ruby_smb 0.0.18 → 0.0.19

data/lib/ruby_smb/fscc/file_information/file_full_directory_information.rb

@@ -0,0 +1,26 @@
+module RubySMB
+  module Fscc
+    module FileInformation
+      # The FileFullDirectoryInformation Class as defined in
+      # [2.4.14 FileFullDirectoryInformation](https://msdn.microsoft.com/en-us/library/cc232068.aspx)
+      class FileFullDirectoryInformation < BinData::Record
+        CLASS_LEVEL = FileInformation::FILE_FULL_DIRECTORY_INFORMATION
+
+        endian :little
+
+        uint32           :next_offset,      label: 'Next Entry Offset'
+        uint32           :file_index,       label: 'File Index'
+        file_time        :create_time,      label: 'Create Time'
+        file_time        :last_access,      label: 'Last Accessed Time'
+        file_time        :last_write,       label: 'Last Write Time'
+        file_time        :last_change,      label: 'Last Modified Time'
+        uint64           :end_of_file,      label: 'End of File'
+        uint64           :allocation_size,  label: 'Allocated Size'
+        file_attributes  :file_attributes,  label: 'File Attributes'
+        uint32           :file_name_length, label: 'File Name Length', initial_value: -> { file_name.do_num_bytes }
+        uint32           :ea_size,          label: 'Extended Attributes Size'
+        string16         :file_name,        label: 'File Name', read_length: -> { file_name_length }
+      end
+    end
+  end
+end

data/lib/ruby_smb/fscc/file_information/file_id_both_directory_information.rb

@@ -0,0 +1,31 @@
+module RubySMB
+  module Fscc
+    module FileInformation
+      # The FileIdBothDirectoryInformation Class as defined in
+      # [2.4.17 FileIdBothDirectoryInformation](https://msdn.microsoft.com/en-us/library/cc232070.aspx)
+      class FileIdBothDirectoryInformation < BinData::Record
+        CLASS_LEVEL = FileInformation::FILE_ID_BOTH_DIRECTORY_INFORMATION
+
+        endian :little
+
+        uint32           :next_offset,        label: 'Next Entry Offset'
+        uint32           :file_index,         label: 'File Index'
+        file_time        :create_time,        label: 'Create Time'
+        file_time        :last_access,        label: 'Last Accessed Time'
+        file_time        :last_write,         label: 'Last Write Time'
+        file_time        :last_change,        label: 'Last Modified Time'
+        uint64           :end_of_file,        label: 'End of File'
+        uint64           :allocation_size,    label: 'Allocated Size'
+        file_attributes  :file_attributes,    label: 'File Attributes'
+        uint32           :file_name_length,   label: 'File Name Length', initial_value: -> { file_name.do_num_bytes }
+        uint32           :ea_size,            label: 'Extended Attributes Size'
+        uint8            :short_name_length,  label: 'Short Name Length'
+        uint8            :reserved,           label: 'Reserved Space'
+        string16         :short_name,         label: 'File Short Name', length: 24
+        uint16           :reserved2,          label: 'Reserved Space'
+        uint64           :file_id,            label: 'File Id'
+        string16         :file_name,          label: 'File Name', read_length: -> { file_name_length }
+      end
+    end
+  end
+end

data/lib/ruby_smb/fscc/file_information/file_id_full_directory_information.rb

@@ -0,0 +1,28 @@
+module RubySMB
+  module Fscc
+    module FileInformation
+      # The FileIdDirectoryInformation Class as defined in
+      # [2.4.18 FileIdFullDirectoryInformation](https://msdn.microsoft.com/en-us/library/cc232071.aspx)
+      class FileIdFullDirectoryInformation < BinData::Record
+        CLASS_LEVEL = FileInformation::FILE_ID_FULL_DIRECTORY_INFORMATION
+
+        endian :little
+
+        uint32           :next_offset,      label: 'Next Entry Offset'
+        uint32           :file_index,       label: 'File Index'
+        file_time        :create_time,      label: 'Create Time'
+        file_time        :last_access,      label: 'Last Accessed Time'
+        file_time        :last_write,       label: 'Last Write Time'
+        file_time        :last_change,      label: 'Last Modified Time'
+        uint64           :end_of_file,      label: 'End of File'
+        uint64           :allocation_size,  label: 'Allocated Size'
+        file_attributes  :file_attributes,  label: 'File Attributes'
+        uint32           :file_name_length, label: 'File Name Length', initial_value: -> { file_name.do_num_bytes }
+        uint32           :ea_size,          label: 'Extended Attributes Size'
+        uint32           :reserved,         label: 'Reserved Space'
+        uint64           :file_id,          label: 'File ID'
+        string16         :file_name,        label: 'File Name', read_length: -> { file_name_length }
+      end
+    end
+  end
+end

data/lib/ruby_smb/fscc/file_information/file_names_information.rb

@@ -0,0 +1,18 @@
+module RubySMB
+  module Fscc
+    module FileInformation
+      # The FileNamesInformation Class as defined in
+      # [2.4.26 FileNamesInformation](https://msdn.microsoft.com/en-us/library/cc232077.aspx)
+      class FileNamesInformation < BinData::Record
+        CLASS_LEVEL = FileInformation::FILE_NAMES_INFORMATION
+
+        endian :little
+
+        uint32           :next_offset,      label: 'Next Entry Offset'
+        uint32           :file_index,       label: 'File Index'
+        uint32           :file_name_length, label: 'File Name Length',  initial_value: -> { file_name.do_num_bytes }
+        string16         :file_name,        label: 'File Name',         read_length: -> { file_name_length }
+      end
+    end
+  end
+end

data/lib/ruby_smb/fscc/file_information/file_rename_information.rb

@@ -0,0 +1,44 @@
+module RubySMB
+  module Fscc
+    module FileInformation
+      # The FileRenameInformation Class as defined in
+      # [2.4.34.2 FileRenameInformation](https://msdn.microsoft.com/en-us/library/cc704597.aspx)
+      class FileRenameInformation < BinData::Record
+        CLASS_LEVEL = FileInformation::FILE_ID_FULL_DIRECTORY_INFORMATION
+
+        endian :little
+
+        uint8  :replace_if_exists, label: 'Replace If Exists'
+
+        choice :reserved, selection: -> { get_smb_version } do
+          uint24 1, label: 'Reserved Space'
+          uint56 2, label: 'Reserved Space'
+        end
+
+        choice :root_directory, selection: -> { get_smb_version } do
+          uint32 1, label: 'Root Directory', initial_value: 0
+          uint64 2, label: 'Root Directory', initial_value: 0
+        end
+
+        uint32 :file_name_length, label: 'File Name Length', initial_value: -> { file_name.do_num_bytes }
+        string :file_name,        label: 'File Name',        read_length: -> { file_name_length }
+
+        def get_smb_version(obj = self)
+          # Return version 1 by default in case the structure is not part of a
+          # SMB packet. This way, we can still instantiate this structure
+          # independently without breaking the "choice" logic.
+          return 1 if obj.nil?
+          smb_version = if obj.respond_to?(:smb_header)
+                          1
+                        elsif obj.respond_to?(:smb2_header)
+                          2
+                        else
+                          get_smb_version(obj.parent)
+                        end
+          return smb_version
+        end
+
+      end
+    end
+  end
+end

data/lib/ruby_smb/generic_packet.rb

@@ -21,16 +21,38 @@ module RubySMB
       display_str
     end
 
-
     def packet_smb_version
       class_name = self.class.to_s
       case class_name
-        when /SMB1/
-          'SMB1'
-        when /SMB2/
-          'SMB2'
-        else
-          ''
+      when /SMB1/
+        'SMB1'
+      when /SMB2/
+        'SMB2'
+      else
+        ''
+      end
+    end
+
+    # Overrides the class #read method with some automatic
+    # exception handling. If an {EOFError} is thrown, it will try
+    # to read the data into the protocol specific empty ErrorPacket
+    # so that the NTstatus code can be read. We re-raise the exception
+    # in the event that it is not an SMB1 or SMB2 packet, or if it is
+    # already an error packet.
+    def self.read(val)
+      begin
+        super(val)
+      rescue EOFError => e
+        case self.to_s
+          when /EmptyPacket|ErrorPacket/
+            raise e
+          when /SMB1/
+            RubySMB::SMB1::Packet::EmptyPacket.read(val)
+          when /SMB2/
+            RubySMB::SMB2::Packet::ErrorPacket.read(val)
+          else
+            raise e
+        end
       end
     end
 
@@ -38,10 +60,10 @@ module RubySMB
       value = -1
       smb_version = packet_smb_version
       case smb_version
-        when 'SMB1'
-          value = self.smb_header.nt_status.value
-        when 'SMB2'
-          value = self.smb2_header.nt_status.value
+      when 'SMB1'
+        value = smb_header.nt_status.value
+      when 'SMB2'
+        value = smb2_header.nt_status.value
       end
       status_code = WindowsError::NTStatus.find_by_retval(value).first
       if status_code.nil?
@@ -50,8 +72,6 @@ module RubySMB
       status_code
     end
 
-    private
-
     # Returns an array of hashes representing the
     # fields for this record.
     #
@@ -77,7 +97,7 @@ module RubySMB
         name.capitalize!
       end
       formatted_name = "\n" + ("\t" * depth) + name
-      formatted_string = sprintf '%-30s %-10s %s', formatted_name, class_str, field[:label]
+      formatted_string = format '%-30s %-10s %s', formatted_name, class_str, field[:label]
       field[:fields].each do |sub_field|
         formatted_string << format_field(sub_field, (depth + 1))
       end
@@ -110,6 +130,8 @@ module RubySMB
       field_hashes
     end
 
+    private
+
     # Takes a hash representation of a field in the packet structure and formats it
     # into a string representing the contents of that field.
     #
@@ -135,8 +157,8 @@ module RubySMB
           if field[:class].ancestors.include? BinData::Record
             field_str = label
           else
-            value = self.send(name)
-            field_str = sprintf '%-30s %s', label, value
+            value = send(name)
+            field_str = format '%-30s %s', label, value
           end
         else
           parent = self
@@ -146,7 +168,7 @@ module RubySMB
           value = parent.send(name)
           label = field[:label] || name.to_s.capitalize
           label = "\n" + ("\t" * depth) + label
-          field_str = sprintf '%-30s %s', label, value
+          field_str = format '%-30s %s', label, value
         end
       end
       my_parents << name
@@ -173,7 +195,7 @@ module RubySMB
           value = sub_field.send(name)
           label ||= name
           label = "\n" + "\t" * depth + label
-          sub_field_str = sprintf '%-30s %s', label, value
+          sub_field_str = format '%-30s %s', label, value
           array_field_str << sub_field_str
         end
       end

data/lib/ruby_smb/gss.rb

@@ -1,27 +1,25 @@
 module RubySMB
-
   # module containing methods required for using the [GSS-API](http://www.rfc-editor.org/rfc/rfc2743.txt)
   # for Secure Protected Negotiation(SPNEGO) in SMB Authentication.
   module Gss
-
     # Cargo culted from Rex. Hacked Together ASN1 encoding that works for our GSS purposes
     # @todo Document these magic numbers
     def self.asn1encode(str = '')
       # If the high bit of the first byte is 1, it contains the number of
       # length bytes that follow
       case str.length
-        when 0..0x7F
-          encoded_string = [str.length].pack('C') + str
-        when 0x80..0xFF
-          encoded_string = [0x81, str.length].pack('CC') + str
-        when 0x100..0xFFFF
-          encoded_string = [0x82, str.length].pack('Cn') + str
-        when  0x10000..0xffffff
-          encoded_string = [0x83, str.length >> 16, str.length & 0xFFFF].pack('CCn') + str
-        when  0x1000000..0xffffffff
-          encoded_string = [0x84, str.length].pack('CN') + str
-        else
-          raise RubySMB::Error::ASN1Encoding, "Source string is too long. Size is #{str.length}"
+      when 0..0x7F
+        encoded_string = [str.length].pack('C') + str
+      when 0x80..0xFF
+        encoded_string = [0x81, str.length].pack('CC') + str
+      when 0x100..0xFFFF
+        encoded_string = [0x82, str.length].pack('Cn') + str
+      when  0x10000..0xffffff
+        encoded_string = [0x83, str.length >> 16, str.length & 0xFFFF].pack('CCn') + str
+      when  0x1000000..0xffffffff
+        encoded_string = [0x84, str.length].pack('CN') + str
+      else
+        raise RubySMB::Error::ASN1Encoding, "Source string is too long. Size is #{str.length}"
       end
       encoded_string
     end
@@ -29,71 +27,69 @@ module RubySMB
     # Create a GSS Security Blob of an NTLM Type 1 Message.
     # This code has been cargo culted and needs to be researched
     # and refactored into something better later.
-    #@todo Refactor this into non-magical code
+    # @todo Refactor this into non-magical code
     def self.gss_type1(type1)
-      "\x60".force_encoding("binary") + self.asn1encode(
-        "\x06".force_encoding("binary") + self.asn1encode(
-          "\x2b\x06\x01\x05\x05\x02".force_encoding("binary")
+      "\x60".force_encoding('binary') + asn1encode(
+        "\x06".force_encoding('binary') + asn1encode(
+          "\x2b\x06\x01\x05\x05\x02".force_encoding('binary')
         ) +
-          "\xa0".force_encoding("binary") + self.asn1encode(
-          "\x30".force_encoding("binary") + self.asn1encode(
-            "\xa0".force_encoding("binary") + self.asn1encode(
-              "\x30".force_encoding("binary") + self.asn1encode(
-                "\x06".force_encoding("binary") + self.asn1encode(
-                  "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a".force_encoding("binary")
+          "\xa0".force_encoding('binary') + asn1encode(
+            "\x30".force_encoding('binary') + asn1encode(
+              "\xa0".force_encoding('binary') + asn1encode(
+                "\x30".force_encoding('binary') + asn1encode(
+                  "\x06".force_encoding('binary') + asn1encode(
+                    "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a".force_encoding('binary')
+                  )
+                )
+              ) +
+                "\xa2".force_encoding('binary') + asn1encode(
+                  "\x04".force_encoding('binary') + asn1encode(
+                    type1
+                  )
                 )
-              )
-            ) +
-              "\xa2".force_encoding("binary") + self.asn1encode(
-              "\x04".force_encoding("binary") + self.asn1encode(
-                type1
-              )
             )
           )
-        )
       )
     end
 
-
     # Create a GSS Security Blob of an NTLM Type 2 Message.
     # This code has been cargo culted and needs to be researched
     # and refactored into something better later.
     def self.gss_type2(type2)
-
       blob =
-        "\xa1" + self.asn1encode(
-          "\x30" + self.asn1encode(
-            "\xa0" + self.asn1encode(
-              "\x0a" + self.asn1encode(
+        "\xa1" + asn1encode(
+          "\x30" + asn1encode(
+            "\xa0" + asn1encode(
+              "\x0a" + asn1encode(
                 "\x01"
               )
             ) +
-              "\xa1" + self.asn1encode(
-              "\x06" + self.asn1encode(
-                "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"
-              )
-            ) +
-              "\xa2" + self.asn1encode(
-              "\x04" + self.asn1encode(
-                type2
+              "\xa1" + asn1encode(
+                "\x06" + asn1encode(
+                  "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"
+                )
+              ) +
+              "\xa2" + asn1encode(
+                "\x04" + asn1encode(
+                  type2
+                )
               )
-            )
           )
         )
 
-      return blob
+      blob
     end
 
     # Create a GSS Security Blob of an NTLM Type 3 Message.
     # This code has been cargo culted and needs to be researched
     # and refactored into something better later.
-    #@todo Refactor this into non-magical code
+    # @todo Refactor this into non-magical code
     def self.gss_type3(type3)
       gss =
-        "\xa1".force_encoding("binary") + self.asn1encode(
-          "\x30".force_encoding("binary") + self.asn1encode(
-            "\xa2".force_encoding("binary") + self.asn1encode(
-              "\x04".force_encoding("binary") + self.asn1encode(
+        "\xa1".force_encoding('binary') + asn1encode(
+          "\x30".force_encoding('binary') + asn1encode(
+            "\xa2".force_encoding('binary') + asn1encode(
+              "\x04".force_encoding('binary') + asn1encode(
                 type3
               )
             )
@@ -102,8 +98,5 @@ module RubySMB
 
       gss
     end
-
-
-
   end
-end
+end

data/lib/ruby_smb/impersonation_levels.rb

@@ -1,6 +1,7 @@
 module RubySMB
   # Contains constants for the various Impersonation levels as defined in
-  # [2.2.4.64.1 Request](https://msdn.microsoft.com/en-us/library/ee442175.aspx)
+  # [2.2.4.64.1 Request](https://msdn.microsoft.com/en-us/library/ee442175.aspx) and
+  # [2.2.4.9.1 Client Request Extensions](https://msdn.microsoft.com/en-us/library/cc246332.aspx)
   # See also [Impersonation Levels](https://msdn.microsoft.com/en-us/library/ms686632(v=vs.85).aspx)
   module ImpersonationLevels
     # The client is anonymous to the server. The server process can impersonate the client, but the impersonation
@@ -18,5 +19,9 @@ module RubySMB
     # that are on the same computer as the server.
     SEC_IMPERSONATE = 0x00000002
 
+    # The most powerful impersonation level. When this level is selected, the server (whether local or remote)
+    # can impersonate the client's security context while acting on behalf of the client. During impersonation,
+    # the client's credentials (both local and network) can be passed to any number of computers.
+    SEC_DELEGATE    = 0x00000003
   end
-end
+end

data/lib/ruby_smb/nbss.rb

@@ -0,0 +1,16 @@
+module RubySMB
+  # Namespace for all of the NetBIOS packets used by RubySMB
+  module Nbss
+    # Session Packet Types
+    SESSION_MESSAGE           = 0x00
+    SESSION_REQUEST           = 0x81
+    POSITIVE_SESSION_RESPONSE = 0x82
+    NEGATIVE_SESSION_RESPONSE = 0x83
+    RETARGET_SESSION_RESPONSE = 0x84
+    SESSION_KEEP_ALIVE        = 0x85
+
+    require 'ruby_smb/nbss/session_header'
+    require 'ruby_smb/nbss/session_request'
+    require 'ruby_smb/nbss/negative_session_response'
+  end
+end