ruby_smb 1.0.3 → 2.0.1

data/lib/ruby_smb/dcerpc/winreg/enum_key_response.rb

@@ -0,0 +1,42 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumKey Response Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string  :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class, initial_value: 0
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+        uint32              :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_request.rb

@@ -0,0 +1,39 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumValue Request Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        uint32             :dw_index
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_response.rb

@@ -0,0 +1,36 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumValue Response Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/open_key_request.rb

@@ -0,0 +1,34 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegOpenKey Request Packet as defined in
+      # [3.1.5.15 BaseRegOpenKey (Opnum 15)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8cb48f55-19e1-4ea2-8d76-dd0f6934f0d9)
+      class OpenKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_sub_key
+        string             :pad, length: -> { pad_length }
+        uint32             :dw_options
+        regsam             :sam_desired
+
+        def initialize_instance
+          super
+          @opnum = REG_OPEN_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #dw_options. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_sub_key.abs_offset + lp_sub_key.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/open_key_response.rb

@@ -0,0 +1,25 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegOpenKey Response Packet as defined in
+      # [3.1.5.15 BaseRegOpenKey (Opnum 15)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8cb48f55-19e1-4ea2-8d76-dd0f6934f0d9)
+      class OpenKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian    :little
+        prpc_hkey :phk_result
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_OPEN_KEY
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/open_root_key_request.rb

@@ -0,0 +1,43 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a PREGISTRY_SERVER_NAME structure as defined in
+      # [2.2.2 PREGISTRY_SERVER_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bcd15fd-1aa5-44e2-8662-112ec3e9817b)
+      class PRegistryServerName < Ndr::NdrTopLevelFullPointer
+        endian :little
+
+        string16 :referent, read_length: -> { 4 }
+      end
+
+      # This class is a generic class that represents OpenXXX Request packet,
+      # used to open one of the root keys, as defined in:
+      # [3.1.5.1 OpenClassesRoot (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/956a3052-6580-43ee-91aa-aaf61726149b)
+      # [3.1.5.2 OpenCurrentUser (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/ec140ed9-4d00-4c03-a15c-c7245a497ed5)
+      # [3.1.5.3 OpenLocalMachine (Opnum 2)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/6cef29ae-21ba-423f-9158-05145ac80a5b)
+      # [3.1.5.4 OpenPerformanceData (Opnum 3)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/7b514c63-6cad-4fe1-9780-743959e377e6)
+      # [3.1.5.5 OpenUsers (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/694e57f4-da3e-4285-8b71-3181d71d6cd1)
+      # [3.1.5.25 OpenCurrentConfig (Opnum 27)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/160767d7-83cf-4718-a4f3-d864faee3bb1)
+      # [3.1.5.28 OpenPerformanceText (Opnum 32)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/44954f6d-ef2c-4ec1-a27d-32b9b87e3c8a)
+      # [3.1.5.29 OpenPerformanceNlsText (Opnum 33)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3626fa8a-b20f-4243-bf85-cdb615ed2ca0)
+      # The structure is define by the value of the #opnum parameter
+      # e.g. (OpenLocalMachine):
+      #   OpenRootKeyRequest.new(opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM)
+      class OpenRootKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+        p_registry_server_name :p_registry_server_name
+        regsam                 :sam_desired
+
+        def initialize_instance
+          super
+          @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
+          p_registry_server_name.referent = "\0\0"
+          sam_desired.maximum = 1 unless [OPEN_HKPD, OPEN_HKPT, OPEN_HKPN].include?(@opnum)
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/open_root_key_response.rb

@@ -0,0 +1,35 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class is a generic class that represents OpenXXX Response packet,
+      # used to open one of the root keys, as defined in:
+      # [3.1.5.1 OpenClassesRoot (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/956a3052-6580-43ee-91aa-aaf61726149b)
+      # [3.1.5.2 OpenCurrentUser (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/ec140ed9-4d00-4c03-a15c-c7245a497ed5)
+      # [3.1.5.3 OpenLocalMachine (Opnum 2)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/6cef29ae-21ba-423f-9158-05145ac80a5b)
+      # [3.1.5.4 OpenPerformanceData (Opnum 3)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/7b514c63-6cad-4fe1-9780-743959e377e6)
+      # [3.1.5.5 OpenUsers (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/694e57f4-da3e-4285-8b71-3181d71d6cd1)
+      # [3.1.5.25 OpenCurrentConfig (Opnum 27)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/160767d7-83cf-4718-a4f3-d864faee3bb1)
+      # [3.1.5.28 OpenPerformanceText (Opnum 32)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/44954f6d-ef2c-4ec1-a27d-32b9b87e3c8a)
+      # [3.1.5.29 OpenPerformanceNlsText (Opnum 33)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3626fa8a-b20f-4243-bf85-cdb615ed2ca0)
+      # The structure is define by the value of the #opnum parameter
+      # e.g. (OpenLocalMachine):
+      #   OpenRootKeyResponse.new(opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM)
+      class OpenRootKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian    :little
+        prpc_hkey :ph_key
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/query_info_key_request.rb

@@ -0,0 +1,27 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegQueryInfoKey Request Packet as defined in
+      # [3.1.5.16 BaseRegQueryInfoKey (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/a886ba66-5c7b-4331-bacd-7c77edc95d85)
+      class QueryInfoKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_class, initial_value: 0
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_INFO_KEY
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_info_key_response.rb

@@ -0,0 +1,40 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+      # This class represents a BaseRegQueryInfoKey Response Packet as defined in
+      # [3.1.5.16 BaseRegQueryInfoKey (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/a886ba66-5c7b-4331-bacd-7c77edc95d85)
+      class QueryInfoKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_class, initial_value: 0
+        string             :pad,      length: -> { pad_length }
+        uint32             :lpc_sub_keys
+        uint32             :lpc_max_sub_key_len
+        uint32             :lpc_max_class_len
+        uint32             :lpc_values
+        uint32             :lpcb_max_value_name_len
+        uint32             :lpcb_max_value_len
+        uint32             :lpcb_security_descriptor
+        file_time          :lpft_last_write_time
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_INFO_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpc_sub_keys. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_value_request.rb

@@ -0,0 +1,39 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegQueryValue Request Packet as defined in
+      # [3.1.5.17 BaseRegQueryValue (Opnum 17)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)
+      class QueryValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_value_response.rb

@@ -0,0 +1,57 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegQueryValue Response Packet as defined in
+      # [3.1.5.17 BaseRegQueryValue (Opnum 17)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)
+      class QueryValueResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_lp_dword :lp_type
+        ndr_lp_byte  :lp_data
+        string       :pad, length: -> { pad_length }
+        ndr_lp_dword :lpcb_data
+        ndr_lp_dword :lpcb_len
+        uint32       :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpcb_data. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_data.abs_offset + lp_data.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Returns the data portion of the registry value formatted according to its type:
+        # [3.1.1.5 Values](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3d64dbea-f016-4373-8cac-e43bf343837d)
+        def data
+          bytes = lp_data.bytes.to_a.pack('C*')
+          case lp_type
+          when 1,2
+            bytes.force_encoding('utf-16le').strip
+          when 3
+            bytes
+          when 4
+            bytes.unpack('V').first
+          when 5
+            bytes.unpack('N').first
+          when 7
+            str = bytes.force_encoding('utf-16le')
+            str.split("\0".encode('utf-16le'))
+          when 11
+            bytes.unpack('Q<').first
+          else
+            ""
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/regsam.rb

@@ -0,0 +1,40 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a REGSAM structure as defined in
+      # [2.2.3 REGSAM](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/fefbc801-b141-4bb1-9dcb-bf366da3ae7e)
+      # [2.4.3 ACCESS_MASK](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b)
+      class Regsam < BinData::Record
+        endian  :little
+        bit2    :reserved,               label: 'Reserved Space'
+        bit1    :key_create_link,        label: 'Key Create Link'
+        bit1    :key_notify,             label: 'Key Notify'
+        bit1    :key_enumerate_sub_keys, label: 'Key Enumerate Sub Keys'
+        bit1    :key_create_sub_key,     label: 'Key Create Sub Key'
+        bit1    :key_set_value,          label: 'Key Set Value'
+        bit1    :key_query_value,        label: 'Key Query Value'
+        # byte boundary
+        bit6    :reserved2,              label: 'Reserved Space'
+        bit1    :key_wow64_32key,        label: 'Key Wow64 32key'
+        bit1    :key_wow64_64key,        label: 'Key Wow64 64key'
+        # byte boundary
+        bit3    :reserved3,              label: 'Reserved Space'
+        bit1    :synchronize,            label: 'Synchronize'
+        bit1    :write_owner,            label: 'Write Owner'
+        bit1    :write_dac,              label: 'Write DAC'
+        bit1    :read_control,           label: 'Read Control'
+        bit1    :delete_access,          label: 'Delete'
+        # byte boundary
+        bit1    :generic_read,           label: 'Generic Read'
+        bit1    :generic_write,          label: 'Generic Write'
+        bit1    :generic_execute,        label: 'Generic Execute'
+        bit1    :generic_all,            label: 'Generic All'
+        bit2    :reserved4,              label: 'Reserved Space'
+        bit1    :maximum,                label: 'Maximum Allowed'
+        bit1    :system_security,        label: 'System Security'
+      end
+
+    end
+  end
+end