ruby_smb 1.0.5 → 2.0.3

data/lib/ruby_smb/dcerpc/winreg/query_info_key_request.rb

@@ -0,0 +1,27 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegQueryInfoKey Request Packet as defined in
+      # [3.1.5.16 BaseRegQueryInfoKey (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/a886ba66-5c7b-4331-bacd-7c77edc95d85)
+      class QueryInfoKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_class
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_INFO_KEY
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_info_key_response.rb

@@ -0,0 +1,40 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+      # This class represents a BaseRegQueryInfoKey Response Packet as defined in
+      # [3.1.5.16 BaseRegQueryInfoKey (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/a886ba66-5c7b-4331-bacd-7c77edc95d85)
+      class QueryInfoKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_class, initial_value: 0
+        string             :pad,      length: -> { pad_length }
+        uint32             :lpc_sub_keys
+        uint32             :lpc_max_sub_key_len
+        uint32             :lpc_max_class_len
+        uint32             :lpc_values
+        uint32             :lpcb_max_value_name_len
+        uint32             :lpcb_max_value_len
+        uint32             :lpcb_security_descriptor
+        file_time          :lpft_last_write_time
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_INFO_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpc_sub_keys. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_value_request.rb

@@ -0,0 +1,40 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegQueryValue Request Packet as defined in
+      # [3.1.5.17 BaseRegQueryValue (Opnum 17)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)
+      class QueryValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_value_name
+        string             :pad1, length: -> { pad_length(self.lp_value_name) }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte_array  :lp_data
+        string             :pad2, length: -> { pad_length(self.lp_data) }
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_VALUE
+        end
+
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_value_response.rb

@@ -0,0 +1,57 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegQueryValue Response Packet as defined in
+      # [3.1.5.17 BaseRegQueryValue (Opnum 17)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)
+      class QueryValueResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_lp_dword      :lp_type
+        ndr_lp_byte_array :lp_data
+        string            :pad, length: -> { pad_length(self.lp_data) }
+        ndr_lp_dword      :lpcb_data
+        ndr_lp_dword      :lpcb_len
+        uint32            :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_VALUE
+        end
+
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Returns the data portion of the registry value formatted according to its type:
+        # [3.1.1.5 Values](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3d64dbea-f016-4373-8cac-e43bf343837d)
+        def data
+          bytes = lp_data.bytes.to_a.pack('C*')
+          case lp_type
+          when 1,2
+            bytes.force_encoding('utf-16le').strip
+          when 3
+            bytes
+          when 4
+            bytes.unpack('V').first
+          when 5
+            bytes.unpack('N').first
+          when 7
+            str = bytes.force_encoding('utf-16le')
+            str.split("\0".encode('utf-16le'))
+          when 11
+            bytes.unpack('Q<').first
+          else
+            ""
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/regsam.rb

@@ -0,0 +1,40 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a REGSAM structure as defined in
+      # [2.2.3 REGSAM](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/fefbc801-b141-4bb1-9dcb-bf366da3ae7e)
+      # [2.4.3 ACCESS_MASK](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b)
+      class Regsam < BinData::Record
+        endian  :little
+        bit2    :reserved,               label: 'Reserved Space'
+        bit1    :key_create_link,        label: 'Key Create Link'
+        bit1    :key_notify,             label: 'Key Notify'
+        bit1    :key_enumerate_sub_keys, label: 'Key Enumerate Sub Keys'
+        bit1    :key_create_sub_key,     label: 'Key Create Sub Key'
+        bit1    :key_set_value,          label: 'Key Set Value'
+        bit1    :key_query_value,        label: 'Key Query Value'
+        # byte boundary
+        bit6    :reserved2,              label: 'Reserved Space'
+        bit1    :key_wow64_32key,        label: 'Key Wow64 32key'
+        bit1    :key_wow64_64key,        label: 'Key Wow64 64key'
+        # byte boundary
+        bit3    :reserved3,              label: 'Reserved Space'
+        bit1    :synchronize,            label: 'Synchronize'
+        bit1    :write_owner,            label: 'Write Owner'
+        bit1    :write_dac,              label: 'Write DAC'
+        bit1    :read_control,           label: 'Read Control'
+        bit1    :delete_access,          label: 'Delete'
+        # byte boundary
+        bit1    :generic_read,           label: 'Generic Read'
+        bit1    :generic_write,          label: 'Generic Write'
+        bit1    :generic_execute,        label: 'Generic Execute'
+        bit1    :generic_all,            label: 'Generic All'
+        bit2    :reserved4,              label: 'Reserved Space'
+        bit1    :maximum,                label: 'Maximum Allowed'
+        bit1    :system_security,        label: 'System Security'
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/save_key_request.rb

@@ -0,0 +1,37 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegSaveKey Request Packet as defined in
+      # [3.1.5.20 BaseRegSaveKey (Opnum 20)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/f022247d-6ef1-4f46-b195-7f60654f4a0d)
+      class SaveKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey                 :hkey
+        rrp_unicode_string       :lp_file
+        string                   :pad, length: -> { pad_length(self.lp_file) }
+        prpc_security_attributes :lp_security_attributes
+
+        def initialize_instance
+          super
+          @opnum = REG_SAVE_KEY
+        end
+
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+
+

data/lib/ruby_smb/dcerpc/winreg/save_key_response.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegSaveKey Response Packet as defined in
+      # [3.1.5.20 BaseRegSaveKey (Opnum 20)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/f022247d-6ef1-4f46-b195-7f60654f4a0d)
+      class SaveKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        uint32       :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CREATE_KEY
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dispatcher/base.rb

@@ -9,7 +9,7 @@ module RubySMB
       def nbss(packet)
         nbss = RubySMB::Nbss::SessionHeader.new
         nbss.session_packet_type = RubySMB::Nbss::SESSION_MESSAGE
-        nbss.packet_length       = packet.do_num_bytes
+        nbss.stream_protocol_length = packet.do_num_bytes
         nbss.to_binary_s
       end
 

data/lib/ruby_smb/dispatcher/socket.rb

@@ -48,7 +48,7 @@ module RubySMB
           end
 
         rescue IOError, Errno::ECONNABORTED, Errno::ECONNRESET => e
-          raise RubySMB::Error::CommunicationError, "An error occured writing to the Socket: #{e.message}"
+          raise RubySMB::Error::CommunicationError, "An error occurred writing to the Socket: #{e.message}"
         end
         nil
       end
@@ -61,19 +61,20 @@ module RubySMB
       #   which are assumed to be the NetBiosSessionService header.
       # @raise [RubySMB::Error::CommunicationError] if the read timeout expires or an error occurs when reading the socket
       def recv_packet(full_response: false)
+        raise RubySMB::Error::CommunicationError, 'Connection has already been closed' if @tcp_socket.closed?
         if IO.select([@tcp_socket], nil, nil, @read_timeout).nil?
           raise RubySMB::Error::CommunicationError, "Read timeout expired when reading from the Socket (timeout=#{@read_timeout})"
         end
 
         begin
           nbss_data = @tcp_socket.read(4)
-          raise IOError if nbss_data.nil?
+          raise RubySMB::Error::CommunicationError, 'Socket read returned nil' if nbss_data.nil?
           nbss_header = RubySMB::Nbss::SessionHeader.read(nbss_data)
         rescue IOError
           raise ::RubySMB::Error::NetBiosSessionService, 'NBSS Header is missing'
         end
 
-        length = nbss_header.packet_length
+        length = nbss_header.stream_protocol_length
         data = full_response ? nbss_header.to_binary_s : ''
         if length > 0
           if IO.select([@tcp_socket], nil, nil, @read_timeout).nil?
@@ -84,7 +85,7 @@ module RubySMB
         end
         data
       rescue Errno::EINVAL, Errno::ECONNABORTED, Errno::ECONNRESET, TypeError, NoMethodError => e
-        raise RubySMB::Error::CommunicationError, "An error occured reading from the Socket #{e.message}"
+        raise RubySMB::Error::CommunicationError, "An error occurred reading from the Socket #{e.message}"
       end
     end
   end

data/lib/ruby_smb/error.rb

@@ -53,7 +53,28 @@ module RubySMB
     end
 
     # Raised when a response packet has a NTStatus code that was unexpected.
-    class UnexpectedStatusCode < RubySMBError; end
+    class UnexpectedStatusCode < RubySMBError
+      attr_reader :status_code
+
+      def initialize(status_code)
+        case status_code
+        when WindowsError::ErrorCode
+          @status_code = status_code
+        when Integer
+          @status_code = WindowsError::NTStatus.find_by_retval(status_code).first
+          if @status_code.nil?
+            @status_code = WindowsError::ErrorCode.new("0x#{status_code.to_s(16)}", status_code, "Unknown 0x#{status_code.to_s(16)}")
+          end
+        else
+          raise ArgumentError, "Status code must be a WindowsError::ErrorCode or an Integer, got #{status_code.class}"
+        end
+        super
+      end
+
+      def to_s
+        "The server responded with an unexpected status code: #{status_code.name}"
+      end
+    end
 
     # Raised when an error occurs with the underlying socket.
     class CommunicationError < RubySMBError; end
@@ -65,5 +86,11 @@ module RubySMB
     # Raised when trying to parse raw binary into a BitField and the data
     # is invalid.
     class InvalidBitField < RubySMBError; end
+
+    # Raised when an encryption operation fails
+    class EncryptionError < RubySMBError; end
+
+    # Raised when an signing operation fails
+    class SigningError < RubySMBError; end
   end
 end

data/lib/ruby_smb/field/stringz16.rb

@@ -25,12 +25,17 @@ module RubySMB
       # @see BinData::Stringz
       def read_and_return_value(io)
         max_length = eval_parameter(:max_length)
+        if max_length && max_length % 2 != 0
+          raise ArgumentError, "[Stringz16] #max_length should be a multiple of "\
+            "two, since it is Unicode (got #{max_length})"
+        end
         str = ''
         i = 0
         ch = nil
 
         # read until double NULL-byte or we have read in the max number of bytes
-        while (ch != "\0\0") && (i != max_length)
+        loop do
+          break if ch == "\0\0" || (max_length && i == max_length)
           ch = io.readbytes(2)
           str << ch
           i += 2
@@ -46,6 +51,17 @@ module RubySMB
       def truncate_after_first_zero_byte!(str)
         str.sub!(/([^\0]*\0\0\0).*/, '\1')
       end
+
+      def trim_to!(str, max_length = nil)
+        if max_length
+          max_length = 2 if max_length < 2
+          str.slice!(max_length..-1)
+          if str.length == max_length && str[-2, 2] != "\0\0"
+            str[-2, 2] = "\0\0"
+          end
+        end
+      end
+
     end
   end
 end

data/lib/ruby_smb/nbss/session_header.rb

@@ -1,13 +1,13 @@
 module RubySMB
   module Nbss
     # Representation of the NetBIOS Session Service Header as defined in
-    # [4.3.1 GENERAL FORMAT OF SESSION PACKETS](https://tools.ietf.org/html/rfc1002)
+    # SMB: [2.1 Transport](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb/f906c680-330c-43ae-9a71-f854e24aeee6)
+    # SMB2: [2.1 Transport](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/1dfacde4-b5c7-4494-8a14-a09d3ab4cc83)
     class SessionHeader < BinData::Record
       endian :big
 
-      uint8 :session_packet_type,  label: 'Session Packet Type'
-      bit7  :flags,                label: 'Flags',              initial_value: 0
-      bit17 :packet_length,        label: 'Packet Length'
+      uint8  :session_packet_type,    label: 'Session Packet Type', initial_value: 0
+      uint24 :stream_protocol_length, label: 'Stream Protocol Length'
     end
   end
 end

data/lib/ruby_smb/smb1/commands.rb

@@ -10,7 +10,7 @@ module RubySMB
       SMB_COM_TRANSACTION2_SECONDARY  = 0x33
       SMB_COM_TREE_DISCONNECT         = 0x71
       SMB_COM_NEGOTIATE               = 0x72
-      SMB_COM_SESSION_SETUP           = 0x73
+      SMB_COM_SESSION_SETUP_ANDX      = 0x73
       SMB_COM_LOGOFF                  = 0x74
       SMB_COM_TREE_CONNECT            = 0x75
       SMB_COM_NT_TRANSACT             = 0xA0

data/lib/ruby_smb/smb1/file.rb

@@ -91,7 +91,7 @@ module RubySMB
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code
         end
         response.status_code
       end
@@ -106,11 +106,7 @@ module RubySMB
       # @raise [RubySMB::Error::InvalidPacket] if the response packet is not valid
       # @raise [RubySMB::Error::UnexpectedStatusCode] if the response NTStatus is not STATUS_SUCCESS
       def read(bytes: @size, offset: 0)
-        atomic_read_size = if bytes > @tree.client.max_buffer_size
-                             @tree.client.max_buffer_size
-                           else
-                             bytes
-                           end
+        atomic_read_size = [bytes, @tree.client.max_buffer_size].min
         remaining_bytes = bytes
         data = ''
 
@@ -127,7 +123,7 @@ module RubySMB
             )
           end
           unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-            raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+            raise RubySMB::Error::UnexpectedStatusCode, response.status_code
           end
 
           if response.is_a?(RubySMB::SMB1::Packet::ReadAndxResponse)
@@ -156,6 +152,8 @@ module RubySMB
       def read_packet(read_length: 0, offset: 0)
         read_request = set_header_fields(RubySMB::SMB1::Packet::ReadAndxRequest.new)
         read_request.parameter_block.max_count_of_bytes_to_return = read_length
+        read_request.parameter_block.min_count_of_bytes_to_return = read_length
+        read_request.parameter_block.remaining = read_length
         read_request.parameter_block.offset = offset
         read_request
       end
@@ -174,7 +172,7 @@ module RubySMB
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code
         end
 
         response.data_block.data.to_binary_s
@@ -225,11 +223,7 @@ module RubySMB
         total_bytes_written = 0
 
         loop do
-          atomic_write_size = if bytes > @tree.client.max_buffer_size
-                               @tree.client.max_buffer_size
-                              else
-                                bytes
-                              end
+          atomic_write_size = [bytes, @tree.client.max_buffer_size].min
           write_request = write_packet(data: buffer.slice!(0, atomic_write_size), offset: offset)
           raw_response = @tree.client.send_recv(write_request)
           response = RubySMB::SMB1::Packet::WriteAndxResponse.read(raw_response)
@@ -242,7 +236,7 @@ module RubySMB
             )
           end
           unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-            raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+            raise RubySMB::Error::UnexpectedStatusCode, response.status_code
           end
           bytes_written = response.parameter_block.count_low + (response.parameter_block.count_high << 16)
           total_bytes_written += bytes_written