ruby_smb 3.3.13 → 3.3.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c74027d4436875845c9d219abd7cb3243d80acd61fbaeabb9c1256571354634
-  data.tar.gz: 8dbe5857343dbb8e1b163c29a7d3ef8d8e30aa06dc7527195772a058f4022321
+  metadata.gz: c0e82037a7cede300c72e18aca227e16dd6f6c67c46e739aae546ff990562a20
+  data.tar.gz: ac24976008cf479989fbea0edc88ceafec163c998a7d5a87ea4b085ae1f6fcd6
 SHA512:
-  metadata.gz: 5ed11e51a9babe4a7e478e4903dd4c201c8e714288ab49766e62ba3c01cf9b8358899276ecece683dbb586777739a016579e06a9dd9e6581e03a408a6a27cf5c
-  data.tar.gz: a7bf609a4b94040075adda0c17728ef306d780d28db06f47fa2d1c9b6729821309c3c5395c5bb8d22ad76fe693f7f7b21a2de9f9239211af64417ef35da16e37
+  metadata.gz: c9f2bae08d955e0a977b5614a577ff1801f8b977a675f21a70ec7dac2b695d6215d91cd3f69b37b354022aba93494be64687b90e96c8a7b75390384eb7dd0b99
+  data.tar.gz: de80907d4e9d1d91de05ca1b363ba94da81f2f39fd089bad724d1b6c2b5fae8ed8048b66ac84238174f573dbb362e49d809734446e5381b1914bc5cd9b8286ce

data/cortex.yaml

@@ -10,6 +10,8 @@ info:
   x-cortex-type: service
   x-cortex-domain-parents:
   - tag: metasploit
+  x-cortex-groups:
+  - exposure:external-ship
 openapi: 3.0.1
 servers:
 - url: "/"

data/lib/ruby_smb/dcerpc/error.rb

@@ -70,6 +70,16 @@ module RubySMB
           super(msg)
         end
       end
+
+      class GkdiError < DcerpcError
+        include RubySMB::Error::UnexpectedStatusCode::Mixin
+
+        def initialize(msg, status_code: nil)
+          self.status_code = status_code unless status_code.nil?
+
+          super(msg)
+        end
+      end
     end
   end
 end

data/lib/ruby_smb/dcerpc/gkdi/gkdi_ffc_dh_key.rb

@@ -0,0 +1,17 @@
+module RubySMB
+  module Dcerpc
+    module Gkdi
+
+      # [2.2.3.1 FFC DH Key](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gkdi/f8770f01-036d-4bf6-a4cf-1bd0e3913404)
+      class GkdiFfcDhKey < BinData::Record
+        endian :little
+
+        uint8_array :magic, initial_length: 4, initial_value: [ 0x44, 0x48, 0x50, 0x42 ]
+        uint32      :key_length
+        uint8_array :field_order, initial_length: :key_length
+        uint8_array :generator, initial_length: :key_length
+        uint8_array :public_key, initial_length: :key_length
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/gkdi/gkdi_ffc_dh_parameters.rb

@@ -0,0 +1,17 @@
+module RubySMB
+  module Dcerpc
+    module Gkdi
+
+      # [2.2.2 FFC DH Parameters](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gkdi/e15ae269-ee21-446a-a480-de3ea243db5f)
+      class GkdiFfcDhParameters < BinData::Record
+        endian :little
+
+        uint32      :parameters_length, initial_value: -> { (key_length * 2) + offset_of(generator) }
+        uint8_array :magic, initial_length: 4, initial_value: [ 0x44, 0x48, 0x50, 0x4d ]
+        uint32      :key_length
+        uint8_array :field_order, initial_length: :key_length
+        uint8_array :generator, initial_length: :key_length
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/gkdi/gkdi_get_key_request.rb

@@ -0,0 +1,26 @@
+module RubySMB
+  module Dcerpc
+    module Gkdi
+
+      # [3.1.4.1 GetKey (Opnum 0)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gkdi/4cac87a3-521e-4918-a272-240f8fabed39)
+      class GkdiGetKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_uint32     :cb_target_sd
+        ndr_conf_array :pb_target_sd, type: :ndr_uint8
+        uuid_ptr       :p_root_key_id
+        ndr_int32      :l0_key_id
+        ndr_int32      :l1_key_id
+        ndr_int32      :l2_key_id
+
+        def initialize_instance
+          super
+          @opnum = GKDI_GET_KEY
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/gkdi/gkdi_get_key_response.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Gkdi
+
+      # [3.1.4.1 GetKey (Opnum 0)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gkdi/4cac87a3-521e-4918-a272-240f8fabed39)
+      class GkdiGetKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_uint32              :pcb_out
+        ndr_byte_conf_array_ptr :pbb_out
+        ndr_uint32              :error_status
+
+        def initialize_instance
+          super
+          @opnum = GKDI_GET_KEY
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/gkdi/gkdi_group_key_envelope.rb

@@ -0,0 +1,51 @@
+module RubySMB
+  module Dcerpc
+    module Gkdi
+
+      # [2.2.4 Group Key Envelope](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gkdi/192c061c-e740-4aa0-ab1d-6954fb3e58f7)
+      class GkdiGroupKeyEnvelope < BinData::Record
+        endian :little
+
+        uint32      :version
+        uint8_array :magic, initial_length: 4, initial_value: [ 0x4b, 0x44, 0x53, 0x5b ]
+        uint32      :dw_flags
+        uint32      :l0_index
+        uint32      :l1_index
+        uint32      :l2_index
+        uuid        :root_key_identifier
+        uint32      :cb_kdf_algorithm
+        uint32      :cb_kdf_parameters, initial_value: -> { kdf_parameters.length }
+        uint32      :cb_secret_agreement_algorithm
+        uint32      :cb_secret_agreement_parameters
+        uint32      :private_key_length
+        uint32      :public_key_length
+        uint32      :cb_l1_key
+        uint32      :cb_l2_key
+        uint32      :cb_domain_name
+        uint32      :cb_forest_name
+        stringz16   :kdf_algorithm
+        struct      :kdf_parameters, only_if: -> { cb_kdf_parameters > 0 } do
+          uint8_array :block0, initial_length: 8, initial_value: [ 0, 0, 0, 0, 1, 0, 0, 0 ]
+          uint32      :length_of_hash_name, initial_value: -> { hash_algorithm_name.length }
+          uint8_array :block1, initial_length: 4, initial_value: [ 0, 0, 0, 0 ]
+          stringz16   :hash_algorithm_name
+        end
+        stringz16   :secret_agreement_algorithm
+        uint8_array :secret_agreement_parameters, initial_length: :cb_secret_agreement_parameters
+        stringz16   :domain_name
+        stringz16   :forest_name
+        uint8_array :l1_key, initial_length: 64, only_if: -> { cb_l1_key != 0 }
+        uint8_array :l2_key, initial_length: :l2_key_length, only_if: -> { cb_l2_key != 0 }
+
+        private
+
+        def l2_key_length
+          return 0 if cb_l2_key == 0
+          return 64 if (dw_flags & (1 << 31)) == 0
+
+          public_key_length
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/gkdi.rb

@@ -0,0 +1,54 @@
+module RubySMB
+  module Dcerpc
+    module Gkdi
+
+      # [2.1 Transport](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gkdi/2ca63ad2-2464-4a41-ba84-2e0270e95e86)
+      UUID = 'b9785960-524f-11df-8b6d-83dcded72085'
+      VER_MAJOR = 1
+      VER_MINOR = 0
+
+      # Operation numbers
+      GKDI_GET_KEY = 0x0000
+
+      require 'ruby_smb/dcerpc/gkdi/gkdi_get_key_request'
+      require 'ruby_smb/dcerpc/gkdi/gkdi_get_key_response'
+      require 'ruby_smb/dcerpc/gkdi/gkdi_ffc_dh_key'
+      require 'ruby_smb/dcerpc/gkdi/gkdi_ffc_dh_parameters'
+      require 'ruby_smb/dcerpc/gkdi/gkdi_group_key_envelope'
+
+      def gkdi_get_key(target_sd, root_key_id, l0_key_id, l1_key_id, l2_key_id)
+        target_sd = target_sd.to_binary_s if target_sd.respond_to?(:to_binary_s)
+
+        gkdi_get_key_request = GkdiGetKeyRequest.new(
+          cb_target_sd: target_sd.length,
+          pb_target_sd: target_sd.unpack('C*'),
+          p_root_key_id: root_key_id,
+          l0_key_id: l0_key_id,
+          l1_key_id: l1_key_id,
+          l2_key_id: l2_key_id
+        )
+
+        response = dcerpc_request(
+          gkdi_get_key_request,
+          auth_level: @auth_level,
+          auth_type: @auth_type
+        )
+        begin
+          gkdi_get_key_response = GkdiGetKeyResponse.read(response)
+        rescue IOError
+          raise RubySMB::Dcerpc::Error::InvalidPacket, 'Error reading CertServerRequestResponse'
+        end
+        unless gkdi_get_key_response.error_status == WindowsError::NTStatus::STATUS_SUCCESS
+          status_code = WindowsError::Win32.find_by_retval(gkdi_get_key_response.error_status.value).first
+          raise RubySMB::Dcerpc::Error::GkdiError.new(
+            "Error returned with gkdi_get_key: #{status_code}",
+            status_code: status_code
+          )
+        end
+
+        GkdiGroupKeyEnvelope.read(gkdi_get_key_response.pbb_out.snapshot.pack('C*'))
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/request.rb

@@ -124,6 +124,9 @@ module RubySMB
           lsar_close_handle_request              Lsarpc::LSAR_CLOSE_HANDLE
           lsar_lookup_sids_request               Lsarpc::LSAR_LOOKUP_SIDS
         end
+        choice 'Gkdi', selection: -> { opnum } do
+          gkdi_get_key_request Gkdi::GKDI_GET_KEY
+        end
         string :default
       end
 

data/lib/ruby_smb/dcerpc/samr.rb

@@ -522,16 +522,25 @@ module RubySMB
       # [2.2.10.1 USER_PROPERTIES](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/8263e7ab-aba9-43d2-8a36-3a9cb2dd3dad)
       class UserProperties < BinData::Record
         endian :little
+        hide   :bytes_remaining
 
         uint32 :reserved1
-        uint32 :struct_length, initial_value: -> { num_bytes - 12 }
+        # Length, in bytes, of the entire structure, starting from the :reserved4 field (offset 12):
+        uint32 :struct_length, value: -> { num_bytes - 12}
         uint16 :reserved2
         uint16 :reserved3
         string :reserved4, length: 96
         uint16 :property_signature, initial_value: 0x50
-        uint16 :property_count, initial_value: -> { user_properties.size }, onlyif: -> { struct_length > 111 }
-        array  :user_properties, type: :user_property, initial_length: :property_count, onlyif: :property_count?
+        count_bytes_remaining :bytes_remaining
+        # When there are zero `user_property` elements in the `:user_properties` field, this field MUST be omitted;
+        # the resultant `UserProperties` structure has a constant size of 0x6F bytes.
+        uint16 :property_count, value: -> { user_properties.size }, onlyif: :display_user_properties?
+        array  :user_properties, type: :user_property, read_until: -> { array.size == property_count }, onlyif: :display_user_properties?
         uint8  :reserved5
+
+        def display_user_properties?
+          (bytes_remaining > 1 && reading?) || user_properties.size > 0
+        end
       end
 
       # [2.2.10.7 KERB_KEY_DATA_NEW](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/447520a5-e1cc-48cc-8fdc-b90db57f7eac)

data/lib/ruby_smb/dcerpc.rb

@@ -50,6 +50,7 @@ module RubySMB
     require 'ruby_smb/dcerpc/icpr'
     require 'ruby_smb/dcerpc/efsrpc'
     require 'ruby_smb/dcerpc/lsarpc'
+    require 'ruby_smb/dcerpc/gkdi'
     require 'ruby_smb/dcerpc/request'
     require 'ruby_smb/dcerpc/response'
     require 'ruby_smb/dcerpc/rpc_auth3'

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '3.3.13'.freeze
+  VERSION = '3.3.14'.freeze
 end

data/spec/lib/ruby_smb/dcerpc/samr/user_properties_spec.rb

@@ -0,0 +1,76 @@
+RSpec.describe RubySMB::Dcerpc::Samr::UserProperties do
+  describe '#read' do
+    context 'when reading a structure with no user properties' do
+      let(:binary) { [ 0, 0x63, 0, 0, 0x50, 0].pack('L<L<S<S<x96<SC') }
+      let(:subject) { described_class.read(binary) }
+
+      it 'does not include the property_count' do
+        expect(subject.property_count?).to be_falsey
+        expect(subject.snapshot).to_not include(:property_count)
+      end
+
+      it 'does not include the user_properties' do
+        expect(subject.user_properties?).to be_falsey
+        expect(subject.snapshot).to_not include(:user_properties)
+      end
+
+      it 'serializes to the value that was read' do
+        expect(subject.to_binary_s).to eq(binary)
+      end
+    end
+
+    context 'when reading a structure with two user properties' do
+      let(:user_property1) { RubySMB::Dcerpc::Samr::UserProperty.new(property_name: 'key1', property_value: 'value1') }
+      let(:user_property2) { RubySMB::Dcerpc::Samr::UserProperty.new(property_name: 'key2', property_value: 'value2') }
+      let(:user_properties) { user_property1.to_binary_s + user_property2.to_binary_s }
+      let(:binary) { [ 0, 0x63 + 2 + user_properties.length, 0, 0, 0x50, 2].pack('L<L<S<S<x96<S<S') + user_properties + "\x00".b }
+      let(:subject) { described_class.read(binary) }
+
+      it 'includes the property_count' do
+        expect(subject.property_count?).to be_truthy
+        expect(subject.property_count).to eq(2)
+        expect(subject.snapshot).to include(:property_count)
+      end
+
+      it 'includes the user_properties' do
+        expect(subject.user_properties?).to be_truthy
+        expect(subject.user_properties).to eq([user_property1, user_property2])
+        expect(subject.snapshot).to include(:user_properties)
+      end
+
+      it 'serializes to the value that was read' do
+        expect(subject.to_binary_s).to eq(binary)
+      end
+
+      context 'when #user_properties is cleared' do
+        before(:each) { subject.user_properties.clear }
+
+        it 'does not include the property_count' do
+          expect(subject.property_count?).to be_falsey
+          expect(subject.snapshot).to_not include(:property_count)
+        end
+
+        it 'does not include the user_properties' do
+          expect(subject.user_properties?).to be_falsey
+          expect(subject.snapshot).to_not include(:user_properties)
+        end
+      end
+    end
+  end
+
+  describe '#initialize' do
+    let(:subject) { described_class.new }
+
+    it 'initializes #struct_length to 0x63' do
+      expect(subject.struct_length).to eq(0x63)
+    end
+
+    it 'initializes #property_signature to 0x50' do
+      expect(subject.property_signature).to eq(0x50)
+    end
+
+    it 'does not include user_properties' do
+      expect(subject.user_properties).to be_empty
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_smb
 version: !ruby/object:Gem::Version
-  version: 3.3.13
+  version: 3.3.14
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -10,36 +10,10 @@ authors:
 - Dev Mohanty
 - Christophe De La Fuente
 - Spencer McIntyre
-autorequire: 
+autorequire:
 bindir: bin
-cert_chain:
-- |
-  -----BEGIN CERTIFICATE-----
-  MIIERDCCAqygAwIBAgIBATANBgkqhkiG9w0BAQsFADAmMSQwIgYDVQQDDBttc2Zk
-  ZXYvREM9bWV0YXNwbG9pdC9EQz1jb20wHhcNMjMxMDMwMTYwNDI1WhcNMjUxMDI5
-  MTYwNDI1WjAmMSQwIgYDVQQDDBttc2ZkZXYvREM9bWV0YXNwbG9pdC9EQz1jb20w
-  ggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDZN/EKv+yVjwiKWvjAVhjF
-  aWNYI0E9bJ5d1qKd29omRYX9a+OOKBCu5+394fyF5RjwU4mYGr2iopX9ixRJrWXH
-  ojs70tEvV1CmvP9rhz7JKzQQoJOkinrz4d+StIylxVxVdgm7DeiB3ruTwvl7qKUv
-  piWzhrBFiVU6XIEAwq6wNEmnv2D+Omyf4h0Tf99hc6G0QmBnU3XydqvnZ+AzUbBV
-  24RH3+NQoigLbvK4M5aOeYhk19di58hznebOw6twHzNczshrBeMFQp985ScNgsvF
-  rL+7HNNwpcpngERwZfzDNn7iYN5X3cyvTcykShtsuPMa5zXsYo42LZrsTF87DW38
-  D8sxL6Dgdqu25Mltdw9m+iD4rHSfb1KJYEoNO+WwBJLO2Y4d6G1CR66tVeWsZspb
-  zneOVC+sDuil7hOm+6a7Y2yrrRyT6IfL/07DywjPAIRUp5+Jn8ZrkWRNo2AOwWBG
-  k5gz7SfJPHuyVnPlxoMA0MTFCUnnnbyHu882TGoJGgMCAwEAAaN9MHswCQYDVR0T
-  BAIwADALBgNVHQ8EBAMCBLAwHQYDVR0OBBYEFIQfNa4E889ZE334cwU7eNu2hScH
-  MCAGA1UdEQQZMBeBFW1zZmRldkBtZXRhc3Bsb2l0LmNvbTAgBgNVHRIEGTAXgRVt
-  c2ZkZXZAbWV0YXNwbG9pdC5jb20wDQYJKoZIhvcNAQELBQADggGBAMfzvKcV27p7
-  pctmpW2JmIXLMrjNLyGJAxELH/t9pJueXdga7uj2fJkYQDbwGw5x4MGyFqhqJLH4
-  l/qsUF3PyAXDTSWLVaqXQVWO+IIHxecG0XjPXTNudzMU0hzqbqiBKvsW7/a3V5BP
-  SWlFzrFkoXWlPouFpoakyYMJjpW4SGdPzRv7pM4OhXtkXpHiRvx5985FrHgHlI89
-  NSIuIUbp8zqk4hP1i9MV0Lc/vTf2gOmo+RHnjqG1NiYfMCYyY/Mcd4W36kGOl468
-  I8VDTwgCufkAzFu7BJ5yCOueqtDcuq+d3YhAyU7NI4+Ja8EwazOnB+07sWhKpg7z
-  yuQ1mWYPmZfVQpoSVv1CvXsoqJYXVPBBLOacKKSj8ArVG6pPn9Bej7IOQdblaFjl
-  DgscAao7wB3xW2BWEp1KnaDWkf1x9ttgoBEYyuYwU7uatB67kBQG1PKvLt79wHvz
-  Dxs+KOjGbBRfMnPgVGYkORKVrZIwlaboHbDKxcVW5xv+oZc7KYXWGg==
-  -----END CERTIFICATE-----
-date: 2024-12-06 00:00:00.000000000 Z
+cert_chain: []
+date: 2025-04-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redcarpet
@@ -279,6 +253,12 @@ files:
 - lib/ruby_smb/dcerpc/epm/epm_twrt.rb
 - lib/ruby_smb/dcerpc/error.rb
 - lib/ruby_smb/dcerpc/fault.rb
+- lib/ruby_smb/dcerpc/gkdi.rb
+- lib/ruby_smb/dcerpc/gkdi/gkdi_ffc_dh_key.rb
+- lib/ruby_smb/dcerpc/gkdi/gkdi_ffc_dh_parameters.rb
+- lib/ruby_smb/dcerpc/gkdi/gkdi_get_key_request.rb
+- lib/ruby_smb/dcerpc/gkdi/gkdi_get_key_response.rb
+- lib/ruby_smb/dcerpc/gkdi/gkdi_group_key_envelope.rb
 - lib/ruby_smb/dcerpc/icpr.rb
 - lib/ruby_smb/dcerpc/icpr/cert_server_request_request.rb
 - lib/ruby_smb/dcerpc/icpr/cert_server_request_response.rb
@@ -746,6 +726,7 @@ files:
 - spec/lib/ruby_smb/dcerpc/samr/samr_set_information_user2_response_spec.rb
 - spec/lib/ruby_smb/dcerpc/samr/samr_unicode_change_password_user2_request_spec.rb
 - spec/lib/ruby_smb/dcerpc/samr/samr_unicode_change_password_user2_response_spec.rb
+- spec/lib/ruby_smb/dcerpc/samr/user_properties_spec.rb
 - spec/lib/ruby_smb/dcerpc/samr_spec.rb
 - spec/lib/ruby_smb/dcerpc/sec_trailer_spec.rb
 - spec/lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all_spec.rb
@@ -995,7 +976,7 @@ homepage: https://github.com/rapid7/ruby_smb
 licenses:
 - BSD-3-clause
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -1010,8 +991,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key: 
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: A pure Ruby implementation of the SMB Protocol Family
 test_files:
@@ -1096,6 +1077,7 @@ test_files:
 - spec/lib/ruby_smb/dcerpc/samr/samr_set_information_user2_response_spec.rb
 - spec/lib/ruby_smb/dcerpc/samr/samr_unicode_change_password_user2_request_spec.rb
 - spec/lib/ruby_smb/dcerpc/samr/samr_unicode_change_password_user2_response_spec.rb
+- spec/lib/ruby_smb/dcerpc/samr/user_properties_spec.rb
 - spec/lib/ruby_smb/dcerpc/samr_spec.rb
 - spec/lib/ruby_smb/dcerpc/sec_trailer_spec.rb
 - spec/lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all_spec.rb