Skip to content

Commit eb51e62

Browse files
RcoIlRcoIl
committed
[+] 修复 socket 请求中的异常处理
1 parent 716effd commit eb51e62

6 files changed

Lines changed: 55 additions & 43 deletions

File tree

‎SharpDetectionNTLMSSP/FunModule/MSSQL.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ class MSSQL : ModuleScan
44
{
55
public override TriageNTLMSSPKey StartScan(SocketStream socketMessage, TriageNTLMSSPKey _TriageNTLMSSPKey)
66
{
7-
var response = new byte[1024];
87
socketMessage.SendMessage(NTLMSSPBuffer.mssql_buffer_v1);
9-
response = socketMessage.ReceiveMessage();
8+
var response = socketMessage.ReceiveMessage();
109
socketMessage.SendMessage(NTLMSSPBuffer.mssql_buffer_v2);
1110
response = socketMessage.ReceiveMessage();
1211

12+
if (response.Length == 0) return null;
1313
_TriageNTLMSSPKey = ParsingResponse.ParsingSocketStremResponse(response, _TriageNTLMSSPKey, ref response);
1414

1515
return _TriageNTLMSSPKey;

‎SharpDetectionNTLMSSP/FunModule/SMB.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@ class SMB : ModuleScan
77
{
88
public override TriageNTLMSSPKey StartScan(SocketStream socketMessage, TriageNTLMSSPKey _TriageNTLMSSPKey)
99
{
10-
var response = new byte[1024];
1110
socketMessage.SendMessage(NTLMSSPBuffer.smb_buffer_v1);
12-
response = socketMessage.ReceiveMessage();
11+
var response = socketMessage.ReceiveMessage();
1312
socketMessage.SendMessage(NTLMSSPBuffer.smb_buffer_v2);
1413
response = socketMessage.ReceiveMessage();
15-
14+
if (response.Length == 0) return null;
15+
1616
_TriageNTLMSSPKey = ParsingResponse.ParsingSocketStremResponse(response, _TriageNTLMSSPKey, ref response);
1717

1818
var veraw = Encoding.Default.GetString(response).Split(new String[] { "\0\0\0" }, StringSplitOptions.RemoveEmptyEntries);

‎SharpDetectionNTLMSSP/FunModule/WMI.cs‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,12 @@ class WMI : ModuleScan
77
{
88
public override TriageNTLMSSPKey StartScan(SocketStream socketMessage, TriageNTLMSSPKey _TriageNTLMSSPKey)
99
{
10-
var response = new byte[1024];
11-
response = NDR64SyntaxtScan(_TriageNTLMSSPKey);
10+
var response = NDR64SyntaxtScan(_TriageNTLMSSPKey);
1211
_TriageNTLMSSPKey.NDR64Syntax = ParsingNDR64Syntax(response);
1312

1413
socketMessage.SendMessage(NTLMSSPBuffer.dcerpc_buffer_v1);
1514
response = socketMessage.ReceiveMessage();
16-
15+
if (response.Length == 0) return null;
1716
_TriageNTLMSSPKey = ParsingResponse.ParsingSocketStremResponse(response, _TriageNTLMSSPKey, ref response);
1817
return _TriageNTLMSSPKey;
1918
}
@@ -22,18 +21,25 @@ public byte[] NDR64SyntaxtScan(TriageNTLMSSPKey _TriageNTLMSSPKey)
2221
{
2322
var response = new byte[1024];
2423

25-
var socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
26-
socket.Connect(_TriageNTLMSSPKey.Target, _TriageNTLMSSPKey.Port);
27-
socket.Send(NTLMSSPBuffer.dcerpc_buffer_v2);
28-
socket.Receive(response);
29-
24+
try
25+
{
26+
var socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
27+
socket.Connect(_TriageNTLMSSPKey.Target, _TriageNTLMSSPKey.Port);
28+
socket.Send(NTLMSSPBuffer.dcerpc_buffer_v2);
29+
socket.Receive(response);
30+
}
31+
catch
32+
{
33+
return new byte[] { };
34+
}
3035
return response;
3136
}
3237

3338
private int ParsingNDR64Syntax(Byte[] responseBuffer)
3439
{
40+
if (responseBuffer.Length == 0) return 0;
3541
var NDR64SyntaxStr = BitConverter.ToString(responseBuffer).Replace("-", "");
36-
return NDR64SyntaxStr.Contains("33057171BABE37498319B5DBEF9CCC36") ? 64 : 32;
42+
return NDR64SyntaxStr.Contains("33057171BABE37498319B5DBEF9CCC36") ? 64 : 86;
3743
}
3844
}
3945
}

‎SharpDetectionNTLMSSP/Networking/SocketStream.cs‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,26 @@
11
using System;
2-
using System.Collections.Generic;
3-
using System.Linq;
42
using System.Net.Sockets;
5-
using System.Text;
3+
using System.Threading;
64

75
namespace SharpDetectionNTLMSSP
86
{
97
class SocketStream
108
{
119
public Boolean OK = false;
1210
public Socket socket = null;
11+
1312
public SocketStream(String ip, int port)
1413
{
1514
try
1615
{
1716
this.socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
1817
socket.Connect(ip, port);
1918
OK = true;
20-
}
21-
catch
19+
}
20+
catch
2221
{
2322
OK = false;
24-
return;
23+
return;
2524
}
2625
}
2726

@@ -31,9 +30,9 @@ public void SendMessage(Byte[] buffer)
3130
{
3231
socket.Send(buffer);
3332
}
34-
catch (Exception ex)
33+
catch
3534
{
36-
Console.WriteLine($"[!] Socket Error, during sending: {ex.Message}");
35+
return;
3736
}
3837
}
3938

@@ -44,10 +43,11 @@ public byte[] ReceiveMessage()
4443
{
4544
socket.Receive(response);
4645
}
47-
catch (Exception ex)
46+
catch
4847
{
49-
Console.WriteLine($"[!] Socket Error, during receive: {ex.Message}");
48+
return new byte[] { };
5049
}
50+
5151
return response;
5252
}
5353
}

‎SharpDetectionNTLMSSP/Program.cs‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ namespace SharpDetectionNTLMSSP
88
{
99
class Program
1010
{
11+
private static int count = 0;
1112
static void ParsingTriageNTLMSSPKey(TriageNTLMSSPKey _TriageNTLMSSPKey)
1213
{
1314
var result = String.Empty;
@@ -28,14 +29,15 @@ static void ParsingTriageNTLMSSPKey(TriageNTLMSSPKey _TriageNTLMSSPKey)
2829
result += String.Format(" [>] NetBIOS computer name: {0}\r\n", _TriageNTLMSSPKey.NbtComputerName);
2930
result += String.Format(" [>] DNS computer name : {0}\r\n", _TriageNTLMSSPKey.DnsComputerName);
3031
result += String.Format(" [>] Time stamp : {0}\r\n", _TriageNTLMSSPKey.TimeStamp.ToString("yyyy-MM-dd HH-mm-ss ddd"));
31-
32+
count += 1;
3233
Console.WriteLine(result);
3334
}
3435

3536
static void StartDoStuff(string target, int port, string typeKey)
3637
{
3738
var socketMessage = new SocketStream(target, port);
3839
if (!socketMessage.OK) return;
40+
3941
var _TriageNTLMSSPKey = new TriageNTLMSSPKey();
4042
_TriageNTLMSSPKey.Target = target;
4143
_TriageNTLMSSPKey.Port = port;
@@ -48,6 +50,7 @@ static void StartDoStuff(string target, int port, string typeKey)
4850
_ModuleScan = (ModuleScan)Activator.CreateInstance(type);
4951
}
5052
_TriageNTLMSSPKey = _ModuleScan.StartScan(socketMessage, _TriageNTLMSSPKey);
53+
if (_TriageNTLMSSPKey == null) return;
5154
ParsingTriageNTLMSSPKey(_TriageNTLMSSPKey);
5255
}
5356

@@ -120,7 +123,8 @@ static void Main(string[] args)
120123

121124
stopwatch.Stop();
122125
TimeSpan timespan = stopwatch.Elapsed;
123-
Console.WriteLine("[*] Time taken: {0}s", timespan.TotalSeconds);
126+
127+
Console.WriteLine("[*] Count: {0}, Time taken: {1}s", count, timespan.TotalSeconds);
124128
}
125129
}
126130
}

‎SharpDetectionNTLMSSP/lib/ParsingResponse.cs‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -43,28 +43,30 @@ private static TriageNTLMSSPKey ParseTargetInfo(byte[] records, TriageNTLMSSPKey
4343

4444
public static TriageNTLMSSPKey ParsingSocketStremResponse(byte[] responseBuffer, TriageNTLMSSPKey _TriageNTLMSSPKey, ref byte[] otherResponseBuffer)
4545
{
46-
var responseBuffer_String = BitConverter.ToString(responseBuffer).Replace("-", "");
47-
var NTLMSSP_Bytes_Index = responseBuffer_String.IndexOf("4E544C4D53535000") / 2;
46+
try {
47+
var responseBuffer_String = BitConverter.ToString(responseBuffer).Replace("-", "");
48+
var NTLMSSP_Bytes_Index = responseBuffer_String.IndexOf("4E544C4D53535000") / 2;
4849

49-
var len = responseBuffer.Length - NTLMSSP_Bytes_Index;
50-
var challengeResult = new Byte[len];
51-
Array.Copy(responseBuffer, NTLMSSP_Bytes_Index, challengeResult, 0, len);
50+
var len = responseBuffer.Length - NTLMSSP_Bytes_Index;
51+
var challengeResult = new Byte[len];
52+
Array.Copy(responseBuffer, NTLMSSP_Bytes_Index, challengeResult, 0, len);
5253

53-
NTLM_CHALLENGE_MESSAGE typeMessage = ChallengeFromBytes(challengeResult);
54+
NTLM_CHALLENGE_MESSAGE typeMessage = ChallengeFromBytes(challengeResult);
5455

55-
_TriageNTLMSSPKey.OsBuildNumber = typeMessage.Build;
56-
_TriageNTLMSSPKey.OsMajor = typeMessage.Major;
57-
_TriageNTLMSSPKey.OsMinor = typeMessage.Minor;
56+
_TriageNTLMSSPKey.OsBuildNumber = typeMessage.Build;
57+
_TriageNTLMSSPKey.OsMajor = typeMessage.Major;
58+
_TriageNTLMSSPKey.OsMinor = typeMessage.Minor;
5859

59-
var TargetInfo = challengeResult.Skip(typeMessage.TargetInfoBufferOffset).ToArray().Take(typeMessage.TargetInfoLen).ToArray();
60-
_TriageNTLMSSPKey = ParseTargetInfo(TargetInfo, _TriageNTLMSSPKey);
61-
62-
var otherOffset = typeMessage.TargetInfoBufferOffset + typeMessage.TargetInfoLen;
63-
len = len - otherOffset;
64-
var otherByteResult = new Byte[len];
65-
Array.Copy(challengeResult, otherOffset, otherByteResult, 0, len);
66-
otherResponseBuffer = otherByteResult;
60+
var TargetInfo = challengeResult.Skip(typeMessage.TargetInfoBufferOffset).ToArray().Take(typeMessage.TargetInfoLen).ToArray();
61+
_TriageNTLMSSPKey = ParseTargetInfo(TargetInfo, _TriageNTLMSSPKey);
6762

63+
var otherOffset = typeMessage.TargetInfoBufferOffset + typeMessage.TargetInfoLen;
64+
len = len - otherOffset;
65+
var otherByteResult = new Byte[len];
66+
Array.Copy(challengeResult, otherOffset, otherByteResult, 0, len);
67+
otherResponseBuffer = otherByteResult;
68+
}
69+
catch {}
6870
return _TriageNTLMSSPKey;
6971
}
7072
}

0 commit comments

Comments
 (0)