feat(smbserver): add SMB 3.1.1 support with pre-auth integrity hash and KBKDF signing

Author: n3rada

impacket/smbserver.py

@@ -51,7 +51,8 @@
 from pyasn1.codec.der import encoder, decoder
 
 # For signing
-from impacket import smb, nmb, ntlm, uuid
+from Cryptodome.Hash import SHA512
+from impacket import smb, nmb, ntlm, uuid, crypto
 from impacket import smb3structs as smb2
 from impacket.spnego import SPNEGO_NegTokenInit, TypesMech, MechTypes, SPNEGO_NegTokenResp, ASN1_AID, \
     ASN1_SUPPORTED_MECH
@@ -72,6 +73,42 @@
 STATUS_SMB_BAD_UID = 0x005B0002
 STATUS_SMB_BAD_TID = 0x00050002
 
+_SUPPORTED_DIALECTS = (smb2.SMB2_DIALECT_311, smb2.SMB2_DIALECT_21, smb2.SMB2_DIALECT_002)
+_PREAUTH_HASH_ZERO = b'\x00' * 64
+
+
+def _preauth_hash_update(current: bytes, data: bytes) -> bytes:
+    """SHA-512(current || data), one step of the SMB 3.1.1 pre-auth integrity hash chain.
+
+    MS-SMB2 §3.3.5.4 (negotiate) and §3.3.5.5.3 (session setup) describe how the server
+    iteratively hashes request and response bytes into the connection/session pre-auth value:
+    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/b39f253e-4963-40df-8dff-2f9040ebbeb1
+    """
+    h = SHA512.new()
+    h.update(current)
+    h.update(data)
+    return h.digest()
+
+
+def _build_smb311_preauth_context() -> bytes:
+    """Build a serialised SMB2_PREAUTH_INTEGRITY_CAPABILITIES negotiate context (SHA-512, no salt).
+
+    MS-SMB2 §2.2.3.1.1, SMB2_PREAUTH_INTEGRITY_CAPABILITIES structure definition:
+    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5a07bd66-4734-4af8-abcf-5a44ff7ee0e5
+    """
+    preauth = smb2.SMB2PreAuthIntegrityCapabilities()
+    preauth['HashAlgorithmCount'] = 1
+    preauth['SaltLength'] = 0
+    preauth['HashAlgorithms'] = struct.pack('<H', 0x0001)
+    preauth['Salt'] = b''
+    ctx = smb2.SMB2NegotiateContext()
+    ctx['ContextType'] = smb2.SMB2_PREAUTH_INTEGRITY_CAPABILITIES
+    ctx_data = preauth.getData()
+    ctx['DataLength'] = len(ctx_data)
+    ctx['Reserved'] = 0
+    ctx['Data'] = ctx_data
+    return ctx.getData()
+
 
 # Utility functions
 # and general functions.
@@ -2834,7 +2871,7 @@ def default(connId, smbServer, SMBCommand, recvPacket):
 
 class SMB2Commands:
     @staticmethod
-    def smb2Negotiate(connId, smbServer, recvPacket, isSMB1=False):
+    def smbNegotiate(connId, smbServer, recvPacket, isSMB1=False):
         connData = smbServer.getConnectionData(connId, checkStatus=False)
 
         respPacket = smb2.SMB2Packet()
@@ -2857,13 +2894,21 @@ def smb2Negotiate(connId, smbServer, recvPacket, isSMB1=False):
             SMBCommand = smb.SMBCommand(recvPacket['Data'][0])
 
             dialects = SMBCommand['Data'].split(b'\x02')
-            if b'SMB 2.002\x00' in dialects or b'SMB 2.???\x00' in dialects:
+            if b'SMB 2.???\x00' in dialects:
+                respSMBCommand['DialectRevision'] = smb2.SMB2_DIALECT_WILDCARD
+                connData['Dialect'] = smb2.SMB2_DIALECT_WILDCARD
+            elif b'SMB 2.002\x00' in dialects:
                 respSMBCommand['DialectRevision'] = smb2.SMB2_DIALECT_002
+                connData['Dialect'] = smb2.SMB2_DIALECT_002
             else:
-                # Client does not support SMB2 fallbacking
                 raise Exception('SMB2 not supported, fallbacking')
         else:
-            respSMBCommand['DialectRevision'] = smb2.SMB2_DIALECT_002
+            negRequest = smb2.SMB2Negotiate(recvPacket['Data'])
+            offered = set(negRequest['Dialects'])
+            selected = next((d for d in _SUPPORTED_DIALECTS if d in offered), smb2.SMB2_DIALECT_002)
+            respSMBCommand['DialectRevision'] = selected
+            connData['Dialect'] = selected
+
         respSMBCommand['ServerGuid'] = b'A' * 16
         respSMBCommand['Capabilities'] = 0
         respSMBCommand['MaxTransactSize'] = 65536
@@ -2886,12 +2931,40 @@ def smb2Negotiate(connId, smbServer, recvPacket, isSMB1=False):
         respSMBCommand['Buffer'] = blob.getData()
         respSMBCommand['SecurityBufferLength'] = len(respSMBCommand['Buffer'])
 
-        respPacket['Data'] = respSMBCommand
+        if connData.get('Dialect') == smb2.SMB2_DIALECT_311:
+            SMB2Commands._smb311_negotiate(connData, recvPacket, respSMBCommand, respPacket)
+        else:
+            respPacket['Data'] = respSMBCommand
 
         smbServer.setConnectionData(connId, connData)
 
         return None, [respPacket], STATUS_SUCCESS
 
+    @staticmethod
+    def _smb311_negotiate(connData: dict, recvPacket, respSMBCommand, respPacket) -> None:
+        """Handle SMB 3.1.1 negotiate: initialise pre-auth hash chain and append mandatory negotiate context.
+
+        MS-SMB2 §3.3.5.4, Receiving an SMB2 NEGOTIATE Request (3.1.1 NegotiateContextList processing is inline):
+        https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/b39f253e-4963-40df-8dff-2f9040ebbeb1
+        """
+        connData['PreauthIntegrityHashValue'] = _preauth_hash_update(
+            _PREAUTH_HASH_ZERO, recvPacket.rawData)
+
+        # Encryption context omitted intentionally: advertising it would cause the client to enable
+        # session encryption, which this server does not implement.
+        ctx_bytes = _build_smb311_preauth_context()
+        sec_buf_len = len(respSMBCommand['Buffer'])
+        ctx_pad = (8 - sec_buf_len % 8) % 8
+        respSMBCommand['NegotiateContextCount'] = 1
+        respSMBCommand['NegotiateContextOffset'] = 0x80 + sec_buf_len + ctx_pad
+        respSMBCommand['Padding'] = b'\x00' * ctx_pad
+        respSMBCommand['NegotiateContextList'] = ctx_bytes
+
+        respPacket['Data'] = respSMBCommand
+
+        connData['PreauthIntegrityHashValue'] = _preauth_hash_update(
+            connData['PreauthIntegrityHashValue'], respPacket.getData())
+
     @staticmethod
     def _kerberos_auth(token, connData, smbServer):
         try:
@@ -3247,12 +3320,54 @@ def smb2SessionSetup(connId, smbServer, recvPacket):
         else:
             smbServer.log("Unknown or unsupported security blob type", logging.ERROR, connData=connData)
             return [SMB2Commands.generic_negTokenResp()], None, STATUS_MORE_PROCESSING_REQUIRED
-        
+
+        is_311 = (connData.get('Dialect') == smb2.SMB2_DIALECT_311)
+
+        if is_311:
+            # MS-SMB2 §3.3.5.5.3, Handling GSS-API Authentication:
+            # the session pre-auth hash is forked from the connection hash at the first
+            # SESSION_SETUP round and updated with each request/response pair.
+            # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5ed93f06-a1d2-4837-8954-fa8b833c2654
+            is_ntlm_round1 = (token[:8] == b'NTLMSSP\x00' and len(token) >= 12
+                              and struct.unpack('<L', token[8:12])[0] == 0x01)
+            if is_ntlm_round1 or 'SessionPreauthIntegrityHashValue' not in connData:
+                connData['SessionPreauthIntegrityHashValue'] = connData.get('PreauthIntegrityHashValue', _PREAUTH_HASH_ZERO)
+            connData['SessionPreauthIntegrityHashValue'] = _preauth_hash_update(
+                connData['SessionPreauthIntegrityHashValue'], recvPacket.rawData)
+
         if authType in [TypesMech['MS KRB5 - Microsoft Kerberos 5'], TypesMech['KRB5 - Kerberos 5'], TypesMech['KRB5 - Kerberos 5 - User to User']]:
             respSMBCommand, errorCode = SMB2Commands._kerberos_auth(token, connData, smbServer)
         elif authType == TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']:
             respSMBCommand, errorCode = SMB2Commands._ntlm_auth(token, connData, smbServer, rawNTLM)
 
+        if is_311:
+            if errorCode == STATUS_MORE_PROCESSING_REQUIRED:
+                resp_pkt = smb2.SMB2Packet()
+                resp_pkt['Flags'] = smb2.SMB2_FLAGS_SERVER_TO_REDIR
+                resp_pkt['Status'] = errorCode
+                resp_pkt['CreditRequestResponse'] = recvPacket['CreditRequestResponse']
+                resp_pkt['Command'] = recvPacket['Command']
+                resp_pkt['CreditCharge'] = recvPacket['CreditCharge']
+                resp_pkt['Reserved'] = recvPacket['Reserved']
+                resp_pkt['SessionID'] = connData['Uid']
+                resp_pkt['MessageID'] = recvPacket['MessageID']
+                resp_pkt['TreeID'] = recvPacket['TreeID']
+                resp_pkt['Data'] = respSMBCommand.getData()
+                connData['SessionPreauthIntegrityHashValue'] = _preauth_hash_update(
+                    connData['SessionPreauthIntegrityHashValue'], resp_pkt.getData())
+            elif errorCode == STATUS_SUCCESS:
+                # Derive the SMB 3.1.1 signing key via SP 800-108 counter-mode KBKDF.
+                # Label=b"SMBSigningKey\x00", Context=SessionPreauthIntegrityHashValue, L=128 bits.
+                # MS-SMB2 §3.1.4.2, Generating Cryptographic Keys:
+                # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/da4e579e-02ce-4e27-bbce-3fc816a3ff92
+                # NIST SP 800-108r1, KDF in Counter Mode (referenced from §3.1.4.2 as [SP800-108]):
+                # https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
+                session_key = connData.get('SigningSessionKey', b'')
+                if session_key:
+                    connData['SigningSessionKey'] = crypto.KDF_CounterMode(
+                        session_key, b'SMBSigningKey\x00',
+                        connData['SessionPreauthIntegrityHashValue'], 128)
+
         # From now on, the client can ask for other commands
         connData['Authenticated'] = True
         # For now, just switching to nobody
@@ -3324,7 +3439,10 @@ def smb2TreeConnect(connId, smbServer, recvPacket):
 
         # Sign the packet if needed
         if connData['SignatureEnabled']:
-            smbServer.signSMBv2(respPacket, connData['SigningSessionKey'])
+            if connData.get('Dialect', smb2.SMB2_DIALECT_002) >= smb2.SMB2_DIALECT_30:
+                smbServer.signSMBv3(respPacket, connData['SigningSessionKey'])
+            else:
+                smbServer.signSMBv2(respPacket, connData['SigningSessionKey'])
         smbServer.setConnectionData(connId, connData)
 
         return None, [respPacket], errorCode
@@ -4143,7 +4261,7 @@ def fsctlValidateNegotiateInfo(connId, smbServer, ioctlRequest):
         validateNegotiateInfoResponse['Capabilities'] = 0
         validateNegotiateInfoResponse['Guid'] = b'A' * 16
         validateNegotiateInfoResponse['SecurityMode'] = 1
-        validateNegotiateInfoResponse['Dialect'] = smb2.SMB2_DIALECT_002
+        validateNegotiateInfoResponse['Dialect'] = connData.get('Dialect', smb2.SMB2_DIALECT_002)
 
         smbServer.setConnectionData(connId, connData)
         return validateNegotiateInfoResponse.getData(), errorCode
@@ -4350,7 +4468,7 @@ def __init__(self, server_address, handler_class=SMBSERVERHandler, config_parser
         }
 
         self.__smb2Commands = {
-            smb2.SMB2_NEGOTIATE: self.__smb2CommandsHandler.smb2Negotiate,
+            smb2.SMB2_NEGOTIATE: self.__smb2CommandsHandler.smbNegotiate,
             smb2.SMB2_SESSION_SETUP: self.__smb2CommandsHandler.smb2SessionSetup,
             smb2.SMB2_LOGOFF: self.__smb2CommandsHandler.smb2Logoff,
             smb2.SMB2_TREE_CONNECT: self.__smb2CommandsHandler.smb2TreeConnect,
@@ -4659,7 +4777,18 @@ def signSMBv2(self, packet, signingSessionKey, padLength=0):
         packetData = packet.getData() + b'\x00' * padLength
         signature = hmac.new(signingSessionKey, packetData, hashlib.sha256).digest()
         packet['Signature'] = signature[:16]
-        # print "%s" % packet['Signature'].encode('hex')
+
+    def signSMBv3(self, packet, signingKey, padLength=0):
+        """Sign an SMB 3.x packet with AES-CMAC using the derived signing key.
+
+        MS-SMB2 §3.1.4.1, Signing an Outgoing Message (SMB 3.x uses AES-CMAC per RFC 4493):
+        https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/a3e9ea1e-53c8-4cff-94bd-d98fb20417c0
+        """
+        packet['Signature'] = b'\x00' * 16
+        packet['Flags'] |= smb2.SMB2_FLAGS_SIGNED
+        packetData = packet.getData() + b'\x00' * padLength
+        signature = crypto.AES_CMAC(signingKey, packetData, len(packetData))
+        packet['Signature'] = signature[:16]
 
     def processRequest(self, connId, data):
 
@@ -4890,7 +5019,10 @@ def processRequest(self, connId, data):
                     packet['NextCommand'] = len(packet) + padLen
 
                 if connData['SignatureEnabled']:
-                    self.signSMBv2(packet, connData['SigningSessionKey'], padLength=padLen)
+                    if connData.get('Dialect', smb2.SMB2_DIALECT_002) >= smb2.SMB2_DIALECT_30:
+                        self.signSMBv3(packet, connData['SigningSessionKey'], padLength=padLen)
+                    else:
+                        self.signSMBv2(packet, connData['SigningSessionKey'], padLength=padLen)
 
                 if hasattr(packet, 'getData'):
                     finalData.append(packet.getData() + padLen * b'\x00')