
    hh                        d Z ddlZddlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlmZmZmZmZmZ ddl m!Z! ddl"m#Z# ddl$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*  G d	 d
e+          Z,ej-        ddi fdZ.dS )z!
DCE/RPC client as per [MS-RPCE]
    N)conf)DceRpc5DceRpc5AlterContextDceRpc5AlterContextRespDceRpc5Auth3DceRpc5BindDceRpc5BindAckDceRpc5BindNakDceRpc5ContextDceRpc5FaultDceRpc5RequestDceRpc5ResponseDceRpc5AbstractSyntaxDceRpc5TransferSyntaxDceRpcSocketDCERPC_Transportfind_dcerpc_interfaceCommonAuthVerifierDCE_C_AUTHN_LEVEL
NDRPointerNDRContextHandle)SSPGSS_S_FAILUREGSS_S_COMPLETEGSS_S_CONTINUE_NEEDEDGSS_C_FLAGS)STATUS_ERREF)SMB_RPC_SOCKET)ept_map_Requestept_map_Responsetwr_p_tprotocol_tower_tprot_and_addr_tUUIDc                       e Zd ZdZddZei fd            Zddi fd	Zd
 Zd Z	d Z
d Zd Zd Zd Zd Zd Zd Zd Zdi fdZd ZdS )DCERPC_Clientze
    A basic DCE/RPC client

    :param ndr64: Should ask for NDR64 when binding (default False)
    FlittleTc                 x   d | _         || _        t          |t                    s
J d            d| _        d| _        || _        || _        || _        |	                    dt          j                  | _        |	                    dd          | _        |	                    dd           | _        d | _        || _        d S )Nz'transport must be from DCERPC_Transportr   
auth_levelauth_context_idssp)sock	transport
isinstancer   call_idcont_idndr64	ndrendianverbpopr   NONEr)   r*   r+   
sspcontextdcesockargs)selfr-   r1   r2   r3   kwargss         a/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/layers/msrpce/rpcclient.py__init__zDCERPC_Client.__init__D   s    	"'
 
 	5 	54	5 	5 	5 
"	 **\3D3IJJ%zz*;Q??::eT**!    c                     t          t          j        fi |}t          |fi |x}|_        t          |t          f|j        |j        |j	        d|j
        |_        |S )zJ
        Build a DCERPC_Client from a SMB_Client.smblink directly
        r+   r)   r*   )r&   r   NCACN_NPr   
smbrpcsockr   r   r+   r)   r*   r7   r,   )clssmbcli
smb_kwargsr9   clientr,   s         r:   from_smblinkzDCERPC_Client.from_smblinkU   s    
 /8CCFCC#1&#G#GJ#G#GGv "
 
("2
 
  
 
 r<   N   c           
      Z   |G| j         t          j        k    rd}n/| j         t          j        k    rd}nt	          d| j         z            t          j                    }|                    |           | j        r+t          d|d|dt          | j                   d           |
                    ||f           | j        rNt          t          j                            d	t          |                                          z                       | j         t          j        k    r?t          j        |fd
| j        i|x}| _        t'          |t(          fi | j        | _        dS | j         t          j        k    r2t'          |t(          f| j        | j        | j        d| j        | _        dS dS )z'
        Initiate a connection
        N   i  z&Can't guess the port for transport: %su   ┃ Connecting to z	 on port z via z...u   └ Connected from %sr+   r>   )r-   r   NCACN_IP_TCPr?   
ValueErrorsocket
settimeoutr3   printreprconnectr   color_themegreengetsocknamer   from_tcpsockr+   r@   r   r   r7   r,   r)   r*   )r8   ipporttimeoutrC   r,   s         r:   rO   zDCERPC_Client.connectf   s    <~!1!>>>#3#<<< <t~M   }   9 	E22tttT$.11113   	b$Z   9 	 &&.d6F6F6H6H1I1II   
 >-666%3%@& &(&&0& & D4? %T7GGd6FGGDIII^/<<<$ H? $ 4  " DIII =<r<   c                 d    | j         rt          d           | j                                         d S )NzX Connection closed
)r3   rM   r,   closer8   s    r:   rX   zDCERPC_Client.close   s3    9 	+)***	r<   c           	          | xj         dz  c_         t          | j         d| j        |                    dd                     |z  }d|v r|                    d          |_         | j        j        |fddi|S )N   PFC_FIRST_FRAG+PFC_LAST_FRAGauth_verifierr/   	pfc_flagsendianr]   r_   verboser   )r/   r   r2   r4   r_   r,   sr1r8   pktr9   s      r:   rb   zDCERPC_Client.sr1   s    8~$jj$??	    	 &  "JJ{33CMty}S66!6v666r<   c           	          | xj         dz  c_         t          | j         d| j        |                    dd                     |z  }d|v r|                    d          |_         | j        j        |fi |S )Nr[   r\   r]   r^   r_   )r/   r   r2   r4   r_   r,   sendrc   s      r:   rf   zDCERPC_Client.send   s    8~$jj$??	    	 &  "JJ{33CMty~c,,V,,,r<   c           	      >   | j         r9t          t          j                            d|j        j        z                        | j        t          | j	        t          |                    |z  fi |}t          |v rb| j         rIt          t          j                            d|t                   j        j        j        z                       |t                   j        S | j         r7t          |v r+|t                   j        rNt          |t                   j        t          j                  s$|t                   j                                         |j        dk    r-t          t          j                            d                     n|j        dk    r-t          t          j                            d                     n[t          t          j                            dt)          j        |j        d	          z                       |                                 d S |S )
Nz>> REQUEST: %s)r0   
alloc_hintz<< RESPONSE: %srF   ! nca_s_fault_access_denied!  :! nca_s_fault_sec_pkg_error (error in checksum/encryption)! %sFailure)r3   rM   r   rP   opening	__class____name__rb   r   r0   lenr   successpayloadr   r.   	raw_layershowstatusfailr   get)r8   rd   r9   resps       r:   sr1_reqzDCERPC_Client.sr1_req   s   9 	W$"**+;cm>T+TUUVVVtx4<CHHEEEK
 

 
 d""y $,,)08BKM    (00y 4''L)1 :*\*2DN; ; : \*277999{j00d.334QRRSSSS
22 ,11!A      ,11 &)9$+y)Q)Q Q   
 		Kr<   c                    t          dt          |j        |j                  t	          dd          g          g| j        rt          dt          |j        |j                  t	          dd          g          t          dt          |j        |j                  t	          t          j        d          d          g          gng z   S )	Nr   )if_uuid
if_versionNDR 2.0   )r0   abstract_syntaxtransfer_syntaxesr[   NDR64z$6cb71c2c-9812-4540-0300-000000000000)r   r   uuidr}   r   r1   r$   r8   	interfaces     r:   get_bind_contextzDCERPC_Client.get_bind_context   s.    5%N(3! ! !
 * )#$  #  
Z z;$9 )#,#7% % %
 .$+'(  '   $9 )#,#7% % %
 .$(I.T$U$U'(  '   < ]/
 /	
r<   c           
         | j         rUt          t          j                            d|j        d|| j        rd| j        j        j        z  ndz                        | j        r*| j        t          j
        k    rR| j        t          j        k     r=|                      ||                     |                    d           }t           }n| j                            | j        t&          j        t&          j        z  t&          j        z  t&          j        z  | j        t          j        k    rt&          j        ndz  | j        t          j        k    rt&          j        ndz            \  | _        }}|t6          t           fvr| j                                         d	S |                      ||                     |                    | j        sd n&t;          | j        j        | j        | j        |
          d| j        | j         j!        j"        rdndz             }||vr
d }tF          }n4| j                            | j        |j$        j%                  \  | _        }}|t6          t           fv r/|rv| j        &                    | j                  dz  dk    rP| '                    tQ                      t;          | j        j        | j        | j        |
                     t           }n|rtR          }|                     tU          |                     |                    t;          | j        j        | j        | j        |
                    }||vrtF          }nE|j$        t           }n6| j                            | j        |j$        j%                  \  | _        }}||t           k    r||v rtW          d |j,        d t[          | j.                  dz            D                       rd| _/        |j0        j1        2                                }| j         j!        j.        rdpd}t[          | j         j!        j.                  | _3        | j         r:t          t          j        4                    d|j         d| d|                      | j        | j         j!        _        dS | j         r7tj          |v r|6                    d          }	t          t          j        7                    d|	z                       tj          |v r`|tj                   j8        rNts          |tj                   j8        t          j:                  s$|tj                   j8        ;                                 ntx          |v r5|j=        dk    r-t          t          j        7                    d                     n|j=        dk    r-t          t          j        7                    d                     n[t          t          j        7                    dt}          j?        |j=        d          z                       |;                                 tx          |v r`|tx                   j8        rNts          |tx                   j8        t          j:                  s$|tx                   j8        ;                                 n@t          t          j        7                    d                      |;                                 d	S )!Nz>> z on z
 (with %s) )context_elem)r]   r   )	req_flagsF)	auth_typer)   r*   
auth_valuer\   z+PFC_SUPPORT_HEADER_SIGN)r]   r_   )valr   r[   c              3   ,   K   | ]}|j         d k    V  dS )r   N)result.0xs     r:   	<genexpr>z&DCERPC_Client._bind.<locals>.<genexpr>  s(      OOaAHMOOOOOOr<   r   NDR32z<< z port 'z' using Tz6reject_reason: %DceRpc5BindNak.provider_reject_reason%z! Bind_nak (%s)rF   ri   rj   rk   rl   rm   z	! Failure)@r3   rM   r   rP   rn   rp   r+   ro   r-   r   r?   r)   r   PKT_INTEGRITYrb   r   r   GSS_Init_sec_contextr6   r   GSS_C_DCE_STYLEGSS_C_REPLAY_FLAGGSS_C_SEQUENCE_FLAGGSS_C_MUTUAL_FLAGGSS_C_INTEG_FLAGPKT_PRIVACYGSS_C_CONF_FLAGr   
clifailurer   r   r*   r,   sessionsupport_header_signingr   r]   r   
LegsAmountrf   r   r   r   anyresultsintr1   r/   sec_addr	port_specdecoder0   rr   r
   sprintfrw   rs   r.   rt   ru   r   rv   r   rx   )
r8   r   reqclsrespclsry   rv   tokenrU   ndrerr_msgs
             r:   _bindzDCERPC_Client._bind  s   9 	 (((%+___ii@EIXU|dh&8&AAASUW    x m	N.777"3"AAA 88D$9$9)$D$DEEE"   D $FF .2X-J-J  /!34!56 "34  ?.?.MMM $44  ?.?.KKK $33 .K . .*DOUF* 3^DDD**,,,u88D$9$9)$D$DEEE  ?DD+"&("4#'?(,(<#(	   3  8/ I-D 0 32     D. d""& 261N1NO);)F 2O 2 2. /@@@ &TX00AAAEJJ II$&8&*h&8'+,0,@',	' ' '     ,FF
   "9#xx/-1-B-B9-M-M   +=*.(*<+/?040D+0	+ + +	  ( 
  
  #$..%2F!-5%3F!9=9V9V O1C1N :W : :6'   0 n$$4OO4<8M#dj//A:M8M+NOOOOO   DL=*1133D)#)5g@Cty0677DLy $,,Jg.JJtJJSJJ   
 ,0?DI(4y # !T))"llP G $*//0AG0KLLMMM%--/7 @
 08$.A A @ !08==???!T)){j00d.334QRRSSSS
22 ,11!A      ,11 &)9$+y)Q)Q Q   
 		#t++-5 >j .6? ? > !.6;;===$*//<<===IIKKK5r<   c                 D    |                      |t          t                    S )z1
        Bind the client to an interface
        )r   r   r	   r   s     r:   bindzDCERPC_Client.bind  s     zz)[.AAAr<   c                 D    |                      |t          t                    S )z>
        Alter context: post-bind context negotiation
        )r   r   r   r   s     r:   alter_contextzDCERPC_Client.alter_context  s     zz)%8:QRRRr<   c                     | j         j        j        s|                     |           dS |                     |           dS )zW
        Bind the client to an interface or alter the context if already bound
        N)r,   r   rpc_bind_interfacer   r   r   s     r:   bind_or_alterzDCERPC_Client.bind_or_alter  sH     y 3 	*IIi      y)))))r<   c                 x    | j                             d          | _        | j                             |           dS )zB
        Open a certain filehandle with the SMB automaton
        zIPC$N)r@   tree_connectipc_tid	open_pipe)r8   names     r:   open_smbpipezDCERPC_Client.open_smbpipe  s7     33F;;!!$'''''r<   c                     | j                             | j                   | j                                          | j                                          dS )z2
        Close the previously opened pipe
        N)r@   set_TIDr   
close_pipetree_disconnectrY   s    r:   close_smbpipezDCERPC_Client.close_smbpipe  sJ     	---""$$$'')))))r<   c                    | j         t          j        k    rEt          ||| j        | j                  }|r|d         \  }}ndS |                     ||           n| j         t          j        k    rqt          ||| j         | j        | j        |          }|r|d                             d          }ndS |                     |||           | 	                    |           | 
                    |           dS )z
        Asks the Endpoint Mapper what address to use to connect to the interface,
        then uses connect() followed by a bind()
        )r2   r3   r   N)rU   )r-   r2   r3   rC   z\pipe\)rU   rC   )r-   r   rI   get_endpointr2   r3   rO   r?   lstripr   r   )r8   rT   r   rU   rC   	endpointspipenames          r:   connect_and_bindzDCERPC_Client.connect_and_bind  s    >-::: %.Y	  I  $Q<DDLL$L''''^/888 %..Y%  I  $Q<..z::LL$:L>>>h'''		)r<   c                    | j         rd}d}nd}d}|                     t          t          dt	          dddd                    t          dt          t          t          t          d	d
|j	        |j
        d|j                  t          d	d
||dd          t          dddd          t          j        t          dddd          t          j        t          dddd          i| j                 t          j        t          dddd          t          j        t          dddd          i| j                 g                                        t!          dd          d| j         | j                            }|rt$          |v r|t$                   j        }|dk    rd |t$                   j        j        d         j        D             }g }|D ]c}|j        d         j	        |j	        k    r:| j        r,t1          t2          j                            d                     t8          |j        d                             d           |k    r:| j        r,t1          t2          j                            d!                     t8          | j        t          j        k    r9|                    |j        d         j        |j        d"         j        f           | j        t          j        k    rJ|                    |j        d"         j                             d#          !                                           e|S |d$k    rN| j        r@|"                                 t1          t2          j                            d%                     t8          t1          t2          j                            d&                     |r|"                                 t9          d'          )(z6
        Calls ept_map (the EndPoint Manager)
        r   r[   r~   r   r   N)Data1Data2Data3Data4)referent_idvalue      )
lhs_lengthprotocol_identifierr   version
rhs_lengthrhsz RPC connection-oriented protocol)r   r   r   r   rI   rH   r?   s   0 IP   z0.0.0.0NCACN_NB
   s
   127.0.0.1 )floors)tower_octet_strings                   )
attributesr   i  )obj	map_towerentry_handle
max_towersr1   r2   c                 @    g | ]}t          |j        j                  S  )r"   r   r   r   s     r:   
<listcomp>z)DCERPC_Client.epm_map.<locals>.<listcomp>~  s5        %QW%?@@  r<   z-! Server answered with a different interface.z%uuid%z/! Server answered with a different NDR version.       i֠zU! Server errored: 'There are no elements that satisfy the specified search criteria'.z
! Failure.zEPM Map failed)#r1   rz   r   r   r$   r!   bytesr"   r#   r   major_versionminor_versionr   rI   r?   r-   r   r2   r    rv   ITowersr   r   r3   rM   r   rP   rw   rJ   r   appendr   rstripr   ru   )	r8   r   ndr_uuidndr_versionrd   rv   towersr   ts	            r:   epm_mapzDCERPC_Client.epm_map  sy    : 	HKK HKll !"	     % !!+0,$335<?-6^090G34,5,C%& %& %& %435<?-50;34,-%& %& %& %434<^34,-	%& %& %& )9(E,;;<DR;<47	-. -. -. )9(A,;;<DN;<4<	-. -. -.%&" '+n#%6& )9(E,;;<DH;<4=	-. -. -. )9(A,;;<DN;=4D	-. -. -.%&" '+n#%6S;("= = =?, ?,A A AD D DJ . %   j.kV V VX
 X
r  )	!#s**)*1F##  !12:@CI  
 	 S SAx{'9>999 ! $ 0 5 5$S!" !"  
 )(x{**844@@9 ! $ 0 5 5$U!" !"  
 )(~)9)FFF!((!(1+/18A;?)KLLLL+;+DDD!((!)?)?)H)H)O)O)Q)QRRR  :%%9 HHJJJ(--?    ! d##L11222 	HHJJJ)***r<   )Fr'   T)rp   
__module____qualname____doc__r;   classmethodrE   rO   rX   rb   rf   rz   r   r   r   r   r   r   r   r   r   r   r<   r:   r&   r&   =   sU        " " " "" -/    [   $Q2 ) ) ) )V  
7 7 7- - -) ) )V0
 0
 0
dn n n`B B BS S S	* 	* 	*( ( (* * * . . . .`P+ P+ P+ P+ P+r<   r&   r'   Tc                 :   t          |d||          }|                    | |           |t          j        k    r|                    d           |                    t          d                     |                    |          }|                                 |S )z
    Call the endpoint mapper on a remote IP to find an interface

    :param ip:
    :param interface:
    :param mode:
    :param verb:

    :return: a list of connection tuples for this interface
    F)r1   r2   r3   )rC   epmapperept)	r&   rO   r   r?   r   r   r   r   rX   )rT   r   r-   r2   r3   rC   rD   r   s           r:   r   r     s    $ 	  F NN2*N---$---J'''
KK%e,,---y))I
LLNNNr<   )/r   r   rK   scapy.configr   scapy.layers.dcerpcr   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   scapy.layers.gssapir   r   r   r   r   scapy.layers.smb2r   scapy.layers.smbclientr   scapy.layers.msrpce.eptr   r    r!   r"   r#   r$   objectr&   rI   r   r   r<   r:   <module>r      s;                                                      .              + * * * * *     
               j	+ j	+ j	+ j	+ j	+F j	+ j	+ j	+` +	     r<   