[SHEHZADE//ABDULLAH ANSARI]
Red Team Consultant @ Google | MS in Cybersecurity @ NYU
● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
PUBLIC MIRRORGo v1.0
Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.
$
git clone https://shehzade.io/repos/contraband.git
Copy
Source ZIP (1.93 MB)
94 lines · 2.8 KB
| 1 | package smb |
| 2 | |
| 3 | import ( |
| 4 | "encoding/binary" |
| 5 | "fmt" |
| 6 | "io" |
| 7 | ) |
| 8 | |
| 9 | // NetBIOS Session Service framing (RFC 1002) |
| 10 | func PackNetBIOS(payload []byte) []byte { |
| 11 | out := make([]byte, 4+len(payload)) |
| 12 | out[0] = 0x00 |
| 13 | l := len(payload) |
| 14 | out[1] = byte(l >> 16) |
| 15 | out[2] = byte(l >> 8) |
| 16 | out[3] = byte(l) |
| 17 | copy(out[4:], payload) |
| 18 | return out |
| 19 | } |
| 20 | |
| 21 | func ReadNetBIOSMessage(r io.Reader) ([]byte, error) { |
| 22 | hdr := make([]byte, 4) |
| 23 | if _, err := io.ReadFull(r, hdr); err != nil { |
| 24 | return nil, err |
| 25 | } |
| 26 | l := (int(hdr[1]) << 16) | (int(hdr[2]) << 8) | int(hdr[3]) |
| 27 | if l <= 0 || l > 16*1024*1024 { |
| 28 | return nil, fmt.Errorf("invalid NetBIOS packet length: %d", l) |
| 29 | } |
| 30 | payload := make([]byte, l) |
| 31 | if _, err := io.ReadFull(r, payload); err != nil { |
| 32 | return nil, err |
| 33 | } |
| 34 | return payload, nil |
| 35 | } |
| 36 | |
| 37 | // SMB2 Header |
| 38 | type SMB2Header struct { |
| 39 | ProtocolID [4]byte // \xFESMB |
| 40 | StructureSize uint16 // 64 |
| 41 | CreditCharge uint16 |
| 42 | Status uint32 |
| 43 | Command uint16 |
| 44 | CreditReqResp uint16 |
| 45 | Flags uint32 |
| 46 | NextCommand uint32 |
| 47 | MessageID uint64 |
| 48 | Reserved uint32 |
| 49 | TreeID uint32 |
| 50 | SessionID uint64 |
| 51 | Signature [16]byte |
| 52 | } |
| 53 | |
| 54 | func (h *SMB2Header) Encode() []byte { |
| 55 | buf := make([]byte, 64) |
| 56 | copy(buf[0:4], h.ProtocolID[:]) |
| 57 | binary.LittleEndian.PutUint16(buf[4:6], 64) |
| 58 | binary.LittleEndian.PutUint16(buf[6:8], h.CreditCharge) |
| 59 | binary.LittleEndian.PutUint32(buf[8:12], h.Status) |
| 60 | binary.LittleEndian.PutUint16(buf[12:14], h.Command) |
| 61 | binary.LittleEndian.PutUint16(buf[14:16], h.CreditReqResp) |
| 62 | binary.LittleEndian.PutUint32(buf[16:20], h.Flags) |
| 63 | binary.LittleEndian.PutUint32(buf[20:24], h.NextCommand) |
| 64 | binary.LittleEndian.PutUint64(buf[24:32], h.MessageID) |
| 65 | binary.LittleEndian.PutUint32(buf[32:36], h.Reserved) |
| 66 | binary.LittleEndian.PutUint32(buf[36:40], h.TreeID) |
| 67 | binary.LittleEndian.PutUint64(buf[40:48], h.SessionID) |
| 68 | copy(buf[48:64], h.Signature[:]) |
| 69 | return buf |
| 70 | } |
| 71 | |
| 72 | func DecodeSMB2Header(data []byte) (*SMB2Header, error) { |
| 73 | if len(data) < 64 { |
| 74 | return nil, fmt.Errorf("data too short for SMB2 header: %d", len(data)) |
| 75 | } |
| 76 | if data[0] != 0xFE || data[1] != 'S' || data[2] != 'M' || data[3] != 'B' { |
| 77 | return nil, fmt.Errorf("invalid SMB2 magic: %x", data[0:4]) |
| 78 | } |
| 79 | h := &SMB2Header{} |
| 80 | copy(h.ProtocolID[:], data[0:4]) |
| 81 | h.StructureSize = binary.LittleEndian.Uint16(data[4:6]) |
| 82 | h.CreditCharge = binary.LittleEndian.Uint16(data[6:8]) |
| 83 | h.Status = binary.LittleEndian.Uint32(data[8:12]) |
| 84 | h.Command = binary.LittleEndian.Uint16(data[12:14]) |
| 85 | h.CreditReqResp = binary.LittleEndian.Uint16(data[14:16]) |
| 86 | h.Flags = binary.LittleEndian.Uint32(data[16:20]) |
| 87 | h.NextCommand = binary.LittleEndian.Uint32(data[20:24]) |
| 88 | h.MessageID = binary.LittleEndian.Uint64(data[24:32]) |
| 89 | h.Reserved = binary.LittleEndian.Uint32(data[32:36]) |
| 90 | h.TreeID = binary.LittleEndian.Uint32(data[36:40]) |
| 91 | h.SessionID = binary.LittleEndian.Uint64(data[40:48]) |
| 92 | copy(h.Signature[:], data[48:64]) |
| 93 | return h, nil |
| 94 | } |