ruby_smb 3.2.0 → 3.3.0

data/lib/ruby_smb/dcerpc/ndr.rb

@@ -247,12 +247,22 @@ module RubySMB::Dcerpc::Ndr
 
     def do_read(io)
       if is_a?(ConfPlugin) && should_process_max_count?
-        set_max_count(io.readbytes(4).unpack('L<').first)
+        max_count = io.readbytes(4).unpack1('L<')
+        BinData.trace_message do |tracer|
+          tracer.trace_obj("#{debug_name}.max_count", max_count.to_s)
+        end
+        set_max_count(max_count)
       end
 
       if is_a?(VarPlugin)
         @offset = io.readbytes(4).unpack('L<').first
+        BinData.trace_message do |tracer|
+          tracer.trace_obj("#{debug_name}.offset", @offset.to_s)
+        end
         @actual_count = @read_until_index = io.readbytes(4).unpack('L<').first
+        BinData.trace_message do |tracer|
+          tracer.trace_obj("#{debug_name}.actual_count", @actual_count.to_s)
+        end
       end
 
       if has_elements_to_read?
@@ -523,7 +533,11 @@ module RubySMB::Dcerpc::Ndr
 
     def do_read(io)
       if should_process_max_count?
-        set_max_count(io.readbytes(4).unpack('L<').first)
+        max_count = io.readbytes(4).unpack1('L<')
+        BinData.trace_message do |tracer|
+          tracer.trace_obj("#{debug_name}.max_count", max_count.to_s)
+        end
+        set_max_count(max_count)
       end
       super
     end
@@ -582,7 +596,13 @@ module RubySMB::Dcerpc::Ndr
 
     def do_read(io)
       @offset = io.readbytes(4).unpack('L<').first
+       BinData.trace_message do |tracer|
+        tracer.trace_obj("#{debug_name}.offset", @offset.to_s)
+      end
       @actual_count = io.readbytes(4).unpack('L<').first
+      BinData.trace_message do |tracer|
+        tracer.trace_obj("#{debug_name}.actual_count", @actual_count.to_s)
+      end
       super if @actual_count > 0
     end
 
@@ -702,7 +722,11 @@ module RubySMB::Dcerpc::Ndr
 
     def do_read(io)
       if should_process_max_count?
-        set_max_count(io.readbytes(4).unpack('L<').first)
+        max_count = io.readbytes(4).unpack1('L<')
+        BinData.trace_message do |tracer|
+          tracer.trace_obj("#{debug_name}.max_count", max_count.to_s)
+        end
+        set_max_count(max_count)
 
         # Align the structure according to the alignment rules for the structure
         if respond_to?(:referent_bytes_align)
@@ -1034,6 +1058,9 @@ module RubySMB::Dcerpc::Ndr
         end
       else
         @ref_id = io.readbytes(4).unpack('L<').first
+        BinData.trace_message do |tracer|
+          tracer.trace_obj("#{debug_name}.ref_id", @ref_id.to_s)
+        end
         parent_obj = nil
         if parent&.is_a?(ConstructedTypePlugin)
           parent_obj = parent.get_top_level_constructed_type
@@ -1288,5 +1315,123 @@ module RubySMB::Dcerpc::Ndr
     end
   end
 
+  # (IDL/NDR) Pickles as defined in
+  # [(IDL/NDR) # Pickles](https://pubs.opengroup.org/onlinepubs/9668899/chap2.htm#tagcjh_05_01_07)
+  # and
+  # [2.2.6 Type Serialization Version # 1](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/9a1d0f97-eac0-49ab-a197-f1a581c2d6a0)
+
+  # [2.2.6.1 Common Type Header for the Serialization Stream](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/6d75d40e-e2d2-4420-b9e9-8508a726a9ae)
+  class TypeSerialization1CommonTypeHeader < BinData::Record
+    default_parameter byte_align: 8
+    endian :little
+
+    uint8  :version, initial_value: 1
+    uint8  :endianness, initial_value: 0x10
+    uint16 :common_header_length, initial_value: 8
+    uint32 :filler, initial_value: 0xCCCCCCCC
+  end
+
+  # [2.2.6.2 Private Header for Constructed Type](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/63949ba8-bc88-4c0c-9377-23f14b197827)
+  class TypeSerialization1PrivateHeader < BinData::Record
+    default_parameter byte_align: 8
+    endian :little
+
+    uint32 :object_buffer_length, initial_value: -> { buffer_length(@obj) }
+    uint32 :filler, initial_value: 0x00000000
+
+    def buffer_length(obj)
+      parent.respond_to?(:field_length) ? parent.field_length(obj.parent) : 0
+    end
+  end
+
+  # [2.2.6 Type Serialization Version 1](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/9a1d0f97-eac0-49ab-a197-f1a581c2d6a0)
+  #
+  # This structure is not meant to be instantiated directly. Instead, the
+  # structure with the fields to be serialized needs to inherit from
+  # TypeSerialization1. This class will take care of adding the
+  # TypeSerialization1PrivateHeader fields in front of any NDR constructed type
+  # structures and setting the buffer length field (:object_buffer_length) to
+  # the correct value.
+  #
+  # Example:
+  #
+  # class TestStruct < RubySMB::Dcerpc::Ndr::NdrStruct
+  #   default_parameters byte_align: 8
+  #   endian :little
+
+  #   rpc_unicode_string :full_name
+  #   ndr_uint32 :user_id
+  # end
+
+  # class TestTypeSerialization1 < RubySMB::Dcerpc::Ndr::TypeSerialization1
+  #   default_parameter byte_align: 8
+  #   endian :little
+  #
+  #   test_struct :data1
+  #   uint32 :value1, initial_value: 5
+  #   uint32 :value2, initial_value: 6
+  #   test_struct :data2
+  #   uint32 :value3, initial_value: 7
+  #   test_struct :data3
+  # end
+  #
+  # This will result in the following structure:
+  # {
+  #   :common_header => {:version=>1, :endianness=>16, :common_header_length=>8, :filler=>3435973836},
+  #   :private_header1 => {:object_buffer_length=>12, :filler=>0},
+  #   :data1 => {:full_name=>{:buffer_length=>0, :maximum_length=>0, :buffer=>:null}, :user_id=>0},
+  #   :value1 => 5,
+  #   :value2 => 6,
+  #   :private_header2 => {:object_buffer_length=>12, :filler=>0},
+  #   :data2 => {:full_name=>{:buffer_length=>0, :maximum_length=>0, :buffer=>:null}, :user_id=>0},
+  #   :value3 => 7,
+  #   :private_header3 => {:object_buffer_length=>12, :filler=>0},
+  #   :data3 => {:full_name=>{:buffer_length=>0, :maximum_length=>0, :buffer=>:null}, :user_id=>0}
+  # }
+  #
+  class TypeSerialization1 < BinData::Record
+    PRIVATE_HEADER_BASE_NAME = 'private_header'.freeze
+
+    default_parameter byte_align: 8
+    endian :little
+    search_prefix :type_serialization1
+
+    common_type_header :common_header
+
+    def field_length(obj)
+      length = 0
+      index = find_index_of(obj)
+      if index
+        each_pair {|n, o| length = o.num_bytes if n == field_names[index + 1]}
+      end
+      length
+    end
+
+    def self.method_missing(symbol, *args, &block)
+      return super if dsl_parser.respond_to?(symbol)
+
+      klass = BinData::RegisteredClasses.lookup(symbol, {endian: dsl_parser.endian, search_prefix: dsl_parser.search_prefix})
+      if klass.new.is_a?(ConstructedTypePlugin)
+        # We cannot have two fields with the same name. So, here we look for
+        # existing TypeSerialization1PrivateHeader fields and just increment
+        # the ending number of the last TypeSerialization1PrivateHeader field
+        # to make the new name unique.
+        names = dsl_parser.fields.find_all do |field|
+          field.prototype.instance_variable_get(:@obj_class) == TypeSerialization1PrivateHeader
+        end.map(&:name).sort
+        if names.empty?
+          new_name = "#{PRIVATE_HEADER_BASE_NAME}1"
+        else
+          num = names.last.match(/#{PRIVATE_HEADER_BASE_NAME}(\d)$/)[1].to_i
+          new_name = "#{PRIVATE_HEADER_BASE_NAME}#{num + 1}"
+        end
+
+        super(:private_header, new_name.to_sym)
+      end
+
+      super
+    end
+  end
+
 end
 

data/lib/ruby_smb/dcerpc/p_cont_list_t.rb

@@ -0,0 +1,37 @@
+module RubySMB
+  module Dcerpc
+    # The presentation context list and its element as defined in
+    # [Connection-oriented PDU Data Types - Declarations](https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06_03_01)
+    class PContElemT < Ndr::NdrStruct
+      default_parameter byte_align: 4
+      endian :little
+
+      ndr_uint16    :p_cont_id, label: 'Context ID'
+      ndr_uint8     :n_transfer_syn, label: 'Number of transfer syntaxes', initial_value: 1
+      ndr_uint8     :reserved
+      p_syntax_id_t :abstract_syntax, label: 'Abstract syntax',
+        uuid: ->      { endpoint::UUID },
+        ver_major: -> { endpoint::VER_MAJOR },
+        ver_minor: -> { endpoint::VER_MINOR }
+      array         :transfer_syntaxes, label: 'Transfer syntax', type: :p_syntax_id_t,
+        initial_length: -> { n_transfer_syn },
+        uuid: ->      { Ndr::UUID },
+        ver_major: -> { Ndr::VER_MAJOR },
+        ver_minor: -> { Ndr::VER_MINOR },
+        byte_align: 4
+    end
+
+    class PContListT < Ndr::NdrStruct
+      default_parameter byte_align: 4
+      endian :little
+
+      ndr_uint8  :n_context_elem, label: 'Number of context elements', initial_value: -> { 1 }
+      ndr_uint8  :reserved
+      ndr_uint16 :reserved2
+      array      :p_cont_elem, label: 'Presentation context elements', type: :p_cont_elem_t,
+        initial_length: -> {n_context_elem},
+        endpoint: -> {endpoint},
+        byte_align: 4
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/p_result_list_t.rb

@@ -0,0 +1,13 @@
+module RubySMB
+  module Dcerpc
+    class PResultListT < Ndr::NdrStruct
+      default_parameter byte_align: 4
+      endian :little
+
+      ndr_uint8  :n_results, label: 'Number of results', initial_value: -> { p_results.size }
+      ndr_uint8  :reserved
+      ndr_uint16 :reserved2
+      array      :p_results, label: 'Results', type: :p_result_t, initial_length: -> { n_results }, byte_align: 4
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/p_result_t.rb

@@ -0,0 +1,15 @@
+module RubySMB
+  module Dcerpc
+    class PResultT < Ndr::NdrStruct
+      default_parameter byte_align: 4
+      endian :little
+
+      ndr_uint16        :result,          label: 'Presentation context negotiation results'
+      ndr_uint16        :reason,          label: 'Rejection reason'
+      p_syntax_id_t     :transfer_syntax, label: 'Presentation syntax ID',
+        uuid:      -> { Ndr::UUID },
+        ver_major: -> { Ndr::VER_MAJOR },
+        ver_minor: -> { Ndr::VER_MINOR }
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/port_any_t.rb

@@ -0,0 +1,11 @@
+module RubySMB
+  module Dcerpc
+    class PortAnyT < Ndr::NdrStruct
+      default_parameter byte_align: 2
+      endian :little
+
+      ndr_uint16  :str_length, label: 'Length', initial_value: -> { port_spec.to_binary_s.size }
+      stringz     :port_spec, label: 'Port string spec', byte_align: 2, onlyif: -> { str_length > 0 }
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/request.rb

@@ -103,9 +103,10 @@ module RubySMB
         end
         string :default
       end
-      string      :auth_pad,
+
+      string    :auth_pad,
         onlyif: -> { has_auth_verifier? },
-        length: -> { (16 - (stub.num_bytes % 16)) % 16 }
+        length: -> { calculate_padding_size }
 
       # Auth Verifier
       sec_trailer :sec_trailer, onlyif: -> { has_auth_verifier? }
@@ -113,6 +114,11 @@ module RubySMB
         onlyif:      -> { has_auth_verifier? },
         read_length: -> { pdu_header.auth_length }
 
+      # Per the spec (MS_RPCE 2.2.2.11): start of the trailer should be a multiple of 16 bytes offset from the start of the stub
+      def calculate_padding_size
+        (16 - (stub.num_bytes % 16)) % 16
+      end
+
       def initialize_instance
         super
         pdu_header.ptype = PTYPE
@@ -125,7 +131,6 @@ module RubySMB
       def has_auth_verifier?
         self.pdu_header.auth_length > 0
       end
-
     end
   end
 end

data/lib/ruby_smb/dcerpc/response.rb

@@ -18,7 +18,7 @@ module RubySMB
       string      :stub, label: 'Stub', read_length: -> { stub_length }
       string      :auth_pad,
         onlyif: -> { has_auth_verifier? },
-        length: -> { (16 - (stub.num_bytes % 16)) % 16 }
+        length: -> { calculate_padding_size }
 
       # Auth Verifier
       sec_trailer :sec_trailer, onlyif: -> { has_auth_verifier? }
@@ -26,6 +26,11 @@ module RubySMB
         onlyif: -> { has_auth_verifier? },
         read_length: -> { pdu_header.auth_length }
 
+      # Per the spec (MS_RPCE 2.2.2.11): start of the trailer should be a multiple of 16 bytes offset from the start of the stub
+      def calculate_padding_size
+        (16 - (stub.num_bytes % 16)) % 16
+      end
+
       def initialize_instance
         super
         pdu_header.ptype = PTYPE

data/lib/ruby_smb/dcerpc/samr.rb

@@ -259,6 +259,8 @@ module RubySMB
         3          => 'des-cbc-md5',
         17         => 'aes128-cts-hmac-sha1-96',
         18         => 'aes256-cts-hmac-sha1-96',
+        # Windows Server 2008 and later DC includes a KeyType of -140. Not present when the domain functional level is raised to DS_BEHAVIOR_WIN2008 or greater
+        # [Appendix_A_24](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/fa61e5fc-f8fb-4d5b-9695-c724af0c3829#Appendix_A_24)
         0xffffff74 => 'rc4_hmac'
       }
 
@@ -320,7 +322,7 @@ module RubySMB
 
         def self.encrypt_password(password, key)
           # see: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/5fe3c4c4-e71b-440d-b2fd-8448bfaf6e04
-          password = password.encode('UTF-16LE').force_encoding('ASCII-8bit')
+          password = RubySMB::Utils.safe_encode(password, 'UTF-16LE').force_encoding('ASCII-8bit')
           buffer = password.rjust(512, "\x00") + [ password.length ].pack('V')
           salt = SecureRandom.random_bytes(16)
           key = OpenSSL::Digest::MD5.new(salt + key).digest
@@ -461,7 +463,7 @@ module RubySMB
         array  :old_credentials, type: :kerb_key_data_new, initial_length: :old_credential_count
         array  :older_credentials, type: :kerb_key_data_new, initial_length: :older_credential_count
         string :default_salt, read_length: -> { credentials.map { |e| e.key_offset }.min - @obj.abs_offset }
-        string :key_values, read_length: -> { credentials.map { |e| e.key_length }.sum }
+        string :key_values, read_length: -> { credentials.map { |e| e.key_length }.sum(&:to_i) }
 
         def get_key_values
           credentials.map do |credential|