1 | #!/usr/bin/env python
|
---|
2 |
|
---|
3 | import sys, os, string
|
---|
4 |
|
---|
5 | # Find right directory when running from source tree
|
---|
6 | sys.path.insert(0, "bin/python")
|
---|
7 |
|
---|
8 | from cmd import Cmd
|
---|
9 | from optparse import OptionParser
|
---|
10 | from pprint import pprint
|
---|
11 |
|
---|
12 | import dcerpc, samr
|
---|
13 |
|
---|
14 | def swig2dict(obj):
|
---|
15 | """Convert a swig object to a dictionary."""
|
---|
16 |
|
---|
17 | result = {}
|
---|
18 |
|
---|
19 | for attr in filter(lambda x: type(x) == str, dir(obj)):
|
---|
20 |
|
---|
21 | if attr[:2] == '__' and attr[-2:] == '__':
|
---|
22 | continue
|
---|
23 |
|
---|
24 | if attr == 'this' or attr == 'thisown':
|
---|
25 | continue
|
---|
26 |
|
---|
27 | result[attr] = getattr(obj, attr)
|
---|
28 |
|
---|
29 | return result
|
---|
30 |
|
---|
31 | class rpcclient(Cmd):
|
---|
32 |
|
---|
33 | prompt = 'rpcclient$ '
|
---|
34 |
|
---|
35 | def __init__(self, server, cred):
|
---|
36 | Cmd.__init__(self)
|
---|
37 | self.server = server
|
---|
38 | self.cred = cred
|
---|
39 |
|
---|
40 | def emptyline(self):
|
---|
41 |
|
---|
42 | # Default for empty line is to repeat last command - yuck
|
---|
43 |
|
---|
44 | pass
|
---|
45 |
|
---|
46 | def onecmd(self, line):
|
---|
47 |
|
---|
48 | # Override the onecmd() method so we can trap error returns
|
---|
49 |
|
---|
50 | try:
|
---|
51 | Cmd.onecmd(self, line)
|
---|
52 | except dcerpc.NTSTATUS, arg:
|
---|
53 | print 'The command returned an error: %s' % arg[1]
|
---|
54 |
|
---|
55 | # Command handlers
|
---|
56 |
|
---|
57 | def do_help(self, line):
|
---|
58 | """Displays on-line help for rpcclient commands."""
|
---|
59 | Cmd.do_help(self, line)
|
---|
60 |
|
---|
61 | def do_shell(self, line):
|
---|
62 |
|
---|
63 | status = os.system(line)
|
---|
64 |
|
---|
65 | if os.WIFEXITED(status):
|
---|
66 | if os.WEXITSTATUS(status) != 0:
|
---|
67 | print 'Command exited with code %d' % os.WEXITSTATUS(status)
|
---|
68 | else:
|
---|
69 | print 'Command exited with signal %d' % os.WTERMSIG(status)
|
---|
70 |
|
---|
71 | def do_EOF(self, line):
|
---|
72 | """Exits rpcclient."""
|
---|
73 | print
|
---|
74 | sys.exit(0)
|
---|
75 |
|
---|
76 | # SAMR pipe commands
|
---|
77 |
|
---|
78 | def do_SamrEnumDomains(self, line):
|
---|
79 | """Enumerate domain names."""
|
---|
80 |
|
---|
81 | usage = 'usage: SamrEnumDomains'
|
---|
82 |
|
---|
83 | if line != '':
|
---|
84 | print usage
|
---|
85 | return
|
---|
86 |
|
---|
87 | pipe = dcerpc.pipe_connect(
|
---|
88 | 'ncacn_np:%s' % self.server,
|
---|
89 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
90 | self.cred)
|
---|
91 |
|
---|
92 | connect_handle = samr.Connect(pipe)
|
---|
93 |
|
---|
94 | for i in connect_handle.EnumDomains():
|
---|
95 | print i
|
---|
96 |
|
---|
97 | def do_SamrLookupDomain(self, line):
|
---|
98 | """Return the SID for a domain."""
|
---|
99 |
|
---|
100 | usage = 'SamrLookupDomain DOMAIN'
|
---|
101 |
|
---|
102 | parser = OptionParser(usage)
|
---|
103 | options, args = parser.parse_args(string.split(line))
|
---|
104 |
|
---|
105 | if len(args) != 1:
|
---|
106 | print 'usage:', usage
|
---|
107 | return
|
---|
108 |
|
---|
109 | pipe = dcerpc.pipe_connect(
|
---|
110 | 'ncacn_np:%s' % self.server,
|
---|
111 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
112 | self.cred)
|
---|
113 |
|
---|
114 | connect_handle = samr.Connect(pipe)
|
---|
115 |
|
---|
116 | print connect_handle.LookupDomain(args[0])
|
---|
117 |
|
---|
118 | def do_SamrQueryDomInfo(self, line):
|
---|
119 | """Return information about a domain designated by its SID."""
|
---|
120 |
|
---|
121 | usage = 'SamrQueryDomInfo DOMAIN_SID [info_level]'
|
---|
122 |
|
---|
123 | parser = OptionParser(usage)
|
---|
124 | options, args = parser.parse_args(string.split(line))
|
---|
125 |
|
---|
126 | if (len(args) == 0) or (len(args) > 2):
|
---|
127 | print 'usage:', usage
|
---|
128 | return
|
---|
129 |
|
---|
130 | pipe = dcerpc.pipe_connect(
|
---|
131 | 'ncacn_np:%s' % self.server,
|
---|
132 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
133 | self.cred)
|
---|
134 |
|
---|
135 | connect_handle = samr.Connect(pipe)
|
---|
136 | domain_handle = connect_handle.OpenDomain(args[0])
|
---|
137 |
|
---|
138 | if (len(args) == 2):
|
---|
139 | result = domain_handle.QueryDomainInfo(int(args[1]))
|
---|
140 | else:
|
---|
141 | result = domain_handle.QueryDomainInfo()
|
---|
142 |
|
---|
143 | pprint(swig2dict(result))
|
---|
144 |
|
---|
145 | def do_SamrQueryDomInfo2(self, line):
|
---|
146 | """Return information about a domain designated by its SID.
|
---|
147 | (Windows 2000 and >)"""
|
---|
148 |
|
---|
149 | usage = 'SamrQueryDomInfo2 DOMAIN_SID [info_level] (Windows 2000 and >)'
|
---|
150 | parser = OptionParser(usage)
|
---|
151 | options, args = parser.parse_args(string.split(line))
|
---|
152 |
|
---|
153 | if len(args) == 0 or len(args) > 2:
|
---|
154 | print 'usage:', usage
|
---|
155 | return
|
---|
156 |
|
---|
157 | pipe = dcerpc.pipe_connect(
|
---|
158 | 'ncacn_np:%s' % self.server,
|
---|
159 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
160 | self.cred)
|
---|
161 |
|
---|
162 | connect_handle = samr.Connect(pipe)
|
---|
163 | domain_handle = connect_handle.OpenDomain(args[0])
|
---|
164 |
|
---|
165 | if (len(args) == 2):
|
---|
166 | result = domain_handle.QueryDomainInfo2(int(args[1]))
|
---|
167 | else:
|
---|
168 | result = domain_handle.QueryDomainInfo2()
|
---|
169 |
|
---|
170 | pprint(swig2dict(result))
|
---|
171 |
|
---|
172 | def do_SamrEnumDomainGroups(self, line):
|
---|
173 | """Return the list of groups of a domain designated by its SID."""
|
---|
174 |
|
---|
175 | usage = 'SamrEnumDomainGroups DOMAIN_SID'
|
---|
176 |
|
---|
177 | parser = OptionParser(usage)
|
---|
178 | options, args = parser.parse_args(string.split(line))
|
---|
179 |
|
---|
180 | if len(args) != 1:
|
---|
181 | print 'usage:', usage
|
---|
182 | return
|
---|
183 |
|
---|
184 | pipe = dcerpc.pipe_connect(
|
---|
185 | 'ncacn_np:%s' % self.server,
|
---|
186 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
187 | self.cred)
|
---|
188 |
|
---|
189 | connect_handle = samr.Connect(pipe)
|
---|
190 | domain_handle = connect_handle.OpenDomain(args[0])
|
---|
191 |
|
---|
192 | result = domain_handle.EnumDomainGroups()
|
---|
193 |
|
---|
194 | pprint(result)
|
---|
195 |
|
---|
196 | def do_SamrEnumDomainAliases(self, line):
|
---|
197 | """Return the list of aliases (local groups) of a domain designated
|
---|
198 | by its SID."""
|
---|
199 |
|
---|
200 | usage = 'SamrEnumDomainAliases DOMAIN_SID'
|
---|
201 |
|
---|
202 | parser = OptionParser(usage)
|
---|
203 | options, args = parser.parse_args(string.split(line))
|
---|
204 |
|
---|
205 | if len(args) != 1:
|
---|
206 | print 'usage:', usage
|
---|
207 | return
|
---|
208 |
|
---|
209 | pipe = dcerpc.pipe_connect(
|
---|
210 | 'ncacn_np:%s' % self.server,
|
---|
211 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
212 | self.cred)
|
---|
213 |
|
---|
214 | connect_handle = samr.Connect(pipe)
|
---|
215 | domain_handle = connect_handle.OpenDomain(args[0])
|
---|
216 |
|
---|
217 | result = domain_handle.EnumDomainAliases()
|
---|
218 |
|
---|
219 | pprint(result)
|
---|
220 |
|
---|
221 | def do_SamrEnumDomainUsers(self, line):
|
---|
222 | """Return the list of users of a domain designated by its SID."""
|
---|
223 |
|
---|
224 | usage = 'SamrEnumDomainUsers DOMAIN_SID [user_account_flags]'
|
---|
225 |
|
---|
226 | parser = OptionParser(usage)
|
---|
227 | options, args = parser.parse_args(string.split(line))
|
---|
228 |
|
---|
229 | if (len(args) == 0) or (len(args) > 2):
|
---|
230 | print 'usage:', usage
|
---|
231 | return
|
---|
232 |
|
---|
233 | pipe = dcerpc.pipe_connect(
|
---|
234 | 'ncacn_np:%s' % self.server,
|
---|
235 | dcerpc.DCERPC_SAMR_UUID, int(dcerpc.DCERPC_SAMR_VERSION),
|
---|
236 | self.cred)
|
---|
237 |
|
---|
238 | connect_handle = samr.Connect(pipe)
|
---|
239 | domain_handle = connect_handle.OpenDomain(args[0])
|
---|
240 |
|
---|
241 | if (len(args) == 2):
|
---|
242 | result = domain_handle.EnumDomainUsers(int(args[1]))
|
---|
243 | else:
|
---|
244 | result = domain_handle.EnumDomainUsers()
|
---|
245 |
|
---|
246 | pprint(result)
|
---|
247 |
|
---|
248 | if __name__ == '__main__':
|
---|
249 |
|
---|
250 | # Parse command line
|
---|
251 |
|
---|
252 | usage = 'rpcclient SERVER [options]'
|
---|
253 |
|
---|
254 | if len(sys.argv) == 1:
|
---|
255 | print usage
|
---|
256 | sys.exit(1)
|
---|
257 |
|
---|
258 | server = sys.argv[1]
|
---|
259 | del(sys.argv[1])
|
---|
260 |
|
---|
261 | parser = OptionParser(usage)
|
---|
262 |
|
---|
263 | parser.add_option('-U', '--username', action='store', type='string',
|
---|
264 | help='Use given credentials when connecting',
|
---|
265 | metavar='DOMAIN\\username%password',
|
---|
266 | dest='username')
|
---|
267 |
|
---|
268 | parser.add_option('-c', '--command', action='store', type='string',
|
---|
269 | help='Execute COMMAND', dest='command')
|
---|
270 |
|
---|
271 | options, args = parser.parse_args()
|
---|
272 |
|
---|
273 | # Break --username up into domain, username and password
|
---|
274 |
|
---|
275 | cred = None
|
---|
276 |
|
---|
277 | if not options.username:
|
---|
278 | options.username = '%'
|
---|
279 |
|
---|
280 | domain = ''
|
---|
281 | if string.find(options.username, '\\') != -1:
|
---|
282 | domain, options.username = string.split(options.username, '\\')
|
---|
283 |
|
---|
284 | password = ''
|
---|
285 | if string.find(options.username, '%') != -1:
|
---|
286 | options.username, password = string.split(options.username, '%')
|
---|
287 |
|
---|
288 | username = options.username
|
---|
289 |
|
---|
290 | if username != '':
|
---|
291 | cred = (domain, username, password)
|
---|
292 |
|
---|
293 | # Run command loop
|
---|
294 |
|
---|
295 | c = rpcclient(server, cred)
|
---|
296 |
|
---|
297 | if options.command:
|
---|
298 | c.onecmd(options.command)
|
---|
299 | sys.exit(0)
|
---|
300 |
|
---|
301 | while 1:
|
---|
302 | try:
|
---|
303 | c.cmdloop()
|
---|
304 | except KeyboardInterrupt:
|
---|
305 | print 'KeyboardInterrupt'
|
---|