Skip to content

Commit a96d5f2

Browse files
oiweiweioiweiwei
committed
examples: add remote mgmt example
1 parent 8171bb8 commit a96d5f2

File tree

4 files changed

+149
-0
lines changed

4 files changed

+149
-0
lines changed

‎examples/samples_with_config/epm.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ func main() {
134134
fmt.Println("ievent")
135135

136136
MapSyntax(ctx, cli, eventlog.EventlogSyntaxV0_0)
137+
137138
}
138139

139140
func MapSyntax(ctx context.Context, cli epm.EpmClient, syntax *dcerpc.SyntaxID) {

‎examples/samples_with_config/mgmt.go‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
package main
2+
3+
import (
4+
"context"
5+
"flag"
6+
"fmt"
7+
"os"
8+
9+
config "github.com/oiweiwei/go-msrpc/config"
10+
config_flag "github.com/oiweiwei/go-msrpc/config/flag"
11+
"github.com/oiweiwei/go-msrpc/dcerpc"
12+
"github.com/oiweiwei/go-msrpc/msrpc/mgmt/mgmt/v1"
13+
"github.com/oiweiwei/go-msrpc/msrpc/well_known"
14+
"github.com/oiweiwei/go-msrpc/ssp/gssapi"
15+
)
16+
17+
var (
18+
cfg = config.New().DisableEPM()
19+
)
20+
21+
var Statistics = [4]string{
22+
"RPC_C_STATS_CALLS_IN",
23+
"RPC_C_STATS_CALLS_OUT",
24+
"RPC_C_STATS_PKTS_IN",
25+
"RPC_C_STATS_PKTS_OUT",
26+
}
27+
28+
func init() {
29+
30+
config_flag.BindFlags(cfg, flag.CommandLine)
31+
}
32+
33+
func main() {
34+
35+
if err := config_flag.ParseAndValidate(cfg, flag.CommandLine); err != nil {
36+
fmt.Fprintln(os.Stderr, err)
37+
return
38+
}
39+
40+
ctx := gssapi.NewSecurityContext(context.Background())
41+
42+
cc, err := dcerpc.Dial(ctx, cfg.ServerAddr(), cfg.DialOptions(ctx)...)
43+
if err != nil {
44+
fmt.Fprintln(os.Stderr, err)
45+
return
46+
}
47+
defer cc.Close(ctx)
48+
49+
cli2, err := mgmt.NewManagementClient(ctx, cc, cfg.ClientOptions(ctx)...)
50+
if err != nil {
51+
fmt.Fprintln(os.Stderr, err)
52+
return
53+
}
54+
55+
stats, err := cli2.InquireStats(ctx, &mgmt.InquireStatsRequest{Count: 4})
56+
if err != nil {
57+
fmt.Fprintln(os.Stderr, err)
58+
return
59+
}
60+
61+
for i, v := range stats.Statistics {
62+
if i >= len(Statistics) {
63+
fmt.Printf("unknown statistic %d: %d\n", i, v)
64+
}
65+
fmt.Printf("%s: %d\n", Statistics[i], v)
66+
}
67+
68+
ifs, err := cli2.InquireInterfaceIDs(ctx, &mgmt.InquireInterfaceIDsRequest{})
69+
if err != nil {
70+
fmt.Fprintln(os.Stderr, err)
71+
return
72+
}
73+
74+
for i, iff := range ifs.InterfaceIDVector.InterfaceID {
75+
fmt.Printf("[%d]: %s %s %d.%d\n", i, iff.UUID.UUID(), (*well_known.UUID)(iff.UUID.UUID()).Describe(), iff.VersMajor, iff.VersMinor)
76+
}
77+
78+
resp2, err := cli2.InquirePrincName(ctx, &mgmt.InquirePrincNameRequest{
79+
AuthnProto: uint32(dcerpc.AuthTypeWinNT),
80+
PrincNameSize: 1024},
81+
)
82+
if err != nil {
83+
fmt.Fprintln(os.Stderr, err)
84+
return
85+
}
86+
87+
fmt.Println("Server principal name:", resp2.PrincName)
88+
}

‎msrpc/well_known/data/well_known_endpoints.tsv‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,7 @@ F120A684-B926-447F-9DF4-C966CB785648 MS-RAI Remote Assistance Initiation Protoco
326326
45F52C28-7F9F-101A-B52B-08002B2EFABE MS-RAIW Remote Administrative Interface: WINS winsif v1.0 ncacn_np:WinsPipe
327327
A35AF600-9CF4-11CD-A076-08002B2BD711 MS-RDPESC Remote Desktop Protocol: Smart Card Virtual Channel Extension TypeScardPack v1.0
328328
E1AF8308-5D1F-11C9-91A4-08002B14A0FA MS-RPCE Endpoint Mapper Protocol EndpointMapper v3.0 ncacn_ip_tcp:135 ncacn_np:epmapper
329+
AFA8BD80-7D8A-11C9-BEF4-08002B102989 MS-RPCE Remote Management Protocol RemoteManagement v1.0 ncacn_ip_tcp:135
329330
71710533-BEBA-4937-8319-B5DBEF9CCC36 MS-RPCE Transfer Syntax NDR64 TransferNDR64 v1.0
330331
8A885D04-1CEB-11C9-9FE8-08002B104860 MS-RPCE Transfer Syntax NDR TransferNDR v2.0
331332
E33C0CC4-0482-101A-BC0C-02608C6BA218 MS-RPCL Remote Procedure Call Location Services Extensions LocToLoc v1.0 ncacn_np:Locator
@@ -753,3 +754,11 @@ B4CB7611-AD0B-4C2D-B35F-FFE45785C709 MS-DLL wwansvc.dll: WWAN Auto Config Servic
753754
9C56D792-0591-4431-8D1F-681BFD80E4C0 MS-DLL wwansvc.dll: WWAN Auto Config Service Wwan2Rpc v1.0
754755
DE2DAF3B-5C16-4613-B204-D810EE629D9E MS-DLL wwansvc.dll: WWAN Auto Config Service WwanMgmtRpc v1.0
755756
C503F532-443A-4C69-8300-CCD1FBDB3839 MS-DLL mpsvc.dll: Windows Defender Service IMpService v2.0
757+
C6F3EE72-CE7E-11D1-B71E-00C04FC3111A RPCSS Machine Activator Control IMachineActivatorControl v1.0
758+
00000136-0000-0000-C000-000000000046 RPCSS The ISCM Local Activactor ISCMLocalActivator v0.0
759+
412F241E-C12A-11CE-ABFF-0020AF6E7A17 RPCSS The ISCM RPC interface ISCM v0.2 ncacn_ip_tcp:135
760+
B9E79E60-3D52-11CE-AAA1-00006901293F RPCSS Running Object Table Interface IROT v0.2 ncacn_ip_tcp:135
761+
E60C73E6-88F9-11CF-9AF1-0020AF6E72F4 RPCSS Local Object Exporter Service ILocalObjectExporter v2.0 ncacn_ip_tcp:135
762+
0B0A6584-9E0F-11CF-A3CF-00805F68CB1B RPCSS Local Endpoint Mapper localepmp v1.1
763+
1D55B526-C137-46C5-AB79-638F2A68E869 RPCSS Dbgidl Dbgidl v1.0
764+
64FE0B7F-9EF5-4553-A7DB-9A1975777554 RPCSS Fwidl Fwidl v1.0

‎msrpc/well_known/well_known_endpoints.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,7 @@ var (
333333
MSRAIWWinsif = uuid.UUID{TimeLow: 0x45f52c28, TimeMid: 0x7f9f, TimeHiAndVersion: 0x101a, ClockSeqHiAndReserved: 0xb5, ClockSeqLow: 0x2b, Node: [6]uint8{0x8, 0x0, 0x2b, 0x2e, 0xfa, 0xbe}}
334334
MSRDPESCTypeScardPack = uuid.UUID{TimeLow: 0xa35af600, TimeMid: 0x9cf4, TimeHiAndVersion: 0x11cd, ClockSeqHiAndReserved: 0xa0, ClockSeqLow: 0x76, Node: [6]uint8{0x8, 0x0, 0x2b, 0x2b, 0xd7, 0x11}}
335335
MSRPCEEndpointMapper = uuid.UUID{TimeLow: 0xe1af8308, TimeMid: 0x5d1f, TimeHiAndVersion: 0x11c9, ClockSeqHiAndReserved: 0x91, ClockSeqLow: 0xa4, Node: [6]uint8{0x8, 0x0, 0x2b, 0x14, 0xa0, 0xfa}}
336+
MSRPCERemoteManagement = uuid.UUID{TimeLow: 0xafa8bd80, TimeMid: 0x7d8a, TimeHiAndVersion: 0x11c9, ClockSeqHiAndReserved: 0xbe, ClockSeqLow: 0xf4, Node: [6]uint8{0x8, 0x0, 0x2b, 0x10, 0x29, 0x89}}
336337
MSRPCETransferNDR64 = uuid.UUID{TimeLow: 0x71710533, TimeMid: 0xbeba, TimeHiAndVersion: 0x4937, ClockSeqHiAndReserved: 0x83, ClockSeqLow: 0x19, Node: [6]uint8{0xb5, 0xdb, 0xef, 0x9c, 0xcc, 0x36}}
337338
MSRPCETransferNDR = uuid.UUID{TimeLow: 0x8a885d04, TimeMid: 0x1ceb, TimeHiAndVersion: 0x11c9, ClockSeqHiAndReserved: 0x9f, ClockSeqLow: 0xe8, Node: [6]uint8{0x8, 0x0, 0x2b, 0x10, 0x48, 0x60}}
338339
MSRPCLLocToLoc = uuid.UUID{TimeLow: 0xe33c0cc4, TimeMid: 0x482, TimeHiAndVersion: 0x101a, ClockSeqHiAndReserved: 0xbc, ClockSeqLow: 0xc, Node: [6]uint8{0x2, 0x60, 0x8c, 0x6b, 0xa2, 0x18}}
@@ -760,6 +761,14 @@ var (
760761
MSDLLWwan2Rpc = uuid.UUID{TimeLow: 0x9c56d792, TimeMid: 0x591, TimeHiAndVersion: 0x4431, ClockSeqHiAndReserved: 0x8d, ClockSeqLow: 0x1f, Node: [6]uint8{0x68, 0x1b, 0xfd, 0x80, 0xe4, 0xc0}}
761762
MSDLLWwanMgmtRpc = uuid.UUID{TimeLow: 0xde2daf3b, TimeMid: 0x5c16, TimeHiAndVersion: 0x4613, ClockSeqHiAndReserved: 0xb2, ClockSeqLow: 0x4, Node: [6]uint8{0xd8, 0x10, 0xee, 0x62, 0x9d, 0x9e}}
762763
MSDLLIMpService = uuid.UUID{TimeLow: 0xc503f532, TimeMid: 0x443a, TimeHiAndVersion: 0x4c69, ClockSeqHiAndReserved: 0x83, ClockSeqLow: 0x0, Node: [6]uint8{0xcc, 0xd1, 0xfb, 0xdb, 0x38, 0x39}}
764+
RPCSSIMachineActivatorControl = uuid.UUID{TimeLow: 0xc6f3ee72, TimeMid: 0xce7e, TimeHiAndVersion: 0x11d1, ClockSeqHiAndReserved: 0xb7, ClockSeqLow: 0x1e, Node: [6]uint8{0x0, 0xc0, 0x4f, 0xc3, 0x11, 0x1a}}
765+
RPCSSISCMLocalActivator = uuid.UUID{TimeLow: 0x136, TimeMid: 0x0, TimeHiAndVersion: 0x0, ClockSeqHiAndReserved: 0xc0, ClockSeqLow: 0x0, Node: [6]uint8{0x0, 0x0, 0x0, 0x0, 0x0, 0x46}}
766+
RPCSSISCM = uuid.UUID{TimeLow: 0x412f241e, TimeMid: 0xc12a, TimeHiAndVersion: 0x11ce, ClockSeqHiAndReserved: 0xab, ClockSeqLow: 0xff, Node: [6]uint8{0x0, 0x20, 0xaf, 0x6e, 0x7a, 0x17}}
767+
RPCSSIROT = uuid.UUID{TimeLow: 0xb9e79e60, TimeMid: 0x3d52, TimeHiAndVersion: 0x11ce, ClockSeqHiAndReserved: 0xaa, ClockSeqLow: 0xa1, Node: [6]uint8{0x0, 0x0, 0x69, 0x1, 0x29, 0x3f}}
768+
RPCSSILocalObjectExporter = uuid.UUID{TimeLow: 0xe60c73e6, TimeMid: 0x88f9, TimeHiAndVersion: 0x11cf, ClockSeqHiAndReserved: 0x9a, ClockSeqLow: 0xf1, Node: [6]uint8{0x0, 0x20, 0xaf, 0x6e, 0x72, 0xf4}}
769+
RPCSSLocalepmp = uuid.UUID{TimeLow: 0xb0a6584, TimeMid: 0x9e0f, TimeHiAndVersion: 0x11cf, ClockSeqHiAndReserved: 0xa3, ClockSeqLow: 0xcf, Node: [6]uint8{0x0, 0x80, 0x5f, 0x68, 0xcb, 0x1b}}
770+
RPCSSDbgidl = uuid.UUID{TimeLow: 0x1d55b526, TimeMid: 0xc137, TimeHiAndVersion: 0x46c5, ClockSeqHiAndReserved: 0xab, ClockSeqLow: 0x79, Node: [6]uint8{0x63, 0x8f, 0x2a, 0x68, 0xe8, 0x69}}
771+
RPCSSFwidl = uuid.UUID{TimeLow: 0x64fe0b7f, TimeMid: 0x9ef5, TimeHiAndVersion: 0x4553, ClockSeqHiAndReserved: 0xa7, ClockSeqLow: 0xdb, Node: [6]uint8{0x9a, 0x19, 0x75, 0x77, 0x75, 0x54}}
763772
)
764773

765774
type UUID uuid.UUID
@@ -1422,6 +1431,8 @@ func (u UUID) Describe() string {
14221431
return "MS-RDPESC: Remote Desktop Protocol: Smart Card Virtual Channel Extension: TypeScardPack"
14231432
case MSRPCEEndpointMapper:
14241433
return "MS-RPCE: Endpoint Mapper Protocol: EndpointMapper"
1434+
case MSRPCERemoteManagement:
1435+
return "MS-RPCE: Remote Management Protocol: RemoteManagement"
14251436
case MSRPCETransferNDR64:
14261437
return "MS-RPCE: Transfer Syntax NDR64: TransferNDR64"
14271438
case MSRPCETransferNDR:
@@ -2276,6 +2287,22 @@ func (u UUID) Describe() string {
22762287
return "MS-DLL: wwansvc.dll: WWAN Auto Config Service: WwanMgmtRpc"
22772288
case MSDLLIMpService:
22782289
return "MS-DLL: mpsvc.dll: Windows Defender Service: IMpService"
2290+
case RPCSSIMachineActivatorControl:
2291+
return "RPCSS: Machine Activator Control: IMachineActivatorControl"
2292+
case RPCSSISCMLocalActivator:
2293+
return "RPCSS: The ISCM Local Activactor: ISCMLocalActivator"
2294+
case RPCSSISCM:
2295+
return "RPCSS: The ISCM RPC interface: ISCM"
2296+
case RPCSSIROT:
2297+
return "RPCSS: Running Object Table Interface: IROT"
2298+
case RPCSSILocalObjectExporter:
2299+
return "RPCSS: Local Object Exporter Service: ILocalObjectExporter"
2300+
case RPCSSLocalepmp:
2301+
return "RPCSS: Local Endpoint Mapper: localepmp"
2302+
case RPCSSDbgidl:
2303+
return "RPCSS: Dbgidl: Dbgidl"
2304+
case RPCSSFwidl:
2305+
return "RPCSS: Fwidl: Fwidl"
22792306
}
22802307
return ""
22812308
}
@@ -2336,6 +2363,8 @@ func (u UUID) WellKnownEndpoint() []string {
23362363
return []string{"ncacn_np:WinsPipe"}
23372364
case MSRPCEEndpointMapper:
23382365
return []string{"ncacn_ip_tcp:135", "ncacn_np:epmapper"}
2366+
case MSRPCERemoteManagement:
2367+
return []string{"ncacn_ip_tcp:135"}
23392368
case MSRPCLLocToLoc:
23402369
return []string{"ncacn_np:Locator"}
23412370
case MSRPRNWinspool:
@@ -2390,6 +2419,10 @@ func (u UUID) WellKnownEndpoint() []string {
23902419
return []string{"ncacn_np:locator"}
23912420
case MSDLLNsiM:
23922421
return []string{"ncacn_np:locator"}
2422+
case RPCSSIROT:
2423+
return []string{"ncacn_ip_tcp:135"}
2424+
case RPCSSILocalObjectExporter:
2425+
return []string{"ncacn_ip_tcp:135"}
23932426
}
23942427
return nil
23952428
}
@@ -3051,6 +3084,8 @@ func (u UUID) Name() string {
30513084
return "TypeScardPack"
30523085
case MSRPCEEndpointMapper:
30533086
return "EndpointMapper"
3087+
case MSRPCERemoteManagement:
3088+
return "RemoteManagement"
30543089
case MSRPCETransferNDR64:
30553090
return "TransferNDR64"
30563091
case MSRPCETransferNDR:
@@ -3905,6 +3940,22 @@ func (u UUID) Name() string {
39053940
return "WwanMgmtRpc"
39063941
case MSDLLIMpService:
39073942
return "IMpService"
3943+
case RPCSSIMachineActivatorControl:
3944+
return "IMachineActivatorControl"
3945+
case RPCSSISCMLocalActivator:
3946+
return "ISCMLocalActivator"
3947+
case RPCSSISCM:
3948+
return "ISCM"
3949+
case RPCSSIROT:
3950+
return "IROT"
3951+
case RPCSSILocalObjectExporter:
3952+
return "ILocalObjectExporter"
3953+
case RPCSSLocalepmp:
3954+
return "localepmp"
3955+
case RPCSSDbgidl:
3956+
return "Dbgidl"
3957+
case RPCSSFwidl:
3958+
return "Fwidl"
39083959
}
39093960
return ""
39103961
}

0 commit comments

Comments
 (0)