smb

import "github.com/TheManticoreProject/Manticore/network/dcerpc/v5/transport/smb"

Package smb implements the DCE/RPC ncacn_np protocol sequence: DCE/RPC directly over an SMB named pipe.

Per [MS-RPCE] section 2.1.1.2 (SMB (NCACN_NP)), “All PDUs sent over SMB MUST be sent as named pipe writes … and PDUs to be received MUST be received as named pipe reads.” This transport therefore implements SendReceive as a pipe write followed by a pipe read, wrapping an already-connected and authenticated SMB v1.0 client whose tree is connected to the IPC$ share. (The single-round-trip TransactNamedPipe optimization for synchronous calls is an explicit MAY in [MS-RPCE] and is not used here.)

Constants

Default fragment sizes proposed at Bind time. 4280 (0x10B8) is the classic Windows default for RPC over named pipes; it is a safe, widely accepted value. Callers that want larger fragments can override via SetMaxFrag before Connect.

const (
    DefaultMaxXmitFrag uint16 = 4280
    DefaultMaxRecvFrag uint16 = 4280
)

type SMBNamedPipe

SMBNamedPipe is a DCE/RPC transport over an SMB named pipe (ncacn_np).

type SMBNamedPipe struct {
    // contains filtered or unexported fields
}

func New

func New(c *client.Client, pipeName string) *SMBNamedPipe

New creates a named-pipe transport over the supplied SMB client. The client MUST already be connected, have an authenticated session (SessionSetup), and have a tree connected to the IPC$ share (TreeConnect) before Connect is called.

pipeName is the pipe endpoint, for example `\PIPE\lsarpc` or `\PIPE\epmapper`. A leading backslash is added if absent; pipe names are case-insensitive on Windows.

func (*SMBNamedPipe) Close

func (p *SMBNamedPipe) Close() error

Close closes the pipe handle. The underlying SMB session and tree connect are left untouched; their lifecycle belongs to the caller that supplied the SMB client. Close is idempotent.

func (*SMBNamedPipe) Connect

func (p *SMBNamedPipe) Connect() error

Connect opens the named pipe on the SMB tree. It is idempotent.

func (*SMBNamedPipe) MaxRecvFrag

func (p *SMBNamedPipe) MaxRecvFrag() uint16

MaxRecvFrag returns the proposed maximum receive fragment size.

func (*SMBNamedPipe) MaxXmitFrag

func (p *SMBNamedPipe) MaxXmitFrag() uint16

MaxXmitFrag returns the proposed maximum transmit fragment size.

func (*SMBNamedPipe) Recv

func (p *SMBNamedPipe) Recv() ([]byte, error)

Recv reads up to MaxRecvFrag bytes from the pipe. The pipe offset is meaningless, so a zero offset is used.

func (*SMBNamedPipe) Send

func (p *SMBNamedPipe) Send(pdu []byte) error

Send writes a complete PDU to the pipe. The pipe offset is meaningless, so a zero offset is used.

func (*SMBNamedPipe) SetMaxFrag

func (p *SMBNamedPipe) SetMaxFrag(xmit, recv uint16)

SetMaxFrag overrides the transmit and receive fragment sizes proposed at Bind time. It must be called before Connect to take effect.