Bug #6008: smb: wrong offset when parse SMB_COM_WRITE_ANDX record - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #6008

closed

smb: wrong offset when parse SMB_COM_WRITE_ANDX record

Added by b1 tg about 1 year ago. Updated 9 months ago.

Status:

Closed

Priority:

Normal

Assignee:

b1 tg

Target version:

7.0.0-rc2

Affected Versions:

Effort:

Difficulty:

Label:

Description

In function parse_smb1_write_andx_request_record, when wct == 12, offset should use 32-bits value rather than stay 0.

Bug location: https://github.com/OISF/suricata/blob/a94ca4462093c0b41f87a7d8433801a0abbb4390/rust/src/smb/smb1_records.rs#L110-L117

If WordCount is 0x0C, this field represents a 32-bit offset, measured in
bytes, of where the write SHOULD start relative to the beginning of the file. If WordCount
is 0xE, this field represents the lower 32 bits of a 64-bit offset.
[MS-CIFS].pdf (p.246) 2.2.4.43 SMB_COM_WRITE_ANDX (0x2F)
https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-CIFS/%5bMS-CIFS%5d.pdf

Files

Download all files

2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap (22.2 MB) 2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap		b1 tg, 04/19/2023 03:43 AM
smb1_write_andx_request_data_offset.pcap (85.9 KB) smb1_write_andx_request_data_offset.pcap		b1 tg, 05/15/2023 11:30 AM
smb_bug_padding.pcap (10.8 KB) smb_bug_padding.pcap		b1 tg, 05/17/2023 02:03 AM

Subtasks 1 (0 open — 1 closed)

Actions

Copy link

Updated by b1 tg about 1 year ago

File 2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap 2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap added

pcap: https://www.malware-traffic-analysis.net/2018/04/30/2018-04-30-Trickbot-goes-from-client-to-domain-controller.pcap.zip

wireshark filter: (smb.cmd 0x2f) && (smb.flags.response 0) no.5923

Actions

Copy link

Updated by b1 tg 11 months ago

File smb1_write_andx_request_data_offset.pcap smb1_write_andx_request_data_offset.pcap added

Add pcap for test windows behaviour on handling data_offset of smb1 write_andx_request

Actions

Copy link

Updated by b1 tg 11 months ago

File smb_bug_padding.pcap smb_bug_padding.pcap added

Pcap to show padding bug:
In the origin packet, data_length bcc 20, if we use a proxy to change data_length to 17, Windows still accept it and write 17 bytes to file, but the original `parse_smb1_write_andx_request_record` will take 3 bytes padding to make record.data inconsistent with it in Windows.

Actions

Copy link