o j @sddlmZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z mZddlmZmZdd lmZmZmZmZGd d d Zed kreejejd ddZejddddejddddejddddedZejdddddejdgdd d!d"d#d$ed%Zejd&dd'd(de ej!d)kre"e#d)e$Z%e &e%j'e%j(e e%j)\Z*Z+Z,Z-e*durd*Z*e,d*kre+d*kre%j.durdd+l/m/Z/e/d,Z,e%j0dure-e%_0ee+e,e*e%j.e1e%j2Z3e34e-e%j0dSdS)-)division)print_functionN) AUTH_NTLM)logger) parse_target)uuidversion) transportepm)RPC_PROXY_INVALID_RPC_PORT_ERRRPC_PROXY_CONN_A1_0X6BA_ERRRPC_PROXY_CONN_A1_404_ERRRPC_PROXY_RPC_OUT_DATA_404_ERRc@sJeZdZddiddiddiddiddidZdd d Zd d ZddZdS)RPCDumpbindstrzncacn_ip_tcp:%s[135]zncacn_np:%s[\pipe\epmapper]z ncacn_http:[593,RpcProxy=%s:443]z ncacn_http:%s)iQNrcCsL||_||_||_d|_d|_||_d|_|dur$|d\|_|_dSdS)Nr:)_RPCDump__username_RPCDump__password_RPCDump__domain_RPCDump__lmhash_RPCDump__nthash_RPCDump__port_RPCDump__stringbindingsplit)selfusernamepassworddomainhashesportr%/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/rpcdump.py__init__/szRPCDump.__init__c Cstd|g}|j|jd||_td|jt|j}|jdvrA||j |j |j |j |j ||||jn|jdvrZ||j |j |j |j |j |tn z||}Wn7ty}z+d|}t|t|vst|vst|vst|vrtdWYd}~dSWYd}~nd}~wwi}|D]}t|d d } t|d d d } | |vd uri|| <t|| d <tt| ddtj vrtj tt| dd|| d<nd|| d<|ddd!d|| d<|| d "| | ddtjvrtj| dd|| d<qd|| d<qt|#D];} t$d|| dt$d|| dt$d| || dft$d|| d D] } t$d| qVt$dq*|rt%|} d| krytddStd| dStddS) zDumps the list of endpoints registered with the mapper listening at addr. remoteName is a valid host name or IP address in string format. z Retrieving endpoint list from %srzStringBinding %s)rr)rzProtocol failed: %szWThis usually means the target does not allow to connect to its epmapper using RpcProxy.NtowerFloorsrTBindingsEXEzN/A annotationzutf-8$Protocolz Protocol: %s z Provider: %s zUUID : %s %sz Bindings: z %srzReceived one endpoint.zReceived %d endpoints.zNo endpoints found.)&logginginfoKNOWN_PROTOCOLSrrdebugr DCERPCTransportFactoryset_credentialsrrrrr setRemoteHost set_dport set_auth_typer_RPCDump__fetchList Exceptioncriticalr rr r r PrintStringBindingstrlistruuidtup_to_binstring_to_uuidtup KNOWN_UUIDSdecodeappendkeysprintlen) r remoteName remoteHostentries rpctransporte error_text endpointsentrybindingtmpUUIDendpointnumr%r%r&dump:sx         (   z RPCDump.dumpcCs*|}|tjd|d}||S)N)dce) get_dce_rpcconnectr hept_lookup disconnect)rrLrVrespr%r%r& __fetchLists zRPCDump.__fetchList)rrrNr)__name__ __module__ __qualname__r4r'rUr;r%r%r%r&r&s  `r__main__Tz7Dumps the remote RPC enpoints information via epmapper.)add_help descriptiontargetstorez6[[domain/]username[:password]@])actionhelpz-debug store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging output connectionz -target-ipz ip addresszIP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it)remetavarrfz-port)135139443445593?rjzdestination portz2Destination port to connect to RPC Endpoint Mapper)choicesnargsdefaultrirfauthenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHr1r)getpassz Password:)5 __future__rrsysr2argparse impacket.httprimpacket.examplesrimpacket.examples.utilsrimpacketrrimpacket.dcerpc.v5r r impacket.dcerpc.v5.rpchr r r rrr]rGBANNERArgumentParserparser add_argumentadd_argument_groupgrouprHargv print_helpexit parse_argsoptionsinittsr5rcr"r r!rIr#rt target_ipintr$dumperrUr%r%r%r&sT