ruby_smb 2.0.2 → 3.0.0

data/spec/lib/ruby_smb/dcerpc/rpc_auth3_spec.rb

@@ -0,0 +1,75 @@
+RSpec.describe RubySMB::Dcerpc::RpcAuth3 do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :pdu_header }
+  it { is_expected.to respond_to :pad }
+  it { is_expected.to respond_to :sec_trailer }
+  it { is_expected.to respond_to :auth_value }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#pdu_header' do
+    subject(:header) { packet.pdu_header }
+
+    it 'is a standard PDU Header' do
+      expect(header).to be_a RubySMB::Dcerpc::PDUHeader
+    end
+
+    it 'should have the #ptype field set to PTypes::BIND' do
+      expect(header.ptype).to eq RubySMB::Dcerpc::PTypes::RPC_AUTH3
+    end
+  end
+
+  describe '#sec_trailer' do
+    it 'should be SecTrailer structure' do
+      expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.sec_trailer?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.sec_trailer?).to be true
+    end
+  end
+
+  describe '#auth_value' do
+    it 'should be a string' do
+      expect(packet.auth_value).to be_a BinData::String
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.auth_value?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.auth_value?).to be true
+    end
+
+    it 'reads #auth_length bytes' do
+      auth_value = '12345678'
+      packet.pdu_header.auth_length = 6
+      packet.auth_value.read(auth_value)
+      expect(packet.auth_value).to eq(auth_value[0,6])
+    end
+  end
+
+  it 'reads its own binary representation and output the same packet' do
+    auth_size = rand(0xFF)
+    packet = described_class.new(
+      pdu_header: { auth_length: auth_size },
+      pad: rand(0xFFFFFFFF),
+      auth_value: 'A' * auth_size
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+
+end

data/spec/lib/ruby_smb/dcerpc/rpc_security_attributes_spec.rb

@@ -0,0 +1,162 @@
+RSpec.describe RubySMB::Dcerpc::RpcSecurityDescriptor do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :lp_security_descriptor }
+  it { is_expected.to respond_to :cb_in_security_descriptor }
+  it { is_expected.to respond_to :cb_out_security_descriptor }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  it 'has :byte_align parameter set to the expected value' do
+    expect(described_class.default_parameters[:byte_align]).to eq(4)
+  end
+
+  describe '#lp_security_descriptor' do
+    it 'should be a NdrByteArrayPtr structure' do
+      expect(packet.lp_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrByteArrayPtr
+    end
+  end
+
+  describe '#cb_in_security_descriptor' do
+    it 'should be a NdrUint32' do
+      expect(packet.cb_in_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
+    end
+  end
+
+  describe '#cb_out_security_descriptor' do
+    it 'should be a NdrUint32' do
+      expect(packet.cb_out_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
+    end
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal RpcSecurityAttributes structure' do
+      it 'reads its own binary representation' do
+        packet.lp_security_descriptor = RubySMB::Dcerpc::Ndr::NdrByteArrayPtr.new([1, 2, 3])
+        packet.cb_in_security_descriptor = 90
+        packet.cb_out_security_descriptor = 33
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :n_length }
+  it { is_expected.to respond_to :rpc_security_descriptor }
+  it { is_expected.to respond_to :b_inheritHandle }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  it 'has :byte_align parameter set to the expected value' do
+    expect(described_class.default_parameters[:byte_align]).to eq(4)
+  end
+
+  describe '#n_length' do
+    it 'should be a NdrUint32' do
+      expect(packet.n_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
+    end
+  end
+
+  describe '#rpc_security_descriptor' do
+    it 'should be a RpcSecurityDescriptor structure' do
+      expect(packet.rpc_security_descriptor).to be_a RubySMB::Dcerpc::RpcSecurityDescriptor
+    end
+  end
+
+  describe '#b_inheritHandle' do
+    it 'should be a NdrUint8' do
+      expect(packet.b_inheritHandle).to be_a RubySMB::Dcerpc::Ndr::NdrUint8
+    end
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal RpcSecurityAttributes structure' do
+      it 'reads its own binary representation' do
+        packet.n_length = 3
+        packet.rpc_security_descriptor = RubySMB::Dcerpc::RpcSecurityDescriptor.new
+        packet.rpc_security_descriptor.lp_security_descriptor = [1, 2, 3]
+        packet.rpc_security_descriptor.cb_in_security_descriptor = 33
+        packet.rpc_security_descriptor.cb_out_security_descriptor = 22
+        packet.b_inheritHandle = 90
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::PrpcSecurityAttributes do
+  it 'is a RpcSecurityAttributes subclass' do
+    expect(described_class).to be < RubySMB::Dcerpc::RpcSecurityAttributes
+  end
+
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :ref_id }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  it 'should be a RpcSecurityAttributes structure' do
+    expect(packet).to be_a RubySMB::Dcerpc::RpcSecurityAttributes
+  end
+
+  it 'is :null if #ref_id is zero' do
+    packet.ref_id = 0
+    expect(packet).to eq(:null)
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal RpcSecurityAttributes structure' do
+      it 'reads its own binary representation' do
+        struct = RubySMB::Dcerpc::RpcSecurityAttributes.new
+        struct.n_length = 5
+        struct.rpc_security_descriptor = RubySMB::Dcerpc::RpcSecurityDescriptor.new
+        struct.rpc_security_descriptor.lp_security_descriptor = [1, 2, 3]
+        struct.rpc_security_descriptor.cb_in_security_descriptor = 33
+        struct.rpc_security_descriptor.cb_out_security_descriptor = 22
+        struct.b_inheritHandle = 4
+        packet.assign(struct)
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+end
+

data/spec/lib/ruby_smb/dcerpc/rrp_rpc_unicode_string_spec.rb

@@ -0,0 +1,340 @@
+RSpec.describe RubySMB::Dcerpc::RrpUnicodeString do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :buffer_length }
+  it { is_expected.to respond_to :maximum_length }
+  it { is_expected.to respond_to :buffer }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  it 'has :byte_align parameter set to the expected value' do
+    expect(described_class.default_parameters[:byte_align]).to eq(4)
+  end
+
+  describe '#buffer_length' do
+    it 'should be a NdrUint16' do
+      expect(packet.buffer_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint16
+    end
+    it 'is 0 by default' do
+      expect(packet.buffer_length).to eq(0)
+    end
+  end
+
+  describe '#maximum_length' do
+    it 'should be a NdrUint16' do
+      expect(packet.maximum_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint16
+    end
+    it 'is 0 by default' do
+      expect(packet.maximum_length).to eq(0)
+    end
+  end
+
+  describe '#buffer' do
+    it 'should be a NdrWideStringzPtr' do
+      expect(packet.buffer).to be_a RubySMB::Dcerpc::Ndr::NdrWideStringzPtr
+    end
+    it 'is :null by default' do
+      expect(packet.buffer).to eq(:null)
+    end
+  end
+
+  describe '#assign' do
+    context 'with a string' do
+      before :example do
+        packet.assign('spec_test')
+      end
+
+      [BinData::Stringz, BinData::String, String].each do |klass|
+        context "with a #{klass}" do
+          it 'sets #buffer to the expected value' do
+            expect(packet.buffer).to eq(RubySMB::Dcerpc::Ndr::NdrWideStringPtr.new(klass.new('spec_test')))
+          end
+
+          it 'sets #buffer_length to the expected value' do
+            expect(packet.buffer_length).to eq(('spec_test'.size + 1) * 2)
+          end
+
+          it 'sets #maximum_length to the expected value' do
+            expect(packet.maximum_length).to eq(('spec_test'.size + 1) * 2)
+          end
+        end
+      end
+    end
+
+    context 'with a :null pointer' do
+      before :example do
+        packet.assign(:null)
+      end
+      it 'sets #buffer to :null' do
+        expect(packet.buffer).to eq(:null)
+      end
+
+      it 'sets #buffer_length to 0' do
+        expect(packet.buffer_length).to eq(0)
+      end
+
+      it 'sets #maximum_length to 0' do
+        expect(packet.maximum_length).to eq(0)
+      end
+    end
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal string' do
+      it 'reads its own binary representation' do
+        packet.assign('my_test')
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+
+  describe '#set_max_buffer_size' do
+    it 'sets buffer.max_count to the expected value' do
+      packet.set_max_buffer_size(4)
+      expect(packet.buffer.max_count).to eq(4 / 2)
+    end
+
+    it 'sets #maximum_length to the expected value' do
+      packet.set_max_buffer_size(4)
+      expect(packet.maximum_length).to eq(4)
+    end
+
+    it 'instantiates `buffer` if it is a null pointer' do
+      expect(packet.buffer).to eq(:null)
+      packet.set_max_buffer_size(4)
+      expect(packet.buffer).to eq('')
+    end
+  end
+
+  describe '#to_s' do
+    it 'returns a unicode string' do
+      packet.assign('Test')
+      expect(packet.to_s).to eq('Test'.encode('utf-16le'))
+    end
+
+    it 'returns a unicode encoded empty string if `buffer` is a null pointer' do
+      expect(packet.buffer).to eq(:null)
+      expect(packet.to_s).to eq(''.encode('utf-16le'))
+    end
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::PrrpUnicodeString do
+  it 'is RrpUnicodeString subclass' do
+    expect(described_class).to be < RubySMB::Dcerpc::RrpUnicodeString
+  end
+
+  subject(:packet) { described_class.new }
+
+  it 'is a NDR pointer' do
+    expect(subject).to be_a RubySMB::Dcerpc::Ndr::PointerPlugin
+  end
+
+  it { is_expected.to respond_to :ref_id }
+
+  it 'is :null if #ref_id is zero' do
+    packet.ref_id = 0
+    expect(packet).to eq(:null)
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal string' do
+      it 'reads its own binary representation' do
+        packet.assign('my_test')
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::RpcUnicodeString do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :buffer_length }
+  it { is_expected.to respond_to :maximum_length }
+  it { is_expected.to respond_to :buffer }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  it 'has :byte_align parameter set to the expected value' do
+    expect(described_class.default_parameters[:byte_align]).to eq(4)
+  end
+
+  describe '#buffer_length' do
+    it 'should be a NdrUint16' do
+      expect(packet.buffer_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint16
+    end
+    it 'is 0 by default' do
+      expect(packet.buffer_length).to eq(0)
+    end
+  end
+
+  describe '#maximum_length' do
+    it 'should be a NdrUint16' do
+      expect(packet.maximum_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint16
+    end
+    it 'is 0 by default' do
+      expect(packet.maximum_length).to eq(0)
+    end
+  end
+
+  describe '#buffer' do
+    it 'should be a NdrWideStringPtr' do
+      expect(packet.buffer).to be_a RubySMB::Dcerpc::Ndr::NdrWideStringPtr
+    end
+    it 'is :null by default' do
+      expect(packet.buffer).to eq(:null)
+    end
+  end
+
+  describe '#assign' do
+    context 'with a string' do
+      before :example do
+        packet.assign('spec_test')
+      end
+
+      [BinData::Stringz, BinData::String, String].each do |klass|
+        context "with a #{klass}" do
+          it 'sets #buffer to the expected value' do
+            expect(packet.buffer).to eq(RubySMB::Dcerpc::Ndr::NdrWideStringPtr.new('spec_test'))
+          end
+
+          it 'sets #buffer_length to the expected value' do
+            expect(packet.buffer_length).to eq(('spec_test'.size) * 2)
+          end
+
+          it 'sets #maximum_length to the expected value' do
+            expect(packet.maximum_length).to eq(('spec_test'.size) * 2)
+          end
+        end
+      end
+    end
+    context 'with a :null pointer' do
+      before :example do
+        packet.assign(:null)
+      end
+      it 'sets #buffer to :null' do
+        expect(packet.buffer).to eq(:null)
+      end
+
+      it 'sets #buffer_length to 0' do
+        expect(packet.buffer_length).to eq(0)
+      end
+
+      it 'sets #maximum_length to 0' do
+        expect(packet.maximum_length).to eq(0)
+      end
+    end
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal string' do
+      it 'reads its own binary representation' do
+        packet.assign('my_test')
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+
+  describe '#set_max_buffer_size' do
+    it 'sets buffer.max_count to the expected value' do
+      packet.set_max_buffer_size(4)
+      expect(packet.buffer.max_count).to eq(4 / 2)
+    end
+
+    it 'sets #maximum_length to the expected value' do
+      packet.set_max_buffer_size(4)
+      expect(packet.maximum_length).to eq(4)
+    end
+
+    it 'instantiates `buffer` if it is a null pointer' do
+      expect(packet.buffer).to eq(:null)
+      packet.set_max_buffer_size(4)
+      expect(packet.buffer).to eq('')
+    end
+  end
+
+  describe '#to_s' do
+    it 'returns a unicode string' do
+      packet.assign('Test')
+      expect(packet.to_s).to eq('Test'.encode('utf-16le'))
+    end
+
+    it 'returns a unicode encoded empty string if `buffer` is a null pointer' do
+      expect(packet.buffer).to eq(:null)
+      expect(packet.to_s).to eq(''.encode('utf-16le'))
+    end
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::PrpcUnicodeString do
+  it 'is RpcUnicodeString subclass' do
+    expect(described_class).to be < RubySMB::Dcerpc::RpcUnicodeString
+  end
+
+  subject(:packet) { described_class.new }
+
+  it 'is a NDR pointer' do
+    expect(subject).to be_a RubySMB::Dcerpc::Ndr::PointerPlugin
+  end
+
+  it { is_expected.to respond_to :ref_id }
+
+  it 'is :null if #ref_id is zero' do
+    packet.ref_id = 0
+    expect(packet).to eq(:null)
+  end
+
+  describe '#read' do
+    context 'with a null pointer' do
+      it 'reads its own binary representation' do
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+
+    context 'with a normal string' do
+      it 'reads its own binary representation' do
+        packet.assign('my_test')
+        raw = packet.to_binary_s
+        expect(described_class.read(raw)).to eq(packet)
+        expect(described_class.read(raw).to_binary_s).to eq(raw)
+      end
+    end
+  end
+end

data/spec/lib/ruby_smb/dcerpc/samr/rpc_sid_spec.rb

@@ -0,0 +1,116 @@
+RSpec.describe RubySMB::Dcerpc::Samr::RpcSidIdentifierAuthority do
+  subject(:packet) { described_class.new }
+
+  it 'is a Ndr::NdrFixArray' do
+    expect(packet).to be_a(RubySMB::Dcerpc::Ndr::NdrFixArray)
+  end
+  it 'has element of type :ndr_uint8' do
+    expect(packet[0]).to be_a(RubySMB::Dcerpc::Ndr::NdrUint8)
+  end
+  it 'has 6 elements by default' do
+    expect(packet.size).to eq(6)
+  end
+  it 'is one-byte aligned' do
+    expect(packet.eval_parameter(:byte_align)).to eq(1)
+  end
+  it 'reads itself' do
+    expect(packet.read(described_class.new([1, 2, 3, 4, 5, 6]).to_binary_s)).to eq([1, 2, 3, 4, 5, 6])
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::Samr::RpcSid do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :revision }
+  it { is_expected.to respond_to :sub_authority_count }
+  it { is_expected.to respond_to :identifier_authority }
+  it { is_expected.to respond_to :sub_authority }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+  it 'is a Ndr::NdrStruct' do
+    expect(packet).to be_a(RubySMB::Dcerpc::Ndr::NdrStruct)
+  end
+  it 'is four-byte aligned' do
+    expect(packet.eval_parameter(:byte_align)).to eq(4)
+  end
+  describe '#revision' do
+    it 'is a NdrUint8 structure' do
+      expect(packet.revision).to be_a RubySMB::Dcerpc::Ndr::NdrUint8
+    end
+  end
+  describe '#sub_authority_count' do
+    it 'is a NdrUint8 structure' do
+      expect(packet.sub_authority_count).to be_a RubySMB::Dcerpc::Ndr::NdrUint8
+    end
+    it 'is set the the number of #sub_authority elements by default' do
+      packet.sub_authority = [21, 419547006, 9459028, 4093171872, 500]
+      expect(packet.sub_authority_count).to eq(5)
+    end
+  end
+  describe '#identifier_authority' do
+    it 'is a RpcSidIdentifierAuthority structure' do
+      expect(packet.identifier_authority).to be_a RubySMB::Dcerpc::Samr::RpcSidIdentifierAuthority
+    end
+  end
+  describe '#sub_authority' do
+    it 'is a NdrConfArray structure' do
+      expect(packet.sub_authority).to be_a RubySMB::Dcerpc::Ndr::NdrConfArray
+    end
+    it 'has element of type :ndr_uint32' do
+      packet.sub_authority << 1
+      expect(packet.sub_authority[0]).to be_a(RubySMB::Dcerpc::Ndr::NdrUint32)
+    end
+  end
+  describe '#snapshot' do
+    it 'outputs the expected SID' do
+      packet.revision = 1
+      packet.identifier_authority = [0, 0, 0, 0, 0, 5]
+      packet.sub_authority = [21, 419547006, 9459028, 4093171872, 500]
+      expect(packet.snapshot).to eq('S-1-5-21-419547006-9459028-4093171872-500')
+    end
+  end
+  describe '#assign' do
+    it 'assign the correct fields from a String' do
+      packet.assign('S-1-5-21-419547006-9459028-4093171872-500')
+      expect(packet.revision).to eq(1)
+      expect(packet.sub_authority_count).to eq(5)
+      expect(packet.identifier_authority).to eq([0, 0, 0, 0, 0, 5])
+      expect(packet.sub_authority).to eq([21, 419547006, 9459028, 4093171872, 500])
+    end
+    it 'assign the correct fields from another RpcSid object' do
+      packet2 = described_class.new
+      packet2.revision = 1
+      packet2.identifier_authority = [0, 0, 0, 0, 0, 5]
+      packet2.sub_authority = [21, 419547006, 9459028, 4093171872, 500]
+      packet.assign(packet2)
+      expect(packet.revision).to eq(1)
+      expect(packet.sub_authority_count).to eq(5)
+      expect(packet.identifier_authority).to eq([0, 0, 0, 0, 0, 5])
+      expect(packet.sub_authority).to eq([21, 419547006, 9459028, 4093171872, 500])
+      expect(packet.snapshot).to eq('S-1-5-21-419547006-9459028-4093171872-500')
+    end
+  end
+  it 'reads itself' do
+    expect(packet.read(described_class.new('S-1-5-21-419547006-9459028-4093171872-500').to_binary_s)).to eq('S-1-5-21-419547006-9459028-4093171872-500')
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::Samr::PrpcSid do
+  subject(:packet) { described_class.new }
+
+  it 'is a RpcSid' do
+    expect(packet).to be_a(RubySMB::Dcerpc::Samr::RpcSid)
+  end
+  it 'is a NdrPointer' do
+    expect(described_class).to be_a(RubySMB::Dcerpc::Ndr::PointerClassPlugin)
+    expect(packet).to be_a(RubySMB::Dcerpc::Ndr::PointerPlugin)
+  end
+  it 'is four-byte aligned' do
+    expect(packet.eval_parameter(:byte_align)).to eq(4)
+  end
+  it 'reads itself' do
+    expect(packet.read(described_class.new('S-1-5-21-419547006-9459028-4093171872-500').to_binary_s)).to eq('S-1-5-21-419547006-9459028-4093171872-500')
+  end
+end