JezK
Edit File: traffic_packets.py
# Dispatch for various request types. # # Copyright (C) Catalyst IT Ltd. 2017 # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os import ctypes import random from samba.net import Net from samba.dcerpc import security, drsuapi, nbt, lsa, netlogon, ntlmssp from samba.dcerpc.netlogon import netr_WorkstationInformation from samba.dcerpc.security import dom_sid from samba.netbios import Node from samba.ndr import ndr_pack from samba.credentials import ( CLI_CRED_NTLMv2_AUTH, MUST_USE_KERBEROS, DONT_USE_KERBEROS ) from samba import NTSTATUSError from samba.ntstatus import ( NT_STATUS_OBJECT_NAME_NOT_FOUND, NT_STATUS_NO_SUCH_DOMAIN ) import samba import dns.resolver from ldb import SCOPE_BASE def uint32(v): return ctypes.c_uint32(v).value def check_runtime_error(runtime, val): if runtime is None: return False err32 = uint32(runtime.args[0]) if err32 == val: return True return False name_formats = [ drsuapi.DRSUAPI_DS_NAME_FORMAT_FQDN_1779, drsuapi.DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT, drsuapi.DRSUAPI_DS_NAME_FORMAT_DISPLAY, drsuapi.DRSUAPI_DS_NAME_FORMAT_GUID, drsuapi.DRSUAPI_DS_NAME_FORMAT_CANONICAL, drsuapi.DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, drsuapi.DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX, drsuapi.DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL, drsuapi.DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY, drsuapi.DRSUAPI_DS_NAME_FORMAT_DNS_DOMAIN, drsuapi.DRSUAPI_DS_NAME_FORMAT_UPN_AND_ALTSECID, drsuapi.DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT_NAME_SANS_DOMAIN_EX, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_GLOBAL_CATALOG_SERVERS, drsuapi.DRSUAPI_DS_NAME_FORMAT_UPN_FOR_LOGON, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_WITH_DCS_IN_SITE, drsuapi.DRSUAPI_DS_NAME_FORMAT_STRING_SID_NAME, drsuapi.DRSUAPI_DS_NAME_FORMAT_ALT_SECURITY_IDENTITIES_NAME, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_NCS, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_DOMAINS, drsuapi.DRSUAPI_DS_NAME_FORMAT_MAP_SCHEMA_GUID, drsuapi.DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT_NAME_SANS_DOMAIN, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_ROLES, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_INFO_FOR_SERVER, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_FOR_DOMAIN_IN_SITE, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_DOMAINS_IN_SITE, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_IN_SITE, drsuapi.DRSUAPI_DS_NAME_FORMAT_LIST_SITES, ] def warning(message): print("\033[37;41;1m" "Warning: %s" "\033[00m" % (message)) ############################################################################### # # Packet generation functions: # # All the packet generation functions have the following form: # packet_${protocol}_${opcode}(packet, conversation, context) # # The functions return true, if statistics should be collected for the packet # false, the packet has been ignored. # # Where: # protocol is the protocol, i.e. cldap, dcerpc, ... # opcode is the protocol op code i.e. type of the packet to be # generated. # # packet contains data about the captured/generated packet # provides any extra data needed to generate the packet # # conversation Details of the current client/server interaction # # context state data for the current interaction # # # # The following protocols are not currently handled: # smb # smb2 # browser # smb_netlogon # # The following drsuapi replication packets are currently ignored: # DsReplicaSync # DsGetNCChanges # DsReplicaUpdateRefs # Packet generators that do NOTHING are assigned to the null_packet # function which allows the conversation generators to notice this and # avoid a whole lot of pointless work. def null_packet(packet, conversation, context): return False def packet_cldap_3(packet, conversation, context): # searchRequest net = Net(creds=context.creds, lp=context.lp) net.finddc(domain=context.lp.get('realm'), flags=(nbt.NBT_SERVER_LDAP | nbt.NBT_SERVER_DS | nbt.NBT_SERVER_WRITABLE)) return True packet_cldap_5 = null_packet # searchResDone packet_dcerpc_0 = null_packet # Request # Can be ignored, it's the continuation of an existing conversation packet_dcerpc_2 = null_packet # Request # Server response, so should be ignored packet_dcerpc_3 = null_packet packet_dcerpc_11 = null_packet # Bind # creation of the rpc dcerpc connection is managed by the higher level # protocol drivers. So we ignore it when generating traffic packet_dcerpc_12 = null_packet # Bind_ack # Server response, so should be ignored packet_dcerpc_13 = null_packet # Bind_nak # Server response, so should be ignored packet_dcerpc_14 = null_packet # Alter_context # Generated as part of the connect process def packet_dcerpc_15(packet, conversation, context): # Alter_context_resp # This means it was GSSAPI/krb5 (probably) # Check the kerberos_state and issue a diagnostic if kerberos not enabled if context.user_creds.get_kerberos_state() == DONT_USE_KERBEROS: warning("Kerberos disabled but have dcerpc Alter_context_resp " "indicating Kerberos was used") return False def packet_dcerpc_16(packet, conversation, context): # AUTH3 # This means it was NTLMSSP # Check the kerberos_state and issue a diagnostic if kerberos enabled if context.user_creds.get_kerberos_state() == MUST_USE_KERBEROS: warning("Kerberos enabled but have dcerpc AUTH3 " "indicating NTLMSSP was used") return False def packet_dns_0(packet, conversation, context): # query name, rtype = context.guess_a_dns_lookup() dns.resolver.query(name, rtype) return True packet_dns_1 = null_packet # response # Server response, so should be ignored def packet_drsuapi_0(packet, conversation, context): # DsBind context.get_drsuapi_connection_pair(True) return True NAME_FORMATS = [getattr(drsuapi, _x) for _x in dir(drsuapi) if 'NAME_FORMAT' in _x] def packet_drsuapi_12(packet, conversation, context): # DsCrackNames drs, handle = context.get_drsuapi_connection_pair() names = drsuapi.DsNameString() names.str = context.server req = drsuapi.DsNameRequest1() req.format_flags = 0 req.format_offered = 7 req.format_desired = random.choice(name_formats) req.codepage = 1252 req.language = 1033 # German, I think req.format_flags = 0 req.count = 1 req.names = [names] (result, ctr) = drs.DsCrackNames(handle, 1, req) return True def packet_drsuapi_13(packet, conversation, context): # DsWriteAccountSpn req = drsuapi.DsWriteAccountSpnRequest1() req.operation = drsuapi.DRSUAPI_DS_SPN_OPERATION_REPLACE req.unknown1 = 0 # Unused, must be 0 req.object_dn = context.user_dn req.count = 1 # only 1 name spn_name = drsuapi.DsNameString() spn_name.str = 'foo/{}'.format(context.username) req.spn_names = [spn_name] (drs, handle) = context.get_drsuapi_connection_pair() (level, res) = drs.DsWriteAccountSpn(handle, 1, req) return True def packet_drsuapi_1(packet, conversation, context): # DsUnbind (drs, handle) = context.get_drsuapi_connection_pair() drs.DsUnbind(handle) del context.drsuapi_connections[-1] return True packet_drsuapi_2 = null_packet # DsReplicaSync # This is between DCs, triggered on a DB change # Ignoring for now packet_drsuapi_3 = null_packet # DsGetNCChanges # This is between DCs, trigger with DB operation, # or DsReplicaSync between DCs. # Ignoring for now packet_drsuapi_4 = null_packet # DsReplicaUpdateRefs # Ignoring for now packet_epm_3 = null_packet # Map # Will be generated by higher level protocol calls def packet_kerberos_(packet, conversation, context): # Use the presence of kerberos packets as a hint to enable kerberos # for the rest of the conversation. # i.e. kerberos packets are not explicitly generated. context.user_creds.set_kerberos_state(MUST_USE_KERBEROS) context.user_creds_bad.set_kerberos_state(MUST_USE_KERBEROS) context.machine_creds.set_kerberos_state(MUST_USE_KERBEROS) context.machine_creds_bad.set_kerberos_state(MUST_USE_KERBEROS) context.creds.set_kerberos_state(MUST_USE_KERBEROS) return False packet_ldap_ = null_packet # Unknown # The ldap payload was probably encrypted so just ignore it. def packet_ldap_0(packet, conversation, context): # bindRequest if packet.extra[5] == "simple": # Perform a simple bind. context.get_ldap_connection(new=True, simple=True) else: # Perform a sasl bind. context.get_ldap_connection(new=True, simple=False) return True packet_ldap_1 = null_packet # bindResponse # Server response ignored for traffic generation def packet_ldap_2(packet, conversation, context): # unbindRequest # pop the last one off -- most likely we're in a bind/unbind ping. del context.ldap_connections[-1:] return False def packet_ldap_3(packet, conversation, context): # searchRequest (scope, dn_sig, filter, attrs, extra, desc, oid) = packet.extra if not scope: scope = SCOPE_BASE samdb = context.get_ldap_connection() dn = context.get_matching_dn(dn_sig) # try to guess the search expression (don't bother for base searches, as # they're only looking up a single object) if (filter is None or filter == '') and scope != SCOPE_BASE: filter = context.guess_search_filter(attrs, dn_sig, dn) samdb.search(dn, expression=filter, scope=int(scope), attrs=attrs.split(','), controls=["paged_results:1:1000"]) return True packet_ldap_4 = null_packet # searchResEntry # Server response ignored for traffic generation packet_ldap_5 = null_packet # Server response ignored for traffic generation packet_ldap_6 = null_packet packet_ldap_7 = null_packet packet_ldap_8 = null_packet packet_ldap_9 = null_packet packet_ldap_16 = null_packet packet_lsarpc_0 = null_packet # lsarClose packet_lsarpc_1 = null_packet # lsarDelete packet_lsarpc_2 = null_packet # lsarEnumeratePrivileges packet_lsarpc_3 = null_packet # LsarQuerySecurityObject packet_lsarpc_4 = null_packet # LsarSetSecurityObject packet_lsarpc_5 = null_packet # LsarChangePassword packet_lsarpc_6 = null_packet # lsa_OpenPolicy # We ignore this, but take it as a hint that the lsarpc handle should # be over a named pipe. # def packet_lsarpc_14(packet, conversation, context): # lsa_LookupNames c = context.get_lsarpc_named_pipe_connection() objectAttr = lsa.ObjectAttribute() pol_handle = c.OpenPolicy2(u'', objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) sids = lsa.TransSidArray() names = [lsa.String("This Organization"), lsa.String("Digest Authentication")] level = lsa.LSA_LOOKUP_NAMES_ALL count = 0 c.LookupNames(pol_handle, names, sids, level, count) return True def packet_lsarpc_15(packet, conversation, context): # lsa_LookupSids c = context.get_lsarpc_named_pipe_connection() objectAttr = lsa.ObjectAttribute() pol_handle = c.OpenPolicy2(u'', objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) sids = lsa.SidArray() sid = lsa.SidPtr() x = dom_sid("S-1-5-7") sid.sid = x sids.sids = [sid] sids.num_sids = 1 names = lsa.TransNameArray() level = lsa.LSA_LOOKUP_NAMES_ALL count = 0 c.LookupSids(pol_handle, sids, names, level, count) return True def packet_lsarpc_39(packet, conversation, context): # lsa_QueryTrustedDomainInfoBySid # Samba does not support trusted domains, so this call is expected to fail # c = context.get_lsarpc_named_pipe_connection() objectAttr = lsa.ObjectAttribute() pol_handle = c.OpenPolicy2(u'', objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) domsid = security.dom_sid(context.domain_sid) level = 1 try: c.QueryTrustedDomainInfoBySid(pol_handle, domsid, level) except NTSTATUSError as error: # Object Not found is the expected result from samba, # while No Such Domain is the expected result from windows, # anything else is a failure. if not check_runtime_error(error, NT_STATUS_OBJECT_NAME_NOT_FOUND) \ and not check_runtime_error(error, NT_STATUS_NO_SUCH_DOMAIN): raise return True packet_lsarpc_40 = null_packet # lsa_SetTrustedDomainInfo # Not currently supported packet_lsarpc_43 = null_packet # LsaStorePrivateData packet_lsarpc_44 = null_packet # LsaRetrievePrivateData packet_lsarpc_68 = null_packet # LsarLookupNames3 def packet_lsarpc_76(packet, conversation, context): # lsa_LookupSids3 c = context.get_lsarpc_connection() sids = lsa.SidArray() sid = lsa.SidPtr() # Need a set x = dom_sid("S-1-5-7") sid.sid = x sids.sids = [sid] sids.num_sids = 1 names = lsa.TransNameArray2() level = lsa.LSA_LOOKUP_NAMES_ALL count = 0 lookup_options = lsa.LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES client_revision = lsa.LSA_CLIENT_REVISION_2 c.LookupSids3(sids, names, level, count, lookup_options, client_revision) return True def packet_lsarpc_77(packet, conversation, context): # lsa_LookupNames4 c = context.get_lsarpc_connection() sids = lsa.TransSidArray3() names = [lsa.String("This Organization"), lsa.String("Digest Authentication")] level = lsa.LSA_LOOKUP_NAMES_ALL count = 0 lookup_options = lsa.LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES client_revision = lsa.LSA_CLIENT_REVISION_2 c.LookupNames4(names, sids, level, count, lookup_options, client_revision) return True def packet_nbns_0(packet, conversation, context): # query n = Node() try: n.query_name("ANAME", context.server, timeout=4, broadcast=False) except: pass return True packet_nbns_1 = null_packet # response # Server response, not generated by the client packet_rpc_netlogon_0 = null_packet packet_rpc_netlogon_1 = null_packet packet_rpc_netlogon_4 = null_packet # NetrServerReqChallenge # generated by higher level protocol drivers # ignored for traffic generation packet_rpc_netlogon_14 = null_packet packet_rpc_netlogon_15 = null_packet packet_rpc_netlogon_21 = null_packet # NetrLogonDummyRoutine1 # Used to determine security settings. Triggered from schannel setup # So no need for an explicit generator packet_rpc_netlogon_26 = null_packet # NetrServerAuthenticate3 # Triggered from schannel set up, no need for an explicit generator def packet_rpc_netlogon_29(packet, conversation, context): # NetrLogonGetDomainInfo [531] c = context.get_netlogon_connection() (auth, succ) = context.get_authenticator() query = netr_WorkstationInformation() c.netr_LogonGetDomainInfo(context.server, context.netbios_name, auth, succ, 2, # TODO are there other values? query) return True def packet_rpc_netlogon_30(packet, conversation, context): # NetrServerPasswordSet2 c = context.get_netlogon_connection() (auth, succ) = context.get_authenticator() DATA_LEN = 512 # Set the new password to the existing password, this generates the same # work load as a new value, and leaves the account password intact for # subsequent runs newpass = context.machine_creds.get_password().encode('utf-16-le') pwd_len = len(newpass) filler = [x if isinstance(x, int) else ord(x) for x in os.urandom(DATA_LEN - pwd_len)] pwd = netlogon.netr_CryptPassword() pwd.length = pwd_len pwd.data = filler + [x if isinstance(x, int) else ord(x) for x in newpass] context.machine_creds.encrypt_netr_crypt_password(pwd) c.netr_ServerPasswordSet2(context.server, # must ends with $, so use get_username instead # of get_workstation here context.machine_creds.get_username(), context.machine_creds.get_secure_channel_type(), context.netbios_name, auth, pwd) return True packet_rpc_netlogon_34 = null_packet def packet_rpc_netlogon_39(packet, conversation, context): # NetrLogonSamLogonEx [4331] def connect(creds): c = context.get_netlogon_connection() # Disable Kerberos in cli creds to extract NTLM response old_state = creds.get_kerberos_state() creds.set_kerberos_state(DONT_USE_KERBEROS) logon = samlogon_logon_info(context.domain, context.netbios_name, creds) logon_level = netlogon.NetlogonNetworkTransitiveInformation validation_level = netlogon.NetlogonValidationSamInfo4 netr_flags = 0 c.netr_LogonSamLogonEx(context.server, context.machine_creds.get_workstation(), logon_level, logon, validation_level, netr_flags) creds.set_kerberos_state(old_state) context.last_samlogon_bad =\ context.with_random_bad_credentials(connect, context.user_creds, context.user_creds_bad, context.last_samlogon_bad) return True def samlogon_target(domain_name, computer_name): target_info = ntlmssp.AV_PAIR_LIST() target_info.count = 3 computername = ntlmssp.AV_PAIR() computername.AvId = ntlmssp.MsvAvNbComputerName computername.Value = computer_name domainname = ntlmssp.AV_PAIR() domainname.AvId = ntlmssp.MsvAvNbDomainName domainname.Value = domain_name eol = ntlmssp.AV_PAIR() eol.AvId = ntlmssp.MsvAvEOL target_info.pair = [domainname, computername, eol] return ndr_pack(target_info) def samlogon_logon_info(domain_name, computer_name, creds): target_info_blob = samlogon_target(domain_name, computer_name) challenge = b"abcdefgh" # User account under test response = creds.get_ntlm_response(flags=CLI_CRED_NTLMv2_AUTH, challenge=challenge, target_info=target_info_blob) logon = netlogon.netr_NetworkInfo() logon.challenge = [x if isinstance(x, int) else ord(x) for x in challenge] logon.nt = netlogon.netr_ChallengeResponse() logon.nt.length = len(response["nt_response"]) logon.nt.data = [x if isinstance(x, int) else ord(x) for x in response["nt_response"]] logon.identity_info = netlogon.netr_IdentityInfo() (username, domain) = creds.get_ntlm_username_domain() logon.identity_info.domain_name.string = domain logon.identity_info.account_name.string = username logon.identity_info.workstation.string = creds.get_workstation() return logon def packet_rpc_netlogon_40(packet, conversation, context): # DsrEnumerateDomainTrusts c = context.get_netlogon_connection() c.netr_DsrEnumerateDomainTrusts( context.server, netlogon.NETR_TRUST_FLAG_IN_FOREST | netlogon.NETR_TRUST_FLAG_OUTBOUND | netlogon.NETR_TRUST_FLAG_INBOUND) return True def packet_rpc_netlogon_45(packet, conversation, context): # NetrLogonSamLogonWithFlags [7] def connect(creds): c = context.get_netlogon_connection() (auth, succ) = context.get_authenticator() # Disable Kerberos in cli creds to extract NTLM response old_state = creds.get_kerberos_state() creds.set_kerberos_state(DONT_USE_KERBEROS) logon = samlogon_logon_info(context.domain, context.netbios_name, creds) logon_level = netlogon.NetlogonNetworkTransitiveInformation validation_level = netlogon.NetlogonValidationSamInfo4 netr_flags = 0 c.netr_LogonSamLogonWithFlags(context.server, context.machine_creds.get_workstation(), auth, succ, logon_level, logon, validation_level, netr_flags) creds.set_kerberos_state(old_state) context.last_samlogon_bad =\ context.with_random_bad_credentials(connect, context.user_creds, context.user_creds_bad, context.last_samlogon_bad) return True def packet_samr_0(packet, conversation, context): # Open c = context.get_samr_context() c.get_handle() return True def packet_samr_1(packet, conversation, context): # Close c = context.get_samr_context() s = c.get_connection() # close the last opened handle, may not always be accurate # but will do for load simulation if c.user_handle is not None: s.Close(c.user_handle) c.user_handle = None elif c.group_handle is not None: s.Close(c.group_handle) c.group_handle = None elif c.domain_handle is not None: s.Close(c.domain_handle) c.domain_handle = None c.rids = None elif c.handle is not None: s.Close(c.handle) c.handle = None c.domain_sid = None return True def packet_samr_3(packet, conversation, context): # QuerySecurity c = context.get_samr_context() s = c.get_connection() if c.user_handle is None: packet_samr_34(packet, conversation, context) s.QuerySecurity(c.user_handle, 1) return True def packet_samr_5(packet, conversation, context): # LookupDomain c = context.get_samr_context() s = c.get_connection() h = c.get_handle() d = lsa.String() d.string = context.domain c.domain_sid = s.LookupDomain(h, d) return True def packet_samr_6(packet, conversation, context): # EnumDomains c = context.get_samr_context() s = c.get_connection() h = c.get_handle() s.EnumDomains(h, 0, 0) return True def packet_samr_7(packet, conversation, context): # OpenDomain c = context.get_samr_context() s = c.get_connection() h = c.get_handle() if c.domain_sid is None: packet_samr_5(packet, conversation, context) c.domain_handle = s.OpenDomain(h, security.SEC_FLAG_MAXIMUM_ALLOWED, c.domain_sid) return True SAMR_QUERY_DOMAIN_INFO_LEVELS = [8, 12] def packet_samr_8(packet, conversation, context): # QueryDomainInfo [228] c = context.get_samr_context() s = c.get_connection() if c.domain_handle is None: packet_samr_7(packet, conversation, context) level = random.choice(SAMR_QUERY_DOMAIN_INFO_LEVELS) s.QueryDomainInfo(c.domain_handle, level) return True packet_samr_14 = null_packet # CreateDomainAlias # Ignore these for now. def packet_samr_15(packet, conversation, context): # EnumDomainAliases c = context.get_samr_context() s = c.get_connection() if c.domain_handle is None: packet_samr_7(packet, conversation, context) s.EnumDomainAliases(c.domain_handle, 100, 0) return True def packet_samr_16(packet, conversation, context): # GetAliasMembership c = context.get_samr_context() s = c.get_connection() if c.domain_handle is None: packet_samr_7(packet, conversation, context) sids = lsa.SidArray() sid = lsa.SidPtr() sid.sid = c.domain_sid sids.sids = [sid] s.GetAliasMembership(c.domain_handle, sids) return True def packet_samr_17(packet, conversation, context): # LookupNames c = context.get_samr_context() s = c.get_connection() if c.domain_handle is None: packet_samr_7(packet, conversation, context) name = lsa.String(context.username) c.rids = s.LookupNames(c.domain_handle, [name]) return True def packet_samr_18(packet, conversation, context): # LookupRids c = context.get_samr_context() s = c.get_connection() if c.rids is None: packet_samr_17(packet, conversation, context) rids = [] for r in c.rids: for i in r.ids: rids.append(i) s.LookupRids(c.domain_handle, rids) return True def packet_samr_19(packet, conversation, context): # OpenGroup c = context.get_samr_context() s = c.get_connection() if c.domain_handle is None: packet_samr_7(packet, conversation, context) rid = 0x202 # Users I think. c.group_handle = s.OpenGroup(c.domain_handle, security.SEC_FLAG_MAXIMUM_ALLOWED, rid) return True def packet_samr_25(packet, conversation, context): # QueryGroupMember c = context.get_samr_context() s = c.get_connection() if c.group_handle is None: packet_samr_19(packet, conversation, context) s.QueryGroupMember(c.group_handle) return True def packet_samr_34(packet, conversation, context): # OpenUser c = context.get_samr_context() s = c.get_connection() if c.rids is None: packet_samr_17(packet, conversation, context) c.user_handle = s.OpenUser(c.domain_handle, security.SEC_FLAG_MAXIMUM_ALLOWED, c.rids[0].ids[0]) return True def packet_samr_36(packet, conversation, context): # QueryUserInfo c = context.get_samr_context() s = c.get_connection() if c.user_handle is None: packet_samr_34(packet, conversation, context) level = 1 s.QueryUserInfo(c.user_handle, level) return True packet_samr_37 = null_packet def packet_samr_39(packet, conversation, context): # GetGroupsForUser c = context.get_samr_context() s = c.get_connection() if c.user_handle is None: packet_samr_34(packet, conversation, context) s.GetGroupsForUser(c.user_handle) return True packet_samr_40 = null_packet packet_samr_44 = null_packet def packet_samr_57(packet, conversation, context): # Connect2 c = context.get_samr_context() c.get_handle() return True def packet_samr_64(packet, conversation, context): # Connect5 c = context.get_samr_context() c.get_handle() return True packet_samr_68 = null_packet def packet_srvsvc_16(packet, conversation, context): # NetShareGetInfo s = context.get_srvsvc_connection() server_unc = "\\\\" + context.server share_name = "IPC$" level = 1 s.NetShareGetInfo(server_unc, share_name, level) return True def packet_srvsvc_21(packet, conversation, context): """NetSrvGetInfo FIXME: Level changed from 102 to 101 here, to bypass Windows error. Level 102 will cause WERR_ACCESS_DENIED error against Windows, because: > If the level is 102 or 502, the Windows implementation checks whether > the caller is a member of one of the groups previously mentioned or > is a member of the Power Users local group. It passed against Samba since this check is not implemented by Samba yet. refer to: https://msdn.microsoft.com/en-us/library/cc247297.aspx#Appendix_A_80 """ srvsvc = context.get_srvsvc_connection() server_unc = "\\\\" + context.server level = 101 srvsvc.NetSrvGetInfo(server_unc, level) return True