ruby_smb 2.0.1 → 2.0.6

data/lib/ruby_smb/dcerpc/winreg/query_value_request.rb

@@ -13,9 +13,10 @@ module RubySMB
 
         rpc_hkey           :hkey
         rrp_unicode_string :lp_value_name
-        string             :pad, length: -> { pad_length }
+        string             :pad1, length: -> { pad_length(self.lp_value_name) }
         ndr_lp_dword       :lp_type
-        ndr_lp_byte        :lp_data
+        ndr_lp_byte_array  :lp_data
+        string             :pad2, length: -> { pad_length(self.lp_data) }
         ndr_lp_dword       :lpcb_data
         ndr_lp_dword       :lpcb_len
 
@@ -24,10 +25,10 @@ module RubySMB
           @opnum = REG_QUERY_VALUE
         end
 
-        # Determines the correct length for the padding in front of
-        # #lp_type. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
           (4 - offset) % 4
         end
       end

data/lib/ruby_smb/dcerpc/winreg/query_value_response.rb

@@ -9,22 +9,22 @@ module RubySMB
 
         endian :little
 
-        ndr_lp_dword :lp_type
-        ndr_lp_byte  :lp_data
-        string       :pad, length: -> { pad_length }
-        ndr_lp_dword :lpcb_data
-        ndr_lp_dword :lpcb_len
-        uint32       :error_status
+        ndr_lp_dword      :lp_type
+        ndr_lp_byte_array :lp_data
+        string            :pad, length: -> { pad_length(self.lp_data) }
+        ndr_lp_dword      :lpcb_data
+        ndr_lp_dword      :lpcb_len
+        uint32            :error_status
 
         def initialize_instance
           super
           @opnum = REG_QUERY_VALUE
         end
 
-        # Determines the correct length for the padding in front of
-        # #lpcb_data. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_data.abs_offset + lp_data.to_binary_s.length) % 4
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
           (4 - offset) % 4
         end
 

data/lib/ruby_smb/dcerpc/winreg/save_key_request.rb

@@ -0,0 +1,37 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegSaveKey Request Packet as defined in
+      # [3.1.5.20 BaseRegSaveKey (Opnum 20)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/f022247d-6ef1-4f46-b195-7f60654f4a0d)
+      class SaveKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey                 :hkey
+        rrp_unicode_string       :lp_file
+        string                   :pad, length: -> { pad_length(self.lp_file) }
+        prpc_security_attributes :lp_security_attributes
+
+        def initialize_instance
+          super
+          @opnum = REG_SAVE_KEY
+        end
+
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+
+

data/lib/ruby_smb/dcerpc/winreg/save_key_response.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegSaveKey Response Packet as defined in
+      # [3.1.5.20 BaseRegSaveKey (Opnum 20)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/f022247d-6ef1-4f46-b195-7f60654f4a0d)
+      class SaveKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        uint32       :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CREATE_KEY
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dispatcher/base.rb

@@ -9,7 +9,7 @@ module RubySMB
       def nbss(packet)
         nbss = RubySMB::Nbss::SessionHeader.new
         nbss.session_packet_type = RubySMB::Nbss::SESSION_MESSAGE
-        nbss.packet_length       = packet.do_num_bytes
+        nbss.stream_protocol_length = packet.do_num_bytes
         nbss.to_binary_s
       end
 

data/lib/ruby_smb/dispatcher/socket.rb

@@ -74,7 +74,7 @@ module RubySMB
           raise ::RubySMB::Error::NetBiosSessionService, 'NBSS Header is missing'
         end
 
-        length = nbss_header.packet_length
+        length = nbss_header.stream_protocol_length
         data = full_response ? nbss_header.to_binary_s : ''
         if length > 0
           if IO.select([@tcp_socket], nil, nil, @read_timeout).nil?

data/lib/ruby_smb/error.rb

@@ -16,23 +16,26 @@ module RubySMB
     # Raised when trying to parse raw binary into a Packet and the data
     # is invalid.
     class InvalidPacket < RubySMBError
+      attr_reader :status_code
       def initialize(args = nil)
         if args.nil?
           super
         elsif args.is_a? String
           super(args)
         elsif args.is_a? Hash
-          expected_proto = args[:expected_proto] ? translate_protocol(args[:expected_proto]) : "???"
-          expected_cmd = args[:expected_cmd] || "???"
-          received_proto = args[:received_proto] ? translate_protocol(args[:received_proto]) : "???"
-          received_cmd = args[:received_cmd] || "???"
+          expected_proto = args[:expected_proto] ? translate_protocol(args[:expected_proto]) : '???'
+          expected_cmd = args[:expected_cmd] || '???'
+          received_proto = args[:packet]&.packet_smb_version || '???'
+          received_cmd = get_cmd(args[:packet]) || '???'
+          @status_code = args[:packet]&.status_code
           super(
             "Expecting #{expected_proto} protocol "\
             "with command=#{expected_cmd}"\
             "#{(" (" + args[:expected_custom] + ")") if args[:expected_custom]}, "\
             "got #{received_proto} protocol "\
             "with command=#{received_cmd}"\
-            "#{(" (" + args[:received_custom] + ")") if args[:received_custom]}"
+            "#{(" (" + args[:received_custom] + ")") if args[:received_custom]}"\
+            "#{(", Status: #{@status_code}") if @status_code}"
           )
         else
           raise ArgumentError, "InvalidPacket expects a String or a Hash, got a #{args.class}"
@@ -50,6 +53,19 @@ module RubySMB
         end
       end
       private :translate_protocol
+
+      def get_cmd(packet)
+        return nil unless packet
+        case packet.packet_smb_version
+        when 'SMB1'
+          packet.smb_header.command
+        when 'SMB2'
+          packet.smb2_header.command
+        else
+          nil
+        end
+      end
+      private :get_cmd
     end
 
     # Raised when a response packet has a NTStatus code that was unexpected.

data/lib/ruby_smb/field/stringz16.rb

@@ -25,12 +25,17 @@ module RubySMB
       # @see BinData::Stringz
       def read_and_return_value(io)
         max_length = eval_parameter(:max_length)
+        if max_length && max_length % 2 != 0
+          raise ArgumentError, "[Stringz16] #max_length should be a multiple of "\
+            "two, since it is Unicode (got #{max_length})"
+        end
         str = ''
         i = 0
         ch = nil
 
         # read until double NULL-byte or we have read in the max number of bytes
-        while (ch != "\0\0") && (i != max_length)
+        loop do
+          break if ch == "\0\0" || (max_length && i == max_length)
           ch = io.readbytes(2)
           str << ch
           i += 2
@@ -46,6 +51,17 @@ module RubySMB
       def truncate_after_first_zero_byte!(str)
         str.sub!(/([^\0]*\0\0\0).*/, '\1')
       end
+
+      def trim_to!(str, max_length = nil)
+        if max_length
+          max_length = 2 if max_length < 2
+          str.slice!(max_length..-1)
+          if str.length == max_length && str[-2, 2] != "\0\0"
+            str[-2, 2] = "\0\0"
+          end
+        end
+      end
+
     end
   end
 end

data/lib/ruby_smb/generic_packet.rb

@@ -49,7 +49,17 @@ module RubySMB
           when /SMB1/
             packet = RubySMB::SMB1::Packet::EmptyPacket.read(val)
           when /SMB2/
-            packet = RubySMB::SMB2::Packet::ErrorPacket.read(val)
+            begin
+              packet = RubySMB::SMB2::Packet::ErrorPacket.read(val)
+            rescue RubySMB::Error::InvalidPacket
+              # Handle the case where an SMB2 error packet is expected, but the
+              # server sent an SMB1 empty packet instead. This behavior has been
+              # observed with older versions of Samba when something goes wrong
+              # on the server side. We just want to give it a chance and try to
+              # parse it as an SMB1 empty packet to keep information and avoid
+              # failing as much as possible.
+              packet = RubySMB::SMB1::Packet::EmptyPacket.read(val)
+            end
           else
             raise RubySMB::Error::InvalidPacket, 'Not a valid SMB packet'
         end

data/lib/ruby_smb/nbss/session_header.rb

@@ -1,13 +1,13 @@
 module RubySMB
   module Nbss
     # Representation of the NetBIOS Session Service Header as defined in
-    # [4.3.1 GENERAL FORMAT OF SESSION PACKETS](https://tools.ietf.org/html/rfc1002)
+    # SMB: [2.1 Transport](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb/f906c680-330c-43ae-9a71-f854e24aeee6)
+    # SMB2: [2.1 Transport](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/1dfacde4-b5c7-4494-8a14-a09d3ab4cc83)
     class SessionHeader < BinData::Record
       endian :big
 
-      uint8 :session_packet_type,  label: 'Session Packet Type'
-      bit7  :flags,                label: 'Flags',              initial_value: 0
-      bit17 :packet_length,        label: 'Packet Length'
+      uint8  :session_packet_type,    label: 'Session Packet Type', initial_value: 0
+      uint24 :stream_protocol_length, label: 'Stream Protocol Length'
     end
   end
 end

data/lib/ruby_smb/smb1/file.rb

@@ -86,8 +86,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::CloseResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
@@ -106,11 +105,7 @@ module RubySMB
       # @raise [RubySMB::Error::InvalidPacket] if the response packet is not valid
       # @raise [RubySMB::Error::UnexpectedStatusCode] if the response NTStatus is not STATUS_SUCCESS
       def read(bytes: @size, offset: 0)
-        atomic_read_size = if bytes > @tree.client.max_buffer_size
-                             @tree.client.max_buffer_size
-                           else
-                             bytes
-                           end
+        atomic_read_size = [bytes, @tree.client.max_buffer_size].min
         remaining_bytes = bytes
         data = ''
 
@@ -122,8 +117,7 @@ module RubySMB
             raise RubySMB::Error::InvalidPacket.new(
               expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
               expected_cmd:   RubySMB::SMB1::Packet::ReadAndxResponse::COMMAND,
-              received_proto: response.smb_header.protocol,
-              received_cmd:   response.smb_header.command
+              packet:         response
             )
           end
           unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
@@ -171,8 +165,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::ReadAndxResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
@@ -193,8 +186,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::Trans2::SetFileInformationResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         response.status_code
@@ -227,11 +219,7 @@ module RubySMB
         total_bytes_written = 0
 
         loop do
-          atomic_write_size = if bytes > @tree.client.max_buffer_size
-                               @tree.client.max_buffer_size
-                              else
-                                bytes
-                              end
+          atomic_write_size = [bytes, @tree.client.max_buffer_size].min
           write_request = write_packet(data: buffer.slice!(0, atomic_write_size), offset: offset)
           raw_response = @tree.client.send_recv(write_request)
           response = RubySMB::SMB1::Packet::WriteAndxResponse.read(raw_response)
@@ -239,8 +227,7 @@ module RubySMB
             raise RubySMB::Error::InvalidPacket.new(
               expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
               expected_cmd:   RubySMB::SMB1::Packet::WriteAndxResponse::COMMAND,
-              received_proto: response.smb_header.protocol,
-              received_cmd:   response.smb_header.command
+              packet:         response
             )
           end
           unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
@@ -279,8 +266,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::WriteAndxResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         response.parameter_block.count_low
@@ -298,8 +284,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::Trans2::SetFileInformationResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         response.status_code
@@ -316,7 +301,7 @@ module RubySMB
         passthrough_info_level = RubySMB::Fscc::FileInformation::FILE_RENAME_INFORMATION +
           RubySMB::Fscc::FileInformation::SMB_INFO_PASSTHROUGH
         rename_request.data_block.trans2_parameters.information_level = passthrough_info_level
-        rename_request.data_block.trans2_data.info_level_struct.file_name = new_file_name.encode('utf-16le')
+        rename_request.data_block.trans2_data.info_level_struct.file_name = new_file_name
         set_trans2_params(rename_request)
       end
 

data/lib/ruby_smb/smb1/packet/trans2/find_first2_response.rb

@@ -40,7 +40,6 @@ module RubySMB
 
           # The {RubySMB::SMB1::DataBlock} specific to this packet type.
           class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            uint8              :name,               label: 'Name', initial_value: 0x00
             string             :pad1,               length: -> { pad1_length }
             trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
             string             :pad2,               length: -> { pad2_length }

data/lib/ruby_smb/smb1/packet/trans2/find_next2_response.rb

@@ -39,7 +39,6 @@ module RubySMB
 
           # The {RubySMB::SMB1::DataBlock} specific to this packet type.
           class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            uint8              :name,               label: 'Name', initial_value: 0x00
             string             :pad1,               length: -> { pad1_length }
             trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
             string             :pad2,               length: -> { pad2_length }

data/lib/ruby_smb/smb1/packet/trans2/open2_response.rb

@@ -44,8 +44,7 @@ module RubySMB
           class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
             string             :pad1,               length: -> { pad1_length }
             trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            string             :trans2_data,        label: 'Trans2 Data', length: 0
+            # trans2_data: No data is sent by this message.
           end
 
           smb_header        :smb_header

data/lib/ruby_smb/smb1/packet/trans2/set_file_information_response.rb

@@ -23,23 +23,11 @@ module RubySMB
             end
           end
 
-          # The Trans2 Data Block for this particular Subcommand
-          class Trans2Data < BinData::Record
-
-            # Returns the length of the Trans2Data struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
-          end
-
           # The {RubySMB::SMB1::DataBlock} specific to this packet type.
           class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            uint8              :name,               label: 'Name', initial_value: 0x00
             string             :pad1,               length: -> { pad1_length }
             trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            trans2_data        :trans2_data,        label: 'Trans2 Data'
+            # trans2_data: No data is sent by this message.
           end
 
           smb_header        :smb_header

data/lib/ruby_smb/smb1/pipe.rb

@@ -16,9 +16,13 @@ module RubySMB
       def initialize(tree:, response:, name:)
         raise ArgumentError, 'No Name Provided' if name.nil?
         case name
-        when 'srvsvc'
+        when 'netlogon', '\\netlogon'
+          extend RubySMB::Dcerpc::Netlogon
+        when 'srvsvc', '\\srvsvc'
           extend RubySMB::Dcerpc::Srvsvc
-        when 'winreg'
+        when 'svcctl', '\\svcctl'
+          extend RubySMB::Dcerpc::Svcctl
+        when 'winreg', '\\winreg'
           extend RubySMB::Dcerpc::Winreg
         end
         super(tree: tree, response: response, name: name)
@@ -41,8 +45,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::Trans::PeekNmpipeRequest::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
 
@@ -100,8 +103,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::Trans::TransactNmpipeResponse::COMMAND,
-            received_proto: trans_nmpipe_response.smb_header.protocol,
-            received_cmd:   trans_nmpipe_response.smb_header.command
+            packet:         trans_nmpipe_response
           )
         end
         unless [WindowsError::NTStatus::STATUS_SUCCESS,