// Token: 0x06000013 RID: 19 RVA: 0x00002448 File Offset: 0x00000648
protected override void OnCustomCommandInternal(int command)
{
switch (command)
{
case 201:
this.components.ConfigUpdate();
return;
case 202:
case 204:
break;
case 203:
Components.Configuration.ClearCaches();
return;
case 205:
Kerberos.FlushTicketCache();
return;
case 206:
Components.SmtpInComponent.FlushProtocolLog();
Components.SmtpOutConnectionHandler.FlushProtocolLog();
ConnectionLog.FlushBuffer();
MessageTrackingLog.FlushBuffer();
break;
default:
return;
}
}
// Token: 0x06000010 RID: 16 RVA: 0x00002914 File Offset: 0x00000B14
protected override void OnClearKerberosTicketCache()
{
try
{
ExTraceGlobals.ServiceTracer.TraceDebug(0L, "TransportService OnClearKerberosTicketCache");
Kerberos.FlushTicketCache();
}
catch (Win32Exception arg)
{
ExTraceGlobals.ServiceTracer.TraceError <Win32Exception>(0L, "TransportService failed to flush Kerberos ticket cache because {0}", arg);
}
}
private static void PrintKerberosTGTTickets()
{
try
{
Beaprint.MainPrint("Looking for Kerberos TGT tickets");
var kerberosTgts = Kerberos.GetKerberosTGTData();
Beaprint.DictPrint(kerberosTgts, false);
}
catch (Exception ex)
{
Beaprint.PrintException(ex.Message);
}
}
private static void PrintKerberosTickets()
{
try
{
Beaprint.MainPrint("Looking for Kerberos tickets");
Beaprint.LinkPrint("https://book.hacktricks.xyz/pentesting/pentesting-kerberos-88");
var kerberosTickets = Kerberos.ListKerberosTickets();
Beaprint.DictPrint(kerberosTickets, false);
}
catch (Exception ex)
{
Beaprint.PrintException(ex.Message);
}
}
// Token: 0x06000007 RID: 7 RVA: 0x00002504 File Offset: 0x00000704
protected override bool Initialize()
{
try
{
MonitoringService.LogDiagnosticInfo("Flushing Kerberos ticket cache.", new object[0]);
Kerberos.FlushTicketCache();
}
catch (Win32Exception ex)
{
MonitoringService.LogDiagnosticInfo("Caught Win32Exception: {0}", new object[]
{
ex.ToString()
});
if (ex.ErrorCode == -2146232828)
{
return(false);
}
throw;
}
return(base.Initialize());
}
// Token: 0x06000006 RID: 6 RVA: 0x0000244C File Offset: 0x0000064C
protected override bool Initialize()
{
try
{
Kerberos.FlushTicketCache();
}
catch (Win32Exception ex)
{
if (ex.ErrorCode == -2146232828)
{
return(false);
}
string text = string.Format("{0}{1}NativeErrorCode = {2}", ex.ToString(), Environment.NewLine, ex.NativeErrorCode);
ExTraceGlobals.ServiceTracer.TraceError <string>(0L, "TransportService failed to flush Kerberos ticket cache on Initialize because {0}", text);
TransportService.logger.LogEvent(TransportEventLogConstants.Tuple_FailedToFlushTicketCacheOnInitialize, null, new object[]
{
text
});
ExWatson.SendGenericWatsonReport("E12", ExWatson.ApplicationVersion.ToString(), ExWatson.AppName, "15.00.1497.010", Assembly.GetExecutingAssembly().GetName().Name, ex.GetType().Name, ex.StackTrace, ex.GetHashCode().ToString(), ex.TargetSite.Name, text);
return(false);
}
return(base.Initialize());
}
// Token: 0x06000110 RID: 272 RVA: 0x00008194 File Offset: 0x00006394
public static void Main(string[] args)
{
int num = Privileges.RemoveAllExcept(new string[]
{
"SeAuditPrivilege",
"SeChangeNotifyPrivilege",
"SeCreateGlobalPrivilege"
});
if (num != 0)
{
Environment.Exit(num);
}
if (!Debugger.IsAttached)
{
ExWatson.Register();
}
LogSearchService.runningAsService = !Environment.UserInteractive;
bool flag = false;
bool flag2 = false;
foreach (string text in args)
{
if (text.StartsWith("-?", StringComparison.Ordinal))
{
LogSearchService.Usage();
Environment.Exit(0);
}
else if (text.StartsWith("-console"))
{
flag = true;
}
else if (text.StartsWith("-wait"))
{
flag2 = true;
}
}
Globals.InitializeMultiPerfCounterInstance("LogSearchSvc");
ADSession.DisableAdminTopologyMode();
if (!LogSearchService.runningAsService)
{
if (!flag)
{
LogSearchService.Usage();
Environment.Exit(0);
}
Console.WriteLine("Starting {0}, running in console mode.", Assembly.GetExecutingAssembly().GetName().Name);
if (flag2)
{
Console.WriteLine("Press ENTER to continue.");
Console.ReadLine();
}
}
SettingOverrideSync.Instance.Start(true);
if (!VariantConfiguration.GetSnapshot(MachineSettingsContext.Local, null, null).Transport.ADExceptionHandling.Enabled)
{
LogSearchService.logSearchService = new LogSearchService(!LogSearchService.runningAsService);
}
else
{
ADOperationResult adoperationResult = ADNotificationAdapter.TryRunADOperation(delegate()
{
LogSearchService.logSearchService = new LogSearchService(!LogSearchService.runningAsService);
}, 0);
if (!adoperationResult.Succeeded)
{
ExTraceGlobals.ServiceTracer.TraceError <Exception>(0L, "Create Log Search Service failed: {0}", adoperationResult.Exception);
Environment.Exit(1);
}
}
try
{
Kerberos.FlushTicketCache();
}
catch (Win32Exception arg)
{
ExTraceGlobals.ServiceTracer.TraceDebug <Win32Exception>(0L, "MsExchangeLogSearch caught a Win32Exception when flushing the Kerberos Ticket Cache at startup: {0}", arg);
}
if (!LogSearchService.runningAsService)
{
LogSearchService.logSearchService.OnStartInternal(args);
bool flag3 = false;
while (!flag3)
{
Console.WriteLine("Enter 'q' to shutdown.");
string text2 = Console.ReadLine();
if (string.IsNullOrEmpty(text2))
{
break;
}
switch (text2[0])
{
case 'q':
flag3 = true;
break;
case 's':
LogSearchService.logSearchService.sessionManager.ShowSessions();
break;
}
}
Console.WriteLine("Shutting down ...");
LogSearchService.logSearchService.OnStopInternal();
Console.WriteLine("Done.");
return;
}
ServiceBase.Run(LogSearchService.logSearchService);
}
internal void ExecuteApplicationStart(object sender, EventArgs e)
{
ExTraceGlobals.CoreCallTracer.TraceDebug(0L, "Global.Application_Start");
try
{
if (OwaApplicationBase.IsRunningDfpowa)
{
string localPath = new Uri(Assembly.GetExecutingAssembly().CodeBase).LocalPath;
DirectoryInfo[] directories = Directory.GetParent(Directory.GetParent(localPath).FullName).GetDirectories("Config");
if (directories.Length > 0)
{
VariantConfiguration.Initialize(directories[0].FullName);
}
}
Globals.Initialize(this.OwaVDirType);
Kerberos.FlushTicketCache();
SmallIconManager.Initialize();
ThemeManager.Initialize();
FormsRegistryManager.Initialize(HttpRuntime.AppDomainAppPath);
ADCustomPropertyParser.Initialize(HttpRuntime.AppDomainAppPath);
PerformanceCounterManager.InitializePerformanceCounters();
ProxyEventHandler.Initialize();
ExRpcModule.Bind();
UIExtensionManager.Initialize();
HelpProvider.Initialize(HelpProvider.HelpAppName.Owa);
this.ExecuteApplicationSpecificStart();
}
catch (OwaSmallIconManagerInitializationException initializationError)
{
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization failed");
Globals.InitializationError = initializationError;
return;
}
catch (OwaThemeManagerInitializationException initializationError2)
{
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization failed");
Globals.InitializationError = initializationError2;
return;
}
catch (OwaFormsRegistryInitializationException initializationError3)
{
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization failed");
Globals.InitializationError = initializationError3;
return;
}
catch (OwaInvalidConfigurationException ex)
{
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization failed because of a problem with configuration: " + ex.Message);
Globals.InitializationError = ex;
return;
}
catch (OwaWin32Exception ex2)
{
ExTraceGlobals.CoreTracer.TraceDebug <int>(0L, "Application initialization failed with a win32 error: {0}", ex2.LastError);
Globals.InitializationError = ex2;
return;
}
catch (Exception initializationError4)
{
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization failed");
Globals.InitializationError = initializationError4;
throw;
}
Globals.IsInitialized = true;
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization succeeded");
if (Globals.IsPreCheckinApp)
{
OwaDiagnostics.Logger.LogEvent(ClientsEventLogConstants.Tuple_DfpOwaStartedSuccessfully, string.Empty, new object[0]);
return;
}
OwaDiagnostics.Logger.LogEvent(ClientsEventLogConstants.Tuple_OwaStartedSuccessfully, string.Empty, new object[0]);
}
// Token: 0x06000356 RID: 854 RVA: 0x0000D224 File Offset: 0x0000B424
internal void ExecuteApplicationStart(object sender, EventArgs e)
{
ExTraceGlobals.CoreCallTracer.TraceDebug(0L, "Global.Application_Start");
try
{
int num = Privileges.RemoveAllExcept(new string[]
{
"SeAuditPrivilege",
"SeChangeNotifyPrivilege",
"SeCreateGlobalPrivilege",
"SeImpersonatePrivilege",
"SeIncreaseQuotaPrivilege",
"SeAssignPrimaryTokenPrivilege"
}, "MSExchangeOWAAppPool");
if (num != 0)
{
throw new OwaWin32Exception(num, "Failed to remove unnecessary privileges");
}
if (BaseApplication.IsRunningDfpowa)
{
string localPath = new Uri(Assembly.GetExecutingAssembly().CodeBase).LocalPath;
DirectoryInfo[] directories = Directory.GetParent(Directory.GetParent(localPath).FullName).GetDirectories("Config");
if (directories.Length > 0)
{
VariantConfiguration.Initialize(directories[0].FullName);
}
}
string applicationName = this.IsPreCheckinApp ? "PCDFOWA" : "OWA";
Globals.InitializeMultiPerfCounterInstance(applicationName);
Globals.Initialize();
Kerberos.FlushTicketCache();
ExRpcModule.Bind();
this.ExecuteApplicationSpecificStart();
}
catch (OwaWin32Exception ex)
{
ExTraceGlobals.CoreTracer.TraceDebug <int>(0L, "Application initialization failed with a win32 error: {0}", ex.LastError);
Globals.InitializationError = ex;
return;
}
catch (Exception initializationError)
{
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization failed");
Globals.InitializationError = initializationError;
throw;
}
Globals.IsInitialized = true;
ExTraceGlobals.CoreTracer.TraceDebug(0L, "Application initialization succeeded");
int id = Process.GetCurrentProcess().Id;
if (Globals.IsPreCheckinApp)
{
OwaDiagnostics.Logger.LogEvent(ClientsEventLogConstants.Tuple_DfpOwaStartedSuccessfully, string.Empty, new object[]
{
id
});
return;
}
OwaDiagnostics.Logger.LogEvent(ClientsEventLogConstants.Tuple_OwaStartedSuccessfully, string.Empty, new object[]
{
id
});
OwaDiagnostics.PublishMonitoringEventNotification(ExchangeComponent.Owa.Name, "OwaWebAppStarted", "Outlook Web App started successfully", ResultSeverityLevel.Error);
}
