ruby_smb 1.0.3 → 2.0.1

data/lib/ruby_smb/smb1/packet/trans2/find_first2_response.rb

@@ -5,6 +5,8 @@ module RubySMB
         # This class represents an SMB1 Trans2 FIND_FIRST2 Response Packet as defined in
         # [2.2.6.2.2 Response](https://msdn.microsoft.com/en-us/library/ee441704.aspx)
         class FindFirst2Response < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Response::ParameterBlock
           end
 
@@ -51,7 +53,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::FIND_FIRST2
             smb_header.flags.reply = 1
           end
@@ -62,6 +63,7 @@ module RubySMB
           #
           # @param klass [Class] the FileInformationClass class to read the data as
           # @return [array<BinData::Record>] An array of structs holding the requested information
+          # @raise [RubySMB::Error::InvalidPacket] if the string buffer is not a valid File Information packet
           def results(klass, unicode:)
             information_classes = []
             blob = data_block.trans2_data.buffer.to_binary_s.dup
@@ -76,7 +78,11 @@ module RubySMB
 
               file_info = klass.new
               file_info.unicode = unicode
-              information_classes << file_info.read(data)
+              begin
+                information_classes << file_info.read(data)
+              rescue IOError
+                raise RubySMB::Error::InvalidPacket, "Invalid #{klass} File Information packet in the string buffer"
+              end
             end
             information_classes
           end

data/lib/ruby_smb/smb1/packet/trans2/find_next2_request.rb

@@ -5,6 +5,8 @@ module RubySMB
         # A Trans2 FIND_NEXT2 Request Packet as defined in
         # [2.2.6.3.1 Request](https://msdn.microsoft.com/en-us/library/ee441844.aspx)
         class FindNext2Request < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
           end
 
@@ -67,7 +69,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::FIND_NEXT2
           end
         end

data/lib/ruby_smb/smb1/packet/trans2/find_next2_response.rb

@@ -5,6 +5,8 @@ module RubySMB
         # This class represents an SMB1 Trans2 FIND_NEXT2 Response Packet as defined in
         # [2.2.6.3.2 Response](https://msdn.microsoft.com/en-us/library/ee441871.aspx)
         class FindNext2Response < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Response::ParameterBlock
           end
 
@@ -50,7 +52,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::FIND_NEXT2
             smb_header.flags.reply = 1
           end
@@ -61,6 +62,7 @@ module RubySMB
           #
           # @param klass [Class] the FileInformationClass class to read the data as
           # @return [array<BinData::Record>] An array of structs holding the requested information
+          # @raise [RubySMB::Error::InvalidPacket] if the string buffer is not a valid File Information packet
           def results(klass, unicode:)
             information_classes = []
             blob = data_block.trans2_data.buffer.to_binary_s.dup
@@ -75,7 +77,11 @@ module RubySMB
 
               file_info = klass.new
               file_info.unicode = unicode
-              information_classes << file_info.read(data)
+              begin
+                information_classes << file_info.read(data)
+              rescue IOError
+                raise RubySMB::Error::InvalidPacket, "Invalid #{klass} File Information packet in the string buffer"
+              end
             end
             information_classes
           end

data/lib/ruby_smb/smb1/packet/trans2/open2_request.rb

@@ -5,6 +5,8 @@ module RubySMB
         # A Trans2 OPEN2 Request Packet as defined in
         # [2.2.6.1.1 Request](https://msdn.microsoft.com/en-us/library/ee441733.aspx)
         class Open2Request < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
           end
 
@@ -50,7 +52,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::OPEN2
           end
         end

data/lib/ruby_smb/smb1/packet/trans2/open2_response.rb

@@ -5,6 +5,8 @@ module RubySMB
         # This class represents an SMB1 Trans2 Open2 Response Packet as defined in
         # [2.2.6.1.2 Response](https://msdn.microsoft.com/en-us/library/ee441545.aspx)
         class Open2Response < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Response::ParameterBlock
           end
 
@@ -52,7 +54,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::OPEN2
             smb_header.flags.reply = 1
           end

data/lib/ruby_smb/smb1/packet/trans2/request.rb

@@ -5,6 +5,8 @@ module RubySMB
         # This class represents a generic SMB1 Trans2 Request Packet as defined in
         # [2.2.4.46.1 Request](https://msdn.microsoft.com/en-us/library/ee442192.aspx)
         class Request < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           # The {RubySMB::SMB1::ParameterBlock} specific to this packet type.
           class ParameterBlock < RubySMB::SMB1::ParameterBlock
             uint16        :total_parameter_count, label: 'Total Parameter Count(bytes)'
@@ -39,10 +41,6 @@ module RubySMB
           parameter_block   :parameter_block
           data_block        :data_block
 
-          def initialize_instance
-            super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
-          end
         end
       end
     end

data/lib/ruby_smb/smb1/packet/trans2/request_secondary.rb

@@ -5,6 +5,8 @@ module RubySMB
         # This class represents a generic SMB1 Trans2 Secondary Request Packet as defined in
         # [2.2.4.47.1 Request](https://msdn.microsoft.com/en-us/library/ee442105.aspx)
         class RequestSecondary < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2_SECONDARY
+
           # The {RubySMB::SMB1::ParameterBlock} specific to this packet type.
           class ParameterBlock < RubySMB::SMB1::ParameterBlock
             uint16 :total_parameter_count, label: 'Total Parameter Count(bytes)'
@@ -26,10 +28,6 @@ module RubySMB
           parameter_block   :parameter_block
           data_block        :data_block
 
-          def initialize_instance
-            super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2_SECONDARY
-          end
         end
       end
     end

data/lib/ruby_smb/smb1/packet/trans2/response.rb

@@ -5,6 +5,8 @@ module RubySMB
         # This class represents a generic SMB1 Trans2 Response Packet as defined in
         # [2.2.4.46.2 Response](https://msdn.microsoft.com/en-us/library/ee441550.aspx)
         class Response < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           # The {RubySMB::SMB1::ParameterBlock} specific to this packet type.
           class ParameterBlock < RubySMB::SMB1::ParameterBlock
             uint16 :total_parameter_count, label: 'Total Parameter Count(bytes)'
@@ -36,7 +38,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             smb_header.flags.reply = 1
           end
         end

data/lib/ruby_smb/smb1/packet/trans2/set_file_information_request.rb

@@ -5,6 +5,8 @@ module RubySMB
         # A Trans2 SET_FILE_INFORMATION Request Packet as defined in
         # [2.2.6.9.1 Request](https://msdn.microsoft.com/en-us/library/ee441527.aspx)
         class SetFileInformationRequest < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
           end
 
@@ -56,7 +58,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::SET_FILE_INFORMATION
           end
         end

data/lib/ruby_smb/smb1/packet/trans2/set_file_information_response.rb

@@ -5,6 +5,8 @@ module RubySMB
         # A Trans2 SET_FILE_INFORMATION Response Packet as defined in
         # [2.2.6.9.2 Response](https://msdn.microsoft.com/en-us/library/ff469853.aspx)
         class SetFileInformationResponse < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
           class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Response::ParameterBlock
           end
 
@@ -46,7 +48,6 @@ module RubySMB
 
           def initialize_instance
             super
-            smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
             parameter_block.setup << RubySMB::SMB1::Packet::Trans2::Subcommands::SET_FILE_INFORMATION
             smb_header.flags.reply = 1
           end

data/lib/ruby_smb/smb1/packet/tree_connect_request.rb

@@ -4,6 +4,8 @@ module RubySMB
       # This class represents an SMB1 TreeConnect Request Packet as defined in
       # [2.2.4.7.1 Client Request Extensions](https://msdn.microsoft.com/en-us/library/cc246330.aspx)
       class TreeConnectRequest < RubySMB::GenericPacket
+        COMMAND = RubySMB::SMB1::Commands::SMB_COM_TREE_CONNECT
+
         # A SMB1 Parameter Block as defined by the {TreeConnectRequest}
         class ParameterBlock < RubySMB::SMB1::ParameterBlock
           and_x_block          :andx_block
@@ -22,10 +24,6 @@ module RubySMB
         parameter_block   :parameter_block
         data_block        :data_block
 
-        def initialize_instance
-          super
-          smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TREE_CONNECT
-        end
       end
     end
   end

data/lib/ruby_smb/smb1/packet/tree_connect_response.rb

@@ -4,6 +4,8 @@ module RubySMB
       # A SMB1 TreeConnect Response Packet as defined in
       # [2.2.4.7.2 Server Response Extensions](https://msdn.microsoft.com/en-us/library/cc246331.aspx)
       class TreeConnectResponse < RubySMB::GenericPacket
+        COMMAND = RubySMB::SMB1::Commands::SMB_COM_TREE_CONNECT
+
         # A SMB1 Parameter Block as defined by the {SessionSetupResponse}
         class ParameterBlock < RubySMB::SMB1::ParameterBlock
           and_x_block                :andx_block
@@ -24,7 +26,6 @@ module RubySMB
 
         def initialize_instance
           super
-          smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TREE_CONNECT
           smb_header.flags.reply = 1
         end
 
@@ -34,12 +35,17 @@ module RubySMB
         #
         # @return [RubySMB::SMB1::BitField::DirectoryAccessMask] if a directory was connected to
         # @return [RubySMB::SMB1::BitField::FileAccessMask] if anything else was connected to
+        # @raise [RubySMB::Error::InvalidBitField] if ACCESS_MASK bit field is not valid
         def access_rights
           if is_directory?
             parameter_block.access_rights
           else
             mask = parameter_block.access_rights.to_binary_s
-            RubySMB::SMB1::BitField::FileAccessMask.read(mask)
+            begin
+              RubySMB::SMB1::BitField::FileAccessMask.read(mask)
+            rescue IOError
+              raise RubySMB::Error::InvalidBitField, 'Invalid ACCESS_MASK for the Maximal Share Access Rights'
+            end
           end
         end
 
@@ -54,7 +60,11 @@ module RubySMB
             parameter_block.guest_access_rights
           else
             mask = parameter_block.guest_access_rights.to_binary_s
-            RubySMB::SMB1::BitField::FileAccessMask.read(mask)
+            begin
+              RubySMB::SMB1::BitField::FileAccessMask.read(mask)
+            rescue IOError
+              raise RubySMB::Error::InvalidBitField, 'Invalid ACCESS_MASK for the Guest Share Access Rights'
+            end
           end
         end
 

data/lib/ruby_smb/smb1/packet/tree_disconnect_request.rb

@@ -4,6 +4,8 @@ module RubySMB
       # This class represents an SMB1 TreeDisonnect Request Packet as defined in
       # [2.2.4.51.1 Request](https://msdn.microsoft.com/en-us/library/ee441622.aspx)
       class TreeDisconnectRequest < RubySMB::GenericPacket
+        COMMAND = RubySMB::SMB1::Commands::SMB_COM_TREE_DISCONNECT
+
         # The Parameter Block for this packet is empty save the Word Count
         # The {RubySMB::SMB1::ParameterBlock} specific to this packet type.
         class ParameterBlock < RubySMB::SMB1::ParameterBlock
@@ -17,10 +19,6 @@ module RubySMB
         parameter_block   :parameter_block
         data_block        :data_block
 
-        def initialize_instance
-          super
-          smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TREE_DISCONNECT
-        end
       end
     end
   end

data/lib/ruby_smb/smb1/packet/tree_disconnect_response.rb

@@ -4,6 +4,8 @@ module RubySMB
       # This class represents an SMB1 TreeDisonnect Response Packet as defined in
       # [2.2.4.51.2 Response](https://msdn.microsoft.com/en-us/library/ee441823.aspx)
       class TreeDisconnectResponse < RubySMB::GenericPacket
+        COMMAND = RubySMB::SMB1::Commands::SMB_COM_TREE_DISCONNECT
+
         # The Parameter Block for this packet is empty save the Word Count
         # The {RubySMB::SMB1::ParameterBlock} specific to this packet type.
         class ParameterBlock < RubySMB::SMB1::ParameterBlock
@@ -19,7 +21,6 @@ module RubySMB
 
         def initialize_instance
           super
-          smb_header.command = RubySMB::SMB1::Commands::SMB_COM_TREE_DISCONNECT
           smb_header.flags.reply = 1
         end
       end

data/lib/ruby_smb/smb1/packet/write_andx_request.rb

@@ -5,6 +5,8 @@ module RubySMB
       # [2.2.4.43.1 Request](https://msdn.microsoft.com/en-us/library/ee441954.aspx)
       # [2.2.4.3.1 Client Request Extensions](https://msdn.microsoft.com/en-us/library/ff469893.aspx)
       class WriteAndxRequest < RubySMB::GenericPacket
+        COMMAND = RubySMB::SMB1::Commands::SMB_COM_WRITE_ANDX
+
         # A SMB1 Parameter Block as defined by the {WriteAndxRequest}
         class ParameterBlock < RubySMB::SMB1::ParameterBlock
           endian      :little
@@ -41,7 +43,7 @@ module RubySMB
 
         # Represents the specific layout of the DataBlock for a {WriteAndxRequest} Packet.
         class DataBlock < RubySMB::SMB1::DataBlock
-          uint8  :pad,  label: 'Pad'
+          string :pad,  label: 'Pad', length: 1
           string :data, label: 'Data'
         end
 
@@ -49,11 +51,6 @@ module RubySMB
         parameter_block   :parameter_block
         data_block        :data_block
 
-        def initialize_instance
-          super
-          smb_header.command = RubySMB::SMB1::Commands::SMB_COM_WRITE_ANDX
-        end
-
         # Specifies whether the offset is a 32-bit (default) or 64-bit value. When `is_64_bit`
         # is true, a 64-bit offset will be used and the OffsetHigh field will be added to the structure.
         #

data/lib/ruby_smb/smb1/packet/write_andx_response.rb

@@ -5,6 +5,8 @@ module RubySMB
       # [2.2.4.43.2 Response](https://msdn.microsoft.com/en-us/library/ee441673.aspx)
       # [2.2.4.3.2 Server Response Extensions](https://msdn.microsoft.com/en-us/library/ff469858.aspx)
       class WriteAndxResponse < RubySMB::GenericPacket
+        COMMAND = RubySMB::SMB1::Commands::SMB_COM_WRITE_ANDX
+
         # A SMB1 Parameter Block as defined by the {WriteAndxResponse}
         class ParameterBlock < RubySMB::SMB1::ParameterBlock
           endian      :little
@@ -26,7 +28,6 @@ module RubySMB
 
         def initialize_instance
           super
-          smb_header.command = RubySMB::SMB1::Commands::SMB_COM_WRITE_ANDX
           smb_header.flags.reply = 1
         end
       end

data/lib/ruby_smb/smb1/pipe.rb

@@ -3,9 +3,9 @@ module RubySMB
     # Represents a pipe on the Remote server that we can perform
     # various I/O operations on.
     class Pipe < File
-      require 'ruby_smb/smb1/dcerpc'
+      require 'ruby_smb/dcerpc'
 
-      include RubySMB::SMB1::Dcerpc
+      include RubySMB::Dcerpc
 
       # Reference: https://msdn.microsoft.com/en-us/library/ee441883.aspx
       STATUS_DISCONNECTED = 0x0001
@@ -13,6 +13,17 @@ module RubySMB
       STATUS_OK           = 0x0003
       STATUS_CLOSED       = 0x0004
 
+      def initialize(tree:, response:, name:)
+        raise ArgumentError, 'No Name Provided' if name.nil?
+        case name
+        when 'srvsvc'
+          extend RubySMB::Dcerpc::Srvsvc
+        when 'winreg'
+          extend RubySMB::Dcerpc::Winreg
+        end
+        super(tree: tree, response: response, name: name)
+      end
+
       # Performs a peek operation on the named pipe
       #
       # @param peek_size [Integer] Amount of data to peek
@@ -26,14 +37,19 @@ module RubySMB
         packet = @tree.set_header_fields(packet)
         raw_response = @tree.client.send_recv(packet)
         response = RubySMB::SMB1::Packet::Trans::PeekNmpipeResponse.read(raw_response)
+        unless response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB1::Packet::Trans::PeekNmpipeRequest::COMMAND,
+            received_proto: response.smb_header.protocol,
+            received_cmd:   response.smb_header.command
+          )
+        end
 
         unless response.status_code == WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW or response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code
         end
 
-        unless response.smb_header.command == RubySMB::SMB1::Commands::SMB_COM_TRANSACTION
-          raise RubySMB::Error::InvalidPacket, 'Not a TransResponse packet'
-        end
         response
       end
 
@@ -63,6 +79,71 @@ module RubySMB
         state == STATUS_OK
       end
 
+      # Send a DCERPC request with the provided stub packet.
+      #
+      # @params stub_packet [#opnum] the stub packet to add to the DCERPC request
+      # @return [String] the raw DCERPC response stub
+      # @raise [RubySMB::Error::InvalidPacket] if the response is not valid
+      # @raise [RubySMB::Error::UnexpectedStatusCode] if the response status code is different than STATUS_SUCCESS or STATUS_BUFFER_OVERFLOW
+      def dcerpc_request(stub_packet, options={})
+        options.merge!(endpoint: stub_packet.class.name.split('::').at(-2))
+        dcerpc_request = RubySMB::Dcerpc::Request.new({ opnum: stub_packet.opnum }, options)
+        dcerpc_request.stub.read(stub_packet.to_binary_s)
+        trans_nmpipe_request = RubySMB::SMB1::Packet::Trans::TransactNmpipeRequest.new(options)
+        @tree.set_header_fields(trans_nmpipe_request)
+        trans_nmpipe_request.set_fid(@fid)
+        trans_nmpipe_request.data_block.trans_data.write_data = dcerpc_request.to_binary_s
+
+        trans_nmpipe_raw_response = @tree.client.send_recv(trans_nmpipe_request)
+        trans_nmpipe_response = RubySMB::SMB1::Packet::Trans::TransactNmpipeResponse.read(trans_nmpipe_raw_response)
+        unless trans_nmpipe_response.valid?
+          raise RubySMB::Error::InvalidPacket.new(
+            expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
+            expected_cmd:   RubySMB::SMB1::Packet::Trans::TransactNmpipeResponse::COMMAND,
+            received_proto: trans_nmpipe_response.smb_header.protocol,
+            received_cmd:   trans_nmpipe_response.smb_header.command
+          )
+        end
+        unless [WindowsError::NTStatus::STATUS_SUCCESS,
+                WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW].include?(trans_nmpipe_response.status_code)
+          raise RubySMB::Error::UnexpectedStatusCode, trans_nmpipe_response.status_code
+        end
+
+        raw_data = trans_nmpipe_response.data_block.trans_data.read_data.to_binary_s
+        if trans_nmpipe_response.status_code == WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW
+          raw_data << read(bytes: @tree.client.max_buffer_size - trans_nmpipe_response.parameter_block.data_count)
+          dcerpc_response = dcerpc_response_from_raw_response(raw_data)
+          unless dcerpc_response.pdu_header.pfc_flags.first_frag == 1
+            raise RubySMB::Dcerpc::Error::InvalidPacket, "Not the first fragment"
+          end
+          stub_data = dcerpc_response.stub.to_s
+
+          loop do
+            break if dcerpc_response.pdu_header.pfc_flags.last_frag == 1
+            raw_data = read(bytes: @tree.client.max_buffer_size)
+            dcerpc_response = dcerpc_response_from_raw_response(raw_data)
+            stub_data << dcerpc_response.stub.to_s
+          end
+          stub_data
+        else
+          dcerpc_response = dcerpc_response_from_raw_response(raw_data)
+          dcerpc_response.stub.to_s
+        end
+      end
+
+
+      private
+
+      def dcerpc_response_from_raw_response(raw_data)
+        dcerpc_response = RubySMB::Dcerpc::Response.read(raw_data)
+        unless dcerpc_response.pdu_header.ptype == RubySMB::Dcerpc::PTypes::RESPONSE
+          raise RubySMB::Dcerpc::Error::InvalidPacket, "Not a Response packet"
+        end
+        dcerpc_response
+      rescue IOError
+        raise RubySMB::Dcerpc::Error::InvalidPacket, "Error reading the DCERPC response"
+      end
+
     end
   end
 end