ruby_smb 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a683fe9443f70b1f4e7dc98d02d7f4deaf785ae94097752696c516977bc3a36a
-  data.tar.gz: 5e74a2b2daaedb9b2f096ef05fcd5465a9caa1b9672af6e42d13f18b70e47110
+  metadata.gz: e93c38e303cd6e34066d103fd2da4a21c760016778e221491f690d57f628e408
+  data.tar.gz: 5dfe1d3f1febbc197eb9cd4c4fe203a9b0d04a576e10d1aff4812dca5fcd4f4b
 SHA512:
-  metadata.gz: efaaf45fb9fb49bd37a3f45681800f26437efdd76bd6b06ee763768c3674292fe3e7bc35946a489300a3d696a7f060cad2802335aabfd766dd6bc8dd9f503fdd
-  data.tar.gz: cef65fae806b5b6bce656ef799f5ca4376a0cc71e1ad5746ddaf44898652580ce990d728960b2a4767898d1e7ebcb8e12d997919123b4cbc4a2d113c7db57822
+  metadata.gz: 915802d1d3685aa46074e721dc226f66904e9942654cceae5b3fd701be533f00057ef9d554edaaaad115754c4a75cad5c5ac09c53a11895658897ce5326236a1
+  data.tar.gz: 1f78090e799579e6f3a4dd6639cf20a88b89ed865157479e6634f55388125db05e7698117e66effde3e30bfaae98750a6230a8eb1ec057777339a70412390878

data/lib/ruby_smb/client/negotiation.rb

@@ -18,11 +18,9 @@ module RubySMB
         # This is only valid for SMB1.
         response_packet.dialects = request_packet.dialects if response_packet.respond_to? :dialects=
         version = parse_negotiate_response(response_packet)
-        case @dialect
-        when '0x0300', '0x0302'
-          @encryption_algorithm = RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM]
-        when '0x0311'
-          parse_smb3_encryption_data(request_packet, response_packet)
+        if @dialect == '0x0311'
+          update_preauth_hash(request_packet)
+          update_preauth_hash(response_packet)
         end
 
         # If the response contains the SMB2 wildcard revision number dialect;
@@ -123,14 +121,13 @@ module RubySMB
           # protocol overhead every time.
           self.server_max_buffer_size = packet.parameter_block.max_buffer_size - 260
           self.negotiated_smb_version = 1
+          self.session_encrypt_data = false
           'SMB1'
         when RubySMB::SMB2::Packet::NegotiateResponse
           self.smb1 = false
           unless packet.dialect_revision.to_i == 0x02ff
             self.smb2 = packet.dialect_revision.to_i >= 0x0200 && packet.dialect_revision.to_i < 0x0300
             self.smb3 = packet.dialect_revision.to_i >= 0x0300 && packet.dialect_revision.to_i < 0x0400
-            # Only enable session encryption if the server supports it
-            @session_encrypt_data = self.smb3 && @session_encrypt_data && packet.capabilities.encryption == 1
           end
           self.signing_required = packet.security_mode.signing_required == 1 if self.smb2 || self.smb3
           self.dialect = "0x%04x" % packet.dialect_revision
@@ -143,6 +140,19 @@ module RubySMB
           self.server_guid = packet.server_guid
           self.server_start_time = packet.server_start_time.to_time if packet.server_start_time != 0
           self.server_system_time = packet.system_time.to_time if packet.system_time != 0
+          case self.dialect
+          when '0x02ff'
+          when '0x0300', '0x0302'
+            if packet&.capabilities&.encryption == 1
+              self.encryption_algorithm = RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM]
+            end
+            self.session_encrypt_data = self.session_encrypt_data && !self.encryption_algorithm.nil?
+          when '0x0311'
+            parse_smb3_capabilities(packet)
+            self.session_encrypt_data = self.session_encrypt_data && !self.encryption_algorithm.nil?
+          else
+            self.session_encrypt_data = false
+          end
           return "SMB#{self.negotiated_smb_version}"
         else
           error = 'Unable to negotiate with remote host'
@@ -155,7 +165,7 @@ module RubySMB
         end
       end
 
-      def parse_smb3_encryption_data(request_packet, response_packet)
+      def parse_smb3_capabilities(response_packet)
         nc = response_packet.find_negotiate_context(
           RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
         )
@@ -185,8 +195,6 @@ module RubySMB
             'Unable to retrieve the encryption cipher list supported by the server from the Negotiate response'
           )
         end
-        update_preauth_hash(request_packet)
-        update_preauth_hash(response_packet)
 
         nc = response_packet.find_negotiate_context(
           RubySMB::SMB2::NegotiateContext::SMB2_COMPRESSION_CAPABILITIES

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '2.0.1'.freeze
+  VERSION = '2.0.2'.freeze
 end

data/spec/lib/ruby_smb/client_spec.rb

@@ -1065,6 +1065,11 @@ RSpec.describe RubySMB::Client do
             smb3_response.capabilities.encryption = 1
           end
 
+          it 'sets the expected encryption algorithm' do
+            client.parse_negotiate_response(smb3_response)
+            expect(client.encryption_algorithm).to eq(RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM])
+          end
+
           it 'keeps session encryption enabled if it was already' do
             client.session_encrypt_data = true
             client.parse_negotiate_response(smb3_response)
@@ -1166,26 +1171,15 @@ RSpec.describe RubySMB::Client do
         end
       end
 
-      ['0x0300', '0x0302'].each do |dialect|
-        context "with #{dialect} dialect" do
-          before :example do
-            client.dialect = dialect
-          end
-
-          it 'sets the expected encryption algorithm' do
-            client.negotiate
-            expect(client.encryption_algorithm).to eq(RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM])
-          end
-        end
-      end
-
       context "with 0x0311 dialect" do
-        it 'calls #parse_smb3_encryption_data' do
+        it 'calls #parse_negotiate_response and updates the preauth hash' do
           client.dialect = '0x0311'
           request_packet = client.smb2_3_negotiate_request
           allow(client).to receive(:negotiate_request).and_return(request_packet)
           allow(client).to receive(:negotiate_response).and_return(smb3_response)
-          expect(client).to receive(:parse_smb3_encryption_data).with(request_packet, smb3_response)
+          expect(client).to receive(:parse_negotiate_response).with(smb3_response)
+          expect(client).to receive(:update_preauth_hash).with(request_packet)
+          expect(client).to receive(:update_preauth_hash).with(smb3_response)
           client.negotiate
         end
       end
@@ -1258,7 +1252,7 @@ RSpec.describe RubySMB::Client do
         end
       end
 
-      describe '#parse_smb3_encryption_data' do
+      describe '#parse_smb3_capabilities' do
         let(:request_packet) { client.smb2_3_negotiate_request }
         let(:smb3_response) { RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311) }
         let(:nc_encryption) do
@@ -1285,7 +1279,7 @@ RSpec.describe RubySMB::Client do
         context 'when selecting the integrity hash algorithm' do
           context 'with one algorithm' do
             it 'selects the expected algorithm' do
-              smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+              smb3_client.parse_smb3_capabilities(smb3_response)
               expect(smb3_client.preauth_integrity_hash_algorithm).to eq('SHA512')
             end
           end
@@ -1296,7 +1290,7 @@ RSpec.describe RubySMB::Client do
                 RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
               )
               nc.data.hash_algorithms << 3
-              smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+              smb3_client.parse_smb3_capabilities(smb3_response)
               expect(smb3_client.preauth_integrity_hash_algorithm).to eq('SHA512')
             end
           end
@@ -1305,7 +1299,7 @@ RSpec.describe RubySMB::Client do
             it 'raises the expected exception' do
               smb3_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311)
               smb3_response.add_negotiate_context(nc_encryption)
-              expect { smb3_client.parse_smb3_encryption_data(request_packet, smb3_response) }.to raise_error(
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
                 RubySMB::Error::EncryptionError,
                 'Unable to retrieve the Preauth Integrity Hash Algorithm from the Negotiate response'
               )
@@ -1321,7 +1315,7 @@ RSpec.describe RubySMB::Client do
               )
               nc.data.hash_algorithms << 5
               smb3_response.add_negotiate_context(nc)
-              expect { smb3_client.parse_smb3_encryption_data(request_packet, smb3_response) }.to raise_error(
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
                 RubySMB::Error::EncryptionError,
                 'Unable to retrieve the Preauth Integrity Hash Algorithm from the Negotiate response'
               )
@@ -1332,7 +1326,7 @@ RSpec.describe RubySMB::Client do
         context 'when selecting the encryption algorithm' do
           context 'with one algorithm' do
             it 'selects the expected algorithm' do
-              smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+              smb3_client.parse_smb3_capabilities(smb3_response)
               expect(smb3_client.encryption_algorithm).to eq('AES-128-CCM')
             end
           end
@@ -1343,7 +1337,7 @@ RSpec.describe RubySMB::Client do
                 RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
               )
               nc.data.ciphers << RubySMB::SMB2::EncryptionCapabilities::AES_128_GCM
-              smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+              smb3_client.parse_smb3_capabilities(smb3_response)
               expect(smb3_client.encryption_algorithm).to eq('AES-128-GCM')
             end
 
@@ -1352,7 +1346,7 @@ RSpec.describe RubySMB::Client do
                 RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
               )
               nc.data.ciphers << 3
-              smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+              smb3_client.parse_smb3_capabilities(smb3_response)
               expect(smb3_client.encryption_algorithm).to eq('AES-128-CCM')
             end
 
@@ -1361,7 +1355,7 @@ RSpec.describe RubySMB::Client do
                 RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
               )
               nc.data.ciphers << RubySMB::SMB2::EncryptionCapabilities::AES_128_GCM
-              smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+              smb3_client.parse_smb3_capabilities(smb3_response)
               expect(smb3_client.server_encryption_algorithms).to eq([1, 2])
             end
           end
@@ -1370,7 +1364,7 @@ RSpec.describe RubySMB::Client do
             it 'raises the expected exception' do
               smb3_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311)
               smb3_response.add_negotiate_context(nc_integrity)
-              expect { smb3_client.parse_smb3_encryption_data(request_packet, smb3_response) }.to raise_error(
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
                 RubySMB::Error::EncryptionError,
                 'Unable to retrieve the encryption cipher list supported by the server from the Negotiate response'
               )
@@ -1386,7 +1380,7 @@ RSpec.describe RubySMB::Client do
               )
               nc.data.ciphers << 14
               smb3_response.add_negotiate_context(nc)
-              expect { smb3_client.parse_smb3_encryption_data(request_packet, smb3_response) }.to raise_error(
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
                 RubySMB::Error::EncryptionError,
                 'Unable to retrieve the encryption cipher list supported by the server from the Negotiate response'
               )
@@ -1404,16 +1398,10 @@ RSpec.describe RubySMB::Client do
             nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZ77_Huffman
             nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::Pattern_V1
             smb3_response.add_negotiate_context(nc)
-            smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
+            smb3_client.parse_smb3_capabilities(smb3_response)
             expect(smb3_client.server_compression_algorithms).to eq([1, 2, 3, 4])
           end
         end
-
-        it 'updates the preauth hash' do
-          expect(smb3_client).to receive(:update_preauth_hash).with(request_packet)
-          expect(smb3_client).to receive(:update_preauth_hash).with(smb3_response)
-          smb3_client.parse_smb3_encryption_data(request_packet, smb3_response)
-        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_smb
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -97,7 +97,7 @@ cert_chain:
   JI/W23RbIRksG2pioMhd4dCXq3FLLlkOV1YfCwWixNB+iIhQPPZVaPNfgPhCn4Dt
   DeGjje/qA4fkLtRmOtb9PUBq3ToRDE4=
   -----END CERTIFICATE-----
-date: 2020-06-19 00:00:00.000000000 Z
+date: 2020-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redcarpet