Module: Msf::Exploit::Remote::DCERPC

Includes:
DCERPC_EPM, DCERPC_LSA, DCERPC_MGMT, Tcp
Included in:
MsIcpr, SMB::Client::Psexec, SMB::Client::WebExec
Defined in:
lib/msf/core/exploit/remote/dcerpc.rb

Overview

This mixin provides utility methods for interacting with a DCERPC service on a remote machine. These methods may generally be useful in the context of exploitation. This mixin extends the Tcp exploit mixin. Only one DCERPC service can be accessed at a time using this class.

Defined Under Namespace

Modules: KerberosAuthentication

Constant Summary collapse

DCERPCPacket =

Alias over the Rex DCERPC protocol modules

Rex::Proto::DCERPC::Packet
DCERPCClient = 
Rex::Proto::DCERPC::Client
DCERPCResponse = 
Rex::Proto::DCERPC::Response
DCERPCUUID = 
Rex::Proto::DCERPC::UUID
NDR = 
Rex::Encoder::NDR

Instance Attribute Summary collapse

Attributes included from Tcp

#sock

Instance Method Summary collapse

Methods included from DCERPC_LSA

#lsa_open_policy

Methods included from DCERPC_MGMT

#dcerpc_mgmt_connect, #dcerpc_mgmt_inq_if_ids, #dcerpc_mgmt_inq_if_stats, #dcerpc_mgmt_inq_princ_name, #dcerpc_mgmt_is_server_listening, #dcerpc_mgmt_stop_server_listening

Methods included from DCERPC_EPM

#dcerpc_endpoint_find_tcp, #dcerpc_endpoint_find_udp, #dcerpc_endpoint_list

Methods included from Tcp

#chost, #cleanup, #connect, #connect_timeout, #cport, #disconnect, #handler, #lhost, #lport, #peer, #print_prefix, #proxies, #rhost, #rport, #set_tcp_evasions, #shutdown, #ssl, #ssl_cipher, #ssl_verify_mode, #ssl_version

Instance Attribute Details

#dcerpc ⇒ Object

Useful accessors for tracking DCERPC state



213
214
215
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 213

def dcerpc
  @dcerpc
end

#handle ⇒ Object

Useful accessors for tracking DCERPC state



213
214
215
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 213

def handle
  @handle
end

Instance Method Details

#dcerpc_bind(h) ⇒ Object 



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 65

def dcerpc_bind(h)
  opts = { 'Msf' => framework, 'MsfExploit' => self }

  if datastore['DCERPC::max_frag_size']
    opts['frag_size'] = datastore['DCERPC::max_frag_size']
  end

  if datastore['DCERPC::fake_bind_multi']
    opts['fake_multi_bind'] = 1

    if datastore['DCERPC::fake_bind_multi_prepend']
      opts['fake_multi_bind_prepend'] = datastore['DCERPC::fake_bind_multi_prepend']
    end

    if datastore['DCERPC::fake_bind_multi_append']
      opts['fake_multi_bind_append'] = datastore['DCERPC::fake_bind_multi_append']
    end
  end

  opts['connect_timeout'] = (datastore['ConnectTimeout'] || 10).to_i

  opts['read_timeout']    = (datastore['DCERPC::ReadTimeout'] || 10).to_i


  # Configure the SMB evasion options

  if (datastore['SMBUser'])
    opts['smb_user'] = datastore['SMBUser']
  end

  if (datastore['SMBPass'])
    opts['smb_pass'] = datastore['SMBPass']
  end

  if (datastore['DCERPC::smb_pipeio'])
    opts['smb_pipeio'] = datastore['DCERPC::smb_pipeio']
  end

  if (datastore['SMB::pipe_write_min_size'])
    opts['pipe_write_min_size'] = datastore['SMB::pipe_write_min_size']
  end

  if (datastore['SMB::pipe_write_max_size'])
    opts['pipe_write_max_size'] = datastore['SMB::pipe_write_max_size']
  end

  if (datastore['SMB::pipe_read_min_size'])
    opts['pipe_read_min_size'] = datastore['SMB::pipe_read_min_size']
  end

  if (datastore['SMB::pipe_read_max_size'])
    opts['pipe_read_max_size'] = datastore['SMB::pipe_read_max_size']
  end

  if (self.respond_to?('simple') and self.simple)
    opts['smb_client'] = self.simple
  end

  # Create the DCERPC client
  self.dcerpc = Rex::Proto::DCERPC::Client.new(h, self.sock, opts)

  if (self.handle.protocol == 'ncacn_np' and not self.simple)
    self.simple = self.dcerpc.smb  # expose the simple client if we have access to it
  end
end

#dcerpc_call(function, stub = '', timeout = nil, do_recv = true) ⇒ Object 



131
132
133
134
135
136
137
138
139
140
141
142
143
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 131

def dcerpc_call(function, stub = '', timeout=nil, do_recv=true)
  otimeout = dcerpc.options['read_timeout']

  begin
    dcerpc.options['read_timeout'] = timeout if timeout
    dcerpc.call(function, stub, do_recv)
  rescue ::Rex::Proto::SMB::Exceptions::NoReply, Rex::Proto::DCERPC::Exceptions::NoResponse
    print_status("The DCERPC service did not reply to our request")
    return
  ensure
    dcerpc.options['read_timeout'] = otimeout
  end
end

#dcerpc_getarch ⇒ Object

github.com/CoreSecurity/impacket/blob/master/examples/getArch.py msdn.microsoft.com/en-us/library/cc243948.aspx#Appendix_A_53



147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 147

def dcerpc_getarch
  ret = nil

  connect_timeout = (datastore['ConnectTimeout'] || 10).to_i
  read_timeout    = (datastore['DCERPC::ReadTimeout'] || 10).to_i

  pkt = Rex::Proto::DCERPC::Packet.make_bind(
    # Abstract Syntax: EPMv4 V3.0
    'e1af8308-5d1f-11c9-91a4-08002b14a0fa', '3.0',
    # Transfer Syntax[1]: 64bit NDR V1
    '71710533-beba-4937-8319-b5dbef9ccc36', '1.0'
  ).first

  begin
    nsock = Rex::Socket::Tcp.create(
      'PeerHost'     => rhost,
      'PeerPort'     => 135,
      'Proxies'      => proxies,
      'Timeout'      => connect_timeout,
      'Context'      => {
        'Msf'        => framework,
        'MsfExploit' => self
      }
    )
  rescue Rex::ConnectionError => e
    vprint_error(e.to_s)
    return nil
  end

  nsock.put(pkt)

  begin
    res = nsock.get_once(60, read_timeout)
  rescue EOFError
    vprint_error('DCE/RPC socket returned EOFError')
    return nil
  end

  disconnect(nsock)

  begin
    resp = Rex::Proto::DCERPC::Response.new(res)
  rescue Rex::Proto::DCERPC::Exceptions::InvalidPacket => e
    vprint_error(e.to_s)
    return nil
  end

  # Ack result: Acceptance (0)
  if resp.ack_result.first == 0
    ret = ARCH_X64
  end
  # Ack result: Provider rejection (2)
  # Ack reason: Proposed transfer syntaxes not supported (2)
  if resp.ack_result.first == 2 && resp.ack_reason.first == 2
    ret = ARCH_X86
  end

  ret
end

#dcerpc_handle(uuid, version, protocol, opts) ⇒ Object 



57
58
59
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 57

def dcerpc_handle(uuid, version, protocol, opts)
  dcerpc_handle_target(uuid, version, protocol, opts, rhost)
end

#dcerpc_handle_target(uuid, version, protocol, opts, target) ⇒ Object 



61
62
63
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 61

def dcerpc_handle_target(uuid, version, protocol, opts, target)
  self.handle = Rex::Proto::DCERPC::Handle.new([uuid, version], protocol, target, opts)
end

#initialize(info = {}) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 31

def initialize(info = {})
  super

  register_evasion_options(
    [
      OptInt.new('DCERPC::max_frag_size',   [ true, 'Set the DCERPC packet fragmentation size', 4096]),
      OptBool.new('DCERPC::fake_bind_multi', [ false, 'Use multi-context bind calls', true ]),
      OptInt.new('DCERPC::fake_bind_multi_prepend',  [ false, 'Set the number of UUIDs to prepend before the target', 0]),
      OptInt.new('DCERPC::fake_bind_multi_append',   [ false, 'Set the number of UUIDs to append the target', 0]),
      OptEnum.new('DCERPC::smb_pipeio', [ false, 'Use a different delivery method for accessing named pipes', 'rw', ['rw', 'trans']] )

    ], Msf::Exploit::Remote::DCERPC)

  register_options(
    [
      Opt::RHOST,
      Opt::RPORT(135),
    ], Msf::Exploit::Remote::DCERPC)

  register_advanced_options(
    [
      OptInt.new('DCERPC::ReadTimeout',   [ true, 'The number of seconds to wait for DCERPC responses', 10] )
    ], Msf::Exploit::Remote::DCERPC)

end

#unicode(str) ⇒ Object

Convert a standard ASCII string to 16-bit Unicode



208
209
210
 
# File 'lib/msf/core/exploit/remote/dcerpc.rb', line 208

def unicode(str)
  Rex::Text.to_unicode(str)
end