new: replaced pavao with pure rust smb crate (fixes #78)

Author: evilsocket

Cargo.lock

@@ -83,7 +83,7 @@ rdp-rs = { version = "0.1.0", optional = true }
 scylla = { version = "0.10.1", optional = true }
 paho-mqtt = { version = "0.13.3", optional = true }
 csv = "1.3.0"
-pavao = { version = "0.2.12", optional = true }
+smb = { version = "0.8.2", optional = true }
 fast-socks5 = { version = "0.9.2", optional = true }
 shell-words = "1.1.0"
 serde_yaml = "0.9.30"
@@ -158,7 +158,7 @@ amqp = []
 redis = []
 scylla = ["dep:scylla"]
 port_scanner = ["dep:reqwest"]
-samba = ["dep:pavao"]
+samba = ["dep:smb"]
 socks5 = ["dep:fast-socks5"]
 
 # used to build for platforms without openssl

Cargo.toml

@@ -5,5 +5,5 @@ zig = false
 default-target = "x86_64-unknown-linux-gnu"
 pre-build = [
     "dpkg --add-architecture $CROSS_DEB_ARCH",
-    "apt-get update && apt-get --assume-yes install pkg-config:$CROSS_DEB_ARCH libssl-dev:$CROSS_DEB_ARCH libsmbclient-dev:$CROSS_DEB_ARCH cmake git",
+    "apt-get update && apt-get --assume-yes install pkg-config:$CROSS_DEB_ARCH libssl-dev:$CROSS_DEB_ARCH cmake git",
 ]

Cross.toml

@@ -1,12 +1,12 @@
 FROM rust:bullseye AS builder
 
-RUN apt-get update && apt-get install -y libsmbclient-dev libssl-dev ca-certificates cmake git
+RUN apt-get update && apt-get install -y libssl-dev ca-certificates cmake git
 
 WORKDIR /app
 ADD . /app
 RUN cargo build --release
 
 FROM debian:bullseye
-RUN apt-get update && apt-get install -y libsmbclient libssl-dev ca-certificates
+RUN apt-get update && apt-get install -y libssl-dev ca-certificates
 COPY --from=builder /app/target/release/legba /usr/bin/legba
 ENTRYPOINT ["/usr/bin/legba"]

Dockerfile

@@ -32,17 +32,21 @@ fn setup() -> Result<Options, session::Error> {
         unsafe {
             env::set_var(
                 "RUST_LOG",
-                "info,blocking=off,pavao=off,fast_socks5=off,actix_server=warn,rmcp=warn",
+                "info,blocking=off,pavao=off,fast_socks5=off,actix_server=warn,rmcp=warn,smb=warn,sspi=off",
             );
         }
     }
 
-    env_logger::builder()
-        .format_module_path(false)
-        .format_target(false)
-        .format_timestamp(None)
-        .target(Target::Stdout)
-        .init();
+    if env::var_os("RUST_LOG") == Some("debug".into()) {
+        env_logger::builder().target(Target::Stdout).init();
+    } else {
+        env_logger::builder()
+            .format_module_path(false)
+            .format_target(false)
+            .format_timestamp(None)
+            .target(Target::Stdout)
+            .init();
+    }
 
     let mut options: Options = Options::parse();
 

src/main.rs

@@ -1,4 +1,4 @@
-use clap::{parser::ValueSource, ArgMatches, CommandFactory as _, Parser};
+use clap::{ArgMatches, CommandFactory as _, Parser, parser::ValueSource};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
@@ -118,9 +118,6 @@ pub(crate) struct Options {
     #[cfg(feature = "telnet")]
     #[clap(flatten, next_help_heading = "TELNET")]
     pub telnet: crate::plugins::telnet::options::Options,
-    #[cfg(feature = "samba")]
-    #[clap(flatten, next_help_heading = "SAMBA (SMB)")]
-    pub smb: crate::plugins::samba::options::Options,
     #[cfg(feature = "ssh")]
     #[clap(flatten, next_help_heading = "SSH")]
     pub ssh: crate::plugins::ssh::options::Options,
@@ -159,9 +156,11 @@ pub(crate) struct Options {
     pub irc: crate::plugins::irc::options::Options,
 }
 
-
-
-fn update_field_by_name(options: &mut Options, field_name: &str, matches: &ArgMatches) -> Result<(), Box<dyn std::error::Error>> {
+fn update_field_by_name(
+    options: &mut Options,
+    field_name: &str,
+    matches: &ArgMatches,
+) -> Result<(), Box<dyn std::error::Error>> {
     // Serialize current options to JSON
     let mut options_value: Value = serde_json::to_value(&options)?;
 
@@ -194,12 +193,21 @@ fn update_field_by_name(options: &mut Options, field_name: &str, matches: &ArgMa
                         return Err(format!("Missing value for field: {:?}", &field_name).into());
                     }
                 }
-                _ => return Err(format!("Unknown or unsupported type for field: {:?} (current_value={:?})", &field_name, &current_value).into())
+                _ => {
+                    return Err(format!(
+                        "Unknown or unsupported type for field: {:?} (current_value={:?})",
+                        &field_name, &current_value
+                    )
+                    .into());
+                }
             }
         }
-    
     } else {
-        return Err(format!("Invalid options structure: expected JSON object for field: {:?}", &field_name).into());
+        return Err(format!(
+            "Invalid options structure: expected JSON object for field: {:?}",
+            &field_name
+        )
+        .into());
     }
 
     // Deserialize back to Options
@@ -208,18 +216,26 @@ fn update_field_by_name(options: &mut Options, field_name: &str, matches: &ArgMa
     Ok(())
 }
 
-pub(crate) fn update_selectively(options: &mut Options, argv: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+pub(crate) fn update_selectively(
+    options: &mut Options,
+    argv: &[String],
+) -> Result<(), Box<dyn std::error::Error>> {
     let cmd = Options::command();
     let matches = cmd.clone().try_get_matches_from(argv)?;
-    
+
     // Update only the fields that were explicitly provided
     for arg in cmd.get_arguments() {
         let id = arg.get_id().as_str();
-        if matches.contains_id(id) && 
-           matches.value_source(id) == Some(ValueSource::CommandLine) && id != "plugin" && id != "P" && id != "R" && id != "recipe" {
+        if matches.contains_id(id)
+            && matches.value_source(id) == Some(ValueSource::CommandLine)
+            && id != "plugin"
+            && id != "P"
+            && id != "R"
+            && id != "recipe"
+        {
             update_field_by_name(options, id, &matches)?;
         }
     }
-    
+
     Ok(())
 }

src/options.rs

@@ -1,105 +1,22 @@
-use std::collections::HashMap;
-use std::sync::LazyLock;
 use std::time::Duration;
 
 use async_trait::async_trait;
-use pavao::{SmbClient, SmbCredentials, SmbDirentType, SmbOptions};
-use tokio::sync::Mutex;
 
+use crate::Plugin;
 use crate::creds::Credentials;
 use crate::session::{Error, Loot};
-use crate::Plugin;
-use crate::{utils, Options};
-
-pub(crate) mod options;
-
-static SHARE_CACHE: LazyLock<Mutex<HashMap<String, String>>> =
-    LazyLock::new(|| Mutex::new(HashMap::new()));
-static PAVAO_LOCK: Mutex<()> = Mutex::const_new(());
+use crate::{Options, utils};
 
 super::manager::register_plugin! {
     "smb" => SMB::new()
 }
 
 #[derive(Clone)]
-pub(crate) struct SMB {
-    share: Option<String>,
-    workgroup: String,
-}
+pub(crate) struct SMB {}
 
 impl SMB {
     pub fn new() -> Self {
-        SMB {
-            share: None,
-            workgroup: String::default(),
-        }
-    }
-
-    fn get_samba_client(
-        &self,
-        server: &str,
-        workgroup: &str,
-        share: &str,
-        username: &str,
-        password: &str,
-    ) -> Result<SmbClient, Error> {
-        SmbClient::new(
-            SmbCredentials::default()
-                .server(server)
-                .share(share)
-                .username(username)
-                .password(password)
-                .workgroup(workgroup),
-            SmbOptions::default()
-                .no_auto_anonymous_login(false)
-                .one_share_per_server(true),
-        )
-        .map_err(|e| format!("error creating client for {}: {}", share, e))
-    }
-
-    async fn get_share_for(&self, target: &str) -> Result<String, Error> {
-        if let Some(share) = self.share.as_ref() {
-            // return from arguments
-            return Ok(share.clone());
-        }
-
-        let mut guard = SHARE_CACHE.lock().await;
-        if let Some(share) = guard.get(target) {
-            // return from cache
-            return Ok(share.clone());
-        }
-
-        // get from listing
-        log::info!("searching private share for {} ...", target);
-
-        let server = format!("smb://{}", target);
-        let root_cli = self.get_samba_client(&server, &self.workgroup, "", "", "")?;
-
-        if let Ok(entries) = root_cli.list_dir("") {
-            for entry in entries {
-                match entry.get_type() {
-                    SmbDirentType::FileShare | SmbDirentType::Dir => {
-                        let share = format!("/{}", entry.name());
-                        // if share is private we expect an error
-                        let sub_cli =
-                            self.get_samba_client(&server, &self.workgroup, &share, "", "")?;
-                        let listing = sub_cli.list_dir("");
-                        if listing.is_err() {
-                            log::info!("{}{} found", &server, &share);
-                            // found a private share, update the cache and return.
-                            guard.insert(target.to_owned(), share.clone());
-                            return Ok(share);
-                        }
-                    }
-                    _ => {}
-                }
-            }
-        }
-
-        Err(format!(
-            "could not find private share for {}, provide one with --smb-share",
-            target
-        ))
+        SMB {}
     }
 }
 
@@ -109,9 +26,7 @@ impl Plugin for SMB {
         "Samba password authentication."
     }
 
-    async fn setup(&mut self, opts: &Options) -> Result<(), Error> {
-        self.share = opts.smb.smb_share.clone();
-        self.workgroup = opts.smb.smb_workgroup.clone();
+    async fn setup(&mut self, _: &Options) -> Result<(), Error> {
         Ok(())
     }
 
@@ -120,36 +35,41 @@ impl Plugin for SMB {
         creds: &Credentials,
         timeout: Duration,
     ) -> Result<Option<Vec<Loot>>, Error> {
-        let address = utils::parse_target_address(&creds.target, 445)?;
-        let server = format!("smb://{}", &address);
-        let share = tokio::time::timeout(timeout, self.get_share_for(&address))
-            .await
-            .map_err(|e: tokio::time::error::Elapsed| e.to_string())?
+        let (address, port) = utils::parse_target(&creds.target, 445)?;
+
+        let mut config = smb::ClientConfig::default();
+
+        config.connection.port = Some(port);
+        config.connection.timeout = Some(timeout);
+
+        let mut conn = smb::Connection::build(&address, config.connection.clone())
             .map_err(|e| e.to_string())?;
 
-        // HACK: pavao doesn't seem to be thread safe, so we need to acquire this lock here.
-        // Sadly this decreases performances, but it appears that there are no alternatives
-        // for rust :/
-        let _guard = PAVAO_LOCK.lock().await;
-        let client = self.get_samba_client(
-            &server,
-            &self.workgroup,
-            &share,
-            &creds.username,
-            &creds.password,
-        )?;
+        conn.connect().await.map_err(|e| e.to_string())?;
 
-        return if client.list_dir("/").is_ok() {
-            Ok(Some(vec![Loot::new(
+        return match conn
+            .authenticate(&creds.username, creds.password.clone())
+            .await
+        {
+            Ok(_) => Ok(Some(vec![Loot::new(
                 "smb",
                 &address,
                 [
                     ("username".to_owned(), creds.username.to_owned()),
                     ("password".to_owned(), creds.password.to_owned()),
                 ],
-            )]))
-        } else {
-            Ok(None)
+            )])),
+            // correct user, wrong pass: Some(UnexpectedMessageStatus(3221225581))
+            Err(smb::Error::UnexpectedMessageStatus(_)) => Ok(Some(vec![
+                Loot::new(
+                    "smb",
+                    &address,
+                    [("username".to_owned(), creds.username.to_owned())],
+                )
+                .set_partial(),
+            ])),
+            // wrong user: Some(InvalidMessage("Message not signed or encrypted, but signing is required for the session!"))
+            Err(_) => Ok(None),
         };
     }
 }