ruby_smb 2.0.2 → 3.0.0

data/examples/negotiate_with_netbios_service.rb

@@ -9,11 +9,11 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-def run_negotiation(address, smb1, smb2, netbios_name)
+def run_negotiation(address, smb1, smb2, smb3, netbios_name)
   sock = TCPSocket.new address, 139
   dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-  client = RubySMB::Client.new(dispatcher, smb1: smb1, smb2: smb2, username: 'msfadmin', password: 'msfadmin')
+  client = RubySMB::Client.new(dispatcher, smb1: smb1, smb2: smb2, smb3: smb3, username: 'msfadmin', password: 'msfadmin')
   begin
     client.session_request(netbios_name)
   rescue RubySMB::Error::NetBiosSessionService => e
@@ -28,9 +28,13 @@ end
 address      = ARGV[0]
 netbios_name = ARGV[1] || '*SMBSERVER'
 
+# Negotiate with SMB1, SMB2 and SMB3 enabled on the client
+run_negotiation(ARGV[0], true, true, true, netbios_name)
 # Negotiate with both SMB1 and SMB2 enabled on the client
-run_negotiation(ARGV[0], true, true, netbios_name)
+run_negotiation(ARGV[0], true, true, false, netbios_name)
 # Negotiate with only SMB1 enabled
-run_negotiation(ARGV[0], true, false, netbios_name)
+run_negotiation(ARGV[0], true, false, false, netbios_name)
 # Negotiate with only SMB2 enabled
-run_negotiation(ARGV[0], false, true, netbios_name)
+run_negotiation(ARGV[0], false, true, false, netbios_name)
+# Negotiate with only SMB3 enabled
+run_negotiation(ARGV[0], false, false, true, netbios_name)

data/examples/net_share_enum_all.rb

@@ -8,15 +8,17 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+smb_versions = ARGV[3]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\IPC$"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/pipes.rb

@@ -10,25 +10,24 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-pipename = ARGV[1]
-username = ARGV[2]
-password = ARGV[3]
-smbver   = ARGV[4].to_i
+address      = ARGV[0]
+pipename     = ARGV[1]
+username     = ARGV[2]
+password     = ARGV[3]
+smb_versions = ARGV[4]&.split(',') || ['1','2','3']
 
 sock = TCPSocket.new(address, 445)
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-if smbver == 2
-  client = RubySMB::Client.new(dispatcher, smb1: false, username: username, password: password)
-  client.negotiate
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
+smbver = client.negotiate
+
+if smbver == 'SMB1'
+  puts "ServerMaxBuffer: #{client.server_max_buffer_size}"
+else
   puts "ServerMaxRead:   #{client.server_max_read_size}"
   puts "ServerMaxWrite:  #{client.server_max_write_size}"
   puts "ServerMaxTrans:  #{client.server_max_transact_size}"
-elsif smbver == 1
-  client = RubySMB::Client.new(dispatcher, smb2: false, username: username, password: password)
-  client.negotiate
-  puts "ServerMaxBuffer: #{client.server_max_buffer_size}"
 end
 
 client.authenticate

data/examples/query_service_status.rb

@@ -0,0 +1,102 @@
+#!/usr/bin/ruby
+
+# This example script is used for testing remote service status and start type query.
+# It will attempt to connect to a host and query the status and start type of the provided service.
+# Example usage: ruby query_service_status.rb 192.168.172.138 msfadmin msfadmin "RemoteRegistry"
+# This will try to connect to \\192.168.172.138 with the msfadmin:msfadmin credentialas and get the status and start type of the "RemoteRegistry" service.
+
+require 'bundler/setup'
+require 'ruby_smb'
+
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+service      = ARGV[3]
+smb_versions = ARGV[4]&.split(',') || ['1','2','3']
+
+sock = TCPSocket.new address, 445
+dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
+
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
+protocol = client.negotiate
+status = client.authenticate
+
+puts "#{protocol} : #{status}"
+
+tree = client.tree_connect("\\\\#{address}\\IPC$")
+svcctl = tree.open_file(filename: 'svcctl', write: true, read: true)
+
+puts('Binding to \\svcctl...')
+svcctl.bind(endpoint: RubySMB::Dcerpc::Svcctl)
+puts('Bound to \\svcctl')
+
+puts('Opening Service Control Manager')
+scm_handle = svcctl.open_sc_manager_w(address)
+
+svc_handle = svcctl.open_service_w(scm_handle, service)
+svc_status = svcctl.query_service_status(svc_handle)
+
+puts
+case svc_status.dw_current_state
+when RubySMB::Dcerpc::Svcctl::SERVICE_RUNNING
+  puts("Service #{service} is running")
+when RubySMB::Dcerpc::Svcctl::SERVICE_STOPPED
+  puts("Service #{service} is in stopped state")
+end
+puts
+
+svc_config = svcctl.query_service_config(svc_handle)
+
+service_type = 'Service type: '
+case svc_config.dw_service_type
+when RubySMB::Dcerpc::Svcctl::SERVICE_KERNEL_DRIVER
+  service_type << 'Driver service'
+when RubySMB::Dcerpc::Svcctl::SERVICE_FILE_SYSTEM_DRIVER
+  service_type << 'File system driver service'
+when RubySMB::Dcerpc::Svcctl::SERVICE_WIN32_OWN_PROCESS
+  service_type << 'Service that runs in its own process'
+when RubySMB::Dcerpc::Svcctl::SERVICE_WIN32_SHARE_PROCESS
+  service_type << 'Service that shares a process with other services'
+end
+
+start_type = 'Service start type: '
+case svc_config.dw_start_type
+when RubySMB::Dcerpc::Svcctl::SERVICE_DISABLED
+  start_type << 'Service is disabled'
+when RubySMB::Dcerpc::Svcctl::SERVICE_BOOT_START, RubySMB::Dcerpc::Svcctl::SERVICE_SYSTEM_START
+  start_type << 'Service starts when the system boots up (driver)'
+when RubySMB::Dcerpc::Svcctl::SERVICE_AUTO_START
+  start_type << 'Service starts automatically during system startup'
+when RubySMB::Dcerpc::Svcctl::SERVICE_DEMAND_START
+  start_type << 'Service starts manually'
+end
+
+error_control = 'Error control: '
+case svc_config.dw_error_control
+when RubySMB::Dcerpc::Svcctl::SERVICE_ERROR_IGNORE
+  error_control << 'SERVICE_ERROR_IGNORE'
+when RubySMB::Dcerpc::Svcctl::SERVICE_ERROR_NORMAL
+  error_control << 'SERVICE_ERROR_NORMAL'
+when RubySMB::Dcerpc::Svcctl::SERVICE_ERROR_SEVERE
+  error_control << 'SERVICE_ERROR_SEVERE'
+when RubySMB::Dcerpc::Svcctl::SERVICE_ERROR_CRITICAL
+  error_control << 'SERVICE_ERROR_CRITICAL'
+end
+
+puts service_type
+puts start_type
+puts error_control
+puts "Binary path: #{svc_config.lp_binary_path_name.to_s.encode('utf-8')}"
+puts "Load ordering service group: #{svc_config.lp_load_order_group.to_s.encode('utf-8')}"
+puts "Service group tag ID: #{svc_config.dw_tag_id.to_s.encode('utf-8')}"
+puts "Dependencies: #{svc_config.lp_dependencies.to_s.encode('utf-8')}"
+puts "Service start name: #{svc_config.lp_service_start_name.to_s.encode('utf-8')}"
+
+
+if svcctl
+  svcctl.close_service_handle(svc_handle) if svc_handle
+  svcctl.close_service_handle(scm_handle) if scm_handle
+  svcctl.close
+end
+client.disconnect!
+

data/examples/read_file.rb

@@ -9,17 +9,19 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-file     = ARGV[4]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+file         = ARGV[4]
+smb_versions = ARGV[5]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/read_registry_key_value.rb

@@ -8,16 +8,17 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
 registry_key = ARGV[3]
-value_name = ARGV[4]
+value_name   = ARGV[4]
+smb_versions = ARGV[5]&.split(',') || ['1','2','3']
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock, read_timeout: 60)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/rename_file.rb

@@ -9,18 +9,20 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-file     = ARGV[4]
-new_name = ARGV[5]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+file         = ARGV[4]
+new_name     = ARGV[5]
+smb_versions = ARGV[6]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 
 protocol = client.negotiate
 status = client.authenticate

data/examples/tree_connect.rb

@@ -8,16 +8,18 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+smb_versions = ARGV[4]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/examples/write_file.rb

@@ -9,18 +9,20 @@
 require 'bundler/setup'
 require 'ruby_smb'
 
-address  = ARGV[0]
-username = ARGV[1]
-password = ARGV[2]
-share    = ARGV[3]
-file     = ARGV[4]
-data     = ARGV[5]
+address      = ARGV[0]
+username     = ARGV[1]
+password     = ARGV[2]
+share        = ARGV[3]
+file         = ARGV[4]
+data         = ARGV[5]
+smb_versions = ARGV[6]&.split(',') || ['1','2','3']
+
 path     = "\\\\#{address}\\#{share}"
 
 sock = TCPSocket.new address, 445
 dispatcher = RubySMB::Dispatcher::Socket.new(sock)
 
-client = RubySMB::Client.new(dispatcher, smb1: true, smb2: true, username: username, password: password)
+client = RubySMB::Client.new(dispatcher, smb1: smb_versions.include?('1'), smb2: smb_versions.include?('2'), smb3: smb_versions.include?('3'), username: username, password: password)
 protocol = client.negotiate
 status = client.authenticate
 

data/lib/ruby_smb/client/authentication.rb

@@ -60,8 +60,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::SessionSetupLegacyResponse::COMMAND,
-            received_proto: packet.smb_header.protocol,
-            received_cmd:   packet.smb_header.command
+            packet:         packet
           )
         end
         packet
@@ -154,8 +153,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb_header.protocol,
-            received_cmd:   packet.smb_header.command
+            packet:         packet
           )
         end
         packet
@@ -168,8 +166,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb_header.protocol,
-            received_cmd:   packet.smb_header.command
+            packet:         packet
           )
         end
 
@@ -236,8 +233,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb2_header.protocol,
-            received_cmd:   packet.smb2_header.command
+            packet:         packet
           )
         end
 
@@ -251,8 +247,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::SessionSetupResponse::COMMAND,
-            received_proto: packet.smb2_header.protocol,
-            received_cmd:   packet.smb2_header.command
+            packet:         packet
           )
         end
 

data/lib/ruby_smb/client/echo.rb

@@ -21,8 +21,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::EchoResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         response
@@ -40,8 +39,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::EchoResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
         response

data/lib/ruby_smb/client/negotiation.rb

@@ -57,15 +57,20 @@ module RubySMB
 
       # Takes the raw response data from the server and tries
       # parse it into a valid Response packet object.
-      # This method currently assumes that all SMB1 will use Extended Security.
       #
       # @param raw_data [String] the raw binary response from the server
       # @return [RubySMB::SMB1::Packet::NegotiateResponseExtended] when the response is an SMB1 Extended Security Negotiate Response Packet
+      # @return [RubySMB::SMB1::Packet::NegotiateResponse] when the response is an SMB1 Negotiate Response Packet
       # @return [RubySMB::SMB2::Packet::NegotiateResponse] when the response is an SMB2 Negotiate Response Packet
       def negotiate_response(raw_data)
         response = nil
         if smb1
           packet = RubySMB::SMB1::Packet::NegotiateResponseExtended.read raw_data
+
+          unless packet.valid?
+            packet = RubySMB::SMB1::Packet::NegotiateResponse.read raw_data
+          end
+
           response = packet if packet.valid?
         end
         if (smb2 || smb3) && response.nil?
@@ -74,25 +79,16 @@ module RubySMB
         end
         if response.nil?
           if packet.packet_smb_version == 'SMB1'
-            extended_security = if packet.is_a? RubySMB::SMB1::Packet::NegotiateResponseExtended
-              packet.parameter_block.capabilities.extended_security
-            else
-              "n/a"
-            end
             raise RubySMB::Error::InvalidPacket.new(
               expected_proto:  RubySMB::SMB1::SMB_PROTOCOL_ID,
-              expected_cmd:    RubySMB::SMB1::Packet::NegotiateResponseExtended::COMMAND,
-              expected_custom: "extended_security=1",
-              received_proto:  packet.smb_header.protocol,
-              received_cmd:    packet.smb_header.command,
-              received_custom: "extended_security=#{extended_security}"
+              expected_cmd:    RubySMB::SMB1::Packet::NegotiateResponse::COMMAND,
+              packet:          packet
             )
           elsif packet.packet_smb_version == 'SMB2'
             raise RubySMB::Error::InvalidPacket.new(
               expected_proto:  RubySMB::SMB2::SMB2_PROTOCOL_ID,
               expected_cmd:    RubySMB::SMB2::Packet::NegotiateResponse::COMMAND,
-              received_proto:  packet.smb2_header.protocol,
-              received_cmd:    packet.smb2_header.command
+              packet:          packet
             )
           else
             raise RubySMB::Error::InvalidPacket, 'Unknown SMB protocol version'
@@ -125,7 +121,7 @@ module RubySMB
           'SMB1'
         when RubySMB::SMB2::Packet::NegotiateResponse
           self.smb1 = false
-          unless packet.dialect_revision.to_i == 0x02ff
+          unless packet.dialect_revision.to_i == RubySMB::SMB2::SMB2_WILDCARD_REVISION
             self.smb2 = packet.dialect_revision.to_i >= 0x0200 && packet.dialect_revision.to_i < 0x0300
             self.smb3 = packet.dialect_revision.to_i >= 0x0300 && packet.dialect_revision.to_i < 0x0400
           end
@@ -140,6 +136,7 @@ module RubySMB
           self.server_guid = packet.server_guid
           self.server_start_time = packet.server_start_time.to_time if packet.server_start_time != 0
           self.server_system_time = packet.system_time.to_time if packet.system_time != 0
+          self.server_supports_multi_credit = self.dialect != '0x0202' && packet&.capabilities&.large_mtu == 1
           case self.dialect
           when '0x02ff'
           when '0x0300', '0x0302'
@@ -276,8 +273,8 @@ module RubySMB
             context_type: RubySMB::SMB2::NegotiateContext::SMB2_COMPRESSION_CAPABILITIES
           )
           # Adding all possible compression algorithm even if we don't support
-          # them yet. This will force the server to disclose the support
-          # algorithms in the repsonse.
+          # them yet. This will force the server to disclose the supported
+          # algorithms in the response.
           nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZNT1
           nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZ77
           nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZ77_Huffman

data/lib/ruby_smb/client/tree_connect.rb

@@ -33,8 +33,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::TreeConnectResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
@@ -73,8 +72,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::TreeConnectResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS

data/lib/ruby_smb/client/utils.rb

@@ -24,19 +24,25 @@ module RubySMB
         last_tree.id
       end
 
-      def open(path, disposition=RubySMB::Dispositions::FILE_OPEN, write: false, read: true)
-         file = last_tree.open_file(filename: path.sub(/^\\/, ''), write: write, read: read, disposition: disposition)
-         @last_file_id = if file.respond_to?(:guid)
-           file.guid.to_binary_s
-         elsif file.respond_to?(:fid)
-           file.fid.to_binary_s
-         end
-         @open_files[@last_file_id] = file
-         @last_file_id
+      def open(path, disposition=RubySMB::Dispositions::FILE_OPEN, write: false, read: true, pipe: false)
+        if pipe
+         file = last_tree.open_pipe(filename: path, write: write, read: read, disposition: disposition)
+        else
+         file = last_tree.open_file(filename: path, write: write, read: read, disposition: disposition)
+        end
+        @last_file_id = if file.respond_to?(:guid)
+          # SMB2 uses guid
+          file.guid.to_binary_s
+        elsif file.respond_to?(:fid)
+          # SMB1 uses fid
+          file.fid.to_binary_s
+        end
+        @open_files[@last_file_id] = file
+        @last_file_id
       end
 
       def create_pipe(path, disposition=RubySMB::Dispositions::FILE_OPEN_IF)
-        open(path.gsub(/\\/, ''), disposition, write: true, read: true)
+        open(path, disposition, write: true, read: true, pipe: true)
       end
 
       #Writes data to an open file handle

data/lib/ruby_smb/client/winreg.rb

@@ -6,7 +6,7 @@ module RubySMB
         share = "\\\\#{host}\\IPC$"
         tree = @tree_connects.find {|tree| tree.share == share}
         tree = tree_connect(share) unless tree
-        named_pipe = tree.open_file(filename: "winreg", write: true, read: true)
+        named_pipe = tree.open_pipe(filename: "winreg", write: true, read: true)
         if block_given?
           res = yield named_pipe
           named_pipe.close