ruby_smb 2.0.12 → 3.0.2

data/lib/ruby_smb/dcerpc/rpc_security_attributes.rb

@@ -3,30 +3,30 @@ module RubySMB
 
     # This class represents a RPC_SECURITY_DESCRIPTOR structure as defined in
     # [2.2.8 RPC_SECURITY_DESCRIPTOR](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/9729e781-8eb9-441b-82ca-e898f98d29c2)
-    class RpcSecurityDescriptor < BinData::Record
+    class RpcSecurityDescriptor < Ndr::NdrStruct
+      default_parameters byte_align: 4
       endian :little
 
-      ndr_lp_byte_array :lp_security_descriptor
-      uint32            :cb_in_security_descriptor
-      uint32            :cb_out_security_descriptor
+      ndr_byte_array_ptr :lp_security_descriptor
+      ndr_uint32         :cb_in_security_descriptor
+      ndr_uint32         :cb_out_security_descriptor
     end
 
     # This class represents a RPC_SECURITY_ATTRIBUTES structure as defined in
     # [2.2.7 RPC_SECURITY_ATTRIBUTES](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc37b8cf-8c94-4804-ad53-0aaf5eaf0ecb)
-    class RpcSecurityAttributes < BinData::Record
+    class RpcSecurityAttributes < Ndr::NdrStruct
+      default_parameters byte_align: 4
       endian :little
 
-      uint32                  :n_length
+      ndr_uint32              :n_length
       rpc_security_descriptor :rpc_security_descriptor
-      uint8                   :b_inheritHandle
+      ndr_uint8               :b_inheritHandle
     end
 
     # This class represents a pointer to a RPC_SECURITY_ATTRIBUTES structure as defined in
     # [2.2.7 RPC_SECURITY_ATTRIBUTES](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc37b8cf-8c94-4804-ad53-0aaf5eaf0ecb)
-    class PrpcSecurityAttributes < Ndr::NdrPointer
-      endian :little
-
-      rpc_security_attributes :referent, onlyif: -> { self.referent_id != 0 }
+    class PrpcSecurityAttributes < RpcSecurityAttributes
+      extend Ndr::PointerClassPlugin
     end
 
   end

data/lib/ruby_smb/dcerpc/rrp_rpc_unicode_string.rb

@@ -0,0 +1,118 @@
+module RubySMB
+  module Dcerpc
+
+    # A RRP_UNICODE_STRING structure as defined in
+    # [2.2.4 RRP_UNICODE_STRING](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/c0c90f11-a4c4-496a-ac09-8a8a3697ceef)
+    class RrpUnicodeString < Ndr::NdrStruct
+      default_parameters byte_align: 4
+      endian :little
+
+      ndr_uint16           :buffer_length
+      ndr_uint16           :maximum_length
+      ndr_wide_stringz_ptr :buffer
+
+      def assign(val)
+        case val
+        when :null
+          self.buffer = val
+          self.buffer_length = 0
+          self.maximum_length = 0
+        when BinData::Stringz, BinData::String, String
+          self.buffer = val.to_s
+          val_length = val.strip.length
+          val_length += 1 unless val == ''
+          self.buffer_length = val_length * 2
+          self.maximum_length = val_length * 2
+        else
+          super
+        end
+      end
+
+      # Set `maximum_length` and buffer `max_count` values to `val`. It also
+      # takes care of initializing the buffer pointer `ref_id` if the pointer
+      # is null.
+      #
+      # This helper is typically called in requests where a unicode string
+      # field needs to contain the maximum length information without any
+      # string value. It is usually required by some RPC calls and used by the
+      # server to determine the maximum length for the corresponding output
+      # field in order to allocate space accordingly.
+      def set_max_buffer_size(val)
+        self.buffer.instantiate_referent if self.buffer.is_null_ptr?
+        self.buffer.max_count = val / 2
+        self.maximum_length.assign(val)
+      end
+
+      def to_s
+        return ''.encode('utf-16le') if self.buffer.is_null_ptr?
+        self.buffer.to_s
+      end
+    end
+
+    # A pointer to a RRP_UNICODE_STRING structure
+    class PrrpUnicodeString < RrpUnicodeString
+      extend Ndr::PointerClassPlugin
+    end
+
+    # A RPC_UNICODE_STRING structure as defined in
+    # [2.3.10 RPC_UNICODE_STRING](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/94a16bb6-c610-4cb9-8db6-26f15f560061)
+    class RpcUnicodeString < Ndr::NdrStruct
+      # Same as RrpUnicodeString, but not necessary null terminated
+      #
+      # It is the caller responsability to null terminate the string, if it has
+      # to. This structure won't do it automatically the way RrpUnicodeString
+      # do.
+      #
+      # It also takes care of detecting the terminating null character and
+      # exclude when calculating buffer_length and maximum_length.
+      default_parameters byte_align: 4
+      endian :little
+
+      ndr_uint16          :buffer_length
+      ndr_uint16          :maximum_length
+      ndr_wide_string_ptr :buffer
+
+      def assign(val)
+        case val
+        when :null
+          self.buffer = val
+          self.buffer_length = 0
+          self.maximum_length = 0
+        when BinData::Stringz, BinData::String, String
+          self.buffer = val.to_s
+          val_length = val.strip.length
+          self.buffer_length = val_length * 2
+          self.maximum_length = val_length * 2
+        else
+          super
+        end
+      end
+
+      # Set `maximum_length` and buffer `max_count` values to `val`. It also
+      # takes care of initializing the buffer pointer `ref_id` if the pointer
+      # is null.
+      #
+      # This helper is typically called in requests where a unicode string
+      # field needs to contain the maximum length information without any
+      # string value. It is usually required by some RPC calls and used by the
+      # server to determine the maximum length for the corresponding output
+      # field in order to allocate space accordingly.
+      def set_max_buffer_size(val)
+        self.buffer.instantiate_referent if self.buffer.is_null_ptr?
+        self.buffer.max_count = val / 2
+        self.maximum_length.assign(val)
+      end
+
+      def to_s
+        return ''.encode('utf-16le') if self.buffer.is_null_ptr?
+        self.buffer.to_s
+      end
+    end
+
+    # A pointer to a RPC_UNICODE_STRING structure
+    class PrpcUnicodeString < RpcUnicodeString
+      extend Ndr::PointerClassPlugin
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/samr/rpc_sid.rb

@@ -0,0 +1,150 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+      WELL_KNOWN_SID_NAME = {
+        [0,0] => 'NULL SID',
+        [1,0] => 'Everyone',
+        [2,0] => 'LOCAL',
+        [2,1] => 'CONSOLE LOGON',
+        [3,0] => 'CREATOR OWNER',
+        [3,1] => 'CREATOR GROUP',
+        [3,2] => 'CREATOR OWNER SERVER',
+        [3,3] => 'CREATOR GROUP SERVER',
+        [3,4] => 'OWNER RIGHTS',
+        [5,1] => 'NT AUTHORITY\\DIALUP',
+        [5,2] => 'NT AUTHORITY\\NETWORK',
+        [5,3] => 'NT AUTHORITY\\BATCH',
+        [5,4] => 'NT AUTHORITY\\INTERACTIVE',
+        [5,6] => 'NT AUTHORITY\\SERVICE',
+        [5,7] => 'NT AUTHORITY\\ANONYMOUS LOGON',
+        [5,8] => 'NT AUTHORITY\\PROXY',
+        [5,9] => 'NT AUTHORITY\\ENTERPRISE DOMAIN CONTROLLERS',
+        [5,10] => 'NT AUTHORITY\\SELF',
+        [5,11] => 'NT AUTHORITY\\Authenticated Users',
+        [5,12] => 'NT AUTHORITY\\RESTRICTED',
+        [5,13] => 'NT AUTHORITY\\TERMINAL SERVER USER',
+        [5,14] => 'NT AUTHORITY\\REMOTE INTERACTIVE LOGON',
+        [5,15] => 'NT AUTHORITY\\This Organization',
+        [5,17] => 'NT AUTHORITY\\IUSR',
+        [5,18] => 'NT AUTHORITY\\SYSTEM',
+        [5,19] => 'NT AUTHORITY\\LOCAL SERVICE',
+        [5,20] => 'NT AUTHORITY\\NETWORK SERVICE',
+        [5,22] => 'NT AUTHORITY\\ENTERPRISE READ-ONLY DOMAIN CONTROLLERS BETA',
+        [5,33] => 'NT AUTHORITY\\WRITE RESTRICTED',
+        [5,32] => 'Builtin Domain'
+      }
+
+      WELL_KNOWN_RID_NAME = {
+        498 => '(domain)\\Enterprise Read-only Domain Controllers',
+        500 => '(domain)\\Administrator',
+        501 => '(domain)\\Guest',
+        502 => '(domain)\\krbtgt',
+        512 => '(domain)\\Domain Admins',
+        513 => '(domain)\\Domain Users',
+        514 => '(domain)\\Domain Guests',
+        515 => '(domain)\\Domain Computers',
+        516 => '(domain)\\Domain Controllers',
+        517 => '(domain)\\Cert Publishers',
+        518 => '(domain)\\Schema Admins',
+        519 => '(domain)\\Enterprise Admins',
+        520 => '(domain)\\Group Policy Creator Owners',
+        521 => '(domain)\\Read-only Domain Controllers',
+        522 => '(domain)\\Cloneable Domain Controllers',
+        544 => 'BUILTIN\\Administrators',
+        545 => 'BUILTIN\\Users',
+        546 => 'BUILTIN\\Guests',
+        548 => 'BUILTIN\\Account Operators',
+        549 => 'BUILTIN\\Server Operators',
+        550 => 'BUILTIN\\Print Operators',
+        551 => 'BUILTIN\\Backup Operators',
+        552 => 'BUILTIN\\Replicator',
+        553 => '(domain)\\RAS and IAS Servers',
+        554 => 'BUILTIN\\Pre-Windows 2000 Compatible Access',
+        555 => 'BUILTIN\\Remote Desktop Users',
+        556 => 'BUILTIN\\Network Configuration Operators',
+        557 => 'BUILTIN\\Incoming Forest Trust Builders',
+        558 => 'BUILTIN\\Performance Monitor Users',
+        559 => 'BUILTIN\\Performance Log Users',
+        560 => 'BUILTIN\\Windows Authorization Access Group',
+        561 => 'BUILTIN\\Terminal Server License Servers',
+        562 => 'BUILTIN\\Distributed COM Users',
+        568 => 'BUILTIN\\IIS_IUSRS',
+        569 => 'BUILTIN\\Cryptographic Operators',
+        571 => '(domain)\\Allowed RODC Password Replication Group',
+        572 => '(domain)\\Denied RODC Password Replication Group',
+        573 => 'BUILTIN\\Event Log Readers',
+        574 => 'BUILTIN\\Certificate Service DCOM Access',
+        575 => 'BUILTIN\\RDS Remote Access Servers',
+        576 => 'BUILTIN\\RDS Endpoint Servers',
+        577 => 'BUILTIN\\RDS Management Servers',
+        578 => 'BUILTIN\\Hyper-V Administrators',
+        579 => 'BUILTIN\\Access Control Assistance Operators',
+        580 => 'BUILTIN\\Remote Management Users'
+      }
+
+      #[2.4.1.1 RPC_SID_IDENTIFIER_AUTHORITY](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/d7e6e5a5-437c-41e5-8ba1-bdfd43e96cbc)
+      class RpcSidIdentifierAuthority < Ndr::NdrFixArray
+        default_parameters type: :ndr_uint8, initial_length: 6, byte_align: 1
+      end
+
+      # [2.4.2.3 RPC_SID](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/5cb97814-a1c2-4215-b7dc-76d1f4bfad01)
+      class RpcSid < Ndr::NdrStruct
+        default_parameters byte_align: 4
+        endian :little
+
+        ndr_uint8                    :revision
+        ndr_uint8                    :sub_authority_count, initial_value: -> { self.sub_authority.size }
+        rpc_sid_identifier_authority :identifier_authority
+        ndr_conf_array               :sub_authority, type: :ndr_uint32
+
+        def snapshot
+          sid = ['S', self.revision.to_s, self.identifier_authority[-1].to_s]
+          self.sub_authority.each { |e| sid << e.to_s }
+          sid.join('-')
+        end
+
+        def assign(val)
+          case val
+          when String
+            elems = val.split('-')
+            raise ArgumentError, "Wrong SID format" unless elems[0].downcase == 's'
+            self.revision = elems[1].to_i
+            self.sub_authority_count = elems[3..-1].size
+            self.identifier_authority = [0, 0, 0, 0, 0, elems[2].to_i]
+            self.sub_authority = elems[3..-1].map(&:to_i)
+          when RpcSid
+            super
+          else
+            raise ArgumentError, "Can only assign String or other RpcSid object (got #{val.class})"
+          end
+          self
+        end
+
+        def name
+          sid = case sub_authority.size
+          when 1
+            WELL_KNOWN_SID_NAME[[identifier_authority[-1].to_i, sub_authority[0].to_i]]
+          when 2
+            if identifier_authority[-1] == 5 && sub_authority[0] == 32
+              WELL_KNOWN_RID_NAME[sub_authority[1]]
+            end
+          when 3
+            if identifier_authority[-1] == 5 && sub_authority[0] == 5
+              "Current Session Logon SID"
+            end
+          else
+            if identifier_authority[-1] == 5
+              WELL_KNOWN_RID_NAME[sub_authority.last]
+            end
+          end
+          sid || "Unknown SID (#{self})"
+        end
+      end
+
+      class PrpcSid < RpcSid
+        extend Ndr::PointerClassPlugin
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/samr/samr_close_handle_request.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [3.1.5.13.1 SamrCloseHandle (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/55d134df-e257-48ad-8afa-cb2ca45cd3cc)
+      class SamrCloseHandleRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle :sam_handle
+
+        def initialize_instance
+          super
+          @opnum = SAMR_CLOSE_HANDLE
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/samr/samr_close_handle_response.rb

@@ -0,0 +1,24 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [3.1.5.13.1 SamrCloseHandle (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/55d134df-e257-48ad-8afa-cb2ca45cd3cc)
+      class SamrCloseHandleResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle :sam_handle
+        ndr_uint32   :error_status
+
+        def initialize_instance
+          super
+          @opnum = SAMR_CLOSE_HANDLE
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/samr/samr_connect_request.rb

@@ -0,0 +1,32 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [2.2.7.1 PSAMPR_SERVER_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/7a77f1ce-cc55-4e36-a3c2-87c48f835f86)
+      class PsamprServerName < RubySMB::Field::Stringz16
+        default_parameters referent_byte_align: 2
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [3.1.5.1.4 SamrConnect (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/defe2091-0a61-4dfa-be9a-2c1206d53a1f)
+      class SamrConnectRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        psampr_server_name :server_name
+        # Access control on a server object: bitwise OR of common ACCESS_MASK
+        # and server ACCESS_MASK values (see lib/ruby_smb/dcerpc/samr.rb)
+        ndr_uint32         :desired_access
+
+        def initialize_instance
+          super
+          @opnum = SAMR_CONNECT
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/samr/samr_connect_response.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [3.1.5.1.4 SamrConnect (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/defe2091-0a61-4dfa-be9a-2c1206d53a1f)
+      class SamrConnectResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle :server_handle
+        ndr_uint32   :error_status
+
+        def initialize_instance
+          super
+          @opnum = SAMR_CONNECT
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/samr/samr_enumerate_users_in_domain_request.rb

@@ -0,0 +1,26 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [3.1.5.2.5 SamrEnumerateUsersInDomain (Opnum 13)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/6bdc92c0-c692-4ffb-9de7-65858b68da75)
+      class SamrEnumerateUsersInDomainRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle :domain_handle
+        ndr_uint32   :enumeration_context
+        # UserAccountControl flags are defined in lib/ruby_smb/dcerpc/samr.rb
+        ndr_uint32   :user_account_control
+        ndr_uint32   :prefered_maximum_length
+
+        def initialize_instance
+          super
+          @opnum = SAMR_ENUMERATE_USERS_IN_DOMAIN
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/samr/samr_enumerate_users_in_domain_response.rb

@@ -0,0 +1,55 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [2.2.3.9 SAMPR_RID_ENUMERATION](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/5c94a35a-e7f2-4675-af34-741f5a8ee1a2)
+      class SamprRidEnumeration < Ndr::NdrStruct
+        default_parameters byte_align: 4
+        endian :little
+
+        ndr_uint32         :relative_id
+        rpc_unicode_string :name
+      end
+
+      class SamprRidEnumerationArray < Ndr::NdrConfArray
+        default_parameter type: :sampr_rid_enumeration
+      end
+
+      class PsamprRidEnumerationArray < SamprRidEnumerationArray
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.3.10 SAMPR_ENUMERATION_BUFFER](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/c53161a4-38e8-4a28-a33e-0d378fce03dd)
+      class SamprEnumerationBuffer < Ndr::NdrStruct
+        default_parameters byte_align: 4
+        endian :little
+
+        ndr_uint32                   :entries_read
+        psampr_rid_enumeration_array :buffer
+      end
+
+      class PsamprEnumerationBuffer < SamprEnumerationBuffer
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [3.1.5.2.5 SamrEnumerateUsersInDomain (Opnum 13)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/6bdc92c0-c692-4ffb-9de7-65858b68da75)
+      class SamrEnumerateUsersInDomainResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_uint32                :enumeration_context
+        psampr_enumeration_buffer :buffer
+        ndr_uint32                :count_returned
+        ndr_uint32                :error_status
+
+        def initialize_instance
+          super
+          @opnum = SAMR_ENUMERATE_USERS_IN_DOMAIN
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/samr/samr_get_alias_membership_request.rb

@@ -0,0 +1,48 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      #[2.2.7.6 SAMPR_SID_INFORMATION](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/0c138399-f663-4039-b4e7-b3c9f82bff65)
+      class SamprSidInformation < Ndr::NdrStruct
+        default_parameter byte_align: 4
+
+        rpc_sid :sid_pointer
+      end
+
+      class PsamprSidInformation < SamprSidInformation
+        extend Ndr::PointerClassPlugin
+      end
+
+      class PsamprSidInformationArray < Ndr::NdrConfArray
+        default_parameter type: :psampr_sid_information
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.7.5 SAMPR_PSID_ARRAY](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/1d40622e-52e4-4aaa-bc77-aa626089f116)
+      class SamprPsidArray < Ndr::NdrStruct
+        default_parameter byte_align: 4
+
+        ndr_uint32                   :sid_count, initial_value: -> { sids.size }
+        psampr_sid_information_array :sids
+      end
+
+      # [3.1.5.9.2 SamrGetAliasMembership (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/03184045-2208-4c02-b38b-ef955d6dc3ef)
+      class SamrGetAliasMembershipRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle     :domain_handle
+        sampr_psid_array :sid_array
+
+        def initialize_instance
+          super
+          @opnum = SAMR_GET_ALIAS_MEMBERSHIP
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/samr/samr_get_alias_membership_response.rb

@@ -0,0 +1,38 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      class PulongArray < Ndr::NdrConfArray
+        default_parameter type: :ndr_uint32
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.7.4 SAMPR_ULONG_ARRAY](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/2feb3806-4db2-45b7-90d2-86c8336a31ba)
+      class PsamprUlongArray < Ndr::NdrStruct
+        default_parameter byte_align: 4
+
+        ndr_uint32   :elem_count, initial_value: -> { elements.size }
+        pulong_array :elements
+      end
+
+      # [3.1.5.9.2 SamrGetAliasMembership (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/03184045-2208-4c02-b38b-ef955d6dc3ef)
+      class SamrGetAliasMembershipResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        psampr_ulong_array :membership
+        ndr_uint32         :error_status
+
+        def initialize_instance
+          super
+          @opnum = SAMR_GET_ALIAS_MEMBERSHIP
+        end
+      end
+
+    end
+  end
+end
+
+
+

data/lib/ruby_smb/dcerpc/samr/samr_get_groups_for_user_request.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [3.1.5.9.1 SamrGetGroupsForUser (Opnum 39)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/a4adbf20-040f-4416-a960-e5b7917fdae7)
+      class SamrGetGroupsForUserRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle :user_handle
+
+        def initialize_instance
+          super
+          @opnum = SAMR_GET_GROUPS_FOR_USER
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/samr/samr_get_groups_for_user_response.rb

@@ -0,0 +1,48 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [[2.2.7.12 GROUP_MEMBERSHIP](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/dc0d27ac-5218-4709-9d1b-cab6f6d90b10)
+      class GroupMembership < Ndr::NdrStruct
+        default_parameter byte_align: 4
+
+        ndr_uint32 :relative_id
+        ndr_uint32 :attributes
+      end
+
+      class PgroupMembershipArray < Ndr::NdrConfArray
+        default_parameter type: :group_membership
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.7.13 SAMPR_GET_GROUPS_BUFFER](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/31879676-cc95-4cf1-8f75-c09ddcef8750)
+      class SamprGetGroupsBuffer < Ndr::NdrStruct
+        default_parameter byte_align: 4
+
+        ndr_uint32              :membership_count, initial_value: -> { groups.size }
+        pgroup_membership_array :groups
+      end
+
+      class PsamprGetGroupsBuffer < SamprGetGroupsBuffer
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [3.1.5.9.1 SamrGetGroupsForUser (Opnum 39)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/a4adbf20-040f-4416-a960-e5b7917fdae7)
+      class SamrGetGroupsForUserResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        psampr_get_groups_buffer :groups
+        ndr_uint32               :error_status
+
+        def initialize_instance
+          super
+          @opnum = SAMR_GET_GROUPS_FOR_USER
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/samr/samr_lookup_domain_in_sam_server_request.rb

@@ -0,0 +1,24 @@
+module RubySMB
+  module Dcerpc
+    module Samr
+
+      # [3.1.5.11.1 SamrLookupDomainInSamServer (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/47492d59-e095-4398-b03e-8a062b989123)
+      class SamrLookupDomainInSamServerRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        sampr_handle        :server_handle
+        rpc_unicode_string  :name
+
+        def initialize_instance
+          super
+          @opnum = SAMR_LOOKUP_DOMAIN_IN_SAM_SERVER
+        end
+      end
+
+    end
+  end
+end
+
+