Add in debug printing of LookupSidsResponse

rapid7 · May 2, 2024 · 2d42220 · 2d42220
1 parent e519c7b
commit 2d42220
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/lib/ruby_smb/dcerpc/lsarpc.rb b/lib/ruby_smb/dcerpc/lsarpc.rb
@@ -485,7 +485,8 @@ class LsaprReferencedDomainList < Ndr::NdrStruct
         endian :little
 
         ndr_uint32 :num_entries
-        lsapr_trust_information_array_ptr :domains
+        array :domains, type: :lsapr_trust_information, :initial_length => :num_entries, byte_align: 4
+        # lsapr_trust_information_array_ptr :domains
         ndr_uint32 :max_entries
       end
 
@@ -614,7 +615,6 @@ def lsar_close_handle(policy_handle:)
       end
 
       def lsar_lookup_sids(policy_handle:, sid_enum_buffer:, lookup_level:)
-        require 'pry-byebug'; binding.pry;
         lsar_request = LsarLookupSidsRequest.new(
           policy_handle: policy_handle,
           sid_enum_buffer: sid_enum_buffer,
@@ -625,7 +625,9 @@ def lsar_lookup_sids(policy_handle:, sid_enum_buffer:, lookup_level:)
         response = dcerpc_request(lsar_request)
         begin
           require 'pry-byebug'; binding.pry;
-          lsar_response = LsarLookupSidsResponse.read(response)
+          BinData::trace_reading(STDERR) do
+            lsar_response = LsarLookupSidsResponse.read(response)
+          end
         rescue IOError
           raise RubySMB::Dcerpc::Error::InvalidPacket, 'Error reading LsarLookupSidsResponse'
         end