rapid7 / ruby_smb

A native Ruby implementation of the SMB Protocol Family
Other
80 stars 80 forks source link

Add GetKeySecurity and SetKeySecurity MS-RRP structures (DCERPC) #265

Closed cdelafuente-r7 closed 3 months ago

cdelafuente-r7 commented 4 months ago

This adds two new operations to the [MS-RRP]: Windows Remote Registry Protocol DCERPC implementation.

This also includes a fix when passing an empty string to DCERPC requests, via RPC unicode strings or standard strings. This was causing NDR fault errors. Now, it ensures at least one character (the string terminator) is counted. This follows the NDR protocol (see https://pubs.opengroup.org/onlinepubs/9629399/chap14.htm#tagcjh_19_03_04): the NDR String must contain at least one element, the terminator.

As a side note, it makes me wonder if the non-null-terminated NDR structures are relevant. NDR strings seems to always include the terminator. We might want to remove these structures and keep their null-terminated variant (same name but ending with z): NdrVarString, NdrVarWideString, NdrConfVarString and NdrConfVarWideString. Thta being said, it is too much changes for this PR and should be part of another PR.

Testing

This includes a new example script examples/registry_key_security_descriptor.rb and can be used to test (it is documented in the script itself).