435 lines
18 KiB
Plaintext
435 lines
18 KiB
Plaintext
10.0.2.55 = Apple IIgs running Marinetti
|
|
10.0.2.1 = Raspberry Pi running A2SERVER, SMB credentials 'PI' / 'APPLE2' with hostname 'LIVINGROOM' and workgroup 'WORKGROUP'
|
|
.. assumes a file on \\LIVINGROOM\GSFILES named \testfile (sorry no UI yet)
|
|
|
|
01:21:25.052918 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.0.2.1 tell 10.0.2.55, length 46
|
|
0x0000: 0001 0800 0604 0001 000e 3aa2 a2a2 0a00 ..........:.....
|
|
0x0010: 0237 0000 0000 0000 0a00 0201 0101 0101 .7..............
|
|
0x0020: 0101 0101 0101 0101 0101 0101 0101 ..............
|
|
|
|
01:21:25.053068 ARP, Ethernet (len 6), IPv4 (len 4), Reply 10.0.2.1 is-at 8c:ae:4c:fe:6b:64, length 28
|
|
0x0000: 0001 0800 0604 0002 8cae 4cfe 6b64 0a00 ..........L.kd..
|
|
0x0010: 0201 000e 3aa2 a2a2 0a00 0237 ....:......7
|
|
|
|
01:21:28.062931 IP (tos 0x0, ttl 60, id 432, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [S], cksum 0x1d4c (correct), seq 285221793, win 16384, length 0
|
|
0x0000: 4500 0028 01b0 0000 3c06 64e9 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 23a1 0000 0000 ..........#.....
|
|
0x0020: 5002 4000 1d4c 0000 0000 0000 0000 P.@..L........
|
|
|
|
01:21:28.063147 IP (tos 0x0, ttl 64, id 32470, offset 0, flags [DF], proto TCP (6), length 40)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [.], cksum 0x1852 (incorrect -> 0x554f), seq 411873053, ack 272181237, win 15544, length 0
|
|
0x0000: 4500 0028 7ed6 4000 4006 a3c2 0a00 0201 E..(~.@.@.......
|
|
0x0010: 0a00 0237 01bd 0401 188c af1d 1039 27f5 ...7.........9'.
|
|
0x0020: 5010 3cb8 1852 0000 P.<..R..
|
|
|
|
01:21:28.085461 IP (tos 0x0, ttl 60, id 433, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [R], cksum 0x19bd (correct), seq 272181237, win 16384, length 0
|
|
0x0000: 4500 0028 01b1 0000 3c06 64e8 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1039 27f5 0000 0000 .........9'.....
|
|
0x0020: 5004 4000 19bd 0000 0000 0000 0000 P.@...........
|
|
|
|
01:21:31.083243 IP (tos 0x0, ttl 60, id 434, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [S], cksum 0x1d4c (correct), seq 285221793, win 16384, length 0
|
|
0x0000: 4500 0028 01b2 0000 3c06 64e7 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 23a1 0000 0000 ..........#.....
|
|
0x0020: 5002 4000 1d4c 0000 0000 0000 0000 P.@..L........
|
|
|
|
01:21:31.083598 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [S.], cksum 0x1856 (incorrect -> 0x0f6f), seq 3169337375, ack 285221794, win 14600, options [mss 1460], length 0
|
|
0x0000: 4500 002c 0000 4000 4006 2295 0a00 0201 E..,..@.@.".....
|
|
0x0010: 0a00 0237 01bd 0401 bce8 401f 1100 23a2 ...7......@...#.
|
|
0x0020: 6012 3908 1856 0000 0204 05b4 `.9..V......
|
|
|
|
01:21:31.106079 IP (tos 0x0, ttl 60, id 435, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [.], cksum 0x2034 (correct), seq 1, ack 1, win 16384, length 0
|
|
0x0000: 4500 0028 01b3 0000 3c06 64e6 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 23a2 bce8 4020 ..........#...@.
|
|
0x0020: 5010 4000 2034 0000 0000 0000 0000 P.@..4........
|
|
|
|
01:21:31.209213 IP (tos 0x0, ttl 60, id 436, offset 0, flags [none], proto TCP (6), length 91)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [P.], cksum 0x941d (correct), seq 1:52, ack 1, win 16384, length 51
|
|
SMB PACKET: SMBnegprot (REQUEST)
|
|
SMB Command = 0x72
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x8
|
|
Flags2 = 0x1
|
|
Tree ID = 0 (0x0)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 0 (0x0)
|
|
MID = 1 (0x1)
|
|
Word Count = 0 (0x0)
|
|
smb_bcc=12
|
|
Dialect=NT LM 0.12
|
|
|
|
|
|
0x0000: 4500 005b 01b4 0000 3c06 64b2 0a00 0237 E..[....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 23a2 bce8 4020 ..........#...@.
|
|
0x0020: 5018 4000 941d 0000 0000 002f ff53 4d42 P.@......../.SMB
|
|
0x0030: 7200 0000 0008 0100 0000 0000 0000 0000 r...............
|
|
0x0040: 0000 0000 0000 adde 0000 0100 000c 0002 ................
|
|
0x0050: 4e54 204c 4d20 302e 3132 00 NT.LM.0.12.
|
|
|
|
01:21:31.209458 IP (tos 0x0, ttl 64, id 22635, offset 0, flags [DF], proto TCP (6), length 40)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [.], cksum 0x1852 (incorrect -> 0x26f9), seq 1, ack 52, win 14600, length 0
|
|
0x0000: 4500 0028 586b 4000 4006 ca2d 0a00 0201 E..(Xk@.@..-....
|
|
0x0010: 0a00 0237 01bd 0401 bce8 4020 1100 23d5 ...7......@...#.
|
|
0x0020: 5010 3908 1852 0000 P.9..R..
|
|
|
|
01:21:31.214806 IP (tos 0x0, ttl 64, id 22636, offset 0, flags [DF], proto TCP (6), length 141)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [P.], cksum 0x625a (correct), seq 1:102, ack 52, win 14600, length 101
|
|
SMB PACKET: SMBnegprot (REPLY)
|
|
SMB Command = 0x72
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x88
|
|
Flags2 = 0x3
|
|
Tree ID = 0 (0x0)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 0 (0x0)
|
|
MID = 1 (0x1)
|
|
Word Count = 17 (0x11)
|
|
NT1 Protocol
|
|
DialectIndex=0 (0x0)
|
|
SecMode=0x3
|
|
MaxMux=50 (0x32)
|
|
NumVcs=1 (0x1)
|
|
MaxBuffer=16644 (0x4104)
|
|
RawSize=65536 (0x10000)
|
|
SessionKey=0xC87
|
|
Capabilities=0x80F3FD
|
|
ServerTime=Mon May 25 01:21:32 2015
|
|
TimeZone=240 (0xf0)
|
|
CryptKey=Data: (1 bytes)
|
|
[000] 08 \0x08
|
|
smb_bcc=28
|
|
[000] B1 FF 9B 89 49 EF 71 76 57 00 4F 00 52 00 4B 00 \0xb1\0xff\0x9b\0x89I\0xefqv W\0x00O\0x00R\0x00K\0x00
|
|
[010] 47 00 52 00 4F 00 55 00 50 00 00 00 G\0x00R\0x00O\0x00U\0x00 P\0x00\0x00\0x00
|
|
|
|
|
|
0x0000: 4500 008d 586c 4000 4006 c9c7 0a00 0201 E...Xl@.@.......
|
|
0x0010: 0a00 0237 01bd 0401 bce8 4020 1100 23d5 ...7......@...#.
|
|
0x0020: 5018 3908 625a 0000 0000 0061 ff53 4d42 P.9.bZ.....a.SMB
|
|
0x0030: 7200 0000 0088 0340 0000 0000 0000 0000 r......@........
|
|
0x0040: 0000 0000 0000 adde 0000 0100 1100 0003 ................
|
|
0x0050: 3200 0100 0441 0000 0000 0100 870c 0000 2....A..........
|
|
0x0060: fdf3 8000 f416 aba8 aa96 d001 f000 081c ................
|
|
0x0070: 00b1 ff9b 8949 ef71 7657 004f 0052 004b .....I.qvW.O.R.K
|
|
0x0080: 0047 0052 004f 0055 0050 0000 00 .G.R.O.U.P...
|
|
|
|
01:21:31.267352 IP (tos 0x0, ttl 60, id 437, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [.], cksum 0x1f9c (correct), seq 52, ack 102, win 16384, length 0
|
|
0x0000: 4500 0028 01b5 0000 3c06 64e4 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 23d5 bce8 4085 ..........#...@.
|
|
0x0020: 5010 4000 1f9c 0000 0000 0000 0000 P.@...........
|
|
|
|
01:21:31.507035 IP (tos 0x0, ttl 60, id 438, offset 0, flags [none], proto TCP (6), length 183)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [P.], cksum 0x9903 (correct), seq 52:195, ack 102, win 16384, length 143
|
|
SMB PACKET: SMBsesssetupX (REQUEST)
|
|
SMB Command = 0x73
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x8
|
|
Flags2 = 0x1
|
|
Tree ID = 0 (0x0)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 0 (0x0)
|
|
MID = 1 (0x1)
|
|
Word Count = 13 (0xd)
|
|
Com2=0xFF
|
|
Res1=0x0
|
|
Off2=0 (0x0)
|
|
MaxBuffer=16644 (0x4104)
|
|
MaxMpx=50 (0x32)
|
|
VcNumber=1 (0x1)
|
|
SessionKey=0xC87
|
|
CaseInsensitivePasswordLength=24 (0x18)
|
|
CaseSensitivePasswordLength=0 (0x0)
|
|
Res=0x0
|
|
Capabilities=0x80F3FD
|
|
Pass1&Pass2&Account&Domain&OS&LanMan=
|
|
smb_bcc=78
|
|
[000] 9E 83 A5 64 71 8C 7A 1B 3E 90 0B 53 2D FC A2 26 \0x9e\0x83\0xa5dq\0x8cz\0x1b >\0x90\0x0bS-\0xfc\0xa2&
|
|
[010] 6D 9C B3 09 61 56 9C C7 00 00 00 00 00 00 00 00 m\0x9c\0xb3\0x09aV\0x9c\0xc7 \0x00\0x00\0x00\0x00\0x00\0x00\0x00\0x00
|
|
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \0x00\0x00\0x00\0x00\0x00\0x00\0x00\0x00 \0x00\0x00\0x00\0x00\0x00\0x00\0x00\0x00
|
|
[030] 50 49 00 57 4F 52 4B 47 52 4F 55 50 00 47 53 2F PI\0x00WORKG ROUP\0x00GS/
|
|
[040] 4F 53 00 41 70 70 6C 65 20 49 49 67 73 00 OS\0x00Apple IIgs\0x00
|
|
|
|
|
|
0x0000: 4500 00b7 01b6 0000 3c06 6454 0a00 0237 E.......<.dT...7
|
|
0x0010: 0a00 0201 0401 01bd 1100 23d5 bce8 4085 ..........#...@.
|
|
0x0020: 5018 4000 9903 0000 0000 008b ff53 4d42 P.@..........SMB
|
|
0x0030: 7300 0000 0008 0100 0000 0000 0000 0000 s...............
|
|
0x0040: 0000 0000 0000 adde 0000 0100 0dff 0000 ................
|
|
0x0050: 0004 4132 0001 0087 0c00 0018 0000 0000 ..A2............
|
|
0x0060: 0000 00fd f380 004e 009e 83a5 6471 8c7a .......N....dq.z
|
|
0x0070: 1b3e 900b 532d fca2 266d 9cb3 0961 569c .>..S-..&m...aV.
|
|
0x0080: c700 0000 0000 0000 0000 0000 0000 0000 ................
|
|
0x0090: 0000 0000 0000 0000 0050 4900 574f 524b .........PI.WORK
|
|
0x00a0: 4752 4f55 5000 4753 2f4f 5300 4170 706c GROUP.GS/OS.Appl
|
|
0x00b0: 6520 4949 6773 00 e.IIgs.
|
|
|
|
01:21:31.509029 IP (tos 0x0, ttl 64, id 22637, offset 0, flags [DF], proto TCP (6), length 112)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [P.], cksum 0x0f26 (correct), seq 102:174, ack 195, win 15544, length 72
|
|
SMB PACKET: SMBsesssetupX (REPLY)
|
|
SMB Command = 0x73
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x88
|
|
Flags2 = 0x3
|
|
Tree ID = 0 (0x0)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 3 (0x3)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Action=0x1
|
|
smb_bcc=27
|
|
[000] 55 6E 69 78 00 53 61 6D 62 61 20 33 2E 36 2E 36 Unix\0x00Sam ba 3.6.6
|
|
[010] 00 57 4F 52 4B 47 52 4F 55 50 00 \0x00WORKGRO UP\0x00
|
|
|
|
|
|
0x0000: 4500 0070 586d 4000 4006 c9e3 0a00 0201 E..pXm@.@.......
|
|
0x0010: 0a00 0237 01bd 0401 bce8 4085 1100 2464 ...7......@...$d
|
|
0x0020: 5018 3cb8 0f26 0000 0000 0044 ff53 4d42 P.<..&.....D.SMB
|
|
0x0030: 7300 0000 0088 0340 0000 0000 0000 0000 s......@........
|
|
0x0040: 0000 0000 0000 adde 6400 0100 03ff 0000 ........d.......
|
|
0x0050: 0001 001b 0055 6e69 7800 5361 6d62 6120 .....Unix.Samba.
|
|
0x0060: 332e 362e 3600 574f 524b 4752 4f55 5000 3.6.6.WORKGROUP.
|
|
|
|
01:21:31.559120 IP (tos 0x0, ttl 60, id 439, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [.], cksum 0x1ec5 (correct), seq 195, ack 174, win 16384, length 0
|
|
0x0000: 4500 0028 01b7 0000 3c06 64e2 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 2464 bce8 40cd ..........$d..@.
|
|
0x0020: 5010 4000 1ec5 0000 0000 0000 0000 P.@...........
|
|
|
|
01:21:31.675661 IP (tos 0x0, ttl 60, id 440, offset 0, flags [none], proto TCP (6), length 115)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [P.], cksum 0x97d3 (correct), seq 195:270, ack 174, win 16384, length 75
|
|
SMB PACKET: SMBtconX (REQUEST)
|
|
SMB Command = 0x75
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x8
|
|
Flags2 = 0x1
|
|
Tree ID = 0 (0x0)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 4 (0x4)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Flags=0x0
|
|
PassLen=1 (0x1)
|
|
Passwd&Path&Device=
|
|
smb_bcc=28
|
|
smb_buf[]=
|
|
[000] 00 5C 5C 4C 49 56 49 4E 47 52 4F 4F 4D 5C 47 53 \0x00\\LIVIN GROOM\GS
|
|
[010] 46 49 4C 45 53 00 3F 3F 3F 3F 3F 00 FILES\0x00?? ???\0x00
|
|
|
|
|
|
0x0000: 4500 0073 01b8 0000 3c06 6496 0a00 0237 E..s....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 2464 bce8 40cd ..........$d..@.
|
|
0x0020: 5018 4000 97d3 0000 0000 0047 ff53 4d42 P.@........G.SMB
|
|
0x0030: 7500 0000 0008 0100 0000 0000 0000 0000 u...............
|
|
0x0040: 0000 0000 0000 adde 6400 0100 04ff 0000 ........d.......
|
|
0x0050: 0000 0001 001c 0000 5c5c 4c49 5649 4e47 ........\\LIVING
|
|
0x0060: 524f 4f4d 5c47 5346 494c 4553 003f 3f3f ROOM\GSFILES.???
|
|
0x0070: 3f3f 00 ??.
|
|
|
|
01:21:31.696071 IP (tos 0x0, ttl 64, id 22638, offset 0, flags [DF], proto TCP (6), length 93)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [P.], cksum 0x7525 (correct), seq 174:227, ack 270, win 15544, length 53
|
|
SMB PACKET: SMBtconX (REPLY)
|
|
SMB Command = 0x75
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x88
|
|
Flags2 = 0x3
|
|
Tree ID = 1 (0x1)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 3 (0x3)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Data: (2 bytes)
|
|
[000] 01 00 \0x01\0x00
|
|
smb_bcc=8
|
|
ServiceType=A:
|
|
Data: (5 bytes)
|
|
[000] 4E 54 46 53 00 NTFS\0x00
|
|
|
|
|
|
0x0000: 4500 005d 586e 4000 4006 c9f5 0a00 0201 E..]Xn@.@.......
|
|
0x0010: 0a00 0237 01bd 0401 bce8 40cd 1100 24af ...7......@...$.
|
|
0x0020: 5018 3cb8 7525 0000 0000 0031 ff53 4d42 P.<.u%.....1.SMB
|
|
0x0030: 7500 0000 0088 0340 0000 0000 0000 0000 u......@........
|
|
0x0040: 0000 0000 0100 adde 6400 0100 03ff 0000 ........d.......
|
|
0x0050: 0001 0008 0041 3a00 4e54 4653 00 .....A:.NTFS.
|
|
|
|
01:21:31.745968 IP (tos 0x0, ttl 60, id 441, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [.], cksum 0x1e45 (correct), seq 270, ack 227, win 16384, length 0
|
|
0x0000: 4500 0028 01b9 0000 3c06 64e0 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 24af bce8 4102 ..........$...A.
|
|
0x0020: 5010 4000 1e45 0000 0000 0000 0000 P.@..E........
|
|
|
|
01:21:31.866926 IP (tos 0x0, ttl 60, id 442, offset 0, flags [none], proto TCP (6), length 119)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [P.], cksum 0x4497 (correct), seq 270:349, ack 227, win 16384, length 79
|
|
SMB PACKET: SMBopenX (REQUEST)
|
|
SMB Command = 0x2D
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x8
|
|
Flags2 = 0x1
|
|
Tree ID = 1 (0x1)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 15 (0xf)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Flags=0x0
|
|
Mode=0x0
|
|
SearchAttrib=
|
|
Attrib=
|
|
Time=NULL
|
|
OFun=0x1
|
|
Size=0 (0x0)
|
|
TimeOut=0 (0x0)
|
|
Res=0x0
|
|
smb_bcc=10
|
|
Path=\TESTFILE
|
|
|
|
|
|
0x0000: 4500 0077 01ba 0000 3c06 6490 0a00 0237 E..w....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 24af bce8 4102 ..........$...A.
|
|
0x0020: 5018 4000 4497 0000 0000 004b ff53 4d42 P.@.D......K.SMB
|
|
0x0030: 2d00 0000 0008 0100 0000 0000 0000 0000 -...............
|
|
0x0040: 0000 0000 0100 adde 6400 0100 0fff 0000 ........d.......
|
|
0x0050: 0000 0000 0000 0000 0000 0000 0001 0000 ................
|
|
0x0060: 0000 0000 0000 0000 0000 000a 005c 5445 .............\TE
|
|
0x0070: 5354 4649 4c45 00 STFILE.
|
|
|
|
01:21:31.869427 IP (tos 0x0, ttl 64, id 22639, offset 0, flags [DF], proto TCP (6), length 109)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [P.], cksum 0x8f24 (correct), seq 227:296, ack 349, win 15544, length 69
|
|
SMB PACKET: SMBopenX (REPLY)
|
|
SMB Command = 0x2D
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x88
|
|
Flags2 = 0x3
|
|
Tree ID = 1 (0x1)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 15 (0xf)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Handle=19932 (0x4ddc)
|
|
Attrib=
|
|
Time=Sat Mar 3 10:43:04 2018
|
|
Size=44 (0x2c)
|
|
Access=0x0
|
|
Type=0x0
|
|
State=0x0
|
|
Action=0x1
|
|
FileID=0x0
|
|
Res=0x0
|
|
smb_bcc=0
|
|
|
|
|
|
0x0000: 4500 006d 586f 4000 4006 c9e4 0a00 0201 E..mXo@.@.......
|
|
0x0010: 0a00 0237 01bd 0401 bce8 4102 1100 24fe ...7......A...$.
|
|
0x0020: 5018 3cb8 8f24 0000 0000 0041 ff53 4d42 P.<..$.....A.SMB
|
|
0x0030: 2d00 0000 0088 0340 0000 0000 0000 0000 -......@........
|
|
0x0040: 0000 0000 0100 adde 6400 0100 0fff 0000 ........d.......
|
|
0x0050: 00dc 4d80 0063 4c62 552c 0000 0000 0000 ..M..cLbU,......
|
|
0x0060: 0000 0001 0000 0000 0000 0000 00 .............
|
|
|
|
01:21:31.919908 IP (tos 0x0, ttl 60, id 443, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [.], cksum 0x1db1 (correct), seq 349, ack 296, win 16384, length 0
|
|
0x0000: 4500 0028 01bb 0000 3c06 64de 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 24fe bce8 4147 ..........$...AG
|
|
0x0020: 5010 4000 1db1 0000 0000 0000 0000 P.@...........
|
|
|
|
01:21:32.040297 IP (tos 0x0, ttl 60, id 444, offset 0, flags [none], proto TCP (6), length 103)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [P.], cksum 0x2ed6 (correct), seq 349:412, ack 296, win 16384, length 63
|
|
SMB PACKET: SMBreadX (REQUEST)
|
|
SMB Command = 0x2E
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x8
|
|
Flags2 = 0x1
|
|
Tree ID = 1 (0x1)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 12 (0xc)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Handle=19932 (0x4ddc)
|
|
Offset=0 (0x0)
|
|
MaxCount=1024 (0x400)
|
|
MinCount=0 (0x0)
|
|
TimeOut=0 (0x0)
|
|
CountLeft=0 (0x0)
|
|
Data: (4 bytes)
|
|
[000] 00 00 00 00 \0x00\0x00\0x00\0x00
|
|
smb_bcc=0
|
|
|
|
|
|
0x0000: 4500 0067 01bc 0000 3c06 649e 0a00 0237 E..g....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 24fe bce8 4147 ..........$...AG
|
|
0x0020: 5018 4000 2ed6 0000 0000 003b ff53 4d42 P.@........;.SMB
|
|
0x0030: 2e00 0000 0008 0100 0000 0000 0000 0000 ................
|
|
0x0040: 0000 0000 0100 adde 6400 0100 0cff 0000 ........d.......
|
|
0x0050: 00dc 4d00 0000 0000 0400 0000 0000 0000 ..M.............
|
|
0x0060: 0000 0000 0000 00 .......
|
|
|
|
01:21:32.041173 IP (tos 0x0, ttl 64, id 22640, offset 0, flags [DF], proto TCP (6), length 147)
|
|
10.0.2.1.445 > 10.0.2.55.1025: Flags [P.], cksum 0x57d3 (correct), seq 296:403, ack 412, win 15544, length 107
|
|
SMB PACKET: SMBreadX (REPLY)
|
|
SMB Command = 0x2E
|
|
Error class = 0x0
|
|
Error code = 0 (0x0)
|
|
Flags1 = 0x88
|
|
Flags2 = 0x3
|
|
Tree ID = 1 (0x1)
|
|
Proc ID = 57005 (0xdead)
|
|
UID = 100 (0x64)
|
|
MID = 1 (0x1)
|
|
Word Count = 12 (0xc)
|
|
Com2=0xFF
|
|
Off2=0 (0x0)
|
|
Remaining=65535 (0xffff)
|
|
Res=0x0
|
|
DataSize=44 (0x2c)
|
|
DataOff=59 (0x3b)
|
|
Res=(0x0,0x0,0x0,0x0)
|
|
Data: (2 bytes)
|
|
[000] 2C 00 ,\0x00
|
|
smb_bcc=44
|
|
smb_buf[]=
|
|
[000] 54 68 69 73 20 69 73 20 61 20 74 65 73 74 2E 20 This is a test.
|
|
[010] 53 6F 6D 65 74 68 69 6E 67 20 77 61 73 20 64 6F Somethin g was do
|
|
[020] 77 6E 6C 6F 61 64 65 64 20 3A 29 0A wnloaded :)\0x0a
|
|
|
|
|
|
0x0000: 4500 0093 5870 4000 4006 c9bd 0a00 0201 E...Xp@.@.......
|
|
0x0010: 0a00 0237 01bd 0401 bce8 4147 1100 253d ...7......AG..%=
|
|
0x0020: 5018 3cb8 57d3 0000 0000 0067 ff53 4d42 P.<.W......g.SMB
|
|
0x0030: 2e00 0000 0088 0340 0000 0000 0000 0000 .......@........
|
|
0x0040: 0000 0000 0100 adde 6400 0100 0cff 0000 ........d.......
|
|
0x0050: 00ff ff00 0000 002c 003b 0000 0000 0000 .......,.;......
|
|
0x0060: 0000 002c 002c 0054 6869 7320 6973 2061 ...,.,.This.is.a
|
|
0x0070: 2074 6573 742e 2053 6f6d 6574 6869 6e67 .test..Something
|
|
0x0080: 2077 6173 2064 6f77 6e6c 6f61 6465 6420 .was.downloaded.
|
|
0x0090: 3a29 0a :).
|
|
|
|
01:21:32.091445 IP (tos 0x0, ttl 60, id 445, offset 0, flags [none], proto TCP (6), length 40)
|
|
10.0.2.55.1025 > 10.0.2.1.445: Flags [.], cksum 0x1d07 (correct), seq 412, ack 403, win 16384, length 0
|
|
0x0000: 4500 0028 01bd 0000 3c06 64dc 0a00 0237 E..(....<.d....7
|
|
0x0010: 0a00 0201 0401 01bd 1100 253d bce8 41b2 ..........%=..A.
|
|
0x0020: 5010 4000 1d07 0000 0000 0000 0000 P.@...........
|