ruby_smb 2.0.2 → 3.0.0

data/lib/ruby_smb/client.rb

@@ -2,18 +2,19 @@ module RubySMB
   # Represents an SMB client capable of talking to SMB1 or SMB2 servers and handling
   # all end-user client functionality.
   class Client
+    require 'ruby_smb/ntlm'
+    require 'ruby_smb/signing'
     require 'ruby_smb/client/negotiation'
     require 'ruby_smb/client/authentication'
-    require 'ruby_smb/client/signing'
     require 'ruby_smb/client/tree_connect'
     require 'ruby_smb/client/echo'
     require 'ruby_smb/client/utils'
     require 'ruby_smb/client/winreg'
     require 'ruby_smb/client/encryption'
 
+    include RubySMB::Signing
     include RubySMB::Client::Negotiation
     include RubySMB::Client::Authentication
-    include RubySMB::Client::Signing
     include RubySMB::Client::TreeConnect
     include RubySMB::Client::Echo
     include RubySMB::Client::Utils
@@ -160,9 +161,16 @@ module RubySMB
 
     # The UID set in SMB1
     # @!attribute [rw] user_id
-    #   @return [String]
+    #   @return [Integer]
     attr_accessor :user_id
 
+    # The Process ID set in SMB1
+    # It is randomly generated during the client initialization, but can
+    # be modified using the accessor.
+    # @!attribute [rw] pid
+    #   @return [Integer]
+    attr_accessor :pid
+
     # The maximum size SMB message that the Client accepts (in bytes)
     # The default value is equal to {MAX_BUFFER_SIZE}.
     # @!attribute [rw] max_buffer_size
@@ -258,16 +266,26 @@ module RubySMB
     #   @return [Integer] the negotiated SMB version
     attr_accessor :negotiated_smb_version
 
+    # Whether or not the server supports multi-credit operations. It is
+    # reported by the LARGE_MTU capabiliy as part of the negotiation process
+    # (SMB 2.x and 3.x).
+    # @!attribute [rw] server_supports_multi_credit
+    #   @return [Boolean] true if the server supports multi-credit operations,
+    #   false otherwise
+    attr_accessor :server_supports_multi_credit
+
     # @param dispatcher [RubySMB::Dispatcher::Socket] the packet dispatcher to use
     # @param smb1 [Boolean] whether or not to enable SMB1 support
     # @param smb2 [Boolean] whether or not to enable SMB2 support
     # @param smb3 [Boolean] whether or not to enable SMB3 support
-    def initialize(dispatcher, smb1: true, smb2: true, smb3: true, username:, password:, domain: '.', local_workstation: 'WORKSTATION', always_encrypt: true)
+    def initialize(dispatcher, smb1: true, smb2: true, smb3: true, username:, password:, domain: '.',
+                   local_workstation: 'WORKSTATION', always_encrypt: true, ntlm_flags: NTLM::DEFAULT_CLIENT_FLAGS)
       raise ArgumentError, 'No Dispatcher provided' unless dispatcher.is_a? RubySMB::Dispatcher::Base
       if smb1 == false && smb2 == false && smb3 == false
         raise ArgumentError, 'You must enable at least one Protocol'
       end
       @dispatcher        = dispatcher
+      @pid               = rand(0xFFFF)
       @domain            = domain
       @local_workstation = local_workstation
       @password          = password.encode('utf-8') || ''.encode('utf-8')
@@ -280,27 +298,22 @@ module RubySMB
       @smb3              = smb3
       @username          = username.encode('utf-8') || ''.encode('utf-8')
       @max_buffer_size   = MAX_BUFFER_SIZE
-      # These sizes will be modifed during negotiation
+      # These sizes will be modified during negotiation
       @server_max_buffer_size = SERVER_MAX_BUFFER_SIZE
       @server_max_read_size   = RubySMB::SMB2::File::MAX_PACKET_SIZE
       @server_max_write_size  = RubySMB::SMB2::File::MAX_PACKET_SIZE
       @server_max_transact_size = RubySMB::SMB2::File::MAX_PACKET_SIZE
+      @server_supports_multi_credit = false
 
       # SMB 3.x options
       @session_encrypt_data = always_encrypt
 
-      negotiate_version_flag = 0x02000000
-      flags = Net::NTLM::Client::DEFAULT_FLAGS |
-        Net::NTLM::FLAGS[:TARGET_INFO] |
-        negotiate_version_flag ^
-        Net::NTLM::FLAGS[:OEM]
-
       @ntlm_client = Net::NTLM::Client.new(
         @username,
         @password,
         workstation: @local_workstation,
         domain: @domain,
-        flags: flags
+        flags: ntlm_flags
       )
 
       @tree_connects = []
@@ -344,38 +357,35 @@ module RubySMB
     # @param packet [RubySMB::GenericPacket] the packet to set the message id for
     # @return [RubySMB::GenericPacket] the modified packet
     def increment_smb_message_id(packet)
-      packet.smb2_header.message_id = smb2_message_id
+      packet.smb2_header.message_id = self.smb2_message_id
       self.smb2_message_id += 1
       packet
     end
 
     # Performs protocol negotiation and session setup. It defaults to using
     # the credentials supplied during initialization, but can take a new set of credentials if needed.
-    def login(username: self.username, password: self.password, domain: self.domain, local_workstation: self.local_workstation)
+    def login(username: self.username, password: self.password,
+              domain: self.domain, local_workstation: self.local_workstation,
+              ntlm_flags: NTLM::DEFAULT_CLIENT_FLAGS)
       negotiate
-      session_setup(username, password, domain, true,
-                    local_workstation: local_workstation)
+      session_setup(username, password, domain,
+                    local_workstation: local_workstation,
+                    ntlm_flags: ntlm_flags)
     end
 
     def session_setup(user, pass, domain, do_recv=true,
-                      local_workstation: self.local_workstation)
+                      local_workstation: self.local_workstation, ntlm_flags: NTLM::DEFAULT_CLIENT_FLAGS)
       @domain            = domain
       @local_workstation = local_workstation
       @password          = pass.encode('utf-8') || ''.encode('utf-8')
       @username          = user.encode('utf-8') || ''.encode('utf-8')
 
-      negotiate_version_flag = 0x02000000
-      flags = Net::NTLM::Client::DEFAULT_FLAGS |
-        Net::NTLM::FLAGS[:TARGET_INFO] |
-        negotiate_version_flag ^
-        Net::NTLM::FLAGS[:OEM]
-
       @ntlm_client = Net::NTLM::Client.new(
           @username,
           @password,
           workstation: @local_workstation,
           domain: @domain,
-          flags: flags
+          flags: ntlm_flags
       )
 
       authenticate
@@ -394,8 +404,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::LogoffResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
       else
@@ -406,8 +415,7 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB1::SMB_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB1::Packet::LogoffResponse::COMMAND,
-            received_proto: response.smb_header.protocol,
-            received_cmd:   response.smb_header.command
+            packet:         response
           )
         end
       end
@@ -416,7 +424,7 @@ module RubySMB
     end
 
     # Sends a packet and receives the raw response through the Dispatcher.
-    # It will also sign the packet if neccessary.
+    # It will also sign the packet if necessary.
     #
     # @param packet [RubySMB::GenericPacket] the request to be sent
     # @param encrypt [Boolean] true if encryption has to be enabled for this transaction
@@ -427,15 +435,16 @@ module RubySMB
       version = packet.packet_smb_version
       case version
       when 'SMB1'
-        packet.smb_header.uid = user_id if user_id
-        packet = smb1_sign(packet)
+        packet.smb_header.uid = self.user_id if self.user_id
+        packet.smb_header.pid_low = self.pid if self.pid
+        packet = smb1_sign(packet) if signing_required && !session_key.empty?
       when 'SMB2'
         packet = increment_smb_message_id(packet)
         packet.smb2_header.session_id = session_id
-        unless packet.is_a?(RubySMB::SMB2::Packet::SessionSetupRequest)
-          if self.smb2
+        unless packet.is_a?(RubySMB::SMB2::Packet::SessionSetupRequest) || session_key.empty?
+          if self.smb2 && signing_required
             packet = smb2_sign(packet)
-          elsif self.smb3
+          elsif self.smb3 && (signing_required || packet.is_a?(RubySMB::SMB2::Packet::TreeConnectRequest))
             packet = smb3_sign(packet)
           end
         end
@@ -443,35 +452,38 @@ module RubySMB
         packet = packet
       end
 
+      encrypt_data = false
       if can_be_encrypted?(packet) && encryption_supported? && (@session_encrypt_data || encrypt)
-        send_encrypt(packet)
-        raw_response = recv_encrypt
-        loop do
-          break unless is_status_pending?(raw_response)
-          sleep 1
-          raw_response = recv_encrypt
-        end
-      else
-        dispatcher.send_packet(packet)
-        raw_response = dispatcher.recv_packet
-        loop do
-          break unless is_status_pending?(raw_response)
-          sleep 1
-          raw_response = dispatcher.recv_packet
-        end unless version == 'SMB1'
+        encrypt_data = true
       end
+      send_packet(packet, encrypt: encrypt_data)
+      raw_response = recv_packet(encrypt: encrypt_data)
+      smb2_header = nil
+      loop do
+        smb2_header = RubySMB::SMB2::SMB2Header.read(raw_response)
+        break unless is_status_pending?(smb2_header)
+        sleep 1
+        raw_response = recv_packet(encrypt: encrypt_data)
+      rescue IOError
+        # We're expecting an SMB2 packet, but the server sent an SMB1 packet
+        # instead. This behavior has been observed with older versions of Samba
+        # when something goes wrong on the server side. So, we just ignore it
+        # and expect the caller to handle this wrong response packet.
+        break
+      end unless version == 'SMB1'
 
       self.sequence_counter += 1 if signing_required && !session_key.empty?
+      # update the SMB2 message ID according to the received Credit Charged
+      self.smb2_message_id += smb2_header.credit_charge - 1 if smb2_header && self.server_supports_multi_credit
       raw_response
     end
 
     # Check if the response is an asynchronous operation with STATUS_PENDING
     # status code.
     #
-    # @param raw_response [String] the raw response packet
+    # @param smb2_header [String] the response packet SMB2 header
     # @return [Boolean] true if it is a status pending operation, false otherwise
-    def is_status_pending?(raw_response)
-      smb2_header = RubySMB::SMB2::SMB2Header.read(raw_response)
+    def is_status_pending?(smb2_header)
       value = smb2_header.nt_status.value
       status_code = WindowsError::NTStatus.find_by_retval(value).first
       status_code == WindowsError::NTStatus::STATUS_PENDING &&
@@ -497,37 +509,50 @@ module RubySMB
       ['0x0300', '0x0302', '0x0311'].include?(@dialect)
     end
 
-    # Encrypt and send a packet
-    def send_encrypt(packet)
-      begin
-        transform_request = smb3_encrypt(packet.to_binary_s)
-      rescue RubySMB::Error::RubySMBError => e
-        raise RubySMB::Error::EncryptionError, "Error while encrypting #{packet.class.name} packet (SMB #{@dialect}): #{e}"
+    # Encrypt (if required) and send a packet.
+    #
+    # @param encrypt [Boolean] true if the packet should be encrypted, false
+    #   otherwise
+    def send_packet(packet, encrypt: false)
+      if encrypt
+        begin
+          packet = smb3_encrypt(packet.to_binary_s)
+        rescue RubySMB::Error::RubySMBError => e
+          raise RubySMB::Error::EncryptionError, "Error while encrypting #{packet.class.name} packet (SMB #{@dialect}): #{e}"
+        end
       end
-      dispatcher.send_packet(transform_request)
+      dispatcher.send_packet(packet)
     end
 
-    # Receives the raw response through the Dispatcher and decrypt the packet.
+    # Receives the raw response through the Dispatcher and decrypt the packet (if required).
     #
+    # @param encrypt [Boolean] true if the packet is encrypted, false otherwise
     # @return [String] the raw unencrypted packet
-    def recv_encrypt
+    def recv_packet(encrypt: false)
       begin
         raw_response = dispatcher.recv_packet
       rescue RubySMB::Error::CommunicationError => e
-        raise RubySMB::Error::EncryptionError, "Communication error with the "\
-          "remote host: #{e.message}. The server supports encryption but was "\
-          "not able to handle the encrypted request."
-      end
-      begin
-        transform_response = RubySMB::SMB2::Packet::TransformHeader.read(raw_response)
-      rescue IOError
-        raise RubySMB::Error::InvalidPacket, 'Not a SMB2 TransformHeader packet'
+        if encrypt
+          raise RubySMB::Error::EncryptionError, "Communication error with the "\
+            "remote host: #{e.message}. The server supports encryption but was "\
+            "not able to handle the encrypted request."
+        else
+          raise e
+        end
       end
-      begin
-        smb3_decrypt(transform_response)
-      rescue RubySMB::Error::RubySMBError => e
-        raise RubySMB::Error::EncryptionError, "Error while decrypting #{transform_response.class.name} packet (SMB #@dialect}): #{e}"
+      if encrypt
+        begin
+          transform_response = RubySMB::SMB2::Packet::TransformHeader.read(raw_response)
+        rescue IOError
+          raise RubySMB::Error::InvalidPacket, 'Not a SMB2 TransformHeader packet'
+        end
+        begin
+          raw_response = smb3_decrypt(transform_response)
+        rescue RubySMB::Error::RubySMBError => e
+          raise RubySMB::Error::EncryptionError, "Error while decrypting #{transform_response.class.name} packet (SMB #@dialect}): #{e}"
+        end
       end
+      raw_response
     end
 
     # Connects to the supplied share
@@ -551,7 +576,7 @@ module RubySMB
     # @param [String] host
     def net_share_enum_all(host)
       tree = tree_connect("\\\\#{host}\\IPC$")
-      named_pipe = tree.open_file(filename: "srvsvc", write: true, read: true)
+      named_pipe = tree.open_pipe(filename: "srvsvc", write: true, read: true)
       named_pipe.net_share_enum_all(host)
     end
 
@@ -568,6 +593,7 @@ module RubySMB
       self.smb2_message_id  = 0
       self.client_encryption_key = nil
       self.server_encryption_key = nil
+      self.server_supports_multi_credit = false
     end
 
     # Requests a NetBIOS Session Service using the provided name.
@@ -605,7 +631,7 @@ module RubySMB
       session_request.session_header.session_packet_type = RubySMB::Nbss::SESSION_REQUEST
       session_request.called_name  = called_name
       session_request.calling_name = calling_name
-      session_request.session_header.packet_length =
+      session_request.session_header.stream_protocol_length =
         session_request.num_bytes - session_request.session_header.num_bytes
       session_request
     end
@@ -621,5 +647,6 @@ module RubySMB
         @preauth_integrity_hash_value + data.to_binary_s
       )
     end
+
   end
 end

data/lib/ruby_smb/compression/lznt1.rb

@@ -0,0 +1,164 @@
+module RubySMB
+  module Compression
+    module LZNT1
+      def self.compress(buf, chunk_size: 0x1000)
+        out = ''
+        until buf.empty?
+          chunk = buf[0...chunk_size]
+          compressed = compress_chunk(chunk)
+          # chunk is compressed
+          if compressed.length < chunk.length
+            out << [0xb000 | (compressed.length - 1)].pack('v')
+            out << compressed
+          else
+            out << [0x3000 | (chunk.length - 1)].pack('v')
+            out << chunk
+          end
+          buf = buf[chunk_size..-1]
+          break if buf.nil?
+        end
+
+        out
+      end
+
+      def self.compress_chunk(chunk)
+        blob = chunk
+        out = ''
+        pow2 = 0x10
+        l_mask3 = 0x1002
+        o_shift = 12
+        until blob.empty?
+          bits = 0
+          tmp = ''
+          i = -1
+          loop do
+            i += 1
+            bits >>= 1
+            while pow2 < (chunk.length - blob.length)
+              pow2 <<= 1
+              l_mask3 = (l_mask3 >> 1) + 1
+              o_shift -= 1
+            end
+
+            max_len = [blob.length, l_mask3].min
+            offset, length = find(chunk[0...(chunk.length - blob.length)], blob, max_len)
+
+            # try to find more compressed pattern
+            _offset2, length2 = find(chunk[0...chunk.length - blob.length + 1], blob[1..-1], max_len)
+
+            length = 0 if length < length2
+
+            if length > 0
+              symbol = ((offset - 1) << o_shift) | (length - 3)
+              tmp << [symbol].pack('v')
+              # set the highest bit
+              bits |= 0x80
+              blob = blob[length..-1]
+            else
+              tmp += blob[0]
+              blob = blob[1..-1]
+            end
+
+            break if blob.empty? || i == 7
+          end
+
+          out << [bits >> (7 - i)].pack('C')
+          out << tmp
+        end
+
+        out
+      end
+
+      def self.decompress(buf, length_check: true)
+        out = ''
+        until buf.empty?
+          header = buf.unpack1('v')
+          length = (header & 0xfff) + 1
+          raise EncodingError, 'invalid chunk length' if length_check && length > (buf.length - 2)
+
+          chunk = buf[2...length + 2]
+          out << if header & 0x8000 == 0
+                   chunk
+                 else
+                   decompress_chunk(chunk)
+                 end
+          buf = buf[length + 2..-1]
+        end
+
+        out
+      end
+
+      def self.decompress_chunk(chunk)
+        out = ''
+        until chunk.empty?
+          flags = chunk[0].unpack1('C')
+          chunk = chunk[1..-1]
+          8.times do |i|
+            if (flags >> i & 1) == 0
+              out << chunk[0]
+              chunk = chunk[1..-1]
+            else
+              flag = chunk.unpack1('v')
+              pos = out.length - 1
+              l_mask = 0xfff
+              o_shift = 12
+              while pos >= 0x10
+                l_mask >>= 1
+                o_shift -= 1
+                pos >>= 1
+              end
+
+              length = (flag & l_mask) + 3
+              offset = (flag >> o_shift) + 1
+
+              if length >= offset
+                out_offset = out[-offset..-1]
+                tmp = out_offset * (0xfff / out_offset.length + 1)
+                out << tmp[0...length]
+              else
+                out << out[-offset..-offset + length - 1]
+              end
+              chunk = chunk[2..-1]
+            end
+            break if chunk.empty?
+          end
+        end
+
+        out
+      end
+
+      class << self
+        private
+
+        def find(src, target, max_len)
+          result_offset = 0
+          result_length = 0
+          1.upto(max_len - 1) do |i|
+            offset = src.rindex(target[0...i])
+            next if offset.nil?
+
+            tmp_offset = src.length - offset
+            tmp_length = i
+            if tmp_offset == tmp_length
+              src_offset = src[offset..-1]
+              tmp = src_offset * (0xfff / src_offset.length + 1)
+              i.upto(max_len) do |j|
+                offset = tmp.rindex(target[0...j])
+                break if offset.nil?
+
+                tmp_length = j
+              end
+            end
+
+            if tmp_length > result_length
+              result_offset = tmp_offset
+              result_length = tmp_length
+            end
+          end
+
+          result_length < 3 ? [0, 0] : [result_offset, result_length]
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/compression.rb

@@ -0,0 +1,7 @@
+module RubySMB
+  module Compression
+
+    require 'ruby_smb/compression/lznt1'
+
+  end
+end

data/lib/ruby_smb/dcerpc/bind.rb

@@ -2,51 +2,59 @@ module RubySMB
   module Dcerpc
     # The Bind PDU as defined in
     # [The bind PDU](http://pubs.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06_04_03)
-    class PContElemT < BinData::Record
+    class PContElemT < Ndr::NdrStruct
+      default_parameter byte_align: 4
       endian :little
 
-      uint16 :p_cont_id,     label: 'Context ID'
-      uint8 :n_transfer_syn, label: 'Number of transfer syntaxes', initial_value: 1
-      uint8 :reserved
+      ndr_uint16    :p_cont_id, label: 'Context ID'
+      ndr_uint8     :n_transfer_syn, label: 'Number of transfer syntaxes', initial_value: 1
+      ndr_uint8     :reserved
       p_syntax_id_t :abstract_syntax, label: 'Abstract syntax',
         uuid: ->      { endpoint::UUID },
         ver_major: -> { endpoint::VER_MAJOR },
         ver_minor: -> { endpoint::VER_MINOR }
-      array :transfer_syntaxes, label: 'Transfer syntax', type: :p_syntax_id_t,
+      array         :transfer_syntaxes, label: 'Transfer syntax', type: :p_syntax_id_t,
         initial_length: -> { n_transfer_syn },
         uuid: ->      { Ndr::UUID },
         ver_major: -> { Ndr::VER_MAJOR },
-        ver_minor: -> { Ndr::VER_MINOR }
+        ver_minor: -> { Ndr::VER_MINOR },
+        byte_align: 4
     end
 
-    class PContListT < BinData::Record
+    class PContListT < Ndr::NdrStruct
+      default_parameter byte_align: 4
       endian :little
 
-      uint8 :n_context_elem, label: 'Number of context elements', initial_value: -> { 1 }
-      uint8 :reserved
-      uint16 :reserved2
-      array :p_cont_elem, label: 'Presentation context elements', type: :p_cont_elem_t,
+      ndr_uint8  :n_context_elem, label: 'Number of context elements', initial_value: -> { 1 }
+      ndr_uint8  :reserved
+      ndr_uint16 :reserved2
+      array      :p_cont_elem, label: 'Presentation context elements', type: :p_cont_elem_t,
         initial_length: -> {n_context_elem},
-        endpoint: -> {endpoint}
+        endpoint: -> {endpoint},
+        byte_align: 4
     end
 
     class Bind < BinData::Record
-      endian :little
-
-      pdu_header :pdu_header,        label: 'PDU header'
+      PTYPE = PTypes::BIND
 
-      uint16 :max_xmit_frag,         label: 'max transmit frag size',    initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
-      uint16 :max_recv_frag,         label: 'max receive  frag size',    initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
-      uint32 :assoc_group_id,        label: 'ncarnation of client-server assoc group'
+      endian :little
 
+      # PDU Header
+      pdu_header    :pdu_header, label: 'PDU header'
+      ndr_uint16    :max_xmit_frag, label: 'max transmit frag size', initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
+      ndr_uint16    :max_recv_frag, label: 'max receive frag size', initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
+      ndr_uint32    :assoc_group_id, label: 'incarnation of client-server assoc group'
       p_cont_list_t :p_context_list, label: 'Presentation context list', endpoint: -> { endpoint }
-      string :auth_verifier,         label: 'Authentication verifier',
+
+      # Auth Verifier
+      sec_trailer   :sec_trailer, onlyif: -> { pdu_header.auth_length > 0 }
+      string        :auth_value,
         onlyif: -> { pdu_header.auth_length > 0 },
         read_length: -> { pdu_header.auth_length }
 
       def initialize_instance
         super
-        pdu_header.ptype = RubySMB::Dcerpc::PTypes::BIND
+        pdu_header.ptype = PTYPE
       end
     end
   end