SMB2 over RPC example

[krasnovu]

Greetings, would you have an example of calling lsarpc.OpenPolicy2 via SMB2 over RPC? I'm trying to call it, but in the trace in SMB2 it gives Write instead of Ioctl. In the screenshot on the left is my attempt, on the right is the windows attempt.

main.go.tar.gz

[oiweiwei]

Hello, @krasnovu ! AFAIK there is no difference between calling Write and Read on named pipe and Transcieve (Ioctl). Do you see any error in calling Write?

[oiweiwei]

I mean, the error says that access is denied in both cases, is there any principal difference in how it fails?

[oiweiwei]

The actual problem (or problems) with provided code are following:

you use WithConnect() which is for most of security features (and especially when used within named pipe) will not allow you to establish communication. Use WithSeal() for named pipes which will ensure that your request will establish.

you don't specify parameter for QueryInformation.

So, the working code looks like following:

18,20d17
< 
< 	_ "github.com/oiweiwei/go-msrpc/msrpc/erref/ntstatus"
< 	_ "github.com/oiweiwei/go-msrpc/msrpc/erref/win32"
86c83
< 		dcerpc.WithSeal(),
---
> 		dcerpc.WithConnect(),
115c112
< 	respPolicyInfo, err := cli.QueryInformationPolicy2(ctx, &lsarpc.QueryInformationPolicy2Request{Policy: respPolicy.Policy, InformationClass: lsarpc.PolicyInformationClassDNSDomainInformation})
---
> 	respPolicyInfo, err := cli.QueryInformationPolicy2(ctx, &lsarpc.QueryInformationPolicy2Request{Policy: respPolicy.Policy})
124,125c121,122
< 	if ddi, ok := respPolicyInfo.PolicyInformation.GetValue().(*lsarpc.PolicyDNSDomainInfo); ok {
< 		log.Printf("!!!! PolicyDNSDomainInfo = %s", j(ddi))
---
> 	if ddi, ok := respPolicyInfo.PolicyInformation.GetValue().(lsarpc.PolicyDNSDomainInfo); ok {
> 		log.Printf("!!!! PolicyDNSDomainInfo = %s", j(ddi))

[krasnovu]

To be honest, there are a lot of events in the trace, maybe I chose the wrong part.
But thanks to your explanations of the code, I understood it a bit better.
It works!
Thank you for your attention and guidance! 🤝 🙏

[krasnovu]

// RegisterServer.
func (t *conn) RegisterServer(_ ServerHandle, _ ...Option) {
	// TODO: NYI
}

"Dear Diary, I can't find the words to describe the pain I experienced today." 😁

Can you please tell me if you have any plans to implement a server side? Or maybe describe briefly (suspect it won't be short) how to implement it, e.g. how to respond to a QueryInformationPolicy2 request? I understand that the logic itself should be implemented behind the lsarpc.LsarpcServer interface. But it's unclear about the server, especially the SMB2 protocol.

    ...
    func (s *lsaServer) QueryInformationPolicy2(context.Context, *lsarpc.QueryInformationPolicy2Request) (*lsarpc.QueryInformationPolicy2Response, error) {
	    ...logic...
    }
    ...

    func ... {
        ...
	    var srv lsarpc.LsarpcServer = lsaServer{ ... }
	    h := lsarpc.NewLsarpcServerHandle(srv)
	    ...
    }   

Anyway I would like to express my thanks for your project, it is very useful!
ps: I apologize for my English.

[oiweiwei]

I've only charted how it may look like the way it works in gRPC (register some handle somewhere). The real pain is:

• establish security context (that is write all AcceptSecurityContext for NTLM, KRB5, Netlogon, SPNEGO)
• write DCERPC server with security context establishment (read Bind respond with BindAck and follow AlterContext/Response sequence or properly check Auth3 PDU)
• In case of named pipes there should be a SMB server implementation.

So the scope is quite depressing as for me. However people are keep trying to do something, ie https://github.com/mike76-dev/siasmb here I've found some basic examples of lsarpc.

Overall, maybe one day I'll get down to this but right now i feel the scope is a little bit big and requires going through lots of technical documentation that I cannot comprehend. MSDN contains some guidelines on how they would implement SMB2/3 server, same for C706 (DCE/RPC, around 700 pages).

[oiweiwei]

LsarpcServer is just an abstract server that should be registered to rpc.Server and rpc.Server should take care of all things not related to Lsarpc itself. Accept connection, negotiate security, decrypt request encryption response and so on. If it goes about SMB, it must pretend to be an $IPC file for SMB server (so hypothetical SMB should be able to route traffic to IPC file that would be our rpc.Server)