Hide keyboard shortcuts

Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1# Impacket - Collection of Python classes for working with network protocols. 

2# 

3# SECUREAUTH LABS. Copyright (C) 2020 SecureAuth Corporation. All rights reserved. 

4# 

5# This software is provided under a slightly modified version 

6# of the Apache Software License. See the accompanying LICENSE file 

7# for more information. 

8# 

9# Description: 

10# Implementation of iphlpsvc.dll MSRPC calls (Service that offers IPv6 connectivity over an IPv4 network) 

11# 

12# Authors: 

13# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/) 

14# 

15 

16from socket import inet_aton 

17 

18from impacket import uuid 

19from impacket import hresult_errors 

20from impacket.uuid import uuidtup_to_bin 

21from impacket.dcerpc.v5.dtypes import BYTE, ULONG, WSTR, GUID, NULL 

22from impacket.dcerpc.v5.ndr import NDRCALL, NDRUniConformantArray 

23from impacket.dcerpc.v5.rpcrt import DCERPCException 

24 

25MSRPC_UUID_IPHLP_IP_TRANSITION = uuidtup_to_bin(('552d076a-cb29-4e44-8b6a-d15e59e2c0af', '1.0')) 

26 

27# RPC_IF_ALLOW_LOCAL_ONLY 

28MSRPC_UUID_IPHLP_TEREDO = uuidtup_to_bin(('ecbdb051-f208-46b9-8c8b-648d9d3f3944', '1.0')) 

29MSRPC_UUID_IPHLP_TEREDO_CONSUMER = uuidtup_to_bin(('1fff8faa-ec23-4e3f-a8ce-4b2f8707e636', '1.0')) 

30 

31class DCERPCSessionError(DCERPCException): 

32 def __init__(self, error_string=None, error_code=None, packet=None): 

33 DCERPCException.__init__(self, error_string, error_code, packet) 

34 

35 def __str__( self ): 

36 key = self.error_code 

37 if key in hresult_errors.ERROR_MESSAGES: 

38 error_msg_short = hresult_errors.ERROR_MESSAGES[key][0] 

39 error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1] 

40 return 'IPHLP SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose) 

41 else: 

42 return 'IPHLP SessionError: unknown error code: 0x%x' % self.error_code 

43 

44################################################################################ 

45# CONSTANTS 

46################################################################################ 

47 

48# Notification types 

49NOTIFICATION_ISATAP_CONFIGURATION_CHANGE = 0 

50NOTIFICATION_PROCESS6TO4_CONFIGURATION_CHANGE = 1 

51NOTIFICATION_TEREDO_CONFIGURATION_CHANGE = 2 

52NOTIFICATION_IP_TLS_CONFIGURATION_CHANGE = 3 

53NOTIFICATION_PORT_CONFIGURATION_CHANGE = 4 

54NOTIFICATION_DNS64_CONFIGURATION_CHANGE = 5 

55NOTIFICATION_DA_SITE_MGR_LOCAL_CONFIGURATION_CHANGE_EX = 6 

56 

57################################################################################ 

58# STRUCTURES 

59################################################################################ 

60 

61class BYTE_ARRAY(NDRUniConformantArray): 

62 item = 'c' 

63 

64################################################################################ 

65# RPC CALLS 

66################################################################################ 

67 

68# Opnum 0 

69class IpTransitionProtocolApplyConfigChanges(NDRCALL): 

70 opnum = 0 

71 structure = ( 

72 ('NotificationNum', BYTE), 

73 ) 

74 

75class IpTransitionProtocolApplyConfigChangesResponse(NDRCALL): 

76 structure = ( 

77 ('ErrorCode', ULONG), 

78 ) 

79 

80# Opnum 1 

81class IpTransitionProtocolApplyConfigChangesEx(NDRCALL): 

82 opnum = 1 

83 structure = ( 

84 ('NotificationNum', BYTE), 

85 ('DataLength', ULONG), 

86 ('Data', BYTE_ARRAY), 

87 ) 

88 

89class IpTransitionProtocolApplyConfigChangesExResponse(NDRCALL): 

90 structure = ( 

91 ('ErrorCode', ULONG), 

92 ) 

93 

94# Opnum 2 

95class IpTransitionCreatev6Inv4Tunnel(NDRCALL): 

96 opnum = 2 

97 structure = ( 

98 ('LocalAddress', "4s=''"), 

99 ('RemoteAddress', "4s=''"), 

100 ('InterfaceName', WSTR), 

101 ) 

102 

103class IpTransitionCreatev6Inv4TunnelResponse(NDRCALL): 

104 structure = ( 

105 ('ErrorCode', ULONG), 

106 ) 

107 

108# Opnum 3 

109class IpTransitionDeletev6Inv4Tunnel(NDRCALL): 

110 opnum = 3 

111 structure = ( 

112 ('TunnelGuid', GUID), 

113 ) 

114 

115class IpTransitionDeletev6Inv4TunnelResponse(NDRCALL): 

116 structure = ( 

117 ('ErrorCode', ULONG), 

118 ) 

119 

120################################################################################ 

121# OPNUMs and their corresponding structures 

122################################################################################ 

123 

124OPNUMS = { 

125 0 : (IpTransitionProtocolApplyConfigChanges, IpTransitionProtocolApplyConfigChangesResponse), 

126 1 : (IpTransitionProtocolApplyConfigChangesEx, IpTransitionProtocolApplyConfigChangesExResponse), 

127 2 : (IpTransitionCreatev6Inv4Tunnel, IpTransitionCreatev6Inv4TunnelResponse), 

128 3 : (IpTransitionDeletev6Inv4Tunnel, IpTransitionDeletev6Inv4TunnelResponse) 

129} 

130 

131################################################################################ 

132# HELPER FUNCTIONS 

133################################################################################ 

134def checkNullString(string): 

135 if string == NULL: 

136 return string 

137 

138 if string[-1:] != '\x00': 

139 return string + '\x00' 

140 else: 

141 return string 

142 

143# For all notifications except EX 

144def hIpTransitionProtocolApplyConfigChanges(dce, notification_num): 

145 request = IpTransitionProtocolApplyConfigChanges() 

146 request['NotificationNum'] = notification_num 

147 

148 return dce.request(request) 

149 

150# Only for NOTIFICATION_DA_SITE_MGR_LOCAL_CONFIGURATION_CHANGE_EX 

151# No admin required 

152def hIpTransitionProtocolApplyConfigChangesEx(dce, notification_num, notification_data): 

153 request = IpTransitionProtocolApplyConfigChangesEx() 

154 request['NotificationNum'] = notification_num 

155 request['DataLength'] = len(notification_data) 

156 request['Data'] = notification_data 

157 

158 return dce.request(request) 

159 

160# Same as netsh interface ipv6 add v6v4tunnel "Test Tunnel" 192.168.0.1 10.0.0.5 

161def hIpTransitionCreatev6Inv4Tunnel(dce, local_address, remote_address, interface_name): 

162 request = IpTransitionCreatev6Inv4Tunnel() 

163 request['LocalAddress'] = inet_aton(local_address) 

164 request['RemoteAddress'] = inet_aton(remote_address) 

165 

166 request['InterfaceName'] = checkNullString(interface_name) 

167 request.fields['InterfaceName'].fields['MaximumCount'] = 256 

168 

169 return dce.request(request) 

170 

171def hIpTransitionDeletev6Inv4Tunnel(dce, tunnel_guid): 

172 request = IpTransitionDeletev6Inv4Tunnel() 

173 request['TunnelGuid'] = uuid.string_to_bin(tunnel_guid) 

174 

175 return dce.request(request)