Squashed commit of the following:

commit e5cb0a18d5474730310f1797016e1106c33ca059
Author: Patrik Karlsson <patrik@cqure.net>
Date:   Sun Oct 7 10:47:35 2012 +0200

    compatibility fixes to spnego authentication in smb and smbauth libraries

    the spnego authentication blob now decodes properly in wireshark
    fixes in spnego authentication for both Window 2003 and Windows 7

nselib/smb.lua

@@ -836,6 +836,11 @@ function smb_read(smb, read_data)
 	repeat
 		attempts = attempts - 1
 		status, netbios_data = smb['socket']:receive_buf(match.numbytes(4), true);
+		
+		if ( not(status) and netbios_data == "EOF" ) then
+			stdnse.print_debug(1, "SMB: ERROR: Server disconnected the connection")
+			return false, "SMB: ERROR: Server disconnected the connection"
+		end
 	until(status or (attempts == 0))
 
 	-- Make sure the connection is still alive
@@ -1322,14 +1327,13 @@ local function start_session_extended(smb, log_errors, overrides)
 					security_blob = enc:encode( { type = 'A0', value = security_blob } )
 					security_blob = oid .. security_blob
 					security_blob = enc:encode( { type = '60', value = security_blob } )
-					
 				end
 			else
 				if ( sp_nego ) then
 					if ( smb['domain'] or smb['server'] and ( not(domain) or #domain == 0 ) ) then
 						domain = smb['domain'] or smb['server']
 					end
-					hash_type = "v2"
+					hash_type = "ntlm"
 				end
 				
 				status, security_blob, smb['mac_key'] = smbauth.get_security_blob(security_blob, smb['ip'], username, domain, password, password_hash, hash_type, (sp_nego and 0x00088215))
@@ -1350,26 +1354,27 @@ local function start_session_extended(smb, log_errors, overrides)
 			end
 	
 			header     = smb_encode_header(smb, command_codes['SMB_COM_SESSION_SETUP_ANDX'], overrides)
+
+			-- Data is a list of strings, terminated by a blank one. 
+			data = bin.pack("<Azzz", 
+						security_blob,         -- Security blob
+						"Nmap",                -- OS
+						"Native Lanman",       -- Native LAN Manager
+						""                     -- Primary domain
+			)
+	
 			-- Parameters
 			parameters = bin.pack("<CCSSSSISII", 
 						0xFF,               -- ANDX -- no further commands
 						0x00,               -- ANDX -- Reserved (0)
-						0x0000,             -- ANDX -- next offset
+						#data + 24 + #header + 3, -- ANDX -- next offset
 						0xFFFF,             -- Max buffer size
 						0x0001,             -- Max multiplexes
 						0x0001,             -- Virtual circuit num
 						smb['session_key'], -- The session key
 						#security_blob,     -- Security blob length
 						0x00000000,         -- Reserved
-		                0x80000050          -- Capabilities
+						0x80000050          -- Capabilities
-					)
-		
-			-- Data is a list of strings, terminated by a blank one. 
-			data       = bin.pack("<Azzz", 
-						security_blob,         -- Security blob
-						"Nmap",                -- OS
-						"Native Lanman",       -- Native LAN Manager
-						""                     -- Primary domain
 					)
 			
 			-- Send the session setup request

nselib/smbauth.lua

@@ -677,39 +677,51 @@ function get_security_blob(security_blob, ip, username, domain, password, passwo
 	else
 		-- Parse the old security blob
 		local pos, identifier, message_type, domain_length, domain_max, domain_offset, server_flags, challenge, reserved = bin.unpack("<LISSIIA8A8", security_blob, 1)
-
+   	local lanman, ntlm, mac_key = get_password_response(ip, username, domain, password, password_hash, hash_type, challenge, true)
-		-- Get the information for the current login
-        local lanman, ntlm, mac_key = get_password_response(ip, username, domain, password, password_hash, hash_type, challenge, true)
 
 		-- Convert the username and domain to unicode (TODO: Disable the unicode flag, evaluate if that'll work)
 		username = to_unicode(username)
-		domain   = to_unicode(domain)
+		hostname = to_unicode("nmap")
+		domain   = (#username > 0 ) and to_unicode(domain) or ""
+		ntlm     = (#username > 0 ) and ntlm or ""
+		lanman   = (#username > 0 ) and lanman or string.char(0)
 
-		new_blob = bin.pack("<zISSISSISSISSISSISSII", 
+		local domain_offset = 0x40
-					"NTLMSSP",            -- Identifier
+		local username_offset = domain_offset + #domain
-					NTLMSSP_AUTH,         -- Type
+		local hostname_offset = username_offset + #username
-					#lanman,              -- Lanman (length, max, offset)
+		local lanman_offset = hostname_offset + #hostname
-					#lanman,              -- 
+		local ntlm_offset = lanman_offset + #lanman
-					0x40,                 -- 
+		local sessionkey_offset = ntlm_offset + #ntlm
-					#ntlm,                -- NTLM (length, max, offset)
+
-					#ntlm,                -- 
+		new_blob = bin.pack("<zISSISSISSISSISSISSIIAAAAAA",
-					0x40 + #lanman,       -- 
+			"NTLMSSP",
-					#domain,              -- Domain (length, max, offset)
+			NTLMSSP_AUTH,
-					#domain,              --
+			#lanman,
-					0x40 + #lanman + #ntlm,--
+			#lanman,
-					#username,            -- Username (length, max, offset)
+			lanman_offset,
-					#username,            -- 
+			( #ntlm > 0 and #ntlm - 16 or 0 ),
-					0x40 + #lanman + #ntlm + #domain,
+			( #ntlm > 0 and #ntlm - 16 or 0 ),
-					#domain,              -- Hostname (length, max, offset)
+			ntlm_offset,
-					#domain,              --
+			#domain,
-					0x40 + #lanman + #ntlm + #domain + #username,
+			#domain,
-					#session_key,         -- Session key (length, max, offset)
+			domain_offset,
-					#session_key,         --
+			#username,
-					0x40 + #lanman + #ntlm + #domain + #username + #domain,
+			#username,
-					flags                 -- Flags
+			username_offset,
-				)
+			#hostname,
+			#hostname,
+			hostname_offset,
+			#session_key,
+			#session_key,
+			sessionkey_offset,
+			flags,
+			domain,
+			username,
+			hostname,
+			lanman,
+			ntlm,
+			session_key)
 	
-		new_blob = new_blob .. bin.pack("AAAAAA", lanman, ntlm, domain, username, domain, session_key)
 		return true, new_blob, mac_key
 	end