ruby_smb 2.0.12 → 2.0.13

Sign up to get free protection for your applications and to get access to all the features.
Files changed (194) hide show
  1. checksums.yaml +4 -4
  2. checksums.yaml.gz.sig +0 -0
  3. data/.github/workflows/verify.yml +1 -1
  4. data/examples/dump_secrets_from_sid.rb +207 -0
  5. data/examples/enum_domain_users.rb +75 -0
  6. data/examples/get_computer_info.rb +42 -0
  7. data/examples/query_service_status.rb +42 -4
  8. data/lib/ruby_smb/client.rb +3 -14
  9. data/lib/ruby_smb/dcerpc/bind.rb +28 -20
  10. data/lib/ruby_smb/dcerpc/bind_ack.rb +29 -28
  11. data/lib/ruby_smb/dcerpc/client.rb +542 -0
  12. data/lib/ruby_smb/dcerpc/drsr/drs_bind_request.rb +24 -0
  13. data/lib/ruby_smb/dcerpc/drsr/drs_bind_response.rb +26 -0
  14. data/lib/ruby_smb/dcerpc/drsr/drs_crack_names_request.rb +57 -0
  15. data/lib/ruby_smb/dcerpc/drsr/drs_crack_names_response.rb +76 -0
  16. data/lib/ruby_smb/dcerpc/drsr/drs_domain_controller_info_request.rb +46 -0
  17. data/lib/ruby_smb/dcerpc/drsr/drs_domain_controller_info_response.rb +168 -0
  18. data/lib/ruby_smb/dcerpc/drsr/drs_extensions.rb +56 -0
  19. data/lib/ruby_smb/dcerpc/drsr/drs_get_nc_changes_request.rb +121 -0
  20. data/lib/ruby_smb/dcerpc/drsr/drs_get_nc_changes_response.rb +118 -0
  21. data/lib/ruby_smb/dcerpc/drsr/drs_unbind_request.rb +24 -0
  22. data/lib/ruby_smb/dcerpc/drsr/drs_unbind_response.rb +26 -0
  23. data/lib/ruby_smb/dcerpc/drsr.rb +909 -0
  24. data/lib/ruby_smb/dcerpc/epm/epm_ept_map_request.rb +26 -0
  25. data/lib/ruby_smb/dcerpc/epm/epm_ept_map_response.rb +25 -0
  26. data/lib/ruby_smb/dcerpc/epm/epm_twrt.rb +211 -0
  27. data/lib/ruby_smb/dcerpc/epm.rb +75 -0
  28. data/lib/ruby_smb/dcerpc/error.rb +17 -0
  29. data/lib/ruby_smb/dcerpc/ndr.rb +1159 -297
  30. data/lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_request.rb +3 -13
  31. data/lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_response.rb +3 -3
  32. data/lib/ruby_smb/dcerpc/netlogon/netr_server_password_set2_request.rb +3 -13
  33. data/lib/ruby_smb/dcerpc/netlogon/netr_server_password_set2_response.rb +1 -1
  34. data/lib/ruby_smb/dcerpc/netlogon/netr_server_req_challenge_request.rb +3 -11
  35. data/lib/ruby_smb/dcerpc/netlogon/netr_server_req_challenge_response.rb +1 -1
  36. data/lib/ruby_smb/dcerpc/netlogon.rb +5 -4
  37. data/lib/ruby_smb/dcerpc/p_syntax_id_t.rb +4 -3
  38. data/lib/ruby_smb/dcerpc/pdu_header.rb +7 -7
  39. data/lib/ruby_smb/dcerpc/ptypes.rb +1 -0
  40. data/lib/ruby_smb/dcerpc/request.rb +79 -32
  41. data/lib/ruby_smb/dcerpc/response.rb +45 -10
  42. data/lib/ruby_smb/dcerpc/rpc_auth3.rb +28 -0
  43. data/lib/ruby_smb/dcerpc/rpc_security_attributes.rb +11 -11
  44. data/lib/ruby_smb/dcerpc/rrp_rpc_unicode_string.rb +118 -0
  45. data/lib/ruby_smb/dcerpc/samr/rpc_sid.rb +150 -0
  46. data/lib/ruby_smb/dcerpc/samr/samr_close_handle_request.rb +23 -0
  47. data/lib/ruby_smb/dcerpc/samr/samr_close_handle_response.rb +24 -0
  48. data/lib/ruby_smb/dcerpc/samr/samr_connect_request.rb +32 -0
  49. data/lib/ruby_smb/dcerpc/samr/samr_connect_response.rb +23 -0
  50. data/lib/ruby_smb/dcerpc/samr/samr_enumerate_users_in_domain_request.rb +26 -0
  51. data/lib/ruby_smb/dcerpc/samr/samr_enumerate_users_in_domain_response.rb +55 -0
  52. data/lib/ruby_smb/dcerpc/samr/samr_get_alias_membership_request.rb +48 -0
  53. data/lib/ruby_smb/dcerpc/samr/samr_get_alias_membership_response.rb +38 -0
  54. data/lib/ruby_smb/dcerpc/samr/samr_get_groups_for_user_request.rb +23 -0
  55. data/lib/ruby_smb/dcerpc/samr/samr_get_groups_for_user_response.rb +48 -0
  56. data/lib/ruby_smb/dcerpc/samr/samr_lookup_domain_in_sam_server_request.rb +24 -0
  57. data/lib/ruby_smb/dcerpc/samr/samr_lookup_domain_in_sam_server_response.rb +25 -0
  58. data/lib/ruby_smb/dcerpc/samr/samr_open_domain_request.rb +27 -0
  59. data/lib/ruby_smb/dcerpc/samr/samr_open_domain_response.rb +24 -0
  60. data/lib/ruby_smb/dcerpc/samr/samr_open_user_request.rb +26 -0
  61. data/lib/ruby_smb/dcerpc/samr/samr_open_user_response.rb +24 -0
  62. data/lib/ruby_smb/dcerpc/samr/samr_rid_to_sid_request.rb +23 -0
  63. data/lib/ruby_smb/dcerpc/samr/samr_rid_to_sid_response.rb +23 -0
  64. data/lib/ruby_smb/dcerpc/samr.rb +613 -0
  65. data/lib/ruby_smb/dcerpc/sec_trailer.rb +26 -0
  66. data/lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all.rb +56 -79
  67. data/lib/ruby_smb/dcerpc/srvsvc.rb +27 -4
  68. data/lib/ruby_smb/dcerpc/svcctl/change_service_config_w_request.rb +13 -25
  69. data/lib/ruby_smb/dcerpc/svcctl/change_service_config_w_response.rb +2 -2
  70. data/lib/ruby_smb/dcerpc/svcctl/close_service_handle_response.rb +1 -1
  71. data/lib/ruby_smb/dcerpc/svcctl/control_service_request.rb +1 -1
  72. data/lib/ruby_smb/dcerpc/svcctl/control_service_response.rb +1 -1
  73. data/lib/ruby_smb/dcerpc/svcctl/open_sc_manager_w_request.rb +4 -14
  74. data/lib/ruby_smb/dcerpc/svcctl/open_sc_manager_w_response.rb +1 -1
  75. data/lib/ruby_smb/dcerpc/svcctl/open_service_w_request.rb +3 -11
  76. data/lib/ruby_smb/dcerpc/svcctl/open_service_w_response.rb +1 -1
  77. data/lib/ruby_smb/dcerpc/svcctl/query_service_config_w_request.rb +1 -1
  78. data/lib/ruby_smb/dcerpc/svcctl/query_service_config_w_response.rb +12 -11
  79. data/lib/ruby_smb/dcerpc/svcctl/query_service_status_response.rb +1 -1
  80. data/lib/ruby_smb/dcerpc/svcctl/service_status.rb +9 -8
  81. data/lib/ruby_smb/dcerpc/svcctl/start_service_w_request.rb +3 -3
  82. data/lib/ruby_smb/dcerpc/svcctl/start_service_w_response.rb +1 -1
  83. data/lib/ruby_smb/dcerpc/svcctl.rb +1 -3
  84. data/lib/ruby_smb/dcerpc/uuid.rb +3 -0
  85. data/lib/ruby_smb/dcerpc/winreg/close_key_response.rb +2 -2
  86. data/lib/ruby_smb/dcerpc/winreg/create_key_request.rb +2 -13
  87. data/lib/ruby_smb/dcerpc/winreg/create_key_response.rb +3 -3
  88. data/lib/ruby_smb/dcerpc/winreg/enum_key_request.rb +3 -20
  89. data/lib/ruby_smb/dcerpc/winreg/enum_key_response.rb +3 -20
  90. data/lib/ruby_smb/dcerpc/winreg/enum_value_request.rb +5 -14
  91. data/lib/ruby_smb/dcerpc/winreg/enum_value_response.rb +5 -14
  92. data/lib/ruby_smb/dcerpc/winreg/open_key_request.rb +1 -9
  93. data/lib/ruby_smb/dcerpc/winreg/open_key_response.rb +4 -3
  94. data/lib/ruby_smb/dcerpc/winreg/open_root_key_request.rb +5 -6
  95. data/lib/ruby_smb/dcerpc/winreg/open_root_key_response.rb +2 -2
  96. data/lib/ruby_smb/dcerpc/winreg/query_info_key_response.rb +9 -18
  97. data/lib/ruby_smb/dcerpc/winreg/query_value_request.rb +4 -14
  98. data/lib/ruby_smb/dcerpc/winreg/query_value_response.rb +7 -15
  99. data/lib/ruby_smb/dcerpc/winreg/regsam.rb +3 -1
  100. data/lib/ruby_smb/dcerpc/winreg/save_key_request.rb +0 -9
  101. data/lib/ruby_smb/dcerpc/winreg/save_key_response.rb +1 -1
  102. data/lib/ruby_smb/dcerpc/winreg.rb +10 -14
  103. data/lib/ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_request.rb +26 -0
  104. data/lib/ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_response.rb +88 -0
  105. data/lib/ruby_smb/dcerpc/wkssvc.rb +65 -0
  106. data/lib/ruby_smb/dcerpc.rb +41 -11
  107. data/lib/ruby_smb/field/file_time.rb +1 -1
  108. data/lib/ruby_smb/field/string16.rb +5 -1
  109. data/lib/ruby_smb/ntlm.rb +18 -2
  110. data/lib/ruby_smb/smb1/pipe.rb +4 -0
  111. data/lib/ruby_smb/smb2/pipe.rb +4 -0
  112. data/lib/ruby_smb/version.rb +1 -1
  113. data/spec/lib/ruby_smb/client_spec.rb +1 -2
  114. data/spec/lib/ruby_smb/dcerpc/bind_ack_spec.rb +69 -41
  115. data/spec/lib/ruby_smb/dcerpc/bind_spec.rb +75 -21
  116. data/spec/lib/ruby_smb/dcerpc/client_spec.rb +714 -0
  117. data/spec/lib/ruby_smb/dcerpc/drsr_spec.rb +2169 -0
  118. data/spec/lib/ruby_smb/dcerpc/ndr_spec.rb +3792 -1373
  119. data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_request_spec.rb +4 -4
  120. data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_password_set2_request_spec.rb +4 -4
  121. data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_req_challenge_request_spec.rb +2 -2
  122. data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_req_challenge_response_spec.rb +2 -2
  123. data/spec/lib/ruby_smb/dcerpc/p_syntax_id_t_spec.rb +18 -4
  124. data/spec/lib/ruby_smb/dcerpc/pdu_header_spec.rb +27 -1
  125. data/spec/lib/ruby_smb/dcerpc/request_spec.rb +76 -11
  126. data/spec/lib/ruby_smb/dcerpc/response_spec.rb +99 -9
  127. data/spec/lib/ruby_smb/dcerpc/rpc_auth3_spec.rb +75 -0
  128. data/spec/lib/ruby_smb/dcerpc/rpc_security_attributes_spec.rb +29 -28
  129. data/spec/lib/ruby_smb/dcerpc/rrp_rpc_unicode_string_spec.rb +340 -0
  130. data/spec/lib/ruby_smb/dcerpc/samr/rpc_sid_spec.rb +116 -0
  131. data/spec/lib/ruby_smb/dcerpc/samr/samr_close_handle_request_spec.rb +40 -0
  132. data/spec/lib/ruby_smb/dcerpc/samr/samr_close_handle_response_spec.rb +48 -0
  133. data/spec/lib/ruby_smb/dcerpc/samr/samr_connect_request_spec.rb +56 -0
  134. data/spec/lib/ruby_smb/dcerpc/samr/samr_connect_response_spec.rb +47 -0
  135. data/spec/lib/ruby_smb/dcerpc/samr/samr_enumerate_users_in_domain_request_spec.rb +63 -0
  136. data/spec/lib/ruby_smb/dcerpc/samr/samr_enumerate_users_in_domain_response_spec.rb +265 -0
  137. data/spec/lib/ruby_smb/dcerpc/samr/samr_lookup_domain_in_sam_server_request_spec.rb +52 -0
  138. data/spec/lib/ruby_smb/dcerpc/samr/samr_lookup_domain_in_sam_server_response_spec.rb +36 -0
  139. data/spec/lib/ruby_smb/dcerpc/samr/samr_open_domain_request_spec.rb +56 -0
  140. data/spec/lib/ruby_smb/dcerpc/samr/samr_open_domain_response_spec.rb +48 -0
  141. data/spec/lib/ruby_smb/dcerpc/samr/samr_rid_to_sid_request_spec.rb +48 -0
  142. data/spec/lib/ruby_smb/dcerpc/samr/samr_rid_to_sid_response_spec.rb +42 -0
  143. data/spec/lib/ruby_smb/dcerpc/samr_spec.rb +420 -0
  144. data/spec/lib/ruby_smb/dcerpc/sec_trailer_spec.rb +92 -0
  145. data/spec/lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all_spec.rb +149 -110
  146. data/spec/lib/ruby_smb/dcerpc/srvsvc_spec.rb +21 -17
  147. data/spec/lib/ruby_smb/dcerpc/svcctl/change_service_config_w_request_spec.rb +56 -79
  148. data/spec/lib/ruby_smb/dcerpc/svcctl/change_service_config_w_response_spec.rb +4 -4
  149. data/spec/lib/ruby_smb/dcerpc/svcctl/close_service_handle_response_spec.rb +2 -2
  150. data/spec/lib/ruby_smb/dcerpc/svcctl/control_service_request_spec.rb +2 -2
  151. data/spec/lib/ruby_smb/dcerpc/svcctl/control_service_response_spec.rb +2 -2
  152. data/spec/lib/ruby_smb/dcerpc/svcctl/open_sc_manager_w_request_spec.rb +19 -29
  153. data/spec/lib/ruby_smb/dcerpc/svcctl/open_sc_manager_w_response_spec.rb +2 -2
  154. data/spec/lib/ruby_smb/dcerpc/svcctl/open_service_w_request_spec.rb +9 -15
  155. data/spec/lib/ruby_smb/dcerpc/svcctl/open_service_w_response_spec.rb +2 -2
  156. data/spec/lib/ruby_smb/dcerpc/svcctl/query_service_config_w_request_spec.rb +2 -2
  157. data/spec/lib/ruby_smb/dcerpc/svcctl/query_service_config_w_response_spec.rb +22 -22
  158. data/spec/lib/ruby_smb/dcerpc/svcctl/query_service_status_response_spec.rb +2 -2
  159. data/spec/lib/ruby_smb/dcerpc/svcctl/service_status_spec.rb +18 -14
  160. data/spec/lib/ruby_smb/dcerpc/svcctl/start_service_w_request_spec.rb +5 -4
  161. data/spec/lib/ruby_smb/dcerpc/svcctl/start_service_w_response_spec.rb +2 -2
  162. data/spec/lib/ruby_smb/dcerpc/svcctl_spec.rb +1 -5
  163. data/spec/lib/ruby_smb/dcerpc/uuid_spec.rb +15 -23
  164. data/spec/lib/ruby_smb/dcerpc/winreg/close_key_response_spec.rb +2 -2
  165. data/spec/lib/ruby_smb/dcerpc/winreg/create_key_request_spec.rb +4 -41
  166. data/spec/lib/ruby_smb/dcerpc/winreg/create_key_response_spec.rb +4 -4
  167. data/spec/lib/ruby_smb/dcerpc/winreg/enum_key_request_spec.rb +4 -52
  168. data/spec/lib/ruby_smb/dcerpc/winreg/enum_key_response_spec.rb +4 -56
  169. data/spec/lib/ruby_smb/dcerpc/winreg/enum_value_request_spec.rb +10 -34
  170. data/spec/lib/ruby_smb/dcerpc/winreg/enum_value_response_spec.rb +10 -34
  171. data/spec/lib/ruby_smb/dcerpc/winreg/open_key_request_spec.rb +2 -26
  172. data/spec/lib/ruby_smb/dcerpc/winreg/open_key_response_spec.rb +2 -2
  173. data/spec/lib/ruby_smb/dcerpc/winreg/open_root_key_request_spec.rb +17 -25
  174. data/spec/lib/ruby_smb/dcerpc/winreg/open_root_key_response_spec.rb +2 -2
  175. data/spec/lib/ruby_smb/dcerpc/winreg/query_info_key_response_spec.rb +20 -44
  176. data/spec/lib/ruby_smb/dcerpc/winreg/query_value_request_spec.rb +8 -32
  177. data/spec/lib/ruby_smb/dcerpc/winreg/query_value_response_spec.rb +10 -22
  178. data/spec/lib/ruby_smb/dcerpc/winreg/regsam_spec.rb +4 -0
  179. data/spec/lib/ruby_smb/dcerpc/winreg/save_key_request_spec.rb +0 -12
  180. data/spec/lib/ruby_smb/dcerpc/winreg/save_key_response_spec.rb +2 -2
  181. data/spec/lib/ruby_smb/dcerpc/winreg_spec.rb +18 -47
  182. data/spec/lib/ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_request_spec.rb +43 -0
  183. data/spec/lib/ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_response_spec.rb +410 -0
  184. data/spec/lib/ruby_smb/dcerpc/wkssvc_spec.rb +70 -0
  185. data/spec/lib/ruby_smb/field/string16_spec.rb +22 -0
  186. data/spec/lib/ruby_smb/gss/provider/ntlm/os_version_spec.rb +1 -1
  187. data/spec/lib/ruby_smb/smb1/pipe_spec.rb +18 -37
  188. data/spec/lib/ruby_smb/smb2/pipe_spec.rb +18 -16
  189. data/spec/support/bin_helper.rb +9 -0
  190. data.tar.gz.sig +0 -0
  191. metadata +96 -5
  192. metadata.gz.sig +0 -0
  193. data/lib/ruby_smb/dcerpc/rrp_unicode_string.rb +0 -38
  194. data/spec/lib/ruby_smb/dcerpc/rrp_unicode_string_spec.rb +0 -135
@@ -19,8 +19,8 @@ RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerAuthenticate3Request do
19
19
  end
20
20
 
21
21
  describe '#account_name' do
22
- it 'is a NdrString structure' do
23
- expect(packet.account_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
22
+ it 'is a NdrConfVarWideStringz structure' do
23
+ expect(packet.account_name).to be_a RubySMB::Dcerpc::Ndr::NdrConfVarWideStringz
24
24
  end
25
25
  end
26
26
 
@@ -31,8 +31,8 @@ RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerAuthenticate3Request do
31
31
  end
32
32
 
33
33
  describe '#computer_name' do
34
- it 'is a NdrString structure' do
35
- expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
34
+ it 'is a NdrConfVarWideStringz structure' do
35
+ expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrConfVarWideStringz
36
36
  end
37
37
  end
38
38
 
@@ -19,8 +19,8 @@ RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerPasswordSet2Request do
19
19
  end
20
20
 
21
21
  describe '#account_name' do
22
- it 'is a NdrString structure' do
23
- expect(packet.account_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
22
+ it 'is a NdrConfVarWideStringz structure' do
23
+ expect(packet.account_name).to be_a RubySMB::Dcerpc::Ndr::NdrConfVarWideStringz
24
24
  end
25
25
  end
26
26
 
@@ -31,8 +31,8 @@ RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerPasswordSet2Request do
31
31
  end
32
32
 
33
33
  describe '#computer_name' do
34
- it 'is a NdrString structure' do
35
- expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
34
+ it 'is a NdrConfVarWideStringz structure' do
35
+ expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrConfVarWideStringz
36
36
  end
37
37
  end
38
38
 
@@ -16,8 +16,8 @@ RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerReqChallengeRequest do
16
16
  end
17
17
 
18
18
  describe '#computer_name' do
19
- it 'is a NdrString structure' do
20
- expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
19
+ it 'is a NdrConfVarWideStringz structure' do
20
+ expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrConfVarWideStringz
21
21
  end
22
22
  end
23
23
 
@@ -15,8 +15,8 @@ RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerReqChallengeResponse do
15
15
  end
16
16
 
17
17
  describe '#error_status' do
18
- it 'is a 32-bit unsigned integer' do
19
- expect(packet.error_status).to be_a BinData::Uint32le
18
+ it 'is a NDR 32-bit unsigned integer' do
19
+ expect(packet.error_status).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
20
20
  end
21
21
  end
22
22
 
@@ -9,6 +9,10 @@ RSpec.describe RubySMB::Dcerpc::PSyntaxIdT do
9
9
  expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
10
10
  end
11
11
 
12
+ it 'has :byte_align parameter set to the expected value' do
13
+ expect(described_class.default_parameters[:byte_align]).to eq(4)
14
+ end
15
+
12
16
  describe '#if_uuid' do
13
17
  it 'is a Uuid' do
14
18
  expect(packet.if_uuid).to be_a RubySMB::Dcerpc::Uuid
@@ -16,16 +20,26 @@ RSpec.describe RubySMB::Dcerpc::PSyntaxIdT do
16
20
  end
17
21
 
18
22
  describe '#if_ver_major' do
19
- it 'should be a 16-bit unsigned integer' do
20
- expect(packet.if_ver_major).to be_a BinData::Uint16le
23
+ it 'should be a NdrUint16' do
24
+ expect(packet.if_ver_major).to be_a RubySMB::Dcerpc::Ndr::NdrUint16
21
25
  end
22
26
  end
23
27
 
24
28
  describe '#if_ver_minor' do
25
- it 'should be a 16-bit unsigned integer' do
26
- expect(packet.if_ver_minor).to be_a BinData::Uint16le
29
+ it 'should be a NdrUint16' do
30
+ expect(packet.if_ver_minor).to be_a RubySMB::Dcerpc::Ndr::NdrUint16
27
31
  end
28
32
  end
29
33
 
34
+ it 'reads its own binary representation and output the same packet' do
35
+ packet = described_class.new(
36
+ if_uuid: '22fd0d58-357a-472d-9d03-5f19e09b3a92',
37
+ if_ver_major: rand(0xFF),
38
+ if_ver_minor: rand(0xFF)
39
+ )
40
+ binary = packet.to_binary_s
41
+ expect(described_class.read(binary)).to eq(packet)
42
+ end
43
+
30
44
  end
31
45
 
@@ -37,9 +37,20 @@ RSpec.describe RubySMB::Dcerpc::PDUHeader do
37
37
  end
38
38
 
39
39
  describe '#pfc_flags' do
40
+ subject(:pfc_flags) { packet.pfc_flags }
41
+
40
42
  it 'should be a custom structure' do
41
- expect(packet.pfc_flags).to be_a BinData::Struct
43
+ expect(pfc_flags).to be_a BinData::Struct
42
44
  end
45
+
46
+ it { is_expected.to respond_to :object_uuid }
47
+ it { is_expected.to respond_to :maybe }
48
+ it { is_expected.to respond_to :did_not_execute }
49
+ it { is_expected.to respond_to :conc_mpx }
50
+ it { is_expected.to respond_to :reserved_1 }
51
+ it { is_expected.to respond_to :support_header_sign }
52
+ it { is_expected.to respond_to :last_frag }
53
+ it { is_expected.to respond_to :first_frag }
43
54
  end
44
55
 
45
56
  describe '#packed_drep' do
@@ -79,6 +90,21 @@ RSpec.describe RubySMB::Dcerpc::PDUHeader do
79
90
  end
80
91
  end
81
92
 
93
+ it 'reads its own binary representation and output the same packet' do
94
+ packet = described_class.new(
95
+ rpc_vers: rand(0xFF),
96
+ rpc_vers_minor: rand(0xFF),
97
+ ptype: rand(0xFF),
98
+ pfc_flags: { support_header_sign: 1},
99
+ packed_drep: rand(0xFF),
100
+ frag_length: rand(0xFF),
101
+ auth_length: rand(0xFF),
102
+ call_id: rand(0xFF)
103
+ )
104
+ binary = packet.to_binary_s
105
+ expect(described_class.read(binary)).to eq(packet)
106
+ end
107
+
82
108
  end
83
109
 
84
110
 
@@ -7,7 +7,9 @@ RSpec.describe RubySMB::Dcerpc::Request do
7
7
  it { is_expected.to respond_to :opnum }
8
8
  it { is_expected.to respond_to :object }
9
9
  it { is_expected.to respond_to :stub }
10
- it { is_expected.to respond_to :auth_verifier }
10
+ it { is_expected.to respond_to :auth_pad }
11
+ it { is_expected.to respond_to :sec_trailer }
12
+ it { is_expected.to respond_to :auth_value }
11
13
 
12
14
  it 'is little endian' do
13
15
  expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
@@ -83,7 +85,7 @@ RSpec.describe RubySMB::Dcerpc::Request do
83
85
  end
84
86
 
85
87
  it 'selects the expected packet structure' do
86
- expect(packet.stub).to eq(RubySMB::Dcerpc::Srvsvc::NetShareEnumAll.new(host: host))
88
+ expect(packet.stub).to eq(RubySMB::Dcerpc::Srvsvc::NetShareEnumAllRequest.new)
87
89
  end
88
90
  end
89
91
 
@@ -118,37 +120,100 @@ RSpec.describe RubySMB::Dcerpc::Request do
118
120
  end
119
121
  end
120
122
 
121
- describe '#auth_verifier' do
123
+ describe '#auth_pad' do
122
124
  it 'should be a string' do
123
- expect(packet.auth_verifier).to be_a BinData::String
125
+ expect(packet.auth_pad).to be_a BinData::String
124
126
  end
125
127
 
126
128
  it 'should not exist if the #auth_length PDU header field is 0' do
127
129
  packet.pdu_header.auth_length = 0
128
- expect(packet.auth_verifier?).to be false
130
+ expect(packet.auth_pad?).to be false
129
131
  end
130
132
 
131
133
  it 'should exist only if the #auth_length PDU header field is greater than 0' do
132
134
  packet.pdu_header.auth_length = 10
133
- expect(packet.auth_verifier?).to be true
135
+ expect(packet.auth_pad?).to be true
136
+ end
137
+
138
+ it 'makes sure #sec_trailer is 16-bytes aligned with the begining of the PDU body (stub)' do
139
+ packet.pdu_header.auth_length = 6
140
+ packet.stub = 'A' * rand(0xFF)
141
+ expect((packet.sec_trailer.abs_offset - packet.stub.abs_offset) % 16).to eq(0)
142
+ end
143
+ end
144
+
145
+ describe '#sec_trailer' do
146
+ it 'is a SecTrailer structre' do
147
+ expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
148
+ end
149
+
150
+ it 'should not exist if the #auth_length PDU header field is 0' do
151
+ packet.pdu_header.auth_length = 0
152
+ expect(packet.sec_trailer?).to be false
153
+ end
154
+
155
+ it 'should exist only if the #auth_length PDU header field is greater than 0' do
156
+ packet.pdu_header.auth_length = 10
157
+ expect(packet.sec_trailer?).to be true
158
+ end
159
+ end
160
+
161
+ describe '#auth_value' do
162
+ it 'should be a string' do
163
+ expect(packet.auth_value).to be_a BinData::String
164
+ end
165
+
166
+ it 'should not exist if the #auth_length PDU header field is 0' do
167
+ packet.pdu_header.auth_length = 0
168
+ expect(packet.auth_value?).to be false
169
+ end
170
+
171
+ it 'should exist only if the #auth_length PDU header field is greater than 0' do
172
+ packet.pdu_header.auth_length = 10
173
+ expect(packet.auth_value?).to be true
134
174
  end
135
175
 
136
176
  it 'reads #auth_length bytes' do
137
- auth_verifier = '12345678'
177
+ auth_value = '12345678'
138
178
  packet.pdu_header.auth_length = 6
139
- packet.auth_verifier.read(auth_verifier)
140
- expect(packet.auth_verifier).to eq(auth_verifier[0,6])
179
+ packet.auth_value.read(auth_value)
180
+ expect(packet.auth_value).to eq(auth_value[0,6])
181
+ end
182
+ end
183
+
184
+ describe '#enable_encrypted_stub' do
185
+ it 'sets the stub type to BinData::String' do
186
+ # Set a new packet with a Winreg stub
187
+ packet = described_class.new(
188
+ { opnum: RubySMB::Dcerpc::Winreg::OPEN_HKPD },
189
+ { endpoint: 'Winreg' }
190
+ )
191
+ # Enabling encryption will switch the stub to a string
192
+ packet.enable_encrypted_stub
193
+ expect(packet.stub.send(:current_choice)).to be_a BinData::String
194
+ end
195
+ end
196
+
197
+ describe '#has_auth_verifier?' do
198
+ it 'returns true if PDU header #auth_length is greater than 0' do
199
+ packet.pdu_header.auth_length = 5
200
+ expect(packet.has_auth_verifier?).to be true
201
+ end
202
+
203
+ it 'returns false if PDU header #auth_length is 0' do
204
+ packet.pdu_header.auth_length = 0
205
+ expect(packet.has_auth_verifier?).to be false
141
206
  end
142
207
  end
143
208
 
144
209
  it 'reads its own binary representation and output the same packet' do
145
210
  packet = described_class.new(
146
211
  { :opnum => RubySMB::Dcerpc::Srvsvc::NET_SHARE_ENUM_ALL },
147
- { :endpoint => 'Srvsvc', :host => '1.2.3.4' }
212
+ { :endpoint => 'Srvsvc' }
148
213
  )
149
214
  packet.pdu_header.pfc_flags.object_uuid = 1
150
215
  packet.object = '8a885d04-1ceb-11c9-9fe8-08002b104860'
151
- packet.auth_verifier = '123456'
216
+ packet.auth_value = '123456'
152
217
  packet.pdu_header.auth_length = 6
153
218
  binary = packet.to_binary_s
154
219
  packet2 = described_class.new( { :endpoint => 'Srvsvc' } )
@@ -6,7 +6,9 @@ RSpec.describe RubySMB::Dcerpc::Response do
6
6
  it { is_expected.to respond_to :p_cont_id }
7
7
  it { is_expected.to respond_to :cancel_count }
8
8
  it { is_expected.to respond_to :stub }
9
- it { is_expected.to respond_to :auth_verifier }
9
+ it { is_expected.to respond_to :auth_pad }
10
+ it { is_expected.to respond_to :sec_trailer }
11
+ it { is_expected.to respond_to :auth_value }
10
12
 
11
13
  it 'is little endian' do
12
14
  expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
@@ -61,32 +63,120 @@ RSpec.describe RubySMB::Dcerpc::Response do
61
63
  end
62
64
  end
63
65
 
64
- describe '#auth_verifier' do
66
+ describe '#auth_pad' do
65
67
  it 'should be a string' do
66
- expect(packet.auth_verifier).to be_a BinData::String
68
+ expect(packet.auth_pad).to be_a BinData::String
67
69
  end
68
70
 
69
71
  it 'should not exist if the #auth_length PDU header field is 0' do
70
72
  packet.pdu_header.auth_length = 0
71
- expect(packet.auth_verifier?).to be false
73
+ expect(packet.auth_pad?).to be false
72
74
  end
73
75
 
74
76
  it 'should exist only if the #auth_length PDU header field is greater than 0' do
75
77
  packet.pdu_header.auth_length = 10
76
- expect(packet.auth_verifier?).to be true
78
+ expect(packet.auth_pad?).to be true
79
+ end
80
+
81
+ it 'makes sure #sec_trailer is 16-bytes aligned with the begining of the PDU body (stub)' do
82
+ packet.pdu_header.auth_length = 6
83
+ packet.stub = 'A' * rand(0xFF)
84
+ expect((packet.sec_trailer.abs_offset - packet.stub.abs_offset) % 16).to eq(0)
85
+ end
86
+ end
87
+
88
+ describe '#sec_trailer' do
89
+ it 'is a SecTrailer structre' do
90
+ expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
91
+ end
92
+
93
+ it 'should not exist if the #auth_length PDU header field is 0' do
94
+ packet.pdu_header.auth_length = 0
95
+ expect(packet.sec_trailer?).to be false
96
+ end
97
+
98
+ it 'should exist only if the #auth_length PDU header field is greater than 0' do
99
+ packet.pdu_header.auth_length = 10
100
+ expect(packet.sec_trailer?).to be true
101
+ end
102
+ end
103
+
104
+ describe '#auth_value' do
105
+ it 'should be a string' do
106
+ expect(packet.auth_value).to be_a BinData::String
107
+ end
108
+
109
+ it 'should not exist if the #auth_length PDU header field is 0' do
110
+ packet.pdu_header.auth_length = 0
111
+ expect(packet.auth_value?).to be false
112
+ end
113
+
114
+ it 'should exist only if the #auth_length PDU header field is greater than 0' do
115
+ packet.pdu_header.auth_length = 10
116
+ expect(packet.auth_value?).to be true
77
117
  end
78
118
 
79
119
  it 'reads #auth_length bytes' do
80
- auth_verifier = '12345678'
120
+ auth_value = '12345678'
81
121
  packet.pdu_header.auth_length = 6
82
- packet.auth_verifier.read(auth_verifier)
83
- expect(packet.auth_verifier).to eq(auth_verifier[0,6])
122
+ packet.auth_value.read(auth_value)
123
+ expect(packet.auth_value).to eq(auth_value[0,6])
124
+ end
125
+ end
126
+
127
+ describe '#has_auth_verifier?' do
128
+ it 'returns true if PDU header #auth_length is greater than 0' do
129
+ packet.pdu_header.auth_length = 5
130
+ expect(packet.has_auth_verifier?).to be true
131
+ end
132
+
133
+ it 'returns false if PDU header #auth_length is 0' do
134
+ packet.pdu_header.auth_length = 0
135
+ expect(packet.has_auth_verifier?).to be false
136
+ end
137
+ end
138
+
139
+ describe '#stub_length' do
140
+ let(:stub_length) { rand(0xFF) }
141
+ before :example do
142
+ packet.stub = 'A' * stub_length
143
+ end
144
+
145
+ it 'returns the correct stub length' do
146
+ expect(packet.stub_length).to eq(stub_length)
147
+ end
148
+
149
+ context 'with auth verifier' do
150
+ it 'returns the correct stub length' do
151
+ auth_size = rand(0xFF)
152
+ packet.pdu_header.auth_length = auth_size
153
+ packet.auth_value = 'B' * auth_size
154
+ expect(packet.stub_length).to eq(stub_length + packet.auth_pad.num_bytes)
155
+ end
156
+ end
157
+ end
158
+
159
+ describe '#read' do
160
+ let(:response) { described_class.new }
161
+ let(:auth_size) { rand(0xFF) }
162
+ let(:stub_size) { rand(0xFF) }
163
+ before :example do
164
+ response.pdu_header.auth_length = auth_size
165
+ response.stub = 'A' * stub_size
166
+ response.auth_value = 'B' * auth_size
167
+ response.auth_pad = 'C' * response.auth_pad.size
168
+ end
169
+
170
+ it 'sets #stub and #auth_pad to the correct values' do
171
+ packet.read(response.to_binary_s)
172
+ expect(packet.stub).to eq(response.stub)
173
+ expect(packet.auth_pad).to eq(response.auth_pad)
84
174
  end
85
175
  end
86
176
 
87
177
  it 'reads its own binary representation and output the same packet' do
88
178
  packet.stub = 'ABCD'
89
- packet.auth_verifier = '123456'
179
+ packet.auth_value = '123456'
90
180
  packet.pdu_header.auth_length = 6
91
181
  binary = packet.to_binary_s
92
182
  expect(described_class.read(binary)).to eq(packet)
@@ -0,0 +1,75 @@
1
+ RSpec.describe RubySMB::Dcerpc::RpcAuth3 do
2
+ subject(:packet) { described_class.new }
3
+
4
+ it { is_expected.to respond_to :pdu_header }
5
+ it { is_expected.to respond_to :pad }
6
+ it { is_expected.to respond_to :sec_trailer }
7
+ it { is_expected.to respond_to :auth_value }
8
+
9
+ it 'is little endian' do
10
+ expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
11
+ end
12
+
13
+ describe '#pdu_header' do
14
+ subject(:header) { packet.pdu_header }
15
+
16
+ it 'is a standard PDU Header' do
17
+ expect(header).to be_a RubySMB::Dcerpc::PDUHeader
18
+ end
19
+
20
+ it 'should have the #ptype field set to PTypes::BIND' do
21
+ expect(header.ptype).to eq RubySMB::Dcerpc::PTypes::RPC_AUTH3
22
+ end
23
+ end
24
+
25
+ describe '#sec_trailer' do
26
+ it 'should be SecTrailer structure' do
27
+ expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
28
+ end
29
+
30
+ it 'should not exist if the #auth_length PDU header field is 0' do
31
+ packet.pdu_header.auth_length = 0
32
+ expect(packet.sec_trailer?).to be false
33
+ end
34
+
35
+ it 'should exist only if the #auth_length PDU header field is greater than 0' do
36
+ packet.pdu_header.auth_length = 10
37
+ expect(packet.sec_trailer?).to be true
38
+ end
39
+ end
40
+
41
+ describe '#auth_value' do
42
+ it 'should be a string' do
43
+ expect(packet.auth_value).to be_a BinData::String
44
+ end
45
+
46
+ it 'should not exist if the #auth_length PDU header field is 0' do
47
+ packet.pdu_header.auth_length = 0
48
+ expect(packet.auth_value?).to be false
49
+ end
50
+
51
+ it 'should exist only if the #auth_length PDU header field is greater than 0' do
52
+ packet.pdu_header.auth_length = 10
53
+ expect(packet.auth_value?).to be true
54
+ end
55
+
56
+ it 'reads #auth_length bytes' do
57
+ auth_value = '12345678'
58
+ packet.pdu_header.auth_length = 6
59
+ packet.auth_value.read(auth_value)
60
+ expect(packet.auth_value).to eq(auth_value[0,6])
61
+ end
62
+ end
63
+
64
+ it 'reads its own binary representation and output the same packet' do
65
+ auth_size = rand(0xFF)
66
+ packet = described_class.new(
67
+ pdu_header: { auth_length: auth_size },
68
+ pad: rand(0xFFFFFFFF),
69
+ auth_value: 'A' * auth_size
70
+ )
71
+ binary = packet.to_binary_s
72
+ expect(described_class.read(binary)).to eq(packet)
73
+ end
74
+
75
+ end
@@ -9,21 +9,25 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityDescriptor do
9
9
  expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
10
10
  end
11
11
 
12
+ it 'has :byte_align parameter set to the expected value' do
13
+ expect(described_class.default_parameters[:byte_align]).to eq(4)
14
+ end
15
+
12
16
  describe '#lp_security_descriptor' do
13
- it 'should be a NdrLpByteArray structure' do
14
- expect(packet.lp_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrLpByteArray
17
+ it 'should be a NdrByteArrayPtr structure' do
18
+ expect(packet.lp_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrByteArrayPtr
15
19
  end
16
20
  end
17
21
 
18
22
  describe '#cb_in_security_descriptor' do
19
- it 'should be a 32-bit unsigned integer' do
20
- expect(packet.cb_in_security_descriptor).to be_a BinData::Uint32le
23
+ it 'should be a NdrUint32' do
24
+ expect(packet.cb_in_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
21
25
  end
22
26
  end
23
27
 
24
28
  describe '#cb_out_security_descriptor' do
25
- it 'should be a 32-bit unsigned integer' do
26
- expect(packet.cb_out_security_descriptor).to be_a BinData::Uint32le
29
+ it 'should be a NdrUint32' do
30
+ expect(packet.cb_out_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
27
31
  end
28
32
  end
29
33
 
@@ -38,7 +42,7 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityDescriptor do
38
42
 
39
43
  context 'with a normal RpcSecurityAttributes structure' do
40
44
  it 'reads its own binary representation' do
41
- packet.lp_security_descriptor = RubySMB::Dcerpc::Ndr::NdrLpByteArray.new([1, 2, 3])
45
+ packet.lp_security_descriptor = RubySMB::Dcerpc::Ndr::NdrByteArrayPtr.new([1, 2, 3])
42
46
  packet.cb_in_security_descriptor = 90
43
47
  packet.cb_out_security_descriptor = 33
44
48
  raw = packet.to_binary_s
@@ -60,9 +64,13 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
60
64
  expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
61
65
  end
62
66
 
67
+ it 'has :byte_align parameter set to the expected value' do
68
+ expect(described_class.default_parameters[:byte_align]).to eq(4)
69
+ end
70
+
63
71
  describe '#n_length' do
64
- it 'should be a 32-bit unsigned integer' do
65
- expect(packet.n_length).to be_a BinData::Uint32le
72
+ it 'should be a NdrUint32' do
73
+ expect(packet.n_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
66
74
  end
67
75
  end
68
76
 
@@ -73,8 +81,8 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
73
81
  end
74
82
 
75
83
  describe '#b_inheritHandle' do
76
- it 'should be a 8-bit unsigned integer' do
77
- expect(packet.b_inheritHandle).to be_a BinData::Uint8
84
+ it 'should be a NdrUint8' do
85
+ expect(packet.b_inheritHandle).to be_a RubySMB::Dcerpc::Ndr::NdrUint8
78
86
  end
79
87
  end
80
88
 
@@ -104,32 +112,25 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
104
112
  end
105
113
 
106
114
  RSpec.describe RubySMB::Dcerpc::PrpcSecurityAttributes do
107
- it 'is NdrPointer subclass' do
108
- expect(described_class).to be < RubySMB::Dcerpc::Ndr::NdrPointer
115
+ it 'is a RpcSecurityAttributes subclass' do
116
+ expect(described_class).to be < RubySMB::Dcerpc::RpcSecurityAttributes
109
117
  end
110
118
 
111
119
  subject(:packet) { described_class.new }
112
120
 
113
- it { is_expected.to respond_to :referent }
121
+ it { is_expected.to respond_to :ref_id }
114
122
 
115
123
  it 'is little endian' do
116
124
  expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
117
125
  end
118
126
 
119
- describe '#referent' do
120
- it 'should be a RpcSecurityAttributes structure' do
121
- expect(packet.referent).to be_a RubySMB::Dcerpc::RpcSecurityAttributes
122
- end
123
-
124
- it 'exists if superclass #referent_id is not zero' do
125
- packet.referent_id = 0xCCCC
126
- expect(packet.referent?).to be true
127
- end
127
+ it 'should be a RpcSecurityAttributes structure' do
128
+ expect(packet).to be_a RubySMB::Dcerpc::RpcSecurityAttributes
129
+ end
128
130
 
129
- it 'does not exist if superclass #referent_id is zero' do
130
- packet.referent_id = 0
131
- expect(packet.referent?).to be false
132
- end
131
+ it 'is :null if #ref_id is zero' do
132
+ packet.ref_id = 0
133
+ expect(packet).to eq(:null)
133
134
  end
134
135
 
135
136
  describe '#read' do
@@ -150,7 +151,7 @@ RSpec.describe RubySMB::Dcerpc::PrpcSecurityAttributes do
150
151
  struct.rpc_security_descriptor.cb_in_security_descriptor = 33
151
152
  struct.rpc_security_descriptor.cb_out_security_descriptor = 22
152
153
  struct.b_inheritHandle = 4
153
- packet.set(struct)
154
+ packet.assign(struct)
154
155
  raw = packet.to_binary_s
155
156
  expect(described_class.read(raw)).to eq(packet)
156
157
  expect(described_class.read(raw).to_binary_s).to eq(raw)