rapid7/metasploit-framework — pull request #3071 by 0x41414141 (2014-03-07 12:49:23+00:00)
Title: Implement SMB Server Protocol within Rex.

This commit adds support for implementing the SMBFileServer Module
within Rex, allowing exploit modules to create a payload to be sent
to an SMBFileServer instance. This can be useful in cases where
you would find DLL injection in an system which will read files
over a UNC share, or other instances where a payload can be delivered
over SMB.

This code borrows heavily from the ms13_071_theme module written
by Juan Vazquez, however I have performed a fair amount of protocol
analysis and debugging to provide support for delivering an arbitrary
MSF payload over UNC.
The main differences being the presence of functions to support:
- SMB CMD Trans Query Path Info (Basic and Standard)
- SMB CMD Trans Query File Info (Standard and Internal)

This code can be considered "alpha", as I have only implemented support
for the SMB functions discovered during development of an exploit of an
arbitrary DLL injection into a server performing a "LoadLibraryA" call*
However, this provides a basis upon which additional SMB functions can
be implemented to extend delivery of payloads over SMB.

A separate commit will expose the SMBFileServer Module within
./lib/msf/core/exploit/smb.rb

* This exploit will be committed separately once a fix has been confirmed
by the vendor.