(read_message, **kwargs)
| 476 | closeFid(kwargs['tid'], kwargs['fid'], error = 'Failed to list shares: Unable to read from Server Service RPC endpoint') |
| 477 | |
| 478 | def rpcReadCB(read_message, **kwargs): |
| 479 | self._pushToArray(messages_history, read_message) |
| 480 | if read_message.status == 0: |
| 481 | call_id = self._getNextRPCCallID() |
| 482 | |
| 483 | padding = b'' |
| 484 | remote_name = '\\\\' + self.remote_name |
| 485 | server_len = len(remote_name) + 1 |
| 486 | server_bytes_len = server_len * 2 |
| 487 | if server_len % 2 != 0: |
| 488 | padding = b'\0\0' |
| 489 | server_bytes_len += 2 |
| 490 | |
| 491 | # The data bytes are the RPC call to NetrShareEnum (Opnum 15) at Server Service RPC. |
| 492 | # If you wish to understand the meanings of the byte stream, I would suggest you use a recent version of WireShark to packet capture the stream |
| 493 | data_bytes = \ |
| 494 | binascii.unhexlify(b"""05 00 00 03 10 00 00 00""".replace(b' ', b'')) + \ |
| 495 | struct.pack('<HHI', 72+server_bytes_len, 0, call_id) + \ |
| 496 | binascii.unhexlify(b"""4c 00 00 00 00 00 0f 00 00 00 02 00""".replace(b' ', b'')) + \ |
| 497 | struct.pack('<III', server_len, 0, server_len) + \ |
| 498 | (remote_name + '\0').encode('UTF-16LE') + padding + \ |
| 499 | binascii.unhexlify(b""" |
| 500 | 01 00 00 00 01 00 00 00 04 00 02 00 00 00 00 00 |
| 501 | 00 00 00 00 ff ff ff ff 08 00 02 00 00 00 00 00 |
| 502 | """.replace(b' ', b'').replace(b'\n', b'')) |
| 503 | m = SMB2Message(SMB2IoctlRequest(kwargs['fid'], 0x0011C017, flags = 0x01, max_out_size = 8196, in_data = data_bytes)) |
| 504 | m.tid = kwargs['tid'] |
| 505 | self._sendSMBMessage(m) |
| 506 | self.pending_requests[m.mid] = _PendingRequest(m.mid, expiry_time, listShareResultsCB, errback, tid = kwargs['tid'], fid = kwargs['fid']) |
| 507 | self._pushToArray(messages_history, m) |
| 508 | else: |
| 509 | closeFid(kwargs['tid'], kwargs['fid'], error = 'Failed to list shares: Unable to bind to Server Service RPC endpoint') |
| 510 | |
| 511 | def listShareResultsCB(result_message, **kwargs): |
| 512 | self._pushToArray(messages_history, result_message) |
nothing calls this directly
no test coverage detected