wmi-1.3.16 from opsview.com

This commit is contained in:
Are Casilla
2019-02-16 00:16:52 +01:00
parent 163fdd3d1b
commit 17b3af2911
2146 changed files with 678824 additions and 0 deletions
+37
View File
@@ -0,0 +1,37 @@
README for Samba SWIG Python extensions
---------------------------------------
Instructions for building:
1. Run configure with the --with-python option to enable python
extensions.
2. Edit the script/build_idl.sh script to pass the --swig option to
pidl. Here's a patch:
Index: script/build_idl.sh
===================================================================
--- script/build_idl.sh (revision 2413)
+++ script/build_idl.sh (working copy)
@@ -4,7 +4,7 @@
[ -d librpc/gen_ndr ] || mkdir -p librpc/gen_ndr || exit 1
-PIDL="$PERL ./build/pidl/pidl.pl --output librpc/gen_ndr/ndr_ --parse --header --parser --server"
+PIDL="$PERL ./build/pidl/pidl.pl --output librpc/gen_ndr/ndr_ --parse --header --parser --server --swig"
TABLES="$PERL ./build/pidl/tables.pl --output librpc/gen_ndr/tables"
if [ x$FULLBUILD = xFULL ]; then
3. Run 'make idl_full swig' to build extensions.
4. At some stage there will be a proper system for installing the
extensions, but right now it's easier to run them in place. Set
your PYTHONPATH to include the modules. From the Samba source
directory, run:
export PYTHONPATH=`pwd`/scripting/swig
Now you can go nuts and use the extensions. Check the
scripting/swig/torture directory for a testsuite. There will
hopefully be a bunch of usage examples somewhere.
+29
View File
@@ -0,0 +1,29 @@
dnl # Scripting subsystem
# Check for python support
PYTHON=
AC_ARG_WITH(python,
[ --with-python=PYTHONNAME build Python libraries],
[ case "${withval-python}" in
yes)
PYTHON=python
;;
no)
PYTHON=
;;
*)
PYTHON=${withval-python}
;;
esac ])
if test x"$PYTHON" != "x"; then
incdir=`python -c 'import sys; print "%s/include/python%d.%d" % (sys.prefix, sys.version_info[[0]], sys.version_info[[1]])'`
CPPFLAGS="$CPPFLAGS -I $incdir"
else
SMB_ENABLE(swig_dcerpc, NO)
fi
AC_SUBST(PYTHON)
+30
View File
@@ -0,0 +1,30 @@
#######################
# Start LIBRARY swig_dcerpc
[LIBRARY::swig_dcerpc]
LIBRARY_REALNAME = _dcerpc.$(SHLIBEXT)
PUBLIC_DEPENDENCIES = LIBCLI_SMB NDR_MISC LIBSAMBA-UTIL LIBSAMBA-CONFIG RPC_NDR_SAMR RPC_NDR_LSA DYNCONFIG
OBJ_FILES = dcerpc_wrap.o
# End LIBRARY swig_dcerpc
#######################
# Swig extensions
swig: lib/tdb/swig/_tdb.$(SHLIBEXT) lib/ldb/swig/_ldb.$(SHLIBEXT) \
libcli/swig/_libcli_nbt.$(SHLIBEXT)
.SUFFIXES: _wrap.c .i
.i_wrap.c:
swig -I$(srcdir)/scripting/swig -python $<
SWIG_INCLUDES = librpc/gen_ndr/samr.i librpc/gen_ndr/lsa.i librpc/gen_ndr/spoolss.i
scripting/swig/dcerpc_wrap.c: scripting/swig/dcerpc.i scripting/swig/samba.i scripting/swig/status_codes.i $(SWIG_INCLUDES)
clean::
@echo "Removing SWIG output files"
@-rm -f scripting/swig/tdb.pyc scripting/swig/tdb.py
# Swig testing
swigtest: swig
./script/tests/test_swig.sh
+239
View File
@@ -0,0 +1,239 @@
/* Tastes like -*- C -*- */
/*
Unix SMB/CIFS implementation.
Swig interface to librpc functions.
Copyright (C) Tim Potter 2004
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
%module dcerpc
%{
/* This symbol is used in both includes.h and Python.h which causes an
annoying compiler warning. */
#ifdef HAVE_FSTAT
#undef HAVE_FSTAT
#endif
#include "includes.h"
#include "dynconfig.h"
#undef strcpy
PyObject *ntstatus_exception, *werror_exception;
/* Set up return of a dcerpc.NTSTATUS exception */
void set_ntstatus_exception(int status)
{
PyObject *obj = Py_BuildValue("(i,s)", status,
nt_errstr(NT_STATUS(status)));
PyErr_SetObject(ntstatus_exception, obj);
}
void set_werror_exception(int status)
{
PyObject *obj = Py_BuildValue("(i,s)", status,
win_errstr(W_ERROR(status)));
PyErr_SetObject(werror_exception, obj);
}
%}
%include "samba.i"
%pythoncode %{
NTSTATUS = _dcerpc.NTSTATUS
WERROR = _dcerpc.WERROR
%}
%init %{
setup_logging("python", DEBUG_STDERR);
lp_load();
ntstatus_exception = PyErr_NewException("_dcerpc.NTSTATUS", NULL, NULL);
werror_exception = PyErr_NewException("_dcerpc.WERROR", NULL, NULL);
PyDict_SetItemString(d, "NTSTATUS", ntstatus_exception);
PyDict_SetItemString(d, "WERROR", werror_exception);
/* BINARY swig_dcerpc INIT */
extern NTSTATUS dcerpc_misc_init(void);
extern NTSTATUS dcerpc_krb5pac_init(void);
extern NTSTATUS dcerpc_samr_init(void);
extern NTSTATUS dcerpc_dcerpc_init(void);
extern NTSTATUS auth_sam_init(void);
extern NTSTATUS dcerpc_lsa_init(void);
extern NTSTATUS dcerpc_netlogon_init(void);
extern NTSTATUS gensec_init(void);
extern NTSTATUS auth_developer_init(void);
extern NTSTATUS gensec_spnego_init(void);
extern NTSTATUS auth_winbind_init(void);
extern NTSTATUS gensec_gssapi_init(void);
extern NTSTATUS gensec_ntlmssp_init(void);
extern NTSTATUS dcerpc_nbt_init(void);
extern NTSTATUS auth_anonymous_init(void);
extern NTSTATUS gensec_krb5_init(void);
extern NTSTATUS dcerpc_schannel_init(void);
extern NTSTATUS dcerpc_epmapper_init(void);
if (NT_STATUS_IS_ERR(dcerpc_misc_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_krb5pac_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_samr_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_dcerpc_init())) exit(1);
if (NT_STATUS_IS_ERR(auth_sam_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_lsa_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_netlogon_init())) exit(1);
if (NT_STATUS_IS_ERR(gensec_init())) exit(1);
if (NT_STATUS_IS_ERR(auth_developer_init())) exit(1);
if (NT_STATUS_IS_ERR(gensec_spnego_init())) exit(1);
if (NT_STATUS_IS_ERR(auth_winbind_init())) exit(1);
if (NT_STATUS_IS_ERR(gensec_gssapi_init())) exit(1);
if (NT_STATUS_IS_ERR(gensec_ntlmssp_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_nbt_init())) exit(1);
if (NT_STATUS_IS_ERR(auth_anonymous_init())) exit(1);
if (NT_STATUS_IS_ERR(gensec_krb5_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_schannel_init())) exit(1);
if (NT_STATUS_IS_ERR(dcerpc_epmapper_init())) exit(1);
%}
%typemap(in, numinputs=0) struct dcerpc_pipe **OUT (struct dcerpc_pipe *temp_dcerpc_pipe) {
$1 = &temp_dcerpc_pipe;
}
%typemap(in, numinputs=0) TALLOC_CTX * {
$1 = talloc_init("$symname");
}
%typemap(freearg) TALLOC_CTX * {
// talloc_free($1);
}
%typemap(argout) struct dcerpc_pipe ** {
long status = PyLong_AsLong(resultobj);
/* Throw exception if result was not OK */
if (status != 0) {
set_ntstatus_exception(status);
return NULL;
}
/* Set REF_ALLOC flag so we don't have to do too much extra
mucking around with ref variables in ndr unmarshalling. */
(*$1)->conn->flags |= DCERPC_NDR_REF_ALLOC;
/* Return swig handle on dcerpc_pipe */
resultobj = SWIG_NewPointerObj(*$1, SWIGTYPE_p_dcerpc_pipe, 0);
}
%types(struct dcerpc_pipe *);
%rename(pipe_connect) dcerpc_pipe_connect;
NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx,
struct dcerpc_pipe **OUT,
const char *binding,
const char *pipe_uuid,
uint32_t pipe_version,
struct cli_credentials *credentials);
%typemap(in) DATA_BLOB * (DATA_BLOB temp_data_blob) {
temp_data_blob.data = PyString_AsString($input);
temp_data_blob.length = PyString_Size($input);
$1 = &temp_data_blob;
}
const char *dcerpc_server_name(struct dcerpc_pipe *p);
char *nt_errstr(NTSTATUS nt_code);
/* Some typemaps for easier access to resume handles. Really this can
also be done using the uint32 carray functions, but it's a bit of a
hassle. TODO: Fix memory leak here. */
%typemap(in) uint32_t *resume_handle {
$1 = malloc(sizeof(*$1));
*$1 = PyLong_AsLong($input);
}
%typemap(out) uint32_t *resume_handle {
$result = PyLong_FromLong(*$1);
}
%typemap(in) struct policy_handle * {
if ((SWIG_ConvertPtr($input, (void **) &$1, $1_descriptor,
SWIG_POINTER_EXCEPTION)) == -1)
return NULL;
if ($1 == NULL) {
PyErr_SetString(PyExc_TypeError, "None is not a valid policy handle");
return NULL;
}
}
/* When returning a policy handle to Python we need to make a copy of
as the talloc context it is created under is destroyed after the
wrapper function returns. TODO: Fix memory leak created here. */
%typemap(out) struct policy_handle * {
if ($1) {
struct policy_handle *temp = (struct policy_handle *)malloc(sizeof(struct policy_handle));
memcpy(temp, $1, sizeof(struct policy_handle));
$result = SWIG_NewPointerObj(temp, SWIGTYPE_p_policy_handle, 0);
} else {
Py_INCREF(Py_None);
$result = Py_None;
}
}
%{
#include "librpc/gen_ndr/ndr_misc.h"
#include "librpc/gen_ndr/ndr_security.h"
#include "librpc/gen_ndr/ndr_samr.h"
%}
%include "carrays.i"
/* Some functions for accessing arrays of fixed-width integers. */
%array_functions(uint8_t, uint8_array);
%array_functions(uint16_t, uint16_array);
%array_functions(uint32_t, uint32_array);
/* Functions for handling arrays of structures. It would be nice for
pidl to automatically generating these instead of having to find
them all by hand. */
%array_functions(struct samr_SamEntry, samr_SamEntry_array);
%array_functions(union samr_ConnectInfo, samr_ConnectInfo_array);
%array_functions(struct samr_RidWithAttribute, samr_RidWithAttribute_array);
%array_functions(struct lsa_SidPtr, lsa_SidPtr_array);
%include "librpc/gen_ndr/misc.i"
%include "librpc/gen_ndr/security.i"
%include "librpc/gen_ndr/samr.i"
%include "librpc/gen_ndr/lsa.i"
+301
View File
@@ -0,0 +1,301 @@
#!/usr/bin/python
import sys, os, string
from cmd import Cmd
from optparse import OptionParser
from pprint import pprint
import dcerpc, samr
def swig2dict(obj):
"""Convert a swig object to a dictionary."""
result = {}
for attr in filter(lambda x: type(x) == str, dir(obj)):
if attr[:2] == '__' and attr[-2:] == '__':
continue
if attr == 'this' or attr == 'thisown':
continue
result[attr] = getattr(obj, attr)
return result
class rpcclient(Cmd):
prompt = 'rpcclient$ '
def __init__(self, server, cred):
Cmd.__init__(self)
self.server = server
self.cred = cred
def emptyline(self):
# Default for empty line is to repeat last command - yuck
pass
def onecmd(self, line):
# Override the onecmd() method so we can trap error returns
try:
Cmd.onecmd(self, line)
except dcerpc.NTSTATUS, arg:
print 'The command returned an error: %s' % arg[1]
# Command handlers
def do_help(self, line):
"""Displays on-line help for rpcclient commands."""
Cmd.do_help(self, line)
def do_shell(self, line):
status = os.system(line)
if os.WIFEXITED(status):
if os.WEXITSTATUS(status) != 0:
print 'Command exited with code %d' % os.WEXITSTATUS(status)
else:
print 'Command exited with signal %d' % os.WTERMSIG(status)
def do_EOF(self, line):
"""Exits rpcclient."""
print
sys.exit(0)
# SAMR pipe commands
def do_SamrEnumDomains(self, line):
"""Enumerate domain names."""
usage = 'usage: SamrEnumDomains'
if line != '':
print usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
for i in connect_handle.EnumDomains():
print i
def do_SamrLookupDomain(self, line):
"""Return the SID for a domain."""
usage = 'SamrLookupDomain DOMAIN'
parser = OptionParser(usage)
options, args = parser.parse_args(string.split(line))
if len(args) != 1:
print 'usage:', usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
print connect_handle.LookupDomain(args[0])
def do_SamrQueryDomInfo(self, line):
"""Return information about a domain designated by its SID."""
usage = 'SamrQueryDomInfo DOMAIN_SID [info_level]'
parser = OptionParser(usage)
options, args = parser.parse_args(string.split(line))
if (len(args) == 0) or (len(args) > 2):
print 'usage:', usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
domain_handle = connect_handle.OpenDomain(args[0])
if (len(args) == 2):
result = domain_handle.QueryDomainInfo(int(args[1]))
else:
result = domain_handle.QueryDomainInfo()
pprint(swig2dict(result))
def do_SamrQueryDomInfo2(self, line):
"""Return information about a domain designated by its SID.
(Windows 2000 and >)"""
usage = 'SamrQueryDomInfo2 DOMAIN_SID [info_level] (Windows 2000 and >)'
parser = OptionParser(usage)
options, args = parser.parse_args(string.split(line))
if len(args) == 0 or len(args) > 2:
print 'usage:', usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
domain_handle = connect_handle.OpenDomain(args[0])
if (len(args) == 2):
result = domain_handle.QueryDomainInfo2(int(args[1]))
else:
result = domain_handle.QueryDomainInfo2()
pprint(swig2dict(result))
def do_SamrEnumDomainGroups(self, line):
"""Return the list of groups of a domain designated by its SID."""
usage = 'SamrEnumDomainGroups DOMAIN_SID'
parser = OptionParser(usage)
options, args = parser.parse_args(string.split(line))
if len(args) != 1:
print 'usage:', usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
domain_handle = connect_handle.OpenDomain(args[0])
result = domain_handle.EnumDomainGroups()
pprint(result)
def do_SamrEnumDomainAliases(self, line):
"""Return the list of aliases (local groups) of a domain designated
by its SID."""
usage = 'SamrEnumDomainAliases DOMAIN_SID'
parser = OptionParser(usage)
options, args = parser.parse_args(string.split(line))
if len(args) != 1:
print 'usage:', usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
domain_handle = connect_handle.OpenDomain(args[0])
result = domain_handle.EnumDomainAliases()
pprint(result)
def do_SamrEnumDomainUsers(self, line):
"""Return the list of users of a domain designated by its SID."""
usage = 'SamrEnumDomainUsers DOMAIN_SID [user_account_flags]'
parser = OptionParser(usage)
options, args = parser.parse_args(string.split(line))
if (len(args) == 0) or (len(args) > 2):
print 'usage:', usage
return
pipe = dcerpc.pipe_connect(
'ncacn_np:%s' % self.server,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
self.cred)
connect_handle = samr.Connect(pipe)
domain_handle = connect_handle.OpenDomain(args[0])
if (len(args) == 2):
result = domain_handle.EnumDomainUsers(int(args[1]))
else:
result = domain_handle.EnumDomainUsers()
pprint(result)
if __name__ == '__main__':
# Parse command line
usage = 'rpcclient SERVER [options]'
if len(sys.argv) == 1:
print usage
sys.exit(1)
server = sys.argv[1]
del(sys.argv[1])
parser = OptionParser(usage)
parser.add_option('-U', '--username', action='store', type='string',
help='Use given credentials when connecting',
metavar='DOMAIN\\username%password',
dest='username')
parser.add_option('-c', '--command', action='store', type='string',
help='Execute COMMAND', dest='command')
options, args = parser.parse_args()
# Break --username up into domain, username and password
cred = None
if not options.username:
options.username = '%'
domain = ''
if string.find(options.username, '\\') != -1:
domain, options.username = string.split(options.username, '\\')
password = ''
if string.find(options.username, '%') != -1:
options.username, password = string.split(options.username, '%')
username = options.username
if username != '':
cred = (domain, username, password)
# Run command loop
c = rpcclient(server, cred)
if options.command:
c.onecmd(options.command)
sys.exit(0)
while 1:
try:
c.cmdloop()
except KeyboardInterrupt:
print 'KeyboardInterrupt'
+85
View File
@@ -0,0 +1,85 @@
/*
Unix SMB/CIFS implementation.
Common swig definitions
Copyright (C) 2004 Tim Potter <tpot@samba.org>
** NOTE! The following LGPL license applies to the swig
** definitions. This does NOT imply that all of Samba is released
** under the LGPL
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
%apply int { uint8_t };
%apply int { int8_t };
%apply unsigned int { uint16_t };
%apply int { int16_t };
%apply unsigned long long { uint64_t };
%apply long long { int64_t };
%typemap(in) uint32_t {
if (PyLong_Check($input))
$1 = PyLong_AsUnsignedLong($input);
else if (PyInt_Check($input))
$1 = PyInt_AsLong($input);
else {
PyErr_SetString(PyExc_TypeError,"Expected a long or an int");
return NULL;
}
}
%typemap(out) uint32_t {
$result = PyLong_FromUnsignedLong($1);
}
%typemap(in) NTSTATUS {
if (PyLong_Check($input))
$1 = NT_STATUS(PyLong_AsUnsignedLong($input));
else if (PyInt_Check($input))
$1 = NT_STATUS(PyInt_AsLong($input));
else {
PyErr_SetString(PyExc_TypeError, "Expected a long or an int");
return NULL;
}
}
%typemap(out) NTSTATUS {
$result = PyLong_FromUnsignedLong(NT_STATUS_V($1));
}
%typemap(in) struct cli_credentials * {
$1 = cli_credentials_init(NULL);
cli_credentials_set_conf($1);
if ($input == Py_None) {
cli_credentials_set_anonymous($1);
} else {
if (!PyTuple_Check($input) ||
PyTuple_Size($input) != 3) {
PyErr_SetString(PyExc_TypeError, "Expecting three element tuple");
return NULL;
}
if (!PyString_Check(PyTuple_GetItem($input, 0)) ||
!PyString_Check(PyTuple_GetItem($input, 1)) ||
!PyString_Check(PyTuple_GetItem($input, 2))) {
PyErr_SetString(PyExc_TypeError, "Expecting string elements");
return NULL;
}
cli_credentials_set_domain($1, PyString_AsString(PyTuple_GetItem($input, 0)), CRED_SPECIFIED);
cli_credentials_set_username($1, PyString_AsString(PyTuple_GetItem($input, 1)), CRED_SPECIFIED);
cli_credentials_set_password($1, PyString_AsString(PyTuple_GetItem($input, 2)), CRED_SPECIFIED);
}
}
+753
View File
@@ -0,0 +1,753 @@
import dcerpc
def sid_to_string(sid):
"""Convert a Python dictionary SID to a string SID."""
result = 'S-%d' % sid.sid_rev_num
result = result + '-%u' % \
(dcerpc.uint8_array_getitem(sid.id_auth, 5) +
(dcerpc.uint8_array_getitem(sid.id_auth, 4) << 8) +
(dcerpc.uint8_array_getitem(sid.id_auth, 3) << 16) +
(dcerpc.uint8_array_getitem(sid.id_auth, 2) << 24))
for i in range(0, sid.num_auths):
result = result + '-%u' % \
dcerpc.uint32_array_getitem(sid.sub_auths, i)
return result
def string_to_sid(string):
"""Convert a string SID to a Python dictionary SID. Throws a
ValueError if the SID string was badly formed."""
if string[0] != 'S':
raise ValueError('Bad SID format')
string = string[1:]
import re
match = re.match('-\d+', string)
if not match:
raise ValueError('Bad SID format')
try:
sid_rev_num = int(string[match.start()+1:match.end()])
except ValueError:
raise ValueError('Bad SID format')
string = string[match.end():]
match = re.match('-\d+', string)
if not match:
raise ValueError('Bad SID format')
try:
ia = int(string[match.start()+1:match.end()])
except ValueError:
raise ValueError('Bad SID format')
string = string[match.end():]
id_auth = [0, 0, (ia >> 24) & 0xff, (ia >> 16) & 0xff,
(ia >> 8) & 0xff, ia & 0xff]
num_auths = 0
sub_auths = []
while len(string):
match = re.match('-\d+', string)
if not match:
raise ValueError('Bad SID format')
try:
sa = int(string[match.start() + 1 : match.end()])
except ValueError:
raise ValueError('Bad SID format')
num_auths = num_auths + 1
sub_auths.append(int(sa))
string = string[match.end():]
sid = dcerpc.dom_sid()
sid.sid_rev_num = sid_rev_num
sid.id_auth = dcerpc.new_uint8_array(6)
for i in range(6):
dcerpc.uint8_array_setitem(sid.id_auth, i, id_auth[i])
sid.num_auths = num_auths
sid.sub_auths = dcerpc.new_uint32_array(num_auths)
for i in range(num_auths):
dcerpc.uint32_array_setitem(sid.sub_auths, i, sub_auths[i])
return sid
def call_fn(fn, pipe, args):
"""Wrap up a RPC call and throw an exception is an error was returned."""
result = fn(pipe, args);
if result & 0xc0000000L:
raise dcerpc.NTSTATUS(result, dcerpc.nt_errstr(result));
return result;
class SamrHandle:
def __init__(self, pipe, handle):
self.pipe = pipe
self.handle = handle
def __del__(self):
if self.handle is not None:
self.Close()
def Close(self):
r = dcerpc.samr_Close()
r.data_in.handle = self.handle
call_fn(dcerpc.dcerpc_samr_Close, self.pipe, r)
self.handle = None
def QuerySecurity(self, sec_info = 7):
r = dcerpc.samr_QuerySecurity()
r.data_in.handle = self.handle
r.data_in.sec_info = sec_info
call_fn(dcerpc.dcerpc_samr_QuerySecurity, self.pipe, r)
return r.data_out.sdbuf
def SetSecurity(self, sdbuf, sec_info = 7):
r = dcerpc.samr_SetSecurity()
r.data_in.handle = self.handle
r.data_in.sec_info = sec_info
r.data_in.sdbuf = sdbuf
call_fn(dcerpc.dcerpc_samr_SetSecurity, self.pipe, r)
class ConnectHandle(SamrHandle):
def EnumDomains(self):
r = dcerpc.samr_EnumDomains()
r.data_in.connect_handle = self.handle
r.data_in.resume_handle = 0
r.data_in.buf_size = -1
domains = []
while 1:
call_fn(dcerpc.dcerpc_samr_EnumDomains, self.pipe, r)
for i in range(r.data_out.sam.count):
domains.append(dcerpc.samr_SamEntry_array_getitem(
r.data_out.sam.entries, i).name.string)
# TODO: Handle more entries here
break
return domains
def LookupDomain(self, domain_name):
r = dcerpc.samr_LookupDomain()
r.data_in.connect_handle = self.handle
r.data_in.domain_name = dcerpc.samr_String()
r.data_in.domain_name.string = domain_name
call_fn(dcerpc.dcerpc_samr_LookupDomain, self.pipe, r)
return sid_to_string(r.data_out.sid);
def OpenDomain(self, domain_sid, access_mask = 0x02000000):
r = dcerpc.samr_OpenDomain()
r.data_in.connect_handle = self.handle
r.data_in.access_mask = access_mask
r.data_in.sid = string_to_sid(domain_sid)
call_fn(dcerpc.dcerpc_samr_OpenDomain, self.pipe, r)
return DomainHandle(self.pipe, r.data_out.domain_handle)
def Shutdown(self):
r = dcerpc.samr_Shutdown()
r.data_in.connect_handle = self.handle
call_fn(dcerpc.dcerpc_samr_Shutdown, self.pipe, r)
def GetDomPwInfo(self, domain_name):
r = dcerpc.samr_GetDomPwInfo()
r.data_in.domain_name = dcerpc.samr_String()
r.data_in.domain_name.string = domain_name
call_fn(dcerpc.dcerpc_samr_GetDomPwInfo, self.pipe, r)
return r.data_out.info
def SetBootKeyInformation(self, unknown1, unknown2, unknown3):
r = dcerpc.samr_GetBootKeyInformation()
r.data_in.connect_handle = self.handle
r.data_in.unknown1 = unknown1
r.data_in.unknown2 = unknown2
r.data_in.unknown3 = unknown3
call_fn(dcerpc.dcerpc_samr_SetBootKeyInformation, self.pipe, r)
class DomainHandle(SamrHandle):
def QueryDomainInfo(self, level = 2):
r = dcerpc.samr_QueryDomainInfo()
r.data_in.domain_handle = self.handle
r.data_in.level = level
call_fn(dcerpc.dcerpc_samr_QueryDomainInfo, self.pipe, r)
return getattr(r.data_out.info, 'info%d' % level)
def QueryDomainInfo2(self, level = 2):
r = dcerpc.samr_QueryDomainInfo2()
r.data_in.domain_handle = self.handle
r.data_in.level = level
call_fn(dcerpc.dcerpc_samr_QueryDomainInfo2, self.pipe, r)
return getattr(r.data_out.info, 'info%d' % level)
def SetDomainInfo(self, level, info):
r = dcerpc.samr_SetDomainInfo()
r.data_in.domain_handle = self.handle
r.data_in.level = level
r.data_in.info = dcerpc.samr_DomainInfo()
setattr(r.data_in.info, 'info%d' % level, info)
call_fn(dcerpc.dcerpc_samr_SetDomainInfo, self.pipe, r)
def EnumDomainGroups(self):
r = dcerpc.samr_EnumDomainGroups()
r.data_in.domain_handle = self.handle
r.data_in.resume_handle = 0
r.data_in.max_size = 1000
call_fn(dcerpc.dcerpc_samr_EnumDomainGroups, self.pipe, r)
groups = []
if r.data_out.sam.entries:
for i in range(r.data_out.sam.count):
groups.append(dcerpc.samr_SamEntry_array_getitem(
r.data_out.sam.entries, i).name.string)
return groups
def EnumDomainAliases(self):
r = dcerpc.samr_EnumDomainAliases()
r.data_in.domain_handle = self.handle
r.data_in.resume_handle = 0
# acct_flags in SamrEnumerateAliasesInDomain has probably
# no meaning so use 0xffffffff like W2K
r.data_in.acct_flags = 0xffffffffL
call_fn(dcerpc.dcerpc_samr_EnumDomainAliases, self.pipe, r)
aliases = []
if r.data_out.sam.entries:
for i in range(r.data_out.sam.count):
aliases.append(dcerpc.samr_SamEntry_array_getitem(
r.data_out.sam.entries, i).name.string)
return aliases
def EnumDomainUsers(self, user_account_flags = 16):
r = dcerpc.samr_EnumDomainUsers()
r.data_in.domain_handle = self.handle
r.data_in.resume_handle = 0
r.data_in.acct_flags = user_account_flags
r.data_in.max_size = 1000
call_fn(dcerpc.dcerpc_samr_EnumDomainUsers, self.pipe, r)
users = []
if r.data_out.sam.entries:
for i in range(r.data_out.sam.count):
users.append(dcerpc.samr_SamEntry_array_getitem(
r.data_out.sam.entries, i).name.string)
return users
def CreateUser(self, account_name, access_mask = 0x02000000):
r = dcerpc.samr_CreateUser()
r.data_in.domain_handle = self.handle
r.data_in.account_name = dcerpc.samr_String()
r.data_in.account_name.string = account_name
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_CreateUser, self.pipe, r)
return (r.data_out.user_handle,
dcerpc.uint32_array_getitem(r.data_out.rid, 0))
def CreateUser2(self, account_name, acct_flags = 0x00000010,
access_mask = 0x02000000):
r = dcerpc.samr_CreateUser2()
r.data_in.domain_handle = self.handle
r.data_in.account_name = dcerpc.samr_String()
r.data_in.account_name.string = account_name
r.data_in.acct_flags = acct_flags
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_CreateUser2, self.pipe, r)
return (r.data_out.user_handle,
dcerpc.uint32_array_getitem(r.data_out.access_granted, 0),
dcerpc.uint32_array_getitem(r.data_out.rid, 0))
def OpenUser(self, rid, access_mask = 0x02000000):
r = dcerpc.samr_OpenUser()
r.data_in.domain_handle = self.handle
r.data_in.access_mask = access_mask
r.data_in.rid = rid
call_fn(dcerpc.dcerpc_samr_OpenUser, self.pipe, r)
return UserHandle(self.pipe, r.data_out.user_handle)
def OpenGroup(self, rid, access_mask = 0x02000000):
r = dcerpc.samr_OpenGroup()
r.data_in.domain_handle = self.handle
r.data_in.access_mask = access_mask
r.data_in.rid = rid
call_fn(dcerpc.dcerpc_samr_OpenGroup, self.pipe, r)
return GroupHandle(self.pipe, r.data_out.group_handle)
def OpenAlias(self, rid, access_mask = 0x02000000):
r = dcerpc.samr_OpenAlias()
r.data_in.domain_handle = self.handle
r.data_in.access_mask = access_mask
r.data_in.rid = rid
call_fn(dcerpc.dcerpc_samr_OpenAlias, self.pipe, r)
return AliasHandle(self.pipe, r.data_out.alias_handle)
def CreateDomAlias(self, alias_name, access_mask = 0x02000000):
r = dcerpc.samr_CreateDomAlias()
r.data_in.domain_handle = self.handle
r.data_in.alias_name = dcerpc.samr_String()
r.data_in.alias_name.string = alias_name
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_CreateDomAlias, self.pipe, r)
return (AliasHandle(self.pipe, r.data_out.alias_handle),
r.data_out.rid)
def RidToSid(self, rid):
r = dcerpc.samr_RidToSid()
r.data_in.domain_handle = self.handle
r.data_in.rid = rid
call_fn(dcerpc.dcerpc_samr_RidToSid, self.pipe, r)
return sid_to_string(r.data_out.sid)
def RemoveMemberFromForeignDomain(self, sid):
r = dcerpc.samr_RemoveMemberFromForeignDomain()
r.data_in.domain_handle = self.handle
r.data_in.sid = sid
call_fn(dcerpc.dcerpc_samr_RemoveMemberFromForeignDomain, self.pipe, r)
def LookupNames(self, names):
r = dcerpc.samr_LookupNames()
r.data_in.domain_handle = self.handle
r.data_in.num_names = len(names)
r.data_in.names = dcerpc.new_samr_String_array(len(names))
for i in range(len(names)):
s = dcerpc.samr_String()
s.string = names[i]
dcerpc.samr_String_array_setitem(r.data_in.names, i, s)
call_fn(dcerpc.dcerpc_samr_LookupNames, self.pipe, r)
return ([dcerpc.uint32_array_getitem(r.data_out.rids.ids, i)
for i in range(r.data_out.rids.count)],
[dcerpc.uint32_array_getitem(r.data_out.types.ids, i)
for i in range(r.data_out.types.count)])
def CreateDomainGroup(self, domain_name, access_mask = 0x02000000):
r = dcerpc.samr_CreateDomainGroup()
r.data_in.domain_handle = self.handle
r.data_in.name = dcerpc.samr_String()
r.data_in.name.string = domain_name
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_CreateDomainGroup, self.pipe, r)
def GetAliasMembership(self, sids):
r = dcerpc.samr_GetAliasMembership()
r.data_in.domain_handle = self.handle
r.data_in.sids = dcerpc.lsa_SidArray()
r.data_in.sids.num_sids = len(sids)
r.data_in.sids.sids = dcerpc.new_lsa_SidPtr_array(len(sids))
for i in range(len(sids)):
s = dcerpc.lsa_SidPtr()
s.sid = string_to_sid(sids[i])
dcerpc.lsa_SidPtr_array_setitem(r.data_in.sids.sids, i, s)
call_fn(dcerpc.dcerpc_samr_GetAliasMembership, self.pipe, r)
return [r.ids[x] for x in range(r.count)]
def QueryDisplayInfo(self, level):
# TODO: Handle more data returns
r = dcerpc.samr_QueryDisplayInfo()
r.data_in.domain_handle = self.handle
r.data_in.level = level
r.data_in.start_idx = 0
r.data_in.max_entries = 1000
r.data_in.buf_size = -1
call_fn(dcerpc.dcerpc_samr_QueryDisplayInfo, self.pipe, r)
# TODO: Return a mapping of the various samr_DispInfo
# structures here.
return getattr(r.data_out.info, 'info%d' % level)
def QueryDisplayInfo2(self, level):
# TODO: Handle more data returns
r = dcerpc.samr_QueryDisplayInfo2()
r.data_in.domain_handle = self.handle
r.data_in.level = level
r.data_in.start_idx = 0
r.data_in.max_entries = 1000
r.data_in.buf_size = -1
call_fn(dcerpc.dcerpc_samr_QueryDisplayInfo2, self.pipe, r)
# TODO: Return a mapping of the various samr_DispInfo
# structures here.
return getattr(r.data_out.info, 'info%d' % level)
def QueryDisplayInfo3(self, level):
# TODO: Handle more data returns
r = dcerpc.samr_QueryDisplayInfo3()
r.data_in.domain_handle = self.handle
r.data_in.level = level
r.data_in.start_idx = 0
r.data_in.max_entries = 1000
r.data_in.buf_size = -1
call_fn(dcerpc.dcerpc_samr_QueryDisplayInfo3, self.pipe, r)
# TODO: Return a mapping of the various samr_DispInfo
# structures here.
return getattr(r.data_out.info, 'info%d' % level)
def GetBootKeyInformation(self):
r = dcerpc.samr_GetBootKeyInformation()
r.data_in.domain_handle = self.handle
call_fn(dcerpc.dcerpc_samr_GetBootKeyInformation, self.pipe, r)
return r.data_out.unknown
def SetBootKeyInformation(self):
r = dcerpc.samr_GetBootKeyInformation()
r.data_in.domain_handle = self.handle
call_fn(dcerpc.dcerpc_samr_GetBootKeyInformation, self.pipe, r)
def TestPrivateFunctionsDomain(self):
r = dcerpc.samr_TestPrivateFunctionsDomain()
r.data_in.domain_handle = self.handle
call_fn(dcerpc.dcerpc_samr_TestPrivateFunctionsDomain, self.pipe, r)
class UserHandle(SamrHandle):
def DeleteUser(self):
r = dcerpc.samr_DeleteUser()
r.data_in.user_handle = self.handle
call_fn(dcerpc.dcerpc_samr_DeleteUser, self.pipe, r)
self.handle = None
def GetUserPwInfo(self):
r = dcerpc.samr_GetUserPwInfo()
r.data_in.user_handle = self.handle
call_fn(dcerpc.dcerpc_samr_GetUserPwInfo, self.pipe, r)
return r.data_out.info
def QueryUserInfo(self, level):
r = dcerpc.samr_QueryUserInfo()
r.data_in.user_handle = self.handle
r.data_in.level = level
call_fn(dcerpc.dcerpc_samr_QueryUserInfo, self.pipe, r)
return r.data_out.info
def QueryUserInfo2(self, level):
r = dcerpc.samr_QueryUserInfo2()
r.data_in.user_handle = self.handle
r.data_in.level = level
call_fn(dcerpc.dcerpc_samr_QueryUserInfo2, self.pipe, r)
return r.data_out.info
def GetGroupsForUser(self):
r = dcerpc.samr_GetGroupsForUser()
r.data_in.user_handle = self.handle
call_fn(dcerpc.dcerpc_samr_GetGroupsForUser, self.pipe, r)
rid_types = [dcerpc.samr_RidType_array_getitem(r.data_out.rids.rid, x)
for x in range(r.data_out.rids.count)]
return [(x.rid, x.type) for x in rid_types]
def TestPrivateFunctionsUser(self):
r = dcerpc.samr_TestPrivateFunctionsUser()
r.data_in.user_handle = self.handle
call_fn(dcerpc.dcerpc_samr_TestPrivateFunctionsUser, self.pipe, r)
class GroupHandle(SamrHandle):
def QueryGroupInfo(self, level):
r = dcerpc.samr_QueryGroupInfo()
r.data_in.group_handle = self.handle
r.data_in.level = level
call_fn(dcerpc.dcerpc_samr_QueryGroupInfo, self.pipe, r)
return r.data_out.info
def SetGroupInfo(self, level, info):
r = dcerpc.samr_SetGroupInfo()
r.data_in.group_handle = self.handle
r.data_in.level = level
r.data_in.info = info
call_fn(dcerpc.dcerpc_samr_SetGroupInfo, self.pipe, r)
def QueryGroupMember(self):
r = dcerpc.samr_QueryGroupMember()
r.data_in.group_handle = self.handle
call_fn(dcerpc.dcerpc_samr_QueryGroupMember, self.pipe, r)
return [(dcerpc.uint32_array_getitem(r.data_out.rids.rids, x),
dcerpc.uint32_array_getitem(r.data_out.rids.unknown, x))
for x in range(r.data_out.rids.count)]
class AliasHandle(SamrHandle):
def DeleteDomAlias(self):
r = dcerpc.samr_DeleteDomAlias()
r.data_in.alias_handle = self.handle
call_fn(dcerpc.dcerpc_samr_DeleteDomAlias, self.pipe, r)
self.handle = None
def QueryAliasInfo(self, level = 1):
r = dcerpc.samr_QueryAliasInfo()
r.data_in.alias_handle = self.handle
r.data_in.level = level
call_fn(dcerpc.dcerpc_samr_QueryAliasInfo, self.pipe, r)
return r.data_out.info
def SetAliasInfo(self, level, info):
r = dcerpc.samr_SetAliasInfo()
r.data_in.alias_handle = self.handle
r.data_in.level = level
r.data_in.info = info
call_fn(dcerpc.dcerpc_samr_SetAliasInfo, self.pipe, r)
def AddAliasMember(self, sid):
r = dcerpc.samr_AddAliasMember()
r.data_in.alias_handle = self.handle
r.data_in.sid = string_to_sid(sid)
call_fn(dcerpc.dcerpc_samr_AddAliasMember, self.pipe, r)
def AddMultipleMembersToAlias(self, sids):
r = dcerpc.samr_AddMultipleMembersToAlias()
r.data_in.alias_handle = self.handle
r.data_in.sids = dcerpc.lsa_SidArray()
r.data_in.sids.num_sids = len(sids)
r.data_in.sids.sids = dcerpc.new_lsa_SidPtr_array(len(sids))
for i in range(len(sids)):
s = dcerpc.lsa_SidPtr()
s.sid = string_to_sid(sids[i])
dcerpc.lsa_SidPtr_array_setitem(r.data_in.sids.sids, i, s)
call_fn(dcerpc.dcerpc_samr_AddMultipleMembersToAlias, self.pipe, r)
def GetMembersInAlias(self):
r = dcerpc.samr_GetMembersInAlias()
r.data_in.alias_handle = self.handle
call_fn(dcerpc.dcerpc_samr_GetMembersInAlias, self.pipe, r)
return [
sid_to_string(
dcerpc.lsa_SidPtr_array_getitem(r.data_out.sids.sids, x).sid)
for x in range(r.data_out.sids.num_sids)]
def Connect(pipe, access_mask = 0x02000000):
r = dcerpc.samr_Connect()
r.data_in.system_name = dcerpc.new_uint16_array(1)
dcerpc.uint16_array_setitem(r.data_in.system_name, 0, ord('\\'))
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_Connect, pipe, r)
return ConnectHandle(pipe, r.data_out.connect_handle)
def Connect2(pipe, system_name = '', access_mask = 0x02000000):
"""Connect to the SAMR pipe."""
r = dcerpc.samr_Connect2()
r.data_in.system_name = system_name
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_Connect2, pipe, r)
return ConnectHandle(pipe, r.data_out.connect_handle)
def Connect3(pipe, system_name = '', access_mask = 0x02000000):
r = dcerpc.samr_Connect3()
r.data_in.system_name = system_name
r.data_in.unknown = 0
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_Connect3, pipe, r)
return ConnectHandle(pipe, r.data_out.connect_handle)
def Connect4(pipe, system_name = '', access_mask = 0x02000000):
r = dcerpc.samr_Connect4()
r.data_in.system_name = system_name
r.data_in.unknown = 0
r.data_in.access_mask = access_mask
call_fn(dcerpc.dcerpc_samr_Connect4, pipe, r)
return ConnectHandle(pipe, r.data_out.connect_handle)
def Connect5(pipe, system_name = '', access_mask = 0x02000000):
r = dcerpc.samr_Connect5()
r.data_in.system_name = system_name
r.data_in.access_mask = access_mask
r.data_in.level = 1
r.data_in.info = dcerpc.new_samr_ConnectInfo_array(1)
r.data_in.info.unknown1 = 0
r.data_in.info.unknown2 = 0
call_fn(dcerpc.dcerpc_samr_Connect5, pipe, r)
return ConnectHandle(pipe, r.data_out.connect_handle)
# AddGroupMember
# DeleteDomainGroup
# DeleteGroupMember
# SetMemberAttributesofGroup
# AddAliasMember
# DeleteAliasMember
# GetMembersinAlias
# SetUserInfo
# ChangePasswordUser
# GetDisplayEnumerationIndex
# RemoveMemberFromForeignDomain
# GetDisplayEnumerationIndex2
# RemoveMultipleMembersFromAlias
# OemChangePasswordUser2
# ChangePasswordUser2
# SetUserInfo2
# ChangePasswordUser3
# SetDsrmPassword
# ValidatePassword
+554
View File
@@ -0,0 +1,554 @@
/* Win32 status codes */
#define STATUS_BUFFER_OVERFLOW 0x80000005
#define STATUS_NO_MORE_FILES 0x80000006
#define NT_STATUS_NO_MORE_ENTRIES 0x8000001a
#define STATUS_MORE_ENTRIES 0x0105
#define STATUS_SOME_UNMAPPED 0x0107
#define ERROR_INVALID_PARAMETER 0x0057
#define ERROR_INSUFFICIENT_BUFFER 0x007a
#define STATUS_NOTIFY_ENUM_DIR 0x010c
#define ERROR_INVALID_DATATYPE 0x070c
/* NT status codes */
#define NT_STATUS_OK 0x00000000
#define NT_STATUS_UNSUCCESSFUL 0xC0000001
#define NT_STATUS_NOT_IMPLEMENTED 0xC0000002
#define NT_STATUS_INVALID_INFO_CLASS 0xC0000003
#define NT_STATUS_INFO_LENGTH_MISMATCH 0xC0000004
#define NT_STATUS_ACCESS_VIOLATION 0xC0000005
#define NT_STATUS_IN_PAGE_ERROR 0xC0000006
#define NT_STATUS_PAGEFILE_QUOTA 0xC0000007
#define NT_STATUS_INVALID_HANDLE 0xC0000008
#define NT_STATUS_BAD_INITIAL_STACK 0xC0000009
#define NT_STATUS_BAD_INITIAL_PC 0xC000000a
#define NT_STATUS_INVALID_CID 0xC000000b
#define NT_STATUS_TIMER_NOT_CANCELED 0xC000000c
#define NT_STATUS_INVALID_PARAMETER 0xC000000d
#define NT_STATUS_NO_SUCH_DEVICE 0xC000000e
#define NT_STATUS_NO_SUCH_FILE 0xC000000f
#define NT_STATUS_INVALID_DEVICE_REQUEST 0xC0000010
#define NT_STATUS_END_OF_FILE 0xC0000011
#define NT_STATUS_WRONG_VOLUME 0xC0000012
#define NT_STATUS_NO_MEDIA_IN_DEVICE 0xC0000013
#define NT_STATUS_UNRECOGNIZED_MEDIA 0xC0000014
#define NT_STATUS_NONEXISTENT_SECTOR 0xC0000015
#define NT_STATUS_MORE_PROCESSING_REQUIRED 0xC0000016
#define NT_STATUS_NO_MEMORY 0xC0000017
#define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000018
#define NT_STATUS_NOT_MAPPED_VIEW 0xC0000019
#define NT_STATUS_UNABLE_TO_FREE_VM 0xC000001a
#define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC000001b
#define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC000001c
#define NT_STATUS_ILLEGAL_INSTRUCTION 0xC000001d
#define NT_STATUS_INVALID_LOCK_SEQUENCE 0xC000001e
#define NT_STATUS_INVALID_VIEW_SIZE 0xC000001f
#define NT_STATUS_INVALID_FILE_FOR_SECTION 0xC0000020
#define NT_STATUS_ALREADY_COMMITTED 0xC0000021
#define NT_STATUS_ACCESS_DENIED 0xC0000022
#define NT_STATUS_BUFFER_TOO_SMALL 0xC0000023
#define NT_STATUS_OBJECT_TYPE_MISMATCH 0xC0000024
#define NT_STATUS_NONCONTINUABLE_EXCEPTION 0xC0000025
#define NT_STATUS_INVALID_DISPOSITION 0xC0000026
#define NT_STATUS_UNWIND 0xC0000027
#define NT_STATUS_BAD_STACK 0xC0000028
#define NT_STATUS_INVALID_UNWIND_TARGET 0xC0000029
#define NT_STATUS_NOT_LOCKED 0xC000002a
#define NT_STATUS_PARITY_ERROR 0xC000002b
#define NT_STATUS_UNABLE_TO_DECOMMIT_VM 0xC000002c
#define NT_STATUS_NOT_COMMITTED 0xC000002d
#define NT_STATUS_INVALID_PORT_ATTRIBUTES 0xC000002e
#define NT_STATUS_PORT_MESSAGE_TOO_LONG 0xC000002f
#define NT_STATUS_INVALID_PARAMETER_MIX 0xC0000030
#define NT_STATUS_INVALID_QUOTA_LOWER 0xC0000031
#define NT_STATUS_DISK_CORRUPT_ERROR 0xC0000032
#define NT_STATUS_OBJECT_NAME_INVALID 0xC0000033
#define NT_STATUS_OBJECT_NAME_NOT_FOUND 0xC0000034
#define NT_STATUS_OBJECT_NAME_COLLISION 0xC0000035
#define NT_STATUS_HANDLE_NOT_WAITABLE 0xC0000036
#define NT_STATUS_PORT_DISCONNECTED 0xC0000037
#define NT_STATUS_DEVICE_ALREADY_ATTACHED 0xC0000038
#define NT_STATUS_OBJECT_PATH_INVALID 0xC0000039
#define NT_STATUS_OBJECT_PATH_NOT_FOUND 0xC000003a
#define NT_STATUS_OBJECT_PATH_SYNTAX_BAD 0xC000003b
#define NT_STATUS_DATA_OVERRUN 0xC000003c
#define NT_STATUS_DATA_LATE_ERROR 0xC000003d
#define NT_STATUS_DATA_ERROR 0xC000003e
#define NT_STATUS_CRC_ERROR 0xC000003f
#define NT_STATUS_SECTION_TOO_BIG 0xC0000040
#define NT_STATUS_PORT_CONNECTION_REFUSED 0xC0000041
#define NT_STATUS_INVALID_PORT_HANDLE 0xC0000042
#define NT_STATUS_SHARING_VIOLATION 0xC0000043
#define NT_STATUS_QUOTA_EXCEEDED 0xC0000044
#define NT_STATUS_INVALID_PAGE_PROTECTION 0xC0000045
#define NT_STATUS_MUTANT_NOT_OWNED 0xC0000046
#define NT_STATUS_SEMAPHORE_LIMIT_EXCEEDED 0xC0000047
#define NT_STATUS_PORT_ALREADY_SET 0xC0000048
#define NT_STATUS_SECTION_NOT_IMAGE 0xC0000049
#define NT_STATUS_SUSPEND_COUNT_EXCEEDED 0xC000004a
#define NT_STATUS_THREAD_IS_TERMINATING 0xC000004b
#define NT_STATUS_BAD_WORKING_SET_LIMIT 0xC000004c
#define NT_STATUS_INCOMPATIBLE_FILE_MAP 0xC000004d
#define NT_STATUS_SECTION_PROTECTION 0xC000004e
#define NT_STATUS_EAS_NOT_SUPPORTED 0xC000004f
#define NT_STATUS_EA_TOO_LARGE 0xC0000050
#define NT_STATUS_NONEXISTENT_EA_ENTRY 0xC0000051
#define NT_STATUS_NO_EAS_ON_FILE 0xC0000052
#define NT_STATUS_EA_CORRUPT_ERROR 0xC0000053
#define NT_STATUS_FILE_LOCK_CONFLICT 0xC0000054
#define NT_STATUS_LOCK_NOT_GRANTED 0xC0000055
#define NT_STATUS_DELETE_PENDING 0xC0000056
#define NT_STATUS_CTL_FILE_NOT_SUPPORTED 0xC0000057
#define NT_STATUS_UNKNOWN_REVISION 0xC0000058
#define NT_STATUS_REVISION_MISMATCH 0xC0000059
#define NT_STATUS_INVALID_OWNER 0xC000005a
#define NT_STATUS_INVALID_PRIMARY_GROUP 0xC000005b
#define NT_STATUS_NO_IMPERSONATION_TOKEN 0xC000005c
#define NT_STATUS_CANT_DISABLE_MANDATORY 0xC000005d
#define NT_STATUS_NO_LOGON_SERVERS 0xC000005e
#define NT_STATUS_NO_SUCH_LOGON_SESSION 0xC000005f
#define NT_STATUS_NO_SUCH_PRIVILEGE 0xC0000060
#define NT_STATUS_PRIVILEGE_NOT_HELD 0xC0000061
#define NT_STATUS_INVALID_ACCOUNT_NAME 0xC0000062
#define NT_STATUS_USER_EXISTS 0xC0000063
#define NT_STATUS_NO_SUCH_USER 0xC0000064
#define NT_STATUS_GROUP_EXISTS 0xC0000065
#define NT_STATUS_NO_SUCH_GROUP 0xC0000066
#define NT_STATUS_MEMBER_IN_GROUP 0xC0000067
#define NT_STATUS_MEMBER_NOT_IN_GROUP 0xC0000068
#define NT_STATUS_LAST_ADMIN 0xC0000069
#define NT_STATUS_WRONG_PASSWORD 0xC000006a
#define NT_STATUS_ILL_FORMED_PASSWORD 0xC000006b
#define NT_STATUS_PASSWORD_RESTRICTION 0xC000006c
#define NT_STATUS_LOGON_FAILURE 0xC000006d
#define NT_STATUS_ACCOUNT_RESTRICTION 0xC000006e
#define NT_STATUS_INVALID_LOGON_HOURS 0xC000006f
#define NT_STATUS_INVALID_WORKSTATION 0xC0000070
#define NT_STATUS_PASSWORD_EXPIRED 0xC0000071
#define NT_STATUS_ACCOUNT_DISABLED 0xC0000072
#define NT_STATUS_NONE_MAPPED 0xC0000073
#define NT_STATUS_TOO_MANY_LUIDS_REQUESTED 0xC0000074
#define NT_STATUS_LUIDS_EXHAUSTED 0xC0000075
#define NT_STATUS_INVALID_SUB_AUTHORITY 0xC0000076
#define NT_STATUS_INVALID_ACL 0xC0000077
#define NT_STATUS_INVALID_SID 0xC0000078
#define NT_STATUS_INVALID_SECURITY_DESCR 0xC0000079
#define NT_STATUS_PROCEDURE_NOT_FOUND 0xC000007a
#define NT_STATUS_INVALID_IMAGE_FORMAT 0xC000007b
#define NT_STATUS_NO_TOKEN 0xC000007c
#define NT_STATUS_BAD_INHERITANCE_ACL 0xC000007d
#define NT_STATUS_RANGE_NOT_LOCKED 0xC000007e
#define NT_STATUS_DISK_FULL 0xC000007f
#define NT_STATUS_SERVER_DISABLED 0xC0000080
#define NT_STATUS_SERVER_NOT_DISABLED 0xC0000081
#define NT_STATUS_TOO_MANY_GUIDS_REQUESTED 0xC0000082
#define NT_STATUS_GUIDS_EXHAUSTED 0xC0000083
#define NT_STATUS_INVALID_ID_AUTHORITY 0xC0000084
#define NT_STATUS_AGENTS_EXHAUSTED 0xC0000085
#define NT_STATUS_INVALID_VOLUME_LABEL 0xC0000086
#define NT_STATUS_SECTION_NOT_EXTENDED 0xC0000087
#define NT_STATUS_NOT_MAPPED_DATA 0xC0000088
#define NT_STATUS_RESOURCE_DATA_NOT_FOUND 0xC0000089
#define NT_STATUS_RESOURCE_TYPE_NOT_FOUND 0xC000008a
#define NT_STATUS_RESOURCE_NAME_NOT_FOUND 0xC000008b
#define NT_STATUS_ARRAY_BOUNDS_EXCEEDED 0xC000008c
#define NT_STATUS_FLOAT_DENORMAL_OPERAND 0xC000008d
#define NT_STATUS_FLOAT_DIVIDE_BY_ZERO 0xC000008e
#define NT_STATUS_FLOAT_INEXACT_RESULT 0xC000008f
#define NT_STATUS_FLOAT_INVALID_OPERATION 0xC0000090
#define NT_STATUS_FLOAT_OVERFLOW 0xC0000091
#define NT_STATUS_FLOAT_STACK_CHECK 0xC0000092
#define NT_STATUS_FLOAT_UNDERFLOW 0xC0000093
#define NT_STATUS_INTEGER_DIVIDE_BY_ZERO 0xC0000094
#define NT_STATUS_INTEGER_OVERFLOW 0xC0000095
#define NT_STATUS_PRIVILEGED_INSTRUCTION 0xC0000096
#define NT_STATUS_TOO_MANY_PAGING_FILES 0xC0000097
#define NT_STATUS_FILE_INVALID 0xC0000098
#define NT_STATUS_ALLOTTED_SPACE_EXCEEDED 0xC0000099
#define NT_STATUS_INSUFFICIENT_RESOURCES 0xC000009a
#define NT_STATUS_DFS_EXIT_PATH_FOUND 0xC000009b
#define NT_STATUS_DEVICE_DATA_ERROR 0xC000009c
#define NT_STATUS_DEVICE_NOT_CONNECTED 0xC000009d
#define NT_STATUS_DEVICE_POWER_FAILURE 0xC000009e
#define NT_STATUS_FREE_VM_NOT_AT_BASE 0xC000009f
#define NT_STATUS_MEMORY_NOT_ALLOCATED 0xC00000a0
#define NT_STATUS_WORKING_SET_QUOTA 0xC00000a1
#define NT_STATUS_MEDIA_WRITE_PROTECTED 0xC00000a2
#define NT_STATUS_DEVICE_NOT_READY 0xC00000a3
#define NT_STATUS_INVALID_GROUP_ATTRIBUTES 0xC00000a4
#define NT_STATUS_BAD_IMPERSONATION_LEVEL 0xC00000a5
#define NT_STATUS_CANT_OPEN_ANONYMOUS 0xC00000a6
#define NT_STATUS_BAD_VALIDATION_CLASS 0xC00000a7
#define NT_STATUS_BAD_TOKEN_TYPE 0xC00000a8
#define NT_STATUS_BAD_MASTER_BOOT_RECORD 0xC00000a9
#define NT_STATUS_INSTRUCTION_MISALIGNMENT 0xC00000aa
#define NT_STATUS_INSTANCE_NOT_AVAILABLE 0xC00000ab
#define NT_STATUS_PIPE_NOT_AVAILABLE 0xC00000ac
#define NT_STATUS_INVALID_PIPE_STATE 0xC00000ad
#define NT_STATUS_PIPE_BUSY 0xC00000ae
#define NT_STATUS_ILLEGAL_FUNCTION 0xC00000af
#define NT_STATUS_PIPE_DISCONNECTED 0xC00000b0
#define NT_STATUS_PIPE_CLOSING 0xC00000b1
#define NT_STATUS_PIPE_CONNECTED 0xC00000b2
#define NT_STATUS_PIPE_LISTENING 0xC00000b3
#define NT_STATUS_INVALID_READ_MODE 0xC00000b4
#define NT_STATUS_IO_TIMEOUT 0xC00000b5
#define NT_STATUS_FILE_FORCED_CLOSED 0xC00000b6
#define NT_STATUS_PROFILING_NOT_STARTED 0xC00000b7
#define NT_STATUS_PROFILING_NOT_STOPPED 0xC00000b8
#define NT_STATUS_COULD_NOT_INTERPRET 0xC00000b9
#define NT_STATUS_FILE_IS_A_DIRECTORY 0xC00000ba
#define NT_STATUS_NOT_SUPPORTED 0xC00000bb
#define NT_STATUS_REMOTE_NOT_LISTENING 0xC00000bc
#define NT_STATUS_DUPLICATE_NAME 0xC00000bd
#define NT_STATUS_BAD_NETWORK_PATH 0xC00000be
#define NT_STATUS_NETWORK_BUSY 0xC00000bf
#define NT_STATUS_DEVICE_DOES_NOT_EXIST 0xC00000c0
#define NT_STATUS_TOO_MANY_COMMANDS 0xC00000c1
#define NT_STATUS_ADAPTER_HARDWARE_ERROR 0xC00000c2
#define NT_STATUS_INVALID_NETWORK_RESPONSE 0xC00000c3
#define NT_STATUS_UNEXPECTED_NETWORK_ERROR 0xC00000c4
#define NT_STATUS_BAD_REMOTE_ADAPTER 0xC00000c5
#define NT_STATUS_PRINT_QUEUE_FULL 0xC00000c6
#define NT_STATUS_NO_SPOOL_SPACE 0xC00000c7
#define NT_STATUS_PRINT_CANCELLED 0xC00000c8
#define NT_STATUS_NETWORK_NAME_DELETED 0xC00000c9
#define NT_STATUS_NETWORK_ACCESS_DENIED 0xC00000ca
#define NT_STATUS_BAD_DEVICE_TYPE 0xC00000cb
#define NT_STATUS_BAD_NETWORK_NAME 0xC00000cc
#define NT_STATUS_TOO_MANY_NAMES 0xC00000cd
#define NT_STATUS_TOO_MANY_SESSIONS 0xC00000ce
#define NT_STATUS_SHARING_PAUSED 0xC00000cf
#define NT_STATUS_REQUEST_NOT_ACCEPTED 0xC00000d0
#define NT_STATUS_REDIRECTOR_PAUSED 0xC00000d1
#define NT_STATUS_NET_WRITE_FAULT 0xC00000d2
#define NT_STATUS_PROFILING_AT_LIMIT 0xC00000d3
#define NT_STATUS_NOT_SAME_DEVICE 0xC00000d4
#define NT_STATUS_FILE_RENAMED 0xC00000d5
#define NT_STATUS_VIRTUAL_CIRCUIT_CLOSED 0xC00000d6
#define NT_STATUS_NO_SECURITY_ON_OBJECT 0xC00000d7
#define NT_STATUS_CANT_WAIT 0xC00000d8
#define NT_STATUS_PIPE_EMPTY 0xC00000d9
#define NT_STATUS_CANT_ACCESS_DOMAIN_INFO 0xC00000da
#define NT_STATUS_CANT_TERMINATE_SELF 0xC00000db
#define NT_STATUS_INVALID_SERVER_STATE 0xC00000dc
#define NT_STATUS_INVALID_DOMAIN_STATE 0xC00000dd
#define NT_STATUS_INVALID_DOMAIN_ROLE 0xC00000de
#define NT_STATUS_NO_SUCH_DOMAIN 0xC00000df
#define NT_STATUS_DOMAIN_EXISTS 0xC00000e0
#define NT_STATUS_DOMAIN_LIMIT_EXCEEDED 0xC00000e1
#define NT_STATUS_OPLOCK_NOT_GRANTED 0xC00000e2
#define NT_STATUS_INVALID_OPLOCK_PROTOCOL 0xC00000e3
#define NT_STATUS_INTERNAL_DB_CORRUPTION 0xC00000e4
#define NT_STATUS_INTERNAL_ERROR 0xC00000e5
#define NT_STATUS_GENERIC_NOT_MAPPED 0xC00000e6
#define NT_STATUS_BAD_DESCRIPTOR_FORMAT 0xC00000e7
#define NT_STATUS_INVALID_USER_BUFFER 0xC00000e8
#define NT_STATUS_UNEXPECTED_IO_ERROR 0xC00000e9
#define NT_STATUS_UNEXPECTED_MM_CREATE_ERR 0xC00000ea
#define NT_STATUS_UNEXPECTED_MM_MAP_ERROR 0xC00000eb
#define NT_STATUS_UNEXPECTED_MM_EXTEND_ERR 0xC00000ec
#define NT_STATUS_NOT_LOGON_PROCESS 0xC00000ed
#define NT_STATUS_LOGON_SESSION_EXISTS 0xC00000ee
#define NT_STATUS_INVALID_PARAMETER_1 0xC00000ef
#define NT_STATUS_INVALID_PARAMETER_2 0xC00000f0
#define NT_STATUS_INVALID_PARAMETER_3 0xC00000f1
#define NT_STATUS_INVALID_PARAMETER_4 0xC00000f2
#define NT_STATUS_INVALID_PARAMETER_5 0xC00000f3
#define NT_STATUS_INVALID_PARAMETER_6 0xC00000f4
#define NT_STATUS_INVALID_PARAMETER_7 0xC00000f5
#define NT_STATUS_INVALID_PARAMETER_8 0xC00000f6
#define NT_STATUS_INVALID_PARAMETER_9 0xC00000f7
#define NT_STATUS_INVALID_PARAMETER_10 0xC00000f8
#define NT_STATUS_INVALID_PARAMETER_11 0xC00000f9
#define NT_STATUS_INVALID_PARAMETER_12 0xC00000fa
#define NT_STATUS_REDIRECTOR_NOT_STARTED 0xC00000fb
#define NT_STATUS_REDIRECTOR_STARTED 0xC00000fc
#define NT_STATUS_STACK_OVERFLOW 0xC00000fd
#define NT_STATUS_NO_SUCH_PACKAGE 0xC00000fe
#define NT_STATUS_BAD_FUNCTION_TABLE 0xC00000ff
#define NT_STATUS_DIRECTORY_NOT_EMPTY 0xC0000101
#define NT_STATUS_FILE_CORRUPT_ERROR 0xC0000102
#define NT_STATUS_NOT_A_DIRECTORY 0xC0000103
#define NT_STATUS_BAD_LOGON_SESSION_STATE 0xC0000104
#define NT_STATUS_LOGON_SESSION_COLLISION 0xC0000105
#define NT_STATUS_NAME_TOO_LONG 0xC0000106
#define NT_STATUS_FILES_OPEN 0xC0000107
#define NT_STATUS_CONNECTION_IN_USE 0xC0000108
#define NT_STATUS_MESSAGE_NOT_FOUND 0xC0000109
#define NT_STATUS_PROCESS_IS_TERMINATING 0xC000010a
#define NT_STATUS_INVALID_LOGON_TYPE 0xC000010b
#define NT_STATUS_NO_GUID_TRANSLATION 0xC000010c
#define NT_STATUS_CANNOT_IMPERSONATE 0xC000010d
#define NT_STATUS_IMAGE_ALREADY_LOADED 0xC000010e
#define NT_STATUS_ABIOS_NOT_PRESENT 0xC000010f
#define NT_STATUS_ABIOS_LID_NOT_EXIST 0xC0000110
#define NT_STATUS_ABIOS_LID_ALREADY_OWNED 0xC0000111
#define NT_STATUS_ABIOS_NOT_LID_OWNER 0xC0000112
#define NT_STATUS_ABIOS_INVALID_COMMAND 0xC0000113
#define NT_STATUS_ABIOS_INVALID_LID 0xC0000114
#define NT_STATUS_ABIOS_SELECTOR_NOT_AVAILABLE 0xC0000115
#define NT_STATUS_ABIOS_INVALID_SELECTOR 0xC0000116
#define NT_STATUS_NO_LDT 0xC0000117
#define NT_STATUS_INVALID_LDT_SIZE 0xC0000118
#define NT_STATUS_INVALID_LDT_OFFSET 0xC0000119
#define NT_STATUS_INVALID_LDT_DESCRIPTOR 0xC000011a
#define NT_STATUS_INVALID_IMAGE_NE_FORMAT 0xC000011b
#define NT_STATUS_RXACT_INVALID_STATE 0xC000011c
#define NT_STATUS_RXACT_COMMIT_FAILURE 0xC000011d
#define NT_STATUS_MAPPED_FILE_SIZE_ZERO 0xC000011e
#define NT_STATUS_TOO_MANY_OPENED_FILES 0xC000011f
#define NT_STATUS_CANCELLED 0xC0000120
#define NT_STATUS_CANNOT_DELETE 0xC0000121
#define NT_STATUS_INVALID_COMPUTER_NAME 0xC0000122
#define NT_STATUS_FILE_DELETED 0xC0000123
#define NT_STATUS_SPECIAL_ACCOUNT 0xC0000124
#define NT_STATUS_SPECIAL_GROUP 0xC0000125
#define NT_STATUS_SPECIAL_USER 0xC0000126
#define NT_STATUS_MEMBERS_PRIMARY_GROUP 0xC0000127
#define NT_STATUS_FILE_CLOSED 0xC0000128
#define NT_STATUS_TOO_MANY_THREADS 0xC0000129
#define NT_STATUS_THREAD_NOT_IN_PROCESS 0xC000012a
#define NT_STATUS_TOKEN_ALREADY_IN_USE 0xC000012b
#define NT_STATUS_PAGEFILE_QUOTA_EXCEEDED 0xC000012c
#define NT_STATUS_COMMITMENT_LIMIT 0xC000012d
#define NT_STATUS_INVALID_IMAGE_LE_FORMAT 0xC000012e
#define NT_STATUS_INVALID_IMAGE_NOT_MZ 0xC000012f
#define NT_STATUS_INVALID_IMAGE_PROTECT 0xC0000130
#define NT_STATUS_INVALID_IMAGE_WIN_16 0xC0000131
#define NT_STATUS_LOGON_SERVER_CONFLICT 0xC0000132
#define NT_STATUS_TIME_DIFFERENCE_AT_DC 0xC0000133
#define NT_STATUS_SYNCHRONIZATION_REQUIRED 0xC0000134
#define NT_STATUS_DLL_NOT_FOUND 0xC0000135
#define NT_STATUS_OPEN_FAILED 0xC0000136
#define NT_STATUS_IO_PRIVILEGE_FAILED 0xC0000137
#define NT_STATUS_ORDINAL_NOT_FOUND 0xC0000138
#define NT_STATUS_ENTRYPOINT_NOT_FOUND 0xC0000139
#define NT_STATUS_CONTROL_C_EXIT 0xC000013a
#define NT_STATUS_LOCAL_DISCONNECT 0xC000013b
#define NT_STATUS_REMOTE_DISCONNECT 0xC000013c
#define NT_STATUS_REMOTE_RESOURCES 0xC000013d
#define NT_STATUS_LINK_FAILED 0xC000013e
#define NT_STATUS_LINK_TIMEOUT 0xC000013f
#define NT_STATUS_INVALID_CONNECTION 0xC0000140
#define NT_STATUS_INVALID_ADDRESS 0xC0000141
#define NT_STATUS_DLL_INIT_FAILED 0xC0000142
#define NT_STATUS_MISSING_SYSTEMFILE 0xC0000143
#define NT_STATUS_UNHANDLED_EXCEPTION 0xC0000144
#define NT_STATUS_APP_INIT_FAILURE 0xC0000145
#define NT_STATUS_PAGEFILE_CREATE_FAILED 0xC0000146
#define NT_STATUS_NO_PAGEFILE 0xC0000147
#define NT_STATUS_INVALID_LEVEL 0xC0000148
#define NT_STATUS_WRONG_PASSWORD_CORE 0xC0000149
#define NT_STATUS_ILLEGAL_FLOAT_CONTEXT 0xC000014a
#define NT_STATUS_PIPE_BROKEN 0xC000014b
#define NT_STATUS_REGISTRY_CORRUPT 0xC000014c
#define NT_STATUS_REGISTRY_IO_FAILED 0xC000014d
#define NT_STATUS_NO_EVENT_PAIR 0xC000014e
#define NT_STATUS_UNRECOGNIZED_VOLUME 0xC000014f
#define NT_STATUS_SERIAL_NO_DEVICE_INITED 0xC0000150
#define NT_STATUS_NO_SUCH_ALIAS 0xC0000151
#define NT_STATUS_MEMBER_NOT_IN_ALIAS 0xC0000152
#define NT_STATUS_MEMBER_IN_ALIAS 0xC0000153
#define NT_STATUS_ALIAS_EXISTS 0xC0000154
#define NT_STATUS_LOGON_NOT_GRANTED 0xC0000155
#define NT_STATUS_TOO_MANY_SECRETS 0xC0000156
#define NT_STATUS_SECRET_TOO_LONG 0xC0000157
#define NT_STATUS_INTERNAL_DB_ERROR 0xC0000158
#define NT_STATUS_FULLSCREEN_MODE 0xC0000159
#define NT_STATUS_TOO_MANY_CONTEXT_IDS 0xC000015a
#define NT_STATUS_LOGON_TYPE_NOT_GRANTED 0xC000015b
#define NT_STATUS_NOT_REGISTRY_FILE 0xC000015c
#define NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED 0xC000015d
#define NT_STATUS_DOMAIN_CTRLR_CONFIG_ERROR 0xC000015e
#define NT_STATUS_FT_MISSING_MEMBER 0xC000015f
#define NT_STATUS_ILL_FORMED_SERVICE_ENTRY 0xC0000160
#define NT_STATUS_ILLEGAL_CHARACTER 0xC0000161
#define NT_STATUS_UNMAPPABLE_CHARACTER 0xC0000162
#define NT_STATUS_UNDEFINED_CHARACTER 0xC0000163
#define NT_STATUS_FLOPPY_VOLUME 0xC0000164
#define NT_STATUS_FLOPPY_ID_MARK_NOT_FOUND 0xC0000165
#define NT_STATUS_FLOPPY_WRONG_CYLINDER 0xC0000166
#define NT_STATUS_FLOPPY_UNKNOWN_ERROR 0xC0000167
#define NT_STATUS_FLOPPY_BAD_REGISTERS 0xC0000168
#define NT_STATUS_DISK_RECALIBRATE_FAILED 0xC0000169
#define NT_STATUS_DISK_OPERATION_FAILED 0xC000016a
#define NT_STATUS_DISK_RESET_FAILED 0xC000016b
#define NT_STATUS_SHARED_IRQ_BUSY 0xC000016c
#define NT_STATUS_FT_ORPHANING 0xC000016d
#define NT_STATUS_PARTITION_FAILURE 0xC0000172
#define NT_STATUS_INVALID_BLOCK_LENGTH 0xC0000173
#define NT_STATUS_DEVICE_NOT_PARTITIONED 0xC0000174
#define NT_STATUS_UNABLE_TO_LOCK_MEDIA 0xC0000175
#define NT_STATUS_UNABLE_TO_UNLOAD_MEDIA 0xC0000176
#define NT_STATUS_EOM_OVERFLOW 0xC0000177
#define NT_STATUS_NO_MEDIA 0xC0000178
#define NT_STATUS_NO_SUCH_MEMBER 0xC000017a
#define NT_STATUS_INVALID_MEMBER 0xC000017b
#define NT_STATUS_KEY_DELETED 0xC000017c
#define NT_STATUS_NO_LOG_SPACE 0xC000017d
#define NT_STATUS_TOO_MANY_SIDS 0xC000017e
#define NT_STATUS_LM_CROSS_ENCRYPTION_REQUIRED 0xC000017f
#define NT_STATUS_KEY_HAS_CHILDREN 0xC0000180
#define NT_STATUS_CHILD_MUST_BE_VOLATILE 0xC0000181
#define NT_STATUS_DEVICE_CONFIGURATION_ERROR 0xC0000182
#define NT_STATUS_DRIVER_INTERNAL_ERROR 0xC0000183
#define NT_STATUS_INVALID_DEVICE_STATE 0xC0000184
#define NT_STATUS_IO_DEVICE_ERROR 0xC0000185
#define NT_STATUS_DEVICE_PROTOCOL_ERROR 0xC0000186
#define NT_STATUS_BACKUP_CONTROLLER 0xC0000187
#define NT_STATUS_LOG_FILE_FULL 0xC0000188
#define NT_STATUS_TOO_LATE 0xC0000189
#define NT_STATUS_NO_TRUST_LSA_SECRET 0xC000018a
#define NT_STATUS_NO_TRUST_SAM_ACCOUNT 0xC000018b
#define NT_STATUS_TRUSTED_DOMAIN_FAILURE 0xC000018c
#define NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE 0xC000018d
#define NT_STATUS_EVENTLOG_FILE_CORRUPT 0xC000018e
#define NT_STATUS_EVENTLOG_CANT_START 0xC000018f
#define NT_STATUS_TRUST_FAILURE 0xC0000190
#define NT_STATUS_MUTANT_LIMIT_EXCEEDED 0xC0000191
#define NT_STATUS_NETLOGON_NOT_STARTED 0xC0000192
#define NT_STATUS_ACCOUNT_EXPIRED 0xC0000193
#define NT_STATUS_POSSIBLE_DEADLOCK 0xC0000194
#define NT_STATUS_NETWORK_CREDENTIAL_CONFLICT 0xC0000195
#define NT_STATUS_REMOTE_SESSION_LIMIT 0xC0000196
#define NT_STATUS_EVENTLOG_FILE_CHANGED 0xC0000197
#define NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT 0xC0000198
#define NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT 0xC0000199
#define NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT 0xC000019a
#define NT_STATUS_DOMAIN_TRUST_INCONSISTENT 0xC000019b
#define NT_STATUS_FS_DRIVER_REQUIRED 0xC000019c
#define NT_STATUS_NO_USER_SESSION_KEY 0xC0000202
#define NT_STATUS_USER_SESSION_DELETED 0xC0000203
#define NT_STATUS_RESOURCE_LANG_NOT_FOUND 0xC0000204
#define NT_STATUS_INSUFF_SERVER_RESOURCES 0xC0000205
#define NT_STATUS_INVALID_BUFFER_SIZE 0xC0000206
#define NT_STATUS_INVALID_ADDRESS_COMPONENT 0xC0000207
#define NT_STATUS_INVALID_ADDRESS_WILDCARD 0xC0000208
#define NT_STATUS_TOO_MANY_ADDRESSES 0xC0000209
#define NT_STATUS_ADDRESS_ALREADY_EXISTS 0xC000020a
#define NT_STATUS_ADDRESS_CLOSED 0xC000020b
#define NT_STATUS_CONNECTION_DISCONNECTED 0xC000020c
#define NT_STATUS_CONNECTION_RESET 0xC000020d
#define NT_STATUS_TOO_MANY_NODES 0xC000020e
#define NT_STATUS_TRANSACTION_ABORTED 0xC000020f
#define NT_STATUS_TRANSACTION_TIMED_OUT 0xC0000210
#define NT_STATUS_TRANSACTION_NO_RELEASE 0xC0000211
#define NT_STATUS_TRANSACTION_NO_MATCH 0xC0000212
#define NT_STATUS_TRANSACTION_RESPONDED 0xC0000213
#define NT_STATUS_TRANSACTION_INVALID_ID 0xC0000214
#define NT_STATUS_TRANSACTION_INVALID_TYPE 0xC0000215
#define NT_STATUS_NOT_SERVER_SESSION 0xC0000216
#define NT_STATUS_NOT_CLIENT_SESSION 0xC0000217
#define NT_STATUS_CANNOT_LOAD_REGISTRY_FILE 0xC0000218
#define NT_STATUS_DEBUG_ATTACH_FAILED 0xC0000219
#define NT_STATUS_SYSTEM_PROCESS_TERMINATED 0xC000021a
#define NT_STATUS_DATA_NOT_ACCEPTED 0xC000021b
#define NT_STATUS_NO_BROWSER_SERVERS_FOUND 0xC000021c
#define NT_STATUS_VDM_HARD_ERROR 0xC000021d
#define NT_STATUS_DRIVER_CANCEL_TIMEOUT 0xC000021e
#define NT_STATUS_REPLY_MESSAGE_MISMATCH 0xC000021f
#define NT_STATUS_MAPPED_ALIGNMENT 0xC0000220
#define NT_STATUS_IMAGE_CHECKSUM_MISMATCH 0xC0000221
#define NT_STATUS_LOST_WRITEBEHIND_DATA 0xC0000222
#define NT_STATUS_CLIENT_SERVER_PARAMETERS_INVALID 0xC0000223
#define NT_STATUS_PASSWORD_MUST_CHANGE 0xC0000224
#define NT_STATUS_NOT_FOUND 0xC0000225
#define NT_STATUS_NOT_TINY_STREAM 0xC0000226
#define NT_STATUS_RECOVERY_FAILURE 0xC0000227
#define NT_STATUS_STACK_OVERFLOW_READ 0xC0000228
#define NT_STATUS_FAIL_CHECK 0xC0000229
#define NT_STATUS_DUPLICATE_OBJECTID 0xC000022a
#define NT_STATUS_OBJECTID_EXISTS 0xC000022b
#define NT_STATUS_CONVERT_TO_LARGE 0xC000022c
#define NT_STATUS_RETRY 0xC000022d
#define NT_STATUS_FOUND_OUT_OF_SCOPE 0xC000022e
#define NT_STATUS_ALLOCATE_BUCKET 0xC000022f
#define NT_STATUS_PROPSET_NOT_FOUND 0xC0000230
#define NT_STATUS_MARSHALL_OVERFLOW 0xC0000231
#define NT_STATUS_INVALID_VARIANT 0xC0000232
#define NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND 0xC0000233
#define NT_STATUS_ACCOUNT_LOCKED_OUT 0xC0000234
#define NT_STATUS_HANDLE_NOT_CLOSABLE 0xC0000235
#define NT_STATUS_CONNECTION_REFUSED 0xC0000236
#define NT_STATUS_GRACEFUL_DISCONNECT 0xC0000237
#define NT_STATUS_ADDRESS_ALREADY_ASSOCIATED 0xC0000238
#define NT_STATUS_ADDRESS_NOT_ASSOCIATED 0xC0000239
#define NT_STATUS_CONNECTION_INVALID 0xC000023a
#define NT_STATUS_CONNECTION_ACTIVE 0xC000023b
#define NT_STATUS_NETWORK_UNREACHABLE 0xC000023c
#define NT_STATUS_HOST_UNREACHABLE 0xC000023d
#define NT_STATUS_PROTOCOL_UNREACHABLE 0xC000023e
#define NT_STATUS_PORT_UNREACHABLE 0xC000023f
#define NT_STATUS_REQUEST_ABORTED 0xC0000240
#define NT_STATUS_CONNECTION_ABORTED 0xC0000241
#define NT_STATUS_BAD_COMPRESSION_BUFFER 0xC0000242
#define NT_STATUS_USER_MAPPED_FILE 0xC0000243
#define NT_STATUS_AUDIT_FAILED 0xC0000244
#define NT_STATUS_TIMER_RESOLUTION_NOT_SET 0xC0000245
#define NT_STATUS_CONNECTION_COUNT_LIMIT 0xC0000246
#define NT_STATUS_LOGIN_TIME_RESTRICTION 0xC0000247
#define NT_STATUS_LOGIN_WKSTA_RESTRICTION 0xC0000248
#define NT_STATUS_IMAGE_MP_UP_MISMATCH 0xC0000249
#define NT_STATUS_INSUFFICIENT_LOGON_INFO 0xC0000250
#define NT_STATUS_BAD_DLL_ENTRYPOINT 0xC0000251
#define NT_STATUS_BAD_SERVICE_ENTRYPOINT 0xC0000252
#define NT_STATUS_LPC_REPLY_LOST 0xC0000253
#define NT_STATUS_IP_ADDRESS_CONFLICT1 0xC0000254
#define NT_STATUS_IP_ADDRESS_CONFLICT2 0xC0000255
#define NT_STATUS_REGISTRY_QUOTA_LIMIT 0xC0000256
#define NT_STATUS_PATH_NOT_COVERED 0xC0000257
#define NT_STATUS_NO_CALLBACK_ACTIVE 0xC0000258
#define NT_STATUS_LICENSE_QUOTA_EXCEEDED 0xC0000259
#define NT_STATUS_PWD_TOO_SHORT 0xC000025a
#define NT_STATUS_PWD_TOO_RECENT 0xC000025b
#define NT_STATUS_PWD_HISTORY_CONFLICT 0xC000025c
#define NT_STATUS_PLUGPLAY_NO_DEVICE 0xC000025e
#define NT_STATUS_UNSUPPORTED_COMPRESSION 0xC000025f
#define NT_STATUS_INVALID_HW_PROFILE 0xC0000260
#define NT_STATUS_INVALID_PLUGPLAY_DEVICE_PATH 0xC0000261
#define NT_STATUS_DRIVER_ORDINAL_NOT_FOUND 0xC0000262
#define NT_STATUS_DRIVER_ENTRYPOINT_NOT_FOUND 0xC0000263
#define NT_STATUS_RESOURCE_NOT_OWNED 0xC0000264
#define NT_STATUS_TOO_MANY_LINKS 0xC0000265
#define NT_STATUS_QUOTA_LIST_INCONSISTENT 0xC0000266
#define NT_STATUS_FILE_IS_OFFLINE 0xC0000267
#define NT_STATUS_NOT_A_REPARSE_POINT 0xC0000275
#define NT_STATUS_NO_SUCH_JOB 0xC0000EDE
#define WERR_OK 0
#define WERR_BADFUNC 1
#define WERR_BADFILE 2
#define WERR_ACCESS_DENIED 5
#define WERR_BADFID 6
#define WERR_NOMEM 8
#define WERR_GENERAL_FAILURE 31
#define WERR_NOT_SUPPORTED 50
#define WERR_BAD_NETPATH 53
#define WERR_PRINTQ_FULL 61
#define WERR_NO_SPOOL_SPACE 62
#define WERR_NO_SUCH_SHARE 67
#define WERR_ALREADY_EXISTS 80
#define WERR_BAD_PASSWORD 86
#define WERR_INVALID_PARAM 87
#define WERR_INSUFFICIENT_BUFFER 122
#define WERR_INVALID_NAME 123
#define WERR_UNKNOWN_LEVEL 124
#define WERR_OBJECT_PATH_INVALID 161
#define WERR_NO_MORE_ITEMS 259
#define WERR_MORE_DATA 234
#define WERR_INVALID_OWNER 1307
#define WERR_CAN_NOT_COMPLETE 1003
#define WERR_INVALID_SECURITY_DESCRIPTOR 1338
#define WERR_SERVER_UNAVAILABLE 1722
#define WERR_UNKNOWN_PRINTER_DRIVER 1797
#define WERR_INVALID_ENVIRONMENT 1805
#define WERR_INVALID_FORM_NAME 1902
#define WERR_INVALID_FORM_SIZE 1903
#define WERR_BUF_TOO_SMALL 2123
#define WERR_JOB_NOT_FOUND 2151
#define WERR_DEST_NOT_FOUND 2152
#define WERR_NOT_LOCAL_DOMAIN 2320
#define WERR_STATUS_MORE_ENTRIES 0x0105
+51
View File
@@ -0,0 +1,51 @@
#!/usr/bin/python
import sys
from optparse import OptionParser
# Parse command line
parser = OptionParser()
parser.add_option("-b", "--binding", action="store", type="string",
dest="binding")
parser.add_option("-d", "--domain", action="store", type="string",
dest="domain")
parser.add_option("-u", "--username", action="store", type="string",
dest="username")
parser.add_option("-p", "--password", action="store", type="string",
dest="password")
(options, args) = parser.parse_args()
if not options.binding:
parser.error('You must supply a binding string')
if not options.username or not options.password or not options.domain:
parser.error('You must supply a domain, username and password')
binding = options.binding
domain = options.domain
username = options.username
password = options.password
if len(args) == 0:
parser.error('You must supply the name of a module to test')
# Import and test
for test in args:
try:
module = __import__('torture_%s' % test)
except ImportError:
print 'No such module "%s"' % test
sys.exit(1)
if not hasattr(module, 'runtests'):
print 'Module "%s" does not have a runtests function' % test
module.runtests(binding, (domain, username, password))
@@ -0,0 +1,437 @@
import sys, string
import dcerpc
def ResizeBufferCall(fn, pipe, r):
r['buffer'] = None
r['buf_size'] = 0
result = fn(pipe, r)
if result['result'] == dcerpc.WERR_INSUFFICIENT_BUFFER or \
result['result'] == dcerpc.WERR_MORE_DATA:
r['buffer'] = result['buf_size'] * '\x00'
r['buf_size'] = result['buf_size']
result = fn(pipe, r)
return result
def test_OpenPrinterEx(pipe, printer):
print 'spoolss_OpenPrinterEx(%s)' % printer
printername = '\\\\%s' % dcerpc.dcerpc_server_name(pipe)
if printer is not None:
printername = printername + '\\%s' % printer
r = {}
r['printername'] = printername
r['datatype'] = None
r['devmode_ctr'] = {}
r['devmode_ctr']['size'] = 0
r['devmode_ctr']['devmode'] = None
r['access_mask'] = 0x02000000
r['level'] = 1
r['userlevel'] = {}
r['userlevel']['level1'] = {}
r['userlevel']['level1']['size'] = 0
r['userlevel']['level1']['client'] = None
r['userlevel']['level1']['user'] = None
r['userlevel']['level1']['build'] = 1381
r['userlevel']['level1']['major'] = 2
r['userlevel']['level1']['minor'] = 0
r['userlevel']['level1']['processor'] = 0
result = dcerpc.spoolss_OpenPrinterEx(pipe, r)
return result['handle']
def test_ClosePrinter(pipe, handle):
r = {}
r['handle'] = handle
dcerpc.spoolss_ClosePrinter(pipe, r)
def test_GetPrinter(pipe, handle):
r = {}
r['handle'] = handle
for level in [0, 1, 2, 3, 4, 5, 6, 7]:
print 'spoolss_GetPrinter(level = %d)' % level
r['level'] = level
r['buffer'] = None
r['buf_size'] = 0
result = ResizeBufferCall(dcerpc.spoolss_GetPrinter, pipe, r)
def test_EnumForms(pipe, handle):
print 'spoolss_EnumForms()'
r = {}
r['handle'] = handle
r['level'] = 1
r['buffer'] = None
r['buf_size'] = 0
result = ResizeBufferCall(dcerpc.spoolss_EnumForms, pipe, r)
forms = dcerpc.unmarshall_spoolss_FormInfo_array(
result['buffer'], r['level'], result['count'])
for form in forms:
r = {}
r['handle'] = handle
r['formname'] = form['info1']['formname']
r['level'] = 1
result = ResizeBufferCall(dcerpc.spoolss_GetForm, pipe, r)
def test_EnumPorts(pipe, handle):
print 'spoolss_EnumPorts()'
for level in [1, 2]:
r = {}
r['handle'] = handle
r['servername'] = None
r['level'] = level
result = ResizeBufferCall(dcerpc.spoolss_EnumPorts, pipe, r)
ports = dcerpc.unmarshall_spoolss_PortInfo_array(
result['buffer'], r['level'], result['count'])
if level == 1:
port_names = map(lambda x: x['info1']['port_name'], ports)
def test_DeleteForm(pipe, handle, formname):
r = {}
r['handle'] = handle
r['formname'] = formname
dcerpc.spoolss_DeleteForm(pipe, r)
def test_GetForm(pipe, handle, formname):
r = {}
r['handle'] = handle
r['formname'] = formname
r['level'] = 1
result = ResizeBufferCall(dcerpc.spoolss_GetForm, pipe, r)
return result['info']['info1']
def test_SetForm(pipe, handle, form):
print 'spoolss_SetForm()'
r = {}
r['handle'] = handle
r['level'] = 1
r['formname'] = form['info1']['formname']
r['info'] = form
dcerpc.spoolss_SetForm(pipe, r)
newform = test_GetForm(pipe, handle, r['formname'])
if form['info1'] != newform:
print 'SetForm: mismatch: %s != %s' % \
(r['info']['info1'], f)
sys.exit(1)
def test_AddForm(pipe, handle):
print 'spoolss_AddForm()'
formname = '__testform__'
r = {}
r['handle'] = handle
r['level'] = 1
r['info'] = {}
r['info']['info1'] = {}
r['info']['info1']['formname'] = formname
r['info']['info1']['flags'] = 0x0002
r['info']['info1']['width'] = 100
r['info']['info1']['length'] = 100
r['info']['info1']['left'] = 0
r['info']['info1']['top'] = 1000
r['info']['info1']['right'] = 2000
r['info']['info1']['bottom'] = 3000
try:
result = dcerpc.spoolss_AddForm(pipe, r)
except dcerpc.WERROR, arg:
if arg[0] == dcerpc.WERR_ALREADY_EXISTS:
test_DeleteForm(pipe, handle, formname)
result = dcerpc.spoolss_AddForm(pipe, r)
f = test_GetForm(pipe, handle, formname)
if r['info']['info1'] != f:
print 'AddForm: mismatch: %s != %s' % \
(r['info']['info1'], f)
sys.exit(1)
r['formname'] = formname
test_SetForm(pipe, handle, r['info'])
test_DeleteForm(pipe, handle, formname)
def test_EnumJobs(pipe, handle):
print 'spoolss_EnumJobs()'
r = {}
r['handle'] = handle
r['firstjob'] = 0
r['numjobs'] = 0xffffffff
r['level'] = 1
result = ResizeBufferCall(dcerpc.spoolss_EnumJobs, pipe, r)
if result['buffer'] is None:
return
jobs = dcerpc.unmarshall_spoolss_JobInfo_array(
result['buffer'], r['level'], result['count'])
for job in jobs:
s = {}
s['handle'] = handle
s['job_id'] = job['info1']['job_id']
s['level'] = 1
result = ResizeBufferCall(dcerpc.spoolss_GetJob, pipe, s)
if result['info'] != job:
print 'EnumJobs: mismatch: %s != %s' % (result['info'], job)
sys.exit(1)
# TODO: AddJob, DeleteJob, ScheduleJob
def test_EnumPrinterData(pipe, handle):
print 'test_EnumPrinterData()'
enum_index = 0
while 1:
r = {}
r['handle'] = handle
r['enum_index'] = enum_index
r['value_offered'] = 0
r['data_size'] = 0
result = dcerpc.spoolss_EnumPrinterData(pipe, r)
r['value_offered'] = result['value_needed']
r['data_size'] = result['data_size']
result = dcerpc.spoolss_EnumPrinterData(pipe, r)
if result['result'] == dcerpc.WERR_NO_MORE_ITEMS:
break
s = {}
s['handle'] = handle
s['value_name'] = result['value_name']
result2 = ResizeBufferCall(dcerpc.spoolss_GetPrinterData, pipe, s)
if result['buffer'][:result2['buf_size']] != result2['buffer']:
print 'EnumPrinterData/GetPrinterData mismatch'
sys.exit(1)
enum_index += 1
def test_SetPrinterDataEx(pipe, handle):
valuename = '__printerdataextest__'
data = '12345'
r = {}
r['handle'] = handle
r['key_name'] = 'DsSpooler'
r['value_name'] = valuename
r['type'] = 3
r['buffer'] = data
r['buf_size'] = len(data)
result = dcerpc.spoolss_SetPrinterDataEx(pipe, r)
def test_EnumPrinterDataEx(pipe, handle):
r = {}
r['handle'] = handle
r['key_name'] = 'DsSpooler'
r['buf_size'] = 0
result = dcerpc.spoolss_EnumPrinterDataEx(pipe, r)
if result['result'] == dcerpc.WERR_MORE_DATA:
r['buf_size'] = result['buf_size']
result = dcerpc.spoolss_EnumPrinterDataEx(pipe, r)
# TODO: test spoolss_GetPrinterDataEx()
def test_SetPrinterData(pipe, handle):
print 'testing spoolss_SetPrinterData()'
valuename = '__printerdatatest__'
data = '12345'
r = {}
r['handle'] = handle
r['value_name'] = valuename
r['type'] = 3 # REG_BINARY
r['buffer'] = data
r['real_len'] = 5
dcerpc.spoolss_SetPrinterData(pipe, r)
s = {}
s['handle'] = handle
s['value_name'] = valuename
result = ResizeBufferCall(dcerpc.spoolss_GetPrinterData, pipe, r)
if result['buffer'] != data:
print 'SetPrinterData: mismatch'
sys.exit(1)
dcerpc.spoolss_DeletePrinterData(pipe, r)
def test_EnumPrinters(pipe):
print 'testing spoolss_EnumPrinters()'
printer_names = None
r = {}
r['flags'] = 0x02
r['server'] = None
for level in [0, 1, 2, 4, 5]:
print 'test_EnumPrinters(level = %d)' % level
r['level'] = level
result = ResizeBufferCall(dcerpc.spoolss_EnumPrinters, pipe, r)
printers = dcerpc.unmarshall_spoolss_PrinterInfo_array(
result['buffer'], r['level'], result['count'])
if level == 2:
for p in printers:
# A nice check is for the specversion in the
# devicemode. This has always been observed to be
# 1025.
if p['info2']['devmode']['specversion'] != 1025:
print 'test_EnumPrinters: specversion != 1025'
sys.exit(1)
r['level'] = 1
result = ResizeBufferCall(dcerpc.spoolss_EnumPrinters, pipe, r)
for printer in dcerpc.unmarshall_spoolss_PrinterInfo_array(
result['buffer'], r['level'], result['count']):
if string.find(printer['info1']['name'], '\\\\') == 0:
print 'Skipping remote printer %s' % printer['info1']['name']
continue
printername = string.split(printer['info1']['name'], ',')[0]
handle = test_OpenPrinterEx(pipe, printername)
test_GetPrinter(pipe, handle)
test_EnumPorts(pipe, handle)
test_EnumForms(pipe, handle)
test_AddForm(pipe, handle)
test_EnumJobs(pipe, handle)
test_EnumPrinterData(pipe, handle)
test_EnumPrinterDataEx(pipe, handle)
test_SetPrinterData(pipe, handle)
# test_SetPrinterDataEx(pipe, handle)
test_ClosePrinter(pipe, handle)
def test_EnumPrinterDrivers(pipe):
print 'test spoolss_EnumPrinterDrivers()'
for level in [1, 2, 3]:
r = {}
r['server'] = None
r['environment'] = None
r['level'] = level
result = ResizeBufferCall(dcerpc.spoolss_EnumPrinterDrivers, pipe, r)
drivers = dcerpc.unmarshall_spoolss_DriverInfo_array(
result['buffer'], r['level'], result['count'])
if level == 1:
driver_names = map(lambda x: x['info1']['driver_name'], drivers)
def test_PrintServer(pipe):
handle = test_OpenPrinterEx(pipe, None)
# EnumForms and AddForm tests return WERR_BADFID here (??)
test_ClosePrinter(pipe, handle)
def runtests(binding, domain, username, password):
print 'Testing SPOOLSS pipe'
pipe = dcerpc.pipe_connect(binding,
dcerpc.DCERPC_SPOOLSS_UUID, dcerpc.DCERPC_SPOOLSS_VERSION,
domain, username, password)
test_EnumPrinters(pipe)
test_EnumPrinterDrivers(pipe)
test_PrintServer(pipe)
+83
View File
@@ -0,0 +1,83 @@
#!/usr/bin/python
#
# A torture test for the Python Ldb bindings. Also a short guide on
# how the API works.
#
from Ldb import *
# Helpers
def t(cond, msg):
"""Test a condition."""
if not cond:
raise RuntimeError('FAILED: %s' % msg)
#
# Torture LdbMessage
#
m = LdbMessage()
# Empty message
t(m.keys() == [], 'empty msg')
t(m.dn == None, 'empty dn')
t(m.sanity_check() == LDB_ERR_INVALID_DN_SYNTAX, 'sanity check')
# Test invalid dn
try:
m.dn = 'invalid dn'
except LdbError, arg:
if arg[0] != LDB_ERR_INVALID_DN_SYNTAX:
raise
else:
t(False, 'LdbError not raised')
# Test valid dn
m.dn = 'name=spotty'
t(m.dn == 'name=spotty', 'specified dn')
t(m.sanity_check() == LDB_SUCCESS, 'sanity check')
# Test some single-valued attributes
m['animal'] = 'dog'
m['name'] = 'spotty'
t(m.keys() == ['animal', 'name'], 'keys() test failed')
t(m.values() == [['dog'], ['spotty']], 'values() test failed')
t(m.items() == [('animal', ['dog']), ('name', ['spotty'])],
'items() test failed')
t(m.sanity_check() == LDB_SUCCESS, 'sanity check')
m['animal'] = 'canine'
t(m['animal'] == ['canine'], 'replace value failed')
# Test a multi-valued attribute
names = ['spotty', 'foot']
m['name'] = names
t(m['name'] == names, 'multi-valued attr failed')
t(m.sanity_check() == LDB_SUCCESS, 'sanity check')
# Test non-string attributes
try:
m['foo'] = 42
except TypeError:
pass
else:
t(False, 'TypeError not raised')
#
# Torture Ldb
#
l = Ldb('foo.ldb')
+221
View File
@@ -0,0 +1,221 @@
#!/usr/bin/python
import sys
import dcerpc, samr
def test_Connect(pipe):
handle = samr.Connect(pipe)
handle = samr.Connect2(pipe)
handle = samr.Connect3(pipe)
handle = samr.Connect4(pipe)
# WIN2K3 only?
try:
handle = samr.Connect5(pipe)
except dcerpc.NTSTATUS, arg:
if arg[0] != 0xc00000d2L: # NT_STATUS_NET_WRITE_FAULT
raise
return handle
def test_UserHandle(user_handle):
# QuerySecurity()/SetSecurity()
user_handle.SetSecurity(user_handle.QuerySecurity())
# GetUserPwInfo()
user_handle.GetUserPwInfo()
# GetUserInfo()
for level in [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 20,
21, 23, 24, 25, 26]:
try:
user_handle.QueryUserInfo(level)
user_handle.QueryUserInfo2(level)
except dcerpc.NTSTATUS, arg:
if arg[0] != 0xc0000003L: # NT_STATUS_INVALID_INFO_CLASS
raise
# GetGroupsForUser()
user_handle.GetGroupsForUser()
# TestPrivateFunctionsUser()
try:
user_handle.TestPrivateFunctionsUser()
except dcerpc.NTSTATUS, arg:
if arg[0] != 0xC0000002L:
raise
def test_GroupHandle(group_handle):
# QuerySecurity()/SetSecurity()
group_handle.SetSecurity(group_handle.QuerySecurity())
# QueryGroupInfo()
for level in [1, 2, 3, 4, 5]:
info = group_handle.QueryGroupInfo(level)
# TODO: SetGroupinfo()
# QueryGroupMember()
group_handle.QueryGroupMember()
def test_AliasHandle(alias_handle):
# QuerySecurity()/SetSecurity()
alias_handle.SetSecurity(alias_handle.QuerySecurity())
print alias_handle.GetMembersInAlias()
def test_DomainHandle(name, sid, domain_handle):
print 'testing %s (%s)' % (name, sid)
# QuerySecurity()/SetSecurity()
domain_handle.SetSecurity(domain_handle.QuerySecurity())
# LookupNames(), none mapped
try:
domain_handle.LookupNames(['xxNONAMExx'])
except dcerpc.NTSTATUS, arg:
if arg[0] != 0xc0000073L:
raise dcerpc.NTSTATUS(arg)
# LookupNames(), some mapped
if name != 'Builtin':
domain_handle.LookupNames(['Administrator', 'xxNONAMExx'])
# QueryDomainInfo()/SetDomainInfo()
levels = [1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13]
set_ok = [1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0]
for i in range(len(levels)):
info = domain_handle.QueryDomainInfo(level = levels[i])
try:
domain_handle.SetDomainInfo(levels[i], info)
except dcerpc.NTSTATUS, arg:
if not (arg[0] == 0xc0000003L and not set_ok[i]):
raise
# QueryDomainInfo2()
levels = [1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13]
for i in range(len(levels)):
domain_handle.QueryDomainInfo2(level = levels[i])
# EnumDomainUsers
print 'testing users'
users = domain_handle.EnumDomainUsers()
rids = domain_handle.LookupNames(users)
for i in range(len(users)):
test_UserHandle(domain_handle.OpenUser(rids[0][i]))
# QueryDisplayInfo
for i in [1, 2, 3, 4, 5]:
domain_handle.QueryDisplayInfo(level = i)
domain_handle.QueryDisplayInfo2(level = i)
domain_handle.QueryDisplayInfo3(level = i)
# EnumDomainGroups
print 'testing groups'
groups = domain_handle.EnumDomainGroups()
rids = domain_handle.LookupNames(groups)
for i in range(len(groups)):
test_GroupHandle(domain_handle.OpenGroup(rids[0][i]))
# EnumDomainAliases
print 'testing aliases'
aliases = domain_handle.EnumDomainAliases()
rids = domain_handle.LookupNames(aliases)
for i in range(len(aliases)):
test_AliasHandle(domain_handle.OpenAlias(rids[0][i]))
# CreateUser
# CreateUser2
# CreateDomAlias
# RidToSid
# RemoveMemberFromForeignDomain
# CreateDomainGroup
# GetAliasMembership
# GetBootKeyInformation()
try:
domain_handle.GetBootKeyInformation()
except dcerpc.NTSTATUS, arg:
pass
# TestPrivateFunctionsDomain()
try:
domain_handle.TestPrivateFunctionsDomain()
except dcerpc.NTSTATUS, arg:
if arg[0] != 0xC0000002L:
raise
def test_ConnectHandle(connect_handle):
print 'testing connect handle'
# QuerySecurity/SetSecurity
connect_handle.SetSecurity(connect_handle.QuerySecurity())
# Lookup bogus domain
try:
connect_handle.LookupDomain('xxNODOMAINxx')
except dcerpc.NTSTATUS, arg:
if arg[0] != 0xC00000DFL: # NT_STATUS_NO_SUCH_DOMAIN
raise
# Test all domains
for domain_name in connect_handle.EnumDomains():
connect_handle.GetDomPwInfo(domain_name)
sid = connect_handle.LookupDomain(domain_name)
domain_handle = connect_handle.OpenDomain(sid)
test_DomainHandle(domain_name, sid, domain_handle)
# TODO: Test Shutdown() function
def runtests(binding, creds):
print 'Testing SAMR pipe'
pipe = dcerpc.pipe_connect(binding,
dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION), creds)
handle = test_Connect(pipe)
test_ConnectHandle(handle)
+90
View File
@@ -0,0 +1,90 @@
#!/usr/bin/python
import sys, os
import Tdb
def fail(msg):
print 'FAILED:', msg
sys.exit(1)
tdb_file = '/tmp/torture_tdb.tdb'
# Create temporary tdb file
t = Tdb.Tdb(tdb_file, flags = Tdb.CLEAR_IF_FIRST)
# Check non-existent key throws KeyError exception
try:
t['__none__']
except KeyError:
pass
else:
fail('non-existent key did not throw KeyError')
# Check storing key
t['bar'] = '1234'
if t['bar'] != '1234':
fail('store key failed')
# Check key exists
if not t.has_key('bar'):
fail('has_key() failed for existing key')
if t.has_key('__none__'):
fail('has_key() succeeded for non-existent key')
# Delete key
try:
del(t['__none__'])
except KeyError:
pass
else:
fail('delete of non-existent key did not throw KeyError')
del t['bar']
if t.has_key('bar'):
fail('delete of existing key did not delete key')
# Clear all keys
t.clear()
if len(t) != 0:
fail('clear failed to remove all keys')
# Other dict functions
t['a'] = '1'
t['ab'] = '12'
t['abc'] = '123'
if len(t) != 3:
fail('len method produced wrong value')
keys = t.keys()
values = t.values()
items = t.items()
if set(keys) != set(['a', 'ab', 'abc']):
fail('keys method produced wrong values')
if set(values) != set(['1', '12', '123']):
fail('values method produced wrong values')
if set(items) != set([('a', '1'), ('ab', '12'), ('abc', '123')]):
fail('values method produced wrong values')
t.close()
# Re-open read-only
t = Tdb.Tdb(tdb_file, open_flags = os.O_RDONLY)
t.keys()
t.close()
# Clean up
os.unlink(tdb_file)
+165
View File
@@ -0,0 +1,165 @@
#!/usr/bin/python
import sys, dcerpc
def test_OpenHKLM(pipe):
r = {}
r['unknown'] = {}
r['unknown']['unknown0'] = 0x9038
r['unknown']['unknown1'] = 0x0000
r['access_required'] = 0x02000000
result = dcerpc.winreg_OpenHKLM(pipe, r)
return result['handle']
def test_QueryInfoKey(pipe, handle):
r = {}
r['handle'] = handle
r['class'] = {}
r['class']['name'] = None
return dcerpc.winreg_QueryInfoKey(pipe, r)
def test_CloseKey(pipe, handle):
r = {}
r['handle'] = handle
dcerpc.winreg_CloseKey(pipe, r)
def test_FlushKey(pipe, handle):
r = {}
r['handle'] = handle
dcerpc.winreg_FlushKey(pipe, r)
def test_GetVersion(pipe, handle):
r = {}
r['handle'] = handle
dcerpc.winreg_GetVersion(pipe, r)
def test_GetKeySecurity(pipe, handle):
r = {}
r['handle'] = handle
r['unknown'] = 4
r['size'] = None
r['data'] = {}
r['data']['max_len'] = 0
r['data']['data'] = ''
result = dcerpc.winreg_GetKeySecurity(pipe, r)
print result
if result['result'] == dcerpc.WERR_INSUFFICIENT_BUFFER:
r['size'] = {}
r['size']['max_len'] = result['data']['max_len']
r['size']['offset'] = 0
r['size']['len'] = result['data']['max_len']
result = dcerpc.winreg_GetKeySecurity(pipe, r)
print result
sys.exit(1)
def test_Key(pipe, handle, name, depth = 0):
# Don't descend too far. Registries can be very deep.
if depth > 2:
return
try:
keyinfo = test_QueryInfoKey(pipe, handle)
except dcerpc.WERROR, arg:
if arg[0] == dcerpc.WERR_ACCESS_DENIED:
return
test_GetVersion(pipe, handle)
test_FlushKey(pipe, handle)
test_GetKeySecurity(pipe, handle)
# Enumerate values in this key
r = {}
r['handle'] = handle
r['name_in'] = {}
r['name_in']['len'] = 0
r['name_in']['max_len'] = (keyinfo['max_valnamelen'] + 1) * 2
r['name_in']['buffer'] = {}
r['name_in']['buffer']['max_len'] = keyinfo['max_valnamelen'] + 1
r['name_in']['buffer']['offset'] = 0
r['name_in']['buffer']['len'] = 0
r['type'] = 0
r['value_in'] = {}
r['value_in']['max_len'] = keyinfo['max_valbufsize']
r['value_in']['offset'] = 0
r['value_in']['len'] = 0
r['value_len1'] = keyinfo['max_valbufsize']
r['value_len2'] = 0
for i in range(0, keyinfo['num_values']):
r['enum_index'] = i
dcerpc.winreg_EnumValue(pipe, r)
# Recursively test subkeys of this key
r = {}
r['handle'] = handle
r['key_name_len'] = 0
r['unknown'] = 0x0414
r['in_name'] = {}
r['in_name']['unknown'] = 0x20a
r['in_name']['key_name'] = {}
r['in_name']['key_name']['name'] = None
r['class'] = {}
r['class']['name'] = None
r['last_changed_time'] = {}
r['last_changed_time']['low'] = 0
r['last_changed_time']['high'] = 0
for i in range(0, keyinfo['num_subkeys']):
r['enum_index'] = i
subkey = dcerpc.winreg_EnumKey(pipe, r)
s = {}
s['handle'] = handle
s['keyname'] = {}
s['keyname']['name'] = subkey['out_name']['name']
s['unknown'] = 0
s['access_mask'] = 0x02000000
result = dcerpc.winreg_OpenKey(pipe, s)
test_Key(pipe, result['handle'], name + '/' + s['keyname']['name'],
depth + 1)
test_CloseKey(pipe, result['handle'])
# Enumerate values
def runtests(binding, domain, username, password):
print 'Testing WINREG pipe'
pipe = dcerpc.pipe_connect(binding,
dcerpc.DCERPC_WINREG_UUID, dcerpc.DCERPC_WINREG_VERSION,
domain, username, password)
handle = test_OpenHKLM(pipe)
test_Key(pipe, handle, 'HKLM')