ruby_smb 1.0.0 → 1.1.0

data/lib/ruby_smb/client/winreg.rb

@@ -0,0 +1,46 @@
+module RubySMB
+  class Client
+    module Winreg
+
+      def connect_to_winreg(host)
+        share = "\\\\#{host}\\IPC$"
+        tree = @tree_connects.find {|tree| tree.share == share}
+        tree = tree_connect(share) unless tree
+        named_pipe = tree.open_file(filename: "winreg", write: true, read: true)
+        if block_given?
+          res = yield named_pipe
+          named_pipe.close
+          res
+        else
+          named_pipe
+        end
+      end
+
+      def has_registry_key?(host, key)
+        connect_to_winreg(host) do |named_pipe|
+          named_pipe.has_registry_key?(key)
+        end
+      end
+
+      def read_registry_key_value(host, key, value_name)
+        connect_to_winreg(host) do |named_pipe|
+          named_pipe.read_registry_key_value(key, value_name)
+        end
+      end
+
+      def enum_registry_key(host, key)
+        connect_to_winreg(host) do |named_pipe|
+          named_pipe.enum_registry_key(key)
+        end
+      end
+
+      def enum_registry_values(host, key)
+        connect_to_winreg(host) do |named_pipe|
+          named_pipe.enum_registry_values(key)
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/client.rb

@@ -8,6 +8,7 @@ module RubySMB
     require 'ruby_smb/client/tree_connect'
     require 'ruby_smb/client/echo'
     require 'ruby_smb/client/utils'
+    require 'ruby_smb/client/winreg'
 
     include RubySMB::Client::Negotiation
     include RubySMB::Client::Authentication
@@ -15,6 +16,7 @@ module RubySMB
     include RubySMB::Client::TreeConnect
     include RubySMB::Client::Echo
     include RubySMB::Client::Utils
+    include RubySMB::Client::Winreg
 
     # The Default SMB1 Dialect string used in an SMB1 Negotiate Request
     SMB1_DIALECT_SMB1_DEFAULT = 'NT LM 0.12'.freeze
@@ -297,15 +299,32 @@ module RubySMB
     # Sends a LOGOFF command to the remote server to terminate the session
     #
     # @return [WindowsError::ErrorCode] the NTStatus of the response
+    # @raise [RubySMB::Error::InvalidPacket] if the response packet is not a LogoffResponse packet
     def logoff!
       if smb2
         request      = RubySMB::SMB2::Packet::LogoffRequest.new
         raw_response = send_recv(request)
         response     = RubySMB::SMB2::Packet::LogoffResponse.read(raw_response)
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB2::Packet::LogoffResponse::COMMAND,
+            received_proto: response.smb2_header.protocol,
+            received_cmd:   response.smb2_header.command
+          )
+        end
       else
         request      = RubySMB::SMB1::Packet::LogoffRequest.new
         raw_response = send_recv(request)
         response     = RubySMB::SMB1::Packet::LogoffResponse.read(raw_response)
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB1::Packet::LogoffResponse::COMMAND,
+            received_proto: response.smb_header.protocol,
+            received_cmd:   response.smb_header.command
+          )
+        end
       end
       wipe_state!
       response.status_code
@@ -380,14 +399,19 @@ module RubySMB
     # @param name [String] the NetBIOS name to request
     # @return [TrueClass] if session request is granted
     # @raise [RubySMB::Error::NetBiosSessionService] if session request is refused
+    # @raise [RubySMB::Error::InvalidPacket] if the response packet is not a NBSS packet
     def session_request(name = '*SMBSERVER')
       session_request = session_request_packet(name)
       dispatcher.send_packet(session_request, nbss_header: false)
       raw_response = dispatcher.recv_packet(full_response: true)
-      session_header =  RubySMB::Nbss::SessionHeader.read(raw_response)
-      if session_header.session_packet_type == RubySMB::Nbss::NEGATIVE_SESSION_RESPONSE
-        negative_session_response =  RubySMB::Nbss::NegativeSessionResponse.read(raw_response)
-        raise RubySMB::Error::NetBiosSessionService, "Session Request failed: #{negative_session_response.error_msg}"
+      begin
+        session_header = RubySMB::Nbss::SessionHeader.read(raw_response)
+        if session_header.session_packet_type == RubySMB::Nbss::NEGATIVE_SESSION_RESPONSE
+          negative_session_response =  RubySMB::Nbss::NegativeSessionResponse.read(raw_response)
+          raise RubySMB::Error::NetBiosSessionService, "Session Request failed: #{negative_session_response.error_msg}"
+        end
+      rescue IOError
+        raise RubySMB::Error::InvalidPacket, 'Not a NBSS packet'
       end
 
       return true

data/lib/ruby_smb/dcerpc/bind.rb

@@ -35,8 +35,8 @@ module RubySMB
 
       pdu_header :pdu_header,        label: 'PDU header'
 
-      uint16 :max_xmit_frag,         label: 'max transmit frag size',    initial_value: 0xFFFF
-      uint16 :max_recv_frag,         label: 'max receive  frag size',    initial_value: 0xFFFF
+      uint16 :max_xmit_frag,         label: 'max transmit frag size',    initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
+      uint16 :max_recv_frag,         label: 'max receive  frag size',    initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
       uint32 :assoc_group_id,        label: 'ncarnation of client-server assoc group'
 
       p_cont_list_t :p_context_list, label: 'Presentation context list', endpoint: -> { endpoint }

data/lib/ruby_smb/dcerpc/bind_ack.rb

@@ -46,8 +46,8 @@ module RubySMB
 
       pdu_header :pdu_header,         label: 'PDU header'
 
-      uint16     :max_xmit_frag,      label: 'Max transmit frag size',  initial_value: 0xFFFF
-      uint16     :max_recv_frag,      label: 'Max receive frag size',   initial_value: 0xFFFF
+      uint16     :max_xmit_frag,      label: 'Max transmit frag size',  initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
+      uint16     :max_recv_frag,      label: 'Max receive frag size',   initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
       uint32     :assoc_group_id,     label: 'Association group ID'
       port_any_t :sec_addr,           label: 'Secondary address'
       string     :pad,                length: -> { pad_length }

data/lib/ruby_smb/dcerpc/error.rb

@@ -10,6 +10,9 @@ module RubySMB
 
       # Raised when an invalid packet is received
       class InvalidPacket < DcerpcError; end
+
+      # Raised when an error is returned during a Winreg operation
+      class WinregError < DcerpcError; end
     end
   end
 end

data/lib/ruby_smb/dcerpc/ndr.rb

@@ -7,36 +7,115 @@ module RubySMB
       VER_MAJOR = 2
       VER_MINOR = 0
 
-      class NdrString < BinData::Record
+      # An NDR Top-level Full Pointers representation as defined in
+      # [Transfer Syntax NDR - Top-level Full Pointers](http://pubs.opengroup.org/onlinepubs/9629399/chap14.htm#tagcjh_19_03_11_01)
+      # This class must be inherited and the subclass must have a #referent protperty
+      class NdrTopLevelFullPointer < BinData::Primitive
         endian :little
 
-        uint32    :max_count, initial_value: -> { str.length }
-        uint32    :offset, initial_value: 0
-        uint32    :actual_count, initial_value: -> { str.length }
-        stringz16 :str, read_length: -> { actual_count }
+        uint32 :referent_identifier, initial_value: 0x00020000
 
-        def assign(v)
-          self.max_count = v.size
-          self.actual_count = v.size
-          self.str = v
+        def get
+          is_a_null_pointer? ? 0 : self.referent
+        end
+
+        def set(v)
+          if v.is_a?(Integer) && v == 0
+            self.referent_identifier = 0
+          else
+            self.referent = v
+          end
+        end
+
+        def is_a_null_pointer?
+          self.referent_identifier == 0
         end
       end
 
-      class NdrLpStr < BinData::Record
+      # An NDR Conformant and Varying String representation as defined in
+      # [Transfer Syntax NDR - Conformant and Varying Strings](http://pubs.opengroup.org/onlinepubs/9629399/chap14.htm#tagcjh_19_03_04_02)
+      # The string elements are Stringz16 (unicode)
+      class NdrString < BinData::Primitive
         endian :little
 
-        uint32     :referent_identifier
-        ndr_string :ndr_str
+        uint32    :max_count
+        uint32    :offset,     initial_value: 0
+        uint32    :actual_count
+        stringz16 :str,        read_length: -> { actual_count }, onlyif: -> { actual_count > 0 }
 
-        def assign(v)
-          self.ndr_str = v
+        def get
+          self.actual_count == 0 ? 0 : self.str
         end
 
+        def set(v)
+          if v.is_a?(Integer) && v == 0
+            self.actual_count = 0
+          else
+            self.str = v
+            self.max_count = self.actual_count = str.to_binary_s.size / 2
+          end
+        end
+      end
+
+      # A pointer to a NdrString structure
+      class NdrLpStr < NdrTopLevelFullPointer
+        endian :little
+
+        ndr_string :referent, onlyif: -> { !is_a_null_pointer? }
+
         def to_s
-          self.ndr_str.str
+          is_a_null_pointer? ? "\0" : self.referent
+        end
+      end
+
+      # An NDR Context Handle representation as defined in
+      # [IDL Data Type Declarations - Basic Type Declarations](http://pubs.opengroup.org/onlinepubs/9629399/apdxn.htm#tagcjh_34_01)
+      class NdrContextHandle < BinData::Primitive
+        endian :little
+        uint32 :context_handle_attributes
+        uuid   :context_handle_uuid
+
+        def get
+          {:context_handle_attributes => context_handle_attributes, :context_handle_uuid => context_handle_uuid}
         end
+
+        def set(handle)
+          if handle.is_a?(Hash)
+            self.context_handle_attributes = handle[:context_handle_attributes]
+            self.context_handle_uuid = handle[:context_handle_uuid]
+          elsif handle.is_a?(NdrContextHandle)
+            read(handle.to_binary_s)
+          else
+            read(handle.to_s)
+          end
+        end
+      end
+
+      # A pointer to a DWORD
+      class NdrLpDword < NdrTopLevelFullPointer
+        endian :little
+
+        uint32 :referent, onlyif: -> { !is_a_null_pointer? }
+      end
+
+      # An NDR Uni-dimensional Conformant-varying Arrays representation as defined in:
+      # [Transfer Syntax NDR - NDR Constructed Types](http://pubs.opengroup.org/onlinepubs/9629399/chap14.htm#tagcjh_19_03_03_04)
+      class NdrLpByte < BinData::Record
+        endian :little
+
+        uint32 :referent_identifier, initial_value: 0x00020000
+        uint32 :max_count,           initial_value: -> { actual_count }, onlyif: -> { referent_identifier != 0 }
+        uint32 :offset,              initial_value: 0,                   onlyif: -> { referent_identifier != 0 }
+        uint32 :actual_count,        initial_value: -> { bytes.size },   onlyif: -> { referent_identifier != 0 }
+        array  :bytes, :type => :uint8, initial_length: -> { actual_count }, onlyif: -> { referent_identifier != 0 }
+      end
+
+      # A pointer to a Windows FILETIME structure
+      class NdrLpFileTime < NdrTopLevelFullPointer
+        endian :little
+
+        file_time :referent, onlyif: -> { !is_a_null_pointer? }
       end
     end
   end
-
 end

data/lib/ruby_smb/dcerpc/pdu_header.rb

@@ -21,7 +21,7 @@ module RubySMB
       end
 
       uint32 :packed_drep, label: 'NDR data representation format label', initial_value: 0x10
-      uint16 :frag_length, label: 'Total length of fragment',             initial_value: -> { parent.do_num_bytes }
+      uint16 :frag_length, label: 'Total length of fragment',             initial_value: -> { parent.num_bytes }
       uint16 :auth_length, label: 'Length of auth_value'
       uint32 :call_id,     label: 'Call identifier',                      initial_value: 1
     end

data/lib/ruby_smb/dcerpc/request.rb

@@ -6,19 +6,38 @@ module RubySMB
       endian :little
 
       pdu_header :pdu_header, label: 'PDU header'
+      uint32     :alloc_hint, label: 'Allocation hint', initial_value: -> { stub.num_bytes }
+      uint16     :p_cont_id,  label: 'Presentation context identification'
+      uint16     :opnum,      label: 'Operation Number'
+      uuid       :object,     label: 'Object UID', onlyif: -> { pdu_header.pfc_flags.object_uuid == 1 }
 
-      uint32 :alloc_hint,     label: 'Allocation hint',  initial_value: -> { stub.do_num_bytes }
-      uint16 :p_cont_id,      label: 'Presentation context identification'
-      uint16 :opnum,          label: 'Operation Number'
-
-      uuid   :object,         label: 'Object UID',      onlyif: -> { pdu_header.pfc_flags.object_uuid == 1 }
-
-      choice :stub, label: 'Stub', selection: -> { opnum } do
-        net_share_enum_all RubySMB::Dcerpc::Srvsvc::NET_SHARE_ENUM_ALL, host: -> { host }
+      choice :stub, label: 'Stub', selection: -> { @obj.parent.get_parameter(:endpoint) || '' } do
+        choice 'Winreg', selection: -> { opnum } do
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKCR, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKCR
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKCU, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKCU
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKLM, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKPD, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKPD
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKU,  opnum: RubySMB::Dcerpc::Winreg::OPEN_HKU
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKCC, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKCC
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKPT, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKPT
+          open_root_key_request  RubySMB::Dcerpc::Winreg::OPEN_HKPN, opnum: RubySMB::Dcerpc::Winreg::OPEN_HKPN
+          close_key_request      RubySMB::Dcerpc::Winreg::REG_CLOSE_KEY
+          enum_key_request       RubySMB::Dcerpc::Winreg::REG_ENUM_KEY
+          enum_value_request     RubySMB::Dcerpc::Winreg::REG_ENUM_VALUE
+          open_key_request       RubySMB::Dcerpc::Winreg::REG_OPEN_KEY
+          query_info_key_request RubySMB::Dcerpc::Winreg::REG_QUERY_INFO_KEY
+          query_value_request    RubySMB::Dcerpc::Winreg::REG_QUERY_VALUE
+          string                 :default
+        end
+        choice 'Srvsvc', selection: -> { opnum } do
+          net_share_enum_all RubySMB::Dcerpc::Srvsvc::NET_SHARE_ENUM_ALL, host: -> { host rescue '' }
+          string             :default
+        end
+        string :default
       end
 
       string :auth_verifier, label: 'Authentication verifier',
-        onlyif: -> { pdu_header.auth_length > 0 },
+        onlyif:      -> { pdu_header.auth_length > 0 },
         read_length: -> { pdu_header.auth_length }
 
       def initialize_instance

data/lib/ruby_smb/dcerpc/rrp_unicode_string.rb

@@ -0,0 +1,35 @@
+require 'ruby_smb/dcerpc/ndr'
+
+module RubySMB
+  module Dcerpc
+
+    # A RRP_UNICODE_STRING structure as defined in
+    # [2.2.4 RRP_UNICODE_STRING](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/c0c90f11-a4c4-496a-ac09-8a8a3697ceef)
+    class RrpUnicodeString < BinData::Primitive
+      endian :little
+
+      uint16     :buffer_length,  initial_value: -> { buffer.to_s == "\0" ? 0 : buffer.actual_count * 2 }
+      uint16     :maximum_length, initial_value: -> { buffer.to_s == "\0" ? 0 : buffer.max_count * 2 }
+      ndr_lp_str :buffer
+
+      def get
+        self.buffer
+      end
+
+      def set(buf)
+        self.buffer = buf
+        self.buffer_length = self.buffer.to_s == "\0" ? 0 : self.buffer.actual_count * 2
+        self.maximum_length = self.buffer.to_s == "\0" ? 0 : self.buffer.max_count * 2
+      end
+    end
+
+    # A pointer to a RRP_UNICODE_STRING structure
+    class PrrpUnicodeString < Ndr::NdrTopLevelFullPointer
+      endian :little
+
+      rrp_unicode_string :referent, onlyif: -> { !is_a_null_pointer? }
+    end
+
+  end
+end
+

data/lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all.rb

@@ -5,6 +5,10 @@ module RubySMB
       #https://msdn.microsoft.com/en-us/library/cc247293.aspx
 
       class NetShareEnumAll < BinData::Record
+        attr_reader :opnum
+
+        mandatory_parameter :host
+
         endian :little
 
         uint32    :referent_id,  initial_value: 0x00000001
@@ -27,6 +31,11 @@ module RubySMB
         uint32 :resume_referent_id, initial_value: 0x00000001
         uint32 :resume_handle,    initial_value: 0
 
+        def initialize_instance
+          super
+          @opnum = NET_SHARE_ENUM_ALL
+        end
+
         def pad_length
           offset = (server_unc.abs_offset + server_unc.to_binary_s.length) % 4
           (4 - offset) % 4

data/lib/ruby_smb/dcerpc/srvsvc.rb

@@ -10,6 +10,16 @@ module RubySMB
       NET_SHARE_ENUM_ALL = 0xF
 
       require 'ruby_smb/dcerpc/srvsvc/net_share_enum_all'
+
+      def net_share_enum_all(host)
+        bind(endpoint: RubySMB::Dcerpc::Srvsvc)
+
+        net_share_enum_all_request_packet = RubySMB::Dcerpc::Srvsvc::NetShareEnumAll.new(host: host)
+        response = dcerpc_request(net_share_enum_all_request_packet)
+
+        shares = RubySMB::Dcerpc::Srvsvc::NetShareEnumAll.parse_response(response)
+        shares.map{|s|{name: s[0], type: s[1], comment: s[2]}}
+      end
     end
   end
 end

data/lib/ruby_smb/dcerpc/winreg/close_key_request.rb

@@ -0,0 +1,24 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCloseKey Request Packet as defined in
+      # [3.1.5.6 BaseRegCloseKey (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc7545ff-0a54-4465-a95a-396b5c2995df)
+      class CloseKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey  :hkey
+
+        def initialize_instance
+          super
+          @opnum = REG_CLOSE_KEY
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/close_key_response.rb

@@ -0,0 +1,27 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCloseKey Response Packet as defined in
+      # [3.1.5.6 BaseRegCloseKey (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc7545ff-0a54-4465-a95a-396b5c2995df)
+      class CloseKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey  :hkey
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CLOSE_KEY
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/enum_key_request.rb

@@ -0,0 +1,45 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumKey Request Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey            :hkey
+        uint32              :dw_index
+        rrp_unicode_string  :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_key_response.rb

@@ -0,0 +1,42 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumKey Response Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string  :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class, initial_value: 0
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+        uint32              :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_request.rb

@@ -0,0 +1,39 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumValue Request Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        uint32             :dw_index
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_response.rb

@@ -0,0 +1,36 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumValue Response Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+