1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
|
#include "idl_types.h"
/*
the base dcerpc packet definitions - not traditionally coded as IDL,
but given that pidl can handle it nicely it simplifies things a lot
to do it this way
see http://www.opengroup.org/onlinepubs/9629399/chap12.htm for packet
layouts
*/
interface dcerpc
{
typedef [public] struct {
GUID uuid;
uint32 if_version;
} dcerpc_syntax_id;
typedef struct {
uint16 context_id;
uint8 num_transfer_syntaxes;
dcerpc_syntax_id abstract_syntax;
dcerpc_syntax_id transfer_syntaxes[num_transfer_syntaxes];
} dcerpc_ctx_list;
typedef struct {
uint16 max_xmit_frag;
uint16 max_recv_frag;
uint32 assoc_group_id;
uint8 num_contexts;
dcerpc_ctx_list ctx_list[num_contexts];
[flag(NDR_ALIGN8)] DATA_BLOB _pad;
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_bind;
const uint8 DCERPC_REQUEST_LENGTH = 24;
const uint8 DCERPC_MAX_SIGN_SIZE = 32;
typedef struct {
uint32 alloc_hint;
uint16 context_id;
uint16 opnum;
[flag(NDR_ALIGN8)] DATA_BLOB _pad;
[flag(NDR_REMAINING)] DATA_BLOB stub_and_verifier;
} dcerpc_request;
const int DCERPC_BIND_PROVIDER_REJECT = 2;
const int DCERPC_BIND_REASON_ASYNTAX = 1;
typedef struct {
uint16 result;
uint16 reason;
dcerpc_syntax_id syntax;
} dcerpc_ack_ctx;
typedef struct {
uint16 max_xmit_frag;
uint16 max_recv_frag;
uint32 assoc_group_id;
ascstr3 secondary_address;
[flag(NDR_ALIGN4)] DATA_BLOB _pad1;
uint8 num_results;
dcerpc_ack_ctx ctx_list[num_results];
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_bind_ack;
typedef struct {
uint16 reject_reason;
uint32 num_versions;
uint32 versions[num_versions];
} dcerpc_bind_nak;
const uint8 DCERPC_RESPONSE_LENGTH = 24;
typedef struct {
uint32 alloc_hint;
uint16 context_id;
uint8 cancel_count;
[flag(NDR_ALIGN8)] DATA_BLOB _pad;
[flag(NDR_REMAINING)] DATA_BLOB stub_and_verifier;
} dcerpc_response;
const int DCERPC_FAULT_OP_RNG_ERROR = 0x1c010002;
const int DCERPC_FAULT_UNK_IF = 0x1c010003;
const int DCERPC_FAULT_NDR = 0x000006f7;
const int DCERPC_FAULT_INVALID_TAG = 0x1c000006;
const int DCERPC_FAULT_CONTEXT_MISMATCH = 0x1c00001a;
const int DCERPC_FAULT_OTHER = 0x00000001;
const int DCERPC_FAULT_LOGON_FAILURE = 0x00000005;
const int DCERPC_FAULT_CANT_PERFORM = 0x000006d8;
/* we return this fault when we haven't yet run the test
to see what fault w2k3 returns in this case */
const int DCERPC_FAULT_TODO = 0x00000042;
typedef struct {
uint32 alloc_hint;
uint16 context_id;
uint8 cancel_count;
uint32 status;
} dcerpc_fault;
const uint8 DCERPC_AUTH_TYPE_NONE = 0;
const uint8 DCERPC_AUTH_TYPE_KRB5 = 1;
const uint8 DCERPC_AUTH_TYPE_SPNEGO = 9;
const uint8 DCERPC_AUTH_TYPE_NTLMSSP = 10;
/* I'm not 100% sure but type 16(0x10)
* seems to be raw krb5 --metze
*/
const uint8 DCERPC_AUTH_TYPE_KRB5_16 = 16;
const uint8 DCERPC_AUTH_TYPE_SCHANNEL = 68;
const uint8 DCERPC_AUTH_TYPE_MSMQ = 100;
const uint8 DCERPC_AUTH_LEVEL_NONE = 1;
const uint8 DCERPC_AUTH_LEVEL_CONNECT = 2;
const uint8 DCERPC_AUTH_LEVEL_CALL = 3;
const uint8 DCERPC_AUTH_LEVEL_PACKET = 4;
const uint8 DCERPC_AUTH_LEVEL_INTEGRITY = 5;
const uint8 DCERPC_AUTH_LEVEL_PRIVACY = 6;
typedef [public] struct {
uint8 auth_type;
uint8 auth_level;
uint8 auth_pad_length;
uint8 auth_reserved;
uint32 auth_context_id;
[flag(NDR_REMAINING)] DATA_BLOB credentials;
} dcerpc_auth;
typedef [public] struct {
uint32 _pad;
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_auth3;
typedef enum {
DCERPC_PKT_REQUEST = 0,
DCERPC_PKT_PING = 1,
DCERPC_PKT_RESPONSE = 2,
DCERPC_PKT_FAULT = 3,
DCERPC_PKT_WORKING = 4,
DCERPC_PKT_NOCALL = 5,
DCERPC_PKT_REJECT = 6,
DCERPC_PKT_ACK = 7,
DCERPC_PKT_CL_CANCEL = 8,
DCERPC_PKT_FACK = 9,
DCERPC_PKT_CANCEL_ACK = 10,
DCERPC_PKT_BIND = 11,
DCERPC_PKT_BIND_ACK = 12,
DCERPC_PKT_BIND_NAK = 13,
DCERPC_PKT_ALTER = 14,
DCERPC_PKT_ALTER_ACK = 15,
DCERPC_PKT_AUTH3 = 16,
DCERPC_PKT_SHUTDOWN = 17,
DCERPC_PKT_CO_CANCEL = 18,
DCERPC_PKT_ORPHANED = 19
} dcerpc_pkt_type;
typedef [nodiscriminant] union {
[case(DCERPC_PKT_REQUEST)] dcerpc_request request;
[case(DCERPC_PKT_RESPONSE)] dcerpc_response response;
[case(DCERPC_PKT_BIND)] dcerpc_bind bind;
[case(DCERPC_PKT_BIND_ACK)] dcerpc_bind_ack bind_ack;
[case(DCERPC_PKT_ALTER)] dcerpc_bind alter;
[case(DCERPC_PKT_ALTER_ACK)] dcerpc_bind_ack alter_ack;
[case(DCERPC_PKT_FAULT)] dcerpc_fault fault;
[case(DCERPC_PKT_AUTH3)] dcerpc_auth3 auth;
[case(DCERPC_PKT_BIND_NAK)] dcerpc_bind_nak bind_nak;
} dcerpc_payload;
typedef struct {
} dcerpc_empty;
typedef [nodiscriminant] union {
[default] dcerpc_empty empty;
[case(DCERPC_PFC_FLAG_ORPC)] GUID object;
} dcerpc_object;
/* pfc_flags values */
const uint8 DCERPC_PFC_FLAG_FIRST = 0x01;
const uint8 DCERPC_PFC_FLAG_LAST = 0x02;
const uint8 DCERPC_PFC_FLAG_NOCALL = 0x20;
const uint8 DCERPC_PFC_FLAG_ORPC = 0x80;
/* these offsets are needed by the signing code */
const uint8 DCERPC_DREP_OFFSET = 4;
const uint8 DCERPC_FRAG_LEN_OFFSET = 8;
const uint8 DCERPC_AUTH_LEN_OFFSET = 10;
/* little-endian flag */
const uint8 DCERPC_DREP_LE = 0x10;
typedef [public] struct {
uint8 rpc_vers; /* RPC version */
uint8 rpc_vers_minor; /* Minor version */
uint8 ptype; /* Packet type */
uint8 pfc_flags; /* Fragmentation flags */
uint8 drep[4]; /* NDR data representation */
uint16 frag_length; /* Total length of fragment */
uint16 auth_length; /* authenticator length */
uint32 call_id; /* Call identifier */
[switch_is(pfc_flags & DCERPC_PFC_FLAG_ORPC)] dcerpc_object object;
[switch_is(ptype)] dcerpc_payload u;
} dcerpc_packet;
}
|
