private void ReadCommonHeader(NdrBinaryReader pacStream) { Version = pacStream.Read(1)[0]; if (Version != NdrConstants.PROTOCOL_VERSION) { throw new InvalidDataException($"Unknown Protocol version {Version}"); } var headerBits = pacStream.Read(1)[0]; var endian = headerBits >> 4 & 0x0F; if (endian != 0 && endian != 1) { throw new InvalidDataException($"Unknown endianness {endian}"); } Endian = Convert.ToBoolean(endian); Encoding = (byte)(headerBits & 0x0F); if (Encoding != 0 && Encoding != 1) { throw new InvalidDataException($"Unknown encoding {Encoding}"); } Length = pacStream.ReadShort(); if (Length != NdrConstants.COMMON_HEADER_BYTES) { throw new InvalidDataException($"Unknown common header length {Length}"); } }
public PacSignature(byte[] infoBuffer, ref byte[] signatureData) { var pacStream = new NdrBinaryReader(infoBuffer); Type = (ChecksumType)pacStream.ReadUnsignedInt(); SignaturePosition = (int)pacStream.Position; switch (Type) { case ChecksumType.KERB_CHECKSUM_HMAC_MD5: Signature = pacStream.Read(16); Validator = new HmacMd5PacValidator(Signature, ref signatureData); break; case ChecksumType.HMAC_SHA1_96_AES128: Signature = pacStream.Read(12); Validator = new HmacAes128PacValidator(Signature, ref signatureData); break; case ChecksumType.HMAC_SHA1_96_AES256: Signature = pacStream.Read(12); Validator = new HmacAes256PacValidator(Signature, ref signatureData); break; } if (pacStream.Position < pacStream.Length) { RODCIdentifier = pacStream.ReadShort(); } }
public ClaimEntry(NdrBinaryReader pacStream) { pacStream.Seek(4); Type = (ClaimType)pacStream.ReadShort(); pacStream.Align(4); Count = pacStream.ReadUnsignedInt(); pacStream.Seek(4); }
public ClaimsSet(byte[] claims) { var pacStream = new NdrBinaryReader(claims); Header = new RpcHeader(pacStream); Count = pacStream.ReadInt(); pacStream.Seek(4); ReservedType = pacStream.ReadShort(); ReservedFieldSize = pacStream.ReadInt(); ReservedField = pacStream.Read(ReservedFieldSize); pacStream.Align(8); ClaimsArray = ReadClaimsArray(pacStream); }
public PacLogonInfo(byte[] node) { var pacStream = new NdrBinaryReader(node); Header = new RpcHeader(pacStream); LogonTime = pacStream.ReadFiletime(); LogoffTime = pacStream.ReadFiletime(); KickOffTime = pacStream.ReadFiletime(); PwdLastChangeTime = pacStream.ReadFiletime(); PwdCanChangeTime = pacStream.ReadFiletime(); PwdMustChangeTime = pacStream.ReadFiletime(); var userName = pacStream.ReadRPCUnicodeString(); var userDisplayName = pacStream.ReadRPCUnicodeString(); var logonScript = pacStream.ReadRPCUnicodeString(); var profilePath = pacStream.ReadRPCUnicodeString(); var homeDirectory = pacStream.ReadRPCUnicodeString(); var homeDrive = pacStream.ReadRPCUnicodeString(); LogonCount = pacStream.ReadShort(); BadPasswordCount = pacStream.ReadShort(); var userSid = pacStream.ReadRid(); var groupSid = pacStream.ReadRid(); // Groups information var groupCount = pacStream.ReadInt(); var groupPointer = pacStream.ReadInt(); UserFlags = (UserFlags)pacStream.ReadInt(); // sessionKey pacStream.Read(new byte[16]); var serverNameString = pacStream.ReadRPCUnicodeString(); var domainNameString = pacStream.ReadRPCUnicodeString(); var domainIdPointer = pacStream.ReadInt(); // reserved1 pacStream.Read(new byte[8]); UserAccountControl = (UserAccountControlFlags)pacStream.ReadInt(); SubAuthStatus = pacStream.ReadInt(); LastSuccessfulILogon = pacStream.ReadFiletime(); LastFailedILogon = pacStream.ReadFiletime(); FailedILogonCount = pacStream.ReadInt(); // reserved3 pacStream.ReadInt(); // Extra SIDs information var extraSidCount = pacStream.ReadInt(); var extraSidPointer = pacStream.ReadInt(); var resourceDomainIdPointer = pacStream.ReadInt(); var resourceGroupCount = pacStream.ReadInt(); var resourceGroupPointer = pacStream.ReadInt(); UserName = userName.ReadString(pacStream); UserDisplayName = userDisplayName.ReadString(pacStream); LogonScript = logonScript.ReadString(pacStream); ProfilePath = profilePath.ReadString(pacStream); HomeDirectory = homeDirectory.ReadString(pacStream); HomeDrive = homeDrive.ReadString(pacStream); // Groups data var groupSids = ParseAttributes(pacStream, groupCount, groupPointer); // Server related strings ServerName = serverNameString.ReadString(pacStream); DomainName = domainNameString.ReadString(pacStream); if (domainIdPointer != 0) { DomainSid = pacStream.ReadSid(); } UserSid = userSid.AppendTo(DomainSid); GroupSid = groupSid.AppendTo(DomainSid); GroupSids = groupSids.Select(g => g.AppendTo(DomainSid)).ToList(); if (UserFlags.HasFlag(UserFlags.LOGON_EXTRA_SIDS)) { ExtraSids = ParseExtraSids(pacStream, extraSidCount, extraSidPointer).Select(e => e.AppendTo(DomainSid)).ToList(); } if (resourceDomainIdPointer != 0) { ResourceDomainSid = pacStream.ReadSid(); } if (UserFlags.HasFlag(UserFlags.LOGON_RESOURCE_GROUPS)) { ResourceGroups = ParseAttributes( pacStream, resourceGroupCount, resourceGroupPointer ).Select(g => g.AppendTo(DomainSid)).ToList(); } }