ruby_smb 2.0.0 → 2.0.5

data/examples/write_file.rb

@@ -9,18 +9,20 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-file     = ARGV[4]
-data     = ARGV[5]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+file         = ARGV[4]
+data         = ARGV[5]
+smb_versions = ARGV[6]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/lib/ruby_smb/client.rb

@@ -160,9 +160,16 @@ module RubySMB
 
     # The UID set in SMB1
     # @!attribute [rw] user_id
-    #   @return [String]
+    #   @return [Integer]
     attr_accessor :user_id
 
+    # The Process ID set in SMB1
+    # It is randomly generated during the client initialization, but can
+    # be modified using the accessor.
+    # @!attribute [rw] pid
+    #   @return [Integer]
+    attr_accessor :pid
+
     # The maximum size SMB message that the Client accepts (in bytes)
     # The default value is equal to {MAX_BUFFER_SIZE}.
     # @!attribute [rw] max_buffer_size
@@ -216,10 +223,10 @@ module RubySMB
     #   @return [String]
     attr_accessor :server_encryption_key
 
-    # Whether or not encryption is required (SMB 3.x)
-    # @!attribute [rw] encryption_required
+    # Whether or not the whole session needs to be encrypted (SMB 3.x)
+    # @!attribute [rw] session_encrypt_data
     #   @return [Boolean]
-    attr_accessor :encryption_required
+    attr_accessor :session_encrypt_data
 
     # The encryption algorithms supported by the server (SMB 3.x).
     # @!attribute [rw] server_encryption_algorithms
@@ -233,12 +240,39 @@ module RubySMB
     #     (constants defined in RubySMB::SMB2::CompressionCapabilities)
     attr_accessor :server_compression_algorithms
 
+    # The GUID of the server (SMB 2.x and 3.x).
+    # @!attribute [rw] server_guid
+    #   @return [String]
+    attr_accessor :server_guid
+
+    # The server's start time if it is reported as part of the negotiation
+    # process (SMB 2.x and 3.x). This value is nil if the server does not report
+    # it (reports a value of 0).
+    # @!attribute [rw] server_start_time
+    #   @return [Time] the time that the server reports that it was started at
+    attr_accessor :server_start_time
+
+    # The server's current time if it is reported as part of the negotiation
+    # process (SMB 2.x and 3.x). This value is nil if the server does not report
+    # it (reports a value of 0).
+    # @!attribute [rw] server_system_time
+    #   @return [Time] the time that the server reports as current
+    attr_accessor :server_system_time
+
     # The SMB version that has been successfully negotiated. This value is only
     # set after the NEGOTIATE handshake has been performed.
     # @!attribute [rw] negotiated_smb_version
     #   @return [Integer] the negotiated SMB version
     attr_accessor :negotiated_smb_version
 
+    # Whether or not the server supports multi-credit operations. It is
+    # reported by the LARGE_MTU capabiliy as part of the negotiation process
+    # (SMB 2.x and 3.x).
+    # @!attribute [rw] server_supports_multi_credit
+    #   @return [Boolean] true if the server supports multi-credit operations,
+    #   false otherwise
+    attr_accessor :server_supports_multi_credit
+
     # @param dispatcher [RubySMB::Dispatcher::Socket] the packet dispatcher to use
     # @param smb1 [Boolean] whether or not to enable SMB1 support
     # @param smb2 [Boolean] whether or not to enable SMB2 support
@@ -249,6 +283,7 @@ module RubySMB
         raise ArgumentError, 'You must enable at least one Protocol'
       end
       @dispatcher        = dispatcher
+      @pid               = rand(0xFFFF)
       @domain            = domain
       @local_workstation = local_workstation
       @password          = password.encode('utf-8') || ''.encode('utf-8')
@@ -266,14 +301,16 @@ module RubySMB
       @server_max_read_size   = RubySMB::SMB2::File::MAX_PACKET_SIZE
       @server_max_write_size  = RubySMB::SMB2::File::MAX_PACKET_SIZE
       @server_max_transact_size = RubySMB::SMB2::File::MAX_PACKET_SIZE
+      @server_supports_multi_credit = false
 
       # SMB 3.x options
-      @encryption_required = always_encrypt
+      @session_encrypt_data = always_encrypt
 
       negotiate_version_flag = 0x02000000
       flags = Net::NTLM::Client::DEFAULT_FLAGS |
         Net::NTLM::FLAGS[:TARGET_INFO] |
-        negotiate_version_flag
+        negotiate_version_flag ^
+        Net::NTLM::FLAGS[:OEM]
 
       @ntlm_client = Net::NTLM::Client.new(
         @username,
@@ -324,7 +361,7 @@ module RubySMB
     # @param packet [RubySMB::GenericPacket] the packet to set the message id for
     # @return [RubySMB::GenericPacket] the modified packet
     def increment_smb_message_id(packet)
-      packet.smb2_header.message_id = smb2_message_id
+      packet.smb2_header.message_id = self.smb2_message_id
       self.smb2_message_id += 1
       packet
     end
@@ -347,7 +384,8 @@ module RubySMB
       negotiate_version_flag = 0x02000000
       flags = Net::NTLM::Client::DEFAULT_FLAGS |
         Net::NTLM::FLAGS[:TARGET_INFO] |
-        negotiate_version_flag
+        negotiate_version_flag ^
+        Net::NTLM::FLAGS[:OEM]
 
       @ntlm_client = Net::NTLM::Client.new(
           @username,
@@ -373,8 +411,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::LogoffResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
       else
@@ -385,8 +422,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::LogoffResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
       end
@@ -398,12 +434,16 @@ module RubySMB
     # It will also sign the packet if neccessary.
     #
     # @param packet [RubySMB::GenericPacket] the request to be sent
+    # @param encrypt [Boolean] true if encryption has to be enabled for this transaction
+    #   (note that if @session_encrypt_data is set, encryption will be enabled
+    #   regardless of this parameter value)
     # @return [String] the raw response data received
     def send_recv(packet, encrypt: false)
       version = packet.packet_smb_version
       case version
       when 'SMB1'
-        packet.smb_header.uid = user_id if user_id
+        packet.smb_header.uid = self.user_id if self.user_id
+        packet.smb_header.pid_low = self.pid if self.pid
         packet = smb1_sign(packet)
       when 'SMB2'
         packet = increment_smb_message_id(packet)
@@ -419,84 +459,107 @@ module RubySMB
         packet = packet
       end
 
-      if can_be_encrypted?(packet) && encryption_supported? && (@encryption_required || encrypt)
-        send_encrypt(packet)
-        raw_response = recv_encrypt
-        loop do
-          break unless is_status_pending?(raw_response)
-          sleep 1
-          raw_response = recv_encrypt
-        end
-      else
-        dispatcher.send_packet(packet)
-        raw_response = dispatcher.recv_packet
-        loop do
-          break unless is_status_pending?(raw_response)
-          sleep 1
-          raw_response = dispatcher.recv_packet
-        end unless version == 'SMB1'
+      encrypt_data = false
+      if can_be_encrypted?(packet) && encryption_supported? && (@session_encrypt_data || encrypt)
+        encrypt_data = true
       end
+      send_packet(packet, encrypt: encrypt_data)
+      raw_response = recv_packet(encrypt: encrypt_data)
+      smb2_header = nil
+      loop do
+        smb2_header = RubySMB::SMB2::SMB2Header.read(raw_response)
+        break unless is_status_pending?(smb2_header)
+        sleep 1
+        raw_response = recv_packet(encrypt: encrypt_data)
+      rescue IOError
+        # We're expecting an SMB2 packet, but the server sent an SMB1 packet
+        # instead. This behavior has been observed with older versions of Samba
+        # when something goes wrong on the server side. So, we just ignore it
+        # and expect the caller to handle this wrong response packet.
+        break
+      end unless version == 'SMB1'
 
       self.sequence_counter += 1 if signing_required && !session_key.empty?
+      # update the SMB2 message ID according to the received Credit Charged
+      self.smb2_message_id += smb2_header.credit_charge - 1 if smb2_header && self.server_supports_multi_credit
       raw_response
     end
 
     # Check if the response is an asynchronous operation with STATUS_PENDING
     # status code.
     #
-    # @param raw_response [String] the raw response packet
+    # @param smb2_header [String] the response packet SMB2 header
     # @return [Boolean] true if it is a status pending operation, false otherwise
-    def is_status_pending?(raw_response)
-      smb2_header = RubySMB::SMB2::SMB2Header.read(raw_response)
+    def is_status_pending?(smb2_header)
       value = smb2_header.nt_status.value
       status_code = WindowsError::NTStatus.find_by_retval(value).first
       status_code == WindowsError::NTStatus::STATUS_PENDING &&
         smb2_header.flags.async_command == 1
     end
 
-    # Check if the request packet can be encrypted. Per the SMB spec,
+    # Check if the request packet can be encrypted. Per the SMB2 spec,
     # SessionSetupRequest and NegotiateRequest must not be encrypted.
     #
     # @param packet [RubySMB::GenericPacket] the request packet
     # @return [Boolean] true if the packet can be encrypted
     def can_be_encrypted?(packet)
+      return false if packet.packet_smb_version == 'SMB1'
       [RubySMB::SMB2::Packet::SessionSetupRequest, RubySMB::SMB2::Packet::NegotiateRequest].none? do |klass|
         packet.is_a?(klass)
       end
     end
 
-    # Check if the current dialect support encryption.
+    # Check if the current dialect supports encryption.
     #
     # @return [Boolean] true if encryption is supported
     def encryption_supported?
       ['0x0300', '0x0302', '0x0311'].include?(@dialect)
     end
 
-    # Encrypt and send a packet
-    def send_encrypt(packet)
-      begin
-        transform_request = smb3_encrypt(packet.to_binary_s)
-      rescue RubySMB::Error::RubySMBError => e
-        raise RubySMB::Error::EncryptionError, "Error while encrypting #{packet.class.name} packet (SMB #{@dialect}): #{e}"
+    # Encrypt (if required) and send a packet.
+    #
+    # @param encrypt [Boolean] true if the packet should be encrypted, false
+    #   otherwise
+    def send_packet(packet, encrypt: false)
+      if encrypt
+        begin
+          packet = smb3_encrypt(packet.to_binary_s)
+        rescue RubySMB::Error::RubySMBError => e
+          raise RubySMB::Error::EncryptionError, "Error while encrypting #{packet.class.name} packet (SMB #{@dialect}): #{e}"
+        end
       end
-      dispatcher.send_packet(transform_request)
+      dispatcher.send_packet(packet)
     end
 
-    # Receives the raw response through the Dispatcher and decrypt the packet.
+    # Receives the raw response through the Dispatcher and decrypt the packet (if required).
     #
+    # @param encrypt [Boolean] true if the packet is encrypted, false otherwise
     # @return [String] the raw unencrypted packet
-    def recv_encrypt
-      raw_response = dispatcher.recv_packet
+    def recv_packet(encrypt: false)
       begin
-        transform_response = RubySMB::SMB2::Packet::TransformHeader.read(raw_response)
-      rescue IOError
-        raise RubySMB::Error::InvalidPacket, 'Not a SMB2 TransformHeader packet'
+        raw_response = dispatcher.recv_packet
+      rescue RubySMB::Error::CommunicationError => e
+        if encrypt
+          raise RubySMB::Error::EncryptionError, "Communication error with the "\
+            "remote host: #{e.message}. The server supports encryption but was "\
+            "not able to handle the encrypted request."
+        else
+          raise e
+        end
       end
-      begin
-        smb3_decrypt(transform_response)
-      rescue RubySMB::Error::RubySMBError => e
-        raise RubySMB::Error::EncryptionError, "Error while decrypting #{transform_response.class.name} packet (SMB #@dialect}): #{e}"
+      if encrypt
+        begin
+          transform_response = RubySMB::SMB2::Packet::TransformHeader.read(raw_response)
+        rescue IOError
+          raise RubySMB::Error::InvalidPacket, 'Not a SMB2 TransformHeader packet'
+        end
+        begin
+          raw_response = smb3_decrypt(transform_response)
+        rescue RubySMB::Error::RubySMBError => e
+          raise RubySMB::Error::EncryptionError, "Error while decrypting #{transform_response.class.name} packet (SMB #@dialect}): #{e}"
+        end
       end
+      raw_response
     end
 
     # Connects to the supplied share
@@ -520,7 +583,7 @@ module RubySMB
     # @param [String] host
     def net_share_enum_all(host)
       tree = tree_connect("\\\\#{host}\\IPC$")
-      named_pipe = tree.open_file(filename: "srvsvc", write: true, read: true)
+      named_pipe = tree.open_pipe(filename: "srvsvc", write: true, read: true)
       named_pipe.net_share_enum_all(host)
     end
 
@@ -537,6 +600,7 @@ module RubySMB
       self.smb2_message_id  = 0
       self.client_encryption_key = nil
       self.server_encryption_key = nil
+      self.server_supports_multi_credit = false
     end
 
     # Requests a NetBIOS Session Service using the provided name.
@@ -574,7 +638,7 @@ module RubySMB
       session_request.session_header.session_packet_type = RubySMB::Nbss::SESSION_REQUEST
       session_request.called_name  = called_name
       session_request.calling_name = calling_name
-      session_request.session_header.packet_length =
+      session_request.session_header.stream_protocol_length =
         session_request.num_bytes - session_request.session_header.num_bytes
       session_request
     end

data/lib/ruby_smb/client/authentication.rb

@@ -60,8 +60,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::SessionSetupLegacyResponse::COMMAND,
-            received_proto: packet.smb_header.protocol,
-            received_cmd:   packet.smb_header.command
+            packet:         packet
           )
         end
         packet
@@ -154,8 +153,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb_header.protocol,
-            received_cmd:   packet.smb_header.command
+            packet:         packet
           )
         end
         packet
@@ -168,8 +166,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb_header.protocol,
-            received_cmd:   packet.smb_header.command
+            packet:         packet
           )
         end
 
@@ -216,8 +213,8 @@ module RubySMB
         raw = smb2_ntlmssp_authenticate(type3_message, @session_id)
         response = smb2_ntlmssp_final_packet(raw)
 
-        if @smb3 && !@encryption_required && response.session_flags.encrypt_data == 1
-          @encryption_required = true
+        if @smb3 && !@session_encrypt_data && response.session_flags.encrypt_data == 1
+          @session_encrypt_data = true
         end
         ######
         # DEBUG
@@ -236,8 +233,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb2_header.protocol,
-            received_cmd:   packet.smb2_header.command
+            packet:         packet
           )
         end
 
@@ -251,8 +247,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb2_header.protocol,
-            received_cmd:   packet.smb2_header.command
+            packet:         packet
           )
         end
 

data/lib/ruby_smb/client/echo.rb

@@ -21,8 +21,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::EchoResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         response
@@ -40,8 +39,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::EchoResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
         response

data/lib/ruby_smb/client/negotiation.rb

@@ -18,12 +18,11 @@ module RubySMB
         # This is only valid for SMB1.
         response_packet.dialects = request_packet.dialects if response_packet.respond_to? :dialects=
         version = parse_negotiate_response(response_packet)
-        case @dialect
-        when '0x0300', '0x0302'
-          @encryption_algorithm = RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM]
-        when '0x0311'
-          parse_smb3_encryption_data(request_packet, response_packet)
+        if @dialect == '0x0311'
+          update_preauth_hash(request_packet)
+          update_preauth_hash(response_packet)
         end
+
         # If the response contains the SMB2 wildcard revision number dialect;
         # it indicates that the server implements SMB 2.1 or future dialect
         # revisions and expects the client to send a subsequent SMB2 Negotiate
@@ -84,16 +83,14 @@ module RubySMB
               expected_proto:  RubySMB::SMB1::SMB_PROTOCOL_ID,
               expected_cmd:    RubySMB::SMB1::Packet::NegotiateResponseExtended::COMMAND,
               expected_custom: "extended_security=1",
-              received_proto:  packet.smb_header.protocol,
-              received_cmd:    packet.smb_header.command,
+              packet:          packet,
               received_custom: "extended_security=#{extended_security}"
             )
           elsif packet.packet_smb_version == 'SMB2'
             raise RubySMB::Error::InvalidPacket.new(
               expected_proto:  RubySMB::SMB2::SMB2_PROTOCOL_ID,
               expected_cmd:    RubySMB::SMB2::Packet::NegotiateResponse::COMMAND,
-              received_proto:  packet.smb2_header.protocol,
-              received_cmd:    packet.smb2_header.command
+              packet:          packet
             )
           else
             raise RubySMB::Error::InvalidPacket, 'Unknown SMB protocol version'
@@ -122,6 +119,7 @@ module RubySMB
           # protocol overhead every time.
           self.server_max_buffer_size = packet.parameter_block.max_buffer_size - 260
           self.negotiated_smb_version = 1
+          self.session_encrypt_data = false
           'SMB1'
         when RubySMB::SMB2::Packet::NegotiateResponse
           self.smb1 = false
@@ -137,6 +135,23 @@ module RubySMB
           # This value is used in SMB1 only but calculate a valid value anyway
           self.server_max_buffer_size = [self.server_max_read_size, self.server_max_write_size, self.server_max_transact_size].min
           self.negotiated_smb_version = self.smb2 ? 2 : 3
+          self.server_guid = packet.server_guid
+          self.server_start_time = packet.server_start_time.to_time if packet.server_start_time != 0
+          self.server_system_time = packet.system_time.to_time if packet.system_time != 0
+          self.server_supports_multi_credit = self.dialect != '0x0202' && packet&.capabilities&.large_mtu == 1
+          case self.dialect
+          when '0x02ff'
+          when '0x0300', '0x0302'
+            if packet&.capabilities&.encryption == 1
+              self.encryption_algorithm = RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM]
+            end
+            self.session_encrypt_data = self.session_encrypt_data && !self.encryption_algorithm.nil?
+          when '0x0311'
+            parse_smb3_capabilities(packet)
+            self.session_encrypt_data = self.session_encrypt_data && !self.encryption_algorithm.nil?
+          else
+            self.session_encrypt_data = false
+          end
           return "SMB#{self.negotiated_smb_version}"
         else
           error = 'Unable to negotiate with remote host'
@@ -149,7 +164,7 @@ module RubySMB
         end
       end
 
-      def parse_smb3_encryption_data(request_packet, response_packet)
+      def parse_smb3_capabilities(response_packet)
         nc = response_packet.find_negotiate_context(
           RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
         )
@@ -179,8 +194,6 @@ module RubySMB
             'Unable to retrieve the encryption cipher list supported by the server from the Negotiate response'
           )
         end
-        update_preauth_hash(request_packet)
-        update_preauth_hash(response_packet)
 
         nc = response_packet.find_negotiate_context(
           RubySMB::SMB2::NegotiateContext::SMB2_COMPRESSION_CAPABILITIES
@@ -198,6 +211,12 @@ module RubySMB
         # while being guaranteed to work with any modern Windows system. We can get more sophisticated
         # with switching this on and off at a later date if the need arises.
         packet.smb_header.flags2.extended_security = 1
+        # Recent Mac OS X requires the unicode flag to be set on the Negotiate
+        # SMB Header request, even if this packet does not contain string fields
+        # (see Flags2 SMB_FLAGS2_UNICODE definition in "2.2.3.1 The SMB Header"
+        # documentation:
+        # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/69a29f73-de0c-45a6-a1aa-8ceeea42217f
+        packet.smb_header.flags2.unicode = 1
         # There is no real good reason to ever send an SMB1 Negotiate packet
         # to Negotiate strictly SMB2, but the protocol WILL support it
         packet.add_dialect(SMB1_DIALECT_SMB1_DEFAULT) if smb1