rapid7 / ruby_smb

A native Ruby implementation of the SMB Protocol Family
Other
79 stars 82 forks source link

Fix Windows 11 File Reads From The Server #207

Closed zeroSteiner closed 2 years ago

zeroSteiner commented 2 years ago

This fixes a couple of small bugs that were preventing Windows 11 clients from reading files on the SMB server.

The main issue was that the new negotiate contexts could not be parsed. This meant the server couldn't negotiate the connection. The contexts now have a default string field that just consumes the data to keep things aligned but doesn't process it. This allows the negotiation to be complete without needing to be aware of all the negotiate contexts which should make it more future proof.

Additionally, the logic used to negotiate the encryption was improved to select the first mutually supported algorithm instead of only selecting the first algorithm if it's supported. This should also help make things more future-proof should additional encryption algorithms be added.

Finally, AES-256 support was fixed for the server. The key generation needed to be updated to account for the encryption algorithm so the bit length would be set correctly.

Testing

Use the example file server and a Windows 11 client.

Fixes #205

gwillcox-r7 commented 2 years ago

Before Patch:

~/git/ruby_smb │ master  sudo ruby examples/file_server.rb --path /var/public --share public --username MSFLAB\\tester --password letsTest123!
D, [2022-04-11T14:13:37.275411 #17237] DEBUG -- : Adding disk share: public
server is running
received connection
#<Thread:0x00007f52d41ccfe0 /home/gwillcox/git/ruby_smb/lib/ruby_smb/server.rb:56 run> terminated with exception (report_on_exception is true):
/root/.gem/gems/bindata-2.4.10/lib/bindata/choice.rb:115:in `instantiate_choice': selection '8' does not exist in :choices for obj.negotiate_context_list[3].data (IndexError)
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/choice.rb:109:in `current_choice'
    from (eval):2:in `do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/struct.rb:139:in `block in do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/struct.rb:139:in `each'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/struct.rb:139:in `do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/array.rb:318:in `block in do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/array.rb:315:in `loop'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/array.rb:315:in `do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/struct.rb:139:in `block in do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/struct.rb:139:in `each'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/struct.rb:139:in `do_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/base.rb:147:in `block in read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/base.rb:253:in `start_read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/base.rb:145:in `read'
    from /root/.gem/gems/bindata-2.4.10/lib/bindata/base.rb:21:in `read'
    from /home/gwillcox/git/ruby_smb/lib/ruby_smb/generic_packet.rb:44:in `read'
    from /home/gwillcox/git/ruby_smb/lib/ruby_smb/server/server_client/negotiation.rb:19:in `handle_negotiate'
    from /home/gwillcox/git/ruby_smb/lib/ruby_smb/server/server_client.rb:161:in `block in run'
    from /home/gwillcox/git/ruby_smb/lib/ruby_smb/server/server_client.rb:153:in `loop'
    from /home/gwillcox/git/ruby_smb/lib/ruby_smb/server/server_client.rb:153:in `run'
    from /home/gwillcox/git/ruby_smb/lib/ruby_smb/server.rb:56:in `block (2 levels) in run'

And on server we would just hang before getting this message:

C:\Users\*****>type \\172.31.117.32\public\cirt-default-usernames.txt
The semaphore timeout period has expired.

C:\Users\****>
gwillcox-r7 commented 2 years ago

Did another test with another Windows 11 machine in a VM and it seems to have worked:

SMB Server Output ``` ~/git/ruby_smb │ fix/server/win11-reads sudo ruby examples/file_server.rb --path /var/public --share public --username win11-test\\normal --password normal D, [2022-04-11T14:31:42.212028 #17989] DEBUG -- : Adding disk share: public server is running received connection I, [2022-04-11T14:32:17.701602 #17989] INFO -- : Negotiated dialect: SMB v3.1.1 D, [2022-04-11T14:32:17.720893 #17989] DEBUG -- : Dispatching request to do_session_setup_smb2 (session: nil) D, [2022-04-11T14:32:17.728284 #17989] DEBUG -- : Dispatching request to do_session_setup_smb2 (session: #) D, [2022-04-11T14:32:17.732022 #17989] DEBUG -- : NTLM authentication request received for WIN11-TEST\normal I, [2022-04-11T14:32:17.732209 #17989] INFO -- : NTLM authentication request succeeded for WIN11-TEST\normal D, [2022-04-11T14:32:17.736488 #17989] DEBUG -- : Dispatching request to do_tree_connect_smb2 (session: #) D, [2022-04-11T14:32:17.736786 #17989] DEBUG -- : Received TREE_CONNECT request for share: IPC$ D, [2022-04-11T14:32:17.743187 #17989] DEBUG -- : Dispatching request to do_ioctl_smb2 (session: #) D, [2022-04-11T14:32:17.743270 #17989] DEBUG -- : Received IOCTL request for share: IPC$ D, [2022-04-11T14:32:17.747049 #17989] DEBUG -- : Dispatching request to do_tree_connect_smb2 (session: #) D, [2022-04-11T14:32:17.747252 #17989] DEBUG -- : Received TREE_CONNECT request for share: public D, [2022-04-11T14:32:17.753900 #17989] DEBUG -- : Dispatching request to do_create_smb2 (session: #) D, [2022-04-11T14:32:17.753972 #17989] DEBUG -- : Received CREATE request for share: public D, [2022-04-11T14:32:17.767632 #17989] DEBUG -- : Dispatching request to do_query_directory_smb2 (session: #) D, [2022-04-11T14:32:17.767731 #17989] DEBUG -- : Received QUERY_DIRECTORY request for share: public D, [2022-04-11T14:32:17.778740 #17989] DEBUG -- : Dispatching request to do_query_directory_smb2 (session: #) D, [2022-04-11T14:32:17.778949 #17989] DEBUG -- : Received QUERY_DIRECTORY request for share: public D, [2022-04-11T14:32:17.825394 #17989] DEBUG -- : Dispatching request to do_create_smb2 (session: #) D, [2022-04-11T14:32:17.825590 #17989] DEBUG -- : Received CREATE request for share: public D, [2022-04-11T14:32:17.840911 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.841004 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.847238 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.847331 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.853529 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.853667 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.859968 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.860067 #17989] DEBUG -- : Received QUERY_INFO request for share: public W, [2022-04-11T14:32:17.860213 #17989] WARN -- : Can not handle QUERY_INFO request for type: 3, class: 0 E, [2022-04-11T14:32:17.860308 #17989] ERROR -- : Caught a NotImplementedError while handling a QUERY_INFO request I, [2022-04-11T14:32:17.863275 #17989] INFO -- : Sending an error packet for SMB2 command: QUERY_INFO, status: 0xc00000bb (STATUS_NOT_SUPPORTED) D, [2022-04-11T14:32:17.874763 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.874907 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.882135 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:17.882317 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:17.922439 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.922601 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.934991 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.935124 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.940956 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.941130 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.947458 #17989] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #) D, [2022-04-11T14:32:17.947636 #17989] DEBUG -- : Received QUERY_INFO request for share: public D, [2022-04-11T14:32:17.952895 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:17.953016 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:17.963286 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:17.963492 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:17.972930 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:17.973116 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.024956 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.025111 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.036744 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.036883 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.048872 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.048969 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.058298 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.058392 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.068369 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.068536 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.078725 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.079037 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.092316 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.092570 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.103538 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.103656 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.115635 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.115752 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.129458 #17989] DEBUG -- : Dispatching request to do_read_smb2 (session: #) D, [2022-04-11T14:32:18.129607 #17989] DEBUG -- : Received READ request for share: public D, [2022-04-11T14:32:18.140588 #17989] DEBUG -- : Dispatching request to do_close_smb2 (session: #) D, [2022-04-11T14:32:18.140812 #17989] DEBUG -- : Received CLOSE request for share: public D, [2022-04-11T14:32:28.436361 #17989] DEBUG -- : Dispatching request to do_tree_disconnect_smb2 (session: #) D, [2022-04-11T14:32:28.436485 #17989] DEBUG -- : Received TREE_DISCONNECT request for share: IPC$ D, [2022-04-11T14:32:28.439436 #17989] DEBUG -- : Dispatching request to do_tree_disconnect_smb2 (session: #) D, [2022-04-11T14:32:28.439517 #17989] DEBUG -- : Received TREE_DISCONNECT request for share: public D, [2022-04-11T14:32:28.483477 #17989] DEBUG -- : Dispatching request to do_logoff_smb2 (session: #) ```

And on the client side:

Client Side ``` C:\Users\normal>type \\172.31.117.32\public\cirt-default-usernames.txt !root $ALOC$ $SRV $system (NULL) (any) (created) 1 11111111 12.x *cut for brevity* C:\Users\normal> ```
gwillcox-r7 commented 2 years ago

Verified this works with AES-256 encryption by setting the code to be

           @cipher_id = 4
            contexts << SMB2::NegotiateContext.new(
              context_type: SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES,
              data: {
                ciphers: [ @cipher_id ]
              }
            )

This will force it to use AES-256-GCM encryption. As you can see this worked fine.

Server:

 ~/git/ruby_smb │ fix/server/win11-reads !1  sudo ruby examples/file_server.rb --path /var/public --share public --username win11-test\\normal --password "normal"
D, [2022-04-11T15:26:11.853332 #18945] DEBUG -- : Adding disk share: public
server is running
received connection
I, [2022-04-11T15:26:30.545524 #18945]  INFO -- : Negotiated dialect: SMB v3.1.1
D, [2022-04-11T15:26:30.548251 #18945] DEBUG -- : Dispatching request to do_session_setup_smb2 (session: nil)
D, [2022-04-11T15:26:30.552804 #18945] DEBUG -- : Dispatching request to do_session_setup_smb2 (session: #<Session id: 208663321, user_id: nil, state: :in_progress>)
D, [2022-04-11T15:26:30.557932 #18945] DEBUG -- : NTLM authentication request received for WIN11-TEST\normal
I, [2022-04-11T15:26:30.558353 #18945]  INFO -- : NTLM authentication request succeeded for WIN11-TEST\normal
D, [2022-04-11T15:26:30.571420 #18945] DEBUG -- : Dispatching request to do_tree_connect_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.581034 #18945] DEBUG -- : Received TREE_CONNECT request for share: public
D, [2022-04-11T15:26:30.597070 #18945] DEBUG -- : Dispatching request to do_create_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.597228 #18945] DEBUG -- : Received CREATE request for share: public
D, [2022-04-11T15:26:30.609740 #18945] DEBUG -- : Dispatching request to do_query_directory_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.609886 #18945] DEBUG -- : Received QUERY_DIRECTORY request for share: public
D, [2022-04-11T15:26:30.623099 #18945] DEBUG -- : Dispatching request to do_query_directory_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.623232 #18945] DEBUG -- : Received QUERY_DIRECTORY request for share: public
D, [2022-04-11T15:26:30.679238 #18945] DEBUG -- : Dispatching request to do_create_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.679328 #18945] DEBUG -- : Received CREATE request for share: public
D, [2022-04-11T15:26:30.695443 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.695727 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.707358 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.707456 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.720127 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.720250 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.726831 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.726977 #18945] DEBUG -- : Received QUERY_INFO request for share: public
W, [2022-04-11T15:26:30.727108 #18945]  WARN -- : Can not handle QUERY_INFO request for type: 3, class: 0
E, [2022-04-11T15:26:30.727224 #18945] ERROR -- : Caught a NotImplementedError while handling a QUERY_INFO request
I, [2022-04-11T15:26:30.730776 #18945]  INFO -- : Sending an error packet for SMB2 command: QUERY_INFO, status: 0xc00000bb (STATUS_NOT_SUPPORTED)
D, [2022-04-11T15:26:30.743201 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.743336 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.749106 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.749230 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.782142 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.782269 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.787810 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.787972 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.795790 #18945] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.795952 #18945] DEBUG -- : Received QUERY_INFO request for share: public
D, [2022-04-11T15:26:30.802115 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.802260 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.816261 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.816381 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.829347 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.829508 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.838395 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.838549 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.848609 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.848711 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.857948 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.858108 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.871823 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.873145 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.888616 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.888764 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.905129 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.905264 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.916173 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.916292 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.926128 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.926470 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.937000 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.937259 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.950882 #18945] DEBUG -- : Dispatching request to do_read_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.956581 #18945] DEBUG -- : Received READ request for share: public
D, [2022-04-11T15:26:30.966719 #18945] DEBUG -- : Dispatching request to do_close_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:30.966830 #18945] DEBUG -- : Received CLOSE request for share: public
D, [2022-04-11T15:26:41.253435 #18945] DEBUG -- : Dispatching request to do_tree_disconnect_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)
D, [2022-04-11T15:26:41.253523 #18945] DEBUG -- : Received TREE_DISCONNECT request for share: public
D, [2022-04-11T15:26:41.258579 #18945] DEBUG -- : Dispatching request to do_logoff_smb2 (session: #<Session id: 208663321, user_id: "win11-test\\normal", state: :valid>)

And on the client side we can get the file:

C:\Users\normal>type \\172.31.117.32\public\cirt-default-usernames.txt
!root
$ALOC$
$SRV
$system
(NULL)
(any)
(created)
1
11111111
12.x
1502
18140815
1nstaller
*cut for brevity*