smb2

import "github.com/TheManticoreProject/Manticore/network/dcerpc/v5/transport/smb2"

Package smb2 implements the DCE/RPC ncacn_np protocol sequence over an SMB 2.x named pipe.

Per [MS-RPCE] 2.1.1.2, PDUs are exchanged as named-pipe writes and reads. This transport uses the SMB2 FSCTL_PIPE_TRANSCEIVE optimization (the explicit MAY in [MS-RPCE]): the last request PDU before a read is written and the reply read in a single round-trip. Earlier fragments of a multi-fragment request are written with ordinary pipe writes, and response fragments beyond the first are read with ordinary pipe reads.

It wraps an already-connected and authenticated SMB 2.x client whose tree is connected to IPC$; that session’s lifecycle is owned by the caller.

Constants

Default fragment sizes proposed at Bind time.

const (
    DefaultMaxXmitFrag uint16 = 4280
    DefaultMaxRecvFrag uint16 = 4280
)

type SMBNamedPipe

SMBNamedPipe is a DCE/RPC transport over an SMB 2.x named pipe (ncacn_np).

type SMBNamedPipe struct {
    // contains filtered or unexported fields
}

func New

func New(c *smb2client.Client, pipeName string) *SMBNamedPipe

New creates an SMB2 named-pipe transport over the supplied client. The client MUST already be connected, authenticated, and tree-connected to IPC$.

pipeName is the pipe endpoint (e.g. “srvsvc” or “\\PIPE\\lsarpc”); a leading backslash and a “PIPE\\” prefix are stripped, as SMB2 names are share-relative.

func (*SMBNamedPipe) Close

func (p *SMBNamedPipe) Close() error

Close closes the pipe handle, leaving the SMB session and tree connect intact. It is idempotent.

func (*SMBNamedPipe) Connect

func (p *SMBNamedPipe) Connect() error

Connect opens the named pipe on the SMB tree. It is idempotent.

func (*SMBNamedPipe) MaxRecvFrag

func (p *SMBNamedPipe) MaxRecvFrag() uint16

MaxRecvFrag returns the proposed maximum receive fragment size.

func (*SMBNamedPipe) MaxXmitFrag

func (p *SMBNamedPipe) MaxXmitFrag() uint16

MaxXmitFrag returns the proposed maximum transmit fragment size.

func (*SMBNamedPipe) Recv

func (p *SMBNamedPipe) Recv() ([]byte, error)

Recv returns the next chunk of the reply. The first Recv after a Send writes the queued PDU and reads the reply in one transceive; subsequent Recv calls read further response fragments with ordinary pipe reads.

func (*SMBNamedPipe) Send

func (p *SMBNamedPipe) Send(pdu []byte) error

Send queues a PDU. The PDU is transmitted on the next Recv via a single transceive; if another Send arrives first (a multi-fragment request), the queued fragment is flushed with an ordinary pipe write.

func (*SMBNamedPipe) SetMaxFrag

func (p *SMBNamedPipe) SetMaxFrag(xmit, recv uint16)

SetMaxFrag overrides the fragment sizes proposed at Bind time. Call before Connect.