ruby_smb 2.0.2 → 3.0.0

data/lib/ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_response.rb

@@ -0,0 +1,88 @@
+module RubySMB
+  module Dcerpc
+    module Wkssvc
+
+
+      # [2.2.5.3 WKSTA_INFO_102](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/49c75566-2d4f-481a-bf32-7eb5627cb4ea)
+      class WkstaInfo102 < Ndr::NdrStruct
+        default_parameter byte_align: 4
+        endian :little
+
+        ndr_uint32           :wki102_platform_id
+        ndr_wide_stringz_ptr :wki102_computername
+        ndr_wide_stringz_ptr :wki102_langroup
+        ndr_uint32           :wki102_ver_major
+        ndr_uint32           :wki102_ver_minor
+        ndr_wide_stringz_ptr :wki102_lanroot
+        ndr_uint32           :wki102_logged_on_users
+      end
+
+      class PwkstaInfo102 < WkstaInfo102
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.5.2 WKSTA_INFO_101](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/98876691-3684-4b0c-bb43-3a8ac4705149)
+      class WkstaInfo101 < Ndr::NdrStruct
+        default_parameter byte_align: 4
+        endian :little
+
+        ndr_uint32           :wki101_platform_id
+        ndr_wide_stringz_ptr :wki101_computername
+        ndr_wide_stringz_ptr :wki101_langroup
+        ndr_uint32           :wki101_ver_major
+        ndr_uint32           :wki101_ver_minor
+        ndr_wide_stringz_ptr :wki101_lanroot
+      end
+
+      class PwkstaInfo101 < WkstaInfo101
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.5.1 WKSTA_INFO_100](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/23275f4a-4e51-49d6-bdb5-f58519a3ea8a)
+      class WkstaInfo100 < Ndr::NdrStruct
+        default_parameter byte_align: 4
+        endian :little
+
+        ndr_uint32           :wki100_platform_id
+        ndr_wide_stringz_ptr :wki100_computername
+        ndr_wide_stringz_ptr :wki100_langroup
+        ndr_uint32           :wki100_ver_major
+        ndr_uint32           :wki100_ver_minor
+      end
+
+      class PwkstaInfo100 < WkstaInfo100
+        extend Ndr::PointerClassPlugin
+      end
+
+      class LpwkstaInfo < Ndr::NdrStruct
+        default_parameter byte_align: 4
+        endian :little
+
+        ndr_uint32 :level
+        choice     :info, selection: :level, byte_align: 4 do
+          pwksta_info100 WKSTA_INFO_100
+          pwksta_info101 WKSTA_INFO_101
+          pwksta_info102 WKSTA_INFO_102
+          #TODO: pwksta_info_502 0x000001F6
+        end
+      end
+
+      # [3.2.4.1 NetrWkstaGetInfo (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/4af41d6f-b800-4de1-af5b-0b15a85f8e04)
+      class NetrWkstaGetInfoResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        lpwksta_info :wksta_info
+        ndr_uint32   :error_status
+
+        def initialize_instance
+          super
+          @opnum = NETR_WKSTA_GET_INFO
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/wkssvc.rb

@@ -0,0 +1,65 @@
+module RubySMB
+  module Dcerpc
+    module Wkssvc
+
+      UUID = '6BFFD098-A112-3610-9833-46C3F87E345A'
+      VER_MAJOR = 1
+      VER_MINOR = 0
+
+      # Operation numbers
+      NETR_WKSTA_GET_INFO = 0x0000
+
+      PLATFORM_ID = {
+        0x0000012C => "DOS",
+        0x00000190 => "OS2",
+        0x000001F4 => "Win",
+        0x00000258 => "OSF",
+        0x000002BC => "VMS"
+      }
+
+      # Information Level
+      WKSTA_INFO_100 = 0x00000064
+      WKSTA_INFO_101 = 0x00000065
+      WKSTA_INFO_102 = 0x00000066
+      #TODO: WKSTA_INFO_502 = 0x000001F6
+
+
+      require 'ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_request'
+      require 'ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_response'
+
+      # Returns details about a computer environment, including
+      # platform-specific information, the names of the domain and local
+      # computer, and the operating system version.
+      #
+      # @param server_name [optional, String] String that identifies the server (optional
+      #   since it is ignored by the server)
+      # @param server_name [optional, Integer] The information level of the data (default: WKSTA_INFO_100)
+      # @return [RubySMB::Dcerpc::Wkssvc::WkstaInfo100, RubySMB::Dcerpc::Wkssvc::WkstaInfo101,
+      #   RubySMB::Dcerpc::Wkssvc::WkstaInfo102] The structure containing the requested information
+      # @raise [RubySMB::Dcerpc::Error::InvalidPacket] if the response is not a
+      #   NetrWkstaGetInfoResponse packet
+      # @raise [RubySMB::Dcerpc::Error::WkssvcError] if the response error status
+      #   is not STATUS_SUCCESS
+      def netr_wksta_get_info(server_name: "\x00", level: WKSTA_INFO_100)
+        wkst_netr_wksta_get_info_request = NetrWkstaGetInfoRequest.new(
+          server_name: server_name,
+          level: level
+        )
+        response = dcerpc_request(wkst_netr_wksta_get_info_request)
+        begin
+          wkst_netr_wksta_get_info_response = NetrWkstaGetInfoResponse.read(response)
+        rescue IOError
+          raise RubySMB::Dcerpc::Error::InvalidPacket, 'Error reading WkstNetrWkstaGetInfoResponse'
+        end
+        unless wkst_netr_wksta_get_info_response.error_status == WindowsError::NTStatus::STATUS_SUCCESS
+          raise RubySMB::Dcerpc::Error::WkssvcError,
+            "Error returned with netr_wksta_get_info: "\
+            "#{WindowsError::NTStatus.find_by_retval(wkst_netr_wksta_get_info_response.error_status.value).join(',')}"
+        end
+        wkst_netr_wksta_get_info_response.wksta_info.info
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc.rb

@@ -3,46 +3,80 @@ module RubySMB
     MAX_XMIT_FRAG = 4280
     MAX_RECV_FRAG = 4280
 
+    # Auth Levels
+    #[2.2.1.1.8 Authentication Levels](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/425a7c53-c33a-4868-8e5b-2a850d40dc73)
+    RPC_C_AUTHN_LEVEL_DEFAULT       = 0
+    RPC_C_AUTHN_LEVEL_NONE          = 1
+    RPC_C_AUTHN_LEVEL_CONNECT       = 2
+    RPC_C_AUTHN_LEVEL_CALL          = 3
+    RPC_C_AUTHN_LEVEL_PKT           = 4
+    RPC_C_AUTHN_LEVEL_PKT_INTEGRITY = 5
+    RPC_C_AUTHN_LEVEL_PKT_PRIVACY   = 6
+
+    ## Auth Types
+    # [2.2.1.1.7 Security Providers](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/d4097450-c62f-484b-872f-ddf59a7a0d36)
+    RPC_C_AUTHN_NONE          = 0x00
+    RPC_C_AUTHN_GSS_NEGOTIATE = 0x09
+    RPC_C_AUTHN_WINNT         = 0x0A
+    RPC_C_AUTHN_GSS_SCHANNEL  = 0x0E
+    RPC_C_AUTHN_GSS_KERBEROS  = 0x10
+    RPC_C_AUTHN_NETLOGON      = 0x44
+    RPC_C_AUTHN_DEFAULT       = 0xFF
+
+    #[Authorisation Services](https://pubs.opengroup.org/onlinepubs/9629399/chap13.htm#tagcjh_18_01_02_03)
+    DCE_C_AUTHZ_NAME = 1
+    DCE_C_AUTHZ_DCE  = 2
+
     require 'windows_error/win32'
     require 'ruby_smb/dcerpc/error'
     require 'ruby_smb/dcerpc/uuid'
     require 'ruby_smb/dcerpc/ndr'
     require 'ruby_smb/dcerpc/ptypes'
     require 'ruby_smb/dcerpc/p_syntax_id_t'
-    require 'ruby_smb/dcerpc/rrp_unicode_string'
+    require 'ruby_smb/dcerpc/rrp_rpc_unicode_string'
+    require 'ruby_smb/dcerpc/rpc_security_attributes'
     require 'ruby_smb/dcerpc/pdu_header'
     require 'ruby_smb/dcerpc/srvsvc'
+    require 'ruby_smb/dcerpc/svcctl'
     require 'ruby_smb/dcerpc/winreg'
+    require 'ruby_smb/dcerpc/netlogon'
+    require 'ruby_smb/dcerpc/samr'
+    require 'ruby_smb/dcerpc/wkssvc'
+    require 'ruby_smb/dcerpc/epm'
+    require 'ruby_smb/dcerpc/drsr'
+    require 'ruby_smb/dcerpc/sec_trailer'
     require 'ruby_smb/dcerpc/request'
     require 'ruby_smb/dcerpc/response'
+    require 'ruby_smb/dcerpc/rpc_auth3'
     require 'ruby_smb/dcerpc/bind'
     require 'ruby_smb/dcerpc/bind_ack'
 
 
+
     # Bind to the remote server interface endpoint.
     #
     # @param options [Hash] the options to pass to the Bind request packet. At least, :endpoint must but provided with an existing Dcerpc class
-    # @return [RubySMB::Dcerpc::BindAck] the BindAck response packet
-    # @raise [RubySMB::Dcerpc::Error::InvalidPacket] if an invalid packet is received
-    # @raise [RubySMB::Dcerpc::Error::BindError] if the response is not a BindAck packet or if the Bind result code is not ACCEPTANCE
+    # @return [BindAck] the BindAck response packet
+    # @raise [Error::InvalidPacket] if an invalid packet is received
+    # @raise [Error::BindError] if the response is not a BindAck packet or if the Bind result code is not ACCEPTANCE
     def bind(options={})
-      bind_req = RubySMB::Dcerpc::Bind.new(options)
+      bind_req = Bind.new(options)
       write(data: bind_req.to_binary_s)
       @size = 1024
       dcerpc_raw_response = read()
       begin
-        dcerpc_response = RubySMB::Dcerpc::BindAck.read(dcerpc_raw_response)
+        dcerpc_response = BindAck.read(dcerpc_raw_response)
       rescue IOError
-        raise RubySMB::Dcerpc::Error::InvalidPacket, "Error reading the DCERPC response"
+        raise Error::InvalidPacket, "Error reading the DCERPC response"
       end
-      unless dcerpc_response.pdu_header.ptype == RubySMB::Dcerpc::PTypes::BIND_ACK
-        raise RubySMB::Dcerpc::Error::BindError, "Not a BindAck packet"
+      unless dcerpc_response.pdu_header.ptype == PTypes::BIND_ACK
+        raise Error::BindError, "Not a BindAck packet"
       end
 
       res_list = dcerpc_response.p_result_list
       if res_list.n_results == 0 ||
-         res_list.p_results[0].result != RubySMB::Dcerpc::BindAck::ACCEPTANCE
-        raise RubySMB::Dcerpc::Error::BindError,
+         res_list.p_results[0].result != BindAck::ACCEPTANCE
+        raise Error::BindError,
           "Bind Failed (Result: #{res_list.p_results[0].result}, Reason: #{res_list.p_results[0].reason})"
       end
       @tree.client.max_buffer_size = dcerpc_response.max_xmit_frag

data/lib/ruby_smb/dialect.rb

@@ -0,0 +1,45 @@
+module RubySMB
+  # Definitions that define metadata around a particular SMB dialect. This is useful for grouping dialects into a
+  # hierarchy as well as printing them as human readable strings with varying degrees of specificity.
+  module Dialect
+    # the order (taxonomic ranking) of the family, 2 and 3 are intentionally combined
+    ORDER_SMB1 = 'SMB1'.freeze
+    ORDER_SMB2 = 'SMB2'.freeze
+
+    # the family of the dialect
+    FAMILY_SMB1 = 'SMB 1'.freeze
+    FAMILY_SMB2 = 'SMB 2.x'.freeze
+    FAMILY_SMB3 = 'SMB 3.x'.freeze
+
+    # the major version of the dialect
+    VERSION_SMB1 = 'SMB v1'.freeze
+    VERSION_SMB2 = 'SMB v2'.freeze
+    VERSION_SMB3 = 'SMB v3'.freeze
+
+    # the names are meant to be human readable and may change in the future, use the #dialect, #order and #family
+    # attributes for any programmatic comparisons
+    Definition = Struct.new(:dialect, :order, :family, :version_name, :full_name) do
+      alias_method :short_name, :version_name
+    end
+
+    ALL = [
+      Definition.new('NT LM 0.12', ORDER_SMB1, FAMILY_SMB1, VERSION_SMB1, 'SMB v1 (NT LM 0.12)'.freeze),
+      Definition.new('0x0202',     ORDER_SMB2, FAMILY_SMB2, VERSION_SMB2, 'SMB v2.0.2'.freeze),
+      Definition.new('0x0210',     ORDER_SMB2, FAMILY_SMB2, VERSION_SMB2, 'SMB v2.1'.freeze),
+      Definition.new('0x02ff',     ORDER_SMB2, FAMILY_SMB2, VERSION_SMB2, 'SMB 2.???'.freeze), # wildcard revision
+      Definition.new('0x0300',     ORDER_SMB2, FAMILY_SMB3, VERSION_SMB3, 'SMB v3.0'.freeze),
+      Definition.new('0x0302',     ORDER_SMB2, FAMILY_SMB3, VERSION_SMB3, 'SMB v3.0.2'.freeze),
+      Definition.new('0x0311',     ORDER_SMB2, FAMILY_SMB3, VERSION_SMB3, 'SMB v3.1.1'.freeze)
+    ].map { |definition| [definition.dialect, definition] }.to_h
+
+    #
+    # Retrieve a dialect definition. The definition contains metadata describing the particular dialect.
+    #
+    # @param [Integer, String] dialect the dialect to retrieve the definition for
+    # @return [Definition, nil] the definition if it was found
+    def self.[](dialect)
+      dialect = '0x%04x' % dialect if dialect.is_a? Integer
+      ALL[dialect]
+    end
+  end
+end

data/lib/ruby_smb/dispatcher/base.rb

@@ -9,7 +9,7 @@ module RubySMB
       def nbss(packet)
         nbss = RubySMB::Nbss::SessionHeader.new
         nbss.session_packet_type = RubySMB::Nbss::SESSION_MESSAGE
-        nbss.packet_length       = packet.do_num_bytes
+        nbss.stream_protocol_length = packet.do_num_bytes.to_i
         nbss.to_binary_s
       end
 

data/lib/ruby_smb/dispatcher/socket.rb

@@ -55,7 +55,7 @@ module RubySMB
 
       # Read a packet off the wire and parse it into a string
       #
-      # @param full_response [Boolean] whether to include the NetBios Session Service header in the repsonse
+      # @param full_response [Boolean] whether to include the NetBios Session Service header in the response
       # @return [String] the raw response (including the NetBios Session Service header if full_response is true)
       # @raise [RubySMB::Error::NetBiosSessionService] if there's an error reading the first 4 bytes,
       #   which are assumed to be the NetBiosSessionService header.
@@ -74,7 +74,7 @@ module RubySMB
           raise ::RubySMB::Error::NetBiosSessionService, 'NBSS Header is missing'
         end
 
-        length = nbss_header.packet_length
+        length = nbss_header.stream_protocol_length
         data = full_response ? nbss_header.to_binary_s : ''
         if length > 0
           if IO.select([@tcp_socket], nil, nil, @read_timeout).nil?

data/lib/ruby_smb/error.rb

@@ -16,23 +16,26 @@ module RubySMB
     # Raised when trying to parse raw binary into a Packet and the data
     # is invalid.
     class InvalidPacket < RubySMBError
+      attr_reader :status_code
       def initialize(args = nil)
         if args.nil?
           super
         elsif args.is_a? String
           super(args)
         elsif args.is_a? Hash
-          expected_proto = args[:expected_proto] ? translate_protocol(args[:expected_proto]) : "???"
-          expected_cmd = args[:expected_cmd] || "???"
-          received_proto = args[:received_proto] ? translate_protocol(args[:received_proto]) : "???"
-          received_cmd = args[:received_cmd] || "???"
+          expected_proto = args[:expected_proto] ? translate_protocol(args[:expected_proto]) : '???'
+          expected_cmd = args[:expected_cmd] || '???'
+          received_proto = args[:packet]&.packet_smb_version || '???'
+          received_cmd = get_cmd(args[:packet]) || '???'
+          @status_code = args[:packet]&.status_code
           super(
             "Expecting #{expected_proto} protocol "\
             "with command=#{expected_cmd}"\
             "#{(" (" + args[:expected_custom] + ")") if args[:expected_custom]}, "\
             "got #{received_proto} protocol "\
             "with command=#{received_cmd}"\
-            "#{(" (" + args[:received_custom] + ")") if args[:received_custom]}"
+            "#{(" (" + args[:received_custom] + ")") if args[:received_custom]}"\
+            "#{(", Status: #{@status_code}") if @status_code}"
           )
         else
           raise ArgumentError, "InvalidPacket expects a String or a Hash, got a #{args.class}"
@@ -50,6 +53,19 @@ module RubySMB
         end
       end
       private :translate_protocol
+
+      def get_cmd(packet)
+        return nil unless packet
+        case packet.packet_smb_version
+        when 'SMB1'
+          packet.smb_header.command
+        when 'SMB2'
+          packet.smb2_header.command
+        else
+          nil
+        end
+      end
+      private :get_cmd
     end
 
     # Raised when a response packet has a NTStatus code that was unexpected.

data/lib/ruby_smb/field/file_time.rb

@@ -3,7 +3,7 @@ require 'date'
 module RubySMB
   module Field
     # Represents a Windows FILETIME structure as defined in
-    # [FILETIME structure](https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx)
+    # [2.3.3 FILETIME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/2c57429b-fdd4-488f-b5fc-9e4cf020fcdf).aspx)
     class FileTime < BinData::Primitive
       # Difference between the Windows and Unix epochs, in 100ns intervals
       EPOCH_DIFF_100NS = 116_444_736_000_000_000

data/lib/ruby_smb/field/string16.rb

@@ -3,12 +3,16 @@ module RubySMB
     # Represents a String in UTF-16LE
     class String16 < BinData::String
       def assign(val)
-        super(val.encode('utf-16le'))
+        super(val.to_s.encode('utf-16le')).force_encoding('utf-16le')
       end
 
       def snapshot
         super.force_encoding('utf-16le')
       end
+
+      def read_and_return_value(io)
+        super.force_encoding('utf-16le')
+      end
     end
   end
 end

data/lib/ruby_smb/field/stringz16.rb

@@ -25,12 +25,17 @@ module RubySMB
       # @see BinData::Stringz
       def read_and_return_value(io)
         max_length = eval_parameter(:max_length)
+        if max_length && max_length % 2 != 0
+          raise ArgumentError, "[Stringz16] #max_length should be a multiple of "\
+            "two, since it is Unicode (got #{max_length})"
+        end
         str = ''
         i = 0
         ch = nil
 
         # read until double NULL-byte or we have read in the max number of bytes
-        while (ch != "\0\0") && (i != max_length)
+        loop do
+          break if ch == "\0\0" || (max_length && i == max_length)
           ch = io.readbytes(2)
           str << ch
           i += 2
@@ -46,6 +51,17 @@ module RubySMB
       def truncate_after_first_zero_byte!(str)
         str.sub!(/([^\0]*\0\0\0).*/, '\1')
       end
+
+      def trim_to!(str, max_length = nil)
+        if max_length
+          max_length = 2 if max_length < 2
+          str.slice!(max_length..-1)
+          if str.length == max_length && str[-2, 2] != "\0\0"
+            str[-2, 2] = "\0\0"
+          end
+        end
+      end
+
     end
   end
 end

data/lib/ruby_smb/generic_packet.rb

@@ -49,7 +49,17 @@ module RubySMB
           when /SMB1/
             packet = RubySMB::SMB1::Packet::EmptyPacket.read(val)
           when /SMB2/
-            packet = RubySMB::SMB2::Packet::ErrorPacket.read(val)
+            begin
+              packet = RubySMB::SMB2::Packet::ErrorPacket.read(val)
+            rescue RubySMB::Error::InvalidPacket
+              # Handle the case where an SMB2 error packet is expected, but the
+              # server sent an SMB1 empty packet instead. This behavior has been
+              # observed with older versions of Samba when something goes wrong
+              # on the server side. We just want to give it a chance and try to
+              # parse it as an SMB1 empty packet to keep information and avoid
+              # failing as much as possible.
+              packet = RubySMB::SMB1::Packet::EmptyPacket.read(val)
+            end
           else
             raise RubySMB::Error::InvalidPacket, 'Not a valid SMB packet'
         end

data/lib/ruby_smb/gss/provider/authenticator.rb

@@ -0,0 +1,42 @@
+module RubySMB
+  module Gss
+    module Provider
+      module Authenticator
+        #
+        # The base class for a GSS provider's unique authenticator. This provides a common interface and is not usable
+        # on it's own. The provider-specific authentication logic is defined within this authenticator class which
+        # actually runs the authentication routine.
+        #
+        class Base
+          # @param [Provider::Base] provider the GSS provider that this instance is an authenticator for
+          # @param server_client the client instance that this will be an authenticator for
+          def initialize(provider, server_client)
+            @provider = provider
+            @server_client = server_client
+            @session_key = nil
+            reset!
+          end
+
+          #
+          # Process a GSS authentication buffer. If no buffer is specified, the request is assumed to be the first in
+          # the negotiation sequence.
+          #
+          # @param [String, nil] buffer the request GSS request buffer that should be processed
+          # @return [Gss::Provider::Result] the result of the processed GSS request
+          def process(request_buffer=nil)
+            raise NotImplementedError
+          end
+
+          #
+          # Reset the authenticator's state, wiping anything related to a partial or complete authentication process.
+          #
+          def reset!
+            @session_key = nil
+          end
+
+          attr_accessor :session_key
+        end
+      end
+    end
+  end
+end