mirror of https://github.com/lianthony/NT4.0
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
901 lines
24 KiB
901 lines
24 KiB
|
|
|
|
#include <windows.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
#define SECURITY_WIN32
|
|
#include <security.h>
|
|
#include <spseal.h>
|
|
#include <sslsp.h>
|
|
|
|
#include <winsock.h>
|
|
|
|
#include "md5.h"
|
|
#include "rc4.h"
|
|
|
|
WSADATA WsaData;
|
|
CredHandle hCreds;
|
|
CtxtHandle hContext;
|
|
|
|
BOOLEAN IpAddress = FALSE;
|
|
|
|
|
|
UCHAR FileBuffer[1024];
|
|
CHAR FileName[MAX_PATH];
|
|
UCHAR NetscapeBuffer[] = {
|
|
0x82,0x2b,0x04,0x00,0x01,0x00,0x02,0x02,0x0d,0x00,0x03,0x00,0x10,0x30,0x82,0x02,
|
|
0x09,0x30,0x82,0x01,0x72,0x02,0x02,0x00,0x88,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
|
|
0x86,0xf7,0x0d,0x01,0x01,0x04,0x05,0x00,0x30,0x47,0x31,0x0b,0x30,0x09,0x06,0x03,
|
|
0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x10,0x30,0x0e,0x06,0x03,0x55,0x04,0x0b,
|
|
0x13,0x07,0x54,0x65,0x73,0x74,0x20,0x43,0x41,0x31,0x26,0x30,0x24,0x06,0x03,0x55,
|
|
0x04,0x0a,0x13,0x1d,0x4e,0x65,0x74,0x73,0x63,0x61,0x70,0x65,0x20,0x43,0x6f,0x6d,
|
|
0x6d,0x75,0x6e,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x73,0x20,0x43,0x6f,0x72,0x70,
|
|
0x2e,0x30,0x1e,0x17,0x0d,0x39,0x35,0x30,0x32,0x32,0x34,0x30,0x31,0x30,0x39,0x32,
|
|
0x34,0x5a,0x17,0x0d,0x39,0x37,0x30,0x32,0x32,0x33,0x30,0x31,0x30,0x39,0x32,0x34,
|
|
0x5a,0x30,0x81,0x97,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
|
|
0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x08,0x13,0x0a,0x43,0x61,0x6c,0x69,
|
|
0x66,0x6f,0x72,0x6e,0x69,0x61,0x31,0x16,0x30,0x14,0x06,0x03,0x55,0x04,0x07,0x13,
|
|
0x0d,0x4d,0x6f,0x75,0x6e,0x74,0x61,0x69,0x6e,0x20,0x56,0x69,0x65,0x77,0x31,0x2c,
|
|
0x30,0x2a,0x06,0x03,0x55,0x04,0x0a,0x13,0x23,0x4e,0x65,0x74,0x73,0x63,0x61,0x70,
|
|
0x65,0x20,0x43,0x6f,0x6d,0x6d,0x75,0x6e,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x73,
|
|
0x20,0x43,0x6f,0x72,0x70,0x6f,0x72,0x61,0x74,0x69,0x6f,0x6e,0x31,0x16,0x30,0x14,
|
|
0x06,0x03,0x55,0x04,0x0b,0x13,0x0d,0x4f,0x6e,0x6c,0x69,0x6e,0x65,0x20,0x4f,0x72,
|
|
0x64,0x65,0x72,0x73,0x31,0x15,0x30,0x13,0x06,0x03,0x55,0x04,0x03,0x13,0x0c,0x41,
|
|
0x72,0x69,0x20,0x4c,0x75,0x6f,0x74,0x6f,0x6e,0x65,0x6e,0x30,0x5a,0x30,0x0d,0x06,
|
|
0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x49,0x00,0x30,
|
|
0x46,0x02,0x41,0x00,0xa5,0xa7,0x7b,0x42,0xb1,0x79,0x2d,0x0b,0x35,0x08,0xb4,0x0d,
|
|
0x74,0x1d,0x46,0x6a,0x29,0x07,0x47,0x08,0xdc,0x3a,0x76,0x36,0xbd,0x7f,0xb3,0xd4,
|
|
0xa9,0x85,0x9d,0x4b,0x65,0x74,0xc1,0x00,0x56,0xec,0x5a,0x31,0x72,0x23,0x04,0xc1,
|
|
0xcf,0x78,0x63,0x21,0x77,0x69,0xd9,0xf0,0x61,0xc8,0x73,0xf7,0xdc,0x4c,0xde,0xd2,
|
|
0x22,0x99,0x79,0xdf,0x02,0x01,0x03,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
|
|
0x0d,0x01,0x01,0x04,0x05,0x00,0x03,0x81,0x81,0x00,0x7e,0x4a,0x28,0x7d,0xba,0xfa,
|
|
0x41,0x5a,0x19,0x1c,0x9a,0xea,0x6d,0x3b,0x07,0x1c,0x97,0xe0,0xf5,0xf8,0x4c,0xd5,
|
|
0x92,0x0c,0x1c,0x30,0x49,0x06,0x72,0x42,0x9a,0x3f,0xfc,0x3b,0x11,0x17,0x78,0x7e,
|
|
0x6c,0x27,0x8a,0x12,0x19,0xf3,0x08,0x18,0x6e,0xe0,0xc3,0xbe,0xe7,0x37,0xbd,0x4e,
|
|
0xae,0xe1,0x9e,0x4a,0x3b,0xa9,0xbf,0xc0,0x92,0x59,0x2c,0xdb,0x37,0x34,0xc8,0xa0,
|
|
0xc0,0xba,0xb8,0x6f,0xd3,0xd6,0xc7,0x48,0x88,0xbc,0xd6,0xff,0x7a,0xf7,0x76,0x70,
|
|
0x2c,0x19,0x07,0xc8,0x7c,0x80,0x29,0x18,0x58,0xfc,0xd1,0x12,0x86,0x99,0x4e,0x32,
|
|
0xee,0xb9,0xf5,0x11,0x70,0xd5,0x1b,0xf7,0x85,0x5b,0x4a,0x0e,0xd6,0xe6,0x6c,0x52,
|
|
0xf5,0x8a,0x2c,0x97,0x3e,0x63,0x85,0x57,0x43,0xbc,0x02,0x00,0x80,0xbf,0xeb,0x90,
|
|
0xf8,0x2c,0x0c,0xe1,0xea,0x18,0xac,0x11,0x4c,0x83,0x14,0x21,0xb6
|
|
};
|
|
|
|
typedef struct _MDValidate {
|
|
char * string;
|
|
unsigned char digest[16];
|
|
} MDValidate, * PMDValidate;
|
|
|
|
|
|
MDValidate MD5Suite[] = {
|
|
{ "",
|
|
{ 0xd4, 0x1d, 0x8c, 0xd9, 0x8f, 0x00, 0xb2, 0x04, 0xe9, 0x80,
|
|
0x09, 0x98, 0xec, 0xf8, 0x42, 0x7e } },
|
|
{ "a",
|
|
{ 0x0c, 0xc1, 0x75, 0xb9, 0xc0, 0xf1, 0xb6, 0xa8, 0x31, 0xc3,
|
|
0x99, 0xe2, 0x69, 0x77, 0x26, 0x61 } },
|
|
{ "abc",
|
|
{ 0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0, 0xd6, 0x96,
|
|
0x3f, 0x7d, 0x28, 0xe1, 0x7f, 0x72 } },
|
|
{ "message digest",
|
|
{ 0xf9, 0x6b, 0x69, 0x7d, 0x7c, 0xb7, 0x93, 0x8d, 0x52, 0x5a,
|
|
0x2f, 0x31, 0xaa, 0xf1, 0x61, 0xd0 } },
|
|
};
|
|
|
|
|
|
|
|
void
|
|
MDPrint(
|
|
unsigned char * digest)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < 16 ; i++ )
|
|
{
|
|
printf("%02x", digest[i]);
|
|
}
|
|
|
|
}
|
|
|
|
void
|
|
MD5String(
|
|
char * string,
|
|
char * expected)
|
|
{
|
|
MD5_CTX context;
|
|
unsigned char digest[16];
|
|
unsigned int len;
|
|
|
|
len = strlen(string);
|
|
|
|
MD5Init( &context );
|
|
MD5Update( &context, string, len );
|
|
MD5Final( &context );
|
|
CopyMemory( digest, context.digest, 16 );
|
|
|
|
printf("MD5 (\"%s\") = ", string);
|
|
|
|
MDPrint(digest);
|
|
|
|
if (memcmp(digest, expected, 16))
|
|
{
|
|
printf(" <--- MISMATCH\n");
|
|
}
|
|
else
|
|
|
|
printf(" [OK]\n");
|
|
|
|
|
|
}
|
|
|
|
void
|
|
MD5Validate(void)
|
|
{
|
|
int i;
|
|
struct RC4_KEYSTRUCT r;
|
|
char test[16] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
|
|
|
|
for (i = 0; i < sizeof(MD5Suite) / sizeof(MDValidate) ; i++ )
|
|
{
|
|
MD5String(MD5Suite[i].string, MD5Suite[i].digest);
|
|
}
|
|
|
|
rc4_key(&r, 16, "richardwterences");
|
|
printf("Before:");
|
|
MDPrint(test);
|
|
printf("\n");
|
|
rc4(&r, 16, test);
|
|
printf("After:");
|
|
MDPrint(test);
|
|
printf("\n");
|
|
|
|
exit(0);
|
|
|
|
}
|
|
|
|
|
|
VOID
|
|
KeyGen(
|
|
int argc,
|
|
char **argv)
|
|
{
|
|
SSL_CREDENTIAL_CERTIFICATE certs;
|
|
|
|
ZeroMemory(&certs, sizeof(certs) );
|
|
|
|
SslGenerateKeyPair( &certs, argv[2], argv[3], 1024 );
|
|
|
|
exit( 0 );
|
|
}
|
|
|
|
|
|
DWORD
|
|
Resolve(
|
|
char * Target)
|
|
{
|
|
struct hostent * h;
|
|
|
|
if (IpAddress)
|
|
{
|
|
return( inet_addr(Target) );
|
|
}
|
|
|
|
h = gethostbyname(Target);
|
|
if (h)
|
|
{
|
|
return(*((DWORD *)h->h_addr));
|
|
}
|
|
|
|
printf("Could not resolve '%s', %d\n", Target, WSAGetLastError() );
|
|
exit(0);
|
|
}
|
|
|
|
|
|
_CRTAPI1
|
|
main (int argc, char *argv[])
|
|
{
|
|
SECURITY_STATUS scRet;
|
|
TimeStamp tsExpiry;
|
|
PSecPkgInfo pInfo;
|
|
DWORD cPackages;
|
|
SecBuffer Buffers[1];
|
|
SecBufferDesc OutputBuffer;
|
|
SecBufferDesc InputBuffer;
|
|
SecBuffer InBuffers[2];
|
|
DWORD ContextAttr;
|
|
HANDLE hFile;
|
|
DWORD Bytes;
|
|
PSTR Target;
|
|
SOCKET s;
|
|
BOOL DoSockets;
|
|
struct sockaddr_in sin;
|
|
DWORD Actual;
|
|
int err;
|
|
BOOL DoBuffer;
|
|
PSTR HttpCommand;
|
|
BOOL Logging;
|
|
BOOL DoRestart;
|
|
BOOL DoHttpCommand;
|
|
|
|
DoBuffer = FALSE;
|
|
DoSockets = TRUE;
|
|
Logging = TRUE;
|
|
DoRestart = TRUE;
|
|
DoHttpCommand = FALSE;
|
|
|
|
if (argc == 1)
|
|
{
|
|
DoSockets = FALSE;
|
|
}
|
|
|
|
else if (strcmp(argv[1], "netscape") == 0)
|
|
{
|
|
DoSockets = FALSE;
|
|
DoBuffer = TRUE;
|
|
}
|
|
|
|
else if (strcmp(argv[1], "-ip") == 0)
|
|
{
|
|
DoSockets = TRUE;
|
|
Target = argv[2];
|
|
IpAddress = TRUE;
|
|
}
|
|
else if (strcmp(argv[1], "-md5") == 0)
|
|
{
|
|
MD5Validate();
|
|
}
|
|
else if (strcmp(argv[1], "-keygen") == 0)
|
|
{
|
|
KeyGen(argc, argv);
|
|
}
|
|
|
|
|
|
Target = argv[1];
|
|
if (argc > 2)
|
|
{
|
|
HttpCommand = argv[2];
|
|
}
|
|
else
|
|
{
|
|
HttpCommand = "get /default.html";
|
|
}
|
|
|
|
|
|
WSAStartup( 0x0101, &WsaData );
|
|
|
|
scRet = EnumerateSecurityPackages( & cPackages, &pInfo);
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Failed %x to Enumerate\n", scRet);
|
|
exit(scRet);
|
|
}
|
|
|
|
printf("%d Packages: name = %s\n", cPackages, pInfo->Name);
|
|
|
|
scRet = AcquireCredentialsHandle(
|
|
NULL, SSLSP_NAME,
|
|
SECPKG_CRED_OUTBOUND,
|
|
NULL, NULL, NULL, NULL,
|
|
&hCreds, &tsExpiry);
|
|
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Failed %x in AcquireCredentialHandle\n", scRet);
|
|
exit(scRet);
|
|
|
|
}
|
|
|
|
printf("Acquired credential handle %x:%x\n", hCreds.dwUpper, hCreds.dwLower);
|
|
|
|
scRet = FreeCredentialsHandle(&hCreds);
|
|
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Failed %x to FreeCredentialHandle\n");
|
|
}
|
|
else
|
|
{
|
|
scRet = FreeCredentialsHandle(&hCreds);
|
|
if (SUCCEEDED(scRet))
|
|
{
|
|
printf("Double Free Succeeded!\n");
|
|
}
|
|
}
|
|
|
|
if (DoSockets)
|
|
{
|
|
s = socket(AF_INET, SOCK_STREAM, 0);
|
|
if (s == INVALID_SOCKET)
|
|
{
|
|
printf("No socket created, %d\n", WSAGetLastError() );
|
|
}
|
|
|
|
sin.sin_family = AF_INET;
|
|
sin.sin_port = htons( 443 );
|
|
sin.sin_addr.s_addr = Resolve(Target) ;
|
|
|
|
printf("Connecting to %s (%s)\n", Target, inet_ntoa(sin.sin_addr));
|
|
|
|
|
|
if (err = connect(s, (struct sockaddr *) &sin, sizeof(sin)) )
|
|
{
|
|
printf("Failed to connect to %s, %d\n", inet_ntoa(sin.sin_addr),
|
|
err );
|
|
exit(0);
|
|
}
|
|
|
|
}
|
|
|
|
scRet = AcquireCredentialsHandle(
|
|
NULL, SSLSP_NAME,
|
|
SECPKG_CRED_OUTBOUND,
|
|
NULL, NULL, NULL, NULL,
|
|
&hCreds, &tsExpiry);
|
|
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Failed %x in AcquireCredentialHandle\n", scRet);
|
|
exit(scRet);
|
|
|
|
}
|
|
|
|
printf("Acquired credential handle %x:%x\n", hCreds.dwUpper, hCreds.dwLower);
|
|
|
|
OutputBuffer.cBuffers = 1;
|
|
OutputBuffer.pBuffers = Buffers;
|
|
OutputBuffer.ulVersion = SECBUFFER_VERSION;
|
|
|
|
|
|
scRet = InitializeSecurityContext(
|
|
&hCreds,
|
|
NULL,
|
|
Target,
|
|
ISC_REQ_SEQUENCE_DETECT |
|
|
ISC_REQ_REPLAY_DETECT |
|
|
ISC_REQ_CONFIDENTIALITY |
|
|
ISC_REQ_ALLOCATE_MEMORY,
|
|
0,
|
|
SECURITY_NATIVE_DREP,
|
|
NULL,
|
|
0,
|
|
&hContext,
|
|
&OutputBuffer,
|
|
&ContextAttr,
|
|
&tsExpiry);
|
|
|
|
printf("Return %x from InitializeSecurityContext\n", scRet);
|
|
|
|
if (SUCCEEDED(scRet))
|
|
{
|
|
printf("Context handle is %x:%x\n", hContext.dwUpper, hContext.dwLower);
|
|
printf("Buffer is <%x, %d, %x>\n", Buffers[0].pvBuffer,
|
|
Buffers[0].cbBuffer, Buffers[0].BufferType);
|
|
|
|
if (Logging)
|
|
{
|
|
|
|
hFile = CreateFile(".\\SendBlob", GENERIC_WRITE, 0,
|
|
NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,
|
|
NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, Buffers[0].pvBuffer, Buffers[0].cbBuffer,
|
|
&Bytes, NULL);
|
|
|
|
CloseHandle(hFile);
|
|
}
|
|
}
|
|
|
|
}
|
|
else
|
|
{
|
|
exit(0);
|
|
}
|
|
|
|
if (DoSockets)
|
|
{
|
|
printf("Sending to %s\n", Target);
|
|
|
|
send(s, Buffers[0].pvBuffer, Buffers[0].cbBuffer, 0);
|
|
|
|
printf("Receiving from %s\n", Target);
|
|
|
|
Bytes = recv(s, FileBuffer, 1024, 0);
|
|
|
|
if ( Logging )
|
|
{
|
|
|
|
hFile = CreateFile(Target, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
|
|
FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, FileBuffer, Bytes, &Actual, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
if (DoBuffer)
|
|
{
|
|
Bytes = sizeof(NetscapeBuffer);
|
|
CopyMemory(FileBuffer, NetscapeBuffer, Bytes);
|
|
|
|
}
|
|
else
|
|
{
|
|
|
|
|
|
hFile = CreateFile(".\\RecvBlob", GENERIC_READ, FILE_SHARE_READ,
|
|
NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
ReadFile(hFile, FileBuffer, 1024, &Bytes, NULL);
|
|
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Could not read response from '.\\RecvBlob', %d\n", GetLastError());
|
|
exit(0);
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
InBuffers[0].pvBuffer = FileBuffer;
|
|
InBuffers[0].cbBuffer = Bytes;
|
|
InBuffers[0].BufferType = SECBUFFER_TOKEN;
|
|
|
|
InputBuffer.cBuffers = 1;
|
|
InputBuffer.pBuffers = InBuffers;
|
|
InputBuffer.ulVersion = SECBUFFER_VERSION;
|
|
|
|
scRet = InitializeSecurityContext( &hCreds,
|
|
&hContext,
|
|
NULL, 0, 0,
|
|
SECURITY_NATIVE_DREP,
|
|
&InputBuffer,
|
|
0,
|
|
NULL,
|
|
&OutputBuffer,
|
|
&ContextAttr,
|
|
&tsExpiry );
|
|
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Second call to Init failed with %x\n", scRet);
|
|
exit(0);
|
|
}
|
|
|
|
printf("Call returned %x\n", scRet);
|
|
|
|
if ( Logging )
|
|
{
|
|
|
|
hFile = CreateFile(".\\SendBlob-2", GENERIC_WRITE, 0,
|
|
NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,
|
|
NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, Buffers[0].pvBuffer, Buffers[0].cbBuffer,
|
|
&Bytes, NULL);
|
|
|
|
CloseHandle(hFile);
|
|
}
|
|
}
|
|
|
|
if (DoSockets)
|
|
{
|
|
printf("Sending to %s\n", Target);
|
|
|
|
send(s, OutputBuffer.pBuffers[0].pvBuffer,
|
|
OutputBuffer.pBuffers[0].cbBuffer, 0);
|
|
|
|
printf("Receiving from %s\n", Target);
|
|
|
|
Bytes = recv(s, FileBuffer, 1024, 0);
|
|
|
|
printf("Received %d bytes (%d)\n", Bytes, WSAGetLastError());
|
|
|
|
if ( Logging )
|
|
{
|
|
strcpy(FileName, Target);
|
|
strcat(FileName, "-2");
|
|
|
|
hFile = CreateFile(FileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
|
|
FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, FileBuffer, Bytes, &Actual, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Unable to open %s, %d\n", FileName, GetLastError());
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
hFile = CreateFile(".\\RecvBlob-2", GENERIC_READ, FILE_SHARE_READ,
|
|
NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
ReadFile(hFile, FileBuffer, 1024, &Bytes, NULL);
|
|
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Could not read response from '.\\RecvBlob-2', %d\n", GetLastError());
|
|
exit(0);
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
if (!Bytes)
|
|
{
|
|
printf("--- Error ---, connection dropped\n");
|
|
exit(0);
|
|
}
|
|
|
|
InBuffers[0].pvBuffer = FileBuffer;
|
|
InBuffers[0].cbBuffer = Bytes;
|
|
InBuffers[0].BufferType = SECBUFFER_TOKEN;
|
|
|
|
InputBuffer.cBuffers = 1;
|
|
InputBuffer.pBuffers = InBuffers;
|
|
InputBuffer.ulVersion = SECBUFFER_VERSION;
|
|
|
|
scRet = InitializeSecurityContext( &hCreds,
|
|
&hContext,
|
|
NULL, 0, 0,
|
|
SECURITY_NATIVE_DREP,
|
|
&InputBuffer,
|
|
0,
|
|
NULL,
|
|
&OutputBuffer,
|
|
&ContextAttr,
|
|
&tsExpiry );
|
|
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Third call to Init failed with %x\n", scRet);
|
|
exit(0);
|
|
}
|
|
|
|
printf("Third call to Init returned %x\n", scRet );
|
|
|
|
if ( Logging )
|
|
{
|
|
|
|
hFile = CreateFile(".\\SendBlob-3", GENERIC_WRITE, 0,
|
|
NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,
|
|
NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, Buffers[0].pvBuffer,
|
|
Buffers[0].cbBuffer,
|
|
&Bytes, NULL);
|
|
|
|
CloseHandle(hFile);
|
|
}
|
|
}
|
|
|
|
if (DoSockets)
|
|
{
|
|
printf("Sending to %s\n", Target);
|
|
|
|
send(s, OutputBuffer.pBuffers[0].pvBuffer,
|
|
OutputBuffer.pBuffers[0].cbBuffer,
|
|
0);
|
|
|
|
printf("Receiving from %s\n", Target);
|
|
|
|
Bytes = recv(s, FileBuffer, 1024, 0);
|
|
|
|
printf("Received %d bytes (%d)\n", Bytes, WSAGetLastError());
|
|
|
|
if ( Logging )
|
|
{
|
|
|
|
strcpy(FileName, Target);
|
|
strcat(FileName, "-3");
|
|
|
|
hFile = CreateFile(FileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
|
|
FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, FileBuffer, Bytes, &Actual, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Unable to open %s, %d\n", FileName, GetLastError());
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
hFile = CreateFile(".\\RecvBlob-3", GENERIC_READ, FILE_SHARE_READ,
|
|
NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
ReadFile(hFile, FileBuffer, 1024, &Bytes, NULL);
|
|
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Could not read response from '.\\RecvBlob-2', %d\n", GetLastError());
|
|
exit(0);
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
if (!Bytes)
|
|
{
|
|
printf("--- Error ---, connection dropped\n");
|
|
exit(0);
|
|
}
|
|
|
|
InBuffers[0].pvBuffer = FileBuffer;
|
|
InBuffers[0].cbBuffer = Bytes;
|
|
InBuffers[0].BufferType = SECBUFFER_TOKEN;
|
|
|
|
InputBuffer.cBuffers = 1;
|
|
InputBuffer.pBuffers = InBuffers;
|
|
InputBuffer.ulVersion = SECBUFFER_VERSION;
|
|
|
|
scRet = InitializeSecurityContext( &hCreds,
|
|
&hContext,
|
|
NULL, 0, 0,
|
|
SECURITY_NATIVE_DREP,
|
|
&InputBuffer,
|
|
0,
|
|
NULL,
|
|
&OutputBuffer,
|
|
&ContextAttr,
|
|
&tsExpiry );
|
|
|
|
if (FAILED(scRet))
|
|
{
|
|
printf("Fourth call to Init failed with %x\n", scRet);
|
|
exit(0);
|
|
}
|
|
|
|
printf("Fourth call to Init returned %x\n", scRet );
|
|
|
|
if ( DoHttpCommand )
|
|
{
|
|
|
|
ZeroMemory(FileBuffer, InBuffers[0].cbBuffer );
|
|
|
|
InBuffers[0].pvBuffer = FileBuffer;
|
|
InBuffers[0].cbBuffer = 18;
|
|
InBuffers[0].BufferType = SECBUFFER_TOKEN;
|
|
|
|
InBuffers[1].pvBuffer = FileBuffer + 18;
|
|
InBuffers[1].cbBuffer = sprintf(InBuffers[1].pvBuffer, "%s\r\n", HttpCommand) + 1;
|
|
InBuffers[1].BufferType = SECBUFFER_DATA;
|
|
|
|
InputBuffer.cBuffers = 2;
|
|
InputBuffer.pBuffers = InBuffers;
|
|
InputBuffer.ulVersion = SECBUFFER_VERSION;
|
|
|
|
scRet = SealMessage(&hContext,
|
|
0,
|
|
&InputBuffer,
|
|
0);
|
|
|
|
if (FAILED( scRet ))
|
|
{
|
|
printf("SealMessage FAILED with %#x\n", scRet );
|
|
exit(0);
|
|
}
|
|
|
|
if (DoSockets)
|
|
{
|
|
printf("sending http command '%s' to target\n", HttpCommand);
|
|
send(s, FileBuffer, InBuffers[0].cbBuffer + InBuffers[1].cbBuffer,
|
|
0 );
|
|
|
|
printf("Receiving from %s\n", Target);
|
|
|
|
Bytes = recv(s, FileBuffer, 1024, 0);
|
|
|
|
if ( Logging )
|
|
{
|
|
printf("Received %d bytes (%d)\n", Bytes, WSAGetLastError());
|
|
|
|
strcpy(FileName, Target);
|
|
strcat(FileName, "-4");
|
|
|
|
hFile = CreateFile(FileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
|
|
FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, FileBuffer, Bytes, &Actual, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Unable to open %s, %d\n", FileName, GetLastError());
|
|
}
|
|
}
|
|
|
|
}
|
|
else
|
|
{
|
|
exit(0);
|
|
}
|
|
|
|
InBuffers[0].pvBuffer = FileBuffer;
|
|
InBuffers[0].cbBuffer = Bytes;
|
|
InBuffers[0].BufferType = SECBUFFER_DATA;
|
|
|
|
InBuffers[1].BufferType = SECBUFFER_EMPTY;
|
|
InBuffers[1].cbBuffer = 0;
|
|
InBuffers[1].pvBuffer = NULL;
|
|
|
|
InputBuffer.cBuffers = 2;
|
|
InputBuffer.pBuffers = InBuffers;
|
|
InputBuffer.ulVersion = SECBUFFER_VERSION;
|
|
|
|
scRet = UnsealMessage( &hContext,
|
|
&InputBuffer,
|
|
0,
|
|
NULL );
|
|
|
|
if (FAILED(scRet) )
|
|
{
|
|
printf("UnsealMessage failed with %#x\n", scRet );
|
|
exit(0);
|
|
}
|
|
|
|
if ( Logging )
|
|
{
|
|
|
|
strcpy(FileName, Target);
|
|
strcat(FileName, "-4-decrypt");
|
|
|
|
hFile = CreateFile(FileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
|
|
FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, InBuffers[1].pvBuffer, InBuffers[1].cbBuffer, &Actual, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Unable to open %s, %d\n", FileName, GetLastError());
|
|
}
|
|
}
|
|
} // DoHttpCommand
|
|
|
|
if ( DoSockets )
|
|
{
|
|
closesocket( s );
|
|
}
|
|
|
|
if ( DoSockets && DoRestart )
|
|
{
|
|
s = socket(AF_INET, SOCK_STREAM, 0);
|
|
if (s == INVALID_SOCKET)
|
|
{
|
|
printf("No socket created, %d\n", WSAGetLastError() );
|
|
}
|
|
|
|
sin.sin_family = AF_INET;
|
|
sin.sin_port = htons( 443 );
|
|
sin.sin_addr.s_addr = Resolve(Target) ;
|
|
|
|
printf("Connecting to %s (%s)\n", Target, inet_ntoa(sin.sin_addr));
|
|
|
|
|
|
if (err = connect(s, (struct sockaddr *) &sin, sizeof(sin)) )
|
|
{
|
|
printf("Failed to connect to %s, %d\n", inet_ntoa(sin.sin_addr),
|
|
err );
|
|
exit(0);
|
|
}
|
|
|
|
|
|
scRet = InitializeSecurityContext(
|
|
&hCreds,
|
|
&hContext,
|
|
Target,
|
|
ISC_REQ_SEQUENCE_DETECT |
|
|
ISC_REQ_REPLAY_DETECT |
|
|
ISC_REQ_CONFIDENTIALITY |
|
|
ISC_REQ_ALLOCATE_MEMORY,
|
|
0,
|
|
SECURITY_NATIVE_DREP,
|
|
NULL,
|
|
0,
|
|
&hContext,
|
|
&OutputBuffer,
|
|
&ContextAttr,
|
|
&tsExpiry);
|
|
|
|
printf("Return %x from InitializeSecurityContext\n", scRet);
|
|
|
|
if (SUCCEEDED(scRet))
|
|
{
|
|
printf("Context handle is %x:%x\n", hContext.dwUpper, hContext.dwLower);
|
|
printf("Buffer is <%x, %d, %x>\n", Buffers[0].pvBuffer,
|
|
Buffers[0].cbBuffer, Buffers[0].BufferType);
|
|
|
|
}
|
|
else
|
|
{
|
|
exit(0);
|
|
}
|
|
|
|
send(s, Buffers[0].pvBuffer, Buffers[0].cbBuffer, 0);
|
|
|
|
printf("Receiving from %s\n", Target);
|
|
|
|
Bytes = recv(s, FileBuffer, 1024, 0);
|
|
|
|
if (Bytes == 0)
|
|
{
|
|
printf("Error %d\n", WSAGetLastError() );
|
|
}
|
|
else
|
|
{
|
|
printf("Got %d bytes back\n");
|
|
}
|
|
|
|
if ( Logging )
|
|
{
|
|
|
|
strcpy(FileName, "Restart-Blob1");
|
|
|
|
hFile = CreateFile(FileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
|
|
FILE_ATTRIBUTE_NORMAL, NULL);
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE)
|
|
{
|
|
WriteFile(hFile, FileBuffer, Bytes, &Actual, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
else
|
|
{
|
|
printf("Unable to open %s, %d\n", FileName, GetLastError());
|
|
}
|
|
}
|
|
|
|
|
|
}
|
|
|
|
return(0);
|
|
}
|