Hide keyboard shortcuts

Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1# Impacket - Collection of Python classes for working with network protocols. 

2# 

3# SECUREAUTH LABS. Copyright (C) 2018 SecureAuth Corporation. All rights reserved. 

4# 

5# This software is provided under a slightly modified version 

6# of the Apache Software License. See the accompanying LICENSE file 

7# for more information. 

8# 

9# Description: 

10# [MS-TSCH] ATSVC Interface implementation 

11# 

12# Best way to learn how to use these calls is to grab the protocol standard 

13# so you understand what the call does, and then read the test case located 

14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC 

15# 

16# Some calls have helper functions, which makes it even easier to use. 

17# They are located at the end of this file. 

18# Helper functions start with "h"<name of the call>. 

19# There are test cases for them too. 

20# 

21# Author: 

22# Alberto Solino (@agsolino) 

23# 

24 

25from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray 

26from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, UCHAR, ULONG, LPDWORD, NULL 

27from impacket import hresult_errors 

28from impacket.uuid import uuidtup_to_bin 

29from impacket.dcerpc.v5.rpcrt import DCERPCException 

30 

31MSRPC_UUID_ATSVC = uuidtup_to_bin(('1FF70682-0A51-30E8-076D-740BE8CEE98B','1.0')) 

32 

33class DCERPCSessionError(DCERPCException): 

34 def __init__(self, error_string=None, error_code=None, packet=None): 

35 DCERPCException.__init__(self, error_string, error_code, packet) 

36 

37 def __str__( self ): 

38 key = self.error_code 

39 if key in hresult_errors.ERROR_MESSAGES: 

40 error_msg_short = hresult_errors.ERROR_MESSAGES[key][0] 

41 error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1] 

42 return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose) 

43 else: 

44 return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code 

45 

46################################################################################ 

47# CONSTANTS 

48################################################################################ 

49ATSVC_HANDLE = LPWSTR 

50# 2.3.1 Constant Values 

51CNLEN = 15 

52DNLEN = CNLEN 

53UNLEN = 256 

54MAX_BUFFER_SIZE = (DNLEN+UNLEN+1+1) 

55 

56# 2.3.7 Flags 

57TASK_FLAG_INTERACTIVE = 0x1 

58TASK_FLAG_DELETE_WHEN_DONE = 0x2 

59TASK_FLAG_DISABLED = 0x4 

60TASK_FLAG_START_ONLY_IF_IDLE = 0x10 

61TASK_FLAG_KILL_ON_IDLE_END = 0x20 

62TASK_FLAG_DONT_START_IF_ON_BATTERIES = 0x40 

63TASK_FLAG_KILL_IF_GOING_ON_BATTERIES = 0x80 

64TASK_FLAG_RUN_ONLY_IF_DOCKED = 0x100 

65TASK_FLAG_HIDDEN = 0x200 

66TASK_FLAG_RUN_IF_CONNECTED_TO_INTERNET = 0x400 

67TASK_FLAG_RESTART_ON_IDLE_RESUME = 0x800 

68TASK_FLAG_SYSTEM_REQUIRED = 0x1000 

69TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x2000 

70 

71################################################################################ 

72# STRUCTURES 

73################################################################################ 

74# 2.3.4 AT_INFO 

75class AT_INFO(NDRSTRUCT): 

76 structure = ( 

77 ('JobTime',DWORD), 

78 ('DaysOfMonth',DWORD), 

79 ('DaysOfWeek',UCHAR), 

80 ('Flags',UCHAR), 

81 ('Command',LPWSTR), 

82 ) 

83 

84class LPAT_INFO(NDRPOINTER): 

85 referent = ( 

86 ('Data',AT_INFO), 

87 ) 

88 

89# 2.3.6 AT_ENUM 

90class AT_ENUM(NDRSTRUCT): 

91 structure = ( 

92 ('JobId',DWORD), 

93 ('JobTime',DWORD), 

94 ('DaysOfMonth',DWORD), 

95 ('DaysOfWeek',UCHAR), 

96 ('Flags',UCHAR), 

97 ('Command',LPWSTR), 

98 ) 

99 

100class AT_ENUM_ARRAY(NDRUniConformantArray): 

101 item = AT_ENUM 

102 

103class LPAT_ENUM_ARRAY(NDRPOINTER): 

104 referent = ( 

105 ('Data',AT_ENUM_ARRAY), 

106 ) 

107 

108# 2.3.5 AT_ENUM_CONTAINER 

109class AT_ENUM_CONTAINER(NDRSTRUCT): 

110 structure = ( 

111 ('EntriesRead',DWORD), 

112 ('Buffer',LPAT_ENUM_ARRAY), 

113 ) 

114 

115################################################################################ 

116# RPC CALLS 

117################################################################################ 

118# 3.2.5.2.1 NetrJobAdd (Opnum 0) 

119class NetrJobAdd(NDRCALL): 

120 opnum = 0 

121 structure = ( 

122 ('ServerName',ATSVC_HANDLE), 

123 ('pAtInfo', AT_INFO), 

124 ) 

125 

126class NetrJobAddResponse(NDRCALL): 

127 structure = ( 

128 ('pJobId',DWORD), 

129 ('ErrorCode',ULONG), 

130 ) 

131 

132# 3.2.5.2.2 NetrJobDel (Opnum 1) 

133class NetrJobDel(NDRCALL): 

134 opnum = 1 

135 structure = ( 

136 ('ServerName',ATSVC_HANDLE), 

137 ('MinJobId', DWORD), 

138 ('MaxJobId', DWORD), 

139 ) 

140 

141class NetrJobDelResponse(NDRCALL): 

142 structure = ( 

143 ('ErrorCode',ULONG), 

144 ) 

145 

146# 3.2.5.2.3 NetrJobEnum (Opnum 2) 

147class NetrJobEnum(NDRCALL): 

148 opnum = 2 

149 structure = ( 

150 ('ServerName',ATSVC_HANDLE), 

151 ('pEnumContainer', AT_ENUM_CONTAINER), 

152 ('PreferedMaximumLength', DWORD), 

153 ('pResumeHandle', DWORD), 

154 ) 

155 

156class NetrJobEnumResponse(NDRCALL): 

157 structure = ( 

158 ('pEnumContainer', AT_ENUM_CONTAINER), 

159 ('pTotalEntries', DWORD), 

160 ('pResumeHandle',LPDWORD), 

161 ('ErrorCode',ULONG), 

162 ) 

163 

164# 3.2.5.2.4 NetrJobGetInfo (Opnum 3) 

165class NetrJobGetInfo(NDRCALL): 

166 opnum = 3 

167 structure = ( 

168 ('ServerName',ATSVC_HANDLE), 

169 ('JobId', DWORD), 

170 ) 

171 

172class NetrJobGetInfoResponse(NDRCALL): 

173 structure = ( 

174 ('ppAtInfo', LPAT_INFO), 

175 ('ErrorCode',ULONG), 

176 ) 

177 

178################################################################################ 

179# OPNUMs and their corresponding structures 

180################################################################################ 

181OPNUMS = { 

182 0 : (NetrJobAdd,NetrJobAddResponse ), 

183 1 : (NetrJobDel,NetrJobDelResponse ), 

184 2 : (NetrJobEnum,NetrJobEnumResponse ), 

185 3 : (NetrJobGetInfo,NetrJobGetInfoResponse ), 

186} 

187 

188################################################################################ 

189# HELPER FUNCTIONS 

190################################################################################ 

191def hNetrJobAdd(dce, serverName = NULL, atInfo = NULL): 

192 netrJobAdd = NetrJobAdd() 

193 netrJobAdd['ServerName'] = serverName 

194 netrJobAdd['pAtInfo'] = atInfo 

195 return dce.request(netrJobAdd) 

196 

197def hNetrJobDel(dce, serverName = NULL, minJobId = 0, maxJobId = 0): 

198 netrJobDel = NetrJobDel() 

199 netrJobDel['ServerName'] = serverName 

200 netrJobDel['MinJobId'] = minJobId 

201 netrJobDel['MaxJobId'] = maxJobId 

202 return dce.request(netrJobDel) 

203 

204def hNetrJobEnum(dce, serverName = NULL, pEnumContainer = NULL, preferedMaximumLength = 0xffffffff): 

205 netrJobEnum = NetrJobEnum() 

206 netrJobEnum['ServerName'] = serverName 

207 netrJobEnum['pEnumContainer']['Buffer'] = pEnumContainer 

208 netrJobEnum['PreferedMaximumLength'] = preferedMaximumLength 

209 return dce.request(netrJobEnum) 

210 

211def hNetrJobGetInfo(dce, serverName = NULL, jobId = 0): 

212 netrJobGetInfo = NetrJobGetInfo() 

213 netrJobGetInfo['ServerName'] = serverName 

214 netrJobGetInfo['JobId'] = jobId 

215 return dce.request(netrJobGetInfo)