Hide keyboard shortcuts

Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1# Impacket - Collection of Python classes for working with network protocols. 

2# 

3# SECUREAUTH LABS. Copyright (C) 2018 SecureAuth Corporation. All rights reserved. 

4# 

5# This software is provided under a slightly modified version 

6# of the Apache Software License. See the accompanying LICENSE file 

7# for more information. 

8# 

9# Description: 

10# [C706] Remote Management Interface implementation 

11# 

12# Best way to learn how to use these calls is to grab the protocol standard 

13# so you understand what the call does, and then read the test case located 

14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC 

15# 

16# Some calls have helper functions, which makes it even easier to use. 

17# They are located at the end of this file. 

18# Helper functions start with "h"<name of the call>. 

19# There are test cases for them too. 

20# 

21# Author: 

22# Alberto Solino (@agsolino) 

23# 

24from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray, NDRUniConformantVaryingArray 

25from impacket.dcerpc.v5.epm import PRPC_IF_ID 

26from impacket.dcerpc.v5.dtypes import ULONG, DWORD_ARRAY, ULONGLONG 

27from impacket.dcerpc.v5.rpcrt import DCERPCException 

28from impacket.uuid import uuidtup_to_bin 

29from impacket import nt_errors 

30 

31MSRPC_UUID_MGMT = uuidtup_to_bin(('afa8bd80-7d8a-11c9-bef4-08002b102989','1.0')) 

32 

33class DCERPCSessionError(DCERPCException): 

34 def __init__(self, error_string=None, error_code=None, packet=None): 

35 DCERPCException.__init__(self, error_string, error_code, packet) 

36 

37 def __str__( self ): 

38 key = self.error_code 

39 if key in nt_errors.ERROR_MESSAGES: 

40 error_msg_short = nt_errors.ERROR_MESSAGES[key][0] 

41 error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1] 

42 return 'MGMT SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose) 

43 else: 

44 return 'MGMT SessionError: unknown error code: 0x%x' % self.error_code 

45 

46################################################################################ 

47# CONSTANTS 

48################################################################################ 

49 

50class rpc_if_id_p_t_array(NDRUniConformantArray): 

51 item = PRPC_IF_ID 

52 

53class rpc_if_id_vector_t(NDRSTRUCT): 

54 structure = ( 

55 ('count',ULONG), 

56 ('if_id',rpc_if_id_p_t_array), 

57 ) 

58 structure64 = ( 

59 ('count',ULONGLONG), 

60 ('if_id',rpc_if_id_p_t_array), 

61 ) 

62 

63class rpc_if_id_vector_p_t(NDRPOINTER): 

64 referent = ( 

65 ('Data', rpc_if_id_vector_t), 

66 ) 

67 

68error_status = ULONG 

69################################################################################ 

70# STRUCTURES 

71################################################################################ 

72 

73################################################################################ 

74# RPC CALLS 

75################################################################################ 

76class inq_if_ids(NDRCALL): 

77 opnum = 0 

78 structure = ( 

79 ) 

80 

81class inq_if_idsResponse(NDRCALL): 

82 structure = ( 

83 ('if_id_vector', rpc_if_id_vector_p_t), 

84 ('status', error_status), 

85 ) 

86 

87class inq_stats(NDRCALL): 

88 opnum = 1 

89 structure = ( 

90 ('count', ULONG), 

91 ) 

92 

93class inq_statsResponse(NDRCALL): 

94 structure = ( 

95 ('count', ULONG), 

96 ('statistics', DWORD_ARRAY), 

97 ('status', error_status), 

98 ) 

99 

100class is_server_listening(NDRCALL): 

101 opnum = 2 

102 structure = ( 

103 ) 

104 

105class is_server_listeningResponse(NDRCALL): 

106 structure = ( 

107 ('status', error_status), 

108 ) 

109 

110class stop_server_listening(NDRCALL): 

111 opnum = 3 

112 structure = ( 

113 ) 

114 

115class stop_server_listeningResponse(NDRCALL): 

116 structure = ( 

117 ('status', error_status), 

118 ) 

119 

120class inq_princ_name(NDRCALL): 

121 opnum = 4 

122 structure = ( 

123 ('authn_proto', ULONG), 

124 ('princ_name_size', ULONG), 

125 ) 

126 

127class inq_princ_nameResponse(NDRCALL): 

128 structure = ( 

129 ('princ_name', NDRUniConformantVaryingArray), 

130 ('status', error_status), 

131 ) 

132 

133 

134################################################################################ 

135# OPNUMs and their corresponding structures 

136################################################################################ 

137OPNUMS = { 

138 0 : (inq_if_ids, inq_if_idsResponse), 

139 1 : (inq_stats, inq_statsResponse), 

140 2 : (is_server_listening, is_server_listeningResponse), 

141 3 : (stop_server_listening, stop_server_listeningResponse), 

142 4 : (inq_princ_name, inq_princ_nameResponse), 

143} 

144 

145################################################################################ 

146# HELPER FUNCTIONS 

147################################################################################ 

148def hinq_if_ids(dce): 

149 request = inq_if_ids() 

150 return dce.request(request) 

151 

152def hinq_stats(dce, count = 4): 

153 request = inq_stats() 

154 request['count'] = count 

155 return dce.request(request) 

156 

157def his_server_listening(dce): 

158 request = is_server_listening() 

159 return dce.request(request, checkError=False) 

160 

161def hstop_server_listening(dce): 

162 request = stop_server_listening() 

163 return dce.request(request) 

164 

165def hinq_princ_name(dce, authn_proto=0, princ_name_size=1): 

166 request = inq_princ_name() 

167 request['authn_proto'] = authn_proto 

168 request['princ_name_size'] = princ_name_size 

169 return dce.request(request, checkError=False)