ruby_smb 3.2.8 → 3.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e4ddd94d3c783b3091a37c946c5069da85350c23294b33ddabcdc0476f828ec4
-  data.tar.gz: 990ad64d98bd60dd957c1b8b6fcf1abdbd6e8a52d408e0e6c03d3694354cb4ad
+  metadata.gz: e95b5ccfe1d32104083d56e9d1e8e27cc972e242b2446f04d899dcf2498b87c1
+  data.tar.gz: 3431c8b15b09b6fbd9731a8abaeb236a4386d2b7713cf865dadba2075147989d
 SHA512:
-  metadata.gz: bc7b1921009d55e8263ecfe3aa282bd4df35636a5055f5126ffa1866ed8140283bbfa14f341a4d791e30a7f51e0df631676ef211961c9712e457e0939983a6c7
-  data.tar.gz: 11982c6c2b2fb653756140c7024ccff301c72ee9b5ac44f85a5071f1d2a27dbdcf31b5936bc3ea646ef7219e3c917b5466ec3e6b26bbba116fc7552169244a4a
+  metadata.gz: 46e1217a44c2addda983c08e5c0ab50ce344e71a5b31fba18385155cbec795740651f1174261bba03337759309170dffe45563f4aa9e2a1d67289e6638bd1715
+  data.tar.gz: 6e1a6c65c904cc9026a638e282d606f9079b5f610feceb21c6232caa929ab02749ae05c26e42c73642909c7cbed12c1e35694ec58325ef879ffbd50461de0bd9

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_decrypt_file_srv_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.6 Receiving an EfsRpcDecryptFileSrv Message (Opnum 5)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/043715de-caee-402a-a61b-921743337e78)
       class EfsRpcDecryptFileSrvRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_decrypt_file_srv_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.6 Receiving an EfsRpcDecryptFileSrv Message (Opnum 5)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/043715de-caee-402a-a61b-921743337e78)
       class EfsRpcDecryptFileSrvResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_encrypt_file_srv_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.5 EfsRpcEncryptFileSrv (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/0d599976-758c-4dbd-ac8c-c9db2a922d76)
       class EfsRpcEncryptFileSrvRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_encrypt_file_srv_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.5 EfsRpcEncryptFileSrv (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/0d599976-758c-4dbd-ac8c-c9db2a922d76)
       class EfsRpcEncryptFileSrvResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_open_file_raw_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.1 EfsRpcOpenFileRaw (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/ccc4fb75-1c86-41d7-bbc4-b278ec13bfb8)
       class EfsRpcOpenFileRawRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_open_file_raw_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.1 EfsRpcOpenFileRaw (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/ccc4fb75-1c86-41d7-bbc4-b278ec13bfb8)
       class EfsRpcOpenFileRawResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system/efs_rpc_query_recover_agents_request.rb → efsrpc/efs_rpc_query_recovery_agents_request.rb}

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.8 Receiving an EfsRpcQueryRecoveryAgents Message (Opnum 7)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/cf759c00-1b90-4c33-9ace-f51c20149cea)
       class EfsRpcQueryRecoveryAgentsRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system/efs_rpc_query_recover_agents_response.rb → efsrpc/efs_rpc_query_recovery_agents_response.rb}

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.8 Receiving an EfsRpcQueryRecoveryAgents Message (Opnum 7)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/cf759c00-1b90-4c33-9ace-f51c20149cea)
       class EfsRpcQueryRecoveryAgentsResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_query_users_on_file_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.7 Receiving an EfsRpcQueryUsersOnFile Message (Opnum 6)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/a058dc6c-bb7e-491c-9143-a5cb1f7e7cea)
       class EfsRpcQueryUsersOnFileRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_query_users_on_file_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.7 Receiving an EfsRpcQueryUsersOnFile Message (Opnum 6)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/a058dc6c-bb7e-491c-9143-a5cb1f7e7cea)
       class EfsRpcQueryUsersOnFileResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system.rb → efsrpc.rb}

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
       # see: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/403c7ae0-1a3a-4e96-8efc-54e79a2cc451
       UUID = EFSRPC_UUID = 'df1941c5-fe89-4e79-bf10-463657acf44d'.freeze
       LSARPC_UUID = 'c681d488-d850-11d0-8c52-00c04fd90f7e'.freeze
@@ -81,16 +81,16 @@ module RubySMB
         extend Ndr::PointerClassPlugin
       end
 
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_response'
     end
   end
 end

data/lib/ruby_smb/dcerpc/lsarpc.rb

@@ -0,0 +1,11 @@
+module RubySMB
+  module Dcerpc
+    module Lsarpc
+      # see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dssp/6f843846-2494-4d49-b715-2f181317dd34
+      UUID = 'c681d488-d850-11d0-8c52-00c04fd90f7e'.freeze
+      VER_MAJOR = 1
+      VER_MINOR = 0
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/request.rb

@@ -101,6 +101,13 @@ module RubySMB
           cert_server_request_request      Icpr::CERT_SERVER_REQUEST
           string                           :default
         end
+        choice 'Efsrpc', selection: -> { opnum } do
+          efs_rpc_decrypt_file_srv_request      Efsrpc::EFS_RPC_DECRYPT_FILE_SRV
+          efs_rpc_encrypt_file_srv_request      Efsrpc::EFS_RPC_ENCRYPT_FILE_SRV
+          efs_rpc_open_file_raw_request         Efsrpc::EFS_RPC_OPEN_FILE_RAW
+          efs_rpc_query_recovery_agents_request Efsrpc::EFS_RPC_QUERY_RECOVERY_AGENTS
+          efs_rpc_query_users_on_file_request   Efsrpc::EFS_RPC_QUERY_USERS_ON_FILE
+        end
         string :default
       end
 

data/lib/ruby_smb/dcerpc/uuid.rb

@@ -22,8 +22,8 @@ module RubySMB
       end
 
       def set(uuid_string)
-        uuid_string.delete_suffix!('}')
-        uuid_string.delete_prefix!('{')
+        uuid_string = uuid_string.delete_suffix('}')
+        uuid_string = uuid_string.delete_prefix('{')
         components = uuid_string.split('-')
         self.time_low.read(to_binary_le(components[0]))
         self.time_mid.read(to_binary_le(components[1]))

data/lib/ruby_smb/dcerpc.rb

@@ -48,6 +48,8 @@ module RubySMB
     require 'ruby_smb/dcerpc/sec_trailer'
     require 'ruby_smb/dcerpc/dfsnm'
     require 'ruby_smb/dcerpc/icpr'
+    require 'ruby_smb/dcerpc/efsrpc'
+    require 'ruby_smb/dcerpc/lsarpc'
     require 'ruby_smb/dcerpc/request'
     require 'ruby_smb/dcerpc/response'
     require 'ruby_smb/dcerpc/rpc_auth3'
@@ -60,7 +62,6 @@ module RubySMB
     require 'ruby_smb/dcerpc/bind_ack'
     require 'ruby_smb/dcerpc/alter_context_resp'
     require 'ruby_smb/dcerpc/print_system'
-    require 'ruby_smb/dcerpc/encrypting_file_system'
 
     # Initialize the auth provider using NTLM. This function should be overriden for other providers (e.g. Kerberos, etc.)
     # @raise ArgumentError If @ntlm_client isn't initialized with a username and password.

data/lib/ruby_smb/smb1/pipe.rb

@@ -28,10 +28,14 @@ module RubySMB
           extend RubySMB::Dcerpc::Samr
         when 'wkssvc', '\\wkssvc'
           extend RubySMB::Dcerpc::Wkssvc
+        when 'lsarpc', '\\lsarpc'
+          extend RubySMB::Dcerpc::Lsarpc
         when 'netdfs', '\\netdfs'
           extend RubySMB::Dcerpc::Dfsnm
         when 'cert', '\\cert'
           extend RubySMB::Dcerpc::Icpr
+        when 'efsrpc', '\\efsrpc'
+          extend RubySMB::Dcerpc::Efsrpc
         end
         super(tree: tree, response: response, name: name)
       end

data/lib/ruby_smb/smb2/pipe.rb

@@ -25,10 +25,14 @@ module RubySMB
           extend RubySMB::Dcerpc::Samr
         when 'wkssvc', '\\wkssvc'
           extend RubySMB::Dcerpc::Wkssvc
+        when 'lsarpc', '\\lsarpc'
+          extend RubySMB::Dcerpc::Lsarpc
         when 'netdfs', '\\netdfs'
           extend RubySMB::Dcerpc::Dfsnm
         when 'cert', '\\cert'
           extend RubySMB::Dcerpc::Icpr
+        when 'efsrpc', '\\efsrpc'
+          extend RubySMB::Dcerpc::Efsrpc
         end
         super(tree: tree, response: response, name: name)
       end

data/lib/ruby_smb/smb2/tree.rb

@@ -85,6 +85,7 @@ module RubySMB
       # @raise [RubySMB::Error::InvalidPacket] if the response is not a QueryDirectoryResponse packet
       def list(directory: nil, pattern: '*', type: RubySMB::Fscc::FileInformation::FileIdFullDirectoryInformation)
         create_response = open_directory(directory: directory)
+        opened_directory = RubySMB::SMB2::File.new(tree: self, response: create_response, name: directory)
         file_id         = create_response.file_id
 
         directory_request                         = RubySMB::SMB2::Packet::QueryDirectoryRequest.new
@@ -127,8 +128,9 @@ module RubySMB
           # Reset the message id so the client can update appropriately.
           directory_request.smb2_header.message_id = 0
         end
-
         files
+      ensure
+        opened_directory.close if opened_directory
       end
 
       # 'Opens' a directory file on the remote end, using a CreateRequest. This

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '3.2.8'.freeze
+  VERSION = '3.3.1'.freeze
 end

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvRequest do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcEncryptFileSrvRequest do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :file_name }
@@ -15,7 +15,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvReques
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_ENCRYPT_FILE_SRV constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_ENCRYPT_FILE_SRV)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_ENCRYPT_FILE_SRV)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvResponse do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcEncryptFileSrvResponse do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :error_status }
@@ -15,7 +15,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvRespon
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_ENCRYPT_FILE_SRV constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_ENCRYPT_FILE_SRV)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_ENCRYPT_FILE_SRV)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawRequest do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcOpenFileRawRequest do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :file_name }
@@ -22,7 +22,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawRequest d
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_OPEN_FILE_RAW constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_OPEN_FILE_RAW)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_OPEN_FILE_RAW)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawResponse do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcOpenFileRawResponse do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :h_context }
@@ -22,7 +22,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawResponse
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_OPEN_FILE_RAW constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_OPEN_FILE_RAW)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_OPEN_FILE_RAW)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/response_spec.rb

@@ -131,7 +131,7 @@ RSpec.describe RubySMB::Dcerpc::Response do
   end
 
   describe '#stub_length' do
-    let(:stub_length) { rand(0xFF) }
+    let(:stub_length) { rand(1..0xFF) }
     before :example do
       packet.stub = 'A' * stub_length
     end
@@ -142,7 +142,7 @@ RSpec.describe RubySMB::Dcerpc::Response do
 
     context 'with auth verifier' do
       it 'returns the correct stub length' do
-        auth_size = rand(0xFF)
+        auth_size = rand(1..0xFF)
         packet.pdu_header.auth_length = auth_size
         packet.auth_value = 'B' * auth_size
         expect(packet.stub_length).to eq(stub_length + packet.auth_pad.num_bytes)
@@ -152,8 +152,8 @@ RSpec.describe RubySMB::Dcerpc::Response do
 
   describe '#read' do
     let(:response) { described_class.new }
-    let(:auth_size) { rand(0xFF) }
-    let(:stub_size) { rand(0xFF) }
+    let(:auth_size) { rand(1..0xFF) }
+    let(:stub_size) { rand(1..0xFF) }
     before :example do
       response.pdu_header.auth_length = auth_size
       response.stub = 'A' * stub_size
@@ -176,5 +176,3 @@ RSpec.describe RubySMB::Dcerpc::Response do
     expect(described_class.read(binary)).to eq(packet)
   end
 end
-
-

data/spec/lib/ruby_smb/smb2/tree_spec.rb

@@ -166,10 +166,14 @@ RSpec.describe RubySMB::SMB2::Tree do
     let(:create_res) { double('create response') }
     let(:query_dir_req) { RubySMB::SMB2::Packet::QueryDirectoryRequest.new }
     let(:query_dir_res) { RubySMB::SMB2::Packet::QueryDirectoryResponse.new }
+    let(:open_dir) { instance_double(RubySMB::SMB2::File) }
 
     before :example do
       allow(tree).to receive(:open_directory).and_return(create_res)
       allow(create_res).to receive(:file_id)
+      allow(RubySMB::SMB2::File).to receive(:new).and_return(open_dir)
+      allow(open_dir).to receive(:close)
+      allow(create_res).to receive(:file_attributes)
       allow(RubySMB::SMB2::Packet::QueryDirectoryRequest).to receive(:new).and_return(query_dir_req)
       allow(client).to receive(:send_recv)
       allow(RubySMB::SMB2::Packet::QueryDirectoryResponse).to receive(:read).and_return(query_dir_res)
@@ -180,6 +184,7 @@ RSpec.describe RubySMB::SMB2::Tree do
       dir = '/dir'
       expect(tree).to receive(:open_directory).with(directory: dir).and_return(create_res)
       tree.list(directory: dir)
+      expect(open_dir).to have_received(:close)
     end
 
     it 'uses the File ID from the create response' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_smb
 version: !ruby/object:Gem::Version
-  version: 3.2.8
+  version: 3.3.1
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -38,7 +38,7 @@ cert_chain:
   DgscAao7wB3xW2BWEp1KnaDWkf1x9ttgoBEYyuYwU7uatB67kBQG1PKvLt79wHvz
   Dxs+KOjGbBRfMnPgVGYkORKVrZIwlaboHbDKxcVW5xv+oZc7KYXWGg==
   -----END CERTIFICATE-----
-date: 2023-11-13 00:00:00.000000000 Z
+date: 2023-12-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redcarpet
@@ -259,17 +259,17 @@ files:
 - lib/ruby_smb/dcerpc/drsr/drs_get_nc_changes_response.rb
 - lib/ruby_smb/dcerpc/drsr/drs_unbind_request.rb
 - lib/ruby_smb/dcerpc/drsr/drs_unbind_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_response.rb
+- lib/ruby_smb/dcerpc/efsrpc.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_response.rb
 - lib/ruby_smb/dcerpc/epm.rb
 - lib/ruby_smb/dcerpc/epm/epm_ept_map_request.rb
 - lib/ruby_smb/dcerpc/epm/epm_ept_map_response.rb
@@ -279,6 +279,7 @@ files:
 - lib/ruby_smb/dcerpc/icpr.rb
 - lib/ruby_smb/dcerpc/icpr/cert_server_request_request.rb
 - lib/ruby_smb/dcerpc/icpr/cert_server_request_response.rb
+- lib/ruby_smb/dcerpc/lsarpc.rb
 - lib/ruby_smb/dcerpc/ndr.rb
 - lib/ruby_smb/dcerpc/netlogon.rb
 - lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_request.rb