ruby_smb 3.3.0 → 3.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f696c845250348795f67d3d5b163c65b432acdbcd01bc86d0a6cd81ddcbfc67
-  data.tar.gz: b43dcb4fa6ff4497e61329b8b5a17049a6b445fcdf5c3df61dc380960ea02b9c
+  metadata.gz: e95b5ccfe1d32104083d56e9d1e8e27cc972e242b2446f04d899dcf2498b87c1
+  data.tar.gz: 3431c8b15b09b6fbd9731a8abaeb236a4386d2b7713cf865dadba2075147989d
 SHA512:
-  metadata.gz: 8368cf1844e47161a57051d7b8dfa807b665c898153636b1baedb2211acd4685ef67c5ba167581ce84a9ec7c8c17e812d1f876bb70f34b647bb075bb94861349
-  data.tar.gz: 3b33a185fb3b981147b005e13793aa1f8a09e11c2e5e0dc9b75469ef980ec019bc2dd5e9bef187910f9b5be012d7ca710799b45aa0bdf79547ae3d48de8e22e7
+  metadata.gz: 46e1217a44c2addda983c08e5c0ab50ce344e71a5b31fba18385155cbec795740651f1174261bba03337759309170dffe45563f4aa9e2a1d67289e6638bd1715
+  data.tar.gz: 6e1a6c65c904cc9026a638e282d606f9079b5f610feceb21c6232caa929ab02749ae05c26e42c73642909c7cbed12c1e35694ec58325ef879ffbd50461de0bd9

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_decrypt_file_srv_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.6 Receiving an EfsRpcDecryptFileSrv Message (Opnum 5)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/043715de-caee-402a-a61b-921743337e78)
       class EfsRpcDecryptFileSrvRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_decrypt_file_srv_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.6 Receiving an EfsRpcDecryptFileSrv Message (Opnum 5)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/043715de-caee-402a-a61b-921743337e78)
       class EfsRpcDecryptFileSrvResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_encrypt_file_srv_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.5 EfsRpcEncryptFileSrv (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/0d599976-758c-4dbd-ac8c-c9db2a922d76)
       class EfsRpcEncryptFileSrvRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_encrypt_file_srv_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.5 EfsRpcEncryptFileSrv (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/0d599976-758c-4dbd-ac8c-c9db2a922d76)
       class EfsRpcEncryptFileSrvResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_open_file_raw_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.1 EfsRpcOpenFileRaw (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/ccc4fb75-1c86-41d7-bbc4-b278ec13bfb8)
       class EfsRpcOpenFileRawRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_open_file_raw_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.1 EfsRpcOpenFileRaw (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/ccc4fb75-1c86-41d7-bbc4-b278ec13bfb8)
       class EfsRpcOpenFileRawResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system/efs_rpc_query_recover_agents_request.rb → efsrpc/efs_rpc_query_recovery_agents_request.rb}

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.8 Receiving an EfsRpcQueryRecoveryAgents Message (Opnum 7)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/cf759c00-1b90-4c33-9ace-f51c20149cea)
       class EfsRpcQueryRecoveryAgentsRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system/efs_rpc_query_recover_agents_response.rb → efsrpc/efs_rpc_query_recovery_agents_response.rb}

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.8 Receiving an EfsRpcQueryRecoveryAgents Message (Opnum 7)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/cf759c00-1b90-4c33-9ace-f51c20149cea)
       class EfsRpcQueryRecoveryAgentsResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_query_users_on_file_request.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.7 Receiving an EfsRpcQueryUsersOnFile Message (Opnum 6)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/a058dc6c-bb7e-491c-9143-a5cb1f7e7cea)
       class EfsRpcQueryUsersOnFileRequest < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system → efsrpc}/efs_rpc_query_users_on_file_response.rb

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
 
       # [3.1.4.2.7 Receiving an EfsRpcQueryUsersOnFile Message (Opnum 6)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/a058dc6c-bb7e-491c-9143-a5cb1f7e7cea)
       class EfsRpcQueryUsersOnFileResponse < BinData::Record

data/lib/ruby_smb/dcerpc/{encrypting_file_system.rb → efsrpc.rb}

@@ -1,6 +1,6 @@
 module RubySMB
   module Dcerpc
-    module EncryptingFileSystem
+    module Efsrpc
       # see: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/403c7ae0-1a3a-4e96-8efc-54e79a2cc451
       UUID = EFSRPC_UUID = 'df1941c5-fe89-4e79-bf10-463657acf44d'.freeze
       LSARPC_UUID = 'c681d488-d850-11d0-8c52-00c04fd90f7e'.freeze
@@ -81,16 +81,16 @@ module RubySMB
         extend Ndr::PointerClassPlugin
       end
 
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_response'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_request'
-      require 'ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_response'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_request'
+      require 'ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_response'
     end
   end
 end

data/lib/ruby_smb/dcerpc/lsarpc.rb

@@ -0,0 +1,11 @@
+module RubySMB
+  module Dcerpc
+    module Lsarpc
+      # see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dssp/6f843846-2494-4d49-b715-2f181317dd34
+      UUID = 'c681d488-d850-11d0-8c52-00c04fd90f7e'.freeze
+      VER_MAJOR = 1
+      VER_MINOR = 0
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/request.rb

@@ -101,6 +101,13 @@ module RubySMB
           cert_server_request_request      Icpr::CERT_SERVER_REQUEST
           string                           :default
         end
+        choice 'Efsrpc', selection: -> { opnum } do
+          efs_rpc_decrypt_file_srv_request      Efsrpc::EFS_RPC_DECRYPT_FILE_SRV
+          efs_rpc_encrypt_file_srv_request      Efsrpc::EFS_RPC_ENCRYPT_FILE_SRV
+          efs_rpc_open_file_raw_request         Efsrpc::EFS_RPC_OPEN_FILE_RAW
+          efs_rpc_query_recovery_agents_request Efsrpc::EFS_RPC_QUERY_RECOVERY_AGENTS
+          efs_rpc_query_users_on_file_request   Efsrpc::EFS_RPC_QUERY_USERS_ON_FILE
+        end
         string :default
       end
 

data/lib/ruby_smb/dcerpc/uuid.rb

@@ -22,8 +22,8 @@ module RubySMB
       end
 
       def set(uuid_string)
-        uuid_string.delete_suffix!('}')
-        uuid_string.delete_prefix!('{')
+        uuid_string = uuid_string.delete_suffix('}')
+        uuid_string = uuid_string.delete_prefix('{')
         components = uuid_string.split('-')
         self.time_low.read(to_binary_le(components[0]))
         self.time_mid.read(to_binary_le(components[1]))

data/lib/ruby_smb/dcerpc.rb

@@ -48,6 +48,8 @@ module RubySMB
     require 'ruby_smb/dcerpc/sec_trailer'
     require 'ruby_smb/dcerpc/dfsnm'
     require 'ruby_smb/dcerpc/icpr'
+    require 'ruby_smb/dcerpc/efsrpc'
+    require 'ruby_smb/dcerpc/lsarpc'
     require 'ruby_smb/dcerpc/request'
     require 'ruby_smb/dcerpc/response'
     require 'ruby_smb/dcerpc/rpc_auth3'
@@ -60,7 +62,6 @@ module RubySMB
     require 'ruby_smb/dcerpc/bind_ack'
     require 'ruby_smb/dcerpc/alter_context_resp'
     require 'ruby_smb/dcerpc/print_system'
-    require 'ruby_smb/dcerpc/encrypting_file_system'
 
     # Initialize the auth provider using NTLM. This function should be overriden for other providers (e.g. Kerberos, etc.)
     # @raise ArgumentError If @ntlm_client isn't initialized with a username and password.

data/lib/ruby_smb/smb1/pipe.rb

@@ -28,10 +28,14 @@ module RubySMB
           extend RubySMB::Dcerpc::Samr
         when 'wkssvc', '\\wkssvc'
           extend RubySMB::Dcerpc::Wkssvc
+        when 'lsarpc', '\\lsarpc'
+          extend RubySMB::Dcerpc::Lsarpc
         when 'netdfs', '\\netdfs'
           extend RubySMB::Dcerpc::Dfsnm
         when 'cert', '\\cert'
           extend RubySMB::Dcerpc::Icpr
+        when 'efsrpc', '\\efsrpc'
+          extend RubySMB::Dcerpc::Efsrpc
         end
         super(tree: tree, response: response, name: name)
       end

data/lib/ruby_smb/smb2/pipe.rb

@@ -25,10 +25,14 @@ module RubySMB
           extend RubySMB::Dcerpc::Samr
         when 'wkssvc', '\\wkssvc'
           extend RubySMB::Dcerpc::Wkssvc
+        when 'lsarpc', '\\lsarpc'
+          extend RubySMB::Dcerpc::Lsarpc
         when 'netdfs', '\\netdfs'
           extend RubySMB::Dcerpc::Dfsnm
         when 'cert', '\\cert'
           extend RubySMB::Dcerpc::Icpr
+        when 'efsrpc', '\\efsrpc'
+          extend RubySMB::Dcerpc::Efsrpc
         end
         super(tree: tree, response: response, name: name)
       end

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '3.3.0'.freeze
+  VERSION = '3.3.1'.freeze
 end

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvRequest do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcEncryptFileSrvRequest do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :file_name }
@@ -15,7 +15,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvReques
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_ENCRYPT_FILE_SRV constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_ENCRYPT_FILE_SRV)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_ENCRYPT_FILE_SRV)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvResponse do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcEncryptFileSrvResponse do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :error_status }
@@ -15,7 +15,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcEncryptFileSrvRespon
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_ENCRYPT_FILE_SRV constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_ENCRYPT_FILE_SRV)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_ENCRYPT_FILE_SRV)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawRequest do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcOpenFileRawRequest do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :file_name }
@@ -22,7 +22,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawRequest d
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_OPEN_FILE_RAW constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_OPEN_FILE_RAW)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_OPEN_FILE_RAW)
     end
   end
 

data/spec/lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response_spec.rb

@@ -1,4 +1,4 @@
-RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawResponse do
+RSpec.describe RubySMB::Dcerpc::Efsrpc::EfsRpcOpenFileRawResponse do
   subject(:packet) { described_class.new }
 
   it { is_expected.to respond_to :h_context }
@@ -22,7 +22,7 @@ RSpec.describe RubySMB::Dcerpc::EncryptingFileSystem::EfsRpcOpenFileRawResponse
 
   describe '#initialize_instance' do
     it 'sets #opnum to EFS_RPC_OPEN_FILE_RAW constant' do
-      expect(packet.opnum).to eq(RubySMB::Dcerpc::EncryptingFileSystem::EFS_RPC_OPEN_FILE_RAW)
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Efsrpc::EFS_RPC_OPEN_FILE_RAW)
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_smb
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.3.1
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -38,7 +38,7 @@ cert_chain:
   DgscAao7wB3xW2BWEp1KnaDWkf1x9ttgoBEYyuYwU7uatB67kBQG1PKvLt79wHvz
   Dxs+KOjGbBRfMnPgVGYkORKVrZIwlaboHbDKxcVW5xv+oZc7KYXWGg==
   -----END CERTIFICATE-----
-date: 2023-12-11 00:00:00.000000000 Z
+date: 2023-12-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redcarpet
@@ -259,17 +259,17 @@ files:
 - lib/ruby_smb/dcerpc/drsr/drs_get_nc_changes_response.rb
 - lib/ruby_smb/dcerpc/drsr/drs_unbind_request.rb
 - lib/ruby_smb/dcerpc/drsr/drs_unbind_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_decrypt_file_srv_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_encrypt_file_srv_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_open_file_raw_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_recover_agents_response.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_request.rb
-- lib/ruby_smb/dcerpc/encrypting_file_system/efs_rpc_query_users_on_file_response.rb
+- lib/ruby_smb/dcerpc/efsrpc.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_decrypt_file_srv_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_encrypt_file_srv_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_open_file_raw_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_recovery_agents_response.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_request.rb
+- lib/ruby_smb/dcerpc/efsrpc/efs_rpc_query_users_on_file_response.rb
 - lib/ruby_smb/dcerpc/epm.rb
 - lib/ruby_smb/dcerpc/epm/epm_ept_map_request.rb
 - lib/ruby_smb/dcerpc/epm/epm_ept_map_response.rb
@@ -279,6 +279,7 @@ files:
 - lib/ruby_smb/dcerpc/icpr.rb
 - lib/ruby_smb/dcerpc/icpr/cert_server_request_request.rb
 - lib/ruby_smb/dcerpc/icpr/cert_server_request_response.rb
+- lib/ruby_smb/dcerpc/lsarpc.rb
 - lib/ruby_smb/dcerpc/ndr.rb
 - lib/ruby_smb/dcerpc/netlogon.rb
 - lib/ruby_smb/dcerpc/netlogon/netr_server_authenticate3_request.rb