1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
|
#
# policyhandle tracking
# This block is to specify where a policyhandle is opened and where it is
# closed so that policyhandles when dissected contain nice info such as
# [opened in xxx] [closed in yyy]
#
# Policyhandles are opened in these functions
PARAM_VALUE lsarpc_dissect_element_lsa_OpenPolicy_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_POLICY
PARAM_VALUE lsarpc_dissect_element_lsa_OpenPolicy2_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_POLICY
PARAM_VALUE lsarpc_dissect_element_lsa_CreateAccount_acct_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_ACCOUNT
PARAM_VALUE lsarpc_dissect_element_lsa_OpenAccount_acct_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_ACCOUNT
PARAM_VALUE lsarpc_dissect_element_lsa_CreateTrustedDomain_trustdom_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_DOMAIN
PARAM_VALUE lsarpc_dissect_element_lsa_OpenTrustedDomain_trustdom_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_DOMAIN
PARAM_VALUE lsarpc_dissect_element_lsa_OpenTrustedDomainByName_trustdom_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_DOMAIN
PARAM_VALUE lsarpc_dissect_element_lsa_CreateSecret_sec_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_SECRET
PARAM_VALUE lsarpc_dissect_element_lsa_OpenSecret_sec_handle_ PIDL_POLHND_OPEN|PIDL_POLHND_TYPE_LSA_SECRET
# Policyhandles are closed in these functions
PARAM_VALUE lsarpc_dissect_element_lsa_Close_handle_ PIDL_POLHND_CLOSE
PARAM_VALUE lsarpc_dissect_element_lsa_Delete_handle_ PIDL_POLHND_CLOSE
PARAM_VALUE lsarpc_dissect_element_lsa_CloseTrustedDomainEx_handle_ PIDL_POLHND_CLOSE
TYPE hyper "offset=cnf_dissect_hyper(tvb, offset, pinfo, tree, di, drep, @PARAM@, @HF@);" FT_UINT64 BASE_DEC 0 NULL 8
TYPE sec_desc_buf "offset=cnf_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);" FT_NONE BASE_NONE 0 NULL 4
HF_FIELD hf_lsarpc_sec_desc_buf_len "Sec Desc Buf Len" "lsarpc.sec_desc_buf_len" FT_UINT32 BASE_DEC NULL 0 "" "" ""
MANUAL lsarpc_dissect_bitmap_lsa_PolicyAccessMask
MANUAL lsarpc_dissect_bitmap_lsa_AccountAccessMask
MANUAL lsarpc_dissect_bitmap_lsa_SecretAccessMask
MANUAL lsarpc_dissect_bitmap_lsa_DomainAccessMask
HF_FIELD hf_lsarpc_policy_access_mask "Access Mask" "lsarpc.policy.access_mask" FT_UINT32 BASE_HEX NULL 0 "" "" ""
HF_FIELD hf_lsarpc_account_access_mask "Access Mask" "lsarpc.policy.access_mask" FT_UINT32 BASE_HEX NULL 0 "" "" ""
HF_FIELD hf_lsarpc_secret_access_mask "Access Mask" "lsarpc.policy.access_mask" FT_UINT32 BASE_HEX NULL 0 "" "" ""
HF_FIELD hf_lsarpc_domain_access_mask "Access Mask" "lsarpc.policy.access_mask" FT_UINT32 BASE_HEX NULL 0 "" "" ""
HF_FIELD hf_lsarpc_String_name "String" "lsarpc.lsa.string" FT_STRING BASE_NONE NULL 0 "" "" ""
MANUAL lsarpc_dissect_element_lsa_LookupNames_names
MANUAL lsarpc_dissect_element_lsa_LookupNames2_names
MANUAL lsarpc_dissect_element_lsa_LookupNames3_names
MANUAL lsarpc_dissect_element_lsa_LookupNames4_names
MANUAL lsarpc_dissect_element_lsa_String_string_
MANUAL lsarpc_dissect_element_lsa_StringLarge_string_
NOEMIT lsarpc_dissect_element_lsa_String_string__
NOEMIT lsarpc_dissect_element_lsa_StringLarge_string__
NOEMIT lsarpc_dissect_element_lsa_DomainInfoEfs_efs_blob__
NOEMIT lsarpc_dissect_element_lsa_LookupNames_names_
NOEMIT lsarpc_dissect_element_lsa_LookupNames2_names_
NOEMIT lsarpc_dissect_element_lsa_LookupNames4_names_
ETT_FIELD ett_lsarpc_names
HF_FIELD hf_lsarpc_names "Names" "lsarpc.lookup.names" FT_NONE BASE_NONE NULL 0 "" "" ""
MANUAL lsarpc_dissect_element_lsa_DomainInfoEfs_efs_blob_
HF_FIELD hf_lsarpc_efs_blob_len "EFS blob size" "lsarpc.efs.blob_size" FT_UINT32 BASE_DEC NULL 0 "" "" ""
CODE START
static void
lsarpc_policy_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree, guint32 access)
{
static const int* access_flags[] = {
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION,
&hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION,
NULL
};
proto_tree_add_bitmask_list_value(tree, tvb, offset, 4, access_flags, access);
}
static void
lsarpc_account_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree, guint32 access)
{
static const int* access_flags[] = {
&hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS,
&hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS,
&hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES,
&hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW,
NULL
};
proto_tree_add_bitmask_list_value(tree, tvb, offset, 4, access_flags, access);
}
static void
lsarpc_secret_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree, guint32 access)
{
static const int* access_flags[] = {
&hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE,
&hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE,
NULL
};
proto_tree_add_bitmask_list_value(tree, tvb, offset, 4, access_flags, access);
}
static void
lsarpc_domain_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree, guint32 access)
{
static const int* access_flags[] = {
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH,
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH,
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX,
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX,
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS,
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS,
&hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME,
NULL
};
proto_tree_add_bitmask_list_value(tree, tvb, offset, 4, access_flags, access);
}
struct access_mask_info lsarpc_policy_access_mask_info = {
"LSA Policy", /* Name of specific rights */
lsarpc_policy_specific_rights, /* Dissection function */
NULL, /* Generic mapping table */
NULL /* Standard mapping table */
};
struct access_mask_info lsarpc_account_access_mask_info = {
"LSA Account", /* Name of specific rights */
lsarpc_account_specific_rights, /* Dissection function */
NULL, /* Generic mapping table */
NULL /* Standard mapping table */
};
struct access_mask_info lsarpc_secret_access_mask_info = {
"LSA Secret", /* Name of specific rights */
lsarpc_secret_specific_rights, /* Dissection function */
NULL, /* Generic mapping table */
NULL /* Standard mapping table */
};
struct access_mask_info lsarpc_domain_access_mask_info = {
"LSA Domain", /* Name of specific rights */
lsarpc_domain_specific_rights, /* Dissection function */
NULL, /* Generic mapping table */
NULL /* Standard mapping table */
};
int
lsarpc_dissect_bitmap_lsa_PolicyAccessMask(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int hf_index _U_, guint32 param _U_)
{
offset = dissect_nt_access_mask(
tvb, offset, pinfo, tree, di, drep, hf_lsarpc_policy_access_mask,
&lsarpc_policy_access_mask_info, NULL);
return offset;
}
int
lsarpc_dissect_bitmap_lsa_AccountAccessMask(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int hf_index _U_, guint32 param _U_)
{
offset = dissect_nt_access_mask(
tvb, offset, pinfo, tree, di, drep, hf_lsarpc_account_access_mask,
&lsarpc_account_access_mask_info, NULL);
return offset;
}
int
lsarpc_dissect_bitmap_lsa_SecretAccessMask(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int hf_index _U_, guint32 param _U_)
{
offset = dissect_nt_access_mask(
tvb, offset, pinfo, tree, di, drep, hf_lsarpc_secret_access_mask,
&lsarpc_secret_access_mask_info, NULL);
return offset;
}
int
lsarpc_dissect_bitmap_lsa_DomainAccessMask(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int hf_index _U_, guint32 param _U_)
{
offset = dissect_nt_access_mask(
tvb, offset, pinfo, tree, di, drep, hf_lsarpc_domain_access_mask,
&lsarpc_domain_access_mask_info, NULL);
return offset;
}
static int
cnf_dissect_sec_desc_buf_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
guint32 len;
e_ctx_hnd *polhnd = NULL;
dcerpc_call_value *dcv = NULL;
guint32 type=0;
struct access_mask_info *ami=NULL;
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
return offset;
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
hf_lsarpc_sec_desc_buf_len, &len);
dcv = (dcerpc_call_value *)di->call_data;
if(dcv){
polhnd = dcv->pol;
}
if(polhnd){
dcerpc_fetch_polhnd_data(polhnd, NULL, &type, NULL, NULL,
pinfo->num);
}
switch(type){
case PIDL_POLHND_TYPE_LSA_POLICY:
ami=&lsarpc_policy_access_mask_info;
break;
case PIDL_POLHND_TYPE_LSA_ACCOUNT:
ami=&lsarpc_account_access_mask_info;
break;
case PIDL_POLHND_TYPE_LSA_SECRET:
ami=&lsarpc_secret_access_mask_info;
break;
case PIDL_POLHND_TYPE_LSA_DOMAIN:
ami=&lsarpc_domain_access_mask_info;
break;
}
dissect_nt_sec_desc(tvb, offset, pinfo, tree, drep, TRUE, len, ami);
offset += len;
return offset;
}
static int
cnf_dissect_sec_desc_buf(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
guint32 len;
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
return offset;
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
hf_lsarpc_sec_desc_buf_len, &len);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep,
cnf_dissect_sec_desc_buf_, NDR_POINTER_UNIQUE,
"LSA SECURITY DESCRIPTOR data:", -1);
return offset;
}
int
lsarpc_dissect_sec_desc_buf(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep){
return cnf_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);
}
static int
lsarpc_dissect_struct_security_descriptor(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_, int unused1 _U_, int unused2 _U_){
return cnf_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);
}
int
lsarpc_dissect_struct_dom_sid2(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_, int unused1 _U_, int unused2 _U_) {
/* sid */
return dissect_ndr_nt_SID(tvb, offset, pinfo, tree, di, drep);
}
static int
cnf_dissect_hyper(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, guint32 param _U_, int hfindex)
{
offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, di, drep, hfindex, NULL);
return offset;
}
# PIDL cant handle top level arrays so we must explicitely go through a
# ref pointer here
static int
lsarpc_dissect_element_lsa_LookupNames3_names_X(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
proto_item *item = NULL;
proto_tree *tree = NULL;
int old_offset = offset;
if (parent_tree) {
item = proto_tree_add_item(parent_tree, hf_lsarpc_names, tvb, offset, -1, ENC_NA);
tree = proto_item_add_subtree(item, ett_lsarpc_names);
}
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, lsarpc_dissect_element_lsa_LookupNames3_names_);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
lsarpc_dissect_element_lsa_LookupNames_names(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, lsarpc_dissect_element_lsa_LookupNames3_names_X, NDR_POINTER_REF, "Pointer to Names", hf_lsarpc_names);
return offset;
}
static int
lsarpc_dissect_element_lsa_LookupNames2_names(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, lsarpc_dissect_element_lsa_LookupNames3_names_X, NDR_POINTER_REF, "Pointer to Names", hf_lsarpc_names);
return offset;
}
static int
lsarpc_dissect_element_lsa_LookupNames3_names(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, lsarpc_dissect_element_lsa_LookupNames3_names_X, NDR_POINTER_REF, "Pointer to Names", hf_lsarpc_names);
return offset;
}
static int
lsarpc_dissect_element_lsa_LookupNames4_names(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, lsarpc_dissect_element_lsa_LookupNames3_names_X, NDR_POINTER_REF, "Pointer to Names", hf_lsarpc_names);
return offset;
}
static int
lsarpc_dissect_element_lsa_String_string_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
char *data;
offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_lsarpc_String_name, FALSE, &data);
proto_item_append_text(tree, ": %s", data);
return offset;
}
static int
lsarpc_dissect_element_lsa_StringLarge_string_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
char *data;
offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_lsarpc_String_name, FALSE, &data);
proto_item_append_text(tree, ": %s", data);
return offset;
}
static int
lsarpc_dissect_element_lsa_DomainInfoEfs_efs_blob_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di, guint8 *drep _U_)
{
tvbuff_t *next_tvb;
gint len, reported_len;
dissector_handle_t efsblob_handle;
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
return offset;
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
hf_lsarpc_efs_blob_len, &reported_len);
len = reported_len;
if (len > tvb_captured_length_remaining(tvb, offset)) {
len = tvb_captured_length_remaining(tvb, offset);
}
next_tvb = tvb_new_subset_length_caplen(tvb, offset, len, reported_len);
efsblob_handle = find_dissector("efsblob");
if (efsblob_handle) {
call_dissector(efsblob_handle, next_tvb, pinfo, tree);
}
offset += reported_len;
return offset;
}
CODE END
HEADER START
extern int
lsarpc_dissect_sec_desc_buf(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep);
extern int
lsarpc_dissect_struct_dom_sid2(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int unused1, int unused2);
HEADER END
|
