Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding dsrgetdcnameex2 implementation #269

Merged
5 commits merged into from
Jun 10, 2024

Conversation

sud0Ru
Copy link
Contributor

@sud0Ru sud0Ru commented May 31, 2024

I need this DCERPC call for my Metasploit module. I successfully implemented the request, but when it came to implementing the response, I always encountered problems with fields pointing to incorrect data. For my module, it's sufficient to implement only the request. However, with some assistance from you, perhaps we can also implement the response.
Here is the response's code which should be in file called dsr_get_dc_name_ex2_resoponse.rb:


module RubySMB
  module Dcerpc
    module Netlogon

      # [3.5.4.3.1 DsrGetDCNameEx2 (Opnum 34)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/fb8e1146-a045-4c31-98d1-c68507ad5620)
      class DsrGetDCNameEx2Response < BinData::Record
        attr_reader :opnum

        endian :little

        pdomain_controller_info_w :domain_info
        ndr_uint32             :error_status

        def initialize_instance
          super
          @opnum =  DSR_GET_DC_NAME_EX2
        end
      end
    end
  end
end

Inside netlogin.rb there is the implementation for this struct :

      class DomainControllerInfoW < Ndr::NdrStruct
        default_parameter byte_align: 4
        endian :little

        ndr_wide_stringz_ptr :dc_name
        ndr_wide_stringz_ptr :dc_address
        ndr_uint32 :dc_address_type
        uuid_ptr :domain_guid
        ndr_wide_stringz_ptr :domain_name
        ndr_wide_stringz_ptr :domain_forrest
        ndr_uint32 :flags
        ndr_wide_stringz_ptr :dc_site_name
        ndr_wide_stringz_ptr :client_site_name
      end

      class PdomainControllerInfoW < DomainControllerInfoW
        extend Ndr::PointerClassPlugin
      end

If I want to access for example dc_address I will get the data that related to dc_name
for dc_name I will get some non-printable bytes which located some where in the beginning of the response

@smcintyre-r7
Copy link
Contributor

smcintyre-r7 commented Jun 7, 2024

I sent a PR to your branch for you to test and review with the response class implemented in sud0Ru#1. The changes you have here all look good. I just tweaked the whitespace so things are alinged and changed DC to Dc to match the docs.

Once you merge my changes, I'll merge this and get the changes released in a gem bump. After that, I'll walk you through updating your Metasploit module.

Thanks for taking the time to put this in RubySMB!

@sud0Ru
Copy link
Contributor Author

sud0Ru commented Jun 10, 2024

Thank you for the review. I will check the PR.

From a quick look at your commits, it seems the issue in my code was using uuid_ptr instead of uuid in the DomainControllerInfoWstruct struct, correct? :)

@smcintyre-r7 smcintyre-r7 closed this pull request by merging all changes into rapid7:master in 541c37a Jun 10, 2024
@smcintyre-r7
Copy link
Contributor

From a quick look at your commits, it seems the issue in my code was using uuid_ptr instead of uuid in the DomainControllerInfoWstruct struct, correct? :)

I think that's correct, it sounds about right.

I've gone ahead and merged this. I'll get it released in a new version shortly which will be 3.3.9.

smcintyre-r7 added a commit to sud0Ru/metasploit-framework that referenced this pull request Jun 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

2 participants