAILSLOT\LANMAN)NameNETLOGONr  BRWSr   	raw_layer)r   r   ms      r   m2iz _SMB_TransactionRequest_Data.m2i  sR    8333A;;X...#(>S2S2S77N~a   r   N)r  r  r  r  r  r   r   r  r    s#        ! ! ! ! !r   r  c                 `    	 t          t          | |                    S # t          $ r Y dS w xY wNr   )r)  getattrAttributeErrorrj  s     r   _optlenr    s?    73??###   qqs    
--c                   ~   e Zd ZdZdZ edddd d           ed	ddd
d            edddd
d            edd           edd           edd           edd           edddddd           e	dd           e
dd           edd           edd           edd           edd           edd d!d"           ed#d           ed!g d$ ed%d          d& '           ed(dd)d
d*            ed)d+           edd,  ed-d.d/ 0           ed1dej        d2 0          g          gZd3 Zd4 ZdS )5r   zSMB COM Transaction RequestBufferr   N
SetupCountc                     |dz   S )NrH   r  rj  s     r   r  zSMBTransaction_Request.<lambda>  
    !d( r   Br  rm  r_  TotalParamCountr1  c                 "    t          | d          S N	Parameterr  r   rw  s     r   r  zSMBTransaction_Request.<lambda>      '#{";"; r   r  r_  rm  TotalDataCountc                 "    t          | d          S NDatar  r  s     r   r  zSMBTransaction_Request.<lambda>      '#v"6"6 r   MaxParamCountr   MaxDataCountMaxSetupCount	Reserved1r   r   r  NO_RESPONSEr  Timeouti  	Reserved2ParameterLenParameterBufferOffsetDataLenDataBufferOffsetr2   Setupcount_ofr_  r  r.   r.   r0   r  c                     | j         S r   r  r  s    r   r  zSMBTransaction_Request.<lambda>      3> r   
count_fromr  r  c                 J    |t          | d          z   t          | d          z   S Nr  r  r  rj  s     r   r  zSMBTransaction_Request.<lambda>  s$    !gc;&?&?"?'#vBVBV"V r   z\MAILSLOT\NET\NETLOGONc                 f    dt          | j                  dz  z   t          | j                  z   dz   S )N?   r0   r.   )r)  r  r  r  s    r   r  zSMBTransaction_Request.<lambda>  s*    #ci..1"44s38}}DqH r   r  r   c                     | j         S r   r  r  s    r   r  zSMBTransaction_Request.<lambda>  	    c>N r   r  r  c                     | j         S r   r  r  s    r   r  zSMBTransaction_Request.<lambda>   s    #+ r   c                     t          | |dt          | j                  dz  z   t          | j                  z   dz   dddt                    |z   S )Nr  r0   r.   rR      r  r  config)r'   r)  r  r  _SMB_CONFIGr  s      r   r  z!SMBTransaction_Request.post_build  sg     #dj//A--DI>B!#  #	 	 	 
	
r   c                     t          | dd           /|                     d          | j                                        z   S |                     d          S )Nr  zTran %Name% zTran %Name%)r  sprintfr  	mysummaryr   s    r   r  z SMBTransaction_Request.mysummary  sK    4&&2<<//$)2E2E2G2GGG||M***r   )r  r  r  r  _NTLM_PAYLOAD_FIELD_NAMEr
   r   r   r   r   r   r   r   r%   r!   r  r   r  r  r  r  r  r   r   r   r     si       (D' 	"**	
 	
 	
 	;;	
 	
 	
 	66	
 	
 	
 	_a((^Q''	/1%%	+q!!
7As*:$O$OPP
9d##
;""^T**,d33Y%%'..lASAAA	+q!!IILQ11		
 	
 	
 	VV	
 	
 	
 	V899HH2N2N   -,D$.>U>U  		
 	
e>K@
 
 
 + + + + +r   r   c                       e Zd ZdZdS )r   rN   N)r  r  r  r   r  r   r   r   r     s        IIIr   r   c                      e Zd ZdZdZ edddd d           ed	ddd
d            edddd
d            edd           edd           edd           edd           edd           edd           edd           edddd           edd           edg d edd          d            edddd
d             e	dd!  e
d"d#d$ %           e
d&d#d' %          g          gZd( ZdS ))r   zSMB COM Transaction Responser  r   Nr  c                     |dz   S )Nr@   r  rj  s     r   r  z SMBTransaction_Response.<lambda>.  r  r   r  r  r  r1  c                 "    t          | d          S r  r  r  s     r   r  z SMBTransaction_Response.<lambda>6  r  r   r  r  c                 "    t          | d          S r  r  r  s     r   r  z SMBTransaction_Response.<lambda>=  r  r   r  r  r  ParameterDisplacementr   r  r  DataDisplacementr2   r  r  r  r  r  c                     | j         S r   r  r  s    r   r  z SMBTransaction_Response.<lambda>L  r  r   r  r  c                 D    t          | d          t          | d          z   S r  r  rj  s     r   r  z SMBTransaction_Response.<lambda>T  s    '#{";";gc6>R>R"R r   c                 6    dt          | j                  dz  z   S )N6   r0   )r)  r  r  s    r   r  z SMBTransaction_Response.<lambda>X  s    #ci..1"44 r   r  r   c                     | j         S r   r  r  s    r   r  z SMBTransaction_Response.<lambda>[  r   r   r  r  c                     | j         S r   r  r  s    r   r  z SMBTransaction_Response.<lambda>]  s    #+ r   c                 p    t          | |dt          | j                  dz  z   dddt                    |z   S )Nr  r0   r:   rF   r  r  )r'   r)  r  r  r  s      r   r  z"SMBTransaction_Response.post_buildb  sU     #dj//A--!"  #	 	 	 
	
r   )r  r  r  r  r  r
   r   r   r   r%   r!   r  r  r  r   r   r   r   &  s       )D'"**	
 	
 	
 	;;	
 	
 	
 	66	
 	
 	
 	[$''^T**,d33,a00Y%%'..'++lASAAA	+q!!IILQ11		
 	
 	
 	RR	
 	
 	
 	442N2N   VS6M6MNNN			
 		
[7Kr
 
 
 
 
r   r   LOGON_PRIMARY_QUERYLOGON_SAM_LOGON_REQUESTLOGON_SAM_LOGON_RESPONSELOGON_SAM_USER_UNKNOWNLOGON_SAM_LOGON_RESPONSE_EXLOGON_SAM_USER_UNKNOWN_EX)r:   rP   rR      r  r  V1V5V5EXV5EX_WITH_IPV5EX_WITH_CLOSEST_SITEAVOID_NT4EMULPDCIPLOCALGC)
r.   r0   r4   r<   rL   i   i          @        c                   &    e Zd Zedd            ZdS )r  Nc                    |r|d         dk    rt           S |d         dk    rt          S |d         dk    rz	 |                    d          }t          j        d                             d ||dz
  |                   d         }|j        r|j        st          S n# t          $ r Y nw xY wt          S |d         d	k    rt          S |d         d
k    rt          S |d         dk    rt          S | S )Nr   r:   rP   rR      r4   r.   r"  r  r  )NETLOGON_LOGON_QUERYNETLOGON_SAM_LOGON_REQUESTindex NETLOGON_SAM_LOGON_RESPONSE_NT40r  getfieldr#  r$  	ExceptionNETLOGON_SAM_LOGON_RESPONSENETLOGON_SAM_LOGON_RESPONSE_EX)r5  r6  r7  r8  i	NtVersions         r   r:  zNETLOGON.dispatch_hook  s    	3Aw$++aD11aD


#677A8DRHQQ $q1uQw-  
 !| @IL @??    D22aD22aD55aD22
s   A B 
B%$B%r   r;  r  r   r   r  r    s2           [  r   r  c            
           e Zd Z edde           edd           edd           edd           eddd	e           e	d
d           e	dd          gZ
dS )r4  OpCoder:   ComputerNamer  MailslotNameUnicodeComputerNamer=  rB   r]  	LmNtToken  	Lm20TokenN)r  r  r  r   _NETLOGON_opcodesr   r   r   _NV_VERSIONr    r  r  r   r   r4  r4    s        3(9::^R((^R((/44
;S+66k6**k6**KKKr   r4  c                      e Zd Z edde           edd           edd           edd           edd	           ed
d           e	dddd           e
ddd            eddde           edd           edd          gZdS )r5  r?  rP   RequestCountr   rB  r  UnicodeUserNamerA  z\MAILSLOT\NET\GETDC701253F9AllowableAccountControlBitsDomainSidSizeNz<I	DomainSid)r_  r  r   c                     | j         S r   )rL  r  s    r   r  z#NETLOGON_SAM_LOGON_REQUEST.<lambda>  s	    s?P r   r  r=  rB   r]  rC  rD  rE  )r  r  r  r   rF  r   r   r   r   r
   r!   r   rG  r    r  r  r   r   r5  r5    s        4):;;^Q''/44+R00^%EFF
0!44otMMM[#3P3PQQQ
;S+66k6**k6**KKKr   r5  c            
           e Zd Z edde           edd           edd           edd           eddd	e           ed
d           edd          gZ	dS )r7  r?  rR   UnicodeLogonServerr  rJ  UnicodeDomainNamer=  r.   r]  rC  rD  rE  N)
r  r  r  r   rF  r   r   rG  r    r  r  r   r   r7  r7    s        4):;;.33+R00-r22
;S+66k6**k6**KKKr   r7  LDAPDCKDC@   TIMESERVCLOSEST   RODCi   GOOD_TIMESERVi   NCSELECT_SECRET_DOMAIN_6i   FULL_SECRET_DOMAIN_6i    WSi @  DS_8i   DS_9rZ  DS_10i   DS_11DNS_CONTROLLER
DNS_DOMAIN
DNS_FOREST)r-  r.  r/  c                   r   e Zd Z edde           edd           edd           edd           eddej        	           ed
dej        	           edd           edd           edd           e	dd           e
ddde           e
ddde           edd           edd          gZd ZdS )r:  r?  r  rP  r  rJ  rQ  
DomainGuidNry  NullGuidDnsForestNameDnsDomainNameDnsHostNameDcIpAddressz0.0.0.0r   r   r]  r=  r.   rC  rD  rE  c                     | j         S r   originalr  s    r   get_fullz$NETLOGON_SAM_LOGON_RESPONSE.get_full
  
    }r   )r  r  r  r   rF  r   r   r}  r"   r   r   _NETLOGON_FLAGSrG  r    r  rp  r  r   r   r:  r:    s       4):;;.33+R00-r22	,y/BCCC	*dY-@AAAOR((OR((M2&&y))
7AsO44
;S+66k6**k6**K"    r   r:  c                   p    e Zd Z edd           edd           edd           edd          gZd ZdS )	
DcSockAddr
sin_familyr0   sin_portr   sin_addrNsin_zeroc                     t           j        S r   r  r  s     r   r  z DcSockAddr.default_payload_class  r  r   )r  r  r  r   r   r   r  r  r  r   r   rt  rt    sf        \1%%Z##
D!!J""	K" " " " "r   rt  c                      e Zd Z edde           edd           eddde           eddej	        	           e
d
d           e
dd           e
dd           e
dd           e
dd           e
dd           e
dd           e
dd           e edd          d            e ed e            e          d            e e
dd          d            eddde           edd           edd          gZd  Zd! ZdS )"r;  r?  r  Sbzr   r   r]  rg  Nry  ri  r  rj  rk  NetbiosDomainNameNetbiosComputerNameUserName
DcSiteNamezDefault-First-Site-NameClientSiteNameDcSockAddrSizerL   c                     | j         j        S r   r=  r&  r  s    r   r  z'NETLOGON_SAM_LOGON_RESPONSE_EX.<lambda>-      2 r   rt  c                     | j         j        S r   r  r  s    r   r  z'NETLOGON_SAM_LOGON_RESPONSE_EX.<lambda>1  r  r   NextClosestSiteNamec                     | j         j        S r   )r=  r'  r  s    r   r  z'NETLOGON_SAM_LOGON_RESPONSE_EX.<lambda>5  s    < r   r=  rB   rC  rD  rE  c                     	 |                     d          }| j        d                             | ||dz
  |                   d         | j        d<   n# t          $ r
 d| _        Y nw xY w|S )Nr2  r3  r4   r.   r=  rB   )r6  r  r8  fieldsr9  r=  )r   sr<  s      r   pre_dissectz*NETLOGON_SAM_LOGON_RESPONSE_EX.pre_dissect<  s    	!+,,A'+'7';'D'D!a%'
( ( (DK$$  	! 	! 	! DNNN	!s   AA A&%A&c                     | j         S r   rn  r  s    r   rp  z'NETLOGON_SAM_LOGON_RESPONSE_EX.get_fullG  rq  r   )r  r  r  r   rF  r   r   rr  r   r}  r"   r	   r   r   rt  rG  r    r  r  rp  r  r   r   r;  r;    s       4):;;UA
7AsO44	,y/BCCCOR((OR((M2&&',,)2..J##L";<<$&?@@I&--22	
 	
 	KjjllJ??22	
 	
 	K-r22<<	
 	
 	
;S+66k6**k6**7K<	 	 	    r   r;  c                   ~    e Zd Z eddddddddd	d
ddd
          gZd Zi Zed             Zedd            Z	d Z
dS )r  r?  r   HostAnnouncementAnnouncementRequestRequestElectionGetBackupListRequestGetBackupListResponseBecomeBackupDomainAnnouncementMasterAnnouncementResetStateRequestLocalMasterAnnouncement)
r.   r0   r<   r>   r@   rB   rD   rF   rH   rJ   c                 ,    |                      d          S )Nz%OpCode%r
  r  s    r   r  zBRWS.mysummary]  s    ||J'''r   c                 .    | | j         | j        j        <   d S r   )registered_opcodesr?  r%  )r5  s    r   register_variantzBRWS.register_variantb  s    58sz1222r   Nc                 L    |r!| j                             |d         |           S | S r  )r  getr5  r6  r7  r8  s       r   r:  zBRWS.dispatch_hookf  s,     	<)--d1gs;;;
r   c                     t           j        S r   r  r  s     r   r  zBRWS.default_payload_classl  r  r   r   )r  r  r  r   r  r  r  r<  r  r:  r  r  r   r   r  r  M  s        h$'#() &&%+'
 '
 	 	K( ( ( 9 9 [9    [
" " " " "r   r  c                       e Zd ZdZe edd           edd           eddd	           ed
d           edd           edd           edd           edd           edd           e	dd          gZ
d ZdS )BRWS_HostAnnouncementr.   UpdateCountr   Periodicityi  r  r   rL   r   OSVersionMajorr8   OSVersionMinor
ServerTypei  BrowserConfigVersionMajorr"  BrowserConfigVersionMinor	SignatureiU  Commentr  c                 ,    |                      d          S )Nz%OpCode% for %ServerName%r  r  s    r   r  zBRWS_HostAnnouncement.mysummary  s    ||7888r   N)r  r  r  r?  r  r   r   r   r    r   r  r  r  r   r   r  r  r  s        F	-##
=&))s2666	"A&&	"A&&
<&&	-r22	-q11k6**Y##K9 9 9 9 9r   r  c                   4    e Zd ZdZe edd          gZd ZdS )BRWS_BecomeBackuprB   BrowserToPromoter   c                 ,    |                      d          S )Nz %OpCode% from %BrowserToPromote%r  r  s    r   r  zBRWS_BecomeBackup.mysummary  s    ||>???r   N)r  r  r  r?  r  r   r  r  r  r   r   r  r    sG        F'--K
@ @ @ @ @r   r  c                       e Zd ZdZdS )BRWS_LocalMasterAnnouncementrJ   N)r  r  r  r?  r  r   r   r  r    s        FFFr   r  c                   F    e Zd ZdZ eddd          gZedd            ZdS )_SMBGenericzSMB Generic dispatcherr   r   r4   Nc                     |r=t          |          dk    r*|dd         dk    rt          S |dd         dk    rt          S | S )z
        Depending on the first 4 bytes of the packet,
        dispatch to the correct version of Header
        (either SMB or SMB2)
        r4   Nr   s   SMB)r)  r   r,   r  s       r   r:  z_SMBGeneric.dispatch_hook  sQ      	#CIINNBQBx:%%!!BQBx:%%""
r   r   )r  r  r  r  r   r  r<  r:  r  r   r   r  r    sN        #D##GZ;;<K   [  r   r  )\__doc__r2  scapy.configr   scapy.packetr   r   r   scapy.fieldsr   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   scapy.layers.dnsr"   r#   scapy.layers.ntlmr$   r%   r&   r'   scapy.layers.netbiosr(   r)   scapy.layers.gssapir*   scapy.layers.smb2r+   r,   r  r   r  r   r&  r-  r/  rr  r4  r   r   r   r  r   r   r   r   LENOFFSETr  r  r  r   r   r   rF  rG  r  r4  r5  r7  rr  r:  rt  r;  r  r  r  r  r  r  r   r   <module>r     s           ; ; ; ; ; ; ; ; ; ;                                                         <                   9 8 8 8 8 8 8 8            L
$L
$L 	.L 	
	L
 	/L 	/L 	
L 	
L 	
%L 	
#L 	.L 	/L 	
#L 	
%L 	
$L  	
!L" 	
##L L$ 	
 %L& 	.'L( 	
!)L* 	
$+L, 	
-L. 	
/L0 	
&1L2 	
3L4 	
5L6 	
'7L8 	
"9L: 	
 ;L< 	
$=L> 	
&?L@ 	
 ALB 	
CLD 	
)EL L LF 	/GLH 	
#ILJ 	.KLL 	.MLN 	.OLP 	
#QLR 	
SLT 	
ULV 	
WLX 	
!YLZ 	
'[L\ 	
 ]L^ 	
*_L` 	
aLb 	
%cLd 	
 eLf 	
#gL L Lh 	
iLj 	
&kLl 	
mLn 	
%oLp 	
)qLr 	
*sLt 	
uLv 	.wLx 	
yLz 	
{L| 	
}L~ 	
)L@ 	
"ALB 	
CLD 	
ELF 	
#GLH 	
$IL LJ %
#


#

#WL L L^e! e! e! e! e! e! e! e!V" " " " "& " " "    6    J,d ; ; ; ;
  "* * *    V   *! ! ! N1 1 1 1 1'= 1 1 1h j:DPT U U U U
    .D    +
       %;   . j8$d S S S S! ! ! ! !F ! ! !H j7 F F F F
    6   0 J,d ; ; ; ; )+?T R R R R
    f   @ 3	   " " " " "V " " "J j8$d S S S S

 
 
 
 
"
 
 
& 4
   L L L L Lf L L L j/4 8 8 8 8
 JNZ&'! ! ! ! !> ! ! !  W+ W+ W+ W+ W+/ W+ W+ W+t j0$ ? ? ? ?    .   J
 J
 J
 J
 J
0 J
 J
 J
Z j14t L L L L 

#
$
"
'
%   (     v   <	 	 	 	 	8 	 	 	       &	 	 	 	 	x 	 	 	  	
  
 	    ( &     !" #$ !)  4    (,?   2	" 	" 	" 	" 	" 	" 	" 	"+ + + + +X/B + + +` "  "  "  "  "6  "  "  "J9 9 9 9 9D 9 9 9,@ @ @ @ @ @ @ @    #8       &   & J $ $ $ K % % % % %r   