ruby_smb 2.0.4 → 2.0.9

data/lib/ruby_smb/smb1/packet/trans2/open2_response.rb

@@ -44,8 +44,7 @@ module RubySMB
           class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
             string             :pad1,               length: -> { pad1_length }
             trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            string             :trans2_data,        label: 'Trans2 Data', length: 0
+            # trans2_data: No data is sent by this message.
           end
 
           smb_header        :smb_header

data/lib/ruby_smb/smb1/packet/trans2/set_file_information_response.rb

@@ -23,23 +23,11 @@ module RubySMB
             end
           end
 
-          # The Trans2 Data Block for this particular Subcommand
-          class Trans2Data < BinData::Record
-
-            # Returns the length of the Trans2Data struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
-          end
-
           # The {RubySMB::SMB1::DataBlock} specific to this packet type.
           class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            uint8              :name,               label: 'Name', initial_value: 0x00
             string             :pad1,               length: -> { pad1_length }
             trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            trans2_data        :trans2_data,        label: 'Trans2 Data'
+            # trans2_data: No data is sent by this message.
           end
 
           smb_header        :smb_header

data/lib/ruby_smb/smb1/pipe.rb

@@ -16,12 +16,14 @@ module RubySMB
       def initialize(tree:, response:, name:)
         raise ArgumentError, 'No Name Provided' if name.nil?
         case name
+        when 'netlogon', '\\netlogon'
+          extend RubySMB::Dcerpc::Netlogon
         when 'srvsvc', '\\srvsvc'
           extend RubySMB::Dcerpc::Srvsvc
-        when 'winreg', '\\winreg'
-          extend RubySMB::Dcerpc::Winreg
         when 'svcctl', '\\svcctl'
           extend RubySMB::Dcerpc::Svcctl
+        when 'winreg', '\\winreg'
+          extend RubySMB::Dcerpc::Winreg
         end
         super(tree: tree, response: response, name: name)
       end

data/lib/ruby_smb/smb2/packet/compression_transform_header.rb

@@ -3,6 +3,9 @@ module RubySMB
     module Packet
       # An SMB2 COMPRESSION_TRANSFORM_HEADER Packet as defined in
       # [2.2.42 SMB2 COMPRESSION_TRANSFORM_HEADER](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/1d435f21-9a21-4f4c-828e-624a176cf2a0)
+      # NOTE: On 2021-04-06 the official documentation split the definition of COMPRESSION_TRANSFORM_HEADER into the following two variants:
+      #   * SMB2_COMPRESSION_TRANSFORM_HEADER_CHAINED
+      #   * SMB2_COMPRESSION_TRANSFORM_HEADER_UNCHAINED
       class CompressionTransformHeader < BinData::Record
         endian :little
 
@@ -11,6 +14,7 @@ module RubySMB
         uint16           :compression_algorithm,            label: 'Compression Algorithm'
         uint16           :flags,                            label: 'Flags'
         uint32           :offset,                           label: 'Offset / Length'
+        array            :compressed_data,                  label: 'Compressed Data', type: :uint8, read_until: :eof
       end
 
       # An SMB2 SMB2_COMPRESSION_TRANSFORM_HEADER_PAYLOAD Packet as defined in

data/lib/ruby_smb/smb2/pipe.rb

@@ -13,12 +13,14 @@ module RubySMB
       def initialize(tree:, response:, name:)
         raise ArgumentError, 'No Name Provided' if name.nil?
         case name
-        when 'srvsvc'
+        when 'netlogon', '\\netlogon'
+          extend RubySMB::Dcerpc::Netlogon
+        when 'srvsvc', '\\srvsvc'
           extend RubySMB::Dcerpc::Srvsvc
-        when 'winreg'
-          extend RubySMB::Dcerpc::Winreg
-        when 'svcctl'
+        when 'svcctl', '\\svcctl'
           extend RubySMB::Dcerpc::Svcctl
+        when 'winreg', '\\winreg'
+          extend RubySMB::Dcerpc::Winreg
         end
         super(tree: tree, response: response, name: name)
       end

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '2.0.4'.freeze
+  VERSION = '2.0.9'.freeze
 end

data/spec/lib/ruby_smb/client_spec.rb

@@ -809,6 +809,18 @@ RSpec.describe RubySMB::Client do
       smb1_extended_response.to_binary_s
     }
 
+    let(:smb1_response) {
+      packet = RubySMB::SMB1::Packet::NegotiateResponse.new
+      smb1_capabilities_dup = smb1_capabilities.dup
+      smb1_capabilities_dup[:extended_security] = 0
+
+      packet.parameter_block.capabilities = smb1_capabilities_dup
+      packet
+    }
+    let(:smb1_response_raw) {
+      smb1_response.to_binary_s
+    }
+
     let(:smb2_response) { RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x200) }
     let(:smb3_response) { RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x300) }
 
@@ -997,10 +1009,14 @@ RSpec.describe RubySMB::Client do
 
     describe '#negotiate_response' do
       context 'with only SMB1' do
-        it 'returns a properly formed packet' do
+        it 'returns a properly formed NegotiateResponseExtended packet if extended_security is set as 1' do
           expect(smb1_client.negotiate_response(smb1_extended_response_raw)).to eq smb1_extended_response
         end
 
+        it 'returns a properly formed NegotiateResponse packet if extended_security is set as 0' do
+          expect(smb1_client.negotiate_response(smb1_response_raw)).to eq smb1_response
+        end
+
         it 'raises an exception if the response is not a SMB packet' do
           expect { smb1_client.negotiate_response(random_junk) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
@@ -1015,12 +1031,6 @@ RSpec.describe RubySMB::Client do
           bogus_response.smb_header.command = 0xff
           expect { smb1_client.negotiate_response(bogus_response.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
         end
-
-        it 'considers the response invalid if Extended Security is not enabled' do
-          bogus_response = smb1_extended_response
-          bogus_response.parameter_block.capabilities.extended_security = 0
-          expect { smb1_client.negotiate_response(bogus_response.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
-        end
       end
 
       context 'with only SMB2' do

data/spec/lib/ruby_smb/compression/lznt1_spec.rb

@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+RSpec.describe RubySMB::Compression::LZNT1 do
+  describe '.compress' do
+    it 'generates an empty blob when provided an empty blob' do
+      expected = "".b
+      expect(described_class.compress('')).to eq(expected)
+    end
+
+    it 'generates a compressed blob when provided a string with non-reoccurring characters' do
+      expect(described_class.compress('RubySMB')).to eq("\x060RubySMB".b)
+    end
+
+    it 'generates a compressed blob when provided a string of reoccurring characters' do
+      expect(described_class.compress("\x01" * 0x200)).to eq("\x03\xB0\x02\x01\xFC\x01".b)
+    end
+  end
+
+  describe '.decompress' do
+    it 'generates a decompressed blob for a string with non-reoccurring characters' do
+      expect(described_class.decompress("\x060RubySMB".b)).to eq('RubySMB')
+    end
+
+    it 'generates a decompressed blob for a string of reoccurring characters' do
+      expect(described_class.decompress("\x03\xB0\x02\x01\xFC\x01".b)).to eq("\x01" * 0x200)
+    end
+
+    it 'raises an EncodingError when the length is invalid' do
+      expect { described_class.decompress("\x010".b) }.to raise_error(EncodingError)
+    end
+  end
+end

data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_request_spec.rb

@@ -0,0 +1,69 @@
+RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerAuthenticate3Request do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :primary_name }
+  it { is_expected.to respond_to :account_name }
+  it { is_expected.to respond_to :secure_channel_type }
+  it { is_expected.to respond_to :computer_name }
+  it { is_expected.to respond_to :client_credential }
+  it { is_expected.to respond_to :flags }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#primary_name' do
+    it 'is a LogonsrvHandle structure' do
+      expect(packet.primary_name).to be_a RubySMB::Dcerpc::Netlogon::LogonsrvHandle
+    end
+  end
+
+  describe '#account_name' do
+    it 'is a NdrString structure' do
+      expect(packet.account_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
+    end
+  end
+
+  describe '#secure_channel_type' do
+    it 'is a NetlogonSecureChannelType enum' do
+      expect(packet.secure_channel_type).to be_a RubySMB::Dcerpc::Netlogon::NetlogonSecureChannelType
+    end
+  end
+
+  describe '#computer_name' do
+    it 'is a NdrString structure' do
+      expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
+    end
+  end
+
+  describe '#client_credential' do
+    it 'is a NetlogonCredential structure' do
+      expect(packet.client_credential).to be_a RubySMB::Dcerpc::Netlogon::NetlogonCredential
+    end
+  end
+
+  describe '#flags' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.flags).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to NETR_SERVER_AUTHENTICATE3 constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Netlogon::NETR_SERVER_AUTHENTICATE3)
+    end
+  end
+
+  it 'reads its own binary representation and outputs the same packet' do
+    packet = described_class.new(
+      primary_name: 'primary_name',
+      account_name: 'account_name',
+      secure_channel_type: 0,
+      computer_name: 'computer_name',
+      client_credential: "\x00" * 8,
+      flags: rand(0xffffffff)
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+end

data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_response_spec.rb

@@ -0,0 +1,53 @@
+RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerAuthenticate3Response do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :server_credential }
+  it { is_expected.to respond_to :negotiate_flags }
+  it { is_expected.to respond_to :account_rid }
+  it { is_expected.to respond_to :error_status }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#server_credential' do
+    it 'is a NetlogonCredential structure' do
+      expect(packet.server_credential).to be_a RubySMB::Dcerpc::Netlogon::NetlogonCredential
+    end
+  end
+
+  describe '#negotiate_flags' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.negotiate_flags).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#account_rid' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.account_rid).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#error_status' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.error_status).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to NETR_SERVER_AUTHENTICATE3 constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Netlogon::NETR_SERVER_AUTHENTICATE3)
+    end
+  end
+
+  it 'reads its own binary representation and outputs the same packet' do
+    packet = described_class.new(
+      server_credential: "\x00" * 8,
+      negotiate_flags: rand(0xffffffff),
+      account_rid: rand(0xffffffff),
+      error_status: rand(0xffffffff)
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+end

data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_password_set2_request_spec.rb

@@ -0,0 +1,69 @@
+RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerPasswordSet2Request do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :primary_name }
+  it { is_expected.to respond_to :account_name }
+  it { is_expected.to respond_to :secure_channel_type }
+  it { is_expected.to respond_to :computer_name }
+  it { is_expected.to respond_to :authenticator }
+  it { is_expected.to respond_to :clear_new_password }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#primary_name' do
+    it 'is a LogonsrvHandle structure' do
+      expect(packet.primary_name).to be_a RubySMB::Dcerpc::Netlogon::LogonsrvHandle
+    end
+  end
+
+  describe '#account_name' do
+    it 'is a NdrString structure' do
+      expect(packet.account_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
+    end
+  end
+
+  describe '#secure_channel_type' do
+    it 'is a NetlogonSecureChannelType enum' do
+      expect(packet.secure_channel_type).to be_a RubySMB::Dcerpc::Netlogon::NetlogonSecureChannelType
+    end
+  end
+
+  describe '#computer_name' do
+    it 'is a NdrString structure' do
+      expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
+    end
+  end
+
+  describe '#authenticator' do
+    it 'is a NetlogonAuthenticator structure' do
+      expect(packet.authenticator).to be_a RubySMB::Dcerpc::Netlogon::NetlogonAuthenticator
+    end
+  end
+
+  describe '#clear_new_password' do
+    it 'is a NdrFixedByteArray structure' do
+      expect(packet.clear_new_password).to be_a RubySMB::Dcerpc::Ndr::NdrFixedByteArray
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to NETR_SERVER_PASSWORD_SET2 constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Netlogon::NETR_SERVER_PASSWORD_SET2)
+    end
+  end
+
+  it 'reads its own binary representation and outputs the same packet' do
+    packet = described_class.new(
+      primary_name: 'primary_name',
+      account_name: 'account_name',
+      secure_channel_type: 0,
+      computer_name: 'computer_name',
+      authenticator: RubySMB::Dcerpc::Netlogon::NetlogonAuthenticator.new,
+      clear_new_password: "\x00" * 516
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+end

data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_password_set2_response_spec.rb

@@ -0,0 +1,37 @@
+RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerPasswordSet2Response do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :return_authenticator }
+  it { is_expected.to respond_to :error_status }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#return_authenticator' do
+    it 'is a NetlogonAuthenticator structure' do
+      expect(packet.return_authenticator).to be_a RubySMB::Dcerpc::Netlogon::NetlogonAuthenticator
+    end
+  end
+
+  describe '#error_status' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.error_status).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to NETR_SERVER_PASSWORD_SET2 constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Netlogon::NETR_SERVER_PASSWORD_SET2)
+    end
+  end
+
+  it 'reads its own binary representation and outputs the same packet' do
+    packet = described_class.new(
+      return_authenticator: RubySMB::Dcerpc::Netlogon::NetlogonAuthenticator.new,
+      error_status: rand(0xffffffff)
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+end

data/spec/lib/ruby_smb/dcerpc/netlogon/netr_server_req_challenge_request_spec.rb

@@ -0,0 +1,45 @@
+RSpec.describe RubySMB::Dcerpc::Netlogon::NetrServerReqChallengeRequest do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :primary_name }
+  it { is_expected.to respond_to :computer_name }
+  it { is_expected.to respond_to :client_challenge }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#primary_name' do
+    it 'is a LogonsrvHandle structure' do
+      expect(packet.primary_name).to be_a RubySMB::Dcerpc::Netlogon::LogonsrvHandle
+    end
+  end
+
+  describe '#computer_name' do
+    it 'is a NdrString structure' do
+      expect(packet.computer_name).to be_a RubySMB::Dcerpc::Ndr::NdrString
+    end
+  end
+
+  describe '#client_challenge' do
+    it 'is a NetlogonCredential structure' do
+      expect(packet.client_challenge).to be_a RubySMB::Dcerpc::Netlogon::NetlogonCredential
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to NETR_SERVER_REQ_CHALLENGE constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Netlogon::NETR_SERVER_REQ_CHALLENGE)
+    end
+  end
+
+  it 'reads its own binary representation and outputs the same packet' do
+    packet = described_class.new(
+      primary_name: 'primary_name',
+      computer_name: 'computer_name',
+      client_challenge: "\x00" * 8,
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+end