ruby_smb 3.2.0 → 3.3.0

data/lib/ruby_smb/dcerpc.rb

@@ -51,11 +51,128 @@ module RubySMB
     require 'ruby_smb/dcerpc/request'
     require 'ruby_smb/dcerpc/response'
     require 'ruby_smb/dcerpc/rpc_auth3'
+    require 'ruby_smb/dcerpc/port_any_t'
+    require 'ruby_smb/dcerpc/p_cont_list_t'
+    require 'ruby_smb/dcerpc/p_result_t'
+    require 'ruby_smb/dcerpc/p_result_list_t'
+    require 'ruby_smb/dcerpc/alter_context'
     require 'ruby_smb/dcerpc/bind'
     require 'ruby_smb/dcerpc/bind_ack'
+    require 'ruby_smb/dcerpc/alter_context_resp'
     require 'ruby_smb/dcerpc/print_system'
     require 'ruby_smb/dcerpc/encrypting_file_system'
 
+    # Initialize the auth provider using NTLM. This function should be overriden for other providers (e.g. Kerberos, etc.)
+    # @raise ArgumentError If @ntlm_client isn't initialized with a username and password.
+    # @return Serialized message for initializing the auth provider (NTLM, unless this class is extended/overridden)
+    def auth_provider_init
+      raise ArgumentError, "NTLM Client not initialized. Username and password must be provided" unless @ntlm_client
+      type1_message = @ntlm_client.init_context
+
+      type1_message.serialize
+    end
+
+    # Encrypt the value in dcerpc_req.stub, and add a valid signature to the request.
+    # This function modifies the request object in-place, and does not return anything.
+    # This function should be overriden for other providers (e.g. Kerberos, etc.)
+    # @param dcerpc_req [Request] The Request object to be encrypted and signed in-place
+    def auth_provider_encrypt_and_sign(dcerpc_req)
+      auth_type = dcerpc_req.sec_trailer.auth_type
+      auth_level = dcerpc_req.sec_trailer.auth_level
+      unless [RPC_C_AUTHN_WINNT, RPC_C_AUTHN_DEFAULT].include?(auth_type)
+        raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
+      end
+      plaintext = dcerpc_req.stub.to_binary_s
+      pad_length = get_auth_padding_length(plaintext.length)
+      dcerpc_req.auth_pad = "\x00" * pad_length
+      data_to_sign = plain_stub_with_padding = dcerpc_req.stub.to_binary_s + dcerpc_req.auth_pad.to_binary_s
+      dcerpc_req.sec_trailer.auth_pad_length = pad_length
+      if @ntlm_client.flags & NTLM::NEGOTIATE_FLAGS[:EXTENDED_SECURITY] != 0
+        data_to_sign = dcerpc_req.to_binary_s[0..-(dcerpc_req.pdu_header.auth_length + 1)]
+      end
+
+      if auth_level == RPC_C_AUTHN_LEVEL_PKT_PRIVACY
+        encrypted = @ntlm_client.session.seal_message(plain_stub_with_padding)
+        set_encrypted_packet(dcerpc_req, encrypted, pad_length)
+      end
+      signature = @ntlm_client.session.sign_message(data_to_sign)
+
+      set_signature_on_packet(dcerpc_req, signature)
+    end
+
+    # Get the response's full stub value (which will include the auth-pad)
+    # @param dcerpc_response [Response] The Response object to extract from
+    # @return [String] The full stub, including auth_pad
+    def get_response_full_stub(dcerpc_response)
+      dcerpc_response.stub.to_binary_s + dcerpc_response.auth_pad.to_binary_s
+    end
+
+    # Decrypt the value in dcerpc_req.stub, and validate its signature.
+    # This function modifies the request object in-place, and returns whether the signature was valid.
+    # This function should be overriden for other providers (e.g. Kerberos, etc.)
+    # @param dcerpc_response [Response] The Response packet to decrypt and verify in-place
+    # @raise ArgumentError If the auth type is not NTLM
+    # @return [Boolean] Is the packet's signature valid?
+    def auth_provider_decrypt_and_verify(dcerpc_response)
+      auth_type = dcerpc_response.sec_trailer.auth_type
+      auth_level = dcerpc_response.sec_trailer.auth_level
+      unless [RPC_C_AUTHN_WINNT, RPC_C_AUTHN_DEFAULT].include?(auth_type)
+        raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
+      end
+      signature = dcerpc_response.auth_value
+      if auth_level == RPC_C_AUTHN_LEVEL_PKT_PRIVACY
+        encrypted_stub = get_response_full_stub(dcerpc_response)
+        plaintext = @ntlm_client.session.unseal_message(encrypted_stub)
+        set_decrypted_packet(dcerpc_response, plaintext)
+      end
+      data_to_check = dcerpc_response.stub.to_binary_s
+      if @ntlm_client.flags & NTLM::NEGOTIATE_FLAGS[:EXTENDED_SECURITY] != 0
+        data_to_check = dcerpc_response.to_binary_s[0..-(dcerpc_response.pdu_header.auth_length + 1)]
+      end
+
+      @ntlm_client.session.verify_signature(signature, data_to_check)
+    end
+
+    # Completes local initialisation of @ntlm_client using the server's response
+    #
+    # @param type2_message [String] NTLM type 2 message sent from server
+    # @return [String] Type 3 message to be sent to the server to complete the NTLM handshake
+    def process_ntlm_type2(type2_message)
+      ntlmssp_offset = type2_message.index('NTLMSSP')
+      type2_blob = type2_message.slice(ntlmssp_offset..-1)
+      type2_b64_message = [type2_blob].pack('m')
+      type3_message = @ntlm_client.init_context(type2_b64_message)
+      auth3 = type3_message.serialize
+
+      @session_key = @ntlm_client.session_key
+      auth3
+    end
+
+    # Send a rpc_auth3 PDU that ends the authentication handshake.
+    # This function should be overriden for other providers (e.g. Kerberos, etc.)
+    #
+    # @param response [BindAck] the BindAck response packet
+    # @param options [Hash] Unused by the NTLM auth provider
+    def auth_provider_complete_handshake(response, options)
+      auth3 = process_ntlm_type2(response.auth_value)
+
+      rpc_auth3 = RpcAuth3.new
+      add_auth_verifier(rpc_auth3, auth3)
+      rpc_auth3.pdu_header.call_id = @call_id
+
+      # The server should not respond
+      send_packet(rpc_auth3)
+      @call_id += 1
+
+      nil
+    end
+
+    def force_set_auth_params(auth_type, auth_level)
+      @auth_type = auth_type
+      @auth_level = auth_level
+    end
+
+
     # Bind to the remote server interface endpoint. It takes care of adding
     # the necessary authentication verifier if `:auth_level` is set to
     # anything different than RPC_C_AUTHN_LEVEL_NONE
@@ -74,23 +191,16 @@ module RubySMB
       @call_id ||= 1
       bind_req = Bind.new(options)
       bind_req.pdu_header.call_id = @call_id
+      auth_type = options.fetch(:auth_type) { RPC_C_AUTHN_WINNT }
+      auth_level = options.fetch(:auth_level) { RPC_C_AUTHN_LEVEL_NONE }
 
-      if options[:auth_level] && options[:auth_level] != RPC_C_AUTHN_LEVEL_NONE
-        case options[:auth_type]
-        when RPC_C_AUTHN_WINNT, RPC_C_AUTHN_DEFAULT
-          @ctx_id            = 0
-          @auth_ctx_id_base  = rand(0xFFFFFFFF)
-          raise ArgumentError, "NTLM Client not initialized. Username and password must be provided" unless @ntlm_client
-          type1_message = @ntlm_client.init_context
-          auth = type1_message.serialize
-        when RPC_C_AUTHN_GSS_KERBEROS, RPC_C_AUTHN_NETLOGON, RPC_C_AUTHN_GSS_NEGOTIATE
-        when RPC_C_AUTHN_GSS_KERBEROS, RPC_C_AUTHN_NETLOGON, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_GSS_SCHANNEL
-          # TODO
-          raise NotImplementedError
-        else
-          raise ArgumentError, "Unsupported Auth Type: #{options[:auth_type]}"
-        end
-        add_auth_verifier(bind_req, auth, options[:auth_type], options[:auth_level])
+      force_set_auth_params(auth_type, auth_level)
+
+      if @auth_level != RPC_C_AUTHN_LEVEL_NONE
+        @ctx_id            = 0
+        @auth_ctx_id_base  = rand(0xFFFFFFFF)
+        auth = auth_provider_init
+        add_auth_verifier(bind_req, auth)
       end
 
       send_packet(bind_req)
@@ -110,17 +220,11 @@ module RubySMB
       self.max_buffer_size = dcerpc_response.max_xmit_frag
       @call_id = dcerpc_response.pdu_header.call_id
 
-      if options[:auth_level] && options[:auth_level] != RPC_C_AUTHN_LEVEL_NONE
+      if auth_level != RPC_C_AUTHN_LEVEL_NONE
         # The number of legs needed to build the security context is defined
         # by the security provider
-        # (see [2.2.1.1.7 Security Providers](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/d4097450-c62f-484b-872f-ddf59a7a0d36))
-        case options[:auth_type]
-        when RPC_C_AUTHN_WINNT
-          send_auth3(dcerpc_response, options[:auth_type], options[:auth_level])
-        when RPC_C_AUTHN_GSS_KERBEROS, RPC_C_AUTHN_NETLOGON, RPC_C_AUTHN_GSS_NEGOTIATE
-          # TODO
-          raise NotImplementedError
-        end
+        # (see [2.2.1.1.7 Security Providers](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/d4097450-c62f-484b-872f-ddf59a7a0d36))
+        auth_provider_complete_handshake(dcerpc_response, options)
       end
 
       dcerpc_response
@@ -156,16 +260,24 @@ module RubySMB
       nil
     end
 
+    def get_auth_padding_length(plaintext_len)
+      (16 - (plaintext_len % 16)) % 16
+    end
+
     # Add the authentication verifier to a Request packet. This includes a
     # sec trailer and the signature of the packet. This also encrypts the
     # Request stub if privacy is required (`:auth_level` option is
     # RPC_C_AUTHN_LEVEL_PKT_PRIVACY).
     #
     # @param dcerpc_req [Request] the Request packet to be updated
-    # @param opts [Hash] the authenticaiton options: `:auth_type` and `:auth_level`
+    # @param opts [Hash] the authentication options: `:auth_type` and `:auth_level`
     # @raise [NotImplementedError] if `:auth_type` is not implemented (yet)
     # @raise [ArgumentError] if `:auth_type` is unknown
     def set_integrity_privacy(dcerpc_req, auth_level:, auth_type:)
+      unless [RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY].include?(auth_level)
+        raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
+      end
+
       dcerpc_req.sec_trailer = {
         auth_type: auth_type,
         auth_level: auth_level,
@@ -174,35 +286,30 @@ module RubySMB
       dcerpc_req.auth_value = ' ' * 16
       dcerpc_req.pdu_header.auth_length = 16
 
-      data_to_sign = plain_stub = dcerpc_req.stub.to_binary_s + dcerpc_req.auth_pad.to_binary_s
-      if @ntlm_client.flags & NTLM::NEGOTIATE_FLAGS[:EXTENDED_SECURITY] != 0
-        data_to_sign = dcerpc_req.to_binary_s[0..-(dcerpc_req.pdu_header.auth_length + 1)]
-      end
-
-      encrypted_stub = ''
-      if auth_level == RPC_C_AUTHN_LEVEL_PKT_PRIVACY
-        case auth_type
-        when RPC_C_AUTHN_NONE
-        when RPC_C_AUTHN_WINNT, RPC_C_AUTHN_DEFAULT
-          encrypted_stub = @ntlm_client.session.seal_message(plain_stub)
-        when RPC_C_AUTHN_NETLOGON, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_GSS_SCHANNEL, RPC_C_AUTHN_GSS_KERBEROS
-          # TODO
-          raise NotImplementedError
-        else
-          raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
-        end
-      end
+      auth_provider_encrypt_and_sign(dcerpc_req)
+    end
 
-      signature = @ntlm_client.session.sign_message(data_to_sign)
+    def set_signature_on_packet(dcerpc_req, signature)
+      dcerpc_req.auth_value = signature
+      dcerpc_req.pdu_header.auth_length = signature.size
+    end
 
+    def set_encrypted_packet(dcerpc_req, encrypted_stub, pad_length)
       unless encrypted_stub.empty?
-        pad_length = dcerpc_req.sec_trailer.auth_pad_length.to_i
         dcerpc_req.enable_encrypted_stub
-        dcerpc_req.stub = encrypted_stub[0..-(pad_length + 1)]
-        dcerpc_req.auth_pad = encrypted_stub[-(pad_length)..-1]
+        dcerpc_req.stub = encrypted_stub[0..-(pad_length+1)]
+        if pad_length != 0
+          dcerpc_req.auth_pad = encrypted_stub[-(pad_length)..-1]
+        end
+      end
+    end
+
+    def set_decrypted_packet(dcerpc_response, decrypted_stub)
+      unless decrypted_stub.empty?
+        pad_length = dcerpc_response.sec_trailer.auth_pad_length.to_i
+        dcerpc_response.stub = decrypted_stub[0..-(pad_length + 1)]
+        dcerpc_response.auth_pad = decrypted_stub[-(pad_length + 1)..-1]
       end
-      dcerpc_req.auth_value = signature
-      dcerpc_req.pdu_header.auth_length = signature.size
     end
 
     # Process the security context received in a response. It decrypts the
@@ -214,39 +321,18 @@ module RubySMB
     #
     # @param dcerpc_response [Response] the Response packet
     #   containing the security context to process
-    # @param opts [Hash] the authenticaiton options: `:auth_type` and
+    # @param opts [Hash] the authentication options: `:auth_type` and
     #   `:auth_level`. To enable errors when signature check fails, set the
     #   `:raise_signature_error` option to true
     # @raise [NotImplementedError] if `:auth_type` is not implemented (yet)
     # @raise [Error::CommunicationError] if socket-related error occurs
     def handle_integrity_privacy(dcerpc_response, auth_level:, auth_type:, raise_signature_error: false)
-      decrypted_stub = ''
-      if auth_level == RPC_C_AUTHN_LEVEL_PKT_PRIVACY
-        encrypted_stub = dcerpc_response.stub.to_binary_s + dcerpc_response.auth_pad.to_binary_s
-        case auth_type
-        when RPC_C_AUTHN_NONE
-        when RPC_C_AUTHN_WINNT, RPC_C_AUTHN_DEFAULT
-          decrypted_stub = @ntlm_client.session.unseal_message(encrypted_stub)
-        when RPC_C_AUTHN_NETLOGON, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_GSS_SCHANNEL, RPC_C_AUTHN_GSS_KERBEROS
-          # TODO
-          raise NotImplementedError
-        else
-          raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
-        end
-      end
-
-      unless decrypted_stub.empty?
-        pad_length = dcerpc_response.sec_trailer.auth_pad_length.to_i
-        dcerpc_response.stub = decrypted_stub[0..-(pad_length + 1)]
-        dcerpc_response.auth_pad = decrypted_stub[-(pad_length)..-1]
+      unless [RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY].include?(auth_level)
+        raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
       end
+      signature_valid = auth_provider_decrypt_and_verify(dcerpc_response)
 
-      signature = dcerpc_response.auth_value
-      data_to_check = dcerpc_response.stub.to_binary_s
-      if @ntlm_client.flags & NTLM::NEGOTIATE_FLAGS[:EXTENDED_SECURITY] != 0
-        data_to_check = dcerpc_response.to_binary_s[0..-(dcerpc_response.pdu_header.auth_length + 1)]
-      end
-      unless @ntlm_client.session.verify_signature(signature, data_to_check)
+      unless signature_valid
         if raise_signature_error
           raise Error::InvalidPacket.new(
             "Wrong packet signature received (set `raise_signature_error` to false to ignore)"
@@ -264,12 +350,10 @@ module RubySMB
     #
     # @param req [BinData::Record] the request to be updated
     # @param auth [String] the authentication data
-    # @param auth_type [Integer] the authentication type
-    # @param auth_level [Integer] the authentication level
-    def add_auth_verifier(req, auth, auth_type, auth_level)
+    def add_auth_verifier(req, auth)
       req.sec_trailer = {
-        auth_type: auth_type,
-        auth_level: auth_level,
+        auth_type: @auth_type,
+        auth_level: @auth_level,
         auth_context_id: @ctx_id + @auth_ctx_id_base
       }
       req.auth_value = auth
@@ -277,46 +361,5 @@ module RubySMB
 
       nil
     end
-
-    def process_ntlm_type2(type2_message)
-      ntlmssp_offset = type2_message.index('NTLMSSP')
-      type2_blob = type2_message.slice(ntlmssp_offset..-1)
-      type2_b64_message = [type2_blob].pack('m')
-      type3_message = @ntlm_client.init_context(type2_b64_message)
-      auth3 = type3_message.serialize
-
-      @session_key = @ntlm_client.session_key
-      auth3
-    end
-
-    # Send a rpc_auth3 PDU that ends the authentication handshake.
-    #
-    # @param response [BindAck] the BindAck response packet
-    # @param auth_type [Integer] the authentication type
-    # @param auth_level [Integer] the authentication level
-    # @raise [ArgumentError] if `:auth_type` is unknown
-    # @raise [NotImplementedError] if `:auth_type` is not implemented (yet)
-    def send_auth3(response, auth_type, auth_level)
-      case auth_type
-      when RPC_C_AUTHN_NONE
-      when RPC_C_AUTHN_WINNT, RPC_C_AUTHN_DEFAULT
-        auth3 = process_ntlm_type2(response.auth_value)
-      when RPC_C_AUTHN_NETLOGON, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_GSS_SCHANNEL, RPC_C_AUTHN_GSS_KERBEROS
-        # TODO
-        raise NotImplementedError
-      else
-        raise ArgumentError, "Unsupported Auth Type: #{auth_type}"
-      end
-
-      rpc_auth3 = RpcAuth3.new
-      add_auth_verifier(rpc_auth3, auth3, auth_type, auth_level)
-      rpc_auth3.pdu_header.call_id = @call_id
-
-      # The server should not respond
-      send_packet(rpc_auth3)
-      @call_id += 1
-
-      nil
-    end
   end
 end

data/lib/ruby_smb/dispatcher/socket.rb

@@ -24,7 +24,7 @@ module RubySMB
       end
 
       # @param host [String] passed to TCPSocket.new
-      # @param port [Fixnum] passed to TCPSocket.new
+      # @param port [Integer] passed to TCPSocket.new
       def self.connect(host, port: 445, socket: TCPSocket.new(host, port))
         new(socket)
       end

data/lib/ruby_smb/field/file_time.rb

@@ -18,12 +18,12 @@ module RubySMB
         val
       end
 
-      # Sets the value of the field from a DateTime,Time,Fixnum, or object
+      # Sets the value of the field from a DateTime,Time,Integer, or object
       # that can be converted to an integer. Datetime and Time objects get
       # converted to account for the Windows/Unix Epoch difference. Any other
       # parameter passed in will be assumed to already be correct.
       #
-      # @param value [DateTime,Time,Fixnum,#to_i] the value to set
+      # @param value [DateTime,Time,Integer,#to_i] the value to set
       # @return
       def set(value)
         case value

data/lib/ruby_smb/field/utime.rb

@@ -16,11 +16,11 @@ module RubySMB
         val
       end
 
-      # Sets the value of the field from a DateTime,Time,Fixnum, or object
+      # Sets the value of the field from a DateTime,Time,Integer, or object
       # that can be converted to an integer. Any other
       # parameter passed in will be assumed to already be correct.
       #
-      # @param value [DateTime,Time,Fixnum,#to_i] the value to set
+      # @param value [DateTime,Time,Integer,#to_i] the value to set
       # @return
       def set(value)
         case value

data/lib/ruby_smb/generic_packet.rb

@@ -129,7 +129,7 @@ module RubySMB
     # string representation.
     #
     # @param field [Hash] the hash representing the field
-    # @param depth [Fixnum] the recursive depth level to track indentation
+    # @param depth [Integer] the recursive depth level to track indentation
     # @return [String] the formatted string representation of the field
     def self.format_field(field, depth = 0)
       name = field[:name].to_s
@@ -181,7 +181,7 @@ module RubySMB
     # into a string representing the contents of that field.
     #
     # @param field [Hash] hash representation of the field to display
-    # @param depth [Fixnum] the recursion depth for setting indent levels
+    # @param depth [Integer] the recursion depth for setting indent levels
     # @param parents [Array<Symbol>] the name of the parent field, if any, of this field
     # @return [String] a formatted string representing the field and it's current contents
     def display_field(field, depth = 0, parents = [])

data/lib/ruby_smb/gss/provider/ntlm.rb

@@ -18,6 +18,7 @@ module RubySMB
         end
 
         class Authenticator < Authenticator::Base
+
           def reset!
             super
             @server_challenge = nil
@@ -141,7 +142,10 @@ module RubySMB
             case type3_msg.ntlm_version
             when :ntlmv1
               my_ntlm_response = Net::NTLM::ntlm_response(
-                ntlm_hash: Net::NTLM::ntlm_hash(account.password.encode('UTF-16LE'), unicode: true),
+                ntlm_hash: Net::NTLM::ntlm_hash(
+                  RubySMB::Utils.safe_encode(account.password, 'UTF-16LE'),
+                  unicode: true
+                ),
                 challenge: @server_challenge
               )
               matches = my_ntlm_response == type3_msg.ntlm_response
@@ -151,9 +155,9 @@ module RubySMB
               their_blob = type3_msg.ntlm_response[digest.digest_length..-1]
 
               ntlmv2_hash = Net::NTLM.ntlmv2_hash(
-                account.username.encode('UTF-16LE'),
-                account.password.encode('UTF-16LE'),
-                type3_msg.domain.encode('UTF-16LE'),  # don't use the account domain because of the special '.' value
+                RubySMB::Utils.safe_encode(account.username, 'UTF-16LE'),
+                RubySMB::Utils.safe_encode(account.password, 'UTF-16LE'),
+                RubySMB::Utils.safe_encode(type3_msg.domain, 'UTF-16LE'),  # don't use the account domain because of the special '.' value
                 {client_challenge: their_blob[16...24], unicode: true}
               )
 
@@ -305,7 +309,10 @@ module RubySMB
           username = username.downcase
           domain = @default_domain if domain.nil? || domain == '.'.encode(domain.encoding)
           domain = domain.downcase
-          @accounts.find { |account| account.username.encode(username.encoding).downcase == username && account.domain.encode(domain.encoding).downcase == domain }
+          @accounts.find do |account|
+            RubySMB::Utils.safe_encode(account.username, username.encoding).downcase == username &&
+              RubySMB::Utils.safe_encode(account.domain, domain.encoding).downcase == domain
+          end
         end
 
         #

data/lib/ruby_smb/ntlm/client.rb

@@ -51,6 +51,10 @@ module RubySMB::NTLM
         !challenge_message.has_flag?(:UNICODE) && challenge_message.has_flag?(:OEM)
       end
 
+      def ntlmv2_hash
+        @ntlmv2_hash ||= RubySMB::NTLM.ntlmv2_hash(username, password, domain, {:client_challenge => client_challenge, :unicode => !use_oem_strings?})
+      end
+
       def calculate_user_session_key!
         if is_anonymous?
           # see MS-NLMP section 3.4

data/lib/ruby_smb/ntlm/custom/string_encoder.rb

@@ -0,0 +1,22 @@
+require 'net/ntlm'
+
+module RubySMB
+  module NTLM
+    module Custom
+      module StringEncoder
+
+        def self.prepended(base)
+          base.singleton_class.send(:prepend, ClassMethods)
+        end
+
+        module ClassMethods
+          def encode_utf16le(str)
+            str.dup.force_encoding('UTF-8').encode(Encoding::UTF_16LE, Encoding::UTF_8).force_encoding('ASCII-8BIT')
+          end
+        end
+      end
+    end
+  end
+end
+
+Net::NTLM::EncodeUtil.send(:prepend, RubySMB::NTLM::Custom::StringEncoder)

data/lib/ruby_smb/ntlm.rb

@@ -1,3 +1,5 @@
+require 'ruby_smb/ntlm/custom/string_encoder'
+
 module RubySMB
   module NTLM
     # [[MS-NLMP] 2.2.2.5](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832)
@@ -56,6 +58,41 @@ module RubySMB
         "Version #{major}.#{minor} (Build #{build}); NTLM Current Revision #{ntlm_revision}"
       end
     end
+
+    class << self
+
+      # Generate a NTLMv2 Hash
+      # @param [String] user The username
+      # @param [String] password The password
+      # @param [String] target The domain or workstation to authenticate to
+      # @option opt :unicode (false) Unicode encode the domain
+      def ntlmv2_hash(user, password, target, opt={})
+        if Net::NTLM.is_ntlm_hash? password
+          decoded_password = Net::NTLM::EncodeUtil.decode_utf16le(password)
+          ntlmhash = [decoded_password.upcase[33,65]].pack('H32')
+        else
+          ntlmhash = Net::NTLM.ntlm_hash(password, opt)
+        end
+
+        if opt[:unicode]
+          # Uppercase operation on username containing non-ASCII characters
+          # after being unicode encoded with `EncodeUtil.encode_utf16le`
+          # doesn't play well. Upcase should be done before encoding.
+          user_upcase = Net::NTLM::EncodeUtil.decode_utf16le(user).upcase
+          user_upcase = Net::NTLM::EncodeUtil.encode_utf16le(user_upcase)
+        else
+          user_upcase = user.upcase
+        end
+        userdomain = user_upcase + target
+
+        unless opt[:unicode]
+          userdomain = Net::NTLM::EncodeUtil.encode_utf16le(userdomain)
+        end
+        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmhash, userdomain)
+      end
+
+    end
+
   end
 end
 

data/lib/ruby_smb/server/server_client/share_io.rb

@@ -11,7 +11,7 @@ module RubySMB
           end
 
           logger.debug("Received #{SMB1::Commands.name(request.smb_header.command)} request for share: #{share_processor.provider.name}")
-          share_processor.send(__callee__, request)
+          share_processor.share_io(__callee__, request)
         end
 
         alias :do_close_smb1          :proxy_share_io_smb1
@@ -29,7 +29,7 @@ module RubySMB
           end
 
           logger.debug("Received #{SMB2::Commands.name(request.smb2_header.command)} request for share: #{share_processor.provider.name}")
-          share_processor.send(__callee__, request)
+          share_processor.share_io(__callee__, request)
         end
 
         alias :do_close_smb2           :proxy_share_io_smb2

data/lib/ruby_smb/server/server_client/tree_connect.rb

@@ -7,7 +7,7 @@ module RubySMB
           # see: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/b062f3e3-1b65-4a9a-854a-0ee432499d8f
           response = RubySMB::SMB1::Packet::TreeConnectResponse.new
 
-          share_name = request.data_block.path.encode('UTF-8').split('\\', 4).last
+          share_name = RubySMB::Utils.safe_encode(request.data_block.path, 'UTF-8').split('\\', 4).last
           share_provider = @server.shares.transform_keys(&:downcase)[share_name.downcase]
           if share_provider.nil?
             logger.warn("Received TREE_CONNECT request for non-existent share: #{share_name}")
@@ -49,7 +49,7 @@ module RubySMB
             return response
           end
 
-          share_name = request.path.encode('UTF-8').split('\\', 4).last
+          share_name = RubySMB::Utils.safe_encode(request.path, 'UTF-8').split('\\', 4).last
           share_provider = @server.shares.transform_keys(&:downcase)[share_name.downcase]
 
           if share_provider.nil?

data/lib/ruby_smb/server/share/provider/disk.rb

@@ -14,13 +14,13 @@ module RubySMB
           # @param [String] name The name of this share.
           # @param [String, Pathname] path The local file system path to share. This path must be an absolute path to an existing
           #   directory.
-          def initialize(name, path)
+          def initialize(name, path, hooks: nil)
             path = Pathname.new(File.expand_path(path)) if path.is_a?(String)
             raise ArgumentError.new('path must be a directory') unless path.directory? # it needs to exist
             raise ArgumentError.new('path must be absolute') unless path.absolute? # it needs to be absolute so it is independent of the cwd
 
             @path = path
-            super(name)
+            super(name, hooks: hooks)
           end
 
           attr_accessor :path

data/lib/ruby_smb/server/share/provider/processor.rb

@@ -80,6 +80,31 @@ module RubySMB
               @server_client.server
             end
 
+            # Forward a share IO method for a particular request. This is a choke point to allow any hooks that were
+            # registered with the share provider to be executed before and after the specified method is invoked to
+            # process the request and generate the response. This is used for both SMB1 and SMB2 requests.
+            #
+            # @param [Symbol] method_name The method name to forward the request to
+            # @param [RubySMB::GenericPacket] request The request packet to be processed
+            # @return [RubySMB::GenericPacket]
+            def share_io(method_name, request)
+              @provider.hooks.each do |hook|
+                next unless hook.request_class == request.class && hook.location == :before
+
+                request = hook.callback.call(@session, request) || request
+              end
+
+              response = send(method_name, request)
+
+              @provider.hooks.each do |hook|
+                next unless hook.request_class == request.class && hook.location == :after
+
+                response = hook.callback.call(@session, request, response) || response
+              end
+
+              response
+            end
+
             # The underlying share provider that this is a processor for.
             # @!attribute [r] provider
             #   @return [RubySMB::Server::Share::Provider::Base]

data/lib/ruby_smb/server/share/provider/virtual_disk.rb

@@ -14,9 +14,9 @@ module RubySMB
           private_constant :HASH_METHODS
 
           # @param [String] name The name of this share.
-          def initialize(name)
+          def initialize(name, hooks: nil)
             @vfs = {}
-            super(name, add(VirtualPathname.new(self, File::SEPARATOR)))
+            super(name, add(VirtualPathname.new(self, File::SEPARATOR)), hooks: hooks)
           end
 
           # Add a dynamic file to the virtual file system. A dynamic file is one whose contents are generated by the
@@ -86,7 +86,7 @@ module RubySMB
           end
 
           def new_processor(server_client, session)
-            scoped_virtual_disk = self.class.new(@name)
+            scoped_virtual_disk = self.class.new(@name, hooks: @hooks)
             @vfs.each_value do |path|
               path = path.dup
               path.virtual_disk = scoped_virtual_disk if path.is_a?(VirtualPathname)