github.com/n00py/Slackor@v0.0.0-20200610224921-d007fcea1740/impacket/examples/opdump.py (about)

     1  #!/usr/bin/env python
     2  """opdump - scan for operations on a given DCERPC interface
     3  
     4  Usage: opdump.py hostname port interface version
     5  
     6  This binds to the given hostname:port and DCERPC interface. Then, it tries to
     7  call each of the first 256 operation numbers in turn and reports the outcome
     8  of each call.
     9  
    10  This will generate a burst of TCP connections to the given host:port!
    11  
    12  Example:
    13  $ ./opdump.py 10.0.0.30 135 99FCFEC4-5260-101B-BBCB-00AA0021347A 0.0
    14  op 0 (0x00): rpc_x_bad_stub_data
    15  op 1 (0x01): rpc_x_bad_stub_data
    16  op 2 (0x02): rpc_x_bad_stub_data
    17  op 3 (0x03): success
    18  op 4 (0x04): rpc_x_bad_stub_data
    19  ops 5-255: nca_s_op_rng_error
    20  
    21  rpc_x_bad_stub_data, rpc_s_access_denied, and success generally means there's an
    22  operation at that number.
    23  
    24  Author: Catalin Patulea <cat@vv.carleton.ca>
    25  """
    26  from __future__ import division
    27  from __future__ import print_function
    28  import sys
    29  
    30  from impacket.examples import logger
    31  from impacket import uuid
    32  from impacket.dcerpc.v5 import transport
    33  
    34  
    35  def main(args):
    36    if len(args) != 4:
    37      print("usage: opdump.py hostname port interface version")
    38      return 1
    39  
    40    host, port, interface, version = args[0],  int(args[1]), args[2], args[3]
    41  
    42    stringbinding = "ncacn_ip_tcp:%s" % host
    43    trans = transport.DCERPCTransportFactory(stringbinding)
    44    trans.set_dport(port)
    45  
    46    results = []
    47    for i in range(256):
    48      dce = trans.get_dce_rpc()
    49      dce.connect()
    50  
    51      iid = uuid.uuidtup_to_bin((interface, version))
    52      dce.bind(iid)
    53  
    54      dce.call(i, "")
    55      try:
    56        dce.recv()
    57      except Exception as e:
    58        result = str(e)
    59      else:
    60        result = "success"
    61  
    62      dce.disconnect()
    63  
    64      results.append(result)
    65  
    66    # trim duplicate suffixes from the back
    67    suffix = results[-1]
    68    while results and results[-1] == suffix:
    69      results.pop()
    70  
    71    for i, result in enumerate(results):
    72      print("op %d (0x%02x): %s" % (i, i, result))
    73  
    74    print("ops %d-%d: %s" % (len(results), 255, suffix))
    75  
    76  if __name__ == "__main__":
    77    # Init the example's logger theme
    78    logger.init()
    79    sys.exit(main(sys.argv[1:]))