Fixes#8. smbclient's interactive shell now supports list_snapshots,
which enumerates VSS shadow copies on the currently selected share
via FSCTL_SRV_ENUMERATE_SNAPSHOTS. Matches Impacket smbclient.py's
list_snapshots output format.
The response follows MS-SMB2 2.2.32 and requires a two-call size
probe: the first ioctl uses a 16-byte output buffer to read the
SRV_SNAPSHOT_ARRAY header (SnapShotArraySize tells us how large the
second buffer needs to be), then a second ioctl asks for the full
payload and parses the UTF-16LE NUL-separated @GMT-... tokens.
Changes:
- pkg/third_party/smb2/client.go: add an exported Ioctl method on
*File as a thin wrapper over the internal ioctl helper, so FSCTL
operations beyond FSCTL_PIPE_TRANSCEIVE don't need their own
dedicated method in the vendored library.
- pkg/smb/client.go: EnumerateSnapshots() method on *Client. Handles
the size-probe dance, parses the UTF-16LE token list via
pkg/utf16le, returns []string. Empty slice when no snapshots exist.
- tools/smbclient/main.go: wire list_snapshots into the shell's
command switch and help text.
Unblocks the VSS-based NTDS extraction path:
use c$
list_snapshots # get @GMT-YYYY.MM.DD-HH.MM.SS
get @GMT-...\Windows\NTDS\ntds.dit
secretsdump -ntds ntds.dit -system SYSTEM
psycep
100500df41