ruby_smb 1.0.0 → 1.1.0

data/lib/ruby_smb/smb2/pipe.rb

@@ -3,18 +3,29 @@ module RubySMB
     # Represents a pipe on the Remote server that we can perform
     # various I/O operations on.
     class Pipe < File
-      require 'ruby_smb/smb2/dcerpc'
+      require 'ruby_smb/dcerpc'
 
-      include RubySMB::SMB2::Dcerpc
+      include RubySMB::Dcerpc
 
       STATUS_CONNECTED = 0x00000003
       STATUS_CLOSING   = 0x00000004
 
+      def initialize(tree:, response:, name:)
+        raise ArgumentError, 'No Name Provided' if name.nil?
+        case name
+        when 'srvsvc'
+          extend RubySMB::Dcerpc::Srvsvc
+        when 'winreg'
+          extend RubySMB::Dcerpc::Winreg
+        end
+        super(tree: tree, response: response, name: name)
+      end
+
       # Performs a peek operation on the named pipe
       #
       # @param peek_size [Integer] Amount of data to peek
       # @return [RubySMB::SMB2::Packet::IoctlResponse]
-      # @raise [RubySMB::Error::InvalidPacket] if not a valid FSCTL_PIPE_PEEK response
+      # @raise [RubySMB::Error::InvalidPacket] if not a valid FIoctlResponse response
       # @raise [RubySMB::Error::UnexpectedStatusCode] If status is not STATUS_BUFFER_OVERFLOW or STATUS_SUCCESS
       def peek(peek_size: 0)
         packet = RubySMB::SMB2::Packet::IoctlRequest.new
@@ -24,19 +35,19 @@ module RubySMB
         packet.max_output_response = 16 + peek_size
         packet = set_header_fields(packet)
         raw_response = @tree.client.send_recv(packet)
-        begin
-          response = RubySMB::SMB2::Packet::IoctlResponse.read(raw_response)
-        rescue IOError
-          response = RubySMB::SMB2::Packet::ErrorPacket.read(raw_response)
+        response = RubySMB::SMB2::Packet::IoctlResponse.read(raw_response)
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB2::Packet::IoctlResponse::COMMAND,
+            received_proto: response.smb2_header.protocol,
+            received_cmd:   response.smb2_header.command
+          )
         end
 
         unless response.status_code == WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW or response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
           raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
         end
-
-        unless response.smb2_header.command == RubySMB::SMB2::Commands::IOCTL
-          raise RubySMB::Error::InvalidPacket, 'Not an IoctlResponse packet'
-        end
         response
       end
 
@@ -67,6 +78,82 @@ module RubySMB
         state == STATUS_CONNECTED
       end
 
+      def dcerpc_request(stub_packet, options={})
+        options.merge!(endpoint: stub_packet.class.name.split('::').at(-2))
+        dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: stub_packet.opnum }, options)
+        dcerpc_request.stub.read(stub_packet.to_binary_s)
+        ioctl_send_recv(dcerpc_request, options)
+      end
+
+      def ioctl_send_recv(action, options={})
+        request = set_header_fields(RubySMB::SMB2::Packet::IoctlRequest.new(options))
+        request.ctl_code = 0x0011C017
+        request.flags.is_fsctl = 0x00000001
+        request.buffer = action.to_binary_s
+
+        ioctl_raw_response = @tree.client.send_recv(request)
+        ioctl_response = RubySMB::SMB2::Packet::IoctlResponse.read(ioctl_raw_response)
+        unless ioctl_response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB2::Packet::IoctlRequest::COMMAND,
+            received_proto: ioctl_response.smb2_header.protocol,
+            received_cmd:   ioctl_response.smb2_header.command
+          )
+        end
+        # TODO: improve the handling of STATUS_PENDING responses
+        if ioctl_response.status_code == WindowsError::NTStatus::STATUS_PENDING
+          sleep 1
+          ioctl_raw_response = @tree.client.dispatcher.recv_packet
+          ioctl_response = RubySMB::SMB2::Packet::IoctlResponse.read(ioctl_raw_response)
+          unless ioctl_response.valid?
+            raise RubySMB::Error::InvalidPacket.new(
+              expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+              expected_cmd:   RubySMB::SMB2::Packet::IoctlRequest::COMMAND,
+              received_proto: ioctl_response.smb2_header.protocol,
+              received_cmd:   ioctl_response.smb2_header.command
+            )
+          end
+        elsif ![WindowsError::NTStatus::STATUS_SUCCESS,
+                WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW].include?(ioctl_response.status_code)
+          raise RubySMB::Error::UnexpectedStatusCode, ioctl_response.status_code.name
+        end
+
+        raw_data = ioctl_response.output_data
+        if ioctl_response.status_code == WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW
+          raw_data << read(bytes: @tree.client.max_buffer_size - ioctl_response.output_count)
+          dcerpc_response = dcerpc_response_from_raw_response(raw_data)
+          unless dcerpc_response.pdu_header.pfc_flags.first_frag == 1
+            raise RubySMB::Dcerpc::Error::InvalidPacket, "Not the first fragment"
+          end
+          stub_data = dcerpc_response.stub.to_s
+
+          loop do
+            break if dcerpc_response.pdu_header.pfc_flags.last_frag == 1
+            raw_data = read(bytes: @tree.client.max_buffer_size)
+            dcerpc_response = dcerpc_response_from_raw_response(raw_data)
+            stub_data << dcerpc_response.stub.to_s
+          end
+          stub_data
+        else
+          dcerpc_response = dcerpc_response_from_raw_response(raw_data)
+          dcerpc_response.stub.to_s
+        end
+      end
+
+
+      private
+
+      def dcerpc_response_from_raw_response(raw_data)
+        dcerpc_response = RubySMB::Dcerpc::Response.read(raw_data)
+        unless dcerpc_response.pdu_header.ptype == RubySMB::Dcerpc::PTypes::RESPONSE
+          raise RubySMB::Dcerpc::Error::InvalidPacket, "Not a Response packet"
+        end
+        dcerpc_response
+      rescue IOError
+        raise RubySMB::Dcerpc::Error::InvalidPacket, "Error reading the DCERPC response"
+      end
+
     end
   end
 end

data/lib/ruby_smb/smb2/tree.rb

@@ -34,11 +34,20 @@ module RubySMB
       # Disconnects this Tree from the current session
       #
       # @return [WindowsError::ErrorCode] the NTStatus sent back by the server.
+      # @raise [RubySMB::Error::InvalidPacket] if the response is not a TreeDisconnectResponse packet
       def disconnect!
         request = RubySMB::SMB2::Packet::TreeDisconnectRequest.new
         request = set_header_fields(request)
         raw_response = client.send_recv(request)
         response = RubySMB::SMB2::Packet::TreeDisconnectResponse.read(raw_response)
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB2::Packet::TreeDisconnectResponse::COMMAND,
+            received_proto: response.smb2_header.protocol,
+            received_cmd:   response.smb2_header.command
+          )
+        end
         response.status_code
       end
 
@@ -89,9 +98,16 @@ module RubySMB
 
         raw_response  = client.send_recv(create_request)
         response      = RubySMB::SMB2::Packet::CreateResponse.read(raw_response)
-
-        if response.is_a?(RubySMB::SMB2::Packet::ErrorPacket)
-          raise RubySMB::Error::RubySMBError
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB2::Packet::CreateResponse::COMMAND,
+            received_proto: response.smb2_header.protocol,
+            received_cmd:   response.smb2_header.command
+          )
+        end
+        unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
         end
 
         case @share_type
@@ -102,7 +118,7 @@ module RubySMB
         # when 0x03
         #   it's a printer!
         else
-          raise RubySMB::Error::RubySMBError
+          raise RubySMB::Error::RubySMBError, 'Unsupported share type'
         end
       end
 
@@ -116,6 +132,7 @@ module RubySMB
       # @param pattern [String] search pattern
       # @param type [Class] file information class
       # @return [Array] array of directory structures
+      # @raise [RubySMB::Error::InvalidPacket] if the response is not a QueryDirectoryResponse packet
       def list(directory: nil, pattern: '*', type: RubySMB::Fscc::FileInformation::FileIdFullDirectoryInformation)
         create_response = open_directory(directory: directory)
         file_id         = create_response.file_id
@@ -133,13 +150,20 @@ module RubySMB
         loop do
           response            = client.send_recv(directory_request)
           directory_response  = RubySMB::SMB2::Packet::QueryDirectoryResponse.read(response)
+          unless directory_response.valid?
+            raise RubySMB::Error::InvalidPacket.new(
+              expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+              expected_cmd:   RubySMB::SMB2::Packet::QueryDirectoryResponse::COMMAND,
+              received_proto: directory_response.smb2_header.protocol,
+              received_cmd:   directory_response.smb2_header.command
+            )
+          end
 
           status_code         = directory_response.smb2_header.nt_status.to_nt_status
 
           break if status_code == WindowsError::NTStatus::STATUS_NO_MORE_FILES
 
           unless status_code == WindowsError::NTStatus::STATUS_SUCCESS
-
             raise RubySMB::Error::UnexpectedStatusCode, status_code.to_s
           end
 
@@ -162,6 +186,7 @@ module RubySMB
       # @param write [Boolean] whether to request write access
       # @param delete [Boolean] whether to request delete access
       # @return [RubySMB::SMB2::Packet::CreateResponse] the response packet returned from the server
+      # @raise [RubySMB::Error::InvalidPacket] if the response is not a CreateResponse packet
       def open_directory(directory: nil, disposition: RubySMB::Dispositions::FILE_OPEN,
                          impersonation: RubySMB::ImpersonationLevels::SEC_IMPERSONATE,
                          read: true, write: false, delete: false)
@@ -169,7 +194,20 @@ module RubySMB
         create_request  = open_directory_packet(directory: directory, disposition: disposition,
                                                 impersonation: impersonation, read: read, write: write, delete: delete)
         raw_response    = client.send_recv(create_request)
-        RubySMB::SMB2::Packet::CreateResponse.read(raw_response)
+        response = RubySMB::SMB2::Packet::CreateResponse.read(raw_response)
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB2::Packet::CreateResponse::COMMAND,
+            received_proto: response.smb2_header.protocol,
+            received_cmd:   response.smb2_header.command
+          )
+        end
+        unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+        end
+
+        response
       end
 
       # Creates the Packet for the #open_directory method.

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '1.0.0'.freeze
+  VERSION = '1.1.0'.freeze
 end

data/lib/ruby_smb.rb

@@ -15,7 +15,6 @@ module RubySMB
   require 'ruby_smb/field'
   require 'ruby_smb/nbss'
   require 'ruby_smb/fscc'
-  require 'ruby_smb/dcerpc'
   require 'ruby_smb/generic_packet'
   require 'ruby_smb/dispatcher'
   require 'ruby_smb/version'

data/ruby_smb.gemspec

@@ -6,8 +6,8 @@ require 'ruby_smb/version'
 Gem::Specification.new do |spec|
   spec.name          = 'ruby_smb'
   spec.version       = RubySMB::VERSION
-  spec.authors       = ['David Maloney', 'James Lee', 'Dev Mohanty', 'Christophe De La Fuente']
-  spec.email         = ['DMaloney@rapid7.com', 'egypt@metasploit.com', 'dev_mohanty@rapid7.com', 'paristvinternet-github@yahoo.com']
+  spec.authors       = ['Metasploit Hackers', 'David Maloney', 'James Lee', 'Dev Mohanty', 'Christophe De La Fuente']
+  spec.email         = ['msfdev@metasploit.com']
   spec.summary       = 'A pure Ruby implementation of the SMB Protocol Family'
   spec.description   = ''
   spec.homepage      = 'https://github.com/rapid7/ruby_smb'
@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
     spec.platform = Gem::Platform::RUBY
   end
 
-  spec.required_ruby_version = '>= 2.2.0'
+  spec.required_ruby_version = '>= 2.3.0'
 
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'fivemat'

data/spec/lib/ruby_smb/client_spec.rb

@@ -9,6 +9,7 @@ RSpec.describe RubySMB::Client do
   let(:smb1_client) { described_class.new(dispatcher, smb2: false, username: username, password: password) }
   let(:smb2_client) { described_class.new(dispatcher, smb1: false, username: username, password: password) }
   let(:empty_packet) { RubySMB::SMB1::Packet::EmptyPacket.new }
+  let(:error_packet) { RubySMB::SMB2::Packet::ErrorPacket.new }
 
   describe '#initialize' do
     it 'should raise an ArgumentError without a valid dispatcher' do
@@ -153,6 +154,94 @@ RSpec.describe RubySMB::Client do
     end
   end
 
+  describe '#logoff!' do
+    context 'with SMB1' do
+      let(:raw_response) { double('Raw response') }
+      let(:logoff_response) {
+        RubySMB::SMB1::Packet::LogoffResponse.new(smb_header: {:command => RubySMB::SMB1::Commands::SMB_COM_LOGOFF} )
+      }
+      before :example do
+        allow(smb1_client).to receive(:send_recv).and_return(raw_response)
+        allow(RubySMB::SMB1::Packet::LogoffResponse).to receive(:read).and_return(logoff_response)
+        allow(smb1_client).to receive(:wipe_state!)
+      end
+
+      it 'creates a LogoffRequest packet' do
+        expect(RubySMB::SMB1::Packet::LogoffRequest).to receive(:new).and_call_original
+        smb1_client.logoff!
+      end
+
+      it 'calls #send_recv' do
+        expect(smb1_client).to receive(:send_recv)
+        smb1_client.logoff!
+      end
+
+      it 'reads the raw response as a LogoffResponse packet' do
+        expect(RubySMB::SMB1::Packet::LogoffResponse).to receive(:read).with(raw_response)
+        smb1_client.logoff!
+      end
+
+      it 'raise an InvalidPacket exception when the response is an empty packet' do
+        allow(RubySMB::SMB1::Packet::LogoffResponse).to receive(:read).and_return(RubySMB::SMB1::Packet::EmptyPacket.new)
+        expect {smb1_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
+      end
+
+      it 'raise an InvalidPacket exception when the response is not valid' do
+        allow(logoff_response).to receive(:valid?).and_return(false)
+        expect {smb1_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
+      end
+
+      it 'calls #wipe_state!' do
+        expect(smb1_client).to receive(:wipe_state!)
+        smb1_client.logoff!
+      end
+
+      it 'returns the expected status code' do
+        logoff_response.smb_header.nt_status = WindowsError::NTStatus::STATUS_PENDING.value
+        allow(RubySMB::SMB1::Packet::LogoffResponse).to receive(:read).and_return(logoff_response)
+        expect(smb1_client.logoff!).to eq(WindowsError::NTStatus::STATUS_PENDING)
+      end
+    end
+
+    context 'with SMB2' do
+      let(:raw_response) { double('Raw response') }
+      let(:logoff_response) {
+        RubySMB::SMB2::Packet::LogoffResponse.new(smb_header: {:command => RubySMB::SMB2::Commands::LOGOFF} )
+      }
+      before :example do
+        allow(smb2_client).to receive(:send_recv).and_return(raw_response)
+        allow(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).and_return(logoff_response)
+        allow(smb2_client).to receive(:wipe_state!)
+      end
+
+      it 'creates a LogoffRequest packet' do
+        expect(RubySMB::SMB2::Packet::LogoffRequest).to receive(:new).and_call_original
+        smb2_client.logoff!
+      end
+
+      it 'calls #send_recv' do
+        expect(smb2_client).to receive(:send_recv)
+        smb2_client.logoff!
+      end
+
+      it 'reads the raw response as a LogoffResponse packet' do
+        expect(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).with(raw_response)
+        smb2_client.logoff!
+      end
+
+      it 'raise an InvalidPacket exception when the response is an error packet' do
+        allow(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).and_return(RubySMB::SMB2::Packet::ErrorPacket.new)
+        expect {smb2_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
+      end
+
+      it 'raise an InvalidPacket exception when the response is not a LOGOFF command' do
+        logoff_response.smb2_header.command = RubySMB::SMB2::Commands::ECHO
+        allow(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).and_return(logoff_response)
+        expect {smb2_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
+      end
+    end
+  end
+
   context 'NetBIOS Session Service' do
     describe '#session_request' do
       let(:session_header)  { RubySMB::Nbss::SessionHeader.new }
@@ -197,6 +286,11 @@ RSpec.describe RubySMB::Client do
         allow(dispatcher).to receive(:recv_packet).and_return(negative_session_response.to_binary_s)
         expect { client.session_request }.to raise_error(RubySMB::Error::NetBiosSessionService)
       end
+
+      it 'raises an InvalidPacket exception when an error occurs while reading' do
+        allow(RubySMB::Nbss::SessionHeader).to receive(:read).and_raise(IOError)
+        expect { client.session_request }.to raise_error(RubySMB::Error::InvalidPacket)
+      end
     end
 
     describe '#session_request_packet' do
@@ -332,10 +426,15 @@ RSpec.describe RubySMB::Client do
           expect(smb1_client.negotiate_response(smb1_extended_response_raw)).to eq smb1_extended_response
         end
 
-        it 'raises an exception if the Response is invalid' do
+        it 'raises an exception if the response is not a SMB packet' do
           expect { smb1_client.negotiate_response(random_junk) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
 
+        it 'raises an InvalidPacket error if the response is not a valid response' do
+          empty_packet.smb_header.command = RubySMB::SMB2::Commands::NEGOTIATE
+          expect { smb1_client.negotiate_response(empty_packet.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
+        end
+
         it 'considers the response invalid if it is not an actual Negotiate Response' do
           bogus_response = smb1_extended_response
           bogus_response.smb_header.command = 0xff
@@ -357,6 +456,12 @@ RSpec.describe RubySMB::Client do
         it 'raises an exception if the Response is invalid' do
           expect { smb2_client.negotiate_response(random_junk) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
+
+        it 'considers the response invalid if it is not an actual Negotiate Response' do
+          bogus_response = smb2_response
+          bogus_response.smb2_header.command = RubySMB::SMB2::Commands::ECHO
+          expect { smb2_client.negotiate_response(bogus_response.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
+        end
       end
 
       context 'with SMB1 and SMB2 enabled' do
@@ -624,7 +729,7 @@ RSpec.describe RubySMB::Client do
           expect { smb1_client.smb1_ntlmssp_challenge_packet(response.to_binary_s) }.to raise_error(RubySMB::Error::UnexpectedStatusCode)
         end
 
-        it 'raises an InvalidPacket if the Command field is wrong' do
+        it 'raise an InvalidPacket exception when the response is not valid' do
           expect { smb1_client.smb1_ntlmssp_challenge_packet(wrong_command.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
       end
@@ -645,7 +750,7 @@ RSpec.describe RubySMB::Client do
           expect(smb1_client.smb1_ntlmssp_final_packet(response.to_binary_s)).to eq response
         end
 
-        it 'raises an InvalidPacket if the Command field is wrong' do
+        it 'raise an InvalidPacket exception when the response is not valid' do
           expect { smb1_client.smb1_ntlmssp_final_packet(wrong_command.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
       end
@@ -717,12 +822,7 @@ RSpec.describe RubySMB::Client do
             expect(smb1_client.smb1_anonymous_auth_response(anonymous_response.to_binary_s)).to eq anonymous_response
           end
 
-          it 'returns an empty packet if the raw data is not a valid response' do
-            empty_packet.smb_header.command = RubySMB::SMB1::Commands::SMB_COM_SESSION_SETUP
-            expect(smb1_client.smb1_anonymous_auth_response(empty_packet.to_binary_s)).to eq empty_packet
-          end
-
-          it 'raises an InvalidPacket error if the command is wrong' do
+          it 'raise an InvalidPacket exception when the response is not valid' do
             anonymous_response.smb_header.command = RubySMB::SMB1::Commands::SMB_COM_NEGOTIATE
             expect { smb1_client.smb1_anonymous_auth_response(anonymous_response.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
           end
@@ -829,7 +929,7 @@ RSpec.describe RubySMB::Client do
           expect { smb2_client.smb2_ntlmssp_challenge_packet(response.to_binary_s) }.to raise_error(RubySMB::Error::UnexpectedStatusCode)
         end
 
-        it 'raises an InvalidPacket if the Command field is wrong' do
+        it 'raise an InvalidPacket exception when the response is not valid' do
           expect { smb2_client.smb2_ntlmssp_challenge_packet(wrong_command.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
       end
@@ -888,7 +988,7 @@ RSpec.describe RubySMB::Client do
           expect(smb2_client.smb2_ntlmssp_final_packet(response.to_binary_s)).to eq response
         end
 
-        it 'raises an InvalidPacket if the Command field is wrong' do
+        it 'raise an InvalidPacket exception when the response is not valid' do
           expect { smb2_client.smb2_ntlmssp_final_packet(wrong_command.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
       end
@@ -1199,6 +1299,12 @@ RSpec.describe RubySMB::Client do
         expect(smb1_client).to receive(:send_recv).and_return(echo_response.to_binary_s)
         expect(smb1_client.echo).to eq WindowsError::NTStatus::STATUS_ABANDONED
       end
+
+      it 'raise an InvalidPacket exception when the response is not valid' do
+        echo_response.smb_header.command = RubySMB::SMB1::Commands::SMB_COM_SESSION_SETUP
+        allow(smb1_client).to receive(:send_recv).and_return(echo_response.to_binary_s)
+        expect { smb1_client.echo }.to raise_error(RubySMB::Error::InvalidPacket)
+      end
     end
 
     context 'with SMB2' do
@@ -1210,8 +1316,162 @@ RSpec.describe RubySMB::Client do
         expect(smb2_client).to receive(:send_recv).with(echo_request).and_return(echo_response.to_binary_s)
         expect(smb2_client.smb2_echo).to eq echo_response
       end
+
+      it 'raise an InvalidPacket exception when the response is not valid' do
+        echo_response.smb2_header.command = RubySMB::SMB2::Commands::SESSION_SETUP
+        allow(smb2_client).to receive(:send_recv).and_return(echo_response.to_binary_s)
+        expect { smb2_client.smb2_echo }.to raise_error(RubySMB::Error::InvalidPacket)
+      end
     end
   end
 
+  context 'Winreg' do
+    describe '#connect_to_winreg' do
+      let(:host)       { '1.2.3.4' }
+      let(:share)      { "\\\\#{host}\\IPC$" }
+      let(:ipc_tree)   { double('IPC$ tree') }
+      let(:named_pipe) { double('Named pipe') }
+      before :example do
+        allow(ipc_tree).to receive_messages(
+          :share     => share,
+          :open_file => named_pipe
+        )
+        allow(client).to receive(:tree_connect).and_return(ipc_tree)
+      end
+
+      context 'when the client is already connected to the IPC$ share' do
+        before :example do
+          client.tree_connects << ipc_tree
+          allow(ipc_tree).to receive(:share).and_return(share)
+        end
+
+        it 'does not connect to the already connected tree' do
+          client.connect_to_winreg(host)
+          expect(client).to_not have_received(:tree_connect)
+        end
+      end
+
+      it 'calls #tree_connect' do
+        client.connect_to_winreg(host)
+        expect(client).to have_received(:tree_connect).with(share)
+      end
+
+      it 'open \'winreg\' file on the IPC$ Tree' do
+        client.connect_to_winreg(host)
+        expect(ipc_tree).to have_received(:open_file).with(filename: "winreg", write: true, read: true)
+      end
+
+      it 'returns the expected opened named pipe' do
+        expect(client.connect_to_winreg(host)).to eq(named_pipe)
+      end
+
+      context 'when a block is given' do
+        before :example do
+          allow(named_pipe).to receive(:close)
+        end
+
+        it 'yields the expected named_pipe' do
+          client.connect_to_winreg(host) do |np|
+            expect(np).to eq(named_pipe)
+          end
+        end
+
+        it 'closes the named pipe' do
+          client.connect_to_winreg(host) { |np| }
+          expect(named_pipe).to have_received(:close)
+        end
+
+        it 'returns the block return value' do
+          result = double('Result')
+          expect(client.connect_to_winreg(host) { |np| result }).to eq(result)
+        end
+      end
+    end
+
+    describe '#has_registry_key?' do
+      let(:host)       { '1.2.3.4' }
+      let(:key)        { 'HKLM\\Registry\\Key' }
+      let(:named_pipe) { double('Named pipe') }
+      let(:result)     { double('Result') }
+      before :example do
+        allow(client).to receive(:connect_to_winreg).and_yield(named_pipe)
+        allow(named_pipe).to receive(:has_registry_key?).and_return(result)
+      end
+
+      it 'calls #connect_to_winreg to wrap the main logic around' do
+        client.has_registry_key?(host, key)
+        expect(client).to have_received(:connect_to_winreg).with(host)
+      end
+
+      it 'calls Pipe #has_registry_key?' do
+        client.has_registry_key?(host, key)
+        expect(named_pipe).to have_received(:has_registry_key?).with(key)
+      end
+    end
+
+    describe '#read_registry_key_value' do
+      let(:host)        { '1.2.3.4' }
+      let(:key)         { 'HKLM\\Registry\\Key' }
+      let(:value_name)  { 'Value' }
+      let(:named_pipe)  { double('Named pipe') }
+      let(:result)      { double('Result') }
+      before :example do
+        allow(client).to receive(:connect_to_winreg).and_yield(named_pipe)
+        allow(named_pipe).to receive(:read_registry_key_value).and_return(result)
+      end
+
+      it 'calls #connect_to_winreg to wrap the main logic around' do
+        client.read_registry_key_value(host, key, value_name)
+        expect(client).to have_received(:connect_to_winreg).with(host)
+      end
+
+      it 'calls Pipe #read_registry_key_value' do
+        client.read_registry_key_value(host, key, value_name)
+        expect(named_pipe).to have_received(:read_registry_key_value).with(key, value_name)
+      end
+    end
+
+    describe '#enum_registry_key' do
+      let(:host)       { '1.2.3.4' }
+      let(:key)        { 'HKLM\\Registry\\Key' }
+      let(:named_pipe) { double('Named pipe') }
+      let(:result)     { double('Result') }
+      before :example do
+        allow(client).to receive(:connect_to_winreg).and_yield(named_pipe)
+        allow(named_pipe).to receive(:enum_registry_key).and_return(result)
+      end
+
+      it 'calls #connect_to_winreg to wrap the main logic around' do
+        client.enum_registry_key(host, key)
+        expect(client).to have_received(:connect_to_winreg).with(host)
+      end
+
+      it 'calls Pipe #enum_registry_key' do
+        client.enum_registry_key(host, key)
+        expect(named_pipe).to have_received(:enum_registry_key).with(key)
+      end
+    end
+
+    describe '#enum_registry_values' do
+      let(:host)       { '1.2.3.4' }
+      let(:key)        { 'HKLM\\Registry\\Key' }
+      let(:named_pipe) { double('Named pipe') }
+      let(:result)     { double('Result') }
+      before :example do
+        allow(client).to receive(:connect_to_winreg).and_yield(named_pipe)
+        allow(named_pipe).to receive(:enum_registry_values).and_return(result)
+      end
+
+      it 'calls #connect_to_winreg to wrap the main logic around' do
+        client.enum_registry_values(host, key)
+        expect(client).to have_received(:connect_to_winreg).with(host)
+      end
+
+      it 'calls Pipe #enum_registry_values' do
+        client.enum_registry_values(host, key)
+        expect(named_pipe).to have_received(:enum_registry_values).with(key)
+      end
+    end
+  end
 end
 

data/spec/lib/ruby_smb/dcerpc/bind_ack_spec.rb

@@ -31,7 +31,7 @@ RSpec.describe RubySMB::Dcerpc::BindAck do
     end
 
     it 'should have a default value of 0xFFFF' do
-      expect(packet.max_xmit_frag).to eq 0xFFFF
+      expect(packet.max_xmit_frag).to eq RubySMB::Dcerpc::MAX_XMIT_FRAG
     end
   end
 
@@ -41,7 +41,7 @@ RSpec.describe RubySMB::Dcerpc::BindAck do
     end
 
     it 'should have a default value of 0xFFFF' do
-      expect(packet.max_recv_frag).to eq 0xFFFF
+      expect(packet.max_recv_frag).to eq RubySMB::Dcerpc::MAX_RECV_FRAG
     end
   end