Closed zeroSteiner closed 2 years ago
Marking this as draft. I'm looking into a vulnerability right now where I really need the FileNormalizedNameInformation class to be defined which makes sense to add here. I'm also going to see about adding a flexible query example which will help me with my research as well as can be used to test these examples with the server. I'm hoping to have it all done and undrafted by the end of today.
You can use this example script to query the different information classes. I'm not including it because it's very much a partial implementation. It does not support SMB1 at all or querying directories. If we were to include this we'd probably want a generic #query
method of some kind on the trees for SMB 1 and 2 and it should support both files and directories which isn't easy right now since the caller has to know which it is that they're querying.
Thanks @zeroSteiner for updating this. Everything looks good now. I tested using the query_file.rb
script, querying every information class structures, and verified it worked as expected. I'll go ahead and land it.
❯ ruby examples/file_server.rb --path /tmp/test/ --username msfuser --password 123456 --share public
D, [2022-05-04T14:42:11.039055 #73271] DEBUG -- : Adding disk share: public
server is running
received connection
I, [2022-05-04T14:46:10.337675 #73271] INFO -- : Negotiated dialect: SMB v3.1.1
D, [2022-05-04T14:46:10.347969 #73271] DEBUG -- : Dispatching request to do_session_setup_smb2 (session: nil)
D, [2022-05-04T14:46:10.356954 #73271] DEBUG -- : Dispatching request to do_session_setup_smb2 (session: #<Session id: 531316813, user_id: nil, state: :in_progress>)
D, [2022-05-04T14:46:10.357534 #73271] DEBUG -- : NTLM authentication request received for .\msfuser
I, [2022-05-04T14:46:10.357682 #73271] INFO -- : NTLM authentication request succeeded for .\msfuser
D, [2022-05-04T14:46:10.370424 #73271] DEBUG -- : Dispatching request to do_tree_connect_smb2 (session: #<Session id: 531316813, user_id: "WORKGROUP\\msfuser", state: :valid>)
D, [2022-05-04T14:46:10.370624 #73271] DEBUG -- : Received TREE_CONNECT request for share: public
D, [2022-05-04T14:46:10.385133 #73271] DEBUG -- : Dispatching request to do_create_smb2 (session: #<Session id: 531316813, user_id: "WORKGROUP\\msfuser", state: :valid>)
D, [2022-05-04T14:46:10.385195 #73271] DEBUG -- : Received CREATE request for share: public
D, [2022-05-04T14:46:10.399636 #73271] DEBUG -- : Dispatching request to do_query_info_smb2 (session: #<Session id: 531316813, user_id: "WORKGROUP\\msfuser", state: :valid>)
D, [2022-05-04T14:46:10.399706 #73271] DEBUG -- : Received QUERY_INFO request for share: public
❯ ruby examples/query_file.rb --username msfuser --password 123456 --info-class FileAllInformation 127.0.0.1 public payload.dll
SMB3 : (0x00000000) STATUS_SUCCESS: The operation completed successfully.
Connected to \\127.0.0.1\public successfully!
{:basic_information=>{:create_time=>132930391790000000, :last_access=>132938986530000000, :last_write=>132938986440000000, :last_change=>132938986440000000, :file_attributes=>{:normal=>1, :device=>0, :archive=>0, :directory=>0, :volume=>0, :system=>0, :hidden=>0, :read_only=>0, :reserved=>0, :encrypted=>0, :content_indexed=>0, :offline=>0, :compressed=>0, :reparse_point=>0, :sparse=>0, :temp=>0, :reserved2=>0, :reserved3=>0}, :reserved=>"\x00\x00\x00\x00"}, :standard_information=>{:allocation_size=>12288, :end_of_file=>8704, :number_of_links=>0, :delete_pending=>0, :directory=>0, :reserved=>"\x00\x00"}, :internal_information=>{:file_id=>2960559540}, :ea_information=>{:ea_size=>0}, :access_information=>{:access_flags=>129}, :position_information=>{:current_byte_offset=>8704}, :mode_information=>{:flags=>{:reserved=>0, :file_synchronous_io_nonalert=>0, :file_synchronous_io_alert=>0, :file_no_intermediate_buffering=>0, :file_sequential_only=>0, :file_write_through=>0, :reserved2=>0, :reserved3=>0, :file_delete_on_close=>0, :reserved4=>0, :reserved5=>0}}, :alignment_information=>{:alignment_requirement=>0}, :name_information=>{:file_name_length=>78, :file_name=>"payload.dll"}}
This adds server support for two new Fscc information classes
FILE_ID_FULL_DIRECTORY_INFORMATION
andFILE_ALL_INFORMATION
.FILE_ALL_INFORMATION
is actually a compound field that is composed of a whole bunch of others that have also all been added.FILE_ALL_INFORMATION
support fixes trying to read files usingsmbclient
andFILE_ID_FULL_DIRECTORY_INFORMATION
fixes trying to list directories on the server using RubySMB's ownexample/list_directory.rb
script (thus closing #208).Testing
examples/file_server.rb
and the necessary arguments to share a directory with some filessmbclient
to connect to the server, then use theget
command to download a file. This would result in NotImplemented error prior to this patch.examples/list_directory.rb
script to list the directory. This would result in a server-side NotImplemented error and a client side stack-trace prior to this patch.