| 1 | #!/usr/bin/python
|
|---|
| 2 |
|
|---|
| 3 | import sys, os, string
|
|---|
| 4 |
|
|---|
| 5 | # Find right directory when running from source tree
|
|---|
| 6 | sys.path.insert(0, "bin/python")
|
|---|
| 7 |
|
|---|
| 8 | from cmd import Cmd
|
|---|
| 9 | from optparse import OptionParser
|
|---|
| 10 | from pprint import pprint
|
|---|
| 11 |
|
|---|
| 12 | import dcerpc, samr
|
|---|
| 13 |
|
|---|
| 14 | def swig2dict(obj):
|
|---|
| 15 | """Convert a swig object to a dictionary."""
|
|---|
| 16 |
|
|---|
| 17 | result = {}
|
|---|
| 18 |
|
|---|
| 19 | for attr in filter(lambda x: type(x) == str, dir(obj)):
|
|---|
| 20 |
|
|---|
| 21 | if attr[:2] == '__' and attr[-2:] == '__':
|
|---|
| 22 | continue
|
|---|
| 23 |
|
|---|
| 24 | if attr == 'this' or attr == 'thisown':
|
|---|
| 25 | continue
|
|---|
| 26 |
|
|---|
| 27 | result[attr] = getattr(obj, attr)
|
|---|
| 28 |
|
|---|
| 29 | return result
|
|---|
| 30 |
|
|---|
| 31 | class rpcclient(Cmd):
|
|---|
| 32 |
|
|---|
| 33 | prompt = 'rpcclient$ '
|
|---|
| 34 |
|
|---|
| 35 | def __init__(self, server, cred):
|
|---|
| 36 | Cmd.__init__(self)
|
|---|
| 37 | self.server = server
|
|---|
| 38 | self.cred = cred
|
|---|
| 39 |
|
|---|
| 40 | def emptyline(self):
|
|---|
| 41 |
|
|---|
| 42 | # Default for empty line is to repeat last command - yuck
|
|---|
| 43 |
|
|---|
| 44 | pass
|
|---|
| 45 |
|
|---|
| 46 | def onecmd(self, line):
|
|---|
| 47 |
|
|---|
| 48 | # Override the onecmd() method so we can trap error returns
|
|---|
| 49 |
|
|---|
| 50 | try:
|
|---|
| 51 | Cmd.onecmd(self, line)
|
|---|
| 52 | except dcerpc.NTSTATUS, arg:
|
|---|
| 53 | print 'The command returned an error: %s' % arg[1]
|
|---|
| 54 |
|
|---|
| 55 | # Command handlers
|
|---|
| 56 |
|
|---|
| 57 | def do_help(self, line):
|
|---|
| 58 | """Displays on-line help for rpcclient commands."""
|
|---|
| 59 | Cmd.do_help(self, line)
|
|---|
| 60 |
|
|---|
| 61 | def do_shell(self, line):
|
|---|
| 62 |
|
|---|
| 63 | status = os.system(line)
|
|---|
| 64 |
|
|---|
| 65 | if os.WIFEXITED(status):
|
|---|
| 66 | if os.WEXITSTATUS(status) != 0:
|
|---|
| 67 | print 'Command exited with code %d' % os.WEXITSTATUS(status)
|
|---|
| 68 | else:
|
|---|
| 69 | print 'Command exited with signal %d' % os.WTERMSIG(status)
|
|---|
| 70 |
|
|---|
| 71 | def do_EOF(self, line):
|
|---|
| 72 | """Exits rpcclient."""
|
|---|
| 73 | print
|
|---|
| 74 | sys.exit(0)
|
|---|
| 75 |
|
|---|
| 76 | # SAMR pipe commands
|
|---|
| 77 |
|
|---|
| 78 | def do_SamrEnumDomains(self, line):
|
|---|
| 79 | """Enumerate domain names."""
|
|---|
| 80 |
|
|---|
| 81 | usage = 'usage: SamrEnumDomains'
|
|---|
| 82 |
|
|---|
| 83 | if line != '':
|
|---|
| 84 | print usage
|
|---|
| 85 | return
|
|---|
| 86 |
|
|---|
| 87 | pipe = dcerpc.pipe_connect(
|
|---|
| 88 | 'ncacn_np:%s' % self.server,
|
|---|
| 89 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 90 | self.cred)
|
|---|
| 91 |
|
|---|
| 92 | connect_handle = samr.Connect(pipe)
|
|---|
| 93 |
|
|---|
| 94 | for i in connect_handle.EnumDomains():
|
|---|
| 95 | print i
|
|---|
| 96 |
|
|---|
| 97 | def do_SamrLookupDomain(self, line):
|
|---|
| 98 | """Return the SID for a domain."""
|
|---|
| 99 |
|
|---|
| 100 | usage = 'SamrLookupDomain DOMAIN'
|
|---|
| 101 |
|
|---|
| 102 | parser = OptionParser(usage)
|
|---|
| 103 | options, args = parser.parse_args(string.split(line))
|
|---|
| 104 |
|
|---|
| 105 | if len(args) != 1:
|
|---|
| 106 | print 'usage:', usage
|
|---|
| 107 | return
|
|---|
| 108 |
|
|---|
| 109 | pipe = dcerpc.pipe_connect(
|
|---|
| 110 | 'ncacn_np:%s' % self.server,
|
|---|
| 111 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 112 | self.cred)
|
|---|
| 113 |
|
|---|
| 114 | connect_handle = samr.Connect(pipe)
|
|---|
| 115 |
|
|---|
| 116 | print connect_handle.LookupDomain(args[0])
|
|---|
| 117 |
|
|---|
| 118 | def do_SamrQueryDomInfo(self, line):
|
|---|
| 119 | """Return information about a domain designated by its SID."""
|
|---|
| 120 |
|
|---|
| 121 | usage = 'SamrQueryDomInfo DOMAIN_SID [info_level]'
|
|---|
| 122 |
|
|---|
| 123 | parser = OptionParser(usage)
|
|---|
| 124 | options, args = parser.parse_args(string.split(line))
|
|---|
| 125 |
|
|---|
| 126 | if (len(args) == 0) or (len(args) > 2):
|
|---|
| 127 | print 'usage:', usage
|
|---|
| 128 | return
|
|---|
| 129 |
|
|---|
| 130 | pipe = dcerpc.pipe_connect(
|
|---|
| 131 | 'ncacn_np:%s' % self.server,
|
|---|
| 132 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 133 | self.cred)
|
|---|
| 134 |
|
|---|
| 135 | connect_handle = samr.Connect(pipe)
|
|---|
| 136 | domain_handle = connect_handle.OpenDomain(args[0])
|
|---|
| 137 |
|
|---|
| 138 | if (len(args) == 2):
|
|---|
| 139 | result = domain_handle.QueryDomainInfo(int(args[1]))
|
|---|
| 140 | else:
|
|---|
| 141 | result = domain_handle.QueryDomainInfo()
|
|---|
| 142 |
|
|---|
| 143 | pprint(swig2dict(result))
|
|---|
| 144 |
|
|---|
| 145 | def do_SamrQueryDomInfo2(self, line):
|
|---|
| 146 | """Return information about a domain designated by its SID.
|
|---|
| 147 | (Windows 2000 and >)"""
|
|---|
| 148 |
|
|---|
| 149 | usage = 'SamrQueryDomInfo2 DOMAIN_SID [info_level] (Windows 2000 and >)'
|
|---|
| 150 | parser = OptionParser(usage)
|
|---|
| 151 | options, args = parser.parse_args(string.split(line))
|
|---|
| 152 |
|
|---|
| 153 | if len(args) == 0 or len(args) > 2:
|
|---|
| 154 | print 'usage:', usage
|
|---|
| 155 | return
|
|---|
| 156 |
|
|---|
| 157 | pipe = dcerpc.pipe_connect(
|
|---|
| 158 | 'ncacn_np:%s' % self.server,
|
|---|
| 159 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 160 | self.cred)
|
|---|
| 161 |
|
|---|
| 162 | connect_handle = samr.Connect(pipe)
|
|---|
| 163 | domain_handle = connect_handle.OpenDomain(args[0])
|
|---|
| 164 |
|
|---|
| 165 | if (len(args) == 2):
|
|---|
| 166 | result = domain_handle.QueryDomainInfo2(int(args[1]))
|
|---|
| 167 | else:
|
|---|
| 168 | result = domain_handle.QueryDomainInfo2()
|
|---|
| 169 |
|
|---|
| 170 | pprint(swig2dict(result))
|
|---|
| 171 |
|
|---|
| 172 | def do_SamrEnumDomainGroups(self, line):
|
|---|
| 173 | """Return the list of groups of a domain designated by its SID."""
|
|---|
| 174 |
|
|---|
| 175 | usage = 'SamrEnumDomainGroups DOMAIN_SID'
|
|---|
| 176 |
|
|---|
| 177 | parser = OptionParser(usage)
|
|---|
| 178 | options, args = parser.parse_args(string.split(line))
|
|---|
| 179 |
|
|---|
| 180 | if len(args) != 1:
|
|---|
| 181 | print 'usage:', usage
|
|---|
| 182 | return
|
|---|
| 183 |
|
|---|
| 184 | pipe = dcerpc.pipe_connect(
|
|---|
| 185 | 'ncacn_np:%s' % self.server,
|
|---|
| 186 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 187 | self.cred)
|
|---|
| 188 |
|
|---|
| 189 | connect_handle = samr.Connect(pipe)
|
|---|
| 190 | domain_handle = connect_handle.OpenDomain(args[0])
|
|---|
| 191 |
|
|---|
| 192 | result = domain_handle.EnumDomainGroups()
|
|---|
| 193 |
|
|---|
| 194 | pprint(result)
|
|---|
| 195 |
|
|---|
| 196 | def do_SamrEnumDomainAliases(self, line):
|
|---|
| 197 | """Return the list of aliases (local groups) of a domain designated
|
|---|
| 198 | by its SID."""
|
|---|
| 199 |
|
|---|
| 200 | usage = 'SamrEnumDomainAliases DOMAIN_SID'
|
|---|
| 201 |
|
|---|
| 202 | parser = OptionParser(usage)
|
|---|
| 203 | options, args = parser.parse_args(string.split(line))
|
|---|
| 204 |
|
|---|
| 205 | if len(args) != 1:
|
|---|
| 206 | print 'usage:', usage
|
|---|
| 207 | return
|
|---|
| 208 |
|
|---|
| 209 | pipe = dcerpc.pipe_connect(
|
|---|
| 210 | 'ncacn_np:%s' % self.server,
|
|---|
| 211 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 212 | self.cred)
|
|---|
| 213 |
|
|---|
| 214 | connect_handle = samr.Connect(pipe)
|
|---|
| 215 | domain_handle = connect_handle.OpenDomain(args[0])
|
|---|
| 216 |
|
|---|
| 217 | result = domain_handle.EnumDomainAliases()
|
|---|
| 218 |
|
|---|
| 219 | pprint(result)
|
|---|
| 220 |
|
|---|
| 221 | def do_SamrEnumDomainUsers(self, line):
|
|---|
| 222 | """Return the list of users of a domain designated by its SID."""
|
|---|
| 223 |
|
|---|
| 224 | usage = 'SamrEnumDomainUsers DOMAIN_SID [user_account_flags]'
|
|---|
| 225 |
|
|---|
| 226 | parser = OptionParser(usage)
|
|---|
| 227 | options, args = parser.parse_args(string.split(line))
|
|---|
| 228 |
|
|---|
| 229 | if (len(args) == 0) or (len(args) > 2):
|
|---|
| 230 | print 'usage:', usage
|
|---|
| 231 | return
|
|---|
| 232 |
|
|---|
| 233 | pipe = dcerpc.pipe_connect(
|
|---|
| 234 | 'ncacn_np:%s' % self.server,
|
|---|
| 235 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
|---|
| 236 | self.cred)
|
|---|
| 237 |
|
|---|
| 238 | connect_handle = samr.Connect(pipe)
|
|---|
| 239 | domain_handle = connect_handle.OpenDomain(args[0])
|
|---|
| 240 |
|
|---|
| 241 | if (len(args) == 2):
|
|---|
| 242 | result = domain_handle.EnumDomainUsers(int(args[1]))
|
|---|
| 243 | else:
|
|---|
| 244 | result = domain_handle.EnumDomainUsers()
|
|---|
| 245 |
|
|---|
| 246 | pprint(result)
|
|---|
| 247 |
|
|---|
| 248 | if __name__ == '__main__':
|
|---|
| 249 |
|
|---|
| 250 | # Parse command line
|
|---|
| 251 |
|
|---|
| 252 | usage = 'rpcclient SERVER [options]'
|
|---|
| 253 |
|
|---|
| 254 | if len(sys.argv) == 1:
|
|---|
| 255 | print usage
|
|---|
| 256 | sys.exit(1)
|
|---|
| 257 |
|
|---|
| 258 | server = sys.argv[1]
|
|---|
| 259 | del(sys.argv[1])
|
|---|
| 260 |
|
|---|
| 261 | parser = OptionParser(usage)
|
|---|
| 262 |
|
|---|
| 263 | parser.add_option('-U', '--username', action='store', type='string',
|
|---|
| 264 | help='Use given credentials when connecting',
|
|---|
| 265 | metavar='DOMAIN\\username%password',
|
|---|
| 266 | dest='username')
|
|---|
| 267 |
|
|---|
| 268 | parser.add_option('-c', '--command', action='store', type='string',
|
|---|
| 269 | help='Execute COMMAND', dest='command')
|
|---|
| 270 |
|
|---|
| 271 | options, args = parser.parse_args()
|
|---|
| 272 |
|
|---|
| 273 | # Break --username up into domain, username and password
|
|---|
| 274 |
|
|---|
| 275 | cred = None
|
|---|
| 276 |
|
|---|
| 277 | if not options.username:
|
|---|
| 278 | options.username = '%'
|
|---|
| 279 |
|
|---|
| 280 | domain = ''
|
|---|
| 281 | if string.find(options.username, '\\') != -1:
|
|---|
| 282 | domain, options.username = string.split(options.username, '\\')
|
|---|
| 283 |
|
|---|
| 284 | password = ''
|
|---|
| 285 | if string.find(options.username, '%') != -1:
|
|---|
| 286 | options.username, password = string.split(options.username, '%')
|
|---|
| 287 |
|
|---|
| 288 | username = options.username
|
|---|
| 289 |
|
|---|
| 290 | if username != '':
|
|---|
| 291 | cred = (domain, username, password)
|
|---|
| 292 |
|
|---|
| 293 | # Run command loop
|
|---|
| 294 |
|
|---|
| 295 | c = rpcclient(server, cred)
|
|---|
| 296 |
|
|---|
| 297 | if options.command:
|
|---|
| 298 | c.onecmd(options.command)
|
|---|
| 299 | sys.exit(0)
|
|---|
| 300 |
|
|---|
| 301 | while 1:
|
|---|
| 302 | try:
|
|---|
| 303 | c.cmdloop()
|
|---|
| 304 | except KeyboardInterrupt:
|
|---|
| 305 | print 'KeyboardInterrupt'
|
|---|