Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/iphlp.py : 58%

Hot-keys on this page
r m x p toggle line displays
j k next/prev highlighted chunk
0 (zero) top of page
1 (one) first highlighted chunk
1# Impacket - Collection of Python classes for working with network protocols.
2#
3# SECUREAUTH LABS. Copyright (C) 2020 SecureAuth Corporation. All rights reserved.
4#
5# This software is provided under a slightly modified version
6# of the Apache Software License. See the accompanying LICENSE file
7# for more information.
8#
9# Description:
10# Implementation of iphlpsvc.dll MSRPC calls (Service that offers IPv6 connectivity over an IPv4 network)
11#
12# Authors:
13# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/)
14#
16from socket import inet_aton
18from impacket import uuid
19from impacket import hresult_errors
20from impacket.uuid import uuidtup_to_bin
21from impacket.dcerpc.v5.dtypes import BYTE, ULONG, WSTR, GUID, NULL
22from impacket.dcerpc.v5.ndr import NDRCALL, NDRUniConformantArray
23from impacket.dcerpc.v5.rpcrt import DCERPCException
25MSRPC_UUID_IPHLP_IP_TRANSITION = uuidtup_to_bin(('552d076a-cb29-4e44-8b6a-d15e59e2c0af', '1.0'))
27# RPC_IF_ALLOW_LOCAL_ONLY
28MSRPC_UUID_IPHLP_TEREDO = uuidtup_to_bin(('ecbdb051-f208-46b9-8c8b-648d9d3f3944', '1.0'))
29MSRPC_UUID_IPHLP_TEREDO_CONSUMER = uuidtup_to_bin(('1fff8faa-ec23-4e3f-a8ce-4b2f8707e636', '1.0'))
31class DCERPCSessionError(DCERPCException):
32 def __init__(self, error_string=None, error_code=None, packet=None):
33 DCERPCException.__init__(self, error_string, error_code, packet)
35 def __str__( self ):
36 key = self.error_code
37 if key in hresult_errors.ERROR_MESSAGES:
38 error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
39 error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
40 return 'IPHLP SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
41 else:
42 return 'IPHLP SessionError: unknown error code: 0x%x' % self.error_code
44################################################################################
45# CONSTANTS
46################################################################################
48# Notification types
49NOTIFICATION_ISATAP_CONFIGURATION_CHANGE = 0
50NOTIFICATION_PROCESS6TO4_CONFIGURATION_CHANGE = 1
51NOTIFICATION_TEREDO_CONFIGURATION_CHANGE = 2
52NOTIFICATION_IP_TLS_CONFIGURATION_CHANGE = 3
53NOTIFICATION_PORT_CONFIGURATION_CHANGE = 4
54NOTIFICATION_DNS64_CONFIGURATION_CHANGE = 5
55NOTIFICATION_DA_SITE_MGR_LOCAL_CONFIGURATION_CHANGE_EX = 6
57################################################################################
58# STRUCTURES
59################################################################################
61class BYTE_ARRAY(NDRUniConformantArray):
62 item = 'c'
64################################################################################
65# RPC CALLS
66################################################################################
68# Opnum 0
69class IpTransitionProtocolApplyConfigChanges(NDRCALL):
70 opnum = 0
71 structure = (
72 ('NotificationNum', BYTE),
73 )
75class IpTransitionProtocolApplyConfigChangesResponse(NDRCALL):
76 structure = (
77 ('ErrorCode', ULONG),
78 )
80# Opnum 1
81class IpTransitionProtocolApplyConfigChangesEx(NDRCALL):
82 opnum = 1
83 structure = (
84 ('NotificationNum', BYTE),
85 ('DataLength', ULONG),
86 ('Data', BYTE_ARRAY),
87 )
89class IpTransitionProtocolApplyConfigChangesExResponse(NDRCALL):
90 structure = (
91 ('ErrorCode', ULONG),
92 )
94# Opnum 2
95class IpTransitionCreatev6Inv4Tunnel(NDRCALL):
96 opnum = 2
97 structure = (
98 ('LocalAddress', "4s=''"),
99 ('RemoteAddress', "4s=''"),
100 ('InterfaceName', WSTR),
101 )
103class IpTransitionCreatev6Inv4TunnelResponse(NDRCALL):
104 structure = (
105 ('ErrorCode', ULONG),
106 )
108# Opnum 3
109class IpTransitionDeletev6Inv4Tunnel(NDRCALL):
110 opnum = 3
111 structure = (
112 ('TunnelGuid', GUID),
113 )
115class IpTransitionDeletev6Inv4TunnelResponse(NDRCALL):
116 structure = (
117 ('ErrorCode', ULONG),
118 )
120################################################################################
121# OPNUMs and their corresponding structures
122################################################################################
124OPNUMS = {
125 0 : (IpTransitionProtocolApplyConfigChanges, IpTransitionProtocolApplyConfigChangesResponse),
126 1 : (IpTransitionProtocolApplyConfigChangesEx, IpTransitionProtocolApplyConfigChangesExResponse),
127 2 : (IpTransitionCreatev6Inv4Tunnel, IpTransitionCreatev6Inv4TunnelResponse),
128 3 : (IpTransitionDeletev6Inv4Tunnel, IpTransitionDeletev6Inv4TunnelResponse)
129}
131################################################################################
132# HELPER FUNCTIONS
133################################################################################
134def checkNullString(string):
135 if string == NULL:
136 return string
138 if string[-1:] != '\x00':
139 return string + '\x00'
140 else:
141 return string
143# For all notifications except EX
144def hIpTransitionProtocolApplyConfigChanges(dce, notification_num):
145 request = IpTransitionProtocolApplyConfigChanges()
146 request['NotificationNum'] = notification_num
148 return dce.request(request)
150# Only for NOTIFICATION_DA_SITE_MGR_LOCAL_CONFIGURATION_CHANGE_EX
151# No admin required
152def hIpTransitionProtocolApplyConfigChangesEx(dce, notification_num, notification_data):
153 request = IpTransitionProtocolApplyConfigChangesEx()
154 request['NotificationNum'] = notification_num
155 request['DataLength'] = len(notification_data)
156 request['Data'] = notification_data
158 return dce.request(request)
160# Same as netsh interface ipv6 add v6v4tunnel "Test Tunnel" 192.168.0.1 10.0.0.5
161def hIpTransitionCreatev6Inv4Tunnel(dce, local_address, remote_address, interface_name):
162 request = IpTransitionCreatev6Inv4Tunnel()
163 request['LocalAddress'] = inet_aton(local_address)
164 request['RemoteAddress'] = inet_aton(remote_address)
166 request['InterfaceName'] = checkNullString(interface_name)
167 request.fields['InterfaceName'].fields['MaximumCount'] = 256
169 return dce.request(request)
171def hIpTransitionDeletev6Inv4Tunnel(dce, tunnel_guid):
172 request = IpTransitionDeletev6Inv4Tunnel()
173 request['TunnelGuid'] = uuid.string_to_bin(tunnel_guid)
175 return dce.request(request)