Module: Msf::Exploit::Remote::DCERPC

Includes:
DCERPC_EPM, DCERPC_LSA, DCERPC_MGMT, Tcp
Included in:
SMB::Client::Psexec, SMB::Client::WebExec
Defined in:
lib/msf/core/exploit/dcerpc.rb

Overview

This mixin provides utility methods for interacting with a DCERPC service on a remote machine. These methods may generally be useful in the context of exploitation. This mixin extends the Tcp exploit mixin. Only one DCERPC service can be accessed at a time using this class.

Constant Summary collapse

DCERPCPacket =

Alias over the Rex DCERPC protocol modules

Rex::Proto::DCERPC::Packet
DCERPCClient =
Rex::Proto::DCERPC::Client
DCERPCResponse =
Rex::Proto::DCERPC::Response
DCERPCUUID =
Rex::Proto::DCERPC::UUID
NDR =
Rex::Encoder::NDR

Instance Attribute Summary collapse

Attributes included from Tcp

#sock

Instance Method Summary collapse

Methods included from DCERPC_LSA

#lsa_open_policy

Methods included from DCERPC_MGMT

#dcerpc_mgmt_connect, #dcerpc_mgmt_inq_if_ids, #dcerpc_mgmt_inq_if_stats, #dcerpc_mgmt_inq_princ_name, #dcerpc_mgmt_is_server_listening, #dcerpc_mgmt_stop_server_listening

Methods included from DCERPC_EPM

#dcerpc_endpoint_find_tcp, #dcerpc_endpoint_find_udp, #dcerpc_endpoint_list

Methods included from Tcp

#chost, #cleanup, #connect, #connect_timeout, #cport, #deregister_tcp_options, #disconnect, #handler, #lhost, #lport, #peer, #print_prefix, #proxies, #rhost, #rport, #set_tcp_evasions, #shutdown, #ssl, #ssl_cipher, #ssl_verify_mode, #ssl_version

Instance Attribute Details

#dcerpcObject

Useful accessors for tracking DCERPC state


214
215
216
# File 'lib/msf/core/exploit/dcerpc.rb', line 214

def dcerpc
  @dcerpc
end

#handleObject

Useful accessors for tracking DCERPC state


214
215
216
# File 'lib/msf/core/exploit/dcerpc.rb', line 214

def handle
  @handle
end

Instance Method Details

#dcerpc_bind(h) ⇒ Object


66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# File 'lib/msf/core/exploit/dcerpc.rb', line 66

def dcerpc_bind(h)
  opts = { 'Msf' => framework, 'MsfExploit' => self }

  if datastore['DCERPC::max_frag_size']
    opts['frag_size'] = datastore['DCERPC::max_frag_size']
  end

  if datastore['DCERPC::fake_bind_multi']
    opts['fake_multi_bind'] = 1

    if datastore['DCERPC::fake_bind_multi_prepend']
      opts['fake_multi_bind_prepend'] = datastore['DCERPC::fake_bind_multi_prepend']
    end

    if datastore['DCERPC::fake_bind_multi_append']
      opts['fake_multi_bind_append'] = datastore['DCERPC::fake_bind_multi_append']
    end
  end

  opts['connect_timeout'] = (datastore['ConnectTimeout'] || 10).to_i

  opts['read_timeout']    = (datastore['DCERPC::ReadTimeout'] || 10).to_i


  # Configure the SMB evasion options

  if (datastore['SMBUser'])
    opts['smb_user'] = datastore['SMBUser']
  end

  if (datastore['SMBPass'])
    opts['smb_pass'] = datastore['SMBPass']
  end

  if (datastore['DCERPC::smb_pipeio'])
    opts['smb_pipeio'] = datastore['DCERPC::smb_pipeio']
  end

  if (datastore['SMB::pipe_write_min_size'])
    opts['pipe_write_min_size'] = datastore['SMB::pipe_write_min_size']
  end

  if (datastore['SMB::pipe_write_max_size'])
    opts['pipe_write_max_size'] = datastore['SMB::pipe_write_max_size']
  end

  if (datastore['SMB::pipe_read_min_size'])
    opts['pipe_read_min_size'] = datastore['SMB::pipe_read_min_size']
  end

  if (datastore['SMB::pipe_read_max_size'])
    opts['pipe_read_max_size'] = datastore['SMB::pipe_read_max_size']
  end

  if (self.respond_to?('simple') and self.simple)
    opts['smb_client'] = self.simple
  end

  # Create the DCERPC client
  self.dcerpc = Rex::Proto::DCERPC::Client.new(h, self.sock, opts)

  if (self.handle.protocol == 'ncacn_np' and not self.simple)
    self.simple = self.dcerpc.smb  # expose the simple client if we have access to it
  end
end

#dcerpc_call(function, stub = '', timeout = nil, do_recv = true) ⇒ Object


132
133
134
135
136
137
138
139
140
141
142
143
144
# File 'lib/msf/core/exploit/dcerpc.rb', line 132

def dcerpc_call(function, stub = '', timeout=nil, do_recv=true)
  otimeout = dcerpc.options['read_timeout']

  begin
    dcerpc.options['read_timeout'] = timeout if timeout
    dcerpc.call(function, stub, do_recv)
  rescue ::Rex::Proto::SMB::Exceptions::NoReply, Rex::Proto::DCERPC::Exceptions::NoResponse
    print_status("The DCERPC service did not reply to our request")
    return
  ensure
    dcerpc.options['read_timeout'] = otimeout
  end
end

#dcerpc_getarchObject


148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
# File 'lib/msf/core/exploit/dcerpc.rb', line 148

def dcerpc_getarch
  ret = nil

  connect_timeout = (datastore['ConnectTimeout'] || 10).to_i
  read_timeout    = (datastore['DCERPC::ReadTimeout'] || 10).to_i

  pkt = Rex::Proto::DCERPC::Packet.make_bind(
    # Abstract Syntax: EPMv4 V3.0
    'e1af8308-5d1f-11c9-91a4-08002b14a0fa', '3.0',
    # Transfer Syntax[1]: 64bit NDR V1
    '71710533-beba-4937-8319-b5dbef9ccc36', '1.0'
  ).first

  begin
    nsock = Rex::Socket::Tcp.create(
      'PeerHost'     => rhost,
      'PeerPort'     => 135,
      'Proxies'      => proxies,
      'Timeout'      => connect_timeout,
      'Context'      => {
        'Msf'        => framework,
        'MsfExploit' => self
      }
    )
  rescue Rex::ConnectionError => e
    vprint_error(e.to_s)
    return nil
  end

  nsock.put(pkt)

  begin
    res = nsock.get_once(60, read_timeout)
  rescue EOFError
    vprint_error('DCE/RPC socket returned EOFError')
    return nil
  end

  disconnect(nsock)

  begin
    resp = Rex::Proto::DCERPC::Response.new(res)
  rescue Rex::Proto::DCERPC::Exceptions::InvalidPacket => e
    vprint_error(e.to_s)
    return nil
  end

  # Ack result: Acceptance (0)
  if resp.ack_result.first == 0
    ret = ARCH_X64
  end
  # Ack result: Provider rejection (2)
  # Ack reason: Proposed transfer syntaxes not supported (2)
  if resp.ack_result.first == 2 && resp.ack_reason.first == 2
    ret = ARCH_X86
  end

  ret
end

#dcerpc_handle(uuid, version, protocol, opts) ⇒ Object


62
63
64
# File 'lib/msf/core/exploit/dcerpc.rb', line 62

def dcerpc_handle(uuid, version, protocol, opts)
  self.handle = Rex::Proto::DCERPC::Handle.new([uuid, version], protocol, rhost, opts)
end

#initialize(info = {}) ⇒ Object


36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# File 'lib/msf/core/exploit/dcerpc.rb', line 36

def initialize(info = {})
  super

  register_evasion_options(
    [
      OptInt.new('DCERPC::max_frag_size',   [ true, 'Set the DCERPC packet fragmentation size', 4096]),
      OptBool.new('DCERPC::fake_bind_multi', [ false, 'Use multi-context bind calls', true ]),
      OptInt.new('DCERPC::fake_bind_multi_prepend',  [ false, 'Set the number of UUIDs to prepend before the target', 0]),
      OptInt.new('DCERPC::fake_bind_multi_append',   [ false, 'Set the number of UUIDs to append the target', 0]),
      OptEnum.new('DCERPC::smb_pipeio', [ false, 'Use a different delivery method for accessing named pipes', 'rw', ['rw', 'trans']] )

    ], Msf::Exploit::Remote::DCERPC)

  register_options(
    [
      Opt::RHOST,
      Opt::RPORT(135),
    ], Msf::Exploit::Remote::DCERPC)

  register_advanced_options(
    [
      OptInt.new('DCERPC::ReadTimeout',   [ true, 'The number of seconds to wait for DCERPC responses', 10] )
    ], Msf::Exploit::Remote::DCERPC)

end

#unicode(str) ⇒ Object

Convert a standard ASCII string to 16-bit Unicode


209
210
211
# File 'lib/msf/core/exploit/dcerpc.rb', line 209

def unicode(str)
  Rex::Text.to_unicode(str)
end