scapy.layers.msrpce.msdcom
[MS-DCOM]
- class scapy.layers.msrpce.msdcom.ACTVFLAGS(*values)[source]
Bases:
IntEnum- ACTIVATE_32_BIT_SERVER = 4
- ACTIVATE_64_BIT_SERVER = 8
- DISABLE_AAA = 2
- NO_FAILURE_LOG = 32
- class scapy.layers.msrpce.msdcom.ActivationContextInfoData(_pkt, /, *, clientOK=0, bReserved1=0, dwReserved1=0, dwReserved2=0, pIFDClientCtx=None, pIFDPrototypeCtx=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.ActivationContextInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<NDRSignedIntField (ActivationContextInfoData).clientOK>, <NDRSignedIntField (ActivationContextInfoData).bReserved1>, <NDRIntField (ActivationContextInfoData).dwReserved1>, <NDRIntField (ActivationContextInfoData).dwReserved2>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>]
- class scapy.layers.msrpce.msdcom.ActivationPropertiesBlob(_pkt, /, *, dwSize=None, dwReserved=0, CustomHeader=<CustomHeader classInfoClsid=<GUID |> |>, Property=[])[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.ActivationPropertiesBlob'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<FieldLenField (ActivationPropertiesBlob).dwSize>, <LEIntField (ActivationPropertiesBlob).dwReserved>, <NDRSerializeType1PacketField (ActivationPropertiesBlob).CustomHeader>, <_ActivationPropertiesField (ActivationPropertiesBlob).Property>]
- class scapy.layers.msrpce.msdcom.COSERVERINFO(_pkt, /, *, dwReserved1=0, pwszName=None, pdwReserved=None, dwReserved2=0)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.COSERVERINFO'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.Context(_pkt, /, *, MajorVersion=1, MinVersion=1, ContextId=None, Flags=<Flag 0 ()>, Reserved=0, dwNumExtents=0, cbExtents=0, MshlFlags=0, Count=None, Frozen=1, PropMarshalHeader=[])[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.Context'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<LEShortField (Context).MajorVersion>, <LEShortField (Context).MinVersion>, <UUIDField (Context).ContextId>, <FlagsField (Context).Flags>, <LEIntField (Context).Reserved>, <LEIntField (Context).dwNumExtents>, <LEIntField (Context).cbExtents>, <LEIntField (Context).MshlFlags>, <FieldLenField (Context).Count>, <LEIntField (Context).Frozen>, <PacketListField (Context).PropMarshalHeader>]
- class scapy.layers.msrpce.msdcom.CustomHeader(_pkt, /, *, totalSize=0, headerSize=0, dwReserved=0, destCtx=2, cIfs=None, classInfoClsid=<GUID |>, pclsid=None, pSizes=None, pdwReserved=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.CustomHeader'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<NDRIntField (CustomHeader).totalSize>, <NDRIntField (CustomHeader).headerSize>, <NDRIntField (CustomHeader).dwReserved>, <scapy.layers.dcerpc.NDRIntEnumField object>, <NDRIntField (CustomHeader).cIfs>, <scapy.layers.dcerpc.NDRPacketField object>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>]
- class scapy.layers.msrpce.msdcom.DATAELEMENT(_pkt, /, *, dataID=None, cbSize=None, cbRounded=None, Data=b'')[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.DATAELEMENT'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.DCOM_Client(cid: GUID = None, verb=True, **kwargs)[source]
Bases:
DCERPC_ClientA wrapper of DCERPC_Client that adds functions to use COM interfaces.
- Parameters:
cid – the client identifier
- AcquireInterface(ipid: UUID, iids: List[ComInterface], cPublicRefs: int)[source]
[MS-DCOM] 3.2.4.4.3 - Acquiring Additional Interfaces on the Object
- IPID_table: Dict[int, IPID_Entry]
- IREMUNKNOWN = <COM Interface IRemUnknown2>
- OXID_table: Dict[int, OXID_Entry]
- RemoteCreateInstance(clsid: UUID, iids: List[ComInterface]) ObjectInstance[source]
Calls IRemoteSCMActivator::RemoteCreateInstance and returns a OXID_Entry that points to an instance of the provided class.
- Parameters:
clsid – the class ID to initialize
iids – the IDs of the interfaces to request
- RemoteGetClassObject(clsid: UUID, iids: List[ComInterface]) ObjectInstance[source]
Calls IRemoteSCMActivator::RemoteGetClassObject and returns a OXID_Entry that points to the factory.
- Parameters:
clsid – the class ID to initialize
iids – the IDs of the interfaces to request
- ResolveOxid2(oxid: int, host: str | None = None, port: int | None = None)[source]
[MS-DCOM] 3.2.4.1.2.2 Issuing the OXID Resolution Request
- Parameters:
oxid – the OXID to resolve
host – (optional) connect to a different host
port – (optional) connect to a different port
- Resolver_table: Dict[STRINGBINDING, Resolver_Entry]
- UnmarshallObjectReference(mifaceptr: MInterfacePointer, iid: ComInterface)[source]
[MS-DCOM] 3.2.4.3 Marshaling an Object Reference
Unmarshall a MInterfacePointer received by the applicative layer.
- connect(host: str, timeout=5)[source]
Initiate a connection to the object resolver.
- Parameters:
host – the host to connect to
timeout – (optional) the connection timeout (default 5)
- sr1_orpc_req(pkt: NDRPacket, ipid: UUID, ssp=None, auth_level=None, impersonation_type=None, timeout=5, **kwargs)[source]
Make an ORPC call.
- Parameters:
ipid – the reference to a specific interface on an object.
pkt – the request to make.
ssp – (optional) non default SSP to use to connect to the object exporter
auth_level – (optional) non default authn level to use
impersonation_type – (optional) non default impersonation type to use
timeout – (optional) timeout for the connection
- class scapy.layers.msrpce.msdcom.IPID_Entry[source]
Bases:
objectAn entry in the IPID table [MS-DCOM] 3.1.1.1 Abstract Data Model
- cPrivateRefs: int
- cPublicRefs: int
- iface: ComInterface | None
- iid: UUID | None
- ipid: UUID | None
- oid: int | None
- oxid: int | None
- state: Any
- class scapy.layers.msrpce.msdcom.InstanceInfoData(_pkt, /, *, fileName=None, mode=0, ifdROT=None, ifdStg=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.InstanceInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.InstantiationInfoData(_pkt, /, *, classId=<GUID |>, classCtx=0, actvflags=0, fIsSurrogate=0, cIID=None, instFlag=0, pIID=None, thisSize=0, clientCOMVersion=<COMVERSION |>)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.InstantiationInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<scapy.layers.dcerpc.NDRPacketField object>, <NDRIntField (InstantiationInfoData).classCtx>, <NDRIntField (InstantiationInfoData).actvflags>, <NDRSignedIntField (InstantiationInfoData).fIsSurrogate>, <NDRIntField (InstantiationInfoData).cIID>, <NDRIntField (InstantiationInfoData).instFlag>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>, <NDRIntField (InstantiationInfoData).thisSize>, <scapy.layers.dcerpc.NDRPacketField object>]
- class scapy.layers.msrpce.msdcom.LocationInfoData(_pkt, /, *, machineName=None, processId=0, apartmentId=0, contextId=0)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.LocationInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.OBJREF(_pkt, /, *, signature=b'MEOW', flags=4, iid=UUID('000001a2-0000-0000-c000-000000000046'))[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.OBJREF'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<XStrFixedLenField (OBJREF).signature>, <LEIntField (OBJREF).flags>, <UUIDEnumField (OBJREF).iid>]
- payload_guess: List[Tuple[Dict[str, Any], Type[Packet]]] = [({'flags': 1}, <class 'scapy.layers.msrpce.msdcom.OBJREF_STANDARD'>), ({'flags': 2}, <class 'scapy.layers.msrpce.msdcom.OBJREF_HANDLER'>), ({'flags': 4}, <class 'scapy.layers.msrpce.msdcom.OBJREF_CUSTOM'>), ({'flags': 8}, <class 'scapy.layers.msrpce.msdcom.OBJREF_EXTENDED'>)]
- class scapy.layers.msrpce.msdcom.OBJREF_CUSTOM(_pkt, /, *, clsid=UUID('00000338-0000-0000-c000-000000000046'), cbExtension=0, reserved=None, pObjectData=<ActivationPropertiesBlob CustomHeader=<CustomHeader classInfoClsid=<GUID |> |> |>)[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.OBJREF_CUSTOM'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.OBJREF_EXTENDED(_pkt, /, *, std=<STDOBJREF |>, Signature1=1314085206, saResAddr=<DUALSTRINGARRAY |>, nElms=1, Signature2=1314085206, ElmArray=<DATAELEMENT |>)[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.OBJREF_EXTENDED'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<PacketField (OBJREF_EXTENDED).std>, <LEIntField (OBJREF_EXTENDED).Signature1>, <PacketField (OBJREF_EXTENDED).saResAddr>, <LEIntField (OBJREF_EXTENDED).nElms>, <LEIntField (OBJREF_EXTENDED).Signature2>, <PacketField (OBJREF_EXTENDED).ElmArray>]
- class scapy.layers.msrpce.msdcom.OBJREF_HANDLER(_pkt, /, *, std=<STDOBJREF |>, clsid=None, saResAddr=<DUALSTRINGARRAY |>)[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.OBJREF_HANDLER'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.OBJREF_STANDARD(_pkt, /, *, std=<STDOBJREF |>, saResAddr=<DUALSTRINGARRAY |>)[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.OBJREF_STANDARD'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.OID_Entry[source]
Bases:
objectAn entry in the OID table [MS-DCOM] 3.1.1.1 Abstract Data Model
- garbage_collection: bool
- hash: bytes | None
- ipids: List[UUID]
- last_orpc: int
- oid: int | None
- oxid: int | None
- class scapy.layers.msrpce.msdcom.OXID_Entry[source]
Bases:
objectAn entry in the OXID table. [MS-DCOM] 3.2.1 Abstract Data Model
- authnHint: RPC_C_AUTHN_LEVEL
- bindingInfo: Tuple[str, int] | None
- ipid_IRemUnknown: UUID | None
- oxid: int | None
- target_name: str
- version: COMVERSION | None
- class scapy.layers.msrpce.msdcom.ObjectInstance(client: DCOM_Client, oid: int)[source]
Bases:
objectAn reference to an instantiated object.
This is a helper to manipulate this object and perform calls over it.
- property ndr64
Whether NDR64 is required to talk to this object
- sr1_req(pkt: NDRPacket, iface: ComInterface, ssp=None, auth_level=None, impersonation_type=None, timeout=None, **kwargs)[source]
Make an ORPC call on this object instance.
- Parameters:
iface – the ComInterface to call.
pkt – the request to make.
ssp – (optional) non default SSP to use to connect to the object exporter
auth_level – (optional) non default authn level to use
impersonation_type – (optional) non default impersonation type to use
timeout – (optional) timeout for the connection
- property valid
Returns whether the current object still exists
- class scapy.layers.msrpce.msdcom.PROPMARSHALHEADER(_pkt, /, *, clsid=None, policyId=None, flags=<Flag 0 ()>, cb=None, ctxProperty=b'')[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.PROPMARSHALHEADER'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.PropsOutInfo(_pkt, /, *, cIfs=None, piid=None, phresults=None, ppIntfData=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.PropsOutInfo'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.Resolver_Entry[source]
Bases:
objectAn entry in the Resolver table. [MS-DCOM] 3.2.1 Abstract Data Model
- binds: List[STRINGBINDING]
- client: DCERPC_Client | None
- hash: bytes | None
- secs: List[SECURITYBINDING]
- setid: int | None
- class scapy.layers.msrpce.msdcom.SECURITYBINDING(_pkt, /, *, wAuthnSvc=0, Reserved=65535, aPrincName=b'')[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.SECURITYBINDING'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.SETID_Entry[source]
Bases:
objectAn entry in the SETID table. [MS-DCOM] 3.2.1 Abstract Data Model
- oids: List[int]
- seq: int | None
- setid: int | None
- class scapy.layers.msrpce.msdcom.STDOBJREF(_pkt, /, *, flags=<Flag 0 ()>, cPublicRefs=0, oxid=0, oid=0, ipid=None)[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.STDOBJREF'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.STRINGBINDING(_pkt, /, *, wTowerId=0, aNetworkAddr=b'')[source]
Bases:
Packet- aliastypes = [<class 'scapy.layers.msrpce.msdcom.STRINGBINDING'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.ScmReplyInfoData(_pkt, /, *, pdwReserved=None, remoteReply=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.ScmReplyInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.ScmRequestInfoData(_pkt, /, *, pdwReserved=None, remoteRequest=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.ScmRequestInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- class scapy.layers.msrpce.msdcom.SecurityInfoData(_pkt, /, *, dwAuthnFlags=0, pServerInfo=None, pdwReserved=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.SecurityInfoData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- scapy.layers.msrpce.msdcom.ServerAlive2(host, timeout=5) Tuple[List[STRINGBINDING], List[SECURITYBINDING]][source]
Call IObjectExporter::ServerAlive2
- class scapy.layers.msrpce.msdcom.SpecialPropertiesData(_pkt, /, *, dwSessionId=4294967295, fRemoteThisSessionId=0, fClientImpersonating=0, fPartitionIDPresent=0, dwDefaultAuthnLvl=RPC_C_AUTHN_LEVEL.PKT_INTEGRITY, guidPartition=<GUID |>, dwPRTFlags=0, dwOrigClsctx=0, dwFlags=0, Reserved1=0, Reserved2=0, Reserved3=[0, 0, 0, 0, 0])[source]
Bases:
NDRPacket- ALIGNMENT = (8, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.SpecialPropertiesData'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<NDRIntField (SpecialPropertiesData).dwSessionId>, <NDRSignedIntField (SpecialPropertiesData).fRemoteThisSessionId>, <NDRSignedIntField (SpecialPropertiesData).fClientImpersonating>, <NDRSignedIntField (SpecialPropertiesData).fPartitionIDPresent>, <NDRIntField (SpecialPropertiesData).dwDefaultAuthnLvl>, <scapy.layers.dcerpc.NDRPacketField object>, <NDRIntField (SpecialPropertiesData).dwPRTFlags>, <NDRIntField (SpecialPropertiesData).dwOrigClsctx>, <scapy.layers.dcerpc.NDRIntEnumField object>, <NDRIntField (SpecialPropertiesData).Reserved1>, <NDRLongField (SpecialPropertiesData).Reserved2>, <NDRFieldListField (SpecialPropertiesData).Reserved3>]
- class scapy.layers.msrpce.msdcom.customREMOTE_REPLY_SCM_INFO(_pkt, /, *, Oxid=0, pdsaOxidBindings=None, ipidRemUnknown=<GUID |>, authnHint=0, serverVersion=<COMVERSION |>)[source]
Bases:
NDRPacket- ALIGNMENT = (8, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.customREMOTE_REPLY_SCM_INFO'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]
- fields_desc: ClassVar[List[Field[Any, Any] | _FieldContainer]] = [<NDRLongField (customREMOTE_REPLY_SCM_INFO).Oxid>, <scapy.layers.dcerpc.NDRFullEmbPointerField object>, <scapy.layers.dcerpc.NDRPacketField object>, <NDRIntField (customREMOTE_REPLY_SCM_INFO).authnHint>, <scapy.layers.dcerpc.NDRPacketField object>]
- class scapy.layers.msrpce.msdcom.customREMOTE_REQUEST_SCM_INFO(_pkt, /, *, ClientImpLevel=2, cRequestedProtseqs=None, pRequestedProtseqs=None)[source]
Bases:
NDRPacket- ALIGNMENT = (4, 8)
- aliastypes = [<class 'scapy.layers.msrpce.msdcom.customREMOTE_REQUEST_SCM_INFO'>, <class 'scapy.layers.dcerpc.NDRPacket'>, <class 'scapy.layers.dcerpc._NDRPacket'>, <class 'scapy.packet.Packet'>]