smb: wrong offset when parse SMB_COM_WRITE_ANDX record
In function parse_smb1_write_andx_request_record, when wct == 12, offset should use 32-bits value rather than stay 0.
If WordCount is 0x0C, this field represents a 32-bit offset, measured in bytes, of where the write SHOULD start relative to the beginning of the file. If WordCount is 0xE, this field represents the lower 32 bits of a 64-bit offset. [MS-CIFS].pdf (p.246) 126.96.36.199 SMB_COM_WRITE_ANDX (0x2F) https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-CIFS/%5bMS-CIFS%5d.pdf
- File 2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap 2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap added
wireshark filter: (smb.cmd 0x2f) && (smb.flags.response 0) no.5923
Pcap to show padding bug:
In the origin packet, data_length bcc 20, if we use a proxy to change data_length to 17, Windows still accept it and write 17 bytes to file, but the original `parse_smb1_write_andx_request_record` will take 3 bytes padding to make record.data inconsistent with it in Windows.