mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-25 12:41:53 +08:00
v2.1.2 核心优化与多架构发布 (#561)
* feat: v2.1.0 核心重构与功能增强
## 架构重构
- 全局变量消除，迁移至 Config/State 对象
- SMB 插件融合（smb/smb2/smbghost/smbinfo）
- 服务探测重构，实现 Nmap 风格 fallback 机制
- 输出系统重构，TXT 实时刷盘 + 双写机制
- i18n 框架升级至 go-i18n
## 性能优化
- 正则表达式预编译
- 内存优化 map[string]struct{}
- 并发指纹匹配
- SOCKS5 连接复用
- 滑动窗口调度 + 自适应线程池
## 新功能
- Web 管理界面
- 多格式 POC 适配（xray/afrog）
- 增强指纹库（3139条）
- Favicon hash 指纹识别
- 插件选择性编译（Build Tags）
- fscan-lab 靶场环境
- 默认端口扩展（62→133）
## 构建系统
- 添加 no_local tag 支持排除本地插件
- 多版本构建：fscan/fscan-nolocal/fscan-web
- CI 添加 snapshot 模式支持仅测试构建
## Bug 修复
- 修复 120+ 个问题，包括 RDP panic、批量扫描漏报、
JSON 输出格式、Redis 检测、Context 超时等
## 测试增强
- 单元测试覆盖率 74-100%
- 并发安全测试
- 集成测试（Web/端口/服务/SSH/ICMP）
* fix(ci): 移除 PR 对 Project 自动化的触发
* fix: Elasticsearch未授权检测优先于爆破 (#554)
* fix: 修复RDP爆破高误报率问题 (#555)
- 移除 screen.go 中错误的认证结果覆盖逻辑
- 启用 NLA 协议的 ErrorCode 字段检测
- 添加 PubKeyAuth 验证确保认证真正成功
- 修复 io.go 中错误被静默忽略的问题
- 修复 socket.go/io.go 中可能导致 panic 的代码
- 修复 screen.go 中文件句柄泄漏和 log.Panic
* fix: 修复-user/-pwd凭据参数不生效的问题
问题原因：
- Parse()解析凭据后更新globalConfig
- 但BuildConfigFromFlags()创建新Config时使用默认字典
- 导致解析的UserPassPairs等凭据信息被丢弃
修复内容：
1. initialize.go: 将Parse解析的凭据结果应用到新Config
2. credential.go: 单用户密码对时创建UserPassPairs
3. rdp.go: 单凭据测试时跳过指纹识别，减少连接次数
* feat: RDP使用NLA仅验证模式，避免挤掉已登录用户
- 添加ErrNLAAuthSuccess标志用于NLA验证成功信号
- tpkt层支持nlaAuthOnly模式，验证成功后不建立完整会话
- x224层正确传播NLA验证结果
- rdpCrack改用NlaAuth进行凭据验证
* fix: 修复进度条在Windows终端满屏重复输出的问题
- 添加终端宽度检测，动态调整进度条长度
- 使用空格覆盖清除旧内容，避免残留
- 简化进度条格式，确保不超过终端宽度
* feat: 优化日志颜色方案，区分漏洞和普通信息
- 新增 LogVuln 级别（红色），用于漏洞和重要发现
- 密码爆破成功、未授权访问、POC漏洞等改用红色显示
- 普通信息（扫描统计等）改为白色
- Web指纹保持绿色
* refactor: 精简化输出，移除冗余启动信息
- 移除showParseSummary开局配置输出
- 移除LogPluginInfo/LogPluginInfoWithPort插件信息输出
- 移除alive_scanner冗余统计输出
- 移除port_scan_start扫描开始提示
- 移除handleUDPPorts SNMP死代码
- 移除相关i18n条目
* chore: 版本号更新为2.1.1
* fix: 降级依赖版本以保持Go 1.20兼容性
* feat(ldap): 添加NTLM Hash认证支持 (#433)
* chore: 清理无用的 replace 指令
* fix(ping): 修复 TTL expired 导致主机误判为存活的问题
在 ExecCommandPing 中增加错误关键词检测，当 ping 输出包含
TTL expired、Destination unreachable 等错误信息时，不再将
目标主机标记为存活。
Fixes #454
* fix(proxy): 修复透明代理导致输出全端口的问题
在代理初始化时主动探测代理行为，通过连接 RFC 5737 保留的
测试地址来检测是否存在"全回显"问题。如果探测到代理不可靠，
则在端口扫描时跳过所有端口，避免误报。
- 新增 proxyReliable 标志位标记代理可靠性
- 新增 ProbeProxyBehavior 函数探测代理行为
- 端口扫描前检查代理可靠性并输出警告
Fixes #495
* refactor: 移动debug模块到common/debug子包
* fix(web): 修复-u模式下Web插件未执行的问题
* fix: 优化输出格式和颜色显示
- 网段统计格式改为 10.253.0.0/16 网段存活: 26
- WebTitle基础信息改为白色，指纹识别单独绿色输出
- 移除重复的端口数量输出
* fix: URL解析自动补全协议头
-uf 文件中 192.168.1.1:8080 自动转为 http://192.168.1.1:8080
* fix: 修复-u/-uf模式下URLs丢失导致0目标扫描的问题
Parse阶段将URLs设置到全局状态，但Initialize随后创建新状态
并覆盖了全局状态，导致URLs数据丢失。现在在创建新状态前
先保存并迁移Parse阶段设置的URLs和HostPorts数据。
* fix: 智能检测HTTP/HTTPS协议并优化URL显示
- 修复-u/-uf模式URLs丢失导致0目标扫描问题
- detectProtocol改为主动TLS握手检测，不依赖服务名
- WebTitle输出显示完整协议(http/https)
- 隐藏标准端口(80/443)使输出更简洁
* refactor: 精简parsers包，统一配置构建入口
- 删除冗余的中间层（XXXInput、XXXParser类）
- 新增 config_builder.go 统一配置构建
- parsers包从3000+行精简至~540行
- 保留核心函数：ParseIP、ParsePort、文件读取、凭据解析
* test: 扩展parsers单元测试覆盖边缘情况
- 新增内网简写解析测试(192/172/10)
- 新增完整IP范围和无效CIDR测试
- 新增Windows行尾(CRLF)处理测试
- 新增凭据和哈希文件解析测试
- 新增端口解析边缘情况测试
- 测试覆盖率达到94.2%
* refactor: 优化控制台输出格式
- 去掉时间戳，保留[*][+]前缀
- Web输出合并WebTitle和WebFinger为一行
- 有指纹显示绿色[+]，无指纹显示白色[*]
- 格式: code:xxx len:xxx title:xxx server:xxx [指纹]
- 服务探测格式: [Product:xxx ||Version:xxx] Banner:(xxx)
- 字段对齐，输出更清爽
* feat: 添加凭据测试未发现弱密码的提示
- credential_tester.go: 失败时设置 Type=ResultTypeCredential
- scanner.go: 根据结果类型在 error 级别输出'未发现弱密码'提示
- 新增 i18n 翻译 brute_no_weak_pass
使用 -log all 或 -log error 可看到此提示
* refactor(logging): 重构日志级别为层级过滤设计
- LogLevel 从 string 改为 int 类型，支持层级比较
- 层级设计：Debug(0) < Base(1) < Info(2) < Success(3) < Vuln(4) < Error(5)
- 设置一个级别后，显示该级别及以上的日志
- Error 级别始终显示，不会被配置过滤掉
- 保留向后兼容别名（LevelAll, LevelInfoSuccess 等）
- 更新测试以匹配新的层级过滤行为
* style(logging): Error级别日志改为黄色显示
* style(findnet): NetInfo输出改为每行一个IP
* refactor(ms17010): 优化错误提示，明确指出SMBv1不支持等情况
* fix(credential): 修复凭据测试结果不一致的问题
问题原因：
1. 未知错误类型不重试，导致服务端限流时跳过正确密码
2. SSH 错误分类不够准确，某些临时错误未被识别
修复内容：
1. 未知错误改为可重试（可能是临时问题）
2. 增加 SSH 特有的网络错误识别（handshake failed, disconnect 等）
* fix(portfinger): 修复SMB2服务指纹识别和NetInfo输出问题
- 添加SMB2ProgNeg探针支持现代Windows的SMB2协议
- 修复Go regexp对高位字节的UTF-8兼容问题，使用Latin-1转换
- 修复探针失败后连接重建逻辑
- 修复vendor_product字段名不匹配问题
- 修复NetInfo多行输出被其他日志打断的问题
* fix(config): 从默认端口移除9100，避免触发打印机打印 (#517)
* feat(proxy): 增强代理端口扫描的深度验证机制
- 新增4阶段深度验证：Banner读取→探测发送→响应等待→最终判定
- 新增SOCKS5错误码和代理错误文本检测
- 优化ProbeProxyBehavior探测逻辑，发送数据验证连接可达性
- 解决透明代理/全回显代理导致的假阳性问题
* fix(proxy): 修复代理深度验证的若干问题
- detector.go: 修复 AutoConfigureProxy 覆盖探测结果的问题
只有未探测过时才设置默认 proxyReliable 值
- port_scan.go: 改进深度验证机制
- 使用带 Host header 的 HTTP GET 请求替代 OPTIONS
- 延长响应等待超时至 2s 以适配慢速服务器
- 正确重置连接 deadline 避免影响后续操作
* refactor: 统一 common 包文件命名风格
Flag.go -> flag.go
* refactor(proxy): 删除自定义 contains() 函数，改用标准库
- 用 strings.Contains() 替代手写的 contains()
- 删除过时的注释
* fix(parsers): 修复带横杠域名被误识别为IP范围的问题
如 111-555.sss.com 这类域名因包含 - 被错误解析为 IP 范围，
添加 looksLikeIPRange() 检查，只有 - 前是有效 IP 才走范围解析
* fix(proxy): 修复代理模式下服务识别错误和端口漏扫问题
- port_scan.go: 验证通过后重建干净连接，避免HTTP GET探测污染服务识别
- port_scan.go: 优化验证策略，用轻量CRLF探测替代HTTP GET，超时从2.2s降至0.6s
- manager.go: 修正ProbeProxyBehavior判断逻辑，超时应视为代理正常转发
* fix(pool): 移除线程池预分配，优化大规模扫描内存占用
WithPreAlloc(true) 会预先创建所有 worker goroutine，
在大规模扫描(如 25域名×65535端口)时可能导致内存问题
* refactor(logging): 统一日志前缀，删除废弃的 LogBase
- 删除 LogBase 函数，所有调用迁移到 LogInfo/LogError
- 新增 PrefixDebug ([.]) 前缀，所有日志级别现在都有前缀
- 修复日志输出缩进不一致的问题
- 删除未使用的 PrefixDefault 常量
* perf(icmp): 实现自适应等待算法优化存活检测性能
- 新增 waitAdaptive 函数，监控响应增量实现智能提前结束
- 算法保守原则：最小等待1s + 连续500ms无新响应才提前结束
- 添加100ms检查间隔避免CPU空转
- 保留原有最大等待时间(3s/6s)作为兜底
- 添加完整单元测试覆盖各种场景
优化效果：
- 全部响应：~100ms (原3s)
- 无响应：~1s (原3s)
- 部分响应后稳定：~1.5s (原3s)
* perf(scan): 实现启发式优化提升扫描体验
1. 端口优先级排序：高价值端口(80,443,22,3389等)优先扫描
- 用户能更快看到有意义的结果
- 不影响端口喷洒策略
2. TCP 补充探测：ICMP 响应率<10%时自动启用
- 对未响应主机用 TCP 80/443/22/445 补充探测
- 解决防火墙过滤 ICMP 导致漏检的问题
* refactor(grdp): 精简RDP库，删除认证检测不需要的代码
- 删除 VNC 协议支持 (protocol/rfb, client/rfb.go)
- 删除完整客户端框架 (client/)
- 删除 RemoteApp 等插件 (plugin/)
- 删除 RLE 图形解压 (core/rle.go)
- 删除绘图指令处理 (pdu/orders.go, pdu/gdi.go)
- 精简 screen.go，移除截图和完整会话功能
- 移除未使用的 RGB 转换函数
grdp 代码从 13,044 行精简至 7,581 行，削减 42%
* refactor(common): 删除死代码，优化代码风格
- 删除未使用的 joinStrings/joinInts 函数
- 删除未使用的 memStats 字段和 getMemoryInfo 方法
- 简化 parsePasswords 中的循环为 append(...) 形式
* refactor(services): 统一数据库插件的DBWrapper
4个数据库插件(MySQL、PostgreSQL、MSSQL、Oracle)都有相同的sql.DB包装代码，
合并为通用的SQLDBWrapper，减少重复。
* refactor(core,grdp): 删除未使用的死代码
- 移除 BaseScanStrategy.LogPluginInfoWithPort 方法（无调用者）
- 移除 mcs.go 中被注释的旧 connect 函数实现
* refactor: 删除 deadcode 检测出的未使用函数
- proxy/detector.go: 删除 IsSOCKS5Standard, IsProxyInitialized
- findnet.go: 删除 NetworkInfo.OneLine, TreeFormat 方法
- port_scan.go: 删除 estimateScanTime 函数
- web_scanner.go: 删除 GetFingerprints 函数
- 清理相关测试代码
* refactor: 删除更多未使用的死代码
- parse.go: 删除 RemoveDuplicate 函数及其测试
- parsers.go: 删除 excludeHosts, removeDuplicates 别名函数
- 更新测试使用真正的函数名
* fix(test): 修复 TestParseIP_InvalidIPRange 测试用例
- 删除不合理的测试用例（无效IP被当作普通主机名处理是设计行为）
- 修复测试逻辑，只在真正通过时输出"正确"
* fix(scan): 移除域名预解析，保留原始域名进行扫描
域名预解析会将域名转换为IP，导致虚拟主机场景下HTTP访问失败
（Host头变成IP而非域名，无法正确路由）
* fix(scan): 修复 -hf 参数无法单独使用的问题
* fix(proxy): 修复透明代理环境下 SOCKS5 代理全端口误报问题
问题：在透明代理(TUN模式)环境下使用 SOCKS5 代理扫描时，
会出现全端口开放的误报，因为代理可靠性检测被透明代理污染。
修复方案（参考 fscanx）：
1. 将探针从 CRLF 改为 HTTP GET，更有效检测真实连接状态
2. 删除 "uncertain" 状态，无响应一律判定为端口关闭
3. 调整超时时间以适应代理链路延迟
Fixes #524
* feat(telnet): 新增 telnetd RCE 命令执行验证，修复未授权访问日志级别
* fix: 修复 i18n.Tr vet 报错、Unicode 测试用例，移除过期域名
- 移除 i18n.Tr 中错误的 fmt.Sprintf fallback，消除 go vet 误报
- 修复 match_engine_test Unicode 测试用例与 Latin-1 转换逻辑不匹配
- README 移除过期的 fscan.club 域名
- 添加 .gitattributes 统一换行符为 LF
* refactor: 统一控制台输出风格，使用统一的日志函数
手动合并 PR #558 的改动，适配重构后的代码路径
* fix(ci): 修复版本注入和CI触发配置
- goreleaser ldflags 指向正确的包路径 common.version/commit/date
- version 改为 var 支持 ldflags 注入，banner 显示 commit 和构建日期
- test-build 触发分支增加 dev-* 通配
* fix(ci): 修复 Windows 产物 .exe.exe 双后缀问题
* feat(ci): 扩展构建架构支持 MIPS/ARM/FreeBSD/Solaris
This commit is contained in:
ZacharyZcR
@@ -0,0 +1,189 @@
|
||||
package ber
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/core"
|
||||
)
|
||||
|
||||
const (
|
||||
CLASS_MASK uint8 = 0xC0
|
||||
CLASS_UNIV = 0x00
|
||||
CLASS_APPL = 0x40
|
||||
CLASS_CTXT = 0x80
|
||||
CLASS_PRIV = 0xC0
|
||||
)
|
||||
|
||||
const (
|
||||
PC_MASK uint8 = 0x20
|
||||
PC_PRIMITIVE = 0x00
|
||||
PC_CONSTRUCT = 0x20
|
||||
)
|
||||
|
||||
const (
|
||||
TAG_MASK uint8 = 0x1F
|
||||
TAG_BOOLEAN = 0x01
|
||||
TAG_INTEGER = 0x02
|
||||
TAG_BIT_STRING = 0x03
|
||||
TAG_OCTET_STRING = 0x04
|
||||
TAG_OBJECT_IDENFIER = 0x06
|
||||
TAG_ENUMERATED = 0x0A
|
||||
TAG_SEQUENCE = 0x10
|
||||
TAG_SEQUENCE_OF = 0x10
|
||||
)
|
||||
|
||||
func berPC(pc bool) uint8 {
|
||||
if pc {
|
||||
return PC_CONSTRUCT
|
||||
}
|
||||
return PC_PRIMITIVE
|
||||
}
|
||||
|
||||
func ReadEnumerated(r io.Reader) (uint8, error) {
|
||||
if !ReadUniversalTag(TAG_ENUMERATED, false, r) {
|
||||
return 0, errors.New("invalid ber tag")
|
||||
}
|
||||
length, err := ReadLength(r)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if length != 1 {
|
||||
return 0, errors.New(fmt.Sprintf("enumerate size is wrong, get %v, expect 1", length))
|
||||
}
|
||||
return core.ReadUInt8(r)
|
||||
}
|
||||
|
||||
func ReadUniversalTag(tag uint8, pc bool, r io.Reader) bool {
|
||||
bb, _ := core.ReadUInt8(r)
|
||||
return bb == (CLASS_UNIV|berPC(pc))|(TAG_MASK&tag)
|
||||
}
|
||||
|
||||
func WriteUniversalTag(tag uint8, pc bool, w io.Writer) {
|
||||
core.WriteUInt8((CLASS_UNIV|berPC(pc))|(TAG_MASK&tag), w)
|
||||
}
|
||||
|
||||
func ReadLength(r io.Reader) (int, error) {
|
||||
ret := 0
|
||||
size, _ := core.ReadUInt8(r)
|
||||
if size&0x80 > 0 {
|
||||
size = size &^ 0x80
|
||||
if size == 1 {
|
||||
r, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
ret = int(r)
|
||||
} else if size == 2 {
|
||||
r, err := core.ReadUint16BE(r)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
ret = int(r)
|
||||
} else {
|
||||
return 0, errors.New("BER length may be 1 or 2")
|
||||
}
|
||||
} else {
|
||||
ret = int(size)
|
||||
}
|
||||
return ret, nil
|
||||
}
|
||||
|
||||
func WriteLength(size int, w io.Writer) {
|
||||
if size > 0x7f {
|
||||
core.WriteUInt8(0x82, w)
|
||||
core.WriteUInt16BE(uint16(size), w)
|
||||
} else {
|
||||
core.WriteUInt8(uint8(size), w)
|
||||
}
|
||||
}
|
||||
|
||||
func ReadInteger(r io.Reader) (int, error) {
|
||||
if !ReadUniversalTag(TAG_INTEGER, false, r) {
|
||||
return 0, errors.New("Bad integer tag")
|
||||
}
|
||||
size, _ := ReadLength(r)
|
||||
switch size {
|
||||
case 1:
|
||||
num, _ := core.ReadUInt8(r)
|
||||
return int(num), nil
|
||||
case 2:
|
||||
num, _ := core.ReadUint16BE(r)
|
||||
return int(num), nil
|
||||
case 3:
|
||||
integer1, _ := core.ReadUInt8(r)
|
||||
integer2, _ := core.ReadUint16BE(r)
|
||||
return int(integer2) + (int(integer1) << 16), nil
|
||||
case 4:
|
||||
num, _ := core.ReadUInt32BE(r)
|
||||
return int(num), nil
|
||||
default:
|
||||
return 0, errors.New("wrong size")
|
||||
}
|
||||
}
|
||||
|
||||
func WriteInteger(n int, w io.Writer) {
|
||||
WriteUniversalTag(TAG_INTEGER, false, w)
|
||||
if n <= 0xff {
|
||||
WriteLength(1, w)
|
||||
core.WriteUInt8(uint8(n), w)
|
||||
} else if n <= 0xffff {
|
||||
WriteLength(2, w)
|
||||
core.WriteUInt16BE(uint16(n), w)
|
||||
} else {
|
||||
WriteLength(4, w)
|
||||
core.WriteUInt32BE(uint32(n), w)
|
||||
}
|
||||
}
|
||||
|
||||
func WriteOctetstring(str string, w io.Writer) {
|
||||
WriteUniversalTag(TAG_OCTET_STRING, false, w)
|
||||
WriteLength(len(str), w)
|
||||
core.WriteBytes([]byte(str), w)
|
||||
}
|
||||
|
||||
func WriteBoolean(b bool, w io.Writer) {
|
||||
bb := uint8(0)
|
||||
if b {
|
||||
bb = uint8(0xff)
|
||||
}
|
||||
WriteUniversalTag(TAG_BOOLEAN, false, w)
|
||||
WriteLength(1, w)
|
||||
core.WriteUInt8(bb, w)
|
||||
}
|
||||
|
||||
func ReadApplicationTag(tag uint8, r io.Reader) (int, error) {
|
||||
bb, _ := core.ReadUInt8(r)
|
||||
if tag > 30 {
|
||||
if bb != (CLASS_APPL|PC_CONSTRUCT)|TAG_MASK {
|
||||
return 0, errors.New("ReadApplicationTag invalid data")
|
||||
}
|
||||
bb, _ := core.ReadUInt8(r)
|
||||
if bb != tag {
|
||||
return 0, errors.New("ReadApplicationTag bad tag")
|
||||
}
|
||||
} else {
|
||||
if bb != (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag) {
|
||||
return 0, errors.New("ReadApplicationTag invalid data2")
|
||||
}
|
||||
}
|
||||
return ReadLength(r)
|
||||
}
|
||||
|
||||
func WriteApplicationTag(tag uint8, size int, w io.Writer) {
|
||||
if tag > 30 {
|
||||
core.WriteUInt8((CLASS_APPL|PC_CONSTRUCT)|TAG_MASK, w)
|
||||
core.WriteUInt8(tag, w)
|
||||
WriteLength(size, w)
|
||||
} else {
|
||||
core.WriteUInt8((CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag), w)
|
||||
WriteLength(size, w)
|
||||
}
|
||||
}
|
||||
|
||||
func WriteEncodedDomainParams(data []byte, w io.Writer) {
|
||||
WriteUniversalTag(TAG_SEQUENCE, true, w)
|
||||
WriteLength(len(data), w)
|
||||
core.WriteBytes(data, w)
|
||||
}
|
||||
@@ -0,0 +1,642 @@
|
||||
package gcc
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/asn1"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"math/big"
|
||||
"os"
|
||||
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/glog"
|
||||
|
||||
"github.com/lunixbochs/struc"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/core"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/protocol/t125/per"
|
||||
)
|
||||
|
||||
var t124_02_98_oid = []byte{0, 0, 20, 124, 0, 1}
|
||||
var h221_cs_key = "Duca"
|
||||
var h221_sc_key = "McDn"
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240509.aspx
|
||||
*/
|
||||
type Message uint16
|
||||
|
||||
const (
|
||||
//server -> client
|
||||
SC_CORE Message = 0x0C01
|
||||
SC_SECURITY = 0x0C02
|
||||
SC_NET = 0x0C03
|
||||
//client -> server
|
||||
CS_CORE = 0xC001
|
||||
CS_SECURITY = 0xC002
|
||||
CS_NET = 0xC003
|
||||
CS_CLUSTER = 0xC004
|
||||
CS_MONITOR = 0xC005
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240510.aspx
|
||||
*/
|
||||
type ColorDepth uint16
|
||||
|
||||
const (
|
||||
RNS_UD_COLOR_8BPP ColorDepth = 0xCA01
|
||||
RNS_UD_COLOR_16BPP_555 = 0xCA02
|
||||
RNS_UD_COLOR_16BPP_565 = 0xCA03
|
||||
RNS_UD_COLOR_24BPP = 0xCA04
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240510.aspx
|
||||
*/
|
||||
type HighColor uint16
|
||||
|
||||
const (
|
||||
HIGH_COLOR_4BPP HighColor = 0x0004
|
||||
HIGH_COLOR_8BPP = 0x0008
|
||||
HIGH_COLOR_15BPP = 0x000f
|
||||
HIGH_COLOR_16BPP = 0x0010
|
||||
HIGH_COLOR_24BPP = 0x0018
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240510.aspx
|
||||
*/
|
||||
type Support uint16
|
||||
|
||||
const (
|
||||
RNS_UD_24BPP_SUPPORT uint16 = 0x0001
|
||||
RNS_UD_16BPP_SUPPORT = 0x0002
|
||||
RNS_UD_15BPP_SUPPORT = 0x0004
|
||||
RNS_UD_32BPP_SUPPORT = 0x0008
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240510.aspx
|
||||
*/
|
||||
type CapabilityFlag uint16
|
||||
|
||||
const (
|
||||
RNS_UD_CS_SUPPORT_ERRINFO_PDU uint16 = 0x0001
|
||||
RNS_UD_CS_WANT_32BPP_SESSION = 0x0002
|
||||
RNS_UD_CS_SUPPORT_STATUSINFO_PDU = 0x0004
|
||||
RNS_UD_CS_STRONG_ASYMMETRIC_KEYS = 0x0008
|
||||
RNS_UD_CS_UNUSED = 0x0010
|
||||
RNS_UD_CS_VALID_CONNECTION_TYPE = 0x0020
|
||||
RNS_UD_CS_SUPPORT_MONITOR_LAYOUT_PDU = 0x0040
|
||||
RNS_UD_CS_SUPPORT_NETCHAR_AUTODETECT = 0x0080
|
||||
RNS_UD_CS_SUPPORT_DYNVC_GFX_PROTOCOL = 0x0100
|
||||
RNS_UD_CS_SUPPORT_DYNAMIC_TIME_ZONE = 0x0200
|
||||
RNS_UD_CS_SUPPORT_HEARTBEAT_PDU = 0x0400
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240510.aspx
|
||||
*/
|
||||
type ConnectionType uint8
|
||||
|
||||
const (
|
||||
CONNECTION_TYPE_MODEM ConnectionType = 0x01
|
||||
CONNECTION_TYPE_BROADBAND_LOW = 0x02
|
||||
CONNECTION_TYPE_SATELLITEV = 0x03
|
||||
CONNECTION_TYPE_BROADBAND_HIGH = 0x04
|
||||
CONNECTION_TYPE_WAN = 0x05
|
||||
CONNECTION_TYPE_LAN = 0x06
|
||||
CONNECTION_TYPE_AUTODETECT = 0x07
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240510.aspx
|
||||
*/
|
||||
type VERSION uint32
|
||||
|
||||
const (
|
||||
RDP_VERSION_4 VERSION = 0x00080001
|
||||
RDP_VERSION_5_PLUS = 0x00080004
|
||||
)
|
||||
|
||||
type Sequence uint16
|
||||
|
||||
const (
|
||||
RNS_UD_SAS_DEL Sequence = 0xAA03
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240511.aspx
|
||||
*/
|
||||
type EncryptionMethod uint32
|
||||
|
||||
const (
|
||||
ENCRYPTION_FLAG_40BIT uint32 = 0x00000001
|
||||
ENCRYPTION_FLAG_128BIT = 0x00000002
|
||||
ENCRYPTION_FLAG_56BIT = 0x00000008
|
||||
FIPS_ENCRYPTION_FLAG = 0x00000010
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240518.aspx
|
||||
*/
|
||||
type EncryptionLevel uint32
|
||||
|
||||
const (
|
||||
ENCRYPTION_LEVEL_NONE EncryptionLevel = 0x00000000
|
||||
ENCRYPTION_LEVEL_LOW = 0x00000001
|
||||
ENCRYPTION_LEVEL_CLIENT_COMPATIBLE = 0x00000002
|
||||
ENCRYPTION_LEVEL_HIGH = 0x00000003
|
||||
ENCRYPTION_LEVEL_FIPS = 0x00000004
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240513.aspx
|
||||
*/
|
||||
type ChannelOptions uint32
|
||||
|
||||
const (
|
||||
CHANNEL_OPTION_INITIALIZED ChannelOptions = 0x80000000
|
||||
CHANNEL_OPTION_ENCRYPT_RDP = 0x40000000
|
||||
CHANNEL_OPTION_ENCRYPT_SC = 0x20000000
|
||||
CHANNEL_OPTION_ENCRYPT_CS = 0x10000000
|
||||
CHANNEL_OPTION_PRI_HIGH = 0x08000000
|
||||
CHANNEL_OPTION_PRI_MED = 0x04000000
|
||||
CHANNEL_OPTION_PRI_LOW = 0x02000000
|
||||
CHANNEL_OPTION_COMPRESS_RDP = 0x00800000
|
||||
CHANNEL_OPTION_COMPRESS = 0x00400000
|
||||
CHANNEL_OPTION_SHOW_PROTOCOL = 0x00200000
|
||||
REMOTE_CONTROL_PERSISTENT = 0x00100000
|
||||
)
|
||||
|
||||
/**
|
||||
* IBM_101_102_KEYS is the most common keyboard type
|
||||
*/
|
||||
type KeyboardType uint32
|
||||
|
||||
const (
|
||||
KT_IBM_PC_XT_83_KEY KeyboardType = 0x00000001
|
||||
KT_OLIVETTI = 0x00000002
|
||||
KT_IBM_PC_AT_84_KEY = 0x00000003
|
||||
KT_IBM_101_102_KEYS = 0x00000004
|
||||
KT_NOKIA_1050 = 0x00000005
|
||||
KT_NOKIA_9140 = 0x00000006
|
||||
KT_JAPANESE = 0x00000007
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://technet.microsoft.com/en-us/library/cc766503%28WS.10%29.aspx
|
||||
*/
|
||||
type KeyboardLayout uint32
|
||||
|
||||
const (
|
||||
ARABIC KeyboardLayout = 0x00000401
|
||||
BULGARIAN = 0x00000402
|
||||
CHINESE_US_KEYBOARD = 0x00000404
|
||||
CZECH = 0x00000405
|
||||
DANISH = 0x00000406
|
||||
GERMAN = 0x00000407
|
||||
GREEK = 0x00000408
|
||||
US = 0x00000409
|
||||
SPANISH = 0x0000040a
|
||||
FINNISH = 0x0000040b
|
||||
FRENCH = 0x0000040c
|
||||
HEBREW = 0x0000040d
|
||||
HUNGARIAN = 0x0000040e
|
||||
ICELANDIC = 0x0000040f
|
||||
ITALIAN = 0x00000410
|
||||
JAPANESE = 0x00000411
|
||||
KOREAN = 0x00000412
|
||||
DUTCH = 0x00000413
|
||||
NORWEGIAN = 0x00000414
|
||||
)
|
||||
|
||||
/**
|
||||
* @see http://msdn.microsoft.com/en-us/library/cc240521.aspx
|
||||
*/
|
||||
type CertificateType uint32
|
||||
|
||||
const (
|
||||
CERT_CHAIN_VERSION_1 CertificateType = 0x00000001
|
||||
CERT_CHAIN_VERSION_2 = 0x00000002
|
||||
)
|
||||
|
||||
type ChannelDef struct {
|
||||
Name string `struc:"little"`
|
||||
Options uint32 `struc:"little"`
|
||||
}
|
||||
|
||||
type ClientCoreData struct {
|
||||
RdpVersion VERSION `struc:"uint32,little"`
|
||||
DesktopWidth uint16 `struc:"little"`
|
||||
DesktopHeight uint16 `struc:"little"`
|
||||
ColorDepth ColorDepth `struc:"little"`
|
||||
SasSequence Sequence `struc:"little"`
|
||||
KbdLayout KeyboardLayout `struc:"little"`
|
||||
ClientBuild uint32 `struc:"little"`
|
||||
ClientName [32]byte `struc:"[32]byte"`
|
||||
KeyboardType uint32 `struc:"little"`
|
||||
KeyboardSubType uint32 `struc:"little"`
|
||||
KeyboardFnKeys uint32 `struc:"little"`
|
||||
ImeFileName [64]byte `struc:"[64]byte"`
|
||||
PostBeta2ColorDepth ColorDepth `struc:"little"`
|
||||
ClientProductId uint16 `struc:"little"`
|
||||
SerialNumber uint32 `struc:"little"`
|
||||
HighColorDepth HighColor `struc:"little"`
|
||||
SupportedColorDepths uint16 `struc:"little"`
|
||||
EarlyCapabilityFlags uint16 `struc:"little"`
|
||||
ClientDigProductId [64]byte `struc:"[64]byte"`
|
||||
ConnectionType uint8 `struc:"uint8"`
|
||||
Pad1octet uint8 `struc:"uint8"`
|
||||
ServerSelectedProtocol uint32 `struc:"little"`
|
||||
}
|
||||
|
||||
func NewClientCoreData() *ClientCoreData {
|
||||
name, _ := os.Hostname()
|
||||
var ClientName [32]byte
|
||||
copy(ClientName[:], core.UnicodeEncode(name)[:])
|
||||
return &ClientCoreData{
|
||||
RDP_VERSION_5_PLUS, 1280, 800, RNS_UD_COLOR_8BPP,
|
||||
RNS_UD_SAS_DEL, US, 3790, ClientName, KT_IBM_101_102_KEYS,
|
||||
0, 12, [64]byte{}, RNS_UD_COLOR_8BPP, 1, 0, HIGH_COLOR_24BPP,
|
||||
RNS_UD_15BPP_SUPPORT | RNS_UD_16BPP_SUPPORT | RNS_UD_24BPP_SUPPORT | RNS_UD_32BPP_SUPPORT,
|
||||
RNS_UD_CS_SUPPORT_ERRINFO_PDU, [64]byte{}, 0, 0, 0}
|
||||
}
|
||||
|
||||
func (data *ClientCoreData) Pack() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
core.WriteUInt16LE(CS_CORE, buff) // 01C0
|
||||
core.WriteUInt16LE(0xd8, buff) // d800
|
||||
struc.Pack(buff, data)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
type ClientNetworkData struct {
|
||||
ChannelCount uint32
|
||||
ChannelDefArray []ChannelDef
|
||||
}
|
||||
|
||||
func NewClientNetworkData() *ClientNetworkData {
|
||||
n := &ClientNetworkData{ChannelDefArray: make([]ChannelDef, 0, 100)}
|
||||
|
||||
/*var d1 ChannelDef
|
||||
d1.Name = plugin.RDPDR_SVC_CHANNEL_NAME
|
||||
d1.Options = uint32(CHANNEL_OPTION_INITIALIZED | CHANNEL_OPTION_ENCRYPT_RDP |
|
||||
CHANNEL_OPTION_COMPRESS_RDP)
|
||||
n.ChannelDefArray = append(n.ChannelDefArray, d1)
|
||||
|
||||
var d2 ChannelDef
|
||||
d2.Name = plugin.RDPSND_SVC_CHANNEL_NAME
|
||||
d2.Options = uint32(CHANNEL_OPTION_INITIALIZED | CHANNEL_OPTION_ENCRYPT_RDP |
|
||||
CHANNEL_OPTION_COMPRESS_RDP | CHANNEL_OPTION_SHOW_PROTOCOL)
|
||||
n.ChannelDefArray = append(n.ChannelDefArray, d2)*/
|
||||
|
||||
return n
|
||||
}
|
||||
|
||||
func (n *ClientNetworkData) AddVirtualChannel(name string, option uint32) {
|
||||
var d ChannelDef
|
||||
d.Name = name
|
||||
d.Options = option
|
||||
n.ChannelDefArray = append(n.ChannelDefArray, d)
|
||||
n.ChannelCount++
|
||||
}
|
||||
|
||||
func (n *ClientNetworkData) Pack() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
core.WriteUInt16LE(CS_NET, buff) // type
|
||||
length := uint16(n.ChannelCount*12 + 8)
|
||||
core.WriteUInt16LE(length, buff) // len 8
|
||||
core.WriteUInt32LE(n.ChannelCount, buff)
|
||||
for i := 0; i < int(n.ChannelCount); i++ {
|
||||
v := n.ChannelDefArray[i]
|
||||
name := make([]byte, 8)
|
||||
copy(name, []byte(v.Name))
|
||||
core.WriteBytes(name[:], buff)
|
||||
core.WriteUInt32LE(v.Options, buff)
|
||||
}
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
type ClientSecurityData struct {
|
||||
EncryptionMethods uint32
|
||||
ExtEncryptionMethods uint32
|
||||
}
|
||||
|
||||
func NewClientSecurityData() *ClientSecurityData {
|
||||
return &ClientSecurityData{
|
||||
ENCRYPTION_FLAG_40BIT | ENCRYPTION_FLAG_56BIT | ENCRYPTION_FLAG_128BIT,
|
||||
00}
|
||||
}
|
||||
|
||||
func (d *ClientSecurityData) Pack() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
core.WriteUInt16LE(CS_SECURITY, buff) // type
|
||||
core.WriteUInt16LE(0x0c, buff) // len 12
|
||||
core.WriteUInt32LE(d.EncryptionMethods, buff)
|
||||
core.WriteUInt32LE(d.ExtEncryptionMethods, buff)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
type RSAPublicKey struct {
|
||||
Magic uint32 `struc:"little"` //0x31415352
|
||||
Keylen uint32 `struc:"little,sizeof=Modulus"`
|
||||
Bitlen uint32 `struc:"little"`
|
||||
Datalen uint32 `struc:"little"`
|
||||
PubExp uint32 `struc:"little"`
|
||||
Modulus []byte `struc:"little"`
|
||||
Padding []byte `struc:"[8]byte"`
|
||||
}
|
||||
|
||||
type ProprietaryServerCertificate struct {
|
||||
DwSigAlgId uint32 `struc:"little"` //0x00000001
|
||||
DwKeyAlgId uint32 `struc:"little"` //0x00000001
|
||||
PublicKeyBlobType uint16 `struc:"little"` //0x0006
|
||||
PublicKeyBlobLen uint16 `struc:"little,sizeof=PublicKeyBlob"`
|
||||
PublicKeyBlob RSAPublicKey `struc:"little"`
|
||||
SignatureBlobType uint16 `struc:"little"` //0x0008
|
||||
SignatureBlobLen uint16 `struc:"little,sizeof=SignatureBlob"`
|
||||
SignatureBlob []byte `struc:"little"`
|
||||
//PaddingLen uint16 `struc:"little,sizeof=Padding,skip"`
|
||||
Padding []byte `struc:"[8]byte"`
|
||||
}
|
||||
|
||||
func (p *ProprietaryServerCertificate) GetPublicKey() (*rsa.PublicKey, error) {
|
||||
b := new(big.Int).SetBytes(core.Reverse(p.PublicKeyBlob.Modulus))
|
||||
e := new(big.Int).SetInt64(int64(p.PublicKeyBlob.PubExp))
|
||||
return &rsa.PublicKey{N: b, E: int(e.Int64())}, nil
|
||||
}
|
||||
func (p *ProprietaryServerCertificate) Verify() bool {
|
||||
return true
|
||||
}
|
||||
func (p *ProprietaryServerCertificate) Encrypt() []byte {
|
||||
//todo
|
||||
return nil
|
||||
}
|
||||
func (p *ProprietaryServerCertificate) Unpack(r io.Reader) error {
|
||||
p.DwSigAlgId, _ = core.ReadUInt32LE(r)
|
||||
p.DwKeyAlgId, _ = core.ReadUInt32LE(r)
|
||||
p.PublicKeyBlobType, _ = core.ReadUint16LE(r)
|
||||
p.PublicKeyBlobLen, _ = core.ReadUint16LE(r)
|
||||
var b RSAPublicKey
|
||||
b.Magic, _ = core.ReadUInt32LE(r)
|
||||
b.Keylen, _ = core.ReadUInt32LE(r)
|
||||
b.Bitlen, _ = core.ReadUInt32LE(r)
|
||||
b.Datalen, _ = core.ReadUInt32LE(r)
|
||||
b.PubExp, _ = core.ReadUInt32LE(r)
|
||||
b.Modulus, _ = core.ReadBytes(int(b.Keylen)-8, r)
|
||||
b.Padding, _ = core.ReadBytes(8, r)
|
||||
p.PublicKeyBlob = b
|
||||
p.SignatureBlobType, _ = core.ReadUint16LE(r)
|
||||
p.SignatureBlobLen, _ = core.ReadUint16LE(r)
|
||||
p.SignatureBlob, _ = core.ReadBytes(int(p.SignatureBlobLen)-8, r)
|
||||
p.Padding, _ = core.ReadBytes(8, r)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
type CertBlob struct {
|
||||
CbCert uint32 `struc:"little,sizeof=AbCert"`
|
||||
AbCert []byte `struc:"little"`
|
||||
}
|
||||
type X509CertificateChain struct {
|
||||
NumCertBlobs uint32 `struc:"little,sizeof=CertBlobArray"`
|
||||
CertBlobArray []CertBlob `struc:"little"`
|
||||
Padding []byte `struc:"[12]byte"`
|
||||
}
|
||||
|
||||
func (x *X509CertificateChain) GetPublicKey() (*rsa.PublicKey, error) {
|
||||
if len(x.CertBlobArray) == 0 {
|
||||
return nil, errors.New("empty certificate chain")
|
||||
}
|
||||
data := x.CertBlobArray[len(x.CertBlobArray)-1].AbCert
|
||||
cert, err := x509.ParseCertificate(data)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse certificate: %w", err)
|
||||
}
|
||||
if cert.PublicKey == nil {
|
||||
var pubKeyInfo struct {
|
||||
Algorithm pkix.AlgorithmIdentifier
|
||||
SubjectPublicKey asn1.BitString
|
||||
}
|
||||
_, err = asn1.Unmarshal(cert.RawSubjectPublicKeyInfo, &pubKeyInfo)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unmarshal public key info: %w", err)
|
||||
}
|
||||
rsaPublicKey, err := x509.ParsePKCS1PublicKey(pubKeyInfo.SubjectPublicKey.Bytes)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse PKCS1 public key: %w", err)
|
||||
}
|
||||
return rsaPublicKey, nil
|
||||
}
|
||||
rsaPublicKey, ok := cert.PublicKey.(*rsa.PublicKey)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("unsupported public key type: %T", cert.PublicKey)
|
||||
}
|
||||
return rsaPublicKey, nil
|
||||
}
|
||||
func (x *X509CertificateChain) Verify() bool {
|
||||
return true
|
||||
}
|
||||
func (x *X509CertificateChain) Encrypt() []byte {
|
||||
//todo
|
||||
return nil
|
||||
}
|
||||
func (x *X509CertificateChain) Unpack(r io.Reader) error {
|
||||
return struc.Unpack(r, x)
|
||||
}
|
||||
|
||||
type ServerCoreData struct {
|
||||
RdpVersion VERSION `struc:"uint32,little"`
|
||||
ClientRequestedProtocol uint32 `struc:"little"`
|
||||
EarlyCapabilityFlags uint32 `struc:"little"`
|
||||
}
|
||||
|
||||
func NewServerCoreData() *ServerCoreData {
|
||||
return &ServerCoreData{
|
||||
RDP_VERSION_5_PLUS, 0, 0}
|
||||
}
|
||||
|
||||
func (d *ServerCoreData) Serialize() []byte {
|
||||
return []byte{}
|
||||
}
|
||||
|
||||
func (d *ServerCoreData) ScType() Message {
|
||||
return SC_CORE
|
||||
}
|
||||
func (d *ServerCoreData) Unpack(r io.Reader) error {
|
||||
version, _ := core.ReadUInt32LE(r)
|
||||
d.RdpVersion = VERSION(version)
|
||||
d.ClientRequestedProtocol, _ = core.ReadUInt32LE(r)
|
||||
d.EarlyCapabilityFlags, _ = core.ReadUInt32LE(r)
|
||||
|
||||
return nil
|
||||
//return struc.Unpack(r, d)
|
||||
}
|
||||
|
||||
type ServerNetworkData struct {
|
||||
MCSChannelId uint16 `struc:"little"`
|
||||
ChannelCount uint16 `struc:"little,sizeof=ChannelIdArray"`
|
||||
ChannelIdArray []uint16 `struc:"little"`
|
||||
}
|
||||
|
||||
func NewServerNetworkData() *ServerNetworkData {
|
||||
return &ServerNetworkData{}
|
||||
}
|
||||
func (d *ServerNetworkData) ScType() Message {
|
||||
return SC_NET
|
||||
}
|
||||
func (d *ServerNetworkData) Unpack(r io.Reader) error {
|
||||
return struc.Unpack(r, d)
|
||||
}
|
||||
|
||||
type CertData interface {
|
||||
GetPublicKey() (*rsa.PublicKey, error)
|
||||
Verify() bool
|
||||
Unpack(io.Reader) error
|
||||
}
|
||||
type ServerCertificate struct {
|
||||
DwVersion uint32
|
||||
CertData CertData
|
||||
}
|
||||
|
||||
func (sc *ServerCertificate) Unpack(r io.Reader) error {
|
||||
sc.DwVersion, _ = core.ReadUInt32LE(r)
|
||||
var cd CertData
|
||||
switch CertificateType(sc.DwVersion & 0x7fffffff) {
|
||||
case CERT_CHAIN_VERSION_1:
|
||||
glog.Debug("ProprietaryServerCertificate")
|
||||
cd = &ProprietaryServerCertificate{}
|
||||
case CERT_CHAIN_VERSION_2:
|
||||
glog.Debug("X509CertificateChain")
|
||||
cd = &X509CertificateChain{}
|
||||
default:
|
||||
glog.Error("Unsupported version:", sc.DwVersion&0x7fffffff)
|
||||
return errors.New("Unsupported version")
|
||||
}
|
||||
if cd != nil {
|
||||
err := cd.Unpack(r)
|
||||
if err != nil {
|
||||
glog.Error("Unpack:", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
sc.CertData = cd
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
type ServerSecurityData struct {
|
||||
EncryptionMethod uint32 `struc:"little"`
|
||||
EncryptionLevel uint32 `struc:"little"`
|
||||
ServerRandomLen uint32 //0x00000020
|
||||
ServerCertLen uint32
|
||||
ServerRandom []byte
|
||||
ServerCertificate ServerCertificate
|
||||
}
|
||||
|
||||
func NewServerSecurityData() *ServerSecurityData {
|
||||
return &ServerSecurityData{
|
||||
0, 0, 0x00000020, 0, []byte{}, ServerCertificate{}}
|
||||
}
|
||||
func (d *ServerSecurityData) ScType() Message {
|
||||
return SC_SECURITY
|
||||
}
|
||||
func (s *ServerSecurityData) Unpack(r io.Reader) error {
|
||||
s.EncryptionMethod, _ = core.ReadUInt32LE(r)
|
||||
s.EncryptionLevel, _ = core.ReadUInt32LE(r)
|
||||
if !(s.EncryptionMethod == 0 && s.EncryptionLevel == 0) {
|
||||
s.ServerRandomLen, _ = core.ReadUInt32LE(r)
|
||||
s.ServerCertLen, _ = core.ReadUInt32LE(r)
|
||||
s.ServerRandom, _ = core.ReadBytes(int(s.ServerRandomLen), r)
|
||||
var sc ServerCertificate
|
||||
data, _ := core.ReadBytes(int(s.ServerCertLen), r)
|
||||
rd := bytes.NewReader(data)
|
||||
err := sc.Unpack(rd)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
s.ServerCertificate = sc
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func MakeConferenceCreateRequest(userData []byte) []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
per.WriteChoice(0, buff) // 00
|
||||
per.WriteObjectIdentifier(t124_02_98_oid, buff) // 05:00:14:7c:00:01
|
||||
per.WriteLength(len(userData)+14, buff)
|
||||
per.WriteChoice(0, buff) // 00
|
||||
per.WriteSelection(0x08, buff) // 08
|
||||
per.WriteNumericString("1", 1, buff) // 00 10
|
||||
per.WritePadding(1, buff) // 00
|
||||
per.WriteNumberOfSet(1, buff) // 01
|
||||
per.WriteChoice(0xc0, buff) // c0
|
||||
per.WriteOctetStream(h221_cs_key, 4, buff) // 00 44:75:63:61
|
||||
per.WriteOctetStream(string(userData), 0, buff)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
type ScData interface {
|
||||
ScType() Message
|
||||
Unpack(io.Reader) error
|
||||
}
|
||||
|
||||
func ReadConferenceCreateResponse(data []byte) []interface{} {
|
||||
ret := make([]interface{}, 0, 3)
|
||||
|
||||
r := bytes.NewReader(data)
|
||||
per.ReadChoice(r)
|
||||
if !per.ReadObjectIdentifier(r, t124_02_98_oid) {
|
||||
glog.Error("NODE_RDP_PROTOCOL_T125_GCC_BAD_OBJECT_IDENTIFIER_T124")
|
||||
return ret
|
||||
}
|
||||
per.ReadLength(r)
|
||||
per.ReadChoice(r)
|
||||
per.ReadInteger16(r)
|
||||
per.ReadInteger(r)
|
||||
per.ReadEnumerates(r)
|
||||
per.ReadNumberOfSet(r)
|
||||
per.ReadChoice(r)
|
||||
|
||||
if !per.ReadOctetStream(r, h221_sc_key, 4) {
|
||||
glog.Error("NODE_RDP_PROTOCOL_T125_GCC_BAD_H221_SC_KEY")
|
||||
return ret
|
||||
}
|
||||
|
||||
ln, _ := per.ReadLength(r)
|
||||
for ln > 0 {
|
||||
t, _ := core.ReadUint16LE(r)
|
||||
glog.Debugf("Message type 0x%x,ln:%v", t, ln)
|
||||
l, _ := core.ReadUint16LE(r)
|
||||
dataBytes, _ := core.ReadBytes(int(l)-4, r)
|
||||
ln = ln - l
|
||||
var d ScData
|
||||
switch Message(t) {
|
||||
case SC_CORE:
|
||||
d = &ServerCoreData{}
|
||||
case SC_SECURITY:
|
||||
d = &ServerSecurityData{}
|
||||
case SC_NET:
|
||||
d = &ServerNetworkData{}
|
||||
default:
|
||||
glog.Error("Unknown type", t)
|
||||
continue
|
||||
}
|
||||
|
||||
if d != nil {
|
||||
r := bytes.NewReader(dataBytes)
|
||||
err := d.Unpack(r)
|
||||
if err != nil {
|
||||
glog.Warn("Unpack:", err)
|
||||
}
|
||||
ret = append(ret, d)
|
||||
}
|
||||
}
|
||||
|
||||
return ret
|
||||
}
|
||||
@@ -0,0 +1,558 @@
|
||||
package t125
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"reflect"
|
||||
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/core"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/emission"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/glog"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/protocol/t125/ber"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/protocol/t125/gcc"
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/protocol/t125/per"
|
||||
)
|
||||
|
||||
// take idea from https://github.com/Madnikulin50/gordp
|
||||
|
||||
// Multiple Channel Service layer
|
||||
|
||||
type MCSMessage uint8
|
||||
|
||||
const (
|
||||
MCS_TYPE_CONNECT_INITIAL MCSMessage = 0x65
|
||||
MCS_TYPE_CONNECT_RESPONSE = 0x66
|
||||
)
|
||||
|
||||
type MCSDomainPDU uint16
|
||||
|
||||
const (
|
||||
ERECT_DOMAIN_REQUEST MCSDomainPDU = 1
|
||||
DISCONNECT_PROVIDER_ULTIMATUM = 8
|
||||
ATTACH_USER_REQUEST = 10
|
||||
ATTACH_USER_CONFIRM = 11
|
||||
CHANNEL_JOIN_REQUEST = 14
|
||||
CHANNEL_JOIN_CONFIRM = 15
|
||||
SEND_DATA_REQUEST = 25
|
||||
SEND_DATA_INDICATION = 26
|
||||
)
|
||||
|
||||
const (
|
||||
MCS_GLOBAL_CHANNEL_ID uint16 = 1003
|
||||
MCS_USERCHANNEL_BASE = 1001
|
||||
)
|
||||
|
||||
const (
|
||||
GLOBAL_CHANNEL_NAME = "global"
|
||||
)
|
||||
|
||||
/**
|
||||
* Format MCS PDULayer header packet
|
||||
* @param mcsPdu {integer}
|
||||
* @param options {integer}
|
||||
* @returns {type.UInt8} headers
|
||||
*/
|
||||
func writeMCSPDUHeader(mcsPdu MCSDomainPDU, options uint8, w io.Writer) {
|
||||
core.WriteUInt8((uint8(mcsPdu)<<2)|options, w)
|
||||
}
|
||||
|
||||
func readMCSPDUHeader(options uint8, mcsPdu MCSDomainPDU) bool {
|
||||
return (options >> 2) == uint8(mcsPdu)
|
||||
}
|
||||
|
||||
type DomainParameters struct {
|
||||
MaxChannelIds int
|
||||
MaxUserIds int
|
||||
MaxTokenIds int
|
||||
NumPriorities int
|
||||
MinThoughput int
|
||||
MaxHeight int
|
||||
MaxMCSPDUsize int
|
||||
ProtocolVersion int
|
||||
}
|
||||
|
||||
/**
|
||||
* @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25
|
||||
* @returns {asn1.univ.Sequence}
|
||||
*/
|
||||
func NewDomainParameters(
|
||||
maxChannelIds int,
|
||||
maxUserIds int,
|
||||
maxTokenIds int,
|
||||
numPriorities int,
|
||||
minThoughput int,
|
||||
maxHeight int,
|
||||
maxMCSPDUsize int,
|
||||
protocolVersion int) *DomainParameters {
|
||||
return &DomainParameters{maxChannelIds, maxUserIds, maxTokenIds,
|
||||
numPriorities, minThoughput, maxHeight, maxMCSPDUsize, protocolVersion}
|
||||
}
|
||||
|
||||
func (d *DomainParameters) BER() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
ber.WriteInteger(d.MaxChannelIds, buff)
|
||||
ber.WriteInteger(d.MaxUserIds, buff)
|
||||
ber.WriteInteger(d.MaxTokenIds, buff)
|
||||
ber.WriteInteger(1, buff)
|
||||
ber.WriteInteger(0, buff)
|
||||
ber.WriteInteger(1, buff)
|
||||
ber.WriteInteger(d.MaxMCSPDUsize, buff)
|
||||
ber.WriteInteger(2, buff)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
func ReadDomainParameters(r io.Reader) (*DomainParameters, error) {
|
||||
if !ber.ReadUniversalTag(ber.TAG_SEQUENCE, true, r) {
|
||||
return nil, errors.New("bad BER tags")
|
||||
}
|
||||
d := &DomainParameters{}
|
||||
ber.ReadLength(r)
|
||||
|
||||
d.MaxChannelIds, _ = ber.ReadInteger(r)
|
||||
d.MaxUserIds, _ = ber.ReadInteger(r)
|
||||
d.MaxTokenIds, _ = ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
d.MaxMCSPDUsize, _ = ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
return d, nil
|
||||
}
|
||||
|
||||
/**
|
||||
* @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25
|
||||
* @param userData {Buffer}
|
||||
* @returns {asn1.univ.Sequence}
|
||||
*/
|
||||
type ConnectInitial struct {
|
||||
CallingDomainSelector []byte
|
||||
CalledDomainSelector []byte
|
||||
UpwardFlag bool
|
||||
TargetParameters DomainParameters
|
||||
MinimumParameters DomainParameters
|
||||
MaximumParameters DomainParameters
|
||||
UserData []byte
|
||||
}
|
||||
|
||||
func NewConnectInitial(userData []byte) ConnectInitial {
|
||||
return ConnectInitial{[]byte{0x1},
|
||||
[]byte{0x1},
|
||||
true,
|
||||
*NewDomainParameters(34, 2, 0, 1, 0, 1, 0xffff, 2),
|
||||
*NewDomainParameters(1, 1, 1, 1, 0, 1, 0x420, 2),
|
||||
*NewDomainParameters(0xffff, 0xfc17, 0xffff, 1, 0, 1, 0xffff, 2),
|
||||
userData}
|
||||
}
|
||||
|
||||
func (c *ConnectInitial) BER() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
ber.WriteOctetstring(string(c.CallingDomainSelector), buff)
|
||||
ber.WriteOctetstring(string(c.CalledDomainSelector), buff)
|
||||
ber.WriteBoolean(c.UpwardFlag, buff)
|
||||
ber.WriteEncodedDomainParams(c.TargetParameters.BER(), buff)
|
||||
ber.WriteEncodedDomainParams(c.MinimumParameters.BER(), buff)
|
||||
ber.WriteEncodedDomainParams(c.MaximumParameters.BER(), buff)
|
||||
ber.WriteOctetstring(string(c.UserData), buff)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
/**
|
||||
* @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25
|
||||
* @returns {asn1.univ.Sequence}
|
||||
*/
|
||||
|
||||
type ConnectResponse struct {
|
||||
result uint8
|
||||
calledConnectId int
|
||||
domainParameters *DomainParameters
|
||||
userData []byte
|
||||
}
|
||||
|
||||
func NewConnectResponse(userData []byte) *ConnectResponse {
|
||||
return &ConnectResponse{0,
|
||||
0,
|
||||
NewDomainParameters(22, 3, 0, 1, 0, 1, 0xfff8, 2),
|
||||
userData}
|
||||
}
|
||||
|
||||
func ReadConnectResponse(r io.Reader) (*ConnectResponse, error) {
|
||||
c := &ConnectResponse{}
|
||||
var err error
|
||||
_, err = ber.ReadApplicationTag(MCS_TYPE_CONNECT_RESPONSE, r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
c.result, err = ber.ReadEnumerated(r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
c.calledConnectId, err = ber.ReadInteger(r)
|
||||
c.domainParameters, err = ReadDomainParameters(r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !ber.ReadUniversalTag(ber.TAG_OCTET_STRING, false, r) {
|
||||
return nil, errors.New("invalid expected BER tag")
|
||||
}
|
||||
dataLen, _ := ber.ReadLength(r)
|
||||
c.userData, err = core.ReadBytes(dataLen, r)
|
||||
return c, err
|
||||
}
|
||||
|
||||
type MCSChannelInfo struct {
|
||||
ID uint16
|
||||
Name string
|
||||
}
|
||||
|
||||
type MCS struct {
|
||||
emission.Emitter
|
||||
transport core.Transport
|
||||
recvOpCode MCSDomainPDU
|
||||
sendOpCode MCSDomainPDU
|
||||
channels []MCSChannelInfo
|
||||
}
|
||||
|
||||
func NewMCS(t core.Transport, recvOpCode MCSDomainPDU, sendOpCode MCSDomainPDU) *MCS {
|
||||
m := &MCS{
|
||||
*emission.NewEmitter(),
|
||||
t,
|
||||
recvOpCode,
|
||||
sendOpCode,
|
||||
[]MCSChannelInfo{{MCS_GLOBAL_CHANNEL_ID, GLOBAL_CHANNEL_NAME}},
|
||||
}
|
||||
|
||||
m.transport.On("close", func() {
|
||||
m.Emit("close")
|
||||
}).On("error", func(err error) {
|
||||
m.Emit("error", err)
|
||||
})
|
||||
return m
|
||||
}
|
||||
|
||||
func (x *MCS) Read(b []byte) (n int, err error) {
|
||||
return x.transport.Read(b)
|
||||
}
|
||||
|
||||
func (x *MCS) Write(b []byte) (n int, err error) {
|
||||
return x.transport.Write(b)
|
||||
}
|
||||
|
||||
func (m *MCS) Close() error {
|
||||
return m.transport.Close()
|
||||
}
|
||||
|
||||
type MCSClient struct {
|
||||
*MCS
|
||||
clientCoreData *gcc.ClientCoreData
|
||||
clientNetworkData *gcc.ClientNetworkData
|
||||
clientSecurityData *gcc.ClientSecurityData
|
||||
|
||||
serverCoreData *gcc.ServerCoreData
|
||||
serverNetworkData *gcc.ServerNetworkData
|
||||
serverSecurityData *gcc.ServerSecurityData
|
||||
|
||||
channelsConnected int
|
||||
userId uint16
|
||||
nbChannelRequested int
|
||||
}
|
||||
|
||||
func NewMCSClient(t core.Transport) *MCSClient {
|
||||
c := &MCSClient{
|
||||
MCS: NewMCS(t, SEND_DATA_INDICATION, SEND_DATA_REQUEST),
|
||||
clientCoreData: gcc.NewClientCoreData(),
|
||||
clientNetworkData: gcc.NewClientNetworkData(),
|
||||
clientSecurityData: gcc.NewClientSecurityData(),
|
||||
userId: 1 + MCS_USERCHANNEL_BASE,
|
||||
}
|
||||
c.transport.On("connect", c.connect)
|
||||
return c
|
||||
}
|
||||
|
||||
func (c *MCSClient) SetClientCoreData(width, height uint16) {
|
||||
c.clientCoreData.DesktopWidth = width
|
||||
c.clientCoreData.DesktopHeight = height
|
||||
}
|
||||
|
||||
func (c *MCSClient) connect(selectedProtocol uint32) {
|
||||
glog.Debug("mcs client on connect", selectedProtocol)
|
||||
c.clientCoreData.ServerSelectedProtocol = selectedProtocol
|
||||
|
||||
glog.Debugf("clientCoreData:%+v", c.clientCoreData)
|
||||
glog.Debugf("clientNetworkData:%+v", c.clientNetworkData)
|
||||
glog.Debugf("clientSecurityData:%+v", c.clientSecurityData)
|
||||
// sendConnectclientCoreDataInitial
|
||||
userDataBuff := bytes.Buffer{}
|
||||
userDataBuff.Write(c.clientCoreData.Pack())
|
||||
userDataBuff.Write(c.clientNetworkData.Pack())
|
||||
userDataBuff.Write(c.clientSecurityData.Pack())
|
||||
|
||||
ccReq := gcc.MakeConferenceCreateRequest(userDataBuff.Bytes())
|
||||
connectInitial := NewConnectInitial(ccReq)
|
||||
connectInitialBerEncoded := connectInitial.BER()
|
||||
|
||||
dataBuff := &bytes.Buffer{}
|
||||
ber.WriteApplicationTag(uint8(MCS_TYPE_CONNECT_INITIAL), len(connectInitialBerEncoded), dataBuff)
|
||||
dataBuff.Write(connectInitialBerEncoded)
|
||||
|
||||
_, err := c.transport.Write(dataBuff.Bytes())
|
||||
if err != nil {
|
||||
c.Emit("error", errors.New(fmt.Sprintf("mcs sendConnectInitial write error %v", err)))
|
||||
return
|
||||
}
|
||||
glog.Debug("mcs wait for data event")
|
||||
c.transport.Once("data", c.recvConnectResponse)
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvConnectResponse(s []byte) {
|
||||
glog.Debug("mcs recvConnectResponse", hex.EncodeToString(s))
|
||||
cResp, err := ReadConnectResponse(bytes.NewReader(s))
|
||||
if err != nil {
|
||||
c.Emit("error", errors.New(fmt.Sprintf("ReadConnectResponse %v", err)))
|
||||
return
|
||||
}
|
||||
// record server gcc block
|
||||
serverSettings := gcc.ReadConferenceCreateResponse(cResp.userData)
|
||||
for _, v := range serverSettings {
|
||||
switch v.(type) {
|
||||
case *gcc.ServerSecurityData:
|
||||
c.serverSecurityData = v.(*gcc.ServerSecurityData)
|
||||
|
||||
case *gcc.ServerCoreData:
|
||||
c.serverCoreData = v.(*gcc.ServerCoreData)
|
||||
|
||||
case *gcc.ServerNetworkData:
|
||||
c.serverNetworkData = v.(*gcc.ServerNetworkData)
|
||||
|
||||
default:
|
||||
err := errors.New(fmt.Sprintf("unhandle server gcc block %v", reflect.TypeOf(v)))
|
||||
glog.Error(err)
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
}
|
||||
glog.Debugf("serverSecurityData: %+v", c.serverSecurityData)
|
||||
glog.Debugf("serverCoreData: %+v", c.serverCoreData)
|
||||
glog.Info("version", c.serverCoreData.RdpVersion, c.serverCoreData.ClientRequestedProtocol)
|
||||
glog.Debugf("serverNetworkData: %+v", c.serverNetworkData)
|
||||
glog.Debug("mcs sendErectDomainRequest")
|
||||
c.sendErectDomainRequest()
|
||||
|
||||
glog.Debug("mcs sendAttachUserRequest")
|
||||
c.sendAttachUserRequest()
|
||||
|
||||
c.transport.Once("data", c.recvAttachUserConfirm)
|
||||
}
|
||||
|
||||
func (c *MCSClient) sendErectDomainRequest() {
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(ERECT_DOMAIN_REQUEST, 0, buff)
|
||||
per.WriteInteger(0, buff)
|
||||
per.WriteInteger(0, buff)
|
||||
c.transport.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func (c *MCSClient) sendAttachUserRequest() {
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(ATTACH_USER_REQUEST, 0, buff)
|
||||
c.transport.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvAttachUserConfirm(s []byte) {
|
||||
glog.Debug("mcs recvAttachUserConfirm", hex.EncodeToString(s))
|
||||
r := bytes.NewReader(s)
|
||||
|
||||
option, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
|
||||
if !readMCSPDUHeader(option, ATTACH_USER_CONFIRM) {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_BAD_HEADER"))
|
||||
return
|
||||
}
|
||||
|
||||
e, err := per.ReadEnumerates(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
if e != 0 {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER'"))
|
||||
return
|
||||
}
|
||||
|
||||
userId, _ := per.ReadInteger16(r)
|
||||
userId += MCS_USERCHANNEL_BASE
|
||||
c.userId = userId
|
||||
|
||||
c.channels = append(c.channels, MCSChannelInfo{userId, "user"})
|
||||
c.connectChannels()
|
||||
}
|
||||
|
||||
func (c *MCSClient) connectChannels() {
|
||||
glog.Debug("mcs connectChannels:", c.channelsConnected, ":", len(c.channels))
|
||||
if c.channelsConnected == len(c.channels) && c.serverNetworkData != nil {
|
||||
if c.nbChannelRequested < int(c.serverNetworkData.ChannelCount) {
|
||||
//static virtual channel
|
||||
chanId := c.serverNetworkData.ChannelIdArray[c.nbChannelRequested]
|
||||
c.nbChannelRequested++
|
||||
c.sendChannelJoinRequest(chanId)
|
||||
c.transport.Once("data", c.recvChannelJoinConfirm)
|
||||
return
|
||||
}
|
||||
c.transport.On("data", c.recvData)
|
||||
// send client and sever gcc informations callback to sec
|
||||
clientData := make([]interface{}, 0)
|
||||
clientData = append(clientData, c.clientCoreData)
|
||||
clientData = append(clientData, c.clientSecurityData)
|
||||
clientData = append(clientData, c.clientNetworkData)
|
||||
|
||||
serverData := make([]interface{}, 0)
|
||||
serverData = append(serverData, c.serverCoreData)
|
||||
serverData = append(serverData, c.serverSecurityData)
|
||||
glog.Debug("msc connectChannels callback to sec")
|
||||
c.Emit("connect", clientData, serverData, c.userId, c.channels)
|
||||
return
|
||||
}
|
||||
|
||||
// sendChannelJoinRequest
|
||||
glog.Debug("sendChannelJoinRequest:", c.channels[c.channelsConnected].Name)
|
||||
c.sendChannelJoinRequest(c.channels[c.channelsConnected].ID)
|
||||
|
||||
c.transport.Once("data", c.recvChannelJoinConfirm)
|
||||
}
|
||||
|
||||
func (c *MCSClient) sendChannelJoinRequest(channelId uint16) {
|
||||
glog.Debug("mcs sendChannelJoinRequest", channelId)
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(CHANNEL_JOIN_REQUEST, 0, buff)
|
||||
per.WriteInteger16(c.userId-MCS_USERCHANNEL_BASE, buff)
|
||||
per.WriteInteger16(channelId, buff)
|
||||
c.transport.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvData(s []byte) {
|
||||
glog.Debug("msc on data recvData:", hex.EncodeToString(s))
|
||||
|
||||
r := bytes.NewReader(s)
|
||||
option, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
|
||||
if readMCSPDUHeader(option, DISCONNECT_PROVIDER_ULTIMATUM) {
|
||||
c.Emit("error", errors.New("MCS DISCONNECT_PROVIDER_ULTIMATUM"))
|
||||
c.transport.Close()
|
||||
return
|
||||
} else if !readMCSPDUHeader(option, c.recvOpCode) {
|
||||
c.Emit("error", errors.New("Invalid expected MCS opcode receive data"))
|
||||
return
|
||||
}
|
||||
|
||||
userId, _ := per.ReadInteger16(r)
|
||||
userId += MCS_USERCHANNEL_BASE
|
||||
|
||||
channelId, _ := per.ReadInteger16(r)
|
||||
per.ReadEnumerates(r)
|
||||
size, _ := per.ReadLength(r)
|
||||
// channel ID doesn't match a requested layer
|
||||
found := false
|
||||
channelName := ""
|
||||
for _, channel := range c.channels {
|
||||
if channel.ID == channelId {
|
||||
found = true
|
||||
channelName = channel.Name
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
glog.Error("mcs receive data for an unconnected layer")
|
||||
return
|
||||
}
|
||||
left, err := core.ReadBytes(int(size), r)
|
||||
if err != nil {
|
||||
c.Emit("error", errors.New(fmt.Sprintf("mcs recvData get data error %v", err)))
|
||||
return
|
||||
}
|
||||
glog.Debugf("mcs emit channel<%s>:%v", channelName, left)
|
||||
c.Emit("sec", channelName, left)
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvChannelJoinConfirm(s []byte) {
|
||||
glog.Debug("mcs recvChannelJoinConfirm", hex.EncodeToString(s))
|
||||
r := bytes.NewReader(s)
|
||||
option, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
|
||||
if !readMCSPDUHeader(option, CHANNEL_JOIN_CONFIRM) {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_WAIT_CHANNEL_JOIN_CONFIRM"))
|
||||
return
|
||||
}
|
||||
|
||||
confirm, _ := per.ReadEnumerates(r)
|
||||
userId, _ := per.ReadInteger16(r)
|
||||
userId += MCS_USERCHANNEL_BASE
|
||||
|
||||
if c.userId != userId {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_INVALID_USER_ID"))
|
||||
return
|
||||
}
|
||||
|
||||
channelId, _ := per.ReadInteger16(r)
|
||||
if (confirm != 0) && (channelId == uint16(MCS_GLOBAL_CHANNEL_ID) || channelId == c.userId) {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_SERVER_MUST_CONFIRM_STATIC_CHANNEL"))
|
||||
return
|
||||
}
|
||||
glog.Debug("Confirm channelId:", channelId)
|
||||
if confirm == 0 && c.serverNetworkData != nil {
|
||||
for i := 0; i < int(c.serverNetworkData.ChannelCount); i++ {
|
||||
if channelId == c.serverNetworkData.ChannelIdArray[i] {
|
||||
var t MCSChannelInfo
|
||||
t.ID = channelId
|
||||
t.Name = string(c.clientNetworkData.ChannelDefArray[i].Name[:])
|
||||
c.channels = append(c.channels, t)
|
||||
}
|
||||
}
|
||||
}
|
||||
c.channelsConnected++
|
||||
c.connectChannels()
|
||||
}
|
||||
|
||||
func (c *MCSClient) Pack(data []byte, channelId uint16) []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(c.sendOpCode, 0, buff)
|
||||
per.WriteInteger16(c.userId-MCS_USERCHANNEL_BASE, buff)
|
||||
per.WriteInteger16(channelId, buff)
|
||||
core.WriteUInt8(0x70, buff)
|
||||
per.WriteLength(len(data), buff)
|
||||
core.WriteBytes(data, buff)
|
||||
glog.Debug("MCSClient write", channelId, ":", hex.EncodeToString(buff.Bytes()))
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
func (c *MCSClient) Write(data []byte) (n int, err error) {
|
||||
data = c.Pack(data, c.channels[0].ID)
|
||||
return c.transport.Write(data)
|
||||
}
|
||||
|
||||
func (c *MCSClient) SendToChannel(channel string, data []byte) (n int, err error) {
|
||||
channelId := c.channels[0].ID
|
||||
for _, ch := range c.channels {
|
||||
if channel == ch.Name {
|
||||
channelId = ch.ID
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
data = c.Pack(data, channelId)
|
||||
return c.transport.Write(data)
|
||||
}
|
||||
@@ -0,0 +1,574 @@
|
||||
package t125
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"reflect"
|
||||
|
||||
"github.com/xxx/wscan/mylib/grdp/plugin/rail"
|
||||
|
||||
"github.com/xxx/wscan/mylib/grdp/plugin/drdynvc"
|
||||
|
||||
"github.com/xxx/wscan/mylib/grdp/core"
|
||||
"github.com/xxx/wscan/mylib/grdp/emission"
|
||||
"github.com/xxx/wscan/mylib/grdp/glog"
|
||||
"github.com/xxx/wscan/mylib/grdp/protocol/t125/ber"
|
||||
"github.com/xxx/wscan/mylib/grdp/protocol/t125/gcc"
|
||||
"github.com/xxx/wscan/mylib/grdp/protocol/t125/per"
|
||||
)
|
||||
|
||||
// take idea from https://github.com/Madnikulin50/gordp
|
||||
|
||||
// Multiple Channel Service layer
|
||||
|
||||
type MCSMessage uint8
|
||||
|
||||
const (
|
||||
MCS_TYPE_CONNECT_INITIAL MCSMessage = 0x65
|
||||
MCS_TYPE_CONNECT_RESPONSE = 0x66
|
||||
)
|
||||
|
||||
type MCSDomainPDU uint16
|
||||
|
||||
const (
|
||||
ERECT_DOMAIN_REQUEST MCSDomainPDU = 1
|
||||
DISCONNECT_PROVIDER_ULTIMATUM = 8
|
||||
ATTACH_USER_REQUEST = 10
|
||||
ATTACH_USER_CONFIRM = 11
|
||||
CHANNEL_JOIN_REQUEST = 14
|
||||
CHANNEL_JOIN_CONFIRM = 15
|
||||
SEND_DATA_REQUEST = 25
|
||||
SEND_DATA_INDICATION = 26
|
||||
)
|
||||
|
||||
const (
|
||||
MCS_GLOBAL_CHANNEL_ID uint16 = 1003
|
||||
MCS_USERCHANNEL_BASE = 1001
|
||||
)
|
||||
|
||||
const (
|
||||
GLOBAL_CHANNEL_NAME = "global"
|
||||
)
|
||||
|
||||
/**
|
||||
* Format MCS PDULayer header packet
|
||||
* @param mcsPdu {integer}
|
||||
* @param options {integer}
|
||||
* @returns {type.UInt8} headers
|
||||
*/
|
||||
func writeMCSPDUHeader(mcsPdu MCSDomainPDU, options uint8, w io.Writer) {
|
||||
core.WriteUInt8((uint8(mcsPdu)<<2)|options, w)
|
||||
}
|
||||
|
||||
func readMCSPDUHeader(options uint8, mcsPdu MCSDomainPDU) bool {
|
||||
return (options >> 2) == uint8(mcsPdu)
|
||||
}
|
||||
|
||||
type DomainParameters struct {
|
||||
MaxChannelIds int
|
||||
MaxUserIds int
|
||||
MaxTokenIds int
|
||||
NumPriorities int
|
||||
MinThoughput int
|
||||
MaxHeight int
|
||||
MaxMCSPDUsize int
|
||||
ProtocolVersion int
|
||||
}
|
||||
|
||||
/**
|
||||
* @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25
|
||||
* @returns {asn1.univ.Sequence}
|
||||
*/
|
||||
func NewDomainParameters(
|
||||
maxChannelIds int,
|
||||
maxUserIds int,
|
||||
maxTokenIds int,
|
||||
numPriorities int,
|
||||
minThoughput int,
|
||||
maxHeight int,
|
||||
maxMCSPDUsize int,
|
||||
protocolVersion int) *DomainParameters {
|
||||
return &DomainParameters{maxChannelIds, maxUserIds, maxTokenIds,
|
||||
numPriorities, minThoughput, maxHeight, maxMCSPDUsize, protocolVersion}
|
||||
}
|
||||
|
||||
func (d *DomainParameters) BER() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
ber.WriteInteger(d.MaxChannelIds, buff)
|
||||
ber.WriteInteger(d.MaxUserIds, buff)
|
||||
ber.WriteInteger(d.MaxTokenIds, buff)
|
||||
ber.WriteInteger(1, buff)
|
||||
ber.WriteInteger(0, buff)
|
||||
ber.WriteInteger(1, buff)
|
||||
ber.WriteInteger(d.MaxMCSPDUsize, buff)
|
||||
ber.WriteInteger(2, buff)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
func ReadDomainParameters(r io.Reader) (*DomainParameters, error) {
|
||||
if !ber.ReadUniversalTag(ber.TAG_SEQUENCE, true, r) {
|
||||
return nil, errors.New("bad BER tags")
|
||||
}
|
||||
d := &DomainParameters{}
|
||||
ber.ReadLength(r)
|
||||
|
||||
d.MaxChannelIds, _ = ber.ReadInteger(r)
|
||||
d.MaxUserIds, _ = ber.ReadInteger(r)
|
||||
d.MaxTokenIds, _ = ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
d.MaxMCSPDUsize, _ = ber.ReadInteger(r)
|
||||
ber.ReadInteger(r)
|
||||
return d, nil
|
||||
}
|
||||
|
||||
/**
|
||||
* @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25
|
||||
* @param userData {Buffer}
|
||||
* @returns {asn1.univ.Sequence}
|
||||
*/
|
||||
type ConnectInitial struct {
|
||||
CallingDomainSelector []byte
|
||||
CalledDomainSelector []byte
|
||||
UpwardFlag bool
|
||||
TargetParameters DomainParameters
|
||||
MinimumParameters DomainParameters
|
||||
MaximumParameters DomainParameters
|
||||
UserData []byte
|
||||
}
|
||||
|
||||
func NewConnectInitial(userData []byte) ConnectInitial {
|
||||
return ConnectInitial{[]byte{0x1},
|
||||
[]byte{0x1},
|
||||
true,
|
||||
*NewDomainParameters(34, 2, 0, 1, 0, 1, 0xffff, 2),
|
||||
*NewDomainParameters(1, 1, 1, 1, 0, 1, 0x420, 2),
|
||||
*NewDomainParameters(0xffff, 0xfc17, 0xffff, 1, 0, 1, 0xffff, 2),
|
||||
userData}
|
||||
}
|
||||
|
||||
func (c *ConnectInitial) BER() []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
ber.WriteOctetstring(string(c.CallingDomainSelector), buff)
|
||||
ber.WriteOctetstring(string(c.CalledDomainSelector), buff)
|
||||
ber.WriteBoolean(c.UpwardFlag, buff)
|
||||
ber.WriteEncodedDomainParams(c.TargetParameters.BER(), buff)
|
||||
ber.WriteEncodedDomainParams(c.MinimumParameters.BER(), buff)
|
||||
ber.WriteEncodedDomainParams(c.MaximumParameters.BER(), buff)
|
||||
ber.WriteOctetstring(string(c.UserData), buff)
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
/**
|
||||
* @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25
|
||||
* @returns {asn1.univ.Sequence}
|
||||
*/
|
||||
|
||||
type ConnectResponse struct {
|
||||
result uint8
|
||||
calledConnectId int
|
||||
domainParameters *DomainParameters
|
||||
userData []byte
|
||||
}
|
||||
|
||||
func NewConnectResponse(userData []byte) *ConnectResponse {
|
||||
return &ConnectResponse{0,
|
||||
0,
|
||||
NewDomainParameters(22, 3, 0, 1, 0, 1, 0xfff8, 2),
|
||||
userData}
|
||||
}
|
||||
|
||||
func ReadConnectResponse(r io.Reader) (*ConnectResponse, error) {
|
||||
c := &ConnectResponse{}
|
||||
var err error
|
||||
_, err = ber.ReadApplicationTag(MCS_TYPE_CONNECT_RESPONSE, r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
c.result, err = ber.ReadEnumerated(r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
c.calledConnectId, err = ber.ReadInteger(r)
|
||||
c.domainParameters, err = ReadDomainParameters(r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !ber.ReadUniversalTag(ber.TAG_OCTET_STRING, false, r) {
|
||||
return nil, errors.New("invalid expected BER tag")
|
||||
}
|
||||
dataLen, _ := ber.ReadLength(r)
|
||||
c.userData, err = core.ReadBytes(dataLen, r)
|
||||
return c, err
|
||||
}
|
||||
|
||||
type MCSChannelInfo struct {
|
||||
ID uint16
|
||||
Name string
|
||||
}
|
||||
|
||||
type MCS struct {
|
||||
emission.Emitter
|
||||
transport core.Transport
|
||||
recvOpCode MCSDomainPDU
|
||||
sendOpCode MCSDomainPDU
|
||||
channels []MCSChannelInfo
|
||||
}
|
||||
|
||||
func NewMCS(t core.Transport, recvOpCode MCSDomainPDU, sendOpCode MCSDomainPDU) *MCS {
|
||||
m := &MCS{
|
||||
*emission.NewEmitter(),
|
||||
t,
|
||||
recvOpCode,
|
||||
sendOpCode,
|
||||
[]MCSChannelInfo{{MCS_GLOBAL_CHANNEL_ID, GLOBAL_CHANNEL_NAME}},
|
||||
}
|
||||
|
||||
m.transport.On("close", func() {
|
||||
m.Emit("close")
|
||||
}).On("error", func(err error) {
|
||||
m.Emit("error", err)
|
||||
})
|
||||
return m
|
||||
}
|
||||
|
||||
func (x *MCS) Read(b []byte) (n int, err error) {
|
||||
return x.transport.Read(b)
|
||||
}
|
||||
|
||||
func (x *MCS) Write(b []byte) (n int, err error) {
|
||||
return x.transport.Write(b)
|
||||
}
|
||||
|
||||
func (m *MCS) Close() error {
|
||||
return m.transport.Close()
|
||||
}
|
||||
|
||||
type MCSClient struct {
|
||||
*MCS
|
||||
clientCoreData *gcc.ClientCoreData
|
||||
clientNetworkData *gcc.ClientNetworkData
|
||||
clientSecurityData *gcc.ClientSecurityData
|
||||
|
||||
serverCoreData *gcc.ServerCoreData
|
||||
serverNetworkData *gcc.ServerNetworkData
|
||||
serverSecurityData *gcc.ServerSecurityData
|
||||
|
||||
channelsConnected int
|
||||
userId uint16
|
||||
nbChannelRequested int
|
||||
}
|
||||
|
||||
func NewMCSClient(t core.Transport) *MCSClient {
|
||||
c := &MCSClient{
|
||||
MCS: NewMCS(t, SEND_DATA_INDICATION, SEND_DATA_REQUEST),
|
||||
clientCoreData: gcc.NewClientCoreData(),
|
||||
clientNetworkData: gcc.NewClientNetworkData(),
|
||||
clientSecurityData: gcc.NewClientSecurityData(),
|
||||
userId: 1 + MCS_USERCHANNEL_BASE,
|
||||
}
|
||||
c.transport.On("connect", c.connect)
|
||||
return c
|
||||
}
|
||||
|
||||
func (c *MCSClient) SetClientDesktop(width, height uint16) {
|
||||
c.clientCoreData.DesktopWidth = width
|
||||
c.clientCoreData.DesktopHeight = height
|
||||
}
|
||||
|
||||
func (c *MCSClient) SetClientDynvcProtocol() {
|
||||
c.clientCoreData.EarlyCapabilityFlags = gcc.RNS_UD_CS_SUPPORT_DYNVC_GFX_PROTOCOL
|
||||
c.clientNetworkData.AddVirtualChannel(drdynvc.ChannelName, drdynvc.ChannelOption)
|
||||
}
|
||||
|
||||
func (c *MCSClient) SetClientRemoteProgram() {
|
||||
c.clientNetworkData.AddVirtualChannel(rail.ChannelName, rail.ChannelOption)
|
||||
}
|
||||
|
||||
func (c *MCSClient) SetClientCliprdr() {
|
||||
//c.clientNetworkData.AddVirtualChannel(cliprdr.ChannelName, cliprdr.ChannelOption)
|
||||
}
|
||||
|
||||
func (c *MCSClient) connect(selectedProtocol uint32) {
|
||||
glog.Debug("mcs client on connect", selectedProtocol)
|
||||
c.clientCoreData.ServerSelectedProtocol = selectedProtocol
|
||||
|
||||
glog.Debugf("clientCoreData:%+v", c.clientCoreData)
|
||||
glog.Debugf("clientNetworkData:%+v", c.clientNetworkData)
|
||||
glog.Debugf("clientSecurityData:%+v", c.clientSecurityData)
|
||||
// sendConnectclientCoreDataInitial
|
||||
userDataBuff := bytes.Buffer{}
|
||||
userDataBuff.Write(c.clientCoreData.Pack())
|
||||
userDataBuff.Write(c.clientNetworkData.Pack())
|
||||
userDataBuff.Write(c.clientSecurityData.Pack())
|
||||
|
||||
ccReq := gcc.MakeConferenceCreateRequest(userDataBuff.Bytes())
|
||||
connectInitial := NewConnectInitial(ccReq)
|
||||
connectInitialBerEncoded := connectInitial.BER()
|
||||
|
||||
dataBuff := &bytes.Buffer{}
|
||||
ber.WriteApplicationTag(uint8(MCS_TYPE_CONNECT_INITIAL), len(connectInitialBerEncoded), dataBuff)
|
||||
dataBuff.Write(connectInitialBerEncoded)
|
||||
|
||||
_, err := c.transport.Write(dataBuff.Bytes())
|
||||
if err != nil {
|
||||
c.Emit("error", errors.New(fmt.Sprintf("mcs sendConnectInitial write error %v", err)))
|
||||
return
|
||||
}
|
||||
glog.Debug("mcs wait for data event")
|
||||
c.transport.Once("data", c.recvConnectResponse)
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvConnectResponse(s []byte) {
|
||||
glog.Trace("mcs recvConnectResponse", hex.EncodeToString(s))
|
||||
cResp, err := ReadConnectResponse(bytes.NewReader(s))
|
||||
if err != nil {
|
||||
c.Emit("error", errors.New(fmt.Sprintf("ReadConnectResponse %v", err)))
|
||||
return
|
||||
}
|
||||
// record server gcc block
|
||||
serverSettings := gcc.ReadConferenceCreateResponse(cResp.userData)
|
||||
for _, v := range serverSettings {
|
||||
switch v.(type) {
|
||||
case *gcc.ServerSecurityData:
|
||||
c.serverSecurityData = v.(*gcc.ServerSecurityData)
|
||||
|
||||
case *gcc.ServerCoreData:
|
||||
c.serverCoreData = v.(*gcc.ServerCoreData)
|
||||
|
||||
case *gcc.ServerNetworkData:
|
||||
c.serverNetworkData = v.(*gcc.ServerNetworkData)
|
||||
|
||||
default:
|
||||
err := errors.New(fmt.Sprintf("unhandle server gcc block %v", reflect.TypeOf(v)))
|
||||
glog.Error(err)
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
}
|
||||
glog.Debugf("serverSecurityData: %+v", c.serverSecurityData)
|
||||
glog.Debugf("serverCoreData: %+v", c.serverCoreData)
|
||||
glog.Debugf("serverNetworkData: %+v", c.serverNetworkData)
|
||||
glog.Debug("mcs sendErectDomainRequest")
|
||||
c.sendErectDomainRequest()
|
||||
|
||||
glog.Debug("mcs sendAttachUserRequest")
|
||||
c.sendAttachUserRequest()
|
||||
|
||||
c.transport.Once("data", c.recvAttachUserConfirm)
|
||||
}
|
||||
|
||||
func (c *MCSClient) sendErectDomainRequest() {
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(ERECT_DOMAIN_REQUEST, 0, buff)
|
||||
per.WriteInteger(0, buff)
|
||||
per.WriteInteger(0, buff)
|
||||
c.transport.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func (c *MCSClient) sendAttachUserRequest() {
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(ATTACH_USER_REQUEST, 0, buff)
|
||||
c.transport.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvAttachUserConfirm(s []byte) {
|
||||
glog.Debug("mcs recvAttachUserConfirm", hex.EncodeToString(s))
|
||||
r := bytes.NewReader(s)
|
||||
|
||||
option, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
|
||||
if !readMCSPDUHeader(option, ATTACH_USER_CONFIRM) {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_BAD_HEADER"))
|
||||
return
|
||||
}
|
||||
|
||||
e, err := per.ReadEnumerates(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
if e != 0 {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER'"))
|
||||
return
|
||||
}
|
||||
|
||||
userId, _ := per.ReadInteger16(r)
|
||||
userId += MCS_USERCHANNEL_BASE
|
||||
c.userId = userId
|
||||
|
||||
c.channels = append(c.channels, MCSChannelInfo{userId, "user"})
|
||||
c.connectChannels()
|
||||
}
|
||||
|
||||
func (c *MCSClient) connectChannels() {
|
||||
glog.Debug("mcs connectChannels:", c.channelsConnected, ":", len(c.channels))
|
||||
if c.channelsConnected == len(c.channels) {
|
||||
if c.nbChannelRequested < int(c.serverNetworkData.ChannelCount) {
|
||||
//static virtual channel
|
||||
chanId := c.serverNetworkData.ChannelIdArray[c.nbChannelRequested]
|
||||
c.nbChannelRequested++
|
||||
c.sendChannelJoinRequest(chanId)
|
||||
c.transport.Once("data", c.recvChannelJoinConfirm)
|
||||
return
|
||||
}
|
||||
c.transport.On("data", c.recvData)
|
||||
// send client and sever gcc informations callback to sec
|
||||
clientData := make([]interface{}, 0)
|
||||
clientData = append(clientData, c.clientCoreData)
|
||||
clientData = append(clientData, c.clientSecurityData)
|
||||
clientData = append(clientData, c.clientNetworkData)
|
||||
|
||||
serverData := make([]interface{}, 0)
|
||||
serverData = append(serverData, c.serverCoreData)
|
||||
serverData = append(serverData, c.serverSecurityData)
|
||||
glog.Debug("msc connectChannels callback to sec")
|
||||
c.Emit("connect", clientData, serverData, c.userId, c.channels)
|
||||
return
|
||||
}
|
||||
|
||||
// sendChannelJoinRequest
|
||||
glog.Debug("sendChannelJoinRequest:", c.channels[c.channelsConnected].Name)
|
||||
c.sendChannelJoinRequest(c.channels[c.channelsConnected].ID)
|
||||
|
||||
c.transport.Once("data", c.recvChannelJoinConfirm)
|
||||
}
|
||||
|
||||
func (c *MCSClient) sendChannelJoinRequest(channelId uint16) {
|
||||
glog.Debug("mcs sendChannelJoinRequest", channelId)
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(CHANNEL_JOIN_REQUEST, 0, buff)
|
||||
per.WriteInteger16(c.userId-MCS_USERCHANNEL_BASE, buff)
|
||||
per.WriteInteger16(channelId, buff)
|
||||
c.transport.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvData(s []byte) {
|
||||
glog.Trace("msc on data recvData:", hex.EncodeToString(s))
|
||||
|
||||
r := bytes.NewReader(s)
|
||||
option, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
|
||||
if readMCSPDUHeader(option, DISCONNECT_PROVIDER_ULTIMATUM) {
|
||||
c.Emit("error", errors.New("MCS DISCONNECT_PROVIDER_ULTIMATUM"))
|
||||
c.transport.Close()
|
||||
return
|
||||
} else if !readMCSPDUHeader(option, c.recvOpCode) {
|
||||
c.Emit("error", errors.New("Invalid expected MCS opcode receive data"))
|
||||
return
|
||||
}
|
||||
|
||||
userId, _ := per.ReadInteger16(r)
|
||||
userId += MCS_USERCHANNEL_BASE
|
||||
|
||||
channelId, _ := per.ReadInteger16(r)
|
||||
per.ReadEnumerates(r)
|
||||
size, _ := per.ReadLength(r)
|
||||
// channel ID doesn't match a requested layer
|
||||
found := false
|
||||
channelName := ""
|
||||
for _, channel := range c.channels {
|
||||
if channel.ID == channelId {
|
||||
found = true
|
||||
channelName = channel.Name
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
glog.Error("mcs receive data for an unconnected layer")
|
||||
return
|
||||
}
|
||||
left, err := core.ReadBytes(int(size), r)
|
||||
if err != nil {
|
||||
c.Emit("error", errors.New(fmt.Sprintf("mcs recvData get data error %v", err)))
|
||||
return
|
||||
}
|
||||
glog.Debugf("mcs emit channel<%s>", channelName)
|
||||
c.Emit("sec", channelName, left)
|
||||
}
|
||||
|
||||
func (c *MCSClient) recvChannelJoinConfirm(s []byte) {
|
||||
glog.Debug("mcs recvChannelJoinConfirm", hex.EncodeToString(s))
|
||||
r := bytes.NewReader(s)
|
||||
option, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
c.Emit("error", err)
|
||||
return
|
||||
}
|
||||
|
||||
if !readMCSPDUHeader(option, CHANNEL_JOIN_CONFIRM) {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_WAIT_CHANNEL_JOIN_CONFIRM"))
|
||||
return
|
||||
}
|
||||
|
||||
confirm, _ := per.ReadEnumerates(r)
|
||||
userId, _ := per.ReadInteger16(r)
|
||||
userId += MCS_USERCHANNEL_BASE
|
||||
|
||||
if c.userId != userId {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_INVALID_USER_ID"))
|
||||
return
|
||||
}
|
||||
|
||||
channelId, _ := per.ReadInteger16(r)
|
||||
if (confirm != 0) && (channelId == uint16(MCS_GLOBAL_CHANNEL_ID) || channelId == c.userId) {
|
||||
c.Emit("error", errors.New("NODE_RDP_PROTOCOL_T125_MCS_SERVER_MUST_CONFIRM_STATIC_CHANNEL"))
|
||||
return
|
||||
}
|
||||
glog.Debug("Confirm channelId:", channelId)
|
||||
if confirm == 0 {
|
||||
for i := 0; i < int(c.serverNetworkData.ChannelCount); i++ {
|
||||
if channelId == c.serverNetworkData.ChannelIdArray[i] {
|
||||
var t MCSChannelInfo
|
||||
t.ID = channelId
|
||||
t.Name = string(c.clientNetworkData.ChannelDefArray[i].Name[:])
|
||||
c.channels = append(c.channels, t)
|
||||
}
|
||||
}
|
||||
}
|
||||
c.channelsConnected++
|
||||
c.connectChannels()
|
||||
}
|
||||
|
||||
func (c *MCSClient) Pack(data []byte, channelId uint16) []byte {
|
||||
buff := &bytes.Buffer{}
|
||||
writeMCSPDUHeader(c.sendOpCode, 0, buff)
|
||||
per.WriteInteger16(c.userId-MCS_USERCHANNEL_BASE, buff)
|
||||
per.WriteInteger16(channelId, buff)
|
||||
core.WriteUInt8(0x70, buff)
|
||||
per.WriteLength(len(data), buff)
|
||||
core.WriteBytes(data, buff)
|
||||
glog.Trace("MCSClient write", channelId, ":", hex.EncodeToString(buff.Bytes()))
|
||||
return buff.Bytes()
|
||||
}
|
||||
|
||||
func (c *MCSClient) Write(data []byte) (n int, err error) {
|
||||
data = c.Pack(data, c.channels[0].ID)
|
||||
return c.transport.Write(data)
|
||||
}
|
||||
|
||||
func (c *MCSClient) SendToChannel(channel string, data []byte) (n int, err error) {
|
||||
channelId := c.channels[0].ID
|
||||
for _, ch := range c.channels {
|
||||
if channel == ch.Name {
|
||||
channelId = ch.ID
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
data = c.Pack(data, channelId)
|
||||
return c.transport.Write(data)
|
||||
}
|
||||
@@ -0,0 +1,203 @@
|
||||
package per
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io"
|
||||
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/glog"
|
||||
|
||||
"github.com/shadow1ng/fscan/mylib/grdp/core"
|
||||
)
|
||||
|
||||
func ReadEnumerates(r io.Reader) (uint8, error) {
|
||||
return core.ReadUInt8(r)
|
||||
}
|
||||
|
||||
func WriteInteger(n int, w io.Writer) {
|
||||
if n <= 0xff {
|
||||
WriteLength(1, w)
|
||||
core.WriteUInt8(uint8(n), w)
|
||||
} else if n <= 0xffff {
|
||||
WriteLength(2, w)
|
||||
core.WriteUInt16BE(uint16(n), w)
|
||||
} else {
|
||||
WriteLength(4, w)
|
||||
core.WriteUInt32BE(uint32(n), w)
|
||||
}
|
||||
}
|
||||
|
||||
func ReadInteger16(r io.Reader) (uint16, error) {
|
||||
return core.ReadUint16BE(r)
|
||||
}
|
||||
|
||||
func WriteInteger16(value uint16, w io.Writer) {
|
||||
core.WriteUInt16BE(value, w)
|
||||
}
|
||||
|
||||
/**
|
||||
* @param choice {integer}
|
||||
* @returns {type.UInt8} choice per encoded
|
||||
*/
|
||||
func WriteChoice(choice uint8, w io.Writer) {
|
||||
core.WriteUInt8(choice, w)
|
||||
}
|
||||
|
||||
/**
|
||||
* @param value {raw} value to convert to per format
|
||||
* @returns type objects per encoding value
|
||||
*/
|
||||
func WriteLength(value int, w io.Writer) {
|
||||
if value > 0x7f {
|
||||
core.WriteUInt16BE(uint16(value|0x8000), w)
|
||||
} else {
|
||||
core.WriteUInt8(uint8(value), w)
|
||||
}
|
||||
}
|
||||
|
||||
func ReadLength(r io.Reader) (uint16, error) {
|
||||
b, err := core.ReadUInt8(r)
|
||||
if err != nil {
|
||||
return 0, nil
|
||||
}
|
||||
var size uint16
|
||||
if b&0x80 > 0 {
|
||||
b = b &^ 0x80
|
||||
size = uint16(b) << 8
|
||||
left, _ := core.ReadUInt8(r)
|
||||
size += uint16(left)
|
||||
} else {
|
||||
size = uint16(b)
|
||||
}
|
||||
return size, nil
|
||||
}
|
||||
|
||||
/**
|
||||
* @param oid {array} oid to write
|
||||
* @returns {type.Component} per encoded object identifier
|
||||
*/
|
||||
func WriteObjectIdentifier(oid []byte, w io.Writer) {
|
||||
core.WriteUInt8(5, w)
|
||||
core.WriteByte((oid[0]<<4)&(oid[1]&0x0f), w)
|
||||
core.WriteByte(oid[2], w)
|
||||
core.WriteByte(oid[3], w)
|
||||
core.WriteByte(oid[4], w)
|
||||
core.WriteByte(oid[5], w)
|
||||
}
|
||||
|
||||
/**
|
||||
* @param selection {integer}
|
||||
* @returns {type.UInt8} per encoded selection
|
||||
*/
|
||||
func WriteSelection(selection uint8, w io.Writer) {
|
||||
core.WriteUInt8(selection, w)
|
||||
}
|
||||
|
||||
func WriteNumericString(s string, minValue int, w io.Writer) {
|
||||
length := len(s)
|
||||
mLength := minValue
|
||||
if length >= minValue {
|
||||
mLength = length - minValue
|
||||
}
|
||||
buff := &bytes.Buffer{}
|
||||
for i := 0; i < length; i += 2 {
|
||||
c1 := int(s[i])
|
||||
c2 := 0x30
|
||||
if i+1 < length {
|
||||
c2 = int(s[i+1])
|
||||
}
|
||||
c1 = (c1 - 0x30) % 10
|
||||
c2 = (c2 - 0x30) % 10
|
||||
core.WriteUInt8(uint8((c1<<4)|c2), buff)
|
||||
}
|
||||
WriteLength(mLength, w)
|
||||
w.Write(buff.Bytes())
|
||||
}
|
||||
|
||||
func WritePadding(length int, w io.Writer) {
|
||||
b := make([]byte, length)
|
||||
w.Write(b)
|
||||
}
|
||||
|
||||
func WriteNumberOfSet(n int, w io.Writer) {
|
||||
core.WriteUInt8(uint8(n), w)
|
||||
}
|
||||
|
||||
/**
|
||||
* @param oStr {String}
|
||||
* @param minValue {integer} default 0
|
||||
* @returns {type.Component} per encoded octet stream
|
||||
*/
|
||||
func WriteOctetStream(oStr string, minValue int, w io.Writer) {
|
||||
length := len(oStr)
|
||||
mlength := minValue
|
||||
|
||||
if length-minValue >= 0 {
|
||||
mlength = length - minValue
|
||||
}
|
||||
WriteLength(mlength, w)
|
||||
w.Write([]byte(oStr)[:length])
|
||||
}
|
||||
|
||||
func ReadChoice(r io.Reader) uint8 {
|
||||
choice, _ := core.ReadUInt8(r)
|
||||
return choice
|
||||
}
|
||||
func ReadNumberOfSet(r io.Reader) uint8 {
|
||||
choice, _ := core.ReadUInt8(r)
|
||||
return choice
|
||||
}
|
||||
func ReadInteger(r io.Reader) uint32 {
|
||||
size, _ := ReadLength(r)
|
||||
switch size {
|
||||
case 1:
|
||||
ret, _ := core.ReadUInt8(r)
|
||||
return uint32(ret)
|
||||
case 2:
|
||||
ret, _ := core.ReadUint16BE(r)
|
||||
return uint32(ret)
|
||||
case 4:
|
||||
ret, _ := core.ReadUInt32BE(r)
|
||||
return ret
|
||||
default:
|
||||
glog.Info("ReadInteger")
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func ReadObjectIdentifier(r io.Reader, oid []byte) bool {
|
||||
size, _ := ReadLength(r)
|
||||
if size != 5 {
|
||||
return false
|
||||
}
|
||||
|
||||
a_oid := []byte{0, 0, 0, 0, 0, 0}
|
||||
t12, _ := core.ReadByte(r)
|
||||
a_oid[0] = t12 >> 4
|
||||
a_oid[1] = t12 & 0x0f
|
||||
a_oid[2], _ = core.ReadByte(r)
|
||||
a_oid[3], _ = core.ReadByte(r)
|
||||
a_oid[4], _ = core.ReadByte(r)
|
||||
a_oid[5], _ = core.ReadByte(r)
|
||||
|
||||
for i, _ := range oid {
|
||||
if oid[i] != a_oid[i] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
func ReadOctetStream(r io.Reader, s string, min int) bool {
|
||||
ln, _ := ReadLength(r)
|
||||
size := int(ln) + min
|
||||
if size != len(s) {
|
||||
return false
|
||||
}
|
||||
for i := 0; i < size; i++ {
|
||||
b, _ := core.ReadByte(r)
|
||||
if b != s[i] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
Reference in New Issue
Block a user