Support guest authentication

[zeroSteiner]

Support guest authentication. Per the specs a guest user is implementation-specific. This effectively allows incoming connections to authenticate when the user doesn't exist in the database. It's necessary to disable encryption in this case for SMB3 unfortunately.

Otherwise, if the returned src_name corresponds to an implementation-specific guest user,<270> the server MUST set the SMB2_SESSION_FLAG_IS_GUEST in the SessionFlags field of the SMB2 SESSION_SETUP Response and MUST set Session.IsGuest to TRUE.

See: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5ed93f06-a1d2-4837-8954-fa8b833c2654

This setting is disabled by default. In the future it'll be necessary to support Metasploit hosting files for incoming requests which may be coming from an authenticated context.

Testing

The example file server now has a --guests option. When enabled, incoming users will be authenticated using the guest context. Turn that option on, and do not add an explicit account.

• [ ] Run: ruby examples/file_server.rb --path /var/public --share public --guest
• [ ] Request a file from a Windows system: type \\192.168.159.128\public\test.txt
• [ ] See in the logging output that the NTLM authentication succeeded for a user and that it was marked as a guest as noted with the (guest) suffix

[cdelafuente-r7]

Thanks @zeroSteiner ! It looks good to me. I tested from a Windows 10 client with SMBv1, v2 and v3 and confirmed the user is correctly authenticated as the guest user. I'll go ahead and land it.