dcerpc

package
v0.12.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 22, 2026 License: MIT Imports: 18 Imported by: 4

Documentation

Index

Constants

View Source 
const (
	ErrorSuccess         uint32 = 0x00000000
	ErrorAccessDenied    uint32 = 0x00000005
	ErrorContextMismatch uint32 = 0x1c00001a
)
View Source 
const (
	PacketTypeRequest          uint8 = 0
	PacketTypeResponse         uint8 = 2
	PacketTypeFault            uint8 = 3
	PacketTypeBind             uint8 = 11
	PacketTypeBindAck          uint8 = 12
	PacketTypeBindNak          uint8 = 13
	PacketTypeAlterContext     uint8 = 14
	PacketTypeAlterContextResp uint8 = 15
	PacketTypeAuth3            uint8 = 16
)

MSRPC Packet Types

View Source 
const (
	RpcAuthnNone         uint8 = 0x00
	RpcAuthnGssNegotiate uint8 = 0x09 // SPNEGO
	RpcAuthnWinnt        uint8 = 0x0A // NTLMSSP
	RpcAuthnGssKerberos  uint8 = 0x10 // Kerberos (raw, without SPNEGO)
)

Auth types (MS-RPCE 2.2.1.1.7)

View Source 
const (
	RpcAuthnLevelNone         uint8 = 1
	RpcAuthnLevelConnect      uint8 = 2
	RpcAuthnLevelCall         uint8 = 3
	RpcAuthnLevelPkt          uint8 = 4
	RpcAuthnLevelPktIntegrity uint8 = 5
	RpcAuthnLevelPktPrivacy   uint8 = 6
)

Auth levels (MS-RPCE 2.2.1.1.8)

View Source 
const (
	PfcFirstFrag     uint8 = 0x1
	PfcLastFrag      uint8 = 0x2
	PfcPendingCancel uint8 = 0x4 // Cancel was pending at sender
	PfcReserved      uint8 = 0x8
	PfcConcMpx       uint8 = 0x10 // Support concurrent multiplexing of a single connection
	PfcDidNotExecute uint8 = 0x20
	PfcMaybe         uint8 = 0x40
	PfcObjectUUID    uint8 = 0x80
)

C706 Section 12.6.3.1 PFC Flags

View Source 
const PDUHeaderCommonSize int = 16

MSRPC Packet header common fields

View Source 
const RequestHeaderSize int = 24

MSRPC Request header size (header + AllocHint + ContextId + Opnum)

View Source 
const RequestHeaderWithObjectUUIDSize int = 40

MSRPC Request header size when PfcObjectUUID flag is set (24 + 16 byte UUID)

View Source 
const ResponseHeaderSize int = 24

ResponseHeaderSize is the fixed size of a Response PDU header (common header 16 + AllocHint 4 + ContextId 2 + CancelCount 1 + Reserved 1).

Variables

View Source 
var (
	ErrAccessDenied    = errors.New("access denied")
	ErrContextMismatch = errors.New("context mismatch")
)

Sentinel errors for the DCERPC Fault status codes recognised by this package. Match them with errors.Is against a *FaultError, e.g.: 

if errors.Is(err, dcerpc.ErrAccessDenied) { ... }
View Source 
var (
	MSRPCUuidNdr = "8a885d04-1ceb-11c9-9fe8-08002b104860" // NDR Transfer Syntax version 2.0

)

Functions

func EncryptSecretDes 

func EncryptSecretDes(key, input []byte) (ciphertext []byte, err error)

MS-LSAD 5.1.2 and 5.1.3 combined

func UUIDToBin 

func UUIDToBin(uuid string) ([]byte, error)

Types

type Auth3Req 

type Auth3Req struct {
	Header                       // Type = PacketTypeAuth3
	MaxSendFragSize uint16       // Pad field (same layout as Bind)
	MaxRecvFragSize uint16       // Pad field
	AuthVerifier    AuthVerifier // Required
}

Auth3Req represents the Auth3 PDU type (MS-RPCE 2.2.2.3). Not currently used — BindAuth uses AlterContext for the 3rd leg instead. Kept for reference; the server does not send a response to this PDU type.

func (*Auth3Req) MarshalBinary 

func (s *Auth3Req) MarshalBinary() (ret []byte, err error)

type AuthVerifier 

type AuthVerifier struct {
	AuthType      uint8
	AuthLevel     uint8
	AuthPadLength uint8
	AuthReserved  uint8 // Must be 0
	AuthContextId uint32
	AuthValue     []byte
}

AuthVerifier represents the auth_verifier structure appended to DCERPC PDUs when authentication is used (MS-RPCE 2.2.2.11).

func (*AuthVerifier) MarshalBinary 

func (s *AuthVerifier) MarshalBinary() (ret []byte, err error)

func (*AuthVerifier) UnmarshalBinary 

func (s *AuthVerifier) UnmarshalBinary(buf []byte) (err error)

type BindNakError added in v0.8.0 

type BindNakError struct {
	Reason uint16
}

BindNakError is returned when the server rejects a Bind request.

func (*BindNakError) Error added in v0.8.0 

func (e *BindNakError) Error() string

type BindReq 

type BindReq struct {
	Header          // 16 Bytes
	MaxSendFragSize uint16
	MaxRecvFragSize uint16
	Association     uint32        // A value of 0 means a request for a new Association group
	ContextList     ContextList   // p_cont_list_t
	AuthVerifier    *AuthVerifier // Optional, present when AuthLength != 0
}

C706 Section 12.6.4.3

func (*BindReq) MarshalBinary 

func (s *BindReq) MarshalBinary() (ret []byte, err error)

func (*BindReq) UnmarshalBinary 

func (s *BindReq) UnmarshalBinary(buf []byte) (err error)

type BindRes 

type BindRes struct {
	Header          // 16 Bytes
	MaxSendFragSize uint16
	MaxRecvFragSize uint16
	Association     uint32
	SecAddrLen      uint16
	SecAddr         []byte
	ResultList      ContextResList
	AuthVerifier    *AuthVerifier // Parsed when Header.AuthLength > 0
}

C706 Section 12.6.4.4 (bind_ack)

func (*BindRes) MarshalBinary 

func (s *BindRes) MarshalBinary() (ret []byte, err error)

func (*BindRes) UnmarshalBinary 

func (s *BindRes) UnmarshalBinary(buf []byte) (err error)

type ContextItem 

type ContextItem struct {
	Id             uint16
	Count          byte // Used only for unmarshal; marshal computes from len(TransferSyntax)
	Reserved       byte // Alignment
	AbstractSyntax SyntaxId
	TransferSyntax []SyntaxId
}

C706 Section 12.6.3.1 

typedef struct {
  p_context_id_t p_cont_id;
  u_int8 n_transfer_syn;               // number of items
  u_int8 reserved;                     // alignment pad, m.b.z.
  p_syntax_id_t abstract_syntax;       // transfer syntax list
  p_syntax_id_t [size_is(n_transfer_syn)] transfer_syntaxes[];
} p_cont_elem_t;

func (*ContextItem) MarshalBinary 

func (s *ContextItem) MarshalBinary() (ret []byte, err error)

func (*ContextItem) UnmarshalBinary 

func (s *ContextItem) UnmarshalBinary(buf []byte) (err error)

type ContextList 

type ContextList struct {
	Count     byte
	Reserved  byte   // Alignment
	Reserved2 uint16 // Alignment
	Items     []ContextItem
}

C706 Section 12.6.3.1 

typedef struct {
  u_int8 n_context_elem;               // number of items
  u_int8 reserved;                     // alignment pad, m.b.z.
  u_short reserved2;                   // alignment pad, m.b.z.
  p_cont_elem_t [size_is(n_cont_elem)] p_cont_elem[];
} p_cont_list_t;

func (*ContextList) MarshalBinary 

func (s *ContextList) MarshalBinary() (ret []byte, err error)

func (*ContextList) UnmarshalBinary 

func (s *ContextList) UnmarshalBinary(buf []byte) (err error)

type ContextResItem 

type ContextResItem struct {
	Result         resultType
	Reason         providerReason
	TransferSyntax SyntaxId
}

C706 12.6.3.1 

typedef struct {
  p_cont_def_result_t result;
  p_provider_reason_t reason; // only relevant if result != acceptance
  p_syntax_id_t transfer_syntax; // tr syntax selected 0 if result not accepted
} p_result_t;

type ContextResList 

type ContextResList struct {
	Results   byte   // Count of ContextResItem list
	Reserved  byte   // Alignment
	Reserved2 uint16 // Alignment
	Items     []ContextResItem
}

C706 12.6.3.1 

typedef struct {
  u_int8 n_results;        // count
  u_int8 reserved;         // alignment pad, m.b.z.
  u_int16 reserved2;       // alignment pad, m.b.z.
  p_result_t [size_is(n_results)] p_results[];
} p_result_list_t;

func (*ContextResList) UnmarshalBinary 

func (s *ContextResList) UnmarshalBinary(buf []byte) (err error)

type DCEAPRepProcessor 

type DCEAPRepProcessor interface {
	DCEProcessAPRep(rawAPRep []byte) error
}

DCEAPRepProcessor is implemented by mechanisms that can process a bare AP_REP (not KRB5Token-wrapped) from a DCE-style SPNEGO response. When GSS_C_DCE_STYLE is set, the server sends the AP_REP directly in the NegTokenResp's ResponseToken field, without KRB5Token wrapping.

type DCERPCTransport 

type DCERPCTransport interface {
	// Transceive sends a complete DCERPC PDU and returns the first response PDU.
	// For SMB: maps to FsctlPipeTransceive (atomic send+receive).
	// For TCP: writes PDU then reads response.
	Transceive(pdu []byte) ([]byte, error)

	// Write sends a DCERPC PDU without waiting for a response.
	// Used for send-side fragmentation (non-last fragments) and Auth3.
	// For SMB: maps to WriteFile on the named pipe.
	// For TCP: writes PDU to socket.
	Write(pdu []byte) error

	// Read reads the next DCERPC PDU fragment from the transport.
	// Used for continuation fragments after the first Transceive response.
	// maxSize is a buffer sizing hint: SMBTransport uses it to size the read
	// buffer, while TCPTransport ignores it (TCP is self-framing via FragLength).
	// For SMB: maps to ReadFile on the named pipe.
	// For TCP: reads a complete PDU (header + body based on FragLength).
	Read(maxSize uint16) ([]byte, error)

	// GetSessionKey returns the session key for upper-layer encryption
	// (e.g., MS-LSAD DES secret encryption, MS-SAMR RC4 password encryption).
	GetSessionKey() []byte
}

DCERPCTransport abstracts the underlying transport for DCERPC PDUs.

type DCEStyleInitiator 

type DCEStyleInitiator interface {
	EnableDCEStyle()
}

DCEStyleInitiator is implemented by Kerberos mechanisms that support DCE-style SPNEGO (GSS_C_DCE_STYLE flag in AP_REQ authenticator checksum). BindAuth calls EnableDCEStyle() before InitSecContext(nil) so that only the DCERPC TCP path sets the flag; SMB transport does not.

type DCEThirdLegProvider 

type DCEThirdLegProvider interface {
	DCEThirdLeg() ([]byte, error)
}

DCEThirdLegProvider is implemented by mechanisms that generate a 3rd leg token for DCERPC SPNEGO authentication (e.g., Kerberos sends a modified AP_REP in the AlterContext).

type FaultError added in v0.11.0 

type FaultError struct {
	Code uint32 // raw fault status as received
	Err  error  // mapped sentinel, or nil when unmapped
}

FaultError represents a DCERPC Fault PDU received in response to a request. Code always preserves the raw fault status, also when no sentinel mapping exists. Err holds the mapped sentinel from faultStatusMap (nil when unmapped) and is exposed via Unwrap so callers can match with errors.Is: 

errors.Is(err, dcerpc.ErrAccessDenied)

func (*FaultError) Error added in v0.11.0 

func (e *FaultError) Error() string

func (*FaultError) Unwrap added in v0.11.0 

func (e *FaultError) Unwrap() error
type Header struct {
	MajorVersion   byte // rpc_vers
	MinorVersion   byte // rpc_vers_minor
	Type           byte
	Flags          byte
	Representation uint32 // NDR data representation
	FragLength     uint16
	AuthLength     uint16
	CallId         uint32
}

Defined in C706 (DCE 1.1: Remote Procedure Call) section 12.6.3.1 as "common fields"

func (*Header) MarshalBinary 

func (s *Header) MarshalBinary() (ret []byte, err error)

func (*Header) UnmarshalBinary 

func (s *Header) UnmarshalBinary(buf []byte) (err error)

type RequestReq 

type RequestReq struct {
	Header // 16 bytes
	// AllocHint is an optional field useful for hinting required space when
	// sending fragmented requests
	AllocHint uint32
	ContextId uint16 // Data representation
	Opnum     uint16
	// Optional field object uuid_t (16 bytes)
	// Only present if PfcObjectUUID is set in the header flags
	ObjectUUID []byte
	Buffer     []byte
}

C706 Section 12.6.4.9

func (*RequestReq) MarshalBinary 

func (s *RequestReq) MarshalBinary() (ret []byte, err error)

func (*RequestReq) UnmarshalBinary 

func (s *RequestReq) UnmarshalBinary(buf []byte) (err error)

type RequestRes 

type RequestRes struct {
	Header // 16 bytes
	// This optional field AllocHint is used to hint about how much
	// contiguous space to allocate for fragmented requests.
	AllocHint   uint32
	ContextId   uint16
	CancelCount byte
	Reserved    byte
	Buffer      []byte
}

C706 Section 12.6.4.10

func (*RequestRes) MarshalBinary 

func (s *RequestRes) MarshalBinary() (ret []byte, err error)

func (*RequestRes) UnmarshalBinary 

func (s *RequestRes) UnmarshalBinary(buf []byte) (err error)

type Sealer 

type Sealer interface {
	// Seal encrypts toEncrypt (stub + auth_pad) and returns ciphertext
	// and signature (auth_value bytes). toSign is the full PDU for NTLM
	// MAC; Kerberos ignores it. The returned ciphertext may be larger
	// than toEncrypt by EncryptionOverhead() bytes.
	// Used for PktPrivacy.
	Seal(toEncrypt, toSign []byte) (ciphertext, signature []byte, err error)
	// Unseal decrypts ciphertext and verifies integrity.
	// signature is the auth_value bytes. pduHeader and secTrailer are
	// provided for NTLM (which MACs the full PDU); Kerberos ignores them.
	// Used for PktPrivacy.
	Unseal(ciphertext, signature, pduHeader, secTrailer []byte) (plaintext []byte, err error)
	// Sign computes a signature over the data without encrypting.
	// data is the stub + auth_pad (same as toEncrypt in Seal).
	// toSign is the full PDU (header + data + sec_trailer) for NTLM MAC;
	// Kerberos ignores toSign and computes a MIC over data instead.
	// Used for PktIntegrity.
	Sign(data, toSign []byte) ([]byte, error)
	// VerifySign verifies the signature without decrypting.
	// data is the plaintext stub + auth_pad.
	// pduHeader and secTrailer are provided for NTLM MAC reconstruction.
	// Used for PktIntegrity.
	VerifySign(data, signature, pduHeader, secTrailer []byte) error
	// SignatureSize returns the maximum auth_value size for PktPrivacy
	// (NTLM=16, Kerberos=16+16+RRC+maxPad).
	SignatureSize() int
	// MICSignatureSize returns the auth_value size for PktIntegrity.
	// For NTLM this equals SignatureSize (16). For Kerberos this is
	// the MIC token size (smaller than the Wrap token).
	MICSignatureSize() int
	// EncryptionOverhead returns extra ciphertext bytes beyond plaintext
	// size (0 for both NTLM and Kerberos).
	EncryptionOverhead() int
}

Sealer provides per-PDU encryption/decryption for auth levels PktIntegrity and PktPrivacy. The mechanism (e.g., NTLMInitiator, KRB5Initiator) implements this interface to seal outgoing and unseal incoming stubs.

For NTLM, the MAC covers the full PDU (header + plaintext stub + auth_pad + sec_trailer) while only the stub + auth_pad is encrypted. For Kerberos, integrity is built into the encryption (HMAC inside the encrypted blob), so the toSign / pduHeader+secTrailer parameters are ignored.

type ServiceBind 

type ServiceBind struct {
	// contains filtered or unexported fields
}

func Bind 

func Bind(transport DCERPCTransport, interfaceUUID string, majorVersion, minorVersion uint16, transferUUID string) (bind *ServiceBind, err error)

func BindAuth 

func BindAuth(transport DCERPCTransport, interfaceUUID string, majorVersion, minorVersion uint16, transferUUID string, authLevel uint8, mechanism gss.Mechanism) (bind *ServiceBind, err error)

BindAuth performs an authenticated DCERPC bind using the provided GSS mechanism. For NTLM (3-leg), it uses Alter Context for the third leg so that the server's response confirms authentication success. For Kerberos, it wraps tokens in SPNEGO and uses Alter Context for the third leg to finalize the security context.

func (*ServiceBind) AlterContext added in v0.8.0 

func (sb *ServiceBind) AlterContext(interfaceUUID string, majorVersion, minorVersion uint16, transferUUID string) (*ServiceBind, error)

AlterContext adds a new presentation context for a different interface on the same connection. Returns a new ServiceBind that shares the underlying transport and auth state but uses the new context ID for requests.

func (*ServiceBind) GetSessionKey 

func (sb *ServiceBind) GetSessionKey() (sessionKey []byte)

func (*ServiceBind) MakeRequest 

func (sb *ServiceBind) MakeRequest(opcode uint16, innerBuf []byte) (result []byte, err error)

func (*ServiceBind) MakeRequestWithObjectUUID added in v0.8.0 

func (sb *ServiceBind) MakeRequestWithObjectUUID(opcode uint16, objectUUID []byte, innerBuf []byte) (result []byte, err error)

type SessionKeySettable 

type SessionKeySettable interface {
	SetSessionKey(key []byte)
}

SessionKeySettable is implemented by transports that support setting a session key after an authenticated bind (e.g., TCPTransport).

type StatusError added in v0.11.0 

type StatusError struct {
	Op   string // RPC operation, e.g. "SamrConnect5"
	Code uint32 // raw return code as received
	Err  error  // mapped sentinel, or nil when unmapped
}

StatusError represents a non-zero return code from a DCERPC operation. Code always preserves the raw value, also when no sentinel mapping exists. Err holds the mapped sentinel from the service package's response-code map (nil when unmapped) and is exposed via Unwrap so callers can match with errors.Is, e.g.: 

errors.Is(err, mssamr.ResponseCodeMap[mssamr.StatusNoSuchGroup])

func (*StatusError) Error added in v0.11.0 

func (e *StatusError) Error() string

func (*StatusError) Unwrap added in v0.11.0 

func (e *StatusError) Unwrap() error

type SyntaxId 

type SyntaxId struct {
	UUID []byte // 16 bytes
	// Major version is encoded in the 16 least significant bits
	// Minor version is encoded in the 16 most significant bits
	Version uint32
}

type TCPTransport 

type TCPTransport struct {
	// contains filtered or unexported fields
}

TCPTransport implements DCERPCTransport over a raw TCP connection. DCERPC over TCP is self-framing via the FragLength field in the PDU header.

func NewTCPTransport 

func NewTCPTransport(conn net.Conn) *TCPTransport

func (*TCPTransport) Close 

func (t *TCPTransport) Close() error

func (*TCPTransport) GetSessionKey 

func (t *TCPTransport) GetSessionKey() []byte

func (*TCPTransport) Read 

func (t *TCPTransport) Read(maxSize uint16) ([]byte, error)

func (*TCPTransport) SetSessionKey 

func (t *TCPTransport) SetSessionKey(key []byte)

func (*TCPTransport) Transceive 

func (t *TCPTransport) Transceive(pdu []byte) ([]byte, error)

func (*TCPTransport) Write 

func (t *TCPTransport) Write(pdu []byte) error

Source Files

View all Source files

Directories

Path Synopsis
Package msdrsr implements the MS-DRSR Directory Replication Service Remote Protocol, enabling DCSync capabilities for replicating Active Directory credentials from domain controllers.
 Package msdrsr implements the MS-DRSR Directory Replication Service Remote Protocol, enabling DCSync capabilities for replicating Active Directory credentials from domain controllers.
Package mseven implements a minimal client for the MS-EVEN (EventLog Remoting Protocol) supporting ElfrOpenBELW and ElfrCloseEL.
 Package mseven implements a minimal client for the MS-EVEN (EventLog Remoting Protocol) supporting ElfrOpenBELW and ElfrCloseEL.
Package msicpr implements the client side of the three protocols an Active Directory Certificate Services CA exposes for enrollment and administration.
 Package msicpr implements the client side of the three protocols an Active Directory Certificate Services CA exposes for enrollment and administration.
Package msrprn implements a minimal client for the MS-RPRN (Print System Remote Protocol) supporting RpcOpenPrinterEx, RpcClosePrinter, RpcRemoteFindFirstPrinterChangeNotification, and RpcRemoteFindFirstPrinterChangeNotificationEx.
 Package msrprn implements a minimal client for the MS-RPRN (Print System Remote Protocol) supporting RpcOpenPrinterEx, RpcClosePrinter, RpcRemoteFindFirstPrinterChangeNotification, and RpcRemoteFindFirstPrinterChangeNotificationEx.
MIT License
 MIT License
server
Package server provides a configurable server-side handler for the Server Service (srvsvc) RPC interface (MS-SRVS).
 Package server provides a configurable server-side handler for the Server Service (srvsvc) RPC interface (MS-SRVS).
MIT License
 MIT License
Package server provides a minimal server-side DCERPC dispatcher.
 Package server provides a minimal server-side DCERPC dispatcher.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.