class RubySMB::Dcerpc::Srvsvc::NetShareEnumAll

msdn.microsoft.com/en-us/library/cc247293.aspx

Attributes

opnum[R]

Public Class Methods

parse_response(response) click to toggle source
# File lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all.rb, line 44
def self.parse_response(response)

  shares = []

  res = response.dup
  win_error = res.slice!(-4, 4).unpack("V")[0]

  if win_error != 0
    raise RuntimeError, "Invalid DCERPC response: win_error = #{win_error}"
  end

  # Remove unused data
  res.slice!(0, 12) # level, CTR header, Reference ID of CTR
  share_count = res.slice!(0, 4).unpack("V")[0]
  res.slice!(0, 4) # Reference ID of CTR1
  share_max_count = res.slice!(0, 4).unpack("V")[0]

  if share_max_count != share_count
    raise RuntimeError, "Invalid DCERPC response: count != count max (#{share_count}/#{share_max_count})"
  end

  # ReferenceID / Type / ReferenceID of Comment
  types = res.slice!(0, share_count * 12).scan(/.{12}/n).map { |a| a[4, 2].unpack("v")[0] }

  share_count.times do |t|
    length, offset, max_length = res.slice!(0, 12).unpack("VVV")
    if offset != 0
      raise RuntimeError, "Invalid DCERPC response: offset != 0 (#{offset})"
    end

    if length != max_length
      raise RuntimeError, "Invalid DCERPC response: length !=max_length (#{length}/#{max_length})"
    end
    name = res.slice!(0, 2 * length).gsub('\x00', '')
    res.slice!(0, 2) if length % 2 == 1 # pad

    comment_length, comment_offset, comment_max_length = res.slice!(0, 12).unpack("VVV")

    if comment_offset != 0
      raise RuntimeError, "Invalid DCERPC response: comment_offset != 0 (#{comment_offset})"
    end

    if comment_length != comment_max_length
      raise RuntimeError, "Invalid DCERPC response: comment_length != comment_max_length (#{comment_length}/#{comment_max_length})"
    end

    comment = res.slice!(0, 2 * comment_length)

    res.slice!(0, 2) if comment_length % 2 == 1 # pad

    name = name.gsub("\x00", "")
    s_type = ['DISK', 'PRINTER', 'DEVICE', 'IPC', 'SPECIAL', 'TEMPORARY'][types[t]].gsub("\x00", "")
    comment = comment.gsub("\x00", "")

    shares << [name, s_type, comment]
  end

  shares
end

Public Instance Methods

initialize_instance() click to toggle source
Calls superclass method
# File lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all.rb, line 34
def initialize_instance
  super
  @opnum = NET_SHARE_ENUM_ALL
end
pad_length() click to toggle source
# File lib/ruby_smb/dcerpc/srvsvc/net_share_enum_all.rb, line 39
def pad_length
  offset = (server_unc.abs_offset + server_unc.to_binary_s.length) % 4
  (4 - offset) % 4
end