Crate smb2_client 

A minimal SMB2 client — from-scratch pure Rust, scoped to what named-pipe DCE/RPC needs: negotiate (dialect 2.1.0), NTLM session setup, tree-connect to IPC$, create a pipe, and FSCTL_PIPE_TRANSCEIVE to carry RPC PDUs.

Raw NTLMSSP is placed directly in the session-setup security buffer (Windows accepts it without a SPNEGO wrapper). SMB 2.x message signing (HMAC-SHA256, truncated to 16 bytes) is applied once a session key is established, since DCs require signing on IPC$.

Re-exports

pub use client::Cred;

pub use client::SmbClient;

pub use msg::DirEntry;

Modules

client

SmbClient — drives the SMB2 exchange up to a usable named-pipe transport for RPC. Flow: connect → negotiate → session-setup (NTLM, two round trips) → tree-connect IPC$ → create(pipe) → transact(). Post-authentication messages are signed.

header

SMB2 sync header (MS-SMB2 §2.2.1.2) — fixed 64 bytes, little-endian.

msg

SMB2 request bodies and response parsers (MS-SMB2 §2.2). Offsets in the on-wire *Offset fields are measured from the start of the SMB2 header (i.e. 64 + body_off).

server

Minimal SMB2 server that captures NetNTLMv2 — the Responder/ntlmrelayx capture side. It speaks just enough SMB2 to make a client complete an NTLM auth: NEGOTIATE → SESSION_SETUP (challenge with the fixed server challenge) → SESSION_SETUP (grab the AUTHENTICATE). Pair it with coercion (PrinterBug/PetitPotam) or name poisoning; the captured hash is hashcat -m 5600. It never grants access — auth is rejected after capture.

socks

Optional SOCKS5 egress. Every TCP dial in the stack (SMB here, plus RPC/LDAP/KDC/WinRM in the crates that depend on this one) goes through dial, which routes to a SOCKS5 proxy when one has been registered with set_proxy — the pivot support real engagements need. Hand-rolled (RFC 1928 CONNECT + RFC 1929 user/pass), consistent with the from-scratch stack.

spnego

Minimal SPNEGO/GSS-API wrapping for SMB2 session setup. Windows expects the NTLM token inside a SPNEGO negTokenInit (first message) / negTokenResp (auth message), not raw NTLMSSP. We emit just enough hand-rolled DER for the NTLM-only mech list.

status

SMB2 status codes we branch on.

transport

SMB over direct TCP/445: each message is prefixed with a 4-byte length (a zero byte then a 24-bit big-endian length), per the NetBIOS-less “direct TCP” framing.

Enums

SmbError

Type Aliases

Result