SMB1 NTLMSSP authentication reuses the challenge UID instead of the final SessionSetup UID (breaks Tree Connect against Samba)

[Isleynorth]

Summary

Over SMB1 with NTLMSSP, RubySMB::Client#smb1_authenticate keeps the UID from the challenge (STATUS_MORE_PROCESSING_REQUIRED) response as the session UID. Servers that return a different UID in the final (STATUS_SUCCESS) SessionSetup response, such as Samba, then reject every following request (e.g. Tree Connect) because that UID is not the authenticated session.

Windows keeps the same UID throughout, so this is invisible on Windows but reproducible on Samba.

Affected code

lib/ruby_smb/client/authentication.rb, #smb1_authenticate:

user_id = challenge_packet.smb_header.uid   # UID from the challenge response
...
@user_id = user_id if response_code == WindowsError::NTStatus::STATUS_SUCCESS
# stores the challenge UID, ignoring the UID in the final response

Environment

• ruby_smb: master (also released 3.3.x)
• Target: Samba 3.0.20-Debian (Metasploitable 2), SMB1 (NT LM 0.12), NTLMSSP

Reproduction

Authenticate a valid account, then Tree Connect. Capture (frame / cmd / smb.uid / nt_status):

 9   SessionSetup  100  STATUS_MORE_PROCESSING_REQUIRED   challenge, server assigns UID 100
10   SessionSetup  100  (Type 3 auth sent with UID 100)
11   SessionSetup  101  STATUS_SUCCESS                    server finalises session as UID 101
12   TreeConnect   100  (client still uses UID 100)
13   TreeConnect   100  STATUS_ACCESS_DENIED              server rejects

Samba (log level = 10):

check_ntlm_password: authentication for user [msfadmin] ... succeeded
smbd/service.c:make_connection(731): refusing to connect with no session setup

Auth succeeds, but the Tree Connect uses UID 100 (not the authenticated 101), so Samba refuses it.

Impact

Client#tree_connect, and anything issued after login, fails against servers that reassign the UID. Downstream, Metasploit smb_login reports valid credentials as failed on Samba, since it confirms logins with a post-auth Tree Connect.

Proposed fix

@user_id = response.smb_header.uid if response_code == WindowsError::NTStatus::STATUS_SUCCESS

The Tree Connect then uses UID 101 and succeeds. Happy to open a PR with a regression spec.