Module: RubySMB::Dcerpc::Epm

Included in:
Client
Defined in:
lib/ruby_smb/dcerpc/epm.rb,
lib/ruby_smb/dcerpc/epm/epm_twrt.rb,
lib/ruby_smb/dcerpc/epm/epm_ept_map_request.rb,
lib/ruby_smb/dcerpc/epm/epm_ept_map_response.rb

Defined Under Namespace

Classes: EpmDecodedTowerOctetString, EpmEptMapRequest, EpmEptMapResponse, EpmFloorHostOrAddr, EpmFloorInterfaceOrDataIdentifier, EpmFloorPipeOrHost, EpmFloorPipeOrPort, EpmFloorProtocolIdentifier, EpmIpv4Address, EpmIpxSpxAddress, EpmTowerOctetString, EpmTwrpt, EpmTwrt

Constant Summary collapse

UUID = 
'E1AF8308-5D1F-11C9-91A4-08002B14A0FA'
VER_MAJOR = 
3
VER_MINOR = 
0
EPT_MAP =

Operation numbers

0x0003

Instance Method Summary collapse

Instance Method Details

#get_host_port_from_ept_mapper(uuid:, maj_ver:, min_ver:, max_towers: 1) ⇒ Hash

Retrieve the service port number given a DCERPC interface UUID See: 2.2.1.2.5 ept_map Method https://pubs.opengroup.org/onlinepubs/9629399/apdxo.htm

Raises:

  • if the response is not a EpmEptMap packet

  • if the response error status is not STATUS_SUCCESS



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/ruby_smb/dcerpc/epm.rb', line 30

def get_host_port_from_ept_mapper(uuid:, maj_ver:, min_ver:, max_towers: 1)
  decoded_tower = EpmDecodedTowerOctetString.new(
    interface_identifier: {
      interface: uuid,
      major_version: maj_ver,
      minor_version: min_ver
    },
    data_representation: {
      interface: Ndr::UUID,
      major_version: Ndr::VER_MAJOR,
      minor_version: Ndr::VER_MINOR
    }
  )
  tower = EpmTwrt.new(decoded_tower)
  ept_map_request = EpmEptMapRequest.new(
    obj: Uuid.new,
    map_tower: tower,
    entry_handle: Ndr::NdrContextHandle.new,
    max_towers: max_towers
  )
  response = dcerpc_request(ept_map_request)
  begin
    ept_map_response = EpmEptMapResponse.read(response)
  rescue IOError
    raise RubySMB::Dcerpc::Error::InvalidPacket, 'Error reading EptMapResponse'
  end
  unless ept_map_response.error_status == WindowsError::NTStatus::STATUS_SUCCESS
    raise RubySMB::Dcerpc::Error::EpmError,
      "Error returned with ept_map: "\
      "#{WindowsError::NTStatus.find_by_retval(ept_map_response.error_status.value).join(',')}"
  end
  tower_binary = ept_map_response.towers[0].tower_octet_string.to_binary_s
  begin
    decoded_tower = EpmDecodedTowerOctetString.read(tower_binary)
  rescue IOError
    raise RubySMB::Dcerpc::Error::InvalidPacket, 'Error reading EpmDecodedTowerOctetString'
  end
  {
    port: decoded_tower.pipe_or_port.pipe_or_port.to_i,
    host: decoded_tower.host_or_addr.host_or_addr.to_i
  }
end