ruby_smb 0.0.18 → 0.0.19

data/lib/ruby_smb/client/authentication.rb

@@ -2,15 +2,14 @@ module RubySMB
   class Client
     # This module holds all the backend client methods for authentication.
     module Authentication
-
       # Responsible for handling Authentication and Session Setup for
       # the SMB Client. It returns the final Status code from the authentication
       # exchange.
       #
       # @return [WindowsError::NTStatus] the NTStatus object from the SessionSetup exchange.
       def authenticate
-        if self.smb1
-          if self.username.empty? && self.password.empty?
+        if smb1
+          if username.empty? && password.empty?
             smb1_anonymous_auth
           else
             smb1_authenticate
@@ -33,9 +32,11 @@ module RubySMB
         response      = smb1_anonymous_auth_response(raw_response)
         response_code = response.status_code
 
-        if response_code.name == "STATUS_SUCCESS"
-          self.user_id  = response.smb_header.uid
-          self.peer_native_os = response.data_block.native_os
+        if response_code == WindowsError::NTStatus::STATUS_SUCCESS
+          self.user_id = response.smb_header.uid
+          self.peer_native_os = response.data_block.native_os.to_s
+          self.peer_native_lm = response.data_block.native_lan_man.to_s
+          self.primary_domain = response.data_block.primary_domain.to_s
         end
 
         response_code
@@ -46,7 +47,7 @@ module RubySMB
       def smb1_anonymous_auth_request
         packet = RubySMB::SMB1::Packet::SessionSetupLegacyRequest.new
         packet.data_block.oem_password = "\x00"
-        packet.parameter_block.max_buffer_size = 4356
+        packet.parameter_block.max_buffer_size = self.max_buffer_size
         packet.parameter_block.max_mpx_count = 50
         packet.parameter_block.capabilities.extended_security = 0
         packet
@@ -65,20 +66,30 @@ module RubySMB
         packet
       end
 
-      # Handles the SMB1 NTLMSSP 4-way handshake for Authentication
+      # Handles the SMB1 NTLMSSP 4-way handshake for Authentication and store
+      # information about the peer/server.
       def smb1_authenticate
         response = smb1_ntlmssp_negotiate
         challenge_packet = smb1_ntlmssp_challenge_packet(response)
+
+        # Store the available OS information before going forward.
+        @peer_native_os = challenge_packet.data_block.native_os.to_s
+        @peer_native_lm = challenge_packet.data_block.native_lan_man.to_s
+
         user_id = challenge_packet.smb_header.uid
-        challenge_message = smb1_type2_message(challenge_packet)
-        raw = smb1_ntlmssp_authenticate(challenge_message, user_id)
+        type2_b64_message = smb1_type2_message(challenge_packet)
+        type3_message = @ntlm_client.init_context(type2_b64_message)
+
+        @session_key = @ntlm_client.session_key
+        challenge_message = @ntlm_client.session.challenge_message
+        store_target_info(challenge_message.target_info) if challenge_message.has_flag?(:TARGET_INFO)
+        @os_version = extract_os_version(challenge_message.os_version.to_s)
+
+        raw = smb1_ntlmssp_authenticate(type3_message, user_id)
         response = smb1_ntlmssp_final_packet(raw)
         response_code = response.status_code
 
-        if response_code.name == "STATUS_SUCCESS"
-          self.user_id  = user_id
-          self.peer_native_os = response.data_block.native_os
-        end
+        @user_id = user_id if response_code == WindowsError::NTStatus::STATUS_SUCCESS
 
         response_code
       end
@@ -92,31 +103,28 @@ module RubySMB
         send_recv(packet)
       end
 
-      # Takes the Base64 encoded NTLM Type 2 (Challenge) message
-      # and calls the routines to build the Auth packet, sends the packet
-      # and receives the raw response
+      # Takes the NTLM Type 3 (authenticate) message and calls the routines to
+      # build the Auth packet, sends the packet and receives the raw response.
       #
-      # @param type2_string [String] the Base64 Encoded NTLM Type 2 message
+      # @param type3_message [String] the NTLM Type 3 message
       # @param user_id [Integer] the temporary user ID from the Type 2 response
       # @return [String] the raw binary response from the server
-      def smb1_ntlmssp_authenticate(type2_string,user_id)
-        packet = smb1_ntlmssp_auth_packet(type2_string,user_id)
+      def smb1_ntlmssp_authenticate(type3_message, user_id)
+        packet = smb1_ntlmssp_auth_packet(type3_message, user_id)
         send_recv(packet)
       end
 
       # Generates the {RubySMB::SMB1::Packet::SessionSetupRequest} packet
       # with the NTLM Type 3 (Auth) message in the security_blob field.
       #
-      # @param type2_string [String] the Base64 encoded Type2 challenge to respond to
+      # @param type3_message [String] the NTLM Type 3 message
       # @param user_id [Integer] the temporary user ID from the Type 2 response
       # @return [RubySMB::SMB1::Packet::SessionSetupRequest] the second authentication packet to send
-      def smb1_ntlmssp_auth_packet(type2_string,user_id)
-        type3_message = ntlm_client.init_context(type2_string)
-        self.session_key = ntlm_client.session_key
+      def smb1_ntlmssp_auth_packet(type3_message, user_id)
         packet = RubySMB::SMB1::Packet::SessionSetupRequest.new
         packet.smb_header.uid = user_id
         packet.set_type3_blob(type3_message.serialize)
-        packet.parameter_block.max_buffer_size = 4356
+        packet.parameter_block.max_buffer_size = self.max_buffer_size
         packet.parameter_block.max_mpx_count = 50
         packet.smb_header.flags2.extended_security = 1
         packet
@@ -131,7 +139,7 @@ module RubySMB
         type1_message = ntlm_client.init_context
         packet = RubySMB::SMB1::Packet::SessionSetupRequest.new
         packet.set_type1_blob(type1_message.serialize)
-        packet.parameter_block.max_buffer_size = 4356
+        packet.parameter_block.max_buffer_size = self.max_buffer_size
         packet.parameter_block.max_mpx_count = 50
         packet.smb_header.flags2.extended_security = 1
         packet
@@ -156,7 +164,7 @@ module RubySMB
         packet = RubySMB::SMB1::Packet::SessionSetupResponse.read(raw_response)
         status_code = packet.status_code
 
-        unless status_code.name == "STATUS_MORE_PROCESSING_REQUIRED"
+        unless status_code.name == 'STATUS_MORE_PROCESSING_REQUIRED'
           raise RubySMB::Error::UnexpectedStatusCode, status_code.to_s
         end
 
@@ -172,24 +180,32 @@ module RubySMB
       # @return [String] the base64 encoded  NTLM Challenge (Type2 Message) from the response
       def smb1_type2_message(response_packet)
         sec_blob = response_packet.data_block.security_blob
-        ntlmssp_offset = sec_blob.index("NTLMSSP")
+        ntlmssp_offset = sec_blob.index('NTLMSSP')
         type2_blob = sec_blob.slice(ntlmssp_offset..-1)
-        [type2_blob].pack("m")
+        [type2_blob].pack('m')
       end
 
       #
       # SMB 2 Methods
       #
 
-      # Handles the SMB1 NTLMSSP 4-way handshake for Authentication
+      # Handles the SMB2 NTLMSSP 4-way handshake for Authentication and store
+      # information about the peer/server.
       def smb2_authenticate
         response = smb2_ntlmssp_negotiate
         challenge_packet = smb2_ntlmssp_challenge_packet(response)
-        session_id = challenge_packet.smb2_header.session_id
-        self.session_id = session_id
-        challenge_message = smb2_type2_message(challenge_packet)
-        raw = smb2_ntlmssp_authenticate(challenge_message, session_id)
+        @session_id = challenge_packet.smb2_header.session_id
+        type2_b64_message = smb2_type2_message(challenge_packet)
+        type3_message = @ntlm_client.init_context(type2_b64_message)
+
+        @session_key = @ntlm_client.session_key
+        challenge_message = ntlm_client.session.challenge_message
+        store_target_info(challenge_message.target_info) if challenge_message.has_flag?(:TARGET_INFO)
+        @os_version = extract_os_version(challenge_message.os_version.to_s)
+
+        raw = smb2_ntlmssp_authenticate(type3_message, @session_id)
         response = smb2_ntlmssp_final_packet(raw)
+
         response.status_code
       end
 
@@ -206,7 +222,7 @@ module RubySMB
       def smb2_ntlmssp_challenge_packet(raw_response)
         packet = RubySMB::SMB2::Packet::SessionSetupResponse.read(raw_response)
         status_code = packet.status_code
-        unless status_code.name == "STATUS_MORE_PROCESSING_REQUIRED"
+        unless status_code.name == 'STATUS_MORE_PROCESSING_REQUIRED'
           raise RubySMB::Error::UnexpectedStatusCode, status_code.to_s
         end
 
@@ -247,39 +263,64 @@ module RubySMB
       # @return [String] the base64 encoded  NTLM Challenge (Type2 Message) from the response
       def smb2_type2_message(response_packet)
         sec_blob = response_packet.buffer
-        ntlmssp_offset = sec_blob.index("NTLMSSP")
+        ntlmssp_offset = sec_blob.index('NTLMSSP')
         type2_blob = sec_blob.slice(ntlmssp_offset..-1)
-        [type2_blob].pack("m")
+        [type2_blob].pack('m')
       end
 
-      # Takes the Base64 encoded NTLM Type 2 (Challenge) message
-      # and calls the routines to build the Auth packet, sends the packet
-      # and receives the raw response
+      # Takes the NTLM Type 3 (authenticate) message and calls the routines to
+      # build the Auth packet, sends the packet and receives the raw response.
       #
-      # @param type2_string [String] the Base64 Encoded NTLM Type 2 message
+      # @param type3_message [String] the NTLM Type 3 message
       # @param user_id [Integer] the temporary user ID from the Type 2 response
       # @return [String] the raw binary response from the server
-      def smb2_ntlmssp_authenticate(type2_string,user_id)
-        packet = smb2_ntlmssp_auth_packet(type2_string,user_id)
+      def smb2_ntlmssp_authenticate(type3_message, user_id)
+        packet = smb2_ntlmssp_auth_packet(type3_message, user_id)
         send_recv(packet)
       end
 
       # Generates the {RubySMB::SMB2::Packet::SessionSetupRequest} packet
       # with the NTLM Type 3 (Auth) message in the security_blob field.
       #
-      # @param type2_string [String] the Base64 encoded Type2 challenge to respond to
+      # @param type3_message [String] the NTLM Type 3 message
       # @param session_id [Integer] the temporary session id from the Type 2 response
       # @return [RubySMB::SMB2::Packet::SessionSetupRequest] the second authentication packet to send
-      def smb2_ntlmssp_auth_packet(type2_string, session_id)
-        type3_message = ntlm_client.init_context(type2_string)
-        self.session_key = ntlm_client.session_key
+      def smb2_ntlmssp_auth_packet(type3_message, session_id)
         packet = RubySMB::SMB2::Packet::SessionSetupRequest.new
         packet.smb2_header.session_id = session_id
         packet.set_type3_blob(type3_message.serialize)
         packet
       end
 
+      # Extract and store useful information about the peer/server from the
+      # NTLM Type 2 (challenge) TargetInfo fields.
+      #
+      # @param target_info_str [String] the Target Info string
+      def store_target_info(target_info_str)
+        target_info = Net::NTLM::TargetInfo.new(target_info_str)
+        {
+          Net::NTLM::TargetInfo::MSV_AV_NB_COMPUTER_NAME  => :@default_name,
+          Net::NTLM::TargetInfo::MSV_AV_NB_DOMAIN_NAME    => :@default_domain,
+          Net::NTLM::TargetInfo::MSV_AV_DNS_COMPUTER_NAME => :@dns_host_name,
+          Net::NTLM::TargetInfo::MSV_AV_DNS_DOMAIN_NAME   => :@dns_domain_name,
+          Net::NTLM::TargetInfo::MSV_AV_DNS_TREE_NAME     => :@dns_tree_name
+        }.each do |constant, attribute|
+          if target_info.av_pairs[constant]
+            value = target_info.av_pairs[constant].dup
+            value.force_encoding('UTF-16LE')
+            instance_variable_set(attribute, value.encode('UTF-8'))
+          end
+        end
+      end
 
+      # Extract the peer/server version number from the NTLM Type 2 (challenge)
+      # Version field.
+      #
+      # @param version [String] the version number as a binary string
+      # @return [String] the formated version number (<major>.<minor>.<build>)
+      def extract_os_version(version)
+        version.unpack('CCS').join('.')
+      end
     end
   end
-end
+end

data/lib/ruby_smb/client/echo.rb

@@ -1,9 +1,7 @@
 module RubySMB
   class Client
-
     # Contains the methods for doing ECHO commands
     module Echo
-
       # Sends an ECHO request packet and returns the
       # last response packet.
       #
@@ -21,7 +19,6 @@ module RubySMB
         RubySMB::SMB1::Packet::EchoResponse.read(raw_response)
       end
 
-
       # Sends an ECHO request packet and returns the
       # response packet.
       #
@@ -33,4 +30,4 @@ module RubySMB
       end
     end
   end
-end
+end

data/lib/ruby_smb/client/negotiation.rb

@@ -3,37 +3,38 @@ module RubySMB
   class Client
     # This module holds all of the methods backing the {RubySMB::Client#negotiate} method
     module Negotiation
-
       # Handles the entire SMB Multi-Protocol Negotiation from the
       # Client to the Server. It sets state on the client appropriate
       # to the protocol and capabilites negotiated during the exchange.
+      # It also keeps track of the negotiated dialect.
       #
       # @return [void]
       def negotiate
-        begin
-          raw_response    = negotiate_request
-          response_packet = negotiate_response(raw_response)
-          parse_negotiate_response(response_packet)
-        rescue RubySMB::Error::InvalidPacket, Errno::ECONNRESET
-          error = "Unable to Negotiate with remote host"
-          if smb1 && !smb2
-            error << ', SMB1 may be disabled'
-          end
-          raise RubySMB::Error::NegotiationFailure, error
-        end
+        request_packet  = negotiate_request
+        raw_response    = send_recv(request_packet)
+        response_packet = negotiate_response(raw_response)
+        # The list of dialect identifiers sent to the server is stored
+        # internally to be able to retrieve the negotiated dialect later on.
+        # This is only valid for SMB1.
+        response_packet.dialects = request_packet.dialects if response_packet.respond_to? :dialects=
+        parse_negotiate_response(response_packet)
+      rescue RubySMB::Error::InvalidPacket, Errno::ECONNRESET
+        error = 'Unable to Negotiate with remote host'
+        error << ', SMB1 may be disabled' if smb1 && !smb2
+        raise RubySMB::Error::NegotiationFailure, error
       end
 
-      # Creates and dispatches the first Negotiate Request Packet and
-      # returns the raw response data.
+      # Creates the first Negotiate Request Packet according to the SMB version
+      # used.
       #
-      # @return [String] the raw binary string containing the response from the server
+      # @return [RubySMB::SMB1::Packet::NegotiateRequest] a SMB1 Negotiate Request packet if SMB1 is used
+      # @return [RubySMB::SMB1::Packet::NegotiateRequest] a SMB2 Negotiate Request packet if SMB2 is used
       def negotiate_request
         if smb1
-          request = smb1_negotiate_request
+          smb1_negotiate_request
         elsif smb2
-          request = smb2_negotiate_request
+          smb2_negotiate_request
         end
-        send_recv(request)
       end
 
       # Takes the raw response data from the server and tries
@@ -48,57 +49,57 @@ module RubySMB
         if smb1
           begin
             packet = RubySMB::SMB1::Packet::NegotiateResponseExtended.read raw_data
-          rescue Exception => e
+          rescue StandardError => e
             raise RubySMB::Error::InvalidPacket, "Not a Valid SMB1 Negoitate Response #{e.message}"
           end
-          if packet.valid?
-            response = packet
-          end
+          response = packet if packet.valid?
         end
         if smb2 && response.nil?
           begin
             packet = RubySMB::SMB2::Packet::NegotiateResponse.read raw_data
-          rescue Exception => e
+          rescue StandardError => e
             raise RubySMB::Error::InvalidPacket, "Not a Valid SMB2 Negoitate Response #{e.message}"
           end
           response = packet
         end
         if response.nil?
-          raise RubySMB::Error::InvalidPacket, "No Valid Negotiate Response found"
+          raise RubySMB::Error::InvalidPacket, 'No Valid Negotiate Response found'
         end
         response
       end
 
       # Sets the supported SMB Protocol and whether or not
       # Signing is enabled based on the Negotiate Response Packet.
+      # It also stores the negotiated dialect.
       #
       # @param packet [RubySMB::SMB1::Packet::NegotiateResponseExtended] if SMB1 was negotiated
       # @param packet [RubySMB::SMB2::Packet::NegotiateResponse] if SMB2 was negotiated
-      # @return [void] This method sets state and does not return a meaningful value
+      # @return [String] The SMB version as a string ('SMB1', 'SMB2')
       def parse_negotiate_response(packet)
         case packet
-          when RubySMB::SMB1::Packet::NegotiateResponseExtended
-            self.smb1 = true
-            self.smb2 = false
-            if packet.parameter_block.security_mode.security_signatures_required == 1
-              self.signing_required = true
-            else
-              self.signing_required = false
-            end
-            'SMB1'
-          when RubySMB::SMB2::Packet::NegotiateResponse
-            self.smb1 = false
-            self.smb2 = true
-            if packet.security_mode.signing_required == 1
-              self.signing_required = true
-            else
-              self.signing_required = false
-            end
-            'SMB2'
+        when RubySMB::SMB1::Packet::NegotiateResponseExtended
+          self.smb1 = true
+          self.smb2 = false
+          if packet.parameter_block.security_mode.security_signatures_required == 1
+            self.signing_required = true
+          else
+            self.signing_required = false
+          end
+          self.dialect = packet.negotiated_dialect.to_s
+          'SMB1'
+        when RubySMB::SMB2::Packet::NegotiateResponse
+          self.smb1 = false
+          self.smb2 = true
+          self.signing_required = if packet.security_mode.signing_required == 1
+                                    true
+                                  else
+                                    false
+                                  end
+          self.dialect = "0x%04x" % packet.dialect_revision
+          'SMB2'
         end
       end
 
-
       # Create a {RubySMB::SMB1::Packet::NegotiateRequest} packet with the
       # dialects filled in based on the protocol options set on the Client.
       #
@@ -130,4 +131,4 @@ module RubySMB
       end
     end
   end
-end
+end

data/lib/ruby_smb/client/signing.rb

@@ -1,9 +1,7 @@
 module RubySMB
   class Client
-
     # Contains the methods for handling packet signing
     module Signing
-
       # The NTLM Session Key used for signing
       # @!attribute [rw] session_key
       #   @return [String]
@@ -16,17 +14,15 @@ module RubySMB
       # @param packet [RubySMB::GenericPacket] the packet to sign
       # @return [RubySMB::GenericPacket] the packet, signed if needed
       def smb1_sign(packet)
-        if self.signing_required && !self.session_key.empty?
+        if signing_required && !session_key.empty?
           # Pack the Sequence counter into a int64le
-          packed_sequence_counter = [self.sequence_counter].pack('Q<')
+          packed_sequence_counter = [sequence_counter].pack('Q<')
           packet.smb_header.security_features = packed_sequence_counter
-          signature = OpenSSL::Digest::MD5.digest(self.session_key + packet.to_binary_s)[0,8]
+          signature = OpenSSL::Digest::MD5.digest(session_key + packet.to_binary_s)[0, 8]
           packet.smb_header.security_features = signature
           self.sequence_counter += 1
-          packet
-        else
-          packet
         end
+        packet
       end
 
       # Take an SMB2 packet and checks to see if it should be signed.
@@ -36,17 +32,14 @@ module RubySMB
       # @param packet [RubySMB::GenericPacket] the packet to sign
       # @return [RubySMB::GenericPacket] the packet, signed if needed
       def smb2_sign(packet)
-        if self.signing_required && !self.session_key.empty?
+        if signing_required && !session_key.empty?
           packet.smb2_header.flags.signed = 1
           packet.smb2_header.signature = "\x00" * 16
-          hmac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, self.session_key, packet.to_binary_s)
-          packet.smb2_header.signature = hmac[0,16]
-          packet
-        else
-          packet
+          hmac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, session_key, packet.to_binary_s)
+          packet.smb2_header.signature = hmac[0, 16]
         end
+        packet
       end
-
     end
   end
-end
+end