ruby_smb 3.2.0 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ce8d4ea99335efaf6bbc1ef003231ffa8a809382760e54dc26be04b76e53529
-  data.tar.gz: f284dabf7fe032ae02933a517abb2371f7c7c37eb641876f1cbf2b8cc0e4c2ac
+  metadata.gz: 2f696c845250348795f67d3d5b163c65b432acdbcd01bc86d0a6cd81ddcbfc67
+  data.tar.gz: b43dcb4fa6ff4497e61329b8b5a17049a6b445fcdf5c3df61dc380960ea02b9c
 SHA512:
-  metadata.gz: 5cf115ffd4c634f593bceef2bb503d2c0a2b19c5cfa73391887d35ce2691472fabda03e47462b716f8c870d7dedbc5dc815f644887b259d1268658752396ea17
-  data.tar.gz: 46ba6053ca246692ef29c545c8a9682b6675c4bf50d10d3611107bf537470226986aeece854516d59d99afa1642ee2d72fed99f39c1731112292fcbb6d8138d2
+  metadata.gz: 8368cf1844e47161a57051d7b8dfa807b665c898153636b1baedb2211acd4685ef67c5ba167581ce84a9ec7c8c17e812d1f876bb70f34b647bb075bb94861349
+  data.tar.gz: 3b33a185fb3b981147b005e13793aa1f8a09e11c2e5e0dc9b75469ef980ec019bc2dd5e9bef187910f9b5be012d7ca710799b45aa0bdf79547ae3d48de8e22e7

data/.github/workflows/verify.yml

@@ -33,17 +33,16 @@ jobs:
       fail-fast: true
       matrix:
         ruby:
-          - 2.6
-          - 2.7
-          - 3.0
-          - 3.1
+          - '2.7'
+          - '3.0'
+          - '3.1'
+          - '3.2'
         os:
-          - ubuntu-18.04
-          - ubuntu-22.04
+          - ubuntu-20.04
+          - ubuntu-latest
         exclude:
-          - { os: ubuntu-22.04, ruby: 2.6 }
-          - { os: ubuntu-22.04, ruby: 2.7 }
-          - { os: ubuntu-22.04, ruby: 3.0 }
+          - { os: ubuntu-latest, ruby: '2.7' }
+          - { os: ubuntu-latest, ruby: '3.0' }
         test_cmd:
           - bundle exec rspec
 

data/README.md

@@ -184,6 +184,7 @@ Example:
 2.3.3 :013 > packet.to_binary_s
  => "\xFFSMB+\x00\x00\x00\x00\x98\x01`\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00"
 ```
+
 ### Using the Client
 
 Sitting on top of the packet layer in RubySMB is the RubySMB::Client class. This is the abstraction that most users of RubySMB will interact with. It provides simple convenience methods for performing SMB actions. It handles the creation, sending and receiving of packets for the user, providing reasonable defaults in many cases.

data/cortex.yaml

@@ -0,0 +1,15 @@
+---
+info:
+  title: Ruby Smb
+  description: A native Ruby implementation of the SMB Protocol Family
+  x-cortex-git:
+    github:
+      alias: r7org
+      repository: rapid7/ruby_smb
+  x-cortex-tag: ruby-smb
+  x-cortex-type: service
+  x-cortex-domain-parents:
+  - tag: metasploit
+openapi: 3.0.1
+servers:
+- url: "/"

data/examples/dump_secrets_from_sid.rb

@@ -26,6 +26,7 @@ client = RubySMB::Dcerpc::Client.new(
 client.connect
 puts('Binding to DRSR...')
 client.bind(
+  endpoint: RubySMB::Dcerpc::Drsr,
   auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
   auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
 )
@@ -59,7 +60,7 @@ dc_infos.each do |dc_info|
     puts "Decrypting hash for user: #{dn}"
 
     entinf_struct = user_record.pmsg_out.msg_getchg.p_objects.entinf
-    object_sid = rid = entinf_struct.p_name.sid[-4..-1].unpack('<L').first
+    object_sid = rid = entinf_struct.p_name.sid[-4..-1].unpack('L<').first
     lm_hash = Net::NTLM.lm_hash('')
     nt_hash = Net::NTLM.ntlm_hash('')
     disabled = nil

data/lib/ruby_smb/client.rb

@@ -4,6 +4,7 @@ module RubySMB
   class Client
     require 'ruby_smb/ntlm'
     require 'ruby_smb/signing'
+    require 'ruby_smb/utils'
     require 'ruby_smb/client/negotiation'
     require 'ruby_smb/client/authentication'
     require 'ruby_smb/client/tree_connect'
@@ -13,6 +14,7 @@ module RubySMB
     require 'ruby_smb/client/encryption'
 
     include RubySMB::Signing
+    include RubySMB::NTLM
     include RubySMB::Client::Negotiation
     include RubySMB::Client::Authentication
     include RubySMB::Client::TreeConnect
@@ -322,7 +324,7 @@ module RubySMB
       @pid               = rand(0xFFFF)
       @domain            = domain
       @local_workstation = local_workstation
-      @password          = password.encode('utf-8') || ''.encode('utf-8')
+      @password          = RubySMB::Utils.safe_encode((password||''), 'utf-8')
       @sequence_counter  = 0
       @session_id        = 0x00
       @session_key       = ''
@@ -332,7 +334,7 @@ module RubySMB
       @smb1              = smb1
       @smb2              = smb2
       @smb3              = smb3
-      @username          = username.encode('utf-8') || ''.encode('utf-8')
+      @username          = RubySMB::Utils.safe_encode((username||''), 'utf-8')
       @max_buffer_size   = MAX_BUFFER_SIZE
       # These sizes will be modified during negotiation
       @server_max_buffer_size = SERVER_MAX_BUFFER_SIZE
@@ -415,8 +417,8 @@ module RubySMB
                       local_workstation: self.local_workstation, ntlm_flags: NTLM::DEFAULT_CLIENT_FLAGS)
       @domain            = domain
       @local_workstation = local_workstation
-      @password          = pass.encode('utf-8') || ''.encode('utf-8')
-      @username          = user.encode('utf-8') || ''.encode('utf-8')
+      @password          = RubySMB::Utils.safe_encode((pass||''), 'utf-8')
+      @username          = RubySMB::Utils.safe_encode((user||''), 'utf-8')
 
       @ntlm_client = RubySMB::NTLM::Client.new(
           @username,

data/lib/ruby_smb/dcerpc/alter_context.rb

@@ -0,0 +1,30 @@
+module RubySMB
+  module Dcerpc
+    # The Alter context PDU as defined in
+    # [The alter_context PDU](https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06_04_01)
+    class AlterContext < BinData::Record
+      PTYPE = PTypes::ALTER_CONTEXT
+
+      endian :little
+
+      # PDU Header
+      pdu_header    :pdu_header, label: 'PDU header'
+      ndr_uint16    :max_xmit_frag, label: 'Max transmit frag size', initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
+      ndr_uint16    :max_recv_frag, label: 'Max receive frag size', initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
+      ndr_uint32    :assoc_group_id, label: 'Incarnation of client-server assoc group'
+      p_cont_list_t :p_context_list, label: 'Presentation context list', endpoint: -> { endpoint }
+
+      # Auth Verifier
+      sec_trailer   :sec_trailer, onlyif: -> { pdu_header.auth_length > 0 }
+      string        :auth_value,
+        onlyif: -> { pdu_header.auth_length > 0 },
+        read_length: -> { pdu_header.auth_length }
+
+      def initialize_instance
+        super
+        pdu_header.ptype = PTYPE
+      end
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/alter_context_resp.rb

@@ -0,0 +1,42 @@
+module RubySMB
+  module Dcerpc
+    # The Alter context resp PDU as defined in
+    # [The alter_context_resp PDU](https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06_04_02)
+
+    class AlterContextResp < BinData::Record
+      PTYPE = PTypes::ALTER_CONTEXT_RESP
+
+      # Presentation context negotiation results
+      ACCEPTANCE         = 0
+      USER_REJECTION     = 1
+      PROVIDER_REJECTION = 2
+
+      # Reasons for rejection of a context element
+      REASON_NOT_SPECIFIED                     = 0
+      ABSTRACT_SYNTAX_NOT_SUPPORTED            = 1
+      PROPOSED_TRANSFER_SYNTAXES_NOT_SUPPORTED = 2
+      LOCAL_LIMIT_EXCEEDED                     = 3
+
+      endian :little
+
+      # PDU Header
+      pdu_header      :pdu_header, label: 'PDU header'
+      ndr_uint16      :max_xmit_frag, label: 'Max transmit frag size', initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
+      ndr_uint16      :max_recv_frag, label: 'Max receive frag size', initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
+      ndr_uint32      :assoc_group_id, label: 'Association group ID'
+      port_any_t      :sec_addr, label: 'Secondary address'
+      p_result_list_t :p_result_list, label: 'Presentation context result list'
+
+      # Auth Verifier
+      sec_trailer     :sec_trailer, onlyif: -> { pdu_header.auth_length > 0 }
+      string          :auth_value,
+        onlyif: -> { pdu_header.auth_length > 0 },
+        read_length: -> { pdu_header.auth_length }
+
+      def initialize_instance
+        super
+        pdu_header.ptype = PTYPE
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/bind.rb

@@ -2,38 +2,6 @@ module RubySMB
   module Dcerpc
     # The Bind PDU as defined in
     # [The bind PDU](http://pubs.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06_04_03)
-    class PContElemT < Ndr::NdrStruct
-      default_parameter byte_align: 4
-      endian :little
-
-      ndr_uint16    :p_cont_id, label: 'Context ID'
-      ndr_uint8     :n_transfer_syn, label: 'Number of transfer syntaxes', initial_value: 1
-      ndr_uint8     :reserved
-      p_syntax_id_t :abstract_syntax, label: 'Abstract syntax',
-        uuid: ->      { endpoint::UUID },
-        ver_major: -> { endpoint::VER_MAJOR },
-        ver_minor: -> { endpoint::VER_MINOR }
-      array         :transfer_syntaxes, label: 'Transfer syntax', type: :p_syntax_id_t,
-        initial_length: -> { n_transfer_syn },
-        uuid: ->      { Ndr::UUID },
-        ver_major: -> { Ndr::VER_MAJOR },
-        ver_minor: -> { Ndr::VER_MINOR },
-        byte_align: 4
-    end
-
-    class PContListT < Ndr::NdrStruct
-      default_parameter byte_align: 4
-      endian :little
-
-      ndr_uint8  :n_context_elem, label: 'Number of context elements', initial_value: -> { 1 }
-      ndr_uint8  :reserved
-      ndr_uint16 :reserved2
-      array      :p_cont_elem, label: 'Presentation context elements', type: :p_cont_elem_t,
-        initial_length: -> {n_context_elem},
-        endpoint: -> {endpoint},
-        byte_align: 4
-    end
-
     class Bind < BinData::Record
       PTYPE = PTypes::BIND
 
@@ -41,9 +9,9 @@ module RubySMB
 
       # PDU Header
       pdu_header    :pdu_header, label: 'PDU header'
-      ndr_uint16    :max_xmit_frag, label: 'max transmit frag size', initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
-      ndr_uint16    :max_recv_frag, label: 'max receive frag size', initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
-      ndr_uint32    :assoc_group_id, label: 'incarnation of client-server assoc group'
+      ndr_uint16    :max_xmit_frag, label: 'Max transmit frag size', initial_value: RubySMB::Dcerpc::MAX_XMIT_FRAG
+      ndr_uint16    :max_recv_frag, label: 'Max receive frag size', initial_value: RubySMB::Dcerpc::MAX_RECV_FRAG
+      ndr_uint32    :assoc_group_id, label: 'Incarnation of client-server assoc group'
       p_cont_list_t :p_context_list, label: 'Presentation context list', endpoint: -> { endpoint }
 
       # Auth Verifier

data/lib/ruby_smb/dcerpc/bind_ack.rb

@@ -2,37 +2,6 @@ module RubySMB
   module Dcerpc
     # The Bind ACK PDU as defined in
     # [The bind_ack PDU](http://pubs.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06_04_04)
-
-    class PResultT < Ndr::NdrStruct
-      default_parameter byte_align: 4
-      endian :little
-
-      ndr_uint16        :result,          label: 'Presentation context negotiation results'
-      ndr_uint16        :reason,          label: 'Rejection reason'
-      p_syntax_id_t     :transfer_syntax, label: 'Presentation syntax ID',
-        uuid:      -> { Ndr::UUID },
-        ver_major: -> { Ndr::VER_MAJOR },
-        ver_minor: -> { Ndr::VER_MINOR }
-    end
-
-    class PResultListT < Ndr::NdrStruct
-      default_parameter byte_align: 4
-      endian :little
-
-      ndr_uint8  :n_results, label: 'Number of results', initial_value: -> { p_results.size }
-      ndr_uint8  :reserved
-      ndr_uint16 :reserved2
-      array      :p_results, label: 'Results', type: :p_result_t, initial_length: -> { n_results }, byte_align: 4
-    end
-
-    class PortAnyT < Ndr::NdrStruct
-      default_parameter byte_align: 2
-      endian :little
-
-      ndr_uint16  :str_length, label: 'Length', initial_value: -> { port_spec.to_binary_s.size }
-      stringz     :port_spec, label: 'Port string spec', byte_align: 2
-    end
-
     class BindAck < BinData::Record
       PTYPE = PTypes::BIND_ACK
 

data/lib/ruby_smb/dcerpc/client.rb

@@ -5,14 +5,16 @@ module RubySMB
     class Client
       require 'bindata'
       require 'windows_error'
-      require 'net/ntlm'
+      require 'ruby_smb/ntlm'
       require 'ruby_smb/dcerpc'
       require 'ruby_smb/gss'
       require 'ruby_smb/peer_info'
+      require 'ruby_smb/utils'
 
       include Dcerpc
       include Epm
       include PeerInfo
+      include Utils
 
       # The default maximum size of a RPC message that the Client accepts (in bytes)
       MAX_BUFFER_SIZE = 64512
@@ -118,15 +120,15 @@ module RubySMB
         @read_timeout      = read_timeout
         @domain            = domain
         @local_workstation = local_workstation
-        @username          = username.encode('utf-8')
-        @password          = password.encode('utf-8')
+        @username          = RubySMB::Utils.safe_encode(username, 'utf-8')
+        @password          = RubySMB::Utils.safe_encode(password, 'utf-8')
         @max_buffer_size   = MAX_BUFFER_SIZE
         @call_id           = 1
         @ctx_id            = 0
         @auth_ctx_id_base  = rand(0xFFFFFFFF)
 
         unless username.empty? && password.empty?
-          @ntlm_client = Net::NTLM::Client.new(
+          @ntlm_client = RubySMB::NTLM::Client.new(
             @username,
             @password,
             workstation: @local_workstation,
@@ -207,6 +209,10 @@ module RubySMB
         if auth_level &&
            [RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY].include?(auth_level)
           set_integrity_privacy(dcerpc_req, auth_level: auth_level, auth_type: auth_type)
+          # Per the spec (MS_RPCE 2.2.2.11): start of the trailer should be a multiple of 16 bytes offset from the start of the stub
+          valid_offset = (((dcerpc_req.sec_trailer.abs_offset - dcerpc_req.stub.abs_offset) % 16))
+          valid_auth_pad = (dcerpc_req.sec_trailer.auth_pad_length == dcerpc_req.auth_pad.length)
+          raise Error::InvalidPacket unless valid_offset == 0 && valid_auth_pad
         end
 
         send_packet(dcerpc_req)

data/lib/ruby_smb/dcerpc/drsr.rb

@@ -613,8 +613,8 @@ module RubySMB
         drs_bind_request = DrsBindRequest.new(pext_client: drs_extensions_int)
         response = dcerpc_request(
           drs_bind_request,
-          auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-          auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+          auth_level: @auth_level,
+          auth_type: @auth_type
         )
         begin
           drs_bind_response = DrsBindResponse.read(response)
@@ -640,8 +640,8 @@ module RubySMB
           drs_bind_request.pext_client.assign(drs_extensions_int)
           response = dcerpc_request(
             drs_bind_request,
-            auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-            auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+            auth_level: @auth_level,
+            auth_type: @auth_type
           )
           begin
             drs_bind_response = DrsBindResponse.read(response)
@@ -668,8 +668,8 @@ module RubySMB
         drs_unbind_request = DrsUnbindRequest.new(ph_drs: ph_drs)
         response = dcerpc_request(
           drs_unbind_request,
-          auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-          auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+            auth_level: @auth_level,
+            auth_type: @auth_type
         )
         begin
           drs_unbind_response = DrsUnbindResponse.read(response)
@@ -709,8 +709,8 @@ module RubySMB
         )
         response = dcerpc_request(
           drs_domain_controller_info_request,
-          auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-          auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+          auth_level: @auth_level,
+          auth_type: @auth_type
         )
         begin
           drs_domain_controller_info_response = DrsDomainControllerInfoResponse.read(response)
@@ -759,8 +759,8 @@ module RubySMB
         )
         response = dcerpc_request(
           drs_crack_names_request,
-          auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-          auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+          auth_level: @auth_level,
+          auth_type: @auth_type
         )
         begin
           drs_crack_names_response = DrsCrackNamesResponse.read(response)
@@ -790,8 +790,8 @@ module RubySMB
         unless @session_key
           raise RubySMB::Error::EncryptionError, 'Unable to decrypt attribute value: session key is empty'
         end
-        encrypted_payload = EncryptedPayload.read(attribute)
 
+        encrypted_payload = EncryptedPayload.read(attribute)
         signature = OpenSSL::Digest::MD5.digest(@session_key + encrypted_payload.salt.to_binary_s)
         rc4 = OpenSSL::Cipher.new('rc4')
         rc4.decrypt
@@ -886,8 +886,8 @@ module RubySMB
 
         response = dcerpc_request(
           drs_get_nc_changes_request,
-          auth_level: RubySMB::Dcerpc::RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-          auth_type: RubySMB::Dcerpc::RPC_C_AUTHN_WINNT
+          auth_level: @auth_level,
+          auth_type: @auth_type
         )
         begin
           drs_get_nc_changes_response = DrsGetNcChangesResponse.read(response)

data/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_request.rb

@@ -0,0 +1,22 @@
+module RubySMB
+  module Dcerpc
+    module EncryptingFileSystem
+
+      # [3.1.4.2.6 Receiving an EfsRpcDecryptFileSrv Message (Opnum 5)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/043715de-caee-402a-a61b-921743337e78)
+      class EfsRpcDecryptFileSrvRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_conf_var_wide_stringz :file_name
+        ndr_uint32                :open_flag
+
+        def initialize_instance
+          super
+          @opnum = EFS_RPC_DECRYPT_FILE_SRV
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_response.rb

@@ -0,0 +1,21 @@
+module RubySMB
+  module Dcerpc
+    module EncryptingFileSystem
+
+      # [3.1.4.2.6 Receiving an EfsRpcDecryptFileSrv Message (Opnum 5)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/043715de-caee-402a-a61b-921743337e78)
+      class EfsRpcDecryptFileSrvResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_uint32         :error_status
+
+        def initialize_instance
+          super
+          @opnum = EFS_RPC_DECRYPT_FILE_SRV
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_request.rb

@@ -0,0 +1,20 @@
+module RubySMB
+  module Dcerpc
+    module EncryptingFileSystem
+
+      # [3.1.4.2.8 Receiving an EfsRpcQueryRecoveryAgents Message (Opnum 7)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/cf759c00-1b90-4c33-9ace-f51c20149cea)
+      class EfsRpcQueryRecoveryAgentsRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_conf_var_wide_stringz :file_name
+
+        def initialize_instance
+          super
+          @opnum = EFS_RPC_QUERY_RECOVERY_AGENTS
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_response.rb

@@ -0,0 +1,21 @@
+module RubySMB
+  module Dcerpc
+    module EncryptingFileSystem
+
+      # [3.1.4.2.8 Receiving an EfsRpcQueryRecoveryAgents Message (Opnum 7)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/cf759c00-1b90-4c33-9ace-f51c20149cea)
+      class EfsRpcQueryRecoveryAgentsResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        encryption_certificate_hash_list_ptr :recover_agents
+        ndr_uint32                           :error_status
+
+        def initialize_instance
+          super
+          @opnum = EFS_RPC_QUERY_RECOVERY_AGENTS
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_request.rb

@@ -0,0 +1,20 @@
+module RubySMB
+  module Dcerpc
+    module EncryptingFileSystem
+
+      # [3.1.4.2.7 Receiving an EfsRpcQueryUsersOnFile Message (Opnum 6)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/a058dc6c-bb7e-491c-9143-a5cb1f7e7cea)
+      class EfsRpcQueryUsersOnFileRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_conf_var_wide_stringz :file_name
+
+        def initialize_instance
+          super
+          @opnum = EFS_RPC_QUERY_USERS_ON_FILE
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_response.rb

@@ -0,0 +1,21 @@
+module RubySMB
+  module Dcerpc
+    module EncryptingFileSystem
+
+      # [3.1.4.2.7 Receiving an EfsRpcQueryUsersOnFile Message (Opnum 6)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/a058dc6c-bb7e-491c-9143-a5cb1f7e7cea)
+      class EfsRpcQueryUsersOnFileResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        encryption_certificate_hash_list_ptr :users
+        ndr_uint32                           :error_status
+
+        def initialize_instance
+          super
+          @opnum = EFS_RPC_QUERY_USERS_ON_FILE
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/encrypting_file_system.rb

@@ -35,10 +35,62 @@ module RubySMB
       OVERWRITE_HIDDEN = 0x00000004
       EFS_DROP_ALTERNATE_STREAMS = 0x00000010
 
+      # [2.2.7 EFS_HASH_BLOB](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/242d857f-ac8e-4cc8-b5e4-9314a942f45e)
+      class EfsHashBlob < Ndr::NdrStruct
+        endian :little
+        default_parameter byte_align: 4
+
+        ndr_uint32   :cb_data
+        ndr_byte_conf_array_ptr :b_data
+      end
+
+      class EfsHashBlobPtr < EfsHashBlob
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.10 ENCRYPTION_CERTIFICATE_HASH](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/3a7e7151-edcb-4b32-a119-35cdce1584c0)
+      class EncryptionCertificateHash < Ndr::NdrStruct
+        endian :little
+        default_parameter byte_align: 4
+
+        ndr_uint32                :cb_total_length
+        prpc_sid                  :user_sid
+        efs_hash_blob_ptr         :certificate_hash
+        ndr_wide_stringz_ptr      :lp_display_information
+      end
+
+      class EncryptionCertificateHashPtr < EncryptionCertificateHash
+        extend Ndr::PointerClassPlugin
+      end
+
+      class EncryptionCertificateHashPtrArrayPtr < Ndr::NdrConfArray
+        default_parameter type: :encryption_certificate_hash_ptr
+        extend Ndr::PointerClassPlugin
+      end
+
+      # [2.2.11 ENCRYPTION_CERTIFICATE_HASH_LIST](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/2718804c-6ab9-45fd-98cf-541bc3b6bc75)
+      class EncryptionCertificateHashList < BinData::Record
+        endian :little
+        default_parameter byte_align: 4
+
+        uint32                                    :ncert_hash
+        encryption_certificate_hash_ptr_array_ptr :users
+      end
+
+      class EncryptionCertificateHashListPtr < EncryptionCertificateHashList
+        extend Ndr::PointerClassPlugin
+      end
+
+      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_request'
+      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_response'
       require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request'
       require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response'
       require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request'
       require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response'
+      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_request'
+      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_response'
+      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_request'
+      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_response'
     end
   end
 end

data/lib/ruby_smb/dcerpc/icpr.rb

@@ -35,7 +35,7 @@ module RubySMB
       def cert_server_request(attributes:, authority:, csr:)
         cert_server_request_request = CertServerRequestRequest.new(
           pwsz_authority: authority,
-          pctb_attribs: { pb: (attributes.map { |k,v| "#{k}:#{v}" }.join("\n").encode('UTF-16le').force_encoding('ASCII-8bit') + "\x00\x00".b) },
+          pctb_attribs: { pb: (RubySMB::Utils.safe_encode(attributes.map { |k,v| "#{k}:#{v}" }.join("\n"), 'UTF-16le').force_encoding('ASCII-8bit') + "\x00\x00".b) },
           pctb_request: { pb: csr.to_der }
         )
 
@@ -51,6 +51,7 @@ module RubySMB
         end
 
         ret = {
+          certificate: nil,
           disposition: cert_server_request_response.pdw_disposition.value,
           disposition_message: cert_server_request_response.pctb_disposition_message.buffer.chomp("\x00\x00").force_encoding('utf-16le').encode,
           status: {
@@ -72,7 +73,7 @@ module RubySMB
               status_code: status_code
             )
           end
-        else
+        elsif !cert_server_request_response.pctb_encoded_cert.buffer.empty?
           ret[:certificate] = OpenSSL::X509::Certificate.new(cert_server_request_response.pctb_encoded_cert.buffer)
         end