Class: Rex::Proto::SMB::SimpleClient::OpenPipe

Inherits:
OpenFile
  • Object
show all
Defined in:
lib/rex/proto/smb/simple_client/open_pipe.rb

Direct Known Subclasses

OpenPipeSock

Constant Summary collapse

STATUS_BUFFER_OVERFLOW =

This will only return the bytes available and does not receive available data

0x80000005
STATUS_PIPE_BROKEN = 
0xc000014b

Instance Attribute Summary collapse

Attributes inherited from OpenFile

#chunk_size, #client, #file_id, #name, #tree_id, #versions

Instance Method Summary collapse

Methods inherited from OpenFile

#<<, #close, #delete, #read_rex_smb

Constructor Details

#initialize(*args) ⇒ OpenPipe

Returns a new instance of OpenPipe.



13
14
15
16
17
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 13

def initialize(*args)
  super(*args)
  self.mode = 'rw'
  @buff = ''
end

Instance Attribute Details

#mode ⇒ Object

Valid modes are: 'trans' and 'rw'



11
12
13
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 11

def mode
  @mode
end

Instance Method Details

#peek ⇒ Object 



114
115
116
117
118
119
120
121
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 114

def peek
  if self.client.is_a?(RubySMB::Client)
    avail = peek_ruby_smb
  else
    avail = peek_rex_smb
  end
  avail
end

#peek_rex_smb ⇒ Object 



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 95

def peek_rex_smb
  setup = [0x23, self.file_id].pack('vv')
  # Must ignore errors since we expect STATUS_BUFFER_OVERFLOW
  pkt = self.client.trans_maxzero('\\PIPE\\', '', '', 2, setup, false, true, true)
  if pkt['Payload']['SMB'].v['ErrorClass'] == STATUS_PIPE_BROKEN
    raise IOError
  end
  avail = 0
  begin
    avail = pkt.to_s[pkt['Payload'].v['ParamOffset']+4, 2].unpack('v')[0]
  rescue
  end

  if (avail == 0) and (pkt['Payload']['SMB'].v['ErrorClass'] == STATUS_BUFFER_OVERFLOW)
    avail = self.client.default_max_buffer_size
  end
  avail
end

#peek_ruby_smb ⇒ Object 



88
89
90
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 88

def peek_ruby_smb
  self.client.last_file.peek_available
end

#read(length = nil, offset = 0) ⇒ Object 



54
55
56
57
58
59
60
61
62
63
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 54

def read(length = nil, offset = 0)
  case self.mode
  when 'trans'
    read_buffer(length, offset)
  when 'rw'
    super(length, offset)
  else
    raise ArgumentError
  end
end

#read_buffer(length, offset = 0) ⇒ Object 



19
20
21
22
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 19

def read_buffer(length, offset=0)
  length ||= @buff.length
  @buff.slice!(0, length)
end

#read_ruby_smb(length, offset, depth = 0) ⇒ Object 



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 24

def read_ruby_smb(length, offset, depth = 0)
  if length.nil?
    max_size = client.open_files[client.last_file_id].size
    fptr = offset

    chunk = [max_size, chunk_size].min

    data = client.read(file_id, fptr, chunk).pack('C*')
    fptr = data.length

    while data.length < max_size
      if (max_size - data.length) < chunk
        chunk = max_size - data.length
      end
      data << client.read(file_id, fptr, chunk).pack('C*')
      fptr = data.length
    end
  else
    begin
      client.read(file_id, offset, length).pack('C*')
    rescue RubySMB::Error::UnexpectedStatusCode => e
      if e.message == 'STATUS_PIPE_EMPTY' && depth < 20
        read_ruby_smb(length, offset, depth + 1)
      else
        raise e
      end
    end
  end
end

#write(data, offset = 0) ⇒ Object 



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 65

def write(data, offset = 0)

  case self.mode

  when 'trans'
    if self.client.is_a?(RubySMB::Client)
      raise NotImplementedError, '\'trans\' mode is not supported by RubySMB'
    end
    write_trans(data, offset)
  when 'rw'
    super(data, offset)
  else
    raise ArgumentError
  end
end

#write_trans(data, offset = 0) ⇒ Object 



81
82
83
84
85
86
 
# File 'lib/rex/proto/smb/simple_client/open_pipe.rb', line 81

def write_trans(data, offset=0)
  ack = self.client.trans_named_pipe(self.file_id, data)
  doff = ack['Payload'].v['DataOffset']
  dlen = ack['Payload'].v['DataCount']
  @buff << ack.to_s[4+doff, dlen]
end