
    h:                        d Z ddlZddlZddlmZ ddlmZmZ ddlm	Z	m
Z
mZmZmZmZmZmZmZmZ ddlmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$ ddl%m&Z&m'Z' ddl(m)Z)m*Z*m+Z+m,Z, dJd
Z-dJdZ. ej/        d          Z0 ej/        d          Z1 ej/        d          Z2 ej/        d          Z3 ej/        d          Z4 ej/        d          Z5 ej/        d          Z6 ej/        d          Z7 ej/        d          Z8 ej/        d          Z9 ej/        d          Z: ej/        d          Z; ej/        d          Z< ej/        d          Z= ej/        d          Z> ej/        d          Z? ej/        d          Z@ ej/        d          ZA G d de          ZB G d d e          ZC G d! d"e          ZD G d# d$e          ZE G d% d&e          ZF G d' d(e          ZG G d) d*e          ZH G d+ d,e          ZI G d- d.e          ZJ G d/ d0e          ZKd1 ZL G d2 d3e          ZM G d4 d5e          ZN G d6 d7e          ZO G d8 d9e          ZP G d: d;e!          ZQ G d< d=e          ZR G d> d?e          ZS G d@ dAe          ZT G dB dCe          ZU G dD dEe          ZV eeSeTdFG            G dH dIe&          ZWdS )Kzw
[MS-DCOM]

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0
    N)conf)Packetbind_layers)
ConditionalField
LEIntFieldLEShortEnumFieldLEShortFieldPacketFieldPacketListFieldStrNullFieldUtf16	UUIDFieldXStrFixedLenFieldXShortField)NDRFieldListFieldNDRIntFieldNDRLongField	NDRPacketNDRPacketFieldNDRFullPointerFieldNDRConfPacketListFieldNDRConfFieldListFieldNDRConfStrLenFieldUtf16NDRConfVarStrNullFieldUtf16NDRShortFieldNDRSignedIntFieldNDRSerializeType1PacketField NDRSerializeType1PacketListFieldndr_deserialize1find_dcerpc_interfaceRPC_C_AUTHN)DCERPC_ClientDCERPC_Transport)
COMVERSIONGUIDServerAlive2_RequestMInterfacePointerlittlec                     |dk    rt          j        |           j        S |dk    rt          j        |           j        S t	          d          )Nr'   bigbad ndrendian)uuidUUIDbytes_lebytes
ValueErrorx	ndrendians     ^/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/layers/msrpce/msdcom.py_uid_to_bytesr4   :   sH    Hy||$$	e		y||!!)))    c                     |dk    rt          j        |           S |dk    rt          j        |           S t          d          )Nr'   )r-   r)   )r.   r*   )r+   r,   r/   r0   s     r3   _uid_from_bytesr7   C   sL    Hy!$$$$	e		yq!!!!)))r5   z$000001a5-0000-0000-c000-000000000046z$00000338-0000-0000-c000-000000000046z$00000339-0000-0000-c000-000000000046z$00000334-0000-0000-c000-000000000046z$0000033b-0000-0000-c000-000000000046z$0000031c-0000-0000-c000-000000000046z$0000031b-0000-0000-c000-000000000046z$000001ad-0000-0000-c000-000000000046z$000001ab-0000-0000-c000-000000000046z$000001b6-0000-0000-c000-000000000046z$000001aa-0000-0000-c000-000000000046z$000001a6-0000-0000-c000-000000000046z$000001a4-0000-0000-c000-000000000046z$000001b9-0000-0000-c000-000000000046z$000001A2-0000-0000-C000-000000000046z$000001A3-0000-0000-C000-000000000046z$000001c0-0000-0000-C000-000000000046c                   0   e Zd ZdZ ed e            e           edd           edd           edd           edd           edd           e e	d	 e            ged
           d           edd           ed e
            e
          g	ZdS )InstantiationInfoData      classIdclassCtxr   	actvflagsfIsSurrogatecIIDinstFlagpIIDc                     | j         S N)rA   pkts    r3   <lambda>zInstantiationInfoData.<lambda>r       sx r5   
count_fromTdeferredthisSizeclientCOMVersionN)__name__
__module____qualname__	ALIGNMENTr   r$   r   r   r   r   r#   fields_desc r5   r3   r9   r9   g   s        Iy$$&&$//J""K##.!,,FAJ""""$3G3G   		
 	
 	
 	J"")::<<DDKKKr5   r9   c                   L   e Zd ZdZ edd           edd           edd           edd           edd           ed e            e           ed	d           ed
d           edd           edd           edd           e	dg  edd          d           gZ
dS )SpecialPropertiesDatar<   r<   dwSessionIdr   fRemoteThisSessionIdfClientImpersonatingfPartitionIDPresentdwDefaultAuthnLvlguidPartition
dwPRTFlagsdwOrigClsctxdwFlags	Reserved1	Reserved2	Reserved3 c                     dS )N   rU   )_s    r3   rH   zSpecialPropertiesData.<lambda>   s    TU r5   rJ   N)rP   rQ   rR   rS   r   r   r   r$   r   r   rT   rU   r5   r3   rW   rW   ~   s        IM1%%0!440!44/33'++55L!$$NA&&Iq!!K##[!$$+r;;r1+=+=++VVVKKKr5   rW   c            
           e Zd ZdZ e edd          d           edd           e ed e            e          d           e ed	 e            e          d          gZ	d
S )InstanceInfoDatar:   fileNamere   TrL   moder   ifdROTifdStgN)
rP   rQ   rR   rS   r   r   r   r   r&   rT   rU   r5   r3   rj   rj      s        I77
BGGRVWWWFAN8%6%6%8%8:KLL	
 	
 	
 	N8%6%6%8%8:KLL	
 	
 	
KKKr5   rj   c            	       t    e Zd ZdZ edd           edd           e eddd           d	
          gZdS )customREMOTE_REQUEST_SCM_INFOr:   ClientImpLevelr   cRequestedProtseqspRequestedProtseqsre   c                     | j         S rE   )rr   rF   s    r3   rH   z&customREMOTE_REQUEST_SCM_INFO.<lambda>   s	    #BX r5   length_fromTrL   N)	rP   rQ   rR   rS   r   r   r   r   rT   rU   r5   r3   rp   rp      st        I$a((*A..##$b6X6X   		
 	
 	
	KKKr5   rp   c                       e Zd ZdZ e edd          d           e ed e            e          d          gZdS )ScmRequestInfoDatar:   pdwReservedr   TrL   remoteRequestN)	rP   rQ   rR   rS   r   r   r   rp   rT   rU   r5   r3   rx   rx      st        IKKq99DIIIN--//- 
 	
 	
 	

KKKr5   rx   c                       e Zd ZdZ edd           edd           edd           edd           e ed e            e          d	           e ed
 e            e          d	          gZ	dS )ActivationContextInfoDatar:   clientOKr   
bReserved1dwReserved1dwReserved2pIFDClientCtxTrL   pIFDPrototypeCtxN)
rP   rQ   rR   rS   r   r   r   r   r&   rT   rU   r5   r3   r|   r|      s        I*a((,**M1%%M1%%N?,=,=,?,?ARSS	
 	
 	
 	N-/@/@/B/BDUVV	
 	
 	
KKKr5   r|   c                       e Zd ZdZ e edd          d           edd           edd           ed	d          gZd
S )LocationInfoDatar:   machineNamere   TrL   	processIdr   apartmentId	contextIdN)rP   rQ   rR   rS   r   r   r   rT   rU   r5   r3   r   r      sp        I''r::T	
 	
 	
 	K##M1%%K##KKKr5   r   c                       e Zd ZdZ edd           e edd          d           e edd          d           ed	d          gZd
S )COSERVERINFOr:   r   r   pwszNamere   TrL   ry   r   N)rP   rQ   rR   rS   r   r   r   rT   rU   r5   r3   r   r      sy        IM1%%77
BGGRVWWWKKq99DIIIM1%%	KKKr5   r   c                       e Zd ZdZ edd           e ed e            e          d           e edd          d          gZdS )	SecurityInfoDatar:   dwAuthnFlagsr   pServerInfoTrL   ry   N)	rP   rQ   rR   rS   r   r   r   r   rT   rU   r5   r3   r   r      sy        INA&&N=,,..,GGRV	
 	
 	
 	KKq99DIIIKKKr5   r   c                   b    e Zd ZdZdZ edd           edd           eddd 	          gZd
S )DUALSTRINGARRAYr:      wNumEntriesr   wSecurityOffsetaStringArrayre   c                     | j         S rE   )r   rF   s    r3   rH   zDUALSTRINGARRAY.<lambda>	  s     r5   ru   N)rP   rQ   rR   rS   CONFORMANT_COUNTr   r   rT   rU   r5   r3   r   r     s_        ImQ'''++B,G,G	
 	
 	
KKKr5   r   c                 &   t          dg t                    }t          dg t                    }|                    | | j        d| j        dz                     d         }|                    | | j        | j        dz  d                   d         }||fS )z
    Process aStringArray
    re   N   r   )r   STRINGBINDINGSECURITYBINDINGgetfieldr   r   )selfstr_fldsec_fldstringsecss        r3   _parseStringArrayr     s     b"m44Gb"o66GdD$56P8Lq8P6P$QRRSTUFD$"3D4H14L4N4N"OPPQRSD4<r5   c            	           e Zd ZdZ edd           e ed e            e          d           ed e            e           e	dd           ed	 e
            e
          gZd
S )customREMOTE_REPLY_SCM_INFOrX   Oxidr   pdsaOxidBindingsTrL   ipidRemUnknown	authnHintserverVersionN)rP   rQ   rR   rS   r   r   r   r   r$   r   r#   rT   rU   r5   r3   r   r     s        IVQN-/@/@/RR	
 	
 	
 	'66K##

jAA	KKKr5   r   c                       e Zd ZdZ e edd          d           e ed e            e          d          gZdS )ScmReplyInfoDatar:   ry   r   TrL   remoteReplyN)	rP   rQ   rR   rS   r   r   r   r   rT   rU   r5   r3   r   r   '  st        IKKq99DIIIN++--+ 
 	
 	
 	

KKKr5   r   c                       e Zd ZdZ edd           e ed e            ged           d           e ed	g  e	d
d          d           d           e ed e
            ge
d           d          gZdS )PropsOutInfor:   cIfsr   piidc                     | j         S rE   r   rF   s    r3   rH   zPropsOutInfo.<lambda>?  rI   r5   rJ   TrL   	phresultsre   c                     | j         S rE   r   rF   s    r3   rH   zPropsOutInfo.<lambda>H      sx r5   
ppIntfDatac                     | j         S rE   r   rF   s    r3   rH   zPropsOutInfo.<lambda>Q  r   r5   N)rP   rQ   rR   rS   r   r   r   r$   r   r   r&   rT   rU   r5   r3   r   r   9  s       IFA""$3G3G   		
 	
 	
 	!!!!"a((//	   	
 	
 	
 	""""$$%!//	   	
 	
 	
#KKKr5   r   c                   f   e Zd ZdZ edd           edd           edd           edd           edd           ed e            e           e ed	 e            ged
           d           e e	dg  edd          d           d           e edd          d          g	Z
dS )CustomHeaderr:   	totalSizer   
headerSize
dwReserveddestCtxr   classInfoClsidpclsidc                     | j         S rE   r   rF   s    r3   rH   zCustomHeader.<lambda>f  s     r5   rJ   TrL   pSizesre   c                     | j         S rE   r   rF   s    r3   rH   zCustomHeader.<lambda>l  s     r5   ry   N)rP   rQ   rR   rS   r   r   r$   r   r   r   rT   rU   r5   r3   r   r   [  s,       IK##L!$$L!$$Iq!!FA'66""4466(D5I5I   		
 	
 	
 	!!"kk"a00=Q=Q   		
 	
 	
 	KKq99DIII'KKKr5   r   c                   $     e Zd Z fdZd Z xZS )_ActivationPropertiesFieldc                 \    | j         |d<    t          t          |           j        |i | d S )Nnext_cls_cb)_get_cls_activationsuperr   __init__r   argskwargs	__class__s      r3   r   z#_ActivationPropertiesField.__init__u  s9     $ 8}8($//8$I&IIIIIr5   c                   	 |j         j        j        j        j        }|j         j        j        }t          |          t          t          |                    z   }|t          |          k    rd S t          ||         |          }t          t          t          t          t          t          t          t           t"          t$          t&          t(          t*          t,          t.          t0          t2          t4          i	|         		fdS )N)r2   c                 (    t          | d          S )NFndr64)r   )r1   clss    r3   rH   z@_ActivationPropertiesField._get_cls_activation.<locals>.<lambda>  s    )!S>>> r5   )r   datar   valuer2   lenintboolr7   CLSID_ActivationContextInfor|   CLSID_InstanceInforj   CLSID_InstantiationInfor9   CLSID_PropsOutInfor   CLSID_ScmReplyInfor   CLSID_ScmRequestInforx   CLSID_SecurityInfor   CLSID_ServerLocationInfor   CLSID_SpecialSystemPropertiesrW   )
r   rG   lstcurremainr   r2   inext_uidr   s
            @r3   r   z._ActivationPropertiesField._get_cls_activationz  s    !&-39$)3	HHs499~~%FF"6!9	BBB ()B 0#%: 0 "4 0$&6)+@

 
 ?>>>>r5   )rP   rQ   rR   r   r   __classcell__r   s   @r3   r   r   t  sL        J J J J J
? ? ? ? ? ? ?r5   r   c                       e Zd Z edd           edd           ed e            e           edg           gZd ZdS )ActivationPropertiesBlobdwSizer   r   r   Propertyc                     t           j        S rE   r   padding_layerr   payloads     r3   default_payload_classz.ActivationPropertiesBlob.default_payload_class      !!r5   N)	rP   rQ   rR   r   r   r   r   rT   r   rU   r5   r3   r   r     sp        
8Q
<##$$^\\^^\RR"":r22	K" " " " "r5   r   c                   \    e Zd Z eddd           edd           eded          gZdS )	OBJREF	signatures   MEOWr;   )lengthflagsiid   N)rP   rQ   rR   r   r   IID_IActivationPropertiesInrT   rU   r5   r3   r   r     sO        +wq999
7D!!%!<RHHHKKKr5   r   c                   |    e Zd Z ede           edd           edd           ed e            e          gZdS )OBJREF_CUSTOMclsidcbExtensionr   reservedpObjectDataN)	rP   rQ   rR   r   CLSID_ActivationPropertiesInr   r
   r   rT   rU   r5   r3   r   r     sd        	'788
=!$$
:q!!33557O	
 	
	KKKr5   r   c                   D    e Zd Z edd           edd          gZd ZdS )r   wTowerIdr   aNetworkAddrre   c                     t           j        S rE   r   r   s     r3   r   z#STRINGBINDING.default_payload_class  r   r5   N)rP   rQ   rR   r	   r   rT   r   rU   r5   r3   r   r     sI        Z##."--K
" " " " "r5   r   c                       e Zd Z edde           e edd          d            e edd          d           gZd	 Z	d
S )r   	wAuthnSvcr   Reservedi  c                     | j         S rE   r  rF   s    r3   rH   zSECURITYBINDING.<lambda>  s    cm r5   
aPrincNamere   c                     | j         S rE   r
  rF   s    r3   rH   zSECURITYBINDING.<lambda>  s    S] r5   c                     t           j        S rE   r   r   s     r3   r   z%SECURITYBINDING.default_payload_class  r   r5   N)
rP   rQ   rR   r   r    r   r   r   rT   r   rU   r5   r3   r   r     s        a55Z88:S:STTlB//1J1J	
 	
K" " " " "r5   r   r;   )r   c                   4     e Zd ZdZd fd	Z fdZd Z xZS )DCOM_Clienta_  
    A wrapper of DCERPC_Client that adds functions to use COM interfaces.

    In this client, the DCE/RPC is abstracted to allow to focus on the upper
    DCOM one. DCE/RPC interfaces are bound automatically and ORPCTHIS/ORPCTHAT
    automatically added/extracted.

    It also provides common handlers for the few [MS-DCOM] special interfaces.
    Tc                 d     t          t          |           j        t          j        fd|d| d S )NF)r   verb)r   r  r   r"   NCACN_IP_TCP)r   r  r   r   s      r3   r   zDCOM_Client.__init__  sK    )k4  ))	
16T	
 	
EK	
 	
 	
 	
 	
r5   c                 t    |                     dd            t          t          |           j        |i | d S )Nport   )
setdefaultr   r  connectr   s      r3   r  zDCOM_Client.connect  sA    &#&&&(k4  ($9&99999r5   c                    |                      t          d                     |                     t          d                    }t	          |j        j                  \  }}t          j        dddg          }g }g }|D ](}|j	        dk    r|
                    |j                   )|D ]?}|
                    |                    d          |j        r
d	|j        z  pd
           @ |||          S )z4
        Call IObjectExporter::ServerAlive2
        IObjectExporterFr   DCOMResults	addressessspsr   z%wAuthnSvc%z%s/re   )bind_or_alterr   sr1_reqr%   r   ppdsaOrBindingsr   collections
namedtupler  appendr  sprintfr  )r   respbindsr   r  r  r  bs           r3   ServerAlive2zDCOM_Client.ServerAlive2  s    	01BCCDDD||0u===>>'(<(BCCt!,][&<QRR	 	- 	-AzQQ^,,,, 	 	AKK IIm,,,L9UQ\%9?R?    {9d+++r5   )T)rP   rQ   rR   __doc__r   r  r'  r   r   s   @r3   r  r    so         
 
 
 
 
 

: : : : :, , , , , , ,r5   r  )r'   )Xr(  r   r+   scapy.configr   scapy.packetr   r   scapy.fieldsr   r   r   r	   r
   r   r   r   r   r   scapy.layers.dcerpcr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    scapy.layers.msrpce.rpcclientr!   r"   scapy.layers.msrpce.raw.ms_dcomr#   r$   r%   r&   r4   r7   r,   r   r  CLSID_ActivationPropertiesOutCLSID_CONTEXT_EXTENSIONCLSID_ContextMarshalerCLSID_ERROR_EXTENSIONCLSID_ErrorObjectr   r   r   r   r   r   r   r   r   IID_IActivationPropertiesOutIID_IContextr9   rW   rj   rp   rx   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  rU   r5   r3   <module>r6     s               , , , , , , , ,                                                            & J I I I I I I I           * * * ** * * * (di(NOO (ty)OPP  )	*P Q Q #$)$JKK "#IJJ !	"HII DIDEE TYEFF #$)$JKK TYEFF TYEFF  ty!GHH TYEFF $49%KLL  )	*P Q Q  (di(NOO (ty)OPP ty?@@
    I   .    I   *    y   &    I          $    	   *	 	 	 	 	y 	 	 	    9       y   	 	 	 	 	i 	 	 	      )       y   $    9   D    9   2? ? ? ? ?!A ? ? ?8	" 	" 	" 	" 	"v 	" 	" 	"    V       F   " " " " "F " " "
" 
" 
" 
" 
"f 
" 
" 
" FM + + + +*, *, *, *, *,- *, *, *, *, *,r5   