Module: Msf::Exploit::Remote::DCERPC

Includes:
DCERPC_EPM, DCERPC_LSA, DCERPC_MGMT, Tcp
Included in:
SMB::Psexec
Defined in:
lib/msf/core/exploit/dcerpc.rb

Overview

This mixin provides utility methods for interacting with a DCERPC service on a remote machine. These methods may generally be useful in the context of exploitation. This mixin extends the Tcp exploit mixin. Only one DCERPC service can be accessed at a time using this class.

Constant Summary collapse

DCERPCPacket =

Alias over the Rex DCERPC protocol modules

Rex::Proto::DCERPC::Packet
DCERPCClient =
Rex::Proto::DCERPC::Client
DCERPCResponse =
Rex::Proto::DCERPC::Response
DCERPCUUID =
Rex::Proto::DCERPC::UUID
NDR =
Rex::Encoder::NDR

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from DCERPC_LSA

#lsa_open_policy

Methods included from DCERPC_MGMT

#dcerpc_mgmt_connect, #dcerpc_mgmt_inq_if_ids, #dcerpc_mgmt_inq_if_stats, #dcerpc_mgmt_inq_princ_name, #dcerpc_mgmt_is_server_listening, #dcerpc_mgmt_stop_server_listening

Methods included from DCERPC_EPM

#dcerpc_endpoint_find_tcp, #dcerpc_endpoint_find_udp, #dcerpc_endpoint_list

Methods included from Tcp

#chost, #cleanup, #connect, #connect_timeout, #cport, #disconnect, #handler, #lhost, #lport, #proxies, #rhost, #rport, #set_tcp_evasions, #ssl, #ssl_version

Instance Attribute Details

#dcerpcObject

Useful accessors for tracking DCERPC state


152
153
154
# File 'lib/msf/core/exploit/dcerpc.rb', line 152

def dcerpc
  @dcerpc
end

#handleObject

Useful accessors for tracking DCERPC state


152
153
154
# File 'lib/msf/core/exploit/dcerpc.rb', line 152

def handle
  @handle
end

Instance Method Details

#dcerpc_bind(h) ⇒ Object


66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# File 'lib/msf/core/exploit/dcerpc.rb', line 66

def dcerpc_bind(h)
  opts = { 'Msf' => framework, 'MsfExploit' => self }

  if datastore['DCERPC::max_frag_size']
    opts['frag_size'] = datastore['DCERPC::max_frag_size']
  end

  if datastore['DCERPC::fake_bind_multi']
    opts['fake_multi_bind'] = 1

    if datastore['DCERPC::fake_bind_multi_prepend']
      opts['fake_multi_bind_prepend'] = datastore['DCERPC::fake_bind_multi_prepend']
    end

    if datastore['DCERPC::fake_bind_multi_append']
      opts['fake_multi_bind_append'] = datastore['DCERPC::fake_bind_multi_append']
    end
  end

  opts['connect_timeout'] = (datastore['ConnectTimeout'] || 10).to_i

  opts['read_timeout']    = (datastore['DCERPC::ReadTimeout'] || 10).to_i


  # Configure the SMB evasion options

  if (datastore['SMBUser'])
    opts['smb_user'] = datastore['SMBUser']
  end

  if (datastore['SMBPass'])
    opts['smb_pass'] = datastore['SMBPass']
  end

  if (datastore['DCERPC::smb_pipeio'])
    opts['smb_pipeio'] = datastore['DCERPC::smb_pipeio']
  end

  if (datastore['SMB::pipe_write_min_size'])
    opts['pipe_write_min_size'] = datastore['SMB::pipe_write_min_size']
  end

  if (datastore['SMB::pipe_write_max_size'])
    opts['pipe_write_max_size'] = datastore['SMB::pipe_write_max_size']
  end

  if (datastore['SMB::pipe_read_min_size'])
    opts['pipe_read_min_size'] = datastore['SMB::pipe_read_min_size']
  end

  if (datastore['SMB::pipe_read_max_size'])
    opts['pipe_read_max_size'] = datastore['SMB::pipe_read_max_size']
  end

  if (self.respond_to?('simple') and self.simple)
    opts['smb_client'] = self.simple
  end

  # Create the DCERPC client
  self.dcerpc = Rex::Proto::DCERPC::Client.new(h, self.sock, opts)

  if (self.handle.protocol == 'ncacn_np' and not self.simple)
    self.simple = self.dcerpc.smb  # expose the simple client if we have access to it
  end
end

#dcerpc_call(function, stub = '', timeout = nil, do_recv = true) ⇒ Object


132
133
134
135
136
137
138
139
140
141
142
143
144
# File 'lib/msf/core/exploit/dcerpc.rb', line 132

def dcerpc_call(function, stub = '', timeout=nil, do_recv=true)
  otimeout = dcerpc.options['read_timeout']

  begin
    dcerpc.options['read_timeout'] = timeout if timeout
    dcerpc.call(function, stub, do_recv)
  rescue ::Rex::Proto::SMB::Exceptions::NoReply, Rex::Proto::DCERPC::Exceptions::NoResponse
    print_status("The DCERPC service did not reply to our request")
    return
  ensure
    dcerpc.options['read_timeout'] = otimeout
  end
end

#dcerpc_handle(uuid, version, protocol, opts) ⇒ Object


62
63
64
# File 'lib/msf/core/exploit/dcerpc.rb', line 62

def dcerpc_handle(uuid, version, protocol, opts)
  self.handle = Rex::Proto::DCERPC::Handle.new([uuid, version], protocol, rhost, opts)
end

#initialize(info = {}) ⇒ Object


36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# File 'lib/msf/core/exploit/dcerpc.rb', line 36

def initialize(info = {})
  super

  register_evasion_options(
    [
      OptInt.new('DCERPC::max_frag_size',   [ true, 'Set the DCERPC packet fragmentation size', 4096]),
      OptBool.new('DCERPC::fake_bind_multi', [ false, 'Use multi-context bind calls', true ]),
      OptInt.new('DCERPC::fake_bind_multi_prepend',  [ false, 'Set the number of UUIDs to prepend before the target', 0]),
      OptInt.new('DCERPC::fake_bind_multi_append',   [ false, 'Set the number of UUIDs to append the target', 0]),
      OptEnum.new('DCERPC::smb_pipeio', [ false, 'Use a different delivery method for accessing named pipes', 'rw', ['rw', 'trans']] )

    ], Msf::Exploit::Remote::DCERPC)

  register_options(
    [
      Opt::RHOST,
      Opt::RPORT(135),
    ], Msf::Exploit::Remote::DCERPC)

  register_advanced_options(
    [
      OptInt.new('DCERPC::ReadTimeout',   [ true, 'The number of seconds to wait for DCERPC responses', 10] )
    ], Msf::Exploit::Remote::DCERPC)

end

#unicode(str) ⇒ Object

Convert a standard ASCII string to 16-bit Unicode


147
148
149
# File 'lib/msf/core/exploit/dcerpc.rb', line 147

def unicode(str)
  Rex::Text.to_unicode(str)
end