psycep 100500df41 smbclient: add list_snapshots command ...

Fixes #8. smbclient's interactive shell now supports list_snapshots,
which enumerates VSS shadow copies on the currently selected share
via FSCTL_SRV_ENUMERATE_SNAPSHOTS. Matches Impacket smbclient.py's
list_snapshots output format.

The response follows MS-SMB2 2.2.32 and requires a two-call size
probe: the first ioctl uses a 16-byte output buffer to read the
SRV_SNAPSHOT_ARRAY header (SnapShotArraySize tells us how large the
second buffer needs to be), then a second ioctl asks for the full
payload and parses the UTF-16LE NUL-separated @GMT-... tokens.

Changes:
- pkg/third_party/smb2/client.go: add an exported Ioctl method on
  *File as a thin wrapper over the internal ioctl helper, so FSCTL
  operations beyond FSCTL_PIPE_TRANSCEIVE don't need their own
  dedicated method in the vendored library.
- pkg/smb/client.go: EnumerateSnapshots() method on *Client. Handles
  the size-probe dance, parses the UTF-16LE token list via
  pkg/utf16le, returns []string. Empty slice when no snapshots exist.
- tools/smbclient/main.go: wire list_snapshots into the shell's
  command switch and help text.

Unblocks the VSS-based NTDS extraction path:
  use c$
  list_snapshots      # get @GMT-YYYY.MM.DD-HH.MM.SS
  get @GMT-...\Windows\NTDS\ntds.dit
  secretsdump -ntds ntds.dit -system SYSTEM

2026-04-22 13:46:16 -05:00

..

main.go

smbclient: add list_snapshots command

2026-04-22 13:46:16 -05:00