1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
# Conformance file for svcctl
HF_FIELD hf_svcctl_service_buffer_size "Buffer Size" "svcctl.services.buffer_size" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
HF_FIELD hf_svcctl_service_referent_id "Referent ID(offset)" "svcctl.ENUM_SERVICE_STATUSW.referent_id" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
MANUAL svcctl_dissect_EnumServicesStatusW_response
ETT_FIELD ett_svcctl_service
ETT_FIELD ett_svcctl_service_name
ETT_FIELD ett_svcctl_display_name
NOEMIT svcctl_dissect_element_EnumServicesStatusW_services
NOEMIT svcctl_dissect_element_EnumServicesStatusW_bytes_needed
NOEMIT svcctl_dissect_element_EnumServicesStatusW_services_returned
CODE START
/* ENUM_SERVICE_STATUSW Caveats
https://github.com/fortra/impacket/blob/4888172ce638910104da4bda2c3301c24e17564c/impacket/dcerpc/v5/scmr.py#L1274
*/
static int
svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, guint8 *drep, int hf_index, gint starting_offset);
static int
svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, guint8 *drep, int hf_index, gint starting_offset)
{
proto_item *item = NULL;
proto_tree *tree = NULL;
proto_tree *tr = NULL;
int old_offset;
guint32 _referent_id = 0;
ALIGN_TO_5_BYTES;
old_offset = offset;
if (parent_tree) {
item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
tree = proto_item_add_subtree(item, ett_svcctl_ENUM_SERVICE_STATUSW);
}
// Service Name
tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_service_name, NULL, "Pointer to Service Name");
offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_service_name , 0);
// Display Name
tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_display_name, NULL, "Pointer to Display Name");
offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_display_name , 0);
// Status
offset = svcctl_dissect_element_ENUM_SERVICE_STATUSW_status(tvb, offset, pinfo, tree, di, drep);
proto_item_set_len(item, offset-old_offset);
if (di->call_data->flags & DCERPC_IS_NDR64) {
ALIGN_TO_5_BYTES;
}
return offset;
}
/* REnumServicesStatusW
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/22b4ff3d-29c6-481f-b598-8ce66a46944a
*/
static int
svcctl_dissect_EnumServicesStatusW_response(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
guint32 status;
guint32 services_returned= 0;
proto_item *item;
proto_tree *tr = NULL;
gint services_buffer_offset;
gint payload_starting_offset = offset;
guint64 buffer_size = 0;
ALIGN_TO_5_BYTES
di->dcerpc_procedure_name="EnumServicesStatusW";
tr = proto_tree_add_subtree(tree, tvb, offset, 0, ett_svcctl_service, &item, "Pointer to Services Status");
// Services Buffer Size
offset = dissect_ndr_uint3264(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_buffer_size, &buffer_size);
services_buffer_offset = offset;
offset += (int)buffer_size;
proto_item_set_len(item, offset-payload_starting_offset);
ALIGN_TO_4_BYTES
// Bytes Needed
offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_svcctl_EnumServicesStatusW_bytes_needed, 0);
// Services Returned
offset = PIDL_dissect_uint32_val( tvb, offset, pinfo, tree, di, drep
, hf_svcctl_svcctl_EnumServicesStatusW_services_returned
, 0, &services_returned);
// Services
if (services_returned > 0){
payload_starting_offset = services_buffer_offset;
for(unsigned idx = 0; idx < services_returned ; ++idx){
services_buffer_offset = svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr( tvb, services_buffer_offset
, pinfo, tr, di, drep
, hf_svcctl_svcctl_EnumDependentServicesW_service_status
, payload_starting_offset);
}
dissect_deferred_pointers(pinfo, tvb, services_buffer_offset, di, drep);
}
// Resume Index
offset = svcctl_dissect_element_EnumServicesStatusW_resume_index(tvb, offset, pinfo, tree, di, drep);
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
// Return status
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_werror, &status);
if (status != 0)
col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
return offset;
}
CODE END
|
